.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
. T! _7 j5 |% e& L& s2 W& r/**
4 k/ T& I& \# ]+ S * uploadFlash.php
- n5 m! M8 H+ E; [, f- c * Flash文件上传.
*/
require_once('../global.inc.php');

( e+ v' r5 p1 L- @: c$ }; P5 w* ^//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
# f  r7 l0 E9 b: a
: K" I% u" Q. n# F3 oif($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
- e! }: ~+ V; C+ g1 f2 l $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
3 V4 C, E+ L  f# l* d  T
1 v  K1 u6 k8 y5 y- M- m $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
$ T, J: C: W- v' o* T4 w. B
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

: ]: U4 F3 A8 F+ P( ]* V2 v5 h if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
, b& {2 G9 y# {* N if(empty($msg)){
6 t5 @  d  @3 d  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
! W4 X1 F) C. u- C3 K1 h; w8 K/ U/ e  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
, V: H0 B7 k( S- w( @% v   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
) I3 g$ s& P9 O) o  }
- `# u- P$ E5 F  
2 F2 d) H6 l. Z7 s" m* y  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
   $msg = 0;
  }
* s- V3 D  r! A  H }
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
: z& ?5 u8 M( j; S& e}else if($operateId == 2){
+ N1 ]5 ^' w. x1 ]" h7 q0 L $outMsg = $_SESSION["eoutmsg"];
' r; e1 q. t2 g2 m$ V6 p1 `2 ~+ U if(!empty($outMsg)){
/ Z* N' c% l) G* U5 G7 J; U  m  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
3 t3 n2 O, {: ?) ~, X }else{
  echo "&fileUrl=0";
  exit;
}
}

* ]* o0 {1 }6 g4 h6 @  Q5 Qfunction getmicrotime(){
% U. o9 G8 Y9 g8 J3 I; y* ~    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
0 @! l- }# e+ f7 u2 ~  b}

- S" W  {- f* m( K* J! ?  [) o?>