.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
2 O- v) x* {% g2 D# k/**
* uploadFlash.php
* Flash文件上传.
*/
; \- h4 I- W+ Z% ~; C- n$ ]require_once('../global.inc.php');
5 T6 h8 a9 J6 I
# V5 p' f/ x( T1 f" T* f3 c//operateId=1 上传,operateId=2 获取地址.
# ], i* A% b  ^# d' z* V/ P2 h$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

; O& x* ]9 X9 k. H0 Bif($operateId == 1){
$date = date("Ymd");
% h; M2 S5 Z: r $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
1 C& h  s) r) x' @' _2 r+ H
# ]8 x* u9 U5 o# G: Q4 O: K! f $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
- D6 c. B$ v* C# A- Q6 s
  b7 h  s+ T+ n$ E4 m+ s. }5 ] $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
$ J5 W; y) K( y7 x9 V/ o+ N1 {& @7 K
if(!in_array($nameExt, $allowedType)){
  $msg = 0;
# M8 R6 G# x, J3 e }
% W: S. M8 }6 N, F0 B if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
( b7 y) h# E1 y8 X0 L& M7 Q  e  
8 G1 y: |( F3 y& Z  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
, C7 @& [+ ^0 x  O! c1 n0 V. A   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
9 g  g0 K7 I8 a9 }( W  }
  
  if (file_exists($filename)){
- q0 U. f$ R* }0 C: h   //$msg = 1;
   $msg = $file_url;
; A: l$ w( g- B7 c0 e% F# |5 ?   @chmod($filename, 0444);
* G, n$ p* ?) R1 D/ {7 r8 s  }else{
0 Q8 t- m- x- I% C% f% o5 O   $msg = 0;
( I6 p1 s: `# O, M3 u  }
) ~& A) Q4 T; A* Y0 W3 y }
6 d: D9 @* S7 G $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
, g/ K! J3 v) s7 B2 ] exit;
}else if($operateId == 2){
" \/ k$ w& e8 L- t9 t& u" N: a $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  session_unregister("eoutmsg");
6 e. o; v# J" w; h3 W# a  \( v  echo '&'.$outMsg;
) ~. C/ b2 e" f; K0 ~, U3 Q  exit;
* u8 b  j( u. i" r. p0 m3 Q: Z }else{
  echo "&fileUrl=0";
  exit;
}
}
$ a; a- t) N& j
function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
/ |% j" `+ p( l; U3 K$ r- I}

?>