.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
0 P0 B" G  d/ S) R1 W1 P/**
3 \- j2 t& z7 I * uploadFlash.php
* Flash文件上传.
2 g! n7 j4 Z( ?0 ~2 d1 C2 [( Z */
( \% I9 c1 P! |1 `& U  Rrequire_once('../global.inc.php');

( i5 q9 P& }# Z: }# f. P* W  ]//operateId=1 上传,operateId=2 获取地址.
( }) L7 ~) m! J3 A- z0 d# B$operateId = intval($_REQUEST['operateId']);
0 a2 |" g  t( J* X- K% Pif(empty($operateId)) exit;
' }7 n: l+ _5 d) c7 C( l
if($operateId == 1){
/ b- \9 Z* D4 V$ \; W- l $date = date("Ymd");
2 @% l' f. \' M3 }- T $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
3 r. k& n, Z8 D! q
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
) ~7 F3 w) t, ]; V( d
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

+ s/ T' Y- C4 h! n! V if(!in_array($nameExt, $allowedType)){
& N8 A/ k1 J. O7 R; c  $msg = 0;
# k) s7 D/ h, T }
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
: h2 }* M/ W+ [- Q6 y) l# v  
  $filename = $dest.$filename;
7 R3 ]! W5 R) g* n2 E  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
7 x/ x$ ~: |# X6 u5 _  w$ }  
  if (file_exists($filename)){
1 N9 U+ ]+ l2 v- p) `2 F9 W5 R   //$msg = 1;
8 y  i4 F5 |) ^! K   $msg = $file_url;
# ~# o" m+ x5 U  l$ }5 \   @chmod($filename, 0444);
  }else{
2 n/ ]: H" [9 v8 ?1 i# @   $msg = 0;
; T+ a( M4 N4 S% o  }
" |' M/ j( A$ s" p, }. ? }
$outMsg = "fileUrl=".$msg;
7 C6 U; O+ a; D7 B( b $_SESSION["eoutmsg"] = $outMsg;
  ~! d/ g* ~8 s$ d exit;
& h5 a0 n5 {8 h( |7 r6 J! K9 @}else if($operateId == 2){
5 {  w, o/ }6 Y5 j. Q% k $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  session_unregister("eoutmsg");
' a* K1 q7 k6 z2 x  echo '&'.$outMsg;
2 R% V/ T% R! G  exit;
2 r0 q. i3 @4 z) } }else{
  echo "&fileUrl=0";
  k2 f7 `0 l: c; c1 M  exit;
}
}

function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}

?>