.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
6 x9 o! P- p8 t$ d * uploadFlash.php
* Flash文件上传.
*/
) Y1 R7 o% [6 I8 T9 xrequire_once('../global.inc.php');

# p% Z0 `, K5 `//operateId=1 上传,operateId=2 获取地址.
, z6 Y7 v0 z7 {- F3 ^% i' T$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
3 P$ D2 v$ K# m0 t1 l' c+ r# j; k- M $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
  i. F: O, R2 v2 Z //if (!is_dir($dest)) mkdir($dest, 0777);
  i  x/ i+ D' O3 x* @
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
/ l( t" c+ o5 _
if(!in_array($nameExt, $allowedType)){
+ W! Y) v! W- t/ m, ]( `4 b  $msg = 0;
5 p, y) V' D+ H* _! Z* T }
# _( m/ h) P' R/ s% }) S( r* B. v if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
- J6 k) N+ ?; Y7 o7 I* F  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
; |' W, o: |. U  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
% N( S! B7 ^4 Q3 {" x3 J( C   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
) k0 Y) M3 W; t" V3 N  
  if (file_exists($filename)){
6 m2 S& [0 f: s   //$msg = 1;
0 V6 Z+ B  Q5 k. z2 b2 ~. I) h   $msg = $file_url;
7 M& L; ^3 r3 C2 B   @chmod($filename, 0444);
8 N9 N# V8 D+ H$ o  q) y  }else{
   $msg = 0;
  }
}
- H. K& _, r: M/ w; Q( G $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
" k+ j- J: \( Q9 o* C $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
0 }7 ~& _, [' i0 ?( F  Z# v  session_unregister("eoutmsg");
/ N5 i/ g. \5 S  @$ b; ?  echo '&'.$outMsg;
, O! E& S: x# E* x  exit;
}else{
3 H) O- j1 O9 _. Z. G  echo "&fileUrl=0";
  exit;
" D& `8 F+ E, T6 V2 v }
}
' e/ C5 {+ y$ X# F8 U  ~: I
: Y' e) }$ X. G7 C" @function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}

6 E' w& M! T1 f- c9 D3 o?>