.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
& R  M6 e) O1 M  F/**
9 l7 ?; Y9 A" d6 M8 y* Q0 w * uploadFlash.php
* Flash文件上传.
*/
6 Y% K2 \+ I/ K3 T/ C/ c. w0 hrequire_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
2 X3 S  C8 j+ X0 fif(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
% f( W7 e9 o: c5 n9 L: d1 |2 b $dest = $CONFIG->basePath."data/files/".$date."/";
4 T( I" y# L$ G+ ]2 m4 X5 |# p $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

" h3 `9 _1 v. t' d $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
  $msg = 0;
7 i0 v, Y. J1 }* z% ? }
9 p3 m$ O( I4 p7 E* ~8 I9 y4 s if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
- Y. p; f7 l+ _, A7 t1 y( y& o  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
/ a- ]- J* Z8 v5 _/ ~  
  $filename = $dest.$filename;
- Q- v2 z- w1 J, a% Z  if(empty($_FILES['Filedata']['error'])){
! G# i0 o% D8 d: X4 G   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
$ F$ Q  Y6 L" z1 A  }
/ Q8 f: y+ b$ H/ }9 g. ~. e- w+ N  
" X/ W2 r$ D4 `$ s0 y1 V% m/ ~8 d  if (file_exists($filename)){
7 o8 m7 A$ I4 Q1 t5 }2 t   //$msg = 1;
: V. J$ q0 `+ U3 Y/ l* s0 K" d8 C2 i) y; b   $msg = $file_url;
" A9 `/ B4 |* ]+ G# s   @chmod($filename, 0444);
  }else{
1 p  C) ?4 @  f5 s   $msg = 0;
5 A1 r/ |. u4 x% p/ }  }
2 }! v7 F. M5 |, F% Y" { }
6 R3 _, I8 z' u) y$ S- W% J, A& I: e& x $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
/ X) |. ^; `8 l& _2 `7 k0 o2 |+ F $outMsg = $_SESSION["eoutmsg"];
3 P1 [+ y$ s, H2 ]; j# f if(!empty($outMsg)){
' f* K! Y7 K- q0 @- G  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
0 F/ R4 A! {; r- m }else{
  echo "&fileUrl=0";
4 c$ g4 d" W4 o% U4 j; f1 m; x4 i3 ]  exit;
. ~" c: J: ?/ x. h  I }
$ B& |: q8 Z6 {* }$ `  F}

function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
+ w/ [; Z3 U4 E2 k    return ((float)$usec + (float)$sec);
8 k9 U$ f& N1 Q4 q% \% @2 g}

?>
( x) v- s" J7 L