.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
* Flash文件上传.
# F) m, Z, U! ~7 A- m! f */
require_once('../global.inc.php');

6 D7 c+ |2 t8 k. O//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
* P9 u; _# i7 Z$ t0 `8 N4 {if(empty($operateId)) exit;

if($operateId == 1){
1 ], d9 U+ s4 h+ z" _ $date = date("Ymd");
1 }/ _( h- b; [& F+ s* `; x $dest = $CONFIG->basePath."data/files/".$date."/";
+ j. v8 E1 W7 ?" v  F# J $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
" {5 D+ V5 ?5 k5 q: ?' O( Z
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
1 K( R" k$ z6 [, J- P% w% u, m4 d+ Z if(empty($msg)){
: A/ g9 K! u1 z# R5 B: U  $filename = getmicrotime().'.'.$nameExt;
4 a* o5 \3 Q3 H9 [; h* d  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
" F: F3 C3 T  P# G* Z  $filename = $dest.$filename;
! b7 v9 l; S4 d) }2 l+ s  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
# z% p* c1 H# ^2 P1 ^  
  if (file_exists($filename)){
6 y( O$ ~- d4 Z8 p. K$ F9 i; s  \+ R   //$msg = 1;
6 ^& u0 Q0 Q. K* G* S   $msg = $file_url;
7 j- }6 c( ^# J. S5 g- J  g/ s   @chmod($filename, 0444);
, @! O& Z  G( D0 C  }else{
   $msg = 0;
( u0 Z. x% i$ u  }
; k; R; e# [" d. y2 I }
$outMsg = "fileUrl=".$msg;
- H$ L2 q& f' U! Q& r6 K2 x. O $_SESSION["eoutmsg"] = $outMsg;
exit;
8 U8 v% `6 `4 b! B9 k}else if($operateId == 2){
/ c' @4 h. I! B( _3 C& u $outMsg = $_SESSION["eoutmsg"];
/ ~- w0 K; L! G5 ~ if(!empty($outMsg)){
  session_unregister("eoutmsg");
0 F5 [$ a& a6 N  echo '&'.$outMsg;
+ z7 f) A# U$ `4 E  J/ s! k+ \  exit;
6 H- P9 T' c& c }else{
% l3 g- L; O3 ]  echo "&fileUrl=0";
  exit;
}
; U1 N% v4 C8 j  ]6 K7 S, j( t0 ]5 H}
. Y. Z% J9 Y! G8 v
function getmicrotime(){
7 v; p9 l' O6 v8 O8 N    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
' Z1 e' d# c; U2 h: o9 k4 W) K8 x}

?>