.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
" G% d0 P1 N3 r( u( P7 D * uploadFlash.php
* e9 g7 j$ W& ]4 M- v' u4 u * Flash文件上传.
* j4 [2 X8 m8 E6 n  A */
' ?. E! l8 R  q+ O% O/ U. W1 k/ Brequire_once('../global.inc.php');

' C8 e  K8 {5 |' S  W7 K6 {9 e//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

8 C6 b% Y+ [  E, L* lif($operateId == 1){
5 N9 R1 T7 J5 Y  s9 D$ V8 d8 l  O $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
" ~2 O: j3 C2 n( q- e3 q: t $COMMON->createDir($dest);
5 T" S+ q' t7 a //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
5 \- O9 A) h9 X- V6 p2 L
" M5 y( R+ _0 U8 G2 z1 O $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

( T7 |! A4 O1 L, Y6 B/ I if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
if(empty($msg)){
0 g& _1 m- _' c4 G' T, @  j: a  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
9 {# _! L% A# o+ Z! P  E$ [8 i8 P" ?  }
  
$ |( ^+ C( ]7 H, I  if (file_exists($filename)){
% t$ |% B8 [/ h) K: i1 Q9 m   //$msg = 1;
& y; O( U/ j2 h9 L. J: `. ]   $msg = $file_url;
   @chmod($filename, 0444);
" D, l. `5 w. c2 J  }else{
   $msg = 0;
' q4 ]% j* s; C' R  }
}
- p* C8 J9 q, ^2 B $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
; q. S% l" I! c; L- h/ f $outMsg = $_SESSION["eoutmsg"];
2 s  `. M' u* k% ~1 p if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
( O  t2 E8 a4 i  exit;
}else{
$ L) o9 ]4 k7 ?  echo "&fileUrl=0";
. m2 |6 K; N* @  exit;
/ w7 d7 h% X: P9 o$ y1 C" r+ e4 j# ` }
}

- s2 ~) B. p! A) m1 [) {' t% c6 ffunction getmicrotime(){
' {, ?3 L8 W0 D+ @$ c: {; p  u9 _    list($usec, $sec) = explode(" ",microtime());
2 ~+ q" F1 P4 Y, h5 Q5 c    return ((float)$usec + (float)$sec);
5 Q9 ]) V% Y8 R4 D}

) @) K2 k0 p) E9 s) h3 i* I?>
. Q* \0 Y% _# {6 U; K! w8 `