.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
* Flash文件上传.
( l  G8 F, m2 E2 y */
5 R. e2 x. u* e0 U* i/ urequire_once('../global.inc.php');
# O4 K! F1 @- x3 q
//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
1 x# x; K0 l2 \. H- j
; V  M( R0 d! _; G0 d5 Kif($operateId == 1){
6 o) C# s9 m0 M $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
; ]" H: J9 ^6 F; o //if (!is_dir($dest)) mkdir($dest, 0777);

9 I) n$ @& M, |3 S# {: p. g $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

/ h5 }# a2 ~1 ?+ Z9 d, @ $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
1 P- `4 _5 x2 _* f7 @* ]9 I if(empty($msg)){
& L- ], B8 q# r; T5 U  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
4 \, \$ J! i1 b. w  
& X2 F- ~' R; n( {  $filename = $dest.$filename;
( r7 T7 N- a$ J# H5 P) t# p  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
9 ?# o! ^" U' e2 A  
$ R: ^! h: I1 S7 z  if (file_exists($filename)){
% x9 x) O' M' U% f2 \   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
% U, c- j: I; l( K( S# K  }else{
   $msg = 0;
: ?: ?* L4 [7 a) E& u  }
}
$outMsg = "fileUrl=".$msg;
  t2 D- r0 c. d0 ~8 E& j" ]) P $_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
+ w( I0 i" \$ D9 ~6 a2 [ if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
* X4 D3 D" R& n }else{
  echo "&fileUrl=0";
  exit;
}
/ y2 I9 u1 }: a, _# C! R* B* q}
& D- ?, f2 b5 h1 f
function getmicrotime(){
( k4 D( i4 t4 W: A; _    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
6 y0 C# @" q5 N4 ?$ m8 z}

?>
$ l9 f6 ~" {5 o