.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
9 U$ A, m/ P$ b/**
: Y6 r$ e/ g: W1 X; d  N) _8 { * uploadFlash.php
  [; U! K6 n7 n6 K" ]) x2 D * Flash文件上传.
*/
require_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
! I& X# z) H/ m! a. S% ]2 @4 w4 T$operateId = intval($_REQUEST['operateId']);
( I1 j- p4 D$ ^# eif(empty($operateId)) exit;
: _( T  \1 o- W7 Y+ N4 W7 r8 d
if($operateId == 1){
$date = date("Ymd");
1 p& X9 t- J% q# c $dest = $CONFIG->basePath."data/files/".$date."/";
" p2 J" g& s4 w8 H $COMMON->createDir($dest);
  ^; A: q0 h* ~( p( j8 r //if (!is_dir($dest)) mkdir($dest, 0777);
1 o8 L5 w2 g7 W
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
$ T, k0 _/ G/ O
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
+ x! B4 z" H8 @- b* j. J: b0 J5 h& \
" A' f  I* v; m" s. V" X if(!in_array($nameExt, $allowedType)){
  $msg = 0;
1 w* B4 P8 l: E% A+ ?: e }
$ V' a! g6 V4 j4 ^5 f( T if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
7 m3 ^6 i5 B+ L' x( V  H  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
# f0 ?! g" i& G: ^1 Z8 S+ u- I   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
1 W+ O/ c# j& E2 h1 v" n% S  
  if (file_exists($filename)){
; x4 w* l& a1 x1 D   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
1 X, o9 ^, H3 K( ^* m# u  }else{
4 @+ L& }4 m: I* J* R( [7 J8 f   $msg = 0;
  }
}
$outMsg = "fileUrl=".$msg;
$ O1 w5 Q1 W; D5 G' a7 W/ W$ ?2 x $_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
' e& G/ m: h9 J! J- T% } if(!empty($outMsg)){
3 \3 p! d. h  F; r+ I  session_unregister("eoutmsg");
6 J6 C) Y# p; ~* {! U. m  echo '&'.$outMsg;
  exit;
}else{
0 T9 F6 W8 G) r/ L1 C5 O  echo "&fileUrl=0";
; p4 E! u7 T( b+ R9 v  exit;
}
  `3 @: ?7 E  l* x}
) l- r: N" f, m. O5 d: |
8 |0 I9 q4 }3 @function getmicrotime(){
( R" `! M; @! ~    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}

1 r* c: b) S7 p" \5 v5 Q8 ?1 Y?>