.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
3 Z  Q2 }% a) M9 N5 J( x+ j * uploadFlash.php
* Flash文件上传.
. P4 z4 B/ e. h/ H% D, K( @) \ */
require_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
7 g+ @& w+ Z% ~( m1 gif(empty($operateId)) exit;
2 |' V  \7 c# j3 n+ J. y$ ^# S2 y
if($operateId == 1){
8 p4 K/ s0 X; F2 L0 ? $date = date("Ymd");
' k) y, F: n8 G' n- i' Y $dest = $CONFIG->basePath."data/files/".$date."/";
0 ?: t) T2 f- p $COMMON->createDir($dest);
; \1 i5 X6 q8 x$ Z/ N //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
# L& r+ h9 Y- z1 p! q  b. m& c/ F! ?
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
, ?5 b/ F$ Q% R, F
. V9 a( z2 l( @: J. k/ b if(!in_array($nameExt, $allowedType)){
6 P4 {9 a+ H/ }2 N2 R  $msg = 0;
6 z7 R; c; m5 H# [: Y  ]6 s }
# V- ~6 O& b5 {+ l if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
4 n" r' U) B4 |! L6 \! x6 `  
  $filename = $dest.$filename;
7 b4 p3 [' R0 k3 b& B* R0 a3 B! ~  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
  
: |8 Y5 q7 K) a  if (file_exists($filename)){
   //$msg = 1;
# O3 L& V- p/ d! D, ?  \7 y6 t0 c7 `/ V   $msg = $file_url;
   @chmod($filename, 0444);
0 U5 Z8 T" x1 Y3 c) D, e* W  }else{
! Y- l) r1 u0 Z   $msg = 0;
$ e& j; i  Q" K9 v5 m5 H: V  }
}
, }7 N* ^, r4 x7 e8 z  O $outMsg = "fileUrl=".$msg;
' j" f5 v/ x, j, Y $_SESSION["eoutmsg"] = $outMsg;
2 Q( |1 G  u/ K0 R exit;
}else if($operateId == 2){
5 A: o3 |& X: I' q' o $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
- b; A4 |" b7 t4 n& p  session_unregister("eoutmsg");
& s' S8 h% I: N  echo '&'.$outMsg;
0 _2 o$ o5 C# R" F8 I  exit;
/ q$ o+ J$ f+ o5 m5 s8 ~! c& G }else{
  echo "&fileUrl=0";
+ Z) M( K- m$ }: a- G  exit;
5 X/ o' G$ t9 L1 S }
! A$ s& r/ e# F. J" K8 _& c- k}

function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
$ J' c, `, ^# o( G" V7 O    return ((float)$usec + (float)$sec);
}
' c% h; d0 t1 X2 r5 }: G  v/ R
% [) V! a) e6 f! Q5 R- [! Z- y?>