.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
" n! p$ a$ a4 [0 W( z4 k$ B+ n/**
* uploadFlash.php
* Flash文件上传.
*/
require_once('../global.inc.php');
/ C( _) O& T$ ~$ _0 D, F) X' v4 L0 N
//operateId=1 上传,operateId=2 获取地址.
/ }1 P: r4 W) ]" N$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
# ^) g; |3 W2 |& B
9 {% \  E! g1 ~0 i+ L. x  Rif($operateId == 1){
% h0 j4 |$ S* d0 y, ~* H5 Q; o $date = date("Ymd");
+ m0 k8 s; |6 p- P, I, F( ~ $dest = $CONFIG->basePath."data/files/".$date."/";
7 X. i8 E) F! K& k $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
; m! U7 v; Z, C4 u$ v
5 t8 E7 H3 C: ` $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
. f% M: @# _" E* }  $msg = 0;
% U: n; D1 b. }  a( L& ?0 c8 I" C }
if(empty($msg)){
& ]0 j9 ]/ v' A  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
- g7 a9 o. J  X2 G/ Z2 w7 n! c  }
  
1 l3 f+ a; c3 H" T( b' j  if (file_exists($filename)){
3 S# b5 @; R0 x  `* T4 d: J2 a   //$msg = 1;
5 S2 {, v1 g5 E" ]  P   $msg = $file_url;
   @chmod($filename, 0444);
1 i# o& d- d; r$ d  }else{
   $msg = 0;
  }
}
$outMsg = "fileUrl=".$msg;
: _& y$ x% o! K0 c: o  e$ k $_SESSION["eoutmsg"] = $outMsg;
2 V$ }! C% D/ b& G$ q+ Z exit;
/ v, ?& e% k) i2 c- P% X}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
' ~( X  c4 L! L5 v: [, m  exit;
}else{
/ J( B& ]1 H5 }  echo "&fileUrl=0";
: R( j1 x7 A$ x; C8 j  exit;
' e2 Z2 P1 m9 j3 X9 L }
}
7 a, B! K3 m# F, m2 a
function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
, g0 Z2 r) X+ y3 i  `3 a) V5 @    return ((float)$usec + (float)$sec);
" f, q, K0 e; q}

?>