.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
! L* g- \2 E0 T2 N& ~" F. S/**
* uploadFlash.php
: g, Q8 T# _' [# Q+ x) Q/ S9 C# Q * Flash文件上传.
*/
' L: R) g# X9 t6 @require_once('../global.inc.php');
; a4 S: k) P  }, S
# F# M, k$ W& u( `9 R! y" x8 _//operateId=1 上传,operateId=2 获取地址.
' A& S9 b  v' @$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

& [7 c  t6 p7 O& rif($operateId == 1){
$date = date("Ymd");
4 I' N5 X* o4 H: m" e+ g4 { $dest = $CONFIG->basePath."data/files/".$date."/";
# ^% `, V: W5 t $COMMON->createDir($dest);
. h9 Y: E  D7 b  M; K9 _* N //if (!is_dir($dest)) mkdir($dest, 0777);
. a" M& h6 _* `0 z
% u" z- {+ W+ G* ]! g $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
  $msg = 0;
8 }! u- C$ a# ]! c2 } }
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
5 L! @+ U- ?2 L, I( J  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
3 S( P" z( I- W  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
2 ~; {( \/ `% u   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
( l8 Q% M6 ~! K1 d4 k& I  }
6 q. ~* J( y  I' o  
& m8 p" j' G  _, j! b  if (file_exists($filename)){
' P7 f) h) a4 V$ x# S. E, Q   //$msg = 1;
   $msg = $file_url;
8 z2 @3 U* ?0 @9 K3 [$ c( n   @chmod($filename, 0444);
  }else{
   $msg = 0;
  }
: B, i5 t; e# g  A: R- w$ ^& d }
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
+ k9 h8 O- q/ j  V1 M4 L $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
8 `" Q' R8 y* X) J5 [- t2 C# |; j1 m  session_unregister("eoutmsg");
; h$ P7 [# ?7 T2 {  echo '&'.$outMsg;
' {, z, u9 L9 }: ?  exit;
$ e* l7 o, h7 O! }. p+ V }else{
6 c5 ^1 Q4 @+ h; o! Q1 @  echo "&fileUrl=0";
  exit;
& Z1 Z8 v% Y# s }
}
* z: U' E% |! [6 H  O
function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
" f  @' G7 F$ r0 |' [2 a) s& t. x    return ((float)$usec + (float)$sec);
}

+ F" r" N( g5 K0 ~3 O$ x% D7 f?>