.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/ t- n  h/ f9 X- k# }0 s$ e4 g; V/**
$ Z# y$ @) |  u, z. u) {2 f * uploadFlash.php
* Flash文件上传.
*/
, m* x: W8 C3 A7 z/ C* G0 @# O8 M5 u6 [require_once('../global.inc.php');

) S, E+ |0 A" ^. @//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
4 g, b0 v/ v# A( T# b2 c
, ^( D. W* K1 g) oif($operateId == 1){
: \: c) z: [. p, b $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

# W9 w2 M  J& } $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
( A* M3 N8 I0 r& R& b! O
if(!in_array($nameExt, $allowedType)){
3 ~2 {; a2 x& t8 Y/ b& B$ h' ~5 k  $msg = 0;
}
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
* L, y6 _5 C& G, n  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
( I" V/ Z6 f4 ~2 z   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
9 T" n" h; ?! B* ]  }
  
- R- p* w; J% N) S' `. j  if (file_exists($filename)){
8 s) g7 v1 O7 J. {, O& ]- b! \   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
+ n) O) J  V- p- ~. H   $msg = 0;
  }
}
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
# Z; T- L6 k, Z, _ exit;
}else if($operateId == 2){
. K2 |  H( j3 F! ~% q $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
: `$ F% s+ p1 H/ i) Z  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
0 i6 b! `3 y. F: K1 `" ~ }else{
  echo "&fileUrl=0";
  exit;
}
}
, w: H# _! n, f3 U- u
function getmicrotime(){
( k3 X6 j$ Q% Q- A# i. M1 y1 E    list($usec, $sec) = explode(" ",microtime());
! }, F8 s, r5 ~    return ((float)$usec + (float)$sec);
}
2 s. a( {, ]( r) F8 K) g1 f
?>