.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
: W  B' S. L' K& F/**
* uploadFlash.php
* Flash文件上传.
*/
8 W( n# A3 L) f4 ?% Yrequire_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
* l8 a" K+ w; u% }) P2 R) V  Zif(empty($operateId)) exit;
# e  j. j" y& Z, d. M. D$ }; ]
if($operateId == 1){
0 l0 t3 c1 F3 c5 G3 b $date = date("Ymd");
7 s+ i0 E3 G9 S6 m  L4 n $dest = $CONFIG->basePath."data/files/".$date."/";
( T2 s4 R$ v6 @) ?/ L% g) p+ h $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

8 E3 h3 ^0 F4 G5 ]# }* d $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
, E8 D4 T5 g, d. ^
if(!in_array($nameExt, $allowedType)){
: g" R2 A( A5 r; z5 e  $msg = 0;
}
if(empty($msg)){
( n6 g- W' u2 v3 G1 C( q: [  $filename = getmicrotime().'.'.$nameExt;
4 Y  G& @  k/ u" U+ G5 j# H9 a  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
; u" }' U! z( X# s- y  
  $filename = $dest.$filename;
" b7 i0 t. K3 b. G+ z  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
4 W( @% ~+ p  Q/ s; q6 }  
  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
! z6 l6 R: t3 B# I  }8 N   @chmod($filename, 0444);
  }else{
" L! X9 N1 d1 Q1 H9 j   $msg = 0;
! }, S0 U( q) d* Y+ t: _  }
6 Q* z- B: T# Q9 e }
$outMsg = "fileUrl=".$msg;
5 q$ J$ N/ E* g7 q $_SESSION["eoutmsg"] = $outMsg;
. }/ j; S& R; Z. d2 _. Y exit;
+ Y! Q8 U8 C: l}else if($operateId == 2){
$ l' A0 ]  Q8 n. s9 C) n1 o $outMsg = $_SESSION["eoutmsg"];
7 W. V; _9 U( z3 I' @0 w( ~ if(!empty($outMsg)){
) z4 w9 m; L& I( ?9 J5 W  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
7 x% y5 r" ^" |! Y; L# R( O }else{
7 M/ o3 @6 U; {' E: b! B' B7 F+ a. |  echo "&fileUrl=0";
  exit;
}
. ^7 y5 w" O: Y. |2 L* B8 p, k& S}
: M8 t! l# o) k$ |1 ?# q
function getmicrotime(){
3 W+ T+ q4 b) A1 r4 f    list($usec, $sec) = explode(" ",microtime());
5 _, D- F' V6 |# r; c% n' w    return ((float)$usec + (float)$sec);
}

3 A; {. F5 H+ |2 J/ p4 x?>
2 ?; y" b! m7 J. k4 H4 o/ q0 {