.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* j- z- V& f1 ]  i+ c  K1 I * uploadFlash.php
* Flash文件上传.
*/
require_once('../global.inc.php');

( k7 ?$ ~; s8 H2 y+ c//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
" d1 t8 j* V. F6 h9 |2 E/ T6 a# g. S
0 u5 H& h% \+ F1 {if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
, c  k% ]% U& |- q $COMMON->createDir($dest);
7 g' F  C, {3 ~( j! A4 k //if (!is_dir($dest)) mkdir($dest, 0777);
" t5 d: {2 l+ x7 i6 L
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
# r- e! o% ?! h) N5 X/ y7 M
) m' o" b1 _( r! @% n+ L% | $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
. b0 @: j4 O$ j6 P5 N# y- c7 |, E0 L  $msg = 0;
: ^5 p# |" ^6 z7 X8 [0 E }
+ g7 l; S1 p2 {& S if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
4 n/ y2 O6 h6 D; f+ O6 {  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
  
  if (file_exists($filename)){
   //$msg = 1;
) {/ R) N0 F5 R5 ?1 W9 w   $msg = $file_url;
+ Q8 R& \: N" H& o# C9 F   @chmod($filename, 0444);
  }else{
/ d) k, O% P0 H: X   $msg = 0;
- F3 U. v0 I. D' \  }
3 \6 Y- C* s0 d; h }
$ ~* a$ T* n& m $outMsg = "fileUrl=".$msg;
/ f  |4 i; K+ F $_SESSION["eoutmsg"] = $outMsg;
exit;
4 c2 O" K. I3 X+ i9 l}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
; S9 }& i3 R" [" y# p }else{
1 P+ n7 j7 a& a4 s  echo "&fileUrl=0";
  exit;
}
}

function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
2 V% J$ d& t5 w9 m2 M+ s}

?>
/ t( r5 U7 A! K  i