.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
% G2 C9 {* ?$ B# `' j * uploadFlash.php
* Flash文件上传.
*/
! s& i* }' C, ]( L2 C8 T+ f# Drequire_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
1 ^( X0 }1 q) k' i: W. qif(empty($operateId)) exit;
6 X6 b9 M2 \" ?
if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
. |2 ?! ]2 P3 N4 X
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
  $msg = 0;
4 f2 H1 [* @; h8 c$ t! q- ? }
if(empty($msg)){
, V6 c) I" Q+ h0 l; i1 a6 \# A  $filename = getmicrotime().'.'.$nameExt;
: O' b7 O% P' S% m& d3 L0 h- C  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
. C+ i/ q  s! r* P+ J4 o  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
2 J' ~$ s; b8 t$ F* A& x# M' V% c   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
  
  if (file_exists($filename)){
* r% v+ T1 O- x& b$ n7 E   //$msg = 1;
1 l0 O  K5 }; A+ I! W- X   $msg = $file_url;
   @chmod($filename, 0444);
5 V1 O# r& O5 k  }else{
) J1 f2 K$ f+ l- A8 R1 j0 d+ w   $msg = 0;
  }
. i2 b! s- S" c6 X+ b# Y }
$ U6 t4 k& K, w2 F6 E6 {& U $outMsg = "fileUrl=".$msg;
4 n" g0 {; F) B7 ` $_SESSION["eoutmsg"] = $outMsg;
7 f4 ?5 q0 K6 Q8 D4 z7 x9 T' @ exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
" a8 F6 a; a6 R; q! p }else{
  echo "&fileUrl=0";
  exit;
}
0 Z3 @! F' u, d' P4 d}

7 D% m, K8 t* [1 C. u# ifunction getmicrotime(){
3 \6 k# W/ r* ?& Z    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
  L3 v" K1 K3 `6 H! z! D% p5 V}

?>
. Z6 X9 w. `5 P; V9 {8 Y; M$ u