.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
) F( ~" A3 H2 p5 c3 p/**
* uploadFlash.php
* Flash文件上传.
6 X' @6 x# m' Z, h */
* V1 e1 t+ S9 Rrequire_once('../global.inc.php');

( i, Z8 y8 b& n% a//operateId=1 上传,operateId=2 获取地址.
) v4 A$ w$ c' N0 C& Y$operateId = intval($_REQUEST['operateId']);
0 F/ a- n+ a2 X- y# Gif(empty($operateId)) exit;
, E) n* p( R3 w- ~/ m; M
5 P- s2 k+ B  z9 o  {4 Iif($operateId == 1){
$date = date("Ymd");
8 _$ J1 ?4 v6 `: h: w% I $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
4 B8 y7 n' _5 ]4 {2 Z
6 S2 D: g+ @! X2 e $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
/ @& K! a8 _0 G7 [+ m9 m
- ?/ _  m/ y; W) _ $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

4 {6 V2 Y% X) S9 ^' a if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
% c, x$ V! f7 o  $filename = $dest.$filename;
% p6 ~0 X2 U4 r3 Y" ~' M! I7 E- c  if(empty($_FILES['Filedata']['error'])){
* s$ R6 |7 A9 y3 f   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
! i$ G4 v. A2 l! \  Q0 R; f0 S* r* A  }
. d" o0 K% v5 M% y  
  if (file_exists($filename)){
   //$msg = 1;
. o, u$ a) W0 H   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
   $msg = 0;
& s# m) M1 F" h% i6 o4 i* S  }
8 O1 n" k+ L% x9 O7 V' w1 f }
& {- G" |4 ]* i $outMsg = "fileUrl=".$msg;
/ r3 U7 g  W4 |9 j$ H $_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
% |: q  Q8 ~% M# z. { }else{
; B& T& U  J! _0 V) L- N$ n  echo "&fileUrl=0";
! C* T# i; p* M  exit;
0 k) U: ?% E' ~8 |/ ~0 h7 l }
0 w! m$ J% \: Y: S% c+ e- ~5 I}
4 N, S/ a6 _9 y; p% h, V
function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
1 r# B) s% _% l( k9 ~    return ((float)$usec + (float)$sec);
}

% P  ~2 ~0 T. j0 }- @1 z% C+ P?>