.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
) E/ p9 L& ]- G% v" K * uploadFlash.php
5 r5 M3 _1 U3 x2 p * Flash文件上传.
$ P, i% b6 t, }) g( M% [ */
+ f5 H  _* }9 N7 d  b4 Zrequire_once('../global.inc.php');

. J& m( w. E# c0 T0 g//operateId=1 上传,operateId=2 获取地址.
: C* q5 N1 d* `$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
8 E7 H: ?+ ?. h
if($operateId == 1){
$date = date("Ymd");
6 Y2 `( m2 |* q5 I7 |, g9 K! r* T. A $dest = $CONFIG->basePath."data/files/".$date."/";
- Q  b) s9 p5 r! x) y$ Y $COMMON->createDir($dest);
4 z. ~7 I& J$ [$ s2 D5 @  { //if (!is_dir($dest)) mkdir($dest, 0777);
0 d! Y! l5 {$ d3 }9 j
; R9 @/ M  {; c8 \/ t, z $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
0 N6 T4 ]& T6 ]$ n1 P! |+ P% I
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
* [8 y: P. d, C2 A5 q  $msg = 0;
  \0 O9 V% t4 \" h; \  L }
' E3 @. [# c& z& B7 [; } if(empty($msg)){
% G9 v8 o" i# H; @) g% J  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
/ o% A- k, N0 k  
' A' B$ ^5 G, i- X  $filename = $dest.$filename;
1 o* g; y" U1 P$ `$ L$ x  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
  
$ d" M3 G" m# F  if (file_exists($filename)){
- \* h( H* N7 b( C5 A   //$msg = 1;
2 U7 {+ R. p4 u   $msg = $file_url;
7 W1 E0 P  m4 T1 E   @chmod($filename, 0444);
! `! {) d, ~  P" O5 n5 ^  }else{
& O; r7 ?# n+ n; S' T* x   $msg = 0;
  }
5 E7 x! z, M1 b2 g/ D# |' m- y8 F }
$outMsg = "fileUrl=".$msg;
8 w* M9 `5 N' k- ?: l: | $_SESSION["eoutmsg"] = $outMsg;
exit;
* W( [8 n+ T! x0 b7 V}else if($operateId == 2){
' I# l6 k' F7 L3 n/ L $outMsg = $_SESSION["eoutmsg"];
7 @1 G1 n* ^1 o5 \) P* ^7 b  _ if(!empty($outMsg)){
4 Z5 z/ e' f6 l  E  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
3 P: D# E8 Z( |( D+ q  }1 z5 V }else{
. M$ _, J5 u0 o3 N+ f2 F8 [. o2 E  echo "&fileUrl=0";
8 i: A. N/ J; D6 l. e  exit;
: Z$ `' C" E1 R. h* S! b' W: a }
" L' d7 s+ O0 G4 }! |. ]}

function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
1 t$ V/ l; F: Q6 x  f7 x    return ((float)$usec + (float)$sec);
}
4 Z6 E0 u6 w( |& e! V9 |! B6 f% Q
" {( y7 c3 `0 n% f- n! u?>
9 K" z  e- r& b3 ^