.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
7 o9 B8 M; O- ?4 F* h/**
* uploadFlash.php
, w6 T! m' R. K$ R * Flash文件上传.
# l& ?9 c, K! h# _: r9 A */
) F" a) ^; i7 Q# y  lrequire_once('../global.inc.php');

3 F4 j* N. x, f/ c" h7 Q//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
6 a+ B, g( W6 Q' d( i! Rif(empty($operateId)) exit;
7 s, L; f* Y/ F: r: U/ N# }
if($operateId == 1){
: _+ M' I: b- e' n, k0 t  `8 t $date = date("Ymd");
2 Q, U0 X/ h' d# } $dest = $CONFIG->basePath."data/files/".$date."/";
" I& C# [. n) |* [& M7 M $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

: O8 a1 F6 Q% t5 v $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
8 M0 o# z& y$ ?4 V  $msg = 0;
% K0 L: [6 r; s+ S }
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
9 X; }# `* Y8 W  
  $filename = $dest.$filename;
; y1 B: k+ U5 |9 w7 z* ]1 H  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
. z7 t2 R0 l+ Q& U% D$ v  
7 t$ D) W8 L9 Q  if (file_exists($filename)){
& p5 b( r8 q7 \' {! E   //$msg = 1;
! A0 r+ Z7 D+ M, b1 D0 ^   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
1 Z6 _5 I  m! l, x   $msg = 0;
5 y5 u: Y( G/ I  z) m1 s. g  h  }
( O$ b" d/ a+ t2 H9 H+ r& K }
$outMsg = "fileUrl=".$msg;
+ s1 Z* K0 X0 A4 Z( i( a% j, V# } $_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
6 h* f: U) z: L4 o, f  session_unregister("eoutmsg");
/ B0 C4 R: Z! [# n( w1 l  echo '&'.$outMsg;
  exit;
}else{
0 M% K- z2 C3 X* b. _5 N  echo "&fileUrl=0";
' J# p0 V1 C( ^- i5 U( I  exit;
}
}
9 r( B5 {) d  Q: @
function getmicrotime(){
/ s, u/ L( p8 f1 k    list($usec, $sec) = explode(" ",microtime());
4 }% `8 L2 E# U2 c8 P2 [1 b    return ((float)$usec + (float)$sec);
& }$ e2 t+ ~$ N$ h}
! N" y' n& Q; [$ x7 J
. E& I5 Y8 C/ t; o9 ^5 S7 A, f1 n?>