.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
% U. H& ?( @6 r. f+ I% S; L- L& F/**
% j9 g/ \/ @/ J5 h. }* {; z * uploadFlash.php
* ]" N4 f0 [6 F3 h7 }( p1 F * Flash文件上传.
*/
require_once('../global.inc.php');

! M( p0 H, M/ m; m8 e. f//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
7 R/ a9 _1 I  u$ P/ S  T6 @& D
0 U, t! p; I1 Zif($operateId == 1){
0 I* H0 H( \4 y5 u9 K- N $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
6 B/ |. W# m: H- G# Z9 N' }3 g //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
3 i# [' P6 }  b# f; v
if(!in_array($nameExt, $allowedType)){
  $msg = 0;
$ E5 y5 [1 f, a/ L+ {5 Q }
( M' E2 \, ^- I" \$ }. d5 P if(empty($msg)){
# s" f# p1 \2 H( Y6 T  $filename = getmicrotime().'.'.$nameExt;
& w9 T2 M# j' O: t' z  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
9 x7 w! O* p* Y" {" O  
1 O. X. ?7 d; f5 {4 _: g: t  $filename = $dest.$filename;
6 N5 I2 r' j8 }- e4 u5 l  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
4 ^' E! m1 U: x5 k2 A' e1 m4 n  }
  
; a" S2 ]4 l! j7 ], ]$ x  if (file_exists($filename)){
! z) B% {( d; f+ m   //$msg = 1;
" f& U( Z( X2 a$ b) @. k5 O$ h   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
3 G' }  u' l" _1 {4 D' o5 @   $msg = 0;
  }
}
' y2 i) b; B0 [. J8 ?+ p $outMsg = "fileUrl=".$msg;
4 A! A: U* {7 G $_SESSION["eoutmsg"] = $outMsg;
exit;
) I+ t& `1 Y& u}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
% R) s. y* {5 g  z& i if(!empty($outMsg)){
  session_unregister("eoutmsg");
' i0 h% z- V" ^- h8 [1 g  echo '&'.$outMsg;
2 H3 E% ]' B  B4 X9 N  exit;
( C3 I/ D, R  h) [  W% ~ }else{
  echo "&fileUrl=0";
& V( K0 ~+ c+ r' T' u  exit;
}
3 Q2 R5 _) x6 j4 A/ M; b}

function getmicrotime(){
" U3 U# k* X; M. z: D. P/ }    list($usec, $sec) = explode(" ",microtime());
) K0 p  O2 w8 K$ V3 \7 T    return ((float)$usec + (float)$sec);
}

( t* F+ M* j3 A) l" d  H5 `?>
6 _% o7 ^$ [( b5 [