.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
3 u. b- o8 }0 L( d+ |( J * uploadFlash.php
* Flash文件上传.
' F4 j3 _7 @' G. k' l0 b* v' H( g */
. }7 s  d8 Q/ }% Q' `* urequire_once('../global.inc.php');
8 W+ F6 Y/ e& j' R
  ~1 v% T- Z* }9 D4 U( g//operateId=1 上传,operateId=2 获取地址.
2 l$ U+ [/ ?4 A% C2 E: P) n$operateId = intval($_REQUEST['operateId']);
7 U- q" B+ h* i! U; oif(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
' w* U% g1 o) ` $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
$ b; k; }! K$ U
1 Z2 R& {3 x9 G! t' b/ f4 N, ?& S $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
/ a3 O  c8 K! g  E0 E
/ x* L+ q4 V1 r0 J: L' ]8 _ if(!in_array($nameExt, $allowedType)){
  $msg = 0;
  S) }# S$ Y" V6 n) I }
/ t: ]- n! n2 [" P if(empty($msg)){
# _# r/ q8 d9 C9 K) l0 {  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
# t. S' h+ k7 P9 \8 B& e  
  $filename = $dest.$filename;
- B8 Q! s; w& B# }' ?! E  if(empty($_FILES['Filedata']['error'])){
% G! z" U9 _" O# C3 r% _   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
# W& l9 b4 ]3 X/ y( m  }
  
  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
( z/ V  Z4 Q# m, u+ \2 z3 b  }else{
   $msg = 0;
  }
}
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
' T! Z$ C) l6 h- R# {0 k3 V: q exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
& }* F1 k0 s+ ?) B  X! n$ R! ~ if(!empty($outMsg)){
- }2 [9 {+ t, \+ c5 \  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
, {; y* b( K7 u5 b }else{
& M1 O2 `8 v& Y; N$ q  w  ?  echo "&fileUrl=0";
/ n5 Z# ]9 \9 e2 A" b  exit;
0 |' q  ~1 R7 a }
}

5 V& ^6 s$ w" x  T2 |6 x& y% ifunction getmicrotime(){
4 h+ P$ G# E, R( H2 [    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}
7 m. Y  Q8 I# d, U  m" i: w
; O0 i% X$ K/ M?>