.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
% K6 m* C! w8 O! C4 h * uploadFlash.php
* Flash文件上传.
5 P  M5 h3 O) v- Y1 `2 D& H1 [ */
' v) U" ~, c& z7 Prequire_once('../global.inc.php');

. u1 G+ \, d& m" U//operateId=1 上传,operateId=2 获取地址.
7 f1 |3 a: A2 _/ W1 z& }; x- }$operateId = intval($_REQUEST['operateId']);
; u3 W. A- d& U- p, Aif(empty($operateId)) exit;

if($operateId == 1){
. v- N: f- r! r. v $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
. ~8 r* i7 C# L
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
# a' ?8 x3 @6 t9 V7 x. w: I' E
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

2 z. W1 O4 P4 ~  h4 i if(!in_array($nameExt, $allowedType)){
  $msg = 0;
. J' _3 Q) S( i% G! W* z }
if(empty($msg)){
. t# q2 X- W1 k6 y+ |  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
7 ^0 Q- F6 R9 g" U& ~& ]3 S  
  $filename = $dest.$filename;
8 j3 ^& F- e. K% I. t  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
# l! r3 N" d: O7 c* g; Z( p  }
. w4 [1 {9 D2 h. b- l' ], F4 \" i' T  
  if (file_exists($filename)){
   //$msg = 1;
' A) z: u2 ~/ a  Z* z   $msg = $file_url;
   @chmod($filename, 0444);
( d" p! |7 i! }! j/ h, C  }else{
   $msg = 0;
  N4 k1 t/ s7 l1 x  }
! g7 Y8 @* Q: X; i }
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
1 l" E- a) p  [ $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
. ]7 o6 J- T3 H% W" L  exit;
}else{
  echo "&fileUrl=0";
  exit;
* n4 }+ c* m# N7 B) X }
+ Z1 ?7 v! ]; p( _  R/ e/ E' H}
+ s% K8 b" d0 w; ^
function getmicrotime(){
$ ]' l+ V# O) Z5 q, o- x5 y    list($usec, $sec) = explode(" ",microtime());
& f5 B. z& N1 z" c    return ((float)$usec + (float)$sec);
}
( F1 U; N) ^% y+ \0 I, |
7 U- m) C1 Z$ G  h) a( V% T?>