.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
7 S. ~3 {9 Q& d. _6 r/**
8 }2 f5 J* h6 J6 s- R; g# l * uploadFlash.php
* Flash文件上传.
6 N/ c/ W' n$ q& b */
0 M( k5 Z) B8 @require_once('../global.inc.php');

! }7 m1 \: I7 i+ J/ f% t; _# u6 `//operateId=1 上传,operateId=2 获取地址.
8 m  }8 {4 X: b& s$operateId = intval($_REQUEST['operateId']);
9 s; S+ J# A2 @- N; Sif(empty($operateId)) exit;

8 R0 N, e- @$ Jif($operateId == 1){
3 E6 N) |% `& E; ^2 S $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
9 V! H+ R2 ^- O/ ?) h
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

0 V# K5 q$ e- m  a; n% V8 ~% @1 N $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

  B- l/ X% j# o/ c" J' y, L if(!in_array($nameExt, $allowedType)){
  $msg = 0;
0 T4 A2 T( X0 N' J: L8 a1 N }
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
# G- @0 q, q. A0 |5 r  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
  
9 V2 V, _- n, L! P7 M  if (file_exists($filename)){
) C) Z: ?, F2 \' l   //$msg = 1;
   $msg = $file_url;
$ K8 f. A0 b, G6 o- S( b: }   @chmod($filename, 0444);
  }else{
3 |1 j- c  T; `   $msg = 0;
  }
1 b& }7 Y4 L% H3 r# B( z+ a9 } }
$outMsg = "fileUrl=".$msg;
5 g# q' J3 E+ } $_SESSION["eoutmsg"] = $outMsg;
exit;
9 ?) \2 _8 O) b# M" f}else if($operateId == 2){
0 x/ s% P: P  c6 ~6 i $outMsg = $_SESSION["eoutmsg"];
! R4 s* M) J# k$ v; s4 j5 { if(!empty($outMsg)){
  session_unregister("eoutmsg");
: r, t8 o5 A" W  k8 Q  echo '&'.$outMsg;
% j: U1 h: F4 X  exit;
}else{
  echo "&fileUrl=0";
( s0 W- `) r/ U" K6 O  exit;
}
* S% t: C1 G2 X# p4 W% X2 J' U4 k}

6 A9 ^$ W! n1 g; dfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
$ }- R" E5 T" z) p2 S! s5 h}
1 B/ N1 `0 [; O4 l, n" }
0 `  c+ F& Y8 f: R?>
# G# l) Q$ g% j( A