.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
3 t' K$ R& \/ }2 m& }" U/**
6 K! g+ p% x0 q8 d * uploadFlash.php
- Y  Q2 E6 z: j1 S * Flash文件上传.
: p0 f. V* z* e# y$ i3 T */
require_once('../global.inc.php');

0 @& `! d; j' H" X6 i//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

if($operateId == 1){
, n1 y, U( g- J( p" ^7 J" X+ Z; H, p $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
: C/ e' ]5 k3 ~8 j( b
, e  Y5 B/ p) f $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
: T  U, _" M! ^( B+ t
/ a3 l0 v) _6 R0 k, A $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
  $msg = 0;
1 \* P  ~" |- _ }
& v2 i9 l1 G- A" q if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
. a, w* d' U& V) r2 O4 p  
! Y2 Y2 U9 t3 v' |7 [5 Q  $filename = $dest.$filename;
+ U/ R+ u7 F. Y: z2 ^8 k) b  if(empty($_FILES['Filedata']['error'])){
1 L! s6 J. `8 Z2 k; {. ?9 ~$ }   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
9 g! k4 W. ]! e7 J, x2 f4 f0 f0 ]  
8 f' f& q' l1 a* a0 y+ D  if (file_exists($filename)){
1 _" t& E6 @7 x- |# @   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
   $msg = 0;
  }
}
$outMsg = "fileUrl=".$msg;
  ^1 w6 r' w2 |0 k1 S' l8 Z9 k $_SESSION["eoutmsg"] = $outMsg;
: Q/ U: R- E; P' I exit;
7 A) P& b, {3 H2 E4 v}else if($operateId == 2){
# A4 @0 c* L7 a, b3 N& F $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  f/ H/ S) i9 @, T( h  session_unregister("eoutmsg");
: A2 g- o& j$ @/ V# q! a7 V6 Z  echo '&'.$outMsg;
  exit;
}else{
: F; o+ O% p6 E' [) f3 o  echo "&fileUrl=0";
7 l8 ]% E! {  g" [, ?! C. H6 [  exit;
- T5 T5 E/ a$ t2 i }
+ W( W) |0 {& g+ X$ s7 `}
$ x% {) M; \* ?
function getmicrotime(){
1 R9 F! V( z. Y0 ]    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
& e5 F5 T4 I" v+ k: F: }}

+ r$ n$ G9 e+ n6 F3 J( i4 Q?>