.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
' I7 C6 d, c8 I7 Q/**
( C5 r& X- c, l( y& X+ h$ m: Y * uploadFlash.php
* Flash文件上传.
*/
8 |8 s! [$ d* Y' R+ Drequire_once('../global.inc.php');

0 `& j2 T/ `. Q//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
" l+ x% S) |. W% u
if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
% F# l0 `- M- g" r/ X% D: ] //if (!is_dir($dest)) mkdir($dest, 0777);
- l- U! k# J6 t2 ]4 @, u8 ]+ f
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
! Y7 w( X4 [! r0 d) g( n+ v
  R" N9 M$ ]8 K: d# {) y& X8 F; c if(!in_array($nameExt, $allowedType)){
& i: Z4 D  ]$ S  $msg = 0;
}
* k/ F* }! _0 E; n& h4 \ if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
7 g, S+ F2 g! `) F# N  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
6 h3 x8 g+ u: ?  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
! ^8 h) H' g" I  m* b7 J% ^; Z   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
& A, W5 M' x* @, l4 g8 j9 B* d0 i/ A  }
  
  if (file_exists($filename)){
   //$msg = 1;
# R8 C7 _0 P6 c4 H# v& b   $msg = $file_url;
) u/ L7 G) y$ {; _   @chmod($filename, 0444);
: s% n% M, a: B2 B0 G  }else{
   $msg = 0;
- q  |+ |! X+ f/ Q  }
}
; D, |' G) m; Z $outMsg = "fileUrl=".$msg;
6 f, S" u. z; y: v1 A $_SESSION["eoutmsg"] = $outMsg;
exit;
' l3 l6 M, \$ _8 _. r}else if($operateId == 2){
& [, ?: {6 n( E. B( x( h2 Y5 u $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
0 B6 ^$ M; O8 a! X- m  session_unregister("eoutmsg");
8 v0 f: H, h4 M6 q6 M) Z+ w  echo '&'.$outMsg;
& F% }  o. p  i1 x, W- V  exit;
) _2 M. b9 V% _% j5 w. ~3 N) @0 P, P }else{
  echo "&fileUrl=0";
  exit;
2 e* T: Y" U, O* B5 Z }
}
7 [0 p; K$ {0 K8 _
function getmicrotime(){
$ Z  n7 W" _  p% ^! h    list($usec, $sec) = explode(" ",microtime());
, x; w. n1 H9 v    return ((float)$usec + (float)$sec);
; \' i& v5 j1 h1 k}
; i, k5 X! P( C+ r6 v; S; e" {8 G
9 e# O' O5 O/ y7 |2 G$ b+ G4 R?>