.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
- M; A) g+ Y( V$ j8 e$ c. ?( d/**
. @2 Z' p  m4 t! [5 e' f" x * uploadFlash.php
* Flash文件上传.
*/
require_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
7 c( Z# f. Q  E, z7 H
% Q: Z% g( h' e' Cif($operateId == 1){
$date = date("Ymd");
5 O# F" x# @& z' S $dest = $CONFIG->basePath."data/files/".$date."/";
2 d( U" G+ `! r" _& b1 Y7 H# i $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
* M9 ?1 u, @  x/ z2 p' a  e
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
; [/ Y* k. O; Q; h/ P% T) R( u1 Z, T$ k
) c* }6 r6 C  w" i  q2 A1 \ $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
  $msg = 0;
! q. k* r+ r3 K' s: t3 k* @0 u }
4 T# d4 U* Z4 K9 r" P if(empty($msg)){
9 `6 w- ?# h6 `5 C5 c% {  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
- E; m* i7 U/ ]. `; l: I  
  if (file_exists($filename)){
2 G5 d0 j4 s) {/ O   //$msg = 1;
1 P5 y; W+ R- q, _0 L   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
; q! i, D% z' f) W5 `- `   $msg = 0;
  }
}
3 j; _. c- Q3 U" m+ @' z7 s $outMsg = "fileUrl=".$msg;
6 y' @" s0 _) W$ _$ x $_SESSION["eoutmsg"] = $outMsg;
6 h9 m+ @0 D) @ exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
( d. N8 ]- x# ^$ ?  session_unregister("eoutmsg");
, L; C. Z) m- l  echo '&'.$outMsg;
  exit;
% f! ^8 S+ z* T$ d( S. [3 q }else{
  echo "&fileUrl=0";
3 p9 y* J  ~$ |1 P2 W( r, J  exit;
}
5 M2 b, b8 P& l* l}
- Y0 n% |9 q+ V8 m
function getmicrotime(){
/ K1 d4 P  G/ c$ D  u7 I    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
& i$ r$ v- E$ U8 P# a}

?>
8 ~5 C8 O. x4 n) O: ?, k6 P