.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
* Flash文件上传.
% r* e$ g- j7 u0 h5 y9 O' S */
require_once('../global.inc.php');
3 E$ V/ B$ H  Q4 F0 p) z1 p* I
//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
& D$ S: q( [0 b; ?7 ^% V( Oif(empty($operateId)) exit;
: i/ b- I; m: X, P
if($operateId == 1){
$date = date("Ymd");
* {* G+ y2 \, L  ?: M& P $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
4 ^/ [3 Z$ I( n  f3 q, e7 A* o //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
  $msg = 0;
. p/ z+ K2 `- F4 ?) g' Q6 L }
if(empty($msg)){
$ {( [0 L4 Q# ^5 v0 o& g. v$ A  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
' \/ h- C" [6 `9 P% c  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
. l% e# q: M4 _# m  
  if (file_exists($filename)){
   //$msg = 1;
5 ]( e# G1 p# j$ G( T; W0 F7 }+ J   $msg = $file_url;
! Y! D# ]# i, u: P   @chmod($filename, 0444);
) \7 E, [# Q# F! S  }else{
   $msg = 0;
  }
}
4 f9 S$ _1 d% X# _6 p5 [ $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
' z7 Y! @- h) q exit;
}else if($operateId == 2){
% P# a2 \5 B# f8 D $outMsg = $_SESSION["eoutmsg"];
% K6 m: q- K8 b) h% L9 v if(!empty($outMsg)){
  session_unregister("eoutmsg");
1 T- [( z; b8 T) p' X  echo '&'.$outMsg;
  ]2 U. A. w1 c2 m2 S7 h5 ^* z: h  exit;
. B& {2 Y2 y# L- ?) C }else{
  echo "&fileUrl=0";
  exit;
}
8 ^$ B  w6 T1 _2 r- \}

5 g, z/ I  x+ M, q) r% S8 rfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
. s5 q" o4 Z; A' w% `    return ((float)$usec + (float)$sec);
+ a9 [$ a4 ]/ [2 R- Y8 b}

?>