.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
; I6 \: K1 ^. P. [: Z7 W4 l* x * Flash文件上传.
*/
require_once('../global.inc.php');

# ^$ N" ^  C* N//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
& _# L) B) O( [6 w- ?* [if(empty($operateId)) exit;
2 {, ^1 f$ R6 y" L
if($operateId == 1){
& w3 m+ J0 q0 ~  Z" E0 b- m $date = date("Ymd");
* l9 A+ ?9 M# b* E2 k0 H% \$ t $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
- ?, g9 H2 a2 Q' }: ?( U: u% P- Y5 s //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
6 `" Y+ ~5 t" y' g
: f, ?+ L% s8 i$ t& K+ f; c) F, | $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

/ @8 N$ |9 V' Z; W7 a8 j% T if(!in_array($nameExt, $allowedType)){
: P. I$ L- l2 J# a; W  $msg = 0;
}
if(empty($msg)){
# s% k! n5 `* n+ d  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
! z$ v4 z7 L! Q  $filename = $dest.$filename;
+ _0 a0 b$ W9 b( Q, [4 n  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
( p0 [) n2 ?9 I# I/ @8 e9 X# u  }
; Y7 b. v2 h, V/ [# |* H7 Z& s" P% ]  
4 c' z  m" H1 H+ K# z' C( O# l. g! i! N  if (file_exists($filename)){
& A, c/ B, s/ K9 L   //$msg = 1;
   $msg = $file_url;
% L  `5 r8 i/ l   @chmod($filename, 0444);
  }else{
0 S  y6 `3 t7 v" S" ~  q/ J   $msg = 0;
6 S5 }3 l4 Y' U. t. ]. D) L7 _  }
, F; @4 K$ W3 h1 o, y  q }
0 |7 M. Q+ X/ `; u) b8 T& B $outMsg = "fileUrl=".$msg;
. w+ ?4 F6 ~+ C5 T $_SESSION["eoutmsg"] = $outMsg;
exit;
; I3 T( J9 g$ k" z. \}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  session_unregister("eoutmsg");
" Z. v7 `! E% ?0 Z. Y( ]  echo '&'.$outMsg;
  exit;
}else{
, N6 C% Y) z( I$ z- M  echo "&fileUrl=0";
  exit;
}
8 e: U+ ~0 R% B3 @2 _, l}

function getmicrotime(){
9 n' [  W% A' l+ w3 A+ z6 m    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}
$ `+ e4 f, D, N8 H: E5 `* L
4 e; ]" t7 w( N?>
  B8 V0 t5 }$ x9 \