.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
: {0 N3 f6 X  A * uploadFlash.php
* Flash文件上传.
* U. o% j, {& G. e) a% g */
, i9 e# ^: H9 g  v, m! |require_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
; e& Y) k5 o* t: |5 O+ v8 @- N) ^% E$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
8 z! c+ s$ a) b+ [ $dest = $CONFIG->basePath."data/files/".$date."/";
2 Q2 v- a! R( u2 Q $COMMON->createDir($dest);
' w, _" b: l2 |: q //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
1 J& r2 G- F0 h# C- f4 b
4 t& r$ O9 P( [ $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
3 p4 M2 C" x5 R' n; Y9 g- `
, N$ O2 x! d2 G- O! O if(!in_array($nameExt, $allowedType)){
1 }% H$ F5 p7 j, @% R: C  $msg = 0;
' x) ~: S) [+ Y' j8 @ }
; o7 L! \+ w: b  ?+ r# A: y7 B& J if(empty($msg)){
- E3 }; o# |9 n# N' `  $filename = getmicrotime().'.'.$nameExt;
9 z1 P7 x) k% a: y" D. F  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
7 Y) _$ j5 t5 K  
: b2 b; U% w+ \& s& ^  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
' n$ ?1 k9 \: z$ E   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
/ N0 D* o" O. F$ _( q+ i4 z, E) A. s  
5 I9 j& ~/ e( C  if (file_exists($filename)){
% C' W1 {, w5 }3 D# m8 H# |   //$msg = 1;
- a$ C; H7 a0 z" j/ X+ U0 a2 K4 Q; `   $msg = $file_url;
   @chmod($filename, 0444);
# C% l8 S" ?9 \8 m# v3 R6 D: `/ l5 c  }else{
   $msg = 0;
$ N6 \! ~* \/ ?- U: B7 E- w  }
}
& m2 n' H  X, ? $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
/ V% F, @9 P$ f3 F: f7 @ if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
) J& J& T* O* w3 S' l  exit;
0 e, r% V/ L8 R }else{
- A$ W7 c* ?8 A9 U- r  echo "&fileUrl=0";
  exit;
" g: b0 n1 l& [0 L, o }
}
& ?8 Z0 V. l/ f
( S8 R  W; u5 a" c; N7 rfunction getmicrotime(){
/ C& v' e1 j; x* Z6 O- ]    list($usec, $sec) = explode(" ",microtime());
% N3 \) d3 f3 B: A    return ((float)$usec + (float)$sec);
}
- o5 ~9 A* O5 Y8 J4 {1 @% i/ y
6 i2 \  a+ v. T( |6 R9 x3 L4 n?>
3 ?( ]2 b' p: Y6 {- ^