.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
/ l) E5 m2 \! I. u  ^ * uploadFlash.php
* Flash文件上传.
/ ]. F% U- ?& I9 J2 F) P. ? */
% d- N. _9 h- Y$ Srequire_once('../global.inc.php');
4 E5 J: r, x, _' T/ X* X
, X- @' M- q6 U' G% R  P8 m3 [//operateId=1 上传,operateId=2 获取地址.
2 M3 b# p9 e+ y7 `' ^$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
* [& c/ i: z/ l* {* Y! G
if($operateId == 1){
8 F) H) \; ~3 e% z7 m $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
6 F4 j: \* p9 z" `: J8 b% P4 G0 k $COMMON->createDir($dest);
/ W, x4 }0 m& N8 z //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

  e' A( L$ \6 R $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
7 b: r+ y1 l  k0 U  {, C+ H  $msg = 0;
}
; |2 ]+ l9 j, i, Y if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
& x. x" I1 b9 j( n' k1 n- l2 `  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
' A$ B3 h* U  x  R/ g; I4 ?  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
; W5 A( o4 O+ M( w  }
  
" T' v' u( c! `* K: D  if (file_exists($filename)){
: K/ A0 [/ B5 `& ?  p; w   //$msg = 1;
   $msg = $file_url;
, W" W& l( v# T4 M   @chmod($filename, 0444);
6 p& {: Z4 n$ ~! o( Z) x: m  }else{
) ]6 a2 n* {5 h' j   $msg = 0;
  }
}
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
$ n8 {3 I7 ~; k% ?}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
2 b! Z# M" i1 ^+ H  session_unregister("eoutmsg");
$ H& W: J# R7 y1 H  echo '&'.$outMsg;
  exit;
}else{
  echo "&fileUrl=0";
  exit;
3 Z1 M- B; w6 Y/ Q }
}
5 l4 z% y& t" b3 f
$ E. \* ^9 [9 a0 \* }. Cfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
: O1 B  a8 \: O1 d; H" o    return ((float)$usec + (float)$sec);
}

4 U* e7 l$ j( V4 v?>