.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
0 P- @/ V8 v; v7 K4 G4 t/**
6 Z3 y* }2 Z* {; h# } * uploadFlash.php
* Flash文件上传.
7 X9 q! ^4 K5 O  B */
; Z; @( |6 ~+ j1 ]require_once('../global.inc.php');
# C6 z2 S$ ~" K0 e( A! {
) G8 [+ P- ?9 _% G/ u8 j//operateId=1 上传,operateId=2 获取地址.
2 i1 F$ F7 h: s% S3 j5 m$operateId = intval($_REQUEST['operateId']);
; z! x0 `' l& Y/ l8 t! |7 Eif(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

+ `. G( r  b2 H! X2 m: |7 R $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
6 H* c2 q* {" f. K  L3 X
0 {; `3 M" T1 ?1 \' U$ @ $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
. \' w/ Y8 O- k) d) f2 Q& k. O
7 I3 v) R7 Z( d) n' R' ~% A if(!in_array($nameExt, $allowedType)){
2 z; g. U; l. N7 k8 {! D+ g6 b  $msg = 0;
; P. V6 x/ k. j# N2 R }
if(empty($msg)){
0 J' c8 E# U& g! L+ C1 Q  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
) q: j# W7 U. R- y4 K/ q  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
  
1 U) l0 S. @% C5 J, i: p  if (file_exists($filename)){
' b& p7 Z9 t% z4 |& C   //$msg = 1;
   $msg = $file_url;
+ B+ C+ B2 @3 s4 m! D   @chmod($filename, 0444);
. b/ \; n9 D/ }8 L  }else{
   $msg = 0;
  }
}
9 E. t, M! \4 `3 l $outMsg = "fileUrl=".$msg;
8 ^0 _) ~9 T9 b# U* c1 Z: X# `; H- N $_SESSION["eoutmsg"] = $outMsg;
7 v. p/ W+ N* e8 W$ h# I# j exit;
4 u, n$ F3 Y" P& }# Q4 k2 W}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
/ x: P- ?( p6 w* f9 @  session_unregister("eoutmsg");
  echo '&'.$outMsg;
. N1 }$ s1 y) ?9 L: E3 ]* O' T1 M( r  exit;
}else{
  echo "&fileUrl=0";
  exit;
}
/ s% ^4 e( |: y}
0 u0 `4 q' t6 C( i* @8 O
; _6 s. t& h9 g7 n9 v5 W4 f- o* ufunction getmicrotime(){
4 Q- n  F6 |6 Y; A' {9 [    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
" M( ]- w6 }8 s, @1 Y$ B}
1 w: c6 N% r' ?% i0 s8 Z
1 H5 ?- d/ Q0 i?>