.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
# a, y0 c; d3 z$ v# u  y/**
2 t+ K: X- N6 j) u) C8 I * uploadFlash.php
* Flash文件上传.
( N) {7 ]9 U' k$ b. Q */
# i+ |6 [! [8 ?# q: k) `4 crequire_once('../global.inc.php');

: V- Z  a( I" b! t2 U- z//operateId=1 上传,operateId=2 获取地址.
1 U+ U( d1 C! |) n$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

6 C8 Y" I  Z/ K0 d: U, Aif($operateId == 1){
2 F. p3 L" j1 a! G  f $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
& h, H3 t0 m, [: E" r( c# V3 M //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
: P# q: U2 e% }: M
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

8 O1 h4 R3 v- _) I7 O4 N$ P if(!in_array($nameExt, $allowedType)){
! d3 c& D0 `" Q$ D9 n0 _8 Q  $msg = 0;
}
  r( {' F5 e. o- ~ if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
6 x/ k1 @! a5 l  {3 a  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
/ i3 g; t9 ]9 d1 X  }
  
  if (file_exists($filename)){
% |5 `% N: w9 [! k* Y   //$msg = 1;
- k/ J* z6 C$ o7 Z1 b: T2 `   $msg = $file_url;
/ `) t* M7 w0 ~; \' K2 J5 Z   @chmod($filename, 0444);
  }else{
   $msg = 0;
  }
" c# |: i# h0 A5 ` }
7 s* \, F, v1 U7 [5 O+ b $outMsg = "fileUrl=".$msg;
, L& v. E9 P/ O8 Z $_SESSION["eoutmsg"] = $outMsg;
: u# m* X. n- C exit;
! L' b0 B; ]/ E2 V}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
* u* z, R! W1 f+ H4 T. g6 q  exit;
$ S9 h& u1 h; N" p2 P0 L6 ~' S }else{
+ A# ~( [- {4 z! ?9 F; p' V/ n  echo "&fileUrl=0";
% j2 f0 k) j2 }! u+ D" h, ?  exit;
}
- b, V. n2 i) _; a4 p( J/ C}
* K$ A) S  n& ^  J3 E, v$ R
function getmicrotime(){
# }. Y& E+ ?3 U2 H  b: j1 r1 h    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
5 I. G0 W# g$ q: O}
/ k$ A! V, z; O# P0 x2 B
?>