.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
9 {2 |0 R( w; \( Y( l/**
* S. P% s) e4 N4 A  C. J5 S6 @ * uploadFlash.php
1 h0 V2 ]; F2 V1 L, [( Y5 C5 \ * Flash文件上传.
/ ]4 I6 j1 }9 @2 W+ J */
4 u( q- T5 W- C3 \0 I0 J$ wrequire_once('../global.inc.php');

+ Q: T6 n3 X) F, E//operateId=1 上传,operateId=2 获取地址.
- T9 i7 D' {: @$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

; M& n& i3 j2 C( d  A* nif($operateId == 1){
' K  {* x( C( E) k! L7 q* ~ $date = date("Ymd");
$ z& B" F/ c$ V4 `7 e $dest = $CONFIG->basePath."data/files/".$date."/";
* P+ Q2 Q1 |; U3 A- q $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

6 F& Z3 q) ?" {: K* u $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

. Q* q  Y  i; W% _$ {4 L. _/ _ $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

0 P/ e. h; w2 [+ X  t9 P" M if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
if(empty($msg)){
: D+ t) t4 N( i6 n% Y& c  $filename = getmicrotime().'.'.$nameExt;
3 n9 P  ~6 k6 x$ h0 D  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
1 ]1 [& N$ h: V3 \& o  
5 Q; F* c; _( n' F  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
' _9 F5 }6 o. t& n  }
  
  if (file_exists($filename)){
   //$msg = 1;
  S- x  o, k  A   $msg = $file_url;
8 [% k" D% A: V5 d   @chmod($filename, 0444);
' ^3 v7 Q- i( C7 ]  }else{
   $msg = 0;
. l7 c; ~4 o5 ^" m! I! w7 f+ P& o( E  }
}
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
) X' Y6 C7 I% l7 I# _ exit;
( U( B1 O5 c% o  `& `}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
# C- \& X! I$ {; e  x, ]  session_unregister("eoutmsg");
  echo '&'.$outMsg;
: D$ a- R* |% o5 z  exit;
3 n4 G: x3 s% u. q }else{
1 S) y/ z. g1 W" t; ]# U  echo "&fileUrl=0";
  exit;
. `& b* K) @. x9 B. w' ^6 `3 b# ^ }
}

function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
6 x) d; J: [( [( U0 _+ y}

?>