.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
* Flash文件上传.
*/
require_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
9 U; q, x1 h* @3 k) r; Vif(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
& [( E$ \! i& |8 m0 a* M' m $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

& C" |1 ^" F$ E& U, X8 v if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
0 N% f4 N3 F5 w9 O8 l4 a1 U if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
. g) B+ H6 P- S1 U  
+ f  V1 p5 i# P( F$ M' Q- P  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
* g; b' o0 Z* Y9 K$ G4 h8 @5 }" g& t   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
, L  _. n0 H' [. m$ `7 g; Z9 D  
  if (file_exists($filename)){
9 c" T, X- @' s4 c1 [# a   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
" n* c8 w- A# C9 G4 {1 ^  }else{
$ P6 v) Q0 I! q) Y0 j) v% m   $msg = 0;
  }
" p; |# d, }  L: V6 b! l }
$outMsg = "fileUrl=".$msg;
: P: ?* M0 O5 ]4 t  q/ ~' k6 O- U& p $_SESSION["eoutmsg"] = $outMsg;
1 ^2 A0 \# V* d8 b% B3 i( M0 D" t1 o exit;
}else if($operateId == 2){
" T) O% f7 T+ Q: r* t6 a $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
- g) ?/ h' k9 j: `4 V  |! [  session_unregister("eoutmsg");
( B9 U4 I" r5 h% C1 U  l1 ?( Q  echo '&'.$outMsg;
  exit;
}else{
' b1 c' m# n% M4 X4 D6 s  echo "&fileUrl=0";
  exit;
) D6 S8 ?0 {/ {$ { }
4 V) ?- o- R( w2 a& ?$ F9 }}
6 W8 R* g' c' G& x+ x) k9 a% H: S% H
5 g" r! j7 r, h6 c, o* f* rfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
6 v! j4 j) R$ P( ]8 `    return ((float)$usec + (float)$sec);
}
3 b8 D, j* p; u8 Y  e3 {3 n5 w( q
?>
) C6 ]$ r) I# ^/ @5 c# F