.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
$ G2 W2 y$ m2 ~9 v/**
) J) i2 X/ i" M# a% J( m  }+ |: k5 Z; s * uploadFlash.php
* Flash文件上传.
*/
require_once('../global.inc.php');
' k9 ]2 y% F% f9 s0 V  @$ @
% P3 W% N$ ^: e//operateId=1 上传,operateId=2 获取地址.
5 S/ T) l" Z* D( S$operateId = intval($_REQUEST['operateId']);
% c$ w& X; `' r2 I. P6 fif(empty($operateId)) exit;
/ B0 r- ?$ s1 y' w
if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
/ L5 ?% f& q5 E( m& W0 y: l: a $COMMON->createDir($dest);
7 @( s. J! C2 f4 _' C6 r //if (!is_dir($dest)) mkdir($dest, 0777);

! x9 Q3 e1 Y* X# D% B! e $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
  $msg = 0;
  l: g3 U  ?: ~  d. J* O! I }
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
; {" U& a! N2 M% p   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
# c; b9 e- [, S5 b, A6 w1 ]  }
  
  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
; v  N/ e6 _6 |% _0 W. N   @chmod($filename, 0444);
  }else{
   $msg = 0;
  }
}
# Q$ N% y8 k# l# k $outMsg = "fileUrl=".$msg;
4 G0 j" f  E/ E6 s3 \; ^+ F- o6 |+ K  y $_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
6 N% ^% e! ?9 }$ l $outMsg = $_SESSION["eoutmsg"];
' F, B! @& n. c& q# o+ s if(!empty($outMsg)){
  session_unregister("eoutmsg");
+ T, z) a. h% `# b/ o% N9 a/ z( A/ s  echo '&'.$outMsg;
  exit;
! t% ^/ D' v" J }else{
( R4 t& |# R8 T5 X, C9 |  echo "&fileUrl=0";
  exit;
7 U4 Y' l% n: P' j }
  i$ o1 Z) b! Q9 n7 b}
8 ~) s& [3 G) b- ~2 G
; {0 u2 ]& d" Z" X  G, \8 ~& }function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
. {  z% P: z: \! r1 w2 P}
" {2 Y; i7 f  F. s. t1 c
?>