.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
: d8 ^8 A1 h; ^2 Y- s8 } * uploadFlash.php
* Flash文件上传.
*/
& ?" l6 `0 o; x' a; _. u8 urequire_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

if($operateId == 1){
0 \% v! h" l& e4 \4 o' {8 E $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
  F& \9 T6 {: @# B4 i $COMMON->createDir($dest);
' g% L: |+ ?' |- F //if (!is_dir($dest)) mkdir($dest, 0777);

& ~" P( i7 g: y7 ^6 d5 \, `, ] $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
2 x" c  D( f6 @( G7 F8 l9 X
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
  $msg = 0;
% U  {& Z) H$ d }
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
. P9 h% j  S4 _; P5 E$ V  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
8 j/ Q$ F- a5 n4 b  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
  
8 @* n' r9 X. a) p# E% H7 A0 f9 K1 s  if (file_exists($filename)){
   //$msg = 1;
2 L0 o5 [- x9 ]: N+ y' S9 i   $msg = $file_url;
   @chmod($filename, 0444);
7 f3 I: e7 u! j" x1 L; D' d, }  }else{
   $msg = 0;
  }
" s- i+ A# p- C$ I) j }
# s, {, O7 [+ l1 d7 U. J9 q1 n $outMsg = "fileUrl=".$msg;
  x; D+ U, l- O& G# d& ~ $_SESSION["eoutmsg"] = $outMsg;
8 ~+ h! L- q2 ~% ] exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
4 |' A! _& O& c6 ^ if(!empty($outMsg)){
  session_unregister("eoutmsg");
( K- R1 I0 {* }/ o% p3 V  echo '&'.$outMsg;
  exit;
/ x6 k* H& l& z0 q1 G' h  R$ } }else{
  echo "&fileUrl=0";
  exit;
3 \+ J" `4 Z, G }
$ C; p1 E' C& V}

function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
- j* C1 p! G, b( x# k    return ((float)$usec + (float)$sec);
}
/ b/ }6 K( o% M0 s3 I* v
3 R) R. I7 @5 r5 _4 `?>
* {) s4 a: }1 z$ a