.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
3 N# m7 `5 F3 n  R! p1 l/**
* uploadFlash.php
: A1 E. T0 W; X* d * Flash文件上传.
*/
9 Z, m2 l; Z: c4 I) Q( prequire_once('../global.inc.php');
5 r& |( z- B' z5 Z' s+ [. x
: `* x( y9 \7 q' Z2 w//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

1 d0 @* I; `& [/ {( @! V. eif($operateId == 1){
$date = date("Ymd");
2 R: z. \% W) S- N% P" Q $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
( v- b4 |, {$ Y! P" W1 N: o5 m* o
9 z- v, Q& v/ ~) Y6 R7 E $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
. z* p" q0 Z% e1 Y
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
9 D( |5 [% q- P; x
if(!in_array($nameExt, $allowedType)){
1 o2 P. W3 U  m  $msg = 0;
}
if(empty($msg)){
8 Q7 T5 ^6 b) m% h# A3 M  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
9 l1 s  I3 |3 g( Y  
) y# j6 n5 v( _8 O+ T5 e9 p" h4 o  $filename = $dest.$filename;
/ N" C  k$ v" ~1 K  if(empty($_FILES['Filedata']['error'])){
3 M- t- G+ U7 _  h5 n: k. [   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
) y0 a, g" {# @/ _  
  if (file_exists($filename)){
6 i/ T) V% x6 v4 z! F: A- M   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
4 S/ Z* N5 t- U6 c7 x. \$ o$ y: H/ y   $msg = 0;
  }
}
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
; w* l) R: X1 y4 b2 m exit;
# i0 H3 G" ~6 ]3 M0 X}else if($operateId == 2){
0 N+ I- c7 b6 [$ F" @' d $outMsg = $_SESSION["eoutmsg"];
$ U4 W6 r5 C  Z4 b! h2 K4 c  [ if(!empty($outMsg)){
  session_unregister("eoutmsg");
! `  @7 m) h4 p/ K7 G4 k/ ?  echo '&'.$outMsg;
  exit;
}else{
/ |9 S2 e! D& L) B8 q: X3 H& X  echo "&fileUrl=0";
/ q, G: q; F' L2 p; L8 U$ S& x  exit;
}
}

function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}
& N) s3 j, f( y7 t1 I( u" T
?>
% H+ C- L8 }( t1 X8 Z4 ]- t5 W