.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
  f7 l" W2 l3 t) u" @/**
* uploadFlash.php
* Flash文件上传.
*/
( q" u, {+ g  y9 U/ m; F0 i9 t9 Krequire_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
6 M% ~4 g! s+ w9 O) n2 A+ N
if($operateId == 1){
) Z$ {# i5 r5 f8 l% r3 Y $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
( e. k' p7 ]/ e0 D3 A/ h2 { $COMMON->createDir($dest);
0 T* ^9 n7 T* @3 o //if (!is_dir($dest)) mkdir($dest, 0777);
: K5 a7 f) p( I9 J( `
$ L4 c% B$ ~/ ]  Y" D- ^, O/ _4 Y( } $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

3 W% A+ v2 I% p' _, F) a' R if(!in_array($nameExt, $allowedType)){
7 I# a+ k5 F9 b- w& W  $msg = 0;
}
) O  O) A, k+ ~' \; P& _5 M if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
- ?8 E4 p# {5 O& b  
  $filename = $dest.$filename;
5 L! L6 U  H/ `; u. L  if(empty($_FILES['Filedata']['error'])){
+ E5 I* Y7 p/ K8 y7 O! T% y* L   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
  
  if (file_exists($filename)){
  ]8 `, f4 Q& w! c) ^. @$ h   //$msg = 1;
  c1 Y, Q" ]3 d" s+ X# }   $msg = $file_url;
9 o6 j6 Q* s" R   @chmod($filename, 0444);
  }else{
   $msg = 0;
. T; A* r0 P2 e9 s  }
}
5 ]" M, b3 D! y" |* r7 r2 m7 d/ E5 g4 y $outMsg = "fileUrl=".$msg;
9 c0 `. w5 e% r" g  L4 ~4 b8 d $_SESSION["eoutmsg"] = $outMsg;
  P* L! P0 c4 X. Q  N exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
, J8 W' b" i( f/ _% `% G' p8 p if(!empty($outMsg)){
" I  c" `2 j! m+ n: I. I5 Z0 A, j  f  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
}else{
  echo "&fileUrl=0";
& g0 M, Z% B: M% D0 r  R6 Q: n  exit;
9 o  V9 E9 \( J2 m1 h1 J+ w }
}

" w- o' h! S) M% L& z2 C; E3 tfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}

: D3 Q9 V8 D" I5 {/ N; h?>