.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
* Flash文件上传.
( a! W) [  m1 X! I7 @ */
require_once('../global.inc.php');
" g4 i. K/ m9 {" C* d
" |& q- r7 K, i. C& v: t! g$ Q//operateId=1 上传,operateId=2 获取地址.
$ L6 ]5 @! [! [/ F( e6 D$operateId = intval($_REQUEST['operateId']);
8 b" `# B! E5 n. w9 b2 _if(empty($operateId)) exit;

8 e' i4 q, D* H7 {if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
/ L5 w% `( Q' { $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
& r, x! L! k) ^3 l
4 h% r7 @  k$ G- q/ X $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

" g( H' d9 ^: |! y- E if(!in_array($nameExt, $allowedType)){
4 n1 j2 |) V5 v+ |+ T  _  $msg = 0;
}
' ?) W  N1 B/ ]- K9 t0 P8 V  [ if(empty($msg)){
  E0 X% T3 d( ~5 K* V  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
6 V+ Y' Q' ]# K2 c4 ?" u  $filename = $dest.$filename;
$ \, c7 }% G& @0 p0 p  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
: l2 B0 D& ]( Y) w# X7 K- Y* ?  
  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
# v: U' Q& s: m  N: B  }else{
   $msg = 0;
/ L0 F7 Q# e8 F0 r& |! d* \  }
}
/ j: P/ T/ x# F6 o) d $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
( {' I* [; B! ]* M: c exit;
7 {5 R/ ^1 t6 y: x# {7 ~9 T  e}else if($operateId == 2){
* Y( i6 W8 J1 O# O% W5 X4 R5 _ $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
}else{
) G8 |8 v/ i3 u& w  echo "&fileUrl=0";
  exit;
}
}
) |/ N$ K' u$ |0 z8 g/ b
function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
# D% m- h- \, _    return ((float)$usec + (float)$sec);
9 _. h& X0 l2 `* E3 N( f2 s- N}
# t# l9 a/ H! @9 V& G" d8 m
6 w+ l) u6 ^) O* S?>