.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
8 Y- T5 R" |* G+ b/**
* uploadFlash.php
* Flash文件上传.
*/
! V. N9 e, g7 S! P: C$ [3 \require_once('../global.inc.php');

# C; h( ^0 }7 Z( M3 f//operateId=1 上传,operateId=2 获取地址.
. z' c8 ?3 f2 S- L" s0 E$operateId = intval($_REQUEST['operateId']);
! J1 O2 H+ F; U' M- jif(empty($operateId)) exit;

% X% r2 c* ?2 X5 ?1 x6 {2 `# Nif($operateId == 1){
9 ^0 f) g( K8 G$ r" f. }- W $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
, Q+ x9 i3 o) k8 T' h- Y5 Q $COMMON->createDir($dest);
& x2 t; |5 B2 X# V- d. n //if (!is_dir($dest)) mkdir($dest, 0777);

0 N! l/ z$ U% `: j $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
! B' S( O5 s: k5 ^2 P& T7 V
! B1 T# Q+ @7 k# H if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
if(empty($msg)){
& i7 J+ r1 g  q" g( `! g( u  $filename = getmicrotime().'.'.$nameExt;
% C! H8 K+ w7 k8 @0 {8 V0 R  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
- s0 s; p. y; ~* b2 A  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
8 y2 }7 e! d/ b& r" E& J4 z  }
  
6 P: Q- ~$ @8 c  ]! r- [& b6 Z  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
# j3 D5 R' d0 z# }  }else{
   $msg = 0;
1 j- I4 [0 [" ?: k. O+ M/ P  }
}
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
, J2 l  B7 h1 \9 [6 m( \8 [ exit;
" Y* ?9 k3 _7 I) r6 G}else if($operateId == 2){
3 v0 y; x4 Q3 \+ L9 K$ {! v $outMsg = $_SESSION["eoutmsg"];
: R5 l$ f* a- ?. M* k8 Q7 F if(!empty($outMsg)){
# i: j) V1 V2 d* r' t; H& M( y( e& b8 t9 O  session_unregister("eoutmsg");
  echo '&'.$outMsg;
& C- a' E% P3 u" S  exit;
}else{
$ B/ |" U0 U; B. x; s, D  echo "&fileUrl=0";
  exit;
  B- R5 Z: t! d }
- d, O- J9 f& q: {}

function getmicrotime(){
! w/ H% s  y: h: O- \    list($usec, $sec) = explode(" ",microtime());
' R) P( Y" ]/ z9 W# p* A9 ~    return ((float)$usec + (float)$sec);
}

. X3 e' \8 R$ s  Y! O+ z/ g?>