.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
- E) R) u9 q/ B+ z! h * Flash文件上传.
*/
require_once('../global.inc.php');
# A- u5 z3 _9 e1 W) N
//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
( Q) d# A. n( }+ V6 q% ?* |
; ]% ?# v. u3 qif($operateId == 1){
$date = date("Ymd");
' U& T7 x5 i& u  n, t3 q $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
4 D4 D9 B# G4 }+ i9 n //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
7 G  S. }( a$ W
5 S( G' S, K& L! K2 P $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
% x4 Z2 o, K% J  $msg = 0;
}
5 r7 \; {6 e0 P. r: m if(empty($msg)){
  ^& K. O( P# x; ?  }, j5 B! S  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
4 P5 w3 p' J; D5 N  
- j2 ~1 E3 q% Y. D  $filename = $dest.$filename;
* J4 T) X) s, V, w; u  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
5 z1 B# Y$ K$ c, d  }
  
  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
, D3 C. E8 N% O2 W$ B   @chmod($filename, 0444);
% _$ r+ x% e$ `% x  }else{
+ g) g6 v5 }( C9 j2 M   $msg = 0;
  }
* m9 K6 p3 \1 _4 s: ?* a! J7 [6 U }
$outMsg = "fileUrl=".$msg;
* K! T9 n! D8 A $_SESSION["eoutmsg"] = $outMsg;
exit;
; j( [9 N+ z) W" t) f, }: a}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
6 o* g7 A) ?# u1 x7 r( x9 J" W if(!empty($outMsg)){
  session_unregister("eoutmsg");
( n, K  A4 f- j/ X0 E0 o6 m  echo '&'.$outMsg;
; g( L, v$ w7 y) C1 V0 X. k  exit;
}else{
  echo "&fileUrl=0";
  exit;
) T5 h4 M# [( S4 z* ? }
. Q! `. P4 K* y! B0 w}

function getmicrotime(){
6 L9 i4 F% n/ w- v    list($usec, $sec) = explode(" ",microtime());
: f4 L  \1 {7 ^8 ^9 Y$ a9 {7 t    return ((float)$usec + (float)$sec);
}

% r9 J) ]0 k9 p?>
4 x: Y3 d. n, ?6 }( L. N2 k. S( B