.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
* Flash文件上传.
9 e; j( _( ]! M  m+ D */
) v. a4 G4 [2 K# Y- O% s: urequire_once('../global.inc.php');
: }/ N6 k6 }4 _- q6 U7 s# D/ J
//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
  c) E) F3 F, ?3 ]* gif(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
4 S6 l9 d. ]  v* @% \3 {) C2 E
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

$ j8 o; G" b4 f+ @& l" t* L! e if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
8 |! T6 T. m  r: w( P* }, V, r if(empty($msg)){
0 S. y5 @+ Q+ J7 |& J" ^& z5 }. @  $filename = getmicrotime().'.'.$nameExt;
" w) W. \0 N$ W$ B  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
( f( M& b8 s* V6 @  z  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
8 F0 I7 w- }) @- E6 m   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
7 B" q' f9 _; r4 m' @  }
  
; c% x* ^& q: ^/ z- {  if (file_exists($filename)){
   //$msg = 1;
2 ~# |) a$ u3 Q. g   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
   $msg = 0;
  }
}
2 L7 t/ O/ z+ }2 G) F  c4 @# S $outMsg = "fileUrl=".$msg;
) d' w. n8 P5 ?( h+ q $_SESSION["eoutmsg"] = $outMsg;
8 ^+ n/ r* W5 j exit;
}else if($operateId == 2){
" `' n' }3 X; P5 p: h $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
$ n; t/ m0 v6 P, [7 f* e' \" Y  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
& @  R8 Y* u: M& w& f# w }else{
  echo "&fileUrl=0";
, p8 l% ]) t0 q; o0 J  exit;
}
}
. w0 H! b4 \+ P5 I- {
function getmicrotime(){
" H: p/ @; x- T( h  x- P1 g    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}
% B9 @# }4 p' |
?>
% I/ T6 q, f, g* o& R5 x2 g4 R