.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
5 ?+ K; \3 M0 s  f4 `' E: N! N6 X/**
* uploadFlash.php
; n! I9 K, U& P( N- U * Flash文件上传.
- F+ i7 G6 ^6 u5 f! _) f$ ]* o */
require_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
. n2 F6 U' z: H& d$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
9 ]8 Q( X3 ^! Z; g5 M$ N/ W2 E
8 F6 X2 [, N; r* y$ `! y3 Jif($operateId == 1){
$date = date("Ymd");
& U) g  j* H* L+ S" {1 H $dest = $CONFIG->basePath."data/files/".$date."/";
/ @" M5 V4 h6 Q* ~6 a $COMMON->createDir($dest);
+ n' G6 V  g6 i9 P //if (!is_dir($dest)) mkdir($dest, 0777);
% T. P6 g% ~0 e3 d
: S, ?1 @: V3 k6 A $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
" a* c: _9 T; s3 U& a4 f
1 O" Z6 Y; P; g& \ $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
; J" V8 ]- F1 E1 D6 d% ^  $msg = 0;
}
0 ~" @" }( a1 K9 C6 Y$ y# w  { if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
; D, d. ^3 Z6 Q% J, I  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
2 B+ B' b3 i: I' t' q   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
  
) l1 q% N% Q1 a7 b+ q  if (file_exists($filename)){
   //$msg = 1;
% k' X9 w) |, P6 L. l   $msg = $file_url;
9 l: [1 U7 Z, b# o! c   @chmod($filename, 0444);
3 G' @  N6 X+ D9 v# y( @, ?  }else{
   $msg = 0;
  }
}
% |2 }  Y6 Q3 F, s3 [  Q* `1 H $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
; N4 N1 M! d* R- B+ Y! D if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
! l5 Q) k0 \$ g6 I/ b# d* v  exit;
: T8 u4 K2 Q) `; @ }else{
  echo "&fileUrl=0";
  exit;
}
4 u# K& b3 U1 s7 y# E) G( }}
- H5 x# e' P0 K4 e  R$ ?
function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
8 {2 N' Y4 [+ _* E* [}
7 x8 V  ^9 j# P1 G
" `2 C5 z6 E& J' L7 a' C0 z  x?>