.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
; v/ X" ^) q% B' H$ T$ B * uploadFlash.php
* Flash文件上传.
2 e. y0 d8 ^  ?& Y- Z2 c */
* Z# Q3 V! [* D+ ]require_once('../global.inc.php');

: M4 p, m' r1 J! s//operateId=1 上传,operateId=2 获取地址.
# E  z$ U% r- ?" ~, _* v$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
9 z  ~6 I# I) z9 y5 E
if($operateId == 1){
4 J! w* t* U7 b" N! n $date = date("Ymd");
9 O$ O- x2 c8 O+ B7 @+ u3 _ $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
! D; W; w! w' g' j# O/ D
+ U! n4 E( v" T* ?5 R, B" P $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

. P6 X2 f" P$ [& |8 r# \) m if(!in_array($nameExt, $allowedType)){
+ Z$ j. u- c3 H3 C  F) p1 b  h  $msg = 0;
}
1 H0 u8 h- A( s: q2 }: ^ if(empty($msg)){
# V) U/ b/ H3 m  w7 ?0 r  $filename = getmicrotime().'.'.$nameExt;
( Q% I' _! F' E2 a$ N9 ?' k  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  C8 M9 c) w9 s+ i* E& Q  r7 r  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
  
  if (file_exists($filename)){
   //$msg = 1;
+ A$ \% {& P3 _3 ]9 x! r& j   $msg = $file_url;
   @chmod($filename, 0444);
7 S; R. e# `* M* ]( X  }else{
9 O% b0 |/ y6 h% S% N; K. K. u4 a   $msg = 0;
  }
% S$ |" }- j9 J; k }
0 K1 ]1 i/ P+ x6 ?( b1 Z8 M+ z $outMsg = "fileUrl=".$msg;
% b9 _: e% x& U5 k* a+ k $_SESSION["eoutmsg"] = $outMsg;
! I1 D/ L7 @, N! f7 Y% _* Q4 U exit;
8 p4 B( w4 _" y# w* b3 D}else if($operateId == 2){
& \3 R5 m4 C6 o $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
5 F$ l, U" J+ s: r* K0 t: b  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
}else{
  echo "&fileUrl=0";
7 \$ S' X: N7 h8 S$ p: c  exit;
" C5 h5 e6 N9 w! r3 ]7 b }
}

, [  {1 m' r8 J, S/ ?/ n, n1 E; Bfunction getmicrotime(){
  N$ v  n$ z! g4 f. G: |: R+ o8 }    list($usec, $sec) = explode(" ",microtime());
2 h) f- t: j* a8 l& G$ a    return ((float)$usec + (float)$sec);
& v8 I4 b; @0 @* ?  r}
% ^& E' O3 k0 a  X
?>
$ f9 _6 ^2 W' H% H* I: T9 X