.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
, n4 J3 r9 z  z9 s) C2 X: }4 @ * uploadFlash.php
* Flash文件上传.
, ~, {# T: l) D0 _( T */
require_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
0 R: J+ p9 X5 ^- ]* B, q/ P- i6 D. V $COMMON->createDir($dest);
' {) P: `, ]( S( [) W //if (!is_dir($dest)) mkdir($dest, 0777);
' |' L) B+ ^1 R0 Q2 d2 k) p
3 a. @: s% B$ c+ U $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
5 k" ~7 x' B, h3 \- t
if(!in_array($nameExt, $allowedType)){
5 ^' P' I. U& \  a" e! N2 Q& E4 _  $msg = 0;
7 p# @. C+ Y& W5 E! K& ~ }
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
8 j& F  G$ b; O  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
6 }, g! x2 h# M' N  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
: ?! ]- |2 v. e0 f7 ^- H$ V. f  
! f4 J, I$ ]( B' [* o  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
+ S$ O3 Y3 P0 b( c2 g0 e* g) y   @chmod($filename, 0444);
  }else{
   $msg = 0;
0 I  m! N1 X0 r# J2 `- ^$ Q0 ?5 }  }
}
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
' O/ u$ Y2 ]0 `; b$ l& o# G exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
1 \) f$ D4 y5 X1 v if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
+ D& e3 e" z' x  exit;
# t, T1 \& Y& \7 p0 P  `6 t6 U }else{
$ I$ V: F% ^, U2 P  [  echo "&fileUrl=0";
  exit;
}
}

& b  N- Q; _9 X# \" j7 I5 L; lfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
( F# {7 d) V1 s1 w7 [3 Z    return ((float)$usec + (float)$sec);
}

?>