.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
% J4 B0 t9 I! q% `/**
- A& `- r+ ]- I4 P  }& C * uploadFlash.php
* Flash文件上传.
*/
require_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
  G/ k$ t! \" r) J5 \$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
! W, j' `/ @2 f/ J
! Z5 h4 Y7 _5 H9 E9 R4 D) m' L. U6 Jif($operateId == 1){
$date = date("Ymd");
; p- O& \) U# c) a/ F2 l+ m: J; m4 c  z $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
% ]# A$ V6 L/ i0 f //if (!is_dir($dest)) mkdir($dest, 0777);
' R' H8 q% Y5 @4 u
; ^8 P. M! k- L$ g" q$ U2 ?: G $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
% i3 E3 F& e( H" {1 X
' m& S: R8 m' V2 {0 \1 h $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
, _# g4 ?9 P2 ]
if(!in_array($nameExt, $allowedType)){
( \" a) Y8 r8 h6 Y( Q  $msg = 0;
}
; \- [$ O5 ?6 t% O6 u4 Z- g if(empty($msg)){
0 T: D$ ?! V4 T& u' ~* J! ?* B: f  $filename = getmicrotime().'.'.$nameExt;
: K9 F- r7 R: ^/ u+ |6 H  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
* o6 j0 _% b4 O* T- D7 l   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
+ g. t1 ~% O8 I. j5 ?" I# x  }
% Y, s/ u# z3 z- g& i2 m  
5 z& h1 {3 `. Z/ Q1 d  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
6 J$ h7 G) t/ {5 i% @  }else{
6 T0 t$ e/ e( K3 d) _$ Z   $msg = 0;
& v! G2 `+ f2 y5 z2 [3 r  }
) |' x! z5 D6 q/ t  p }
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
& d1 T9 P8 L, j$ P6 y}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
+ F6 g; M- a8 R+ y3 K" ^ if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
}else{
  echo "&fileUrl=0";
  exit;
1 v. N2 {4 Q5 j3 E( C' `: b" u }
" s3 k0 D: k+ k4 {: m! ?}
3 `/ E  p& D, ?) @+ A
9 O& V9 _! B; Mfunction getmicrotime(){
1 j. ~" P$ M% Q' A    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}
+ |6 B3 F/ v. o8 [
: F' a' j  T* z. D) c?>