.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
- a: }+ X' h1 u# L. f/**
3 i( R- l8 |2 ^. I * uploadFlash.php
* Flash文件上传.
*/
- y4 S6 p+ v0 D4 mrequire_once('../global.inc.php');

/ d8 z) u+ A- U/ l% p//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
3 t; J. R% v! k7 u5 l8 B4 ?/ Z  Zif(empty($operateId)) exit;
, u6 m/ r7 A% m$ E3 v
if($operateId == 1){
6 [* Z) c6 b5 z, t. h2 P1 a $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
7 F9 H& N! C. z8 s6 G, B1 m- t+ U $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
$ {! e$ v$ d& K! v7 R6 {
8 y$ ^6 q% B8 w $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
2 w) U, R) }4 l; n* v$ G7 i# d
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
* A" s* F8 p0 z/ z
# }8 l6 m7 }8 W4 E( `+ i/ t if(!in_array($nameExt, $allowedType)){
, O/ l: ?9 W/ u4 X3 w  $msg = 0;
}
7 {" w1 n& R; i. c if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
# }+ ]4 b: r9 _: y! a* Z6 M  
+ m+ y" L$ J' y$ D3 c) v& u  W  $filename = $dest.$filename;
4 A* z  A8 X8 v0 }! m* d: r  if(empty($_FILES['Filedata']['error'])){
3 R3 c" ?7 A% y+ e   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
* J3 L& w# L& k  }
/ @; Q. O! k, @- X) z  
  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
. T/ n) z6 w$ m% H+ k   @chmod($filename, 0444);
& W1 Y  x% t" _6 u  }else{
. W4 k. k; E% V$ g8 V   $msg = 0;
  }
$ P+ W5 S" h! o" K& } }
- W6 K) T, r% m' l* p/ N  a3 X8 | $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
  w$ C2 @9 j$ d6 T. X# \ exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
. \% `& R- w  B# x& c9 y, c if(!empty($outMsg)){
8 H/ x/ Z  P# t" |& @9 j; z  session_unregister("eoutmsg");
  echo '&'.$outMsg;
6 I) M/ D6 |2 A! @  exit;
}else{
  echo "&fileUrl=0";
2 |8 n3 n* J) O* q+ c5 K; L  exit;
}
}

, ]! ^2 g9 L8 j/ X9 {% f+ Zfunction getmicrotime(){
. Q& ]0 w5 n" L2 y5 F    list($usec, $sec) = explode(" ",microtime());
$ e1 s% {5 j  X3 j    return ((float)$usec + (float)$sec);
}

8 J  O2 D6 @0 F8 @?>