.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
. e0 J+ K& s: E * uploadFlash.php
: R9 I1 W' |, p2 m * Flash文件上传.
6 c1 f, w1 t0 Y: J */
require_once('../global.inc.php');
- e$ B+ C: @6 |' p8 L$ W* t* k
//operateId=1 上传,operateId=2 获取地址.
0 M8 k9 ?! h1 s" d2 C* c) I$operateId = intval($_REQUEST['operateId']);
  n$ V; j/ g# g$ F; V+ w" g$ Wif(empty($operateId)) exit;
$ s3 E7 o+ e; z  W. w
if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
3 c+ Q: `* G7 L6 b& X0 q  k) H $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
3 B) T+ x7 l: s2 }. T
7 q* |$ Y/ [$ r  t$ p; g  z $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
8 D3 V  O" g) A+ _3 L: a
- ^. X' ?3 [  F2 e0 {; |$ B/ } $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

8 y4 z7 H/ U( W! V( l if(!in_array($nameExt, $allowedType)){
  $msg = 0;
! w% i; N3 y/ f. t5 H8 Z }
9 ~3 h% i" \6 e5 h. k; v# m if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
- v4 K1 w" E/ E1 w  }
, J, T7 p; X# k. U( B  
  if (file_exists($filename)){
; q2 ~+ _- x8 c2 w( P/ }: B   //$msg = 1;
   $msg = $file_url;
( ?5 g* e8 o$ @$ |* l  c   @chmod($filename, 0444);
1 h+ s3 H7 A( z! J) f( O  }else{
   $msg = 0;
  }
}
$outMsg = "fileUrl=".$msg;
  m6 ~7 I. }+ Z6 G% T $_SESSION["eoutmsg"] = $outMsg;
' ]  q; E! V) W& t% } exit;
! Z& g9 I; j9 [7 F5 h$ ?}else if($operateId == 2){
: _4 p" E6 I% e/ s& z# N+ Y. z $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
" d; R/ k1 ^! P2 `! Z6 ~4 c  session_unregister("eoutmsg");
; L" H2 U1 }( J, j( ]' f1 k9 P! [- k  echo '&'.$outMsg;
" C/ g" ^5 H  q6 h/ |5 O  exit;
( O& }. p! _( }; S+ U6 r }else{
  echo "&fileUrl=0";
8 h8 f- I3 b2 L, p' @/ f" ], g  exit;
9 t9 b3 D% k, k0 D; e8 q }
$ |9 ~$ }, }! X9 `3 ?' l}

$ n  Z5 V9 t5 r+ V5 \function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
/ d) q# h' G- w    return ((float)$usec + (float)$sec);
- t2 A9 g/ L$ ?; J9 e9 E. V}

5 @1 M! I3 `( q  W( L% K; y/ \?>