.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
$ r; Q5 ~+ d% W) F& ] * uploadFlash.php
* Flash文件上传.
*/
( L$ T1 m0 U' a7 i3 V4 L5 x( Zrequire_once('../global.inc.php');

9 e2 d- @! Y8 u' i) v, }9 i//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
5 x4 `8 }7 j# h $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
+ c8 ~) ~2 o+ D$ p! _ //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

* P9 Q$ V" i2 Y: Q4 e $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
9 \9 d2 j6 @: _, ]+ @) J
# u' S/ x, |4 N9 m% g: s if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
# o  c+ z1 Y6 e6 E0 W. H if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
0 Z3 N3 e; y3 W8 ?1 R# u  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
: x3 d2 |( \2 p' i+ E  J! b5 O  ^% n2 z  $filename = $dest.$filename;
5 l) K! Q% F: t% P9 N  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
$ b# N! c; f4 w: n  }
  
- ?8 m  J: H, V6 r/ g  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
1 f: C) G# y5 X+ e8 F2 ^$ m. i   @chmod($filename, 0444);
  }else{
   $msg = 0;
' @9 R) v) ~2 q: U) _2 ^* Q- H  }
' p7 N0 d* R2 F7 v2 x1 j6 p& h }
( ^8 s% d$ t# J  Y $outMsg = "fileUrl=".$msg;
) @8 ~8 J$ _# j; @' v" J) x $_SESSION["eoutmsg"] = $outMsg;
. I6 |  ~4 B  N5 I+ T4 V. F) ? exit;
' i4 y* X# }* q- @/ ]}else if($operateId == 2){
% l0 E( ~' I( h3 f" d2 b; T $outMsg = $_SESSION["eoutmsg"];
4 A" _; w- v( ?! O9 r) O$ i/ m8 } if(!empty($outMsg)){
4 Y: s6 V: e& J- y  Z* }# T2 m  session_unregister("eoutmsg");
% A$ e$ y( G# w8 |: M7 `& z  echo '&'.$outMsg;
  exit;
}else{
, x  n3 C8 z  z$ n+ l  echo "&fileUrl=0";
  exit;
}
}

function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}

7 j6 @: U8 ^- ]/ F. ^7 _; a?>