.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
# q7 s  V% c: y/**
* uploadFlash.php
* Flash文件上传.
" ]: j$ w4 _& O: K8 w */
require_once('../global.inc.php');
8 S& w" f  C2 F! _- S7 ^, J
& V/ J/ u8 s% v  I//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
- k) y# r; c& c- }8 eif(empty($operateId)) exit;
) t% W7 D$ b; z) ?4 B
# b& f5 C" c6 Y, L8 P6 N/ T2 S: Q! pif($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
+ s7 X3 i* j* G( F1 V3 b5 @
7 B8 `* v, o3 B- ` $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
" X: j1 H4 s0 X* k0 M
if(!in_array($nameExt, $allowedType)){
. M7 ?- E4 E- f3 y+ V: G  $msg = 0;
}
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
4 |! w8 x! \& `5 `; k+ v  
( t/ E6 Q/ i( e# c; S- ?  $filename = $dest.$filename;
3 a3 a+ G  _( |, d3 u6 i% Q  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
  
  if (file_exists($filename)){
   //$msg = 1;
- h$ a, P) p! n$ E0 U   $msg = $file_url;
- q' [( V* A) x4 |. v1 e. [$ s! J' D   @chmod($filename, 0444);
  }else{
: ?6 a: V/ J6 {' U3 |   $msg = 0;
1 ?2 S8 f' F. `8 C) i6 ]  }
- K9 }0 }9 ]9 p* t% Y }
& e1 {8 d+ }9 `! x $outMsg = "fileUrl=".$msg;
& m+ L0 b2 @  L0 n% A $_SESSION["eoutmsg"] = $outMsg;
8 Q% O, P' Q! z: A exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
5 }9 T1 _3 j5 R! o/ T if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
}else{
2 H3 t4 ~" r) b  echo "&fileUrl=0";
/ Q+ ]: |  G% C$ w" c5 ^  exit;
, \. Z+ v' ?/ ? }
  T, b, D. a# ]}

; s) X& _2 [; qfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}

+ _: W$ Z" T3 K% N! @$ F2 v& q?>
1 K" ~# ~& Z- J9 @2 ~