.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/ |) r! u  `+ f+ K/**
* uploadFlash.php
* Flash文件上传.
: {2 g( C# |: f. O! _2 ?1 } */
require_once('../global.inc.php');

! q+ {4 ?: P7 z2 I# D" h. S3 ~//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

9 N5 R; u. {8 `' x! \. Eif($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
# T2 E7 x! R/ o7 k! L/ ?
& Q& b2 Y! G% d0 @ $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
8 f. k: P5 q  ^# O# H
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
- E* y6 A* F" x: Z4 w
9 s/ [0 o" G. T6 ] if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
! g( R8 s* ~* `  L' K( A4 G6 T if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
2 Y+ y+ t5 a: X* u( u# v  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
4 n% Y# \- J( X  
  j0 P6 R2 f6 d$ C1 Y, `9 \% Y; v7 x  $filename = $dest.$filename;
/ x% X' ^( g7 A, P  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
, N/ P( e/ K) G& P  
5 n6 K2 _+ t  z# k' z  if (file_exists($filename)){
   //$msg = 1;
: O8 Q5 ?, y, F6 @   $msg = $file_url;
4 ~' m& x) [6 ?0 C7 k- {" y   @chmod($filename, 0444);
  }else{
   $msg = 0;
$ s$ i+ @" m# G  }
* I, x, d1 l" s5 s3 I& U" D }
. z6 i3 e, h! ~: d* Z! \ $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
2 ^3 Y) s$ g: |* J% ^+ H% Q. y if(!empty($outMsg)){
& A% a" B8 Y. v0 C6 {; P& L& j  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
}else{
  echo "&fileUrl=0";
$ Y" u0 }# F+ f5 c4 W5 B  exit;
}
}

5 e6 W& O  w. L+ ^function getmicrotime(){
( E  f- ]) O! Z5 y    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}

?>