.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
6 j9 B2 W: @, G. _( f- _ * Flash文件上传.
*/
: P) Z3 T' h. C( G% @require_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
( i3 N! G: C6 f9 R8 O" T$ k
if($operateId == 1){
$date = date("Ymd");
& K" \4 L' ~! b7 j$ j( O $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
( H: R- i1 {7 O4 h- T
1 W# H7 i# U) w3 H $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
- Q# P) s9 {2 P9 k1 _
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

. Q; j" S1 h$ c9 _9 x1 e7 s, T if(!in_array($nameExt, $allowedType)){
  `  X4 l- A5 d/ ~8 p4 B3 `  $msg = 0;
1 q* u. [/ v8 I+ @ }
# D& V. \6 D% u+ X if(empty($msg)){
- g. h/ u; W# V8 S1 M0 A7 a' M; v  $filename = getmicrotime().'.'.$nameExt;
5 A) C6 O" c+ R. V$ t2 x1 H/ ^  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
8 _+ D1 ^6 h- N  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
, P1 L+ r9 P& y+ i6 a: g( ]; W7 C! Z  
  if (file_exists($filename)){
   //$msg = 1;
+ x1 }5 K2 z9 t" k4 P8 V( g   $msg = $file_url;
   @chmod($filename, 0444);
- L; D. E  J/ G  }else{
   $msg = 0;
  }
' b+ Z' S- p5 G0 P# e8 \1 J }
3 V4 b) w" X, }" R $outMsg = "fileUrl=".$msg;
( {- S4 y8 A7 m' W5 h $_SESSION["eoutmsg"] = $outMsg;
. G0 Y, y( {: C0 w( a5 m% N! O exit;
. I* Z" `. E; D" s$ I}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
+ |8 g2 G% D: v* l if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
- C& c# T! }* v1 e/ _: m" A  exit;
}else{
  echo "&fileUrl=0";
0 n9 p# p+ |- @  exit;
}
}
$ \1 B' @- X9 A: @2 ?8 @
3 `$ r! P9 D. a! U5 U# ufunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
, i; E8 ]7 U7 p}

?>
5 N3 B8 m. o2 c# U