.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
3 @# T2 i( M- i* q8 `' d% g, P/**
( G0 b) m) w& [# ^; y * uploadFlash.php
* Flash文件上传.
*/
( s# o9 O2 t. O+ m, y4 f' srequire_once('../global.inc.php');

$ d9 R: i6 A& g- P* o: J% p9 m//operateId=1 上传,operateId=2 获取地址.
5 q  c8 T. a1 y* Z' ^- B0 q3 W' R4 s$operateId = intval($_REQUEST['operateId']);
, C, J" U. o, f$ @5 Kif(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
) X+ o$ p! @/ a& h2 T7 I$ w $dest = $CONFIG->basePath."data/files/".$date."/";
. z/ G) e& R2 H" g; C( j $COMMON->createDir($dest);
; @) y  A4 a2 q" j+ V! { //if (!is_dir($dest)) mkdir($dest, 0777);

$ W- C- [% I& M4 r8 a* l $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

9 H( y: _9 E5 K- V8 {% ^ $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

$ K2 c9 s/ _1 ~2 r/ J/ E6 G# i if(!in_array($nameExt, $allowedType)){
% j" |0 Q$ l: ^3 J/ @# n7 E  $msg = 0;
}
, R0 j3 i8 Z. i: Y! Q) @9 n if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
+ Q* E4 l! L' l  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
# s' \* i' R* H8 A, p, N  if(empty($_FILES['Filedata']['error'])){
, a4 w) X1 b; H5 t   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
+ X7 {9 I, ^9 E  M+ D  
  if (file_exists($filename)){
* ^2 t- f* Q+ i2 X, |0 `   //$msg = 1;
7 ^+ h+ T) z6 l   $msg = $file_url;
4 U, z  w5 |( c   @chmod($filename, 0444);
: c3 \! i$ ]& ]  }else{
0 Q7 b6 V4 ~! G1 n7 J   $msg = 0;
* K3 Q/ [, N, a+ s  }
3 f9 Q# s1 \( U1 O6 W2 @- g$ ~ }
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
7 Z4 E) w. @8 |/ i1 P) o $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
}else{
  echo "&fileUrl=0";
  exit;
}
}

, {8 \$ X% Z3 x. V" }+ hfunction getmicrotime(){
  h# X1 m5 O$ M    list($usec, $sec) = explode(" ",microtime());
  V8 k; f6 B4 I: I    return ((float)$usec + (float)$sec);
}
. l% u! z9 g( ~' {
1 m9 C8 ?! w0 R9 Q$ P?>