.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
2 v. A& B% @2 N; ]. a% L: q. ^ * Flash文件上传.
*/
+ @9 K% F8 ~; o3 r) R4 k  yrequire_once('../global.inc.php');
/ t8 d/ a) o, F- {* D; K9 M7 i) s
//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
- w) p2 Z& _9 f/ ~) T3 A0 m5 w; y1 {. r $COMMON->createDir($dest);
/ v% v5 {9 n: _ //if (!is_dir($dest)) mkdir($dest, 0777);

# ?' F! U* o4 v9 p $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

  f6 g, d: c: J+ E if(!in_array($nameExt, $allowedType)){
/ P9 B" e' T" K( E; }; I  $msg = 0;
}
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
" R9 [7 [$ d; z  ~/ v% u   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
8 x, }4 a& o0 |5 K  
* _/ g0 w! L0 D8 ]% v+ }& V0 a  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
   $msg = 0;
  }
}
' f7 F( y- K  t; {; d $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
2 ^( Q9 o/ z8 E0 E}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
+ q% n- Q1 h. E3 g if(!empty($outMsg)){
) A# s# r+ x- V' T) e  session_unregister("eoutmsg");
; P- b- Q- n& Q9 o) ^) w8 v$ g2 t  echo '&'.$outMsg;
+ p* G! a6 r- z) W6 x  exit;
}else{
  echo "&fileUrl=0";
2 d  w& |9 P: e1 I$ a( s4 f8 o' n  exit;
, j4 j+ Q, B4 y# q0 ` }
}

function getmicrotime(){
8 B' k1 d! {& c    list($usec, $sec) = explode(" ",microtime());
) |2 T9 \1 C# P    return ((float)$usec + (float)$sec);
5 P3 ^, ~/ t3 H, a}

  ?. K) e# }4 a8 |?>
' B/ D; c1 _! `. U3 P% d