.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
* Flash文件上传.
7 |/ p3 @! e: G2 s# p$ [* o */
6 e9 O' c1 T( ~; c2 @require_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
) D2 o* B4 p. k  H, A$operateId = intval($_REQUEST['operateId']);
4 C' p! V4 L/ O6 B: Uif(empty($operateId)) exit;

if($operateId == 1){
2 g$ j" J1 E8 V; ]$ L8 X  J$ N $date = date("Ymd");
3 Z9 W- J( _2 t7 Q  c$ F $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
$ w" r3 C$ y- ^" ^5 L( h: |  }) K/ q //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$ M6 y: h3 E9 W) v$ w $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

8 _4 \0 y" O% x if(!in_array($nameExt, $allowedType)){
  $msg = 0;
, f9 c. E; E6 V' F: ^/ I) B  F }
( k) V9 I& n  x; C' Y- i if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
0 j+ m: u" e# C% F6 ^  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
0 O6 D7 W* b4 L: f  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
8 E% X3 F9 \$ ~4 |  }
  
  if (file_exists($filename)){
* N* p- X/ J+ F( {5 d   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
   $msg = 0;
  }
7 j% L8 a  h" D* D# q/ {9 g }
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
* L7 E. C4 x- V& L exit;
) ~# e% g( e3 V}else if($operateId == 2){
+ N& M4 U5 y* H. U4 E0 q $outMsg = $_SESSION["eoutmsg"];
* u7 ?6 }9 M/ { if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
" n) z# D& x0 H  h# F0 d  exit;
2 B) ^/ q# L5 W% E' y8 n9 J1 R$ W( q }else{
$ W" d1 l* G0 }4 D+ P; i2 k  {  echo "&fileUrl=0";
  exit;
}
3 n* S2 a% ~3 f8 j}
# C1 e9 F! d5 e/ P0 T
function getmicrotime(){
* b% ?- ?/ x* y" e  E    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
/ J5 |2 C; @0 s! S}
* Y# n  k% {- g# t. ~' z( Q2 Q
?>
+ I0 v0 V8 f1 t& h% I