.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
" m! ^* l8 ]2 [' \* P: Y- d. Q * uploadFlash.php
0 y5 D% z* a8 p+ i( F' C2 Z * Flash文件上传.
5 ?& D% J/ @1 ?" {6 {( n" Q* j */
* @) t; g5 F9 Z' |4 {2 yrequire_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
) d1 B+ A* J# K1 _  g$operateId = intval($_REQUEST['operateId']);
# E6 ^2 E; z2 q& K8 S9 _if(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
8 H+ A2 [' K* j* R $dest = $CONFIG->basePath."data/files/".$date."/";
2 k( g$ ]) @: a7 E! N# v" x5 B $COMMON->createDir($dest);
. E$ x  u+ M2 c( ?3 \5 A$ | //if (!is_dir($dest)) mkdir($dest, 0777);
& E9 I! j# b( z2 U) a" l" z
7 |' y7 q# j; a+ [" P* G0 e $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

, J: X# e; q$ B$ D0 W8 L if(!in_array($nameExt, $allowedType)){
  $msg = 0;
7 z  H2 U9 T% A6 v }
5 i) \5 L0 a$ p3 ^7 ^ if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
2 D" K5 H/ k: y+ V, w  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
- Z4 ?2 W) n8 u3 |5 y7 A( s  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
* f5 a! e" k4 Z  I/ X9 {+ ^  }
  
9 d/ W, u6 {. `/ _0 a7 M  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
0 z( h9 z9 `- q( t   @chmod($filename, 0444);
  }else{
   $msg = 0;
! C8 P8 d$ e1 B9 o; Q7 y  }
* N5 ~. M& q: v% U5 |% d# O; j4 R }
2 t& F$ J( s$ S. Z9 }! J  x $outMsg = "fileUrl=".$msg;
& X. [4 V8 |, d6 l' ?* o* `$ z% U+ M $_SESSION["eoutmsg"] = $outMsg;
! B7 }1 c2 _/ D: ], ^% S exit;
2 U8 I* J: u2 L- q* H4 k}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
) T4 {' _6 T$ C if(!empty($outMsg)){
3 r( z/ Y! X* H) R: T3 e  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
}else{
  echo "&fileUrl=0";
  exit;
}
* ]4 Y3 a4 U: ~8 p}
1 P. H& z  W* K6 Z
* ~$ @3 R! p9 q, J. b9 Afunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
& k( z1 ~. r; }9 [4 B  |$ I/ e' _8 {}
# p6 a' V* n+ E& p$ T* N
?>
3 G8 S: ?5 r$ a# O# E  X, n: y