.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
! S( t  E& B# x% x7 l * uploadFlash.php
7 P5 l  S8 d7 C: ?; v4 k5 U9 ~: \2 F * Flash文件上传.
*/
" \& r8 |9 [' _5 M& \( s2 Wrequire_once('../global.inc.php');
7 L$ t5 j( ]) P
! C$ g* L. s) n  I$ H- E3 K//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

& _% C( t8 G  N3 [4 z4 c7 xif($operateId == 1){
$date = date("Ymd");
1 M) L: b) L6 D- y# b- D $dest = $CONFIG->basePath."data/files/".$date."/";
3 \8 W8 X- ^5 ]4 `: V, n/ K) b! N1 d5 r $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
( I( I9 K" n. b. {$ C
- F7 E4 \8 T. ^( Q# ]5 d7 T% x9 D9 E $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
# r3 S  B! K- L' s) L7 C% d* l- T  $msg = 0;
" r/ _3 C% u! b/ k }
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
& r% Q  y* \$ s, c   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
: o5 v. W8 s, ?/ v  
+ f. K( |, R/ b& P: s; }  if (file_exists($filename)){
, g; ?2 b* Z0 A; V5 J2 `   //$msg = 1;
: v, q# b2 T( |   $msg = $file_url;
   @chmod($filename, 0444);
/ v- T# n( L# z( I+ r  }else{
   $msg = 0;
  }
}
9 K7 |" x+ {2 L0 Z $outMsg = "fileUrl=".$msg;
' u! g$ t* B( @* f $_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
3 p  U7 N  \% M $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
- U* h: R" ]5 d) u+ x- l  session_unregister("eoutmsg");
5 M; \. e3 ~, a+ h0 N  echo '&'.$outMsg;
4 [" @6 w' G3 V  c8 l% b: \! ~$ Q4 W  exit;
0 {' G, Q. U7 q+ f8 [6 a% T9 U4 V }else{
  echo "&fileUrl=0";
  exit;
}
1 M9 ~+ E/ [" _) j}
. X: Z4 T7 F* i4 _. ?: f
7 M" E- z$ [0 b4 `. nfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
! o8 [3 f8 c0 }! v) x7 S+ k3 }% C    return ((float)$usec + (float)$sec);
/ {# H' r  ~) `8 e  g  B}

5 E) L4 a1 p0 W3 ]?>