.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
3 D* t& f. J* ]: T' c/**
* uploadFlash.php
* Flash文件上传.
$ i: K0 ~5 i( ^8 \( w) O */
9 P8 T' a1 }# ], w9 u$ K$ y7 t2 u: Q. \require_once('../global.inc.php');
2 ^6 o0 B/ P3 D
//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
# I  i# @; H: L' r2 J' y7 P/ jif(empty($operateId)) exit;
: X" @: s$ O7 \9 V+ `: {2 m% g8 j1 L
if($operateId == 1){
$date = date("Ymd");
0 j3 T/ [# _% Y: F5 J/ m $dest = $CONFIG->basePath."data/files/".$date."/";
' D; z/ L1 L& d8 T) k! h! F# v $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
6 O# T: C  m; l" e. h* D# o
' j% F$ s( Z  w0 f $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
2 H9 l) u0 S5 [
if(!in_array($nameExt, $allowedType)){
5 g' e) `; ]6 ?. V( a# l  $msg = 0;
}
7 \' a8 y5 u* @- H) e7 \ if(empty($msg)){
% _' y, R% V/ x$ }& U  $filename = getmicrotime().'.'.$nameExt;
- x' ^; w: r; s, P" t  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
1 s: }  c  }, M  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
. f+ x3 Y  T4 e( l   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
8 X9 E; p) G$ ^& f  }
  
  if (file_exists($filename)){
+ m5 o1 w9 F% E/ n% a" c0 {* P   //$msg = 1;
   $msg = $file_url;
+ [# l# f6 S' O2 p2 [   @chmod($filename, 0444);
$ y- Y% u% T. \8 h) j% x# }  }else{
   $msg = 0;
  }
}
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
* z" {" h1 h2 y4 \' c; c exit;
- h+ ?3 x; e. Y. q( C7 M1 l2 |! @, o}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
0 V) n7 D1 b+ G* f9 r if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
0 r3 J( j# y6 _$ r' q2 N. P }else{
' Q! M2 E5 L1 f+ M& ?8 G* L  echo "&fileUrl=0";
  exit;
' N/ Q8 P* M2 i( H }
}
. e' l  l% j( q, K
& E* a+ e* w; O; Zfunction getmicrotime(){
$ x1 K: J- q$ d    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
6 ]5 w. ?* h* O9 p1 |8 E}

2 J3 ]* Z% m* C1 u2 S/ `?>
' x' k7 e* @% S