.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
4 O$ C9 I# a9 l2 p/**
* uploadFlash.php
: g; V$ }- e5 [' `/ S: l8 t * Flash文件上传.
7 Y( t" X7 _" I1 w5 S% k" W; G. \ */
require_once('../global.inc.php');
* m5 m( g2 c+ b/ M+ O5 W8 |
9 V' x* y: T. B3 z6 r7 Z//operateId=1 上传,operateId=2 获取地址.
4 J  l* d  K2 o$operateId = intval($_REQUEST['operateId']);
1 a2 q" J* ?2 X0 L& ~4 M9 kif(empty($operateId)) exit;
; u, J# ?7 D" E2 a) f* U# m0 x- k. N
/ N( B2 n7 _. K. _. B5 Cif($operateId == 1){
$date = date("Ymd");
2 w! W4 Y  M3 {- M $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
1 U4 u; v- Y: V/ N+ f' |% E
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

* _: G( C0 a; d* L# {. f9 y if(!in_array($nameExt, $allowedType)){
. a  w6 z8 j2 a" }  $msg = 0;
; b4 ~9 a+ p6 [, D }
1 T+ x: U+ d/ f9 L& i if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
% ]5 R  i, @, D9 u; ]! z( p  }
) ^+ P1 r% i4 a3 ?  
1 X& F0 `% R1 J9 O1 r3 O& |2 I  if (file_exists($filename)){
& Z" c% }! w) A! H5 v' m2 y# `   //$msg = 1;
1 n+ s' O9 z: u& t4 B   $msg = $file_url;
! N, s% ]- {. q  D: A   @chmod($filename, 0444);
* q9 [2 ^( S) X8 l. E. w9 f- ~+ X" b  }else{
   $msg = 0;
  }
! w$ \0 {! @# f- ]8 f }
$outMsg = "fileUrl=".$msg;
; b* }  u% ~7 Q# c6 c $_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
# C0 Z3 M9 f0 s' L  session_unregister("eoutmsg");
5 r; d: K% _; Y1 x3 T, i/ E  echo '&'.$outMsg;
8 V" o6 U/ }$ Q3 R; S1 K  exit;
}else{
  echo "&fileUrl=0";
  exit;
}
}
: f$ H. X; O0 P% I. l$ |
8 q8 m0 j# ^( E0 X$ H! _7 lfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
  }+ w- i, a2 ~8 d3 V% n}
* m4 j4 @; }# y. I7 h
?>
& ~. T; P7 O. l9 q6 J6 B3 ]9 j