.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
8 H+ T1 V: ?( Z, B9 v9 {+ n/**
* uploadFlash.php
* Flash文件上传.
3 i8 R3 [# _! k8 D! L */
+ A  _" E, p8 Z9 crequire_once('../global.inc.php');
- P) t* w2 ~: q0 o9 P
( Z& ?9 {) m0 e/ b4 Z4 x* \& T//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
: M* C2 z8 K! E2 z& P( G% F) O1 {if(empty($operateId)) exit;

. T' n2 Y+ u' c2 E' z7 W4 A$ _8 Sif($operateId == 1){
% O: ~) P8 S) V( w/ Q  Q7 J+ q $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
6 w/ h$ ^& i; ?. h: k8 h4 |( x
: M9 o3 N! Q" }  a $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
1 b! Y, }, U( m! Q) X
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
9 P5 |% [7 w1 V
( M3 M4 f" b/ d if(!in_array($nameExt, $allowedType)){
+ J1 H$ m% `7 y7 o  $msg = 0;
1 M+ w0 z8 G- H, O2 S4 M- y, q }
if(empty($msg)){
: q6 j' m; W* g/ E# f) \  $filename = getmicrotime().'.'.$nameExt;
  G6 q0 [1 U* N9 f0 A  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  [  A( n2 O2 s9 ~" M  }
+ `7 {' n" h" q" X: Q$ _  
1 S3 w( C( G1 I" g  if (file_exists($filename)){
   //$msg = 1;
- D9 r; }! W7 L$ n$ c0 x! \   $msg = $file_url;
  ^4 K" l0 `! e5 a   @chmod($filename, 0444);
  }else{
1 ]+ [# z0 c$ @# }. P   $msg = 0;
/ W8 a: z6 [8 s  O" q  }
3 K1 t- L, M5 @7 H! Y8 m* P* l }
$outMsg = "fileUrl=".$msg;
) e4 @! a- t0 p  g# X7 A $_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
2 p. j. {+ _0 z/ Y8 v; L $outMsg = $_SESSION["eoutmsg"];
3 o$ h! X; {7 I0 P2 {( } if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
) O5 |6 U- V( C3 O7 p3 H- V, Z  exit;
}else{
  echo "&fileUrl=0";
! q+ _3 |' A$ R5 O! r4 Z  exit;
& n; v* D0 k. z  [3 A  p1 p }
}

function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}

?>