.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
: ?5 W) |$ R( d5 s, H( n * Flash文件上传.
' Q, y* b1 W& H# m  _- l. F  B */
, L+ E4 q5 C6 I; Erequire_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
/ l7 H" k8 U5 B# R$operateId = intval($_REQUEST['operateId']);
+ {" b$ o9 [" m3 Rif(empty($operateId)) exit;

, O! A* h! [( W8 O8 Cif($operateId == 1){
/ p  P9 \1 E% d6 Q $date = date("Ymd");
  ^) C: [( J6 E3 |6 ? $dest = $CONFIG->basePath."data/files/".$date."/";
) Q- a) m) Q8 k( R8 L. I& z& K1 k $COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);
$ P" C0 T& k% ^& L
" F: M2 ]( p4 n7 R! I6 @* ? $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
2 X& T; F4 B7 _) b, Y8 Q4 w' P
if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
8 @* L4 _, E. V/ q; N) a) L# d' m  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
8 t8 {1 n( P7 v; M$ e3 e  
  $filename = $dest.$filename;
8 I* q6 H+ {1 o: G  B$ p6 ~' c  if(empty($_FILES['Filedata']['error'])){
: u% j( }3 o) ?3 {8 J, H( m4 j   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
) z3 H9 r3 q! V4 }/ v  
  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
   $msg = 0;
  }
}
, p) y7 {: C8 m6 ^+ O, x( h $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
# e& S& f8 V3 J3 H& I exit;
* C- v+ A: ?/ ^9 S7 H8 n: I6 D}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
  session_unregister("eoutmsg");
6 @3 p" R6 z0 y% s5 W  echo '&'.$outMsg;
! x; b; o: V0 W# K' W; u" {" G  exit;
2 ^5 F9 Y1 P8 e' o4 K }else{
  echo "&fileUrl=0";
$ a0 S4 H; W( `) f: g  exit;
}
}
/ F% v- @* C+ y0 E  v. B; i
function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}
1 W' I' f8 V$ M1 D" W
?>
* p5 c* m" M: }6 |# k