.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
8 k( a1 w9 [5 N6 h; W/**
- s9 G# j% r9 `5 P$ o * uploadFlash.php
* Flash文件上传.
*/
& j! M% o0 Y; prequire_once('../global.inc.php');
( r( f$ F' m5 X. q8 Y
. l+ O' o6 I7 N- b# b) f% t7 |//operateId=1 上传,operateId=2 获取地址.
9 j- Z- c" m, f$ U$ D  ^# K$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;
- F6 i0 G) G  @" m1 g8 |1 q" G
if($operateId == 1){
0 K& R, Z  I* d $date = date("Ymd");
: e; Q5 E* y- N, q5 V  F9 C $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
, E' r# x  W, [  @0 y- {9 f //if (!is_dir($dest)) mkdir($dest, 0777);
- Y2 _* T5 ^+ E2 A3 U
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
) r3 }/ I# ^: O8 t& r+ v# ^& A
& J; p5 f  s  E- u: s) ^ $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
' L) k2 ]& t. F* s if(empty($msg)){
: ^5 W2 L9 o4 Y. A+ t  $filename = getmicrotime().'.'.$nameExt;
, N% O: _+ w9 D  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
" k; a7 R/ R; U, H  
4 F+ @2 C. u; @$ X7 ^: `  $filename = $dest.$filename;
2 y8 ]2 a3 d  \$ ]  if(empty($_FILES['Filedata']['error'])){
& p  b5 F9 z& F4 T   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
* f5 d; G/ g/ W* u: Q2 H# P  }
1 d% a" E# O4 Q3 M6 }+ r  
  if (file_exists($filename)){
1 m9 w. I! |# V   //$msg = 1;
6 b% n% Y. J3 e. b9 B& [' F' [   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
   $msg = 0;
  i7 u% ]% [; M, Q/ g, n  }
}
$outMsg = "fileUrl=".$msg;
9 q  V5 Z2 \: `) s( Q0 _' n $_SESSION["eoutmsg"] = $outMsg;
exit;
. B0 r3 X% T& _- e( n}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
1 t2 ^% E% {  o( [* I' A# H3 s# S if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
}else{
4 c# W2 m; Z7 ]  echo "&fileUrl=0";
  exit;
2 @, |' x2 x0 K" a }
' B' C+ Y" r; g" C( k% w; d1 j' u}

4 ~8 F1 q' M0 q+ A) ^7 l2 Tfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}

% _8 o) z3 V. B4 K?>
: R& q6 o! g( h' r4 P7 P5 N