.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
. V. I+ b# F. t& Z' e6 Z* h/**
* uploadFlash.php
* Flash文件上传.
*/
5 N# C% F' }" B* t6 ?! crequire_once('../global.inc.php');
: {% N% [; g: }/ B4 O+ I
//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
/ n  Z6 W9 a/ }. G' X2 {2 D2 fif(empty($operateId)) exit;
& O8 a% W( P# h9 G( l
if($operateId == 1){
& a: D7 m5 q! }8 ~ $date = date("Ymd");
7 c6 d# _' G8 b: K" s" N $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
" Z4 D! Y2 c$ L# l/ H# ~ //if (!is_dir($dest)) mkdir($dest, 0777);
3 J  k# Y# w3 \* W: V. l
7 b. F3 A  P/ [! I8 j$ F1 F( g $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$ m  S) ]9 _* e% [ $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
  $msg = 0;
}
if(empty($msg)){
$ M8 ^+ p; R9 m/ g. h6 U  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
. ~3 I+ j/ `; y% S3 [  
  $filename = $dest.$filename;
1 P! \7 x7 h& _! ^/ Z# M* {  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
0 |4 X+ K: L8 T. Y  }
  
1 ?" c( {' s' t) ~: M7 A  if (file_exists($filename)){
6 y- T8 r9 J; Z; p4 k' ]3 N1 g   //$msg = 1;
   $msg = $file_url;
" Z9 H" ^# P3 p3 `3 }   @chmod($filename, 0444);
3 F0 h: ?4 L0 U, i  R  }else{
   $msg = 0;
  }
}
$outMsg = "fileUrl=".$msg;
' j' z# N. c2 O) j& |4 O6 ?1 V $_SESSION["eoutmsg"] = $outMsg;
! s  N2 f5 s1 v# t) m& }; _) j4 G exit;
  m  j) s: h7 H/ g5 l* }0 b0 t}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
  T* {  G6 t8 H  `' g  } if(!empty($outMsg)){
7 _/ q  h4 b! d- ^) x$ u  session_unregister("eoutmsg");
  echo '&'.$outMsg;
  exit;
}else{
- S& A& _2 c' I* O8 t& y  echo "&fileUrl=0";
& ^+ X1 E; {2 |! u+ s  l6 k- G  exit;
}
) }; R" Q; F7 v/ k( [( o# D' [0 I}

function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
' D! d/ H6 x* C, G3 }1 L    return ((float)$usec + (float)$sec);
}
5 S: B- Z& G* r! y) z5 O
* _) j; n9 H0 B/ P  @* m' R. l1 \?>