.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
; v% n0 G4 z# |; S; r6 G/**
* B# B. a) l3 e% ^/ q * uploadFlash.php
* Flash文件上传.
8 D( [# ]; k) m" q4 g */
( f$ o6 a- u' I* S" s9 hrequire_once('../global.inc.php');
: l$ R3 s3 ]/ B2 i3 ?
3 \' z: x; y8 E$ Y//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
% j3 [! J1 v4 Lif(empty($operateId)) exit;
* _, F* [9 N) z) R1 A
$ M+ n) S( c* H: K* P; Zif($operateId == 1){
8 c- b+ p* u: S+ `- } $date = date("Ymd");
: ?; y: V1 k! v) j- H% K2 M $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
5 ~. j: l5 n+ ]8 F' q1 f4 K3 n) a //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

9 K" v! c, p4 M if(!in_array($nameExt, $allowedType)){
9 p& g" F* a" x& n- R8 T  $msg = 0;
/ F. ~: d; r2 j. S% s }
  Y) x. }7 y* H4 Z1 U1 M2 X if(empty($msg)){
# I* H% ~1 b3 n; N: i  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
+ p6 K0 k* m) z5 h) q( Z: Q4 v  
  $filename = $dest.$filename;
) ?5 S$ i- ~( Y/ L5 w! g) w  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
" `& h. [( w: N7 a  H8 Z; ]  
  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
  }else{
) n5 w, `4 u7 w' S   $msg = 0;
  }
}
3 L. |' q9 m2 b $outMsg = "fileUrl=".$msg;
& @( N% l  ^5 H7 O+ B( F: _# b* Y $_SESSION["eoutmsg"] = $outMsg;
exit;
8 p# y1 ]3 K3 V6 }3 D2 \}else if($operateId == 2){
+ m# O5 @& k) L $outMsg = $_SESSION["eoutmsg"];
! R7 N0 c& r8 C* T if(!empty($outMsg)){
! V/ U: T+ j( f! h/ H& E  session_unregister("eoutmsg");
$ r1 D. M. u" A! P5 Z# E  B  echo '&'.$outMsg;
  exit;
- p( ]# p6 c* s/ y }else{
  echo "&fileUrl=0";
, p5 ~) `1 z  ^2 m; [8 [7 @* D  exit;
}
7 ?5 q) C0 k/ S- H% e( o0 ^}

  k6 u: ]2 i; P6 q1 x- J$ efunction getmicrotime(){
6 j/ Q; \. e! p9 ]  ^# r3 [$ a1 h- A    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
4 d* ~' |# Q5 _+ w2 N; Z& ~1 t}

?>