.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
, D1 Y' D$ G" O0 G- h0 _/**
: B( q2 Y! M  R5 Q" R7 p$ s * uploadFlash.php
/ x7 c- Q! n4 M) O& ?9 F- U( a * Flash文件上传.
* p" P8 U& I. @& E7 y/ l6 k: f8 U */
require_once('../global.inc.php');

+ R$ T2 \5 ~* g& Q- I2 |//operateId=1 上传,operateId=2 获取地址.
3 Z" Q, x7 O# t: M% b$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
2 G" t3 f4 s5 S; \- L4 Y5 B4 K8 e //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

- n( Y( L0 W7 r6 e# y; a0 p6 L( W $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
6 N9 J/ A0 a& B1 C  $msg = 0;
}
7 o- S$ _2 }& q- b! V$ c if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
$ W, K7 i$ D9 e. |  $filename = $dest.$filename;
( I$ H, h+ S2 H2 M9 O" J  if(empty($_FILES['Filedata']['error'])){
/ g: s2 r$ z, m' P9 i& T: m" \   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
  
6 ?, x8 a9 b0 z) O( [  if (file_exists($filename)){
' n6 }9 i; J! u   //$msg = 1;
   $msg = $file_url;
5 h* }9 w# u, g/ R: c/ G   @chmod($filename, 0444);
" i0 g+ e/ P& ^  }else{
   $msg = 0;
5 j: n9 d/ y, E; X: R  }
}
$ j% X: P) ]: @! } $outMsg = "fileUrl=".$msg;
' `1 S. m9 j( n2 C1 ]6 o2 K7 t $_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
( D2 p+ x0 ?! e  V- k $outMsg = $_SESSION["eoutmsg"];
7 j+ \. Q# [% }: B) A6 a; Y% @ if(!empty($outMsg)){
  session_unregister("eoutmsg");
8 _# c3 Y- f7 ?  R) D/ v  echo '&'.$outMsg;
  exit;
}else{
! M7 X" s$ V6 a  e9 U  echo "&fileUrl=0";
. ~  p: n( k( X7 q* ^3 ^  exit;
}
6 u0 z" z% n1 ]3 N}
+ M% ~  l. V3 |4 w
) i3 i1 W, f+ Y0 h% D/ f' w1 Bfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
* N8 b8 _. D" ]}
6 m) u! H( W' g, d4 n
?>