.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
) Z2 ^5 R( d' O; a# P/**
5 @8 ?( ~' t0 y, K" i * uploadFlash.php
. j6 E6 @5 }2 q * Flash文件上传.
3 Z3 t' W4 S3 o. A2 A6 } */
4 {0 b6 T  ]6 V8 v1 `! I, urequire_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
$ n4 \  h5 H0 q- e; S- p' Xif(empty($operateId)) exit;

if($operateId == 1){
$date = date("Ymd");
7 i% d) q* E7 T $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
& R; H. F  X9 L- _6 T //if (!is_dir($dest)) mkdir($dest, 0777);

' u0 h! q' O, w0 x% h $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

: W! ^& T9 g: b  W& h% D. m $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');

if(!in_array($nameExt, $allowedType)){
4 ^' `& \. t% [. F& S6 X& T" t  $msg = 0;
  {$ R9 }% [( _ }
if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
5 o9 l2 {+ c7 _5 B/ p$ i/ R6 o1 J1 ]  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
& ]$ U5 o: U/ x  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
, p5 a2 o0 ?8 D  
/ m& T( P, W& f1 k' `  if (file_exists($filename)){
$ |8 Y# \. K0 Y+ u4 K' v   //$msg = 1;
   $msg = $file_url;
   @chmod($filename, 0444);
9 b3 m6 N* ~- u5 e4 f; u  }else{
* t. T3 X( ^/ q3 ^5 G2 i/ U   $msg = 0;
  }
) W6 O; p9 C1 i( Z7 I }
! @; v3 s# l' S$ k $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
, l1 U/ m- J; n  _! ? if(!empty($outMsg)){
  session_unregister("eoutmsg");
  echo '&'.$outMsg;
+ H, b* |8 v; ]- o3 O, v  exit;
8 b7 I  ^/ W# F }else{
5 a5 e$ |$ e6 s  |9 S" T. ~* Y' v  echo "&fileUrl=0";
  exit;
}
}

& t5 p5 p2 {! F8 G$ z, Gfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
+ l0 g) U% `& ~6 J: y, a& t}

?>