.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
* uploadFlash.php
5 m3 e( t1 U8 v1 a# r) { * Flash文件上传.
; ?9 m" N9 }' E) k) a0 ?0 q9 } */
require_once('../global.inc.php');
# I' r8 h1 I! }+ G& [, ~, C6 y
6 J6 ]& U# {; @, Y3 o* C4 H//operateId=1 上传,operateId=2 获取地址.
  b, w2 u7 |! @' t' i5 J2 A$operateId = intval($_REQUEST['operateId']);
# D  i' I$ x" c3 u; p( Aif(empty($operateId)) exit;
5 w: c+ O. F# M/ m: ~
if($operateId == 1){
  Z# P; U  I' { $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
9 o5 o* B8 A/ ^7 d) [( c- G $COMMON->createDir($dest);
2 n  N% u, _' u //if (!is_dir($dest)) mkdir($dest, 0777);
; J' \( Z$ ^( _1 U: {5 t
/ I5 @' V; N( D $nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
) l3 Z: S2 h3 t) M) x
$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
4 j5 j1 h- s4 T3 A6 N: N% T
; m0 K3 T' ]& J0 e" k$ S if(!in_array($nameExt, $allowedType)){
  $msg = 0;
( K0 u7 f) H, U9 H, o7 { }
if(empty($msg)){
7 x8 d6 X4 K- {$ X. H  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
' U% I& x3 F0 h/ H% D  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
0 y  M3 e+ i* \  }
  
% X8 \: X6 ~; i  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
# c4 m) `& T( d/ B0 T$ ?5 D+ b0 s   @chmod($filename, 0444);
* z4 O1 O6 q0 j8 ~( h2 S; R  }else{
   $msg = 0;
  }
/ |" X' X" k& H; T }
/ C2 C8 E, Z' ]6 G2 ~) K) k $outMsg = "fileUrl=".$msg;
' R' K" ^7 W& p; N6 U# w* v $_SESSION["eoutmsg"] = $outMsg;
exit;
}else if($operateId == 2){
% Z/ `* }8 `% e$ U8 f $outMsg = $_SESSION["eoutmsg"];
- d0 W% M9 v4 C if(!empty($outMsg)){
  session_unregister("eoutmsg");
# h0 r$ K) x/ U9 C  echo '&'.$outMsg;
  exit;
}else{
$ h& ?0 J" a  B) k! s  echo "&fileUrl=0";
  exit;
}
}

3 a7 K& T9 L2 F: {6 |function getmicrotime(){
/ \$ h6 u3 Z, E- D$ W2 o    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
! T6 ]( N% U% O* T}
, B) v9 {2 c; G# x& h- c! N* T' H
- w' b* v) h! K; S) w?>
1 B1 n1 m1 p2 e1 D3 x8 n