漏洞描述
灵当CRM<=V8.6.3.3.11 版本的popup.php文件允许任意文件上传，然后上传php文件进行服务器权限获取
灵当CRMV8.6.3.3.11 uploadify.php文件上传
PoC代码
暂无相关漏洞推荐
- 灵当 CRM /crm/WeiXinApp/yunzhijia/yunzhijiaApi.php SQL 注入漏洞
- western-digital-mycloud-multi-uploadify-file-upload: Western Digital MyCloud Multi Uploadify File Upload
- POC eoffice-v9-uploadify-fileupload: 泛微 E-Office v9.5 uploadify 任意文件上传漏洞
- POC huatiandongli-oa-downloadfortrace-fileread: 灵当CRM Playforrecord.php 任意文件读取漏洞
- POC lingdang-crm-playforrecord-fileread: 灵当CRM Playforrecord.php 任意文件读取漏洞
- POC weaver-lazyuploadify-file-upload: OA E-Office LazyUploadify - Arbitrary File Upload
- POC weaver-uploadify-file-upload: OA E-Office Uploadify - Arbitrary File Upload
- 灵当CRM yunzhijiaApi.php 存在SQL注入漏洞（CVE-2025-8345）
- 灵当CRM /crm/WeiXinApp/marketing/index.php 服务器端请求伪造漏洞
- 灵当CRM /crm/wechatSession/index.php 文件上传漏洞
- 灵当 CRM /crm/WeiXinApp/CallRecordLog/getLogInfo.php 文件上传漏洞
- 灵当CRM /crm/modules/XlsImportNew/documentEntry/XlsFileUpload.php 文件上传漏洞
- 灵当CRMV8.6.3.3.11 getLogInfo.php文件上传