Description
发票抽奖平台存在默认的测试账号，文件 /Invoice/plugins/uploadify/uploadFile.jsp可以上传任意文件，登陆后台后即可上传 jsp 文件。
发票抽奖平台 /Invoice/plugins/uploadify/uploadFile.jsp 任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/FH%20Admin/FH%20Admin%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E/
https://cn-sec.com/archives/2181284.html