泛微OA 后台任意文件上传漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AE-eoffice-webservice-file-upload%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
• https://cloud.tencent.com/developer/article/2118444
• https://blog.csdn.net/qq_34780861/article/details/137801061
• https://bbs.chaitin.cn/topic/37
• https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/oa/%E6%B3%9B%E5%BE%AEOA-E-cology-KtreeUploadAction-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
• https://www.hackjie.com/docs/3324.html
• https://ta0ing.github.io/article/b8b3650.html
• https://github.com/zan8in/wy876-POC/blob/main/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEE-Cology-KtreeUploadAction%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
• https://www.modb.pro/db/190091
• https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/oa/%E6%B3%9B%E5%BE%AEOA-E-Office-OfficeServer.php-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md

Related Vulnerabilities

• PoC泛微OA E-Cology /rest/ofs/ProcessDoneRequestByXml XML 外部实体注入漏洞
• PoC泛微OA E-Cology /rest/ofs/ReceiveTodoRequestByXml XML 外部实体注入漏洞
• PoC泛微OA E-Cology /rest/ofs/deleteRequestInfoByXml XML 外部实体注入漏洞
• 泛微OA /dwr/call/plaincall/ 权限绕过漏洞
• 泛微OA weaver.common.Ctrl 任意文件上传漏洞
• PoC泛微OA ShowDocsImage SQL注入漏洞
• PoC泛微OA E-Cology Action.jsp mobile.skin.SkinAction 任意文件上传漏洞
• e-office-v10-officeserver-upload: 泛微OA E-Office OfficeServer.php 任意文件上传漏洞
• 泛微 OA E-Cology deleteUserRequestInfoByXml 文件读取漏洞（CVE-2023-2806）
• 泛微OA /weaver/weaver.file.FileDownloadForOutDoc SQL 注入漏洞