Description
用友U8 Cloud是一款面向成长型、创新型企业的云ERP系统，提供企业级云ERP整体解决方案。用友U8Cloud的IFileTrans接口存在文件上传漏洞，由于其上传功能未对上传内容进行严格校验，攻击者可实现任意文件上传并获取服务器权限。
用友 U8 Cloud /ServiceDispatcherServlet IFileTrans 文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/hackoadmin/POC2/blob/main/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8BU8-Cloud%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3esnserver%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
https://www.cnblogs.com/cwkiller/p/19030876
https://stack.chaitin.com/vuldb/detail/ff7df135-8a40-4bd9-87e2-bf586bdf90c1
https://www.secrss.com/articles/59025
https://blog.nsfocus.net/u8cloud-servicedispatcher/
https://zhuanlan.zhihu.com/p/664992281
https://www.h3c.com/cn/d_202310/1949410_30003_0.htm