用友 U8 cloud nc.itf.uap.pfxx.IPFxxFileService 存在任意文件上传漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://github.com/0day404/HV-2024-POC/blob/main/%E7%94%A8%E5%8F%8BU8-Cloud%20upload%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
• https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/oa/%E7%94%A8%E5%8F%8B-U8-cloud-upload.jsp-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
• https://www.cnblogs.com/Domren/articles/19242469
• https://github.com/adeljck/YongYou-Exploit
• https://dev.to/sharon_42e16b8da44dabde6d/critical-file-upload-vulnerability-in-yonyou-u8-cloud-ipfxxfileservice-22k1
• https://www.cnblogs.com/pa0fu/p/18269408
• https://cn-sec.com/archives/4921912.html
• https://www.siukwai.com/archives/gNVjbOoL
• https://comate.baidu.com/zh/page/g2tn5f7u8qi
• https://www.zbysec.com/?mod=news_detail&id=112

Related Vulnerabilities

• 金蝶eascloud管理控制端任意文件上传
• PoCCVE-2026-18072: Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass
• PoCCVE-2026-27960: OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation
• PoCarangodb-auth-bypass: ArangoDB - Authentication Bypass via URL-Encoded Underscore (%5f) to RCE
• PoCCVE-2026-19092: Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation
• PoCCVE-2026-29962: HSC MailInspector - Local File Inclusion
• PoCCVE-2026-85200: GEO my WP <=4.5.5.3 - Unauthenticated Local File Inclusion
• 关于U9 cloud存在接口XML注入漏洞的安全通告
• 关于U9 cloud存在接口SQL注入漏洞的安全通告
• 关于U9 cloud存在接口无授权访问漏洞的安全通告
• 关于U8cloud所有版本CodeSyncServlet接口存在任意文件下载漏洞的安全通告
• 关于NC Cloud及YonBIP高级版系统的公共入口接口漏洞安全通告
• 畅捷通 T+ POSSyncService.asmx 接口SQL注入漏洞