关于畅捷通T+SaveFileInfoToFile接口存在任意文件上传漏洞的安全通告

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.ufida168.com/case_detail/4377.html
• https://www.ufida168.com/news/19/
• https://it.ruc.edu.cn/wlaq/b9e593cfb51742c9a55d1f7210815e9a.htm
• https://blog.nsfocus.net/t/
• https://www.secrss.com/articles/46391
• https://www.chanjet.com/news/123919.html
• https://www.njucm.edu.cn/its/2023/0605/c4052a113704/page.htm

Related Vulnerabilities

• 畅捷通T+系统 AccountExtendRuleController接口处存在反序列化漏洞
• PoC畅捷通T+ /tplus/GLSyncService.asmx/SimulationLoginNew SQL 注入漏洞
• 畅捷通信息技术股份有限公司畅捷通T+存在SQL注入漏洞
• 畅捷通T+ DownLoadBlockFile 存在任意文件读取漏洞
• PoC畅捷通T+ /tplus/FormReport/FormReportOperateAction.aspx 文件读取漏洞
• 畅捷通T+ /tplus/ajaxpro/Ufida.T.SM.UIP.MultiCompanySettingController.Ufida.T.SM.UIP.ashx SQL 注入漏洞
• 畅捷通-TPlus /tplus/ajaxpro/ASP_sm_setupaccount_versionupdate_selectbackupfileonserver_aspx App_Web_selectbackupfileonserver.aspx.1cbd2a00.ashx 目录遍历漏洞
• 用友 畅捷通T+ InitContext 登录绕过漏洞
• 用友 畅捷通T+ SaveFileInfoToFile 任意文件上传漏洞
• 用友 畅捷通T+ GetRecordAll 敏感信息泄露漏洞
• 畅捷通T+ ME_MemberIntegral_IntegralAdjust 存在反序列化漏洞
• 畅捷通T+ getdecallusers信息泄露漏洞