Description
I Doc View是一款由北京卓软在线信息技术有限公司开发的在线文档预览工具，主要为用户提供各种类型文档的在线预览服务，而无需下载或安装相应软件。该工具的/html/2word接口存在文件上传漏洞，攻击者可以通过该漏洞上传恶意文件，从而获取服务器权限，导致系统安全受到严重威胁。
I Doc View 在线文档预览系统 /html/2word 文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://cloud.tencent.com/developer/article/2376094
https://github.com/adysec/POC/blob/main/wpoc/iDocView/I%20Doc%20View%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
https://zhuanlan.zhihu.com/p/668379259
http://www.bmth666.cn/2023/12/15/I-Doc-View%E5%9C%A8%E7%BA%BF%E6%96%87%E6%A1%A3%E9%A2%84%E8%A7%88-%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/index.html
https://blog.csdn.net/xiayu729100940/article/details/135068973
https://cn-sec.com/archives/2302149.html
https://stack.chaitin.com/vuldb/detail/d7bb33fc-d7e0-4a26-855b-fccffb054cc3
https://www.secrss.com/articles/60990
https://www.ddpoc.com/DVB-2024-5853.html
https://www.wangsu.com/news/content/blog/3618
https://www.h3c.com/cn/d_202312/1978829_30003_0.htm
https://loudongyun.360.net/leakDetail/KgndYhsjd%2Fk%3D