金蝶云星空 kdfile 文件存在任意文件上传漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.cnblogs.com/Domren/articles/18735718
• https://www.h3c.com/cn/d_202312/1978826_30003_0.htm
• https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E9%87%91%E8%9D%B6/%E9%87%91%E8%9D%B6OA%E4%BA%91%E6%98%9F%E7%A9%BA%20ScpSupRegHandler%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
• https://www.secrss.com/articles/60830
• https://security.zone.ci/vulns/msec/307880.html
• http://nic.cqrk.edu.cn/2023_11/20_10/content-42387.html
• https://stack.chaitin.com/vuldb/detail/eff4c35e-ee6c-4ef3-aa17-0debe079b983
• https://blog.csdn.net/qq_56698744/article/details/134398238
• https://www.ddpoc.com/DVB-2023-5400.html
• https://it.shanghaitech.edu.cn/2024/0409/c8406a1093717/page.htm
• https://zone.ci/vulns/msec/307881.html
• https://blog.csdn.net/weixin_43981050/article/details/134523305

Related Vulnerabilities

• 金蝶云星空 /Kingdee.BOS.WebApi.ServicesStub.AuthService.ValidateLoginInfo.common.kdsvc 命令执行漏洞
• PoCjindie-yunxingkong-dynamicformservice-rce: 金蝶云星空DynamicFormService.CloseForm.common.kdsvc远程代码执行漏洞
• PoCkindee-scpsupreghandler-fileupload: 金蝶云星空ScpSupRegHandler任意文件上传
• PoCkingdee-cloud-user-deserialization-rce: 金蝶云星空 UserService 反序列化远程代码执行
• PoCkingdee-commonfileserver-fileread: 金蝶云星空 CommonFileserver 任意文件读取漏洞
• PoCkingdee-deserialization-rce: 金蝶云星空反序列化rce
• 金蝶云星空 /Kingdee.BOS.ServiceFacade.ServicesStub.InOutDataService.GetImportOutData.common.kdsvc 命令执行漏洞
• 金蝶云星空 BusinessDataService.BatchLoad.common.kdsvc 远程代码执行漏洞
• PoC金蝶云星空 /Kingdee.BOS.ServiceFacade.ServicesStub.AppDesigner.AppDesignerService.RecordCurDevCodeInfo.common.kdsvc 命令执行漏洞
• 金蝶云星空 /kingdee.BOS.ServiceFacade.ServicesStub.BusinessData.BusinessDataService.BatchLoad.common.kdsvc 代码执行漏洞