泛微OA9 前台無限制Getshell漏洞

From PwnWiki
Revision as of 21:23, 26 May 2021 by Pwnwiki (talk | contribs) (Created page with "利用非常简单,只要对目標")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Other languages:
Chinese • ‎中文（繁體）‎

漏洞信息

漏洞位於:/page/exportImport/uploadOperation.jsp文件中


Jsp流程大概是:判斷請求是否是multipart請求。

重點關注File file=new File(savepath+filename),

Filename參數,是前台可控的,並且沒有做任何過濾限制。

利用非常简单,只要对目標

127.0.0.1/page/exportImport/uploadOperation.jsp

發送一个multipartRequest即可。


然後請求路徑: 

view-source:http://112.91.144.90:5006/page/exportImport/fileTransfer/1.jsp
Retrieved from "https://pwnwiki.com/index.php?title=泛微OA9_前台無限制Getshell漏洞/zh-hant&oldid=3410"