daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/vulnerabilities/other/zhiyuan-file-upload.yaml

30 lines
774 B
YAML
Raw Normal View History

Create zhiyuan-file-upload.yaml Zhiyuan OA is a set of office coordinating management software. Recently, Qianxin CERT monitors the relevant vulnerability information of the long OA. Since there is an unauthorized access in some interfaces, and some functions are insufficient, the attacker can upload malicious script files without logging in, so that there is no need to log in. Zhiyuan OA official has provided patches for this vulnerability. In view of the large vulnerability harm, it is recommended that users apply patch updates as soon as possible. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-02 02:07:14 +00:00
id: zhiyuan-file-upload
info:
name: Zhiyuan Oa arbitrary file upload vulnerability
author: gy741
severity: critical
Description
2021-10-25 07:06:44 +00:00
description: A vulnerability in Zhiyuan Oa allows remote unauthenticated attackers to upload arbitrary files to the remote server which they can later access and cause their code to be executed.
Create zhiyuan-file-upload.yaml Zhiyuan OA is a set of office coordinating management software. Recently, Qianxin CERT monitors the relevant vulnerability information of the long OA. Since there is an unauthorized access in some interfaces, and some functions are insufficient, the attacker can upload malicious script files without logging in, so that there is no need to log in. Zhiyuan OA official has provided patches for this vulnerability. In view of the large vulnerability harm, it is recommended that users apply patch updates as soon as possible. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-02 02:07:14 +00:00
reference: https://www.programmersought.com/article/92658169875/
tags: zhiyuan,rce
requests:
- method: GET
path:
- "{{BaseURL}}/seeyon/thirdpartyController.do.css/..;/ajax.do"
matchers-condition: and
matchers:
- type: word
words:
- "java.lang.NullPointerException:null"
- type: word
words:
- "text/html"
part: header
- type: status
status:
- 200