[★]U+Smart Enjoyment WebSite—/Report/Upload/UploadFormImg.ashx—Unauthorized File Upload Vulnerability
输入“/”快速插入内容
[★]U+Smart Enjoyment WebSite—/Report/Upload/UploadFormImg.ashx—Unauthorized File Upload Vulnerability
[★]U+Smart Enjoyment WebSite—/Report/Upload/UploadFormImg.ashx—Unauthorized File Upload Vulnerability
用户8507用户8507
用户6144用户61447月24日修改
Company：Beijing Meite Software Technology Co., Ltd.
Product: U+Smart Enjoyment WebSite
Affected version: 18.6001.1096.1000
Vulnerability Type: CWE-434 (Unrestricted Upload of File with Dangerous Type)
Attack Vector: Network (Remote)
漏洞描述 (Description)：
The /Report/Upload/UploadFormImg.ashx interface of the U+ Smart Enjoyment system developed by Chengdu Youjia Changjie Technology Co., Ltd. exhibits a file upload vulnerability. This vulnerability arises from the system's failure to conduct comprehensive type verification, extension name checking, and content filtering before storing user-uploaded files on the server. Attackers can exploit this vulnerability by uploading maliciously crafted files (such as ashx files containing malicious software) to persistently store executable scripts on the server. When other users access the file or the server processes and executes the file, risks such as remote code execution, server takeover, sensitive data leakage, website tampering, or further internal network penetration may occur.
Impact Score (CVSS v3.1):
◦
Attack Vector (AV): Network (只要能联网就能打)
◦
Attack Complexity (AC): Low (无需特殊条件)
◦
Privileges Required (PR): None (未授权)
◦
User Interaction (UI): None (无需管理员点链接)
◦
Scope (S): Changed
◦
Confidentiality (C): High
◦
Integrity (I): High
◦
Availability (A): High
Vulnerability POC
This vulnerability widely affects the U+智享版 system. Attackers can use network security mapping tools such as Hunter to search and query web. body="U+智享版" to obtain a large number of global public network targets using the system.
1.
Unauthorized file upload path found: /Report/Upload/UploadFormImg.ashx，The prompt request type is empty.