### 简要描述：
最近公司也买了这系统，对系统测试了下发现存在漏洞，官网demo同样存在这漏洞。
财务系统如果对外了被拿权限了确实很麻烦。
### 详细说明：
漏洞地址
```
http://**.**.**.**/k3cloud/
```
漏洞代码如下
```
public void ProcessRequest(HttpContext context)
{
try
{
context.Response.ContentType = "text/plain";
string physicalPath = context.Request.Headers["filefolder"];
if (string.IsNullOrEmpty(physicalPath))
{
physicalPath = context.Server.MapPath("UploadFiles");
}
else
{
physicalPath = PathUtils.GetPhysicalPath(physicalPath);
}
if (!Directory.Exists(physicalPath))
{
Directory.CreateDirectory(physicalPath);
}
HttpFileCollection files = context.Request.Files;
int count = files.Count;
if (count > 0)
{
for (int i = 0; i < count; i++)
{
HttpPostedFile file = files[i];
if ((file != null) && (file.ContentLength > 0))
{
string filename = physicalPath + "/" + file.FileName;
file.SaveAs(filename);
}
}
context.Response.Write("0");
}
else
{
string str3 = context.Request.Headers["Name"].ToString();
if (string.IsNullOrWhiteSpace(str3))
{
str3 = "null";
}
FileStream stream = new FileStream(physicalPath + "/" + str3, FileMode.Append);
context.Request.InputStream.CopyTo(stream);
stream.Flush();
stream.Close();
context.Response.Write("1");
}
}
catch (Exception exception)
{
context.Response.Write("-1");
throw exception;
}
}
```
没有对上传文件类型进行判断。
### 漏洞证明：
随便找了个网站
```
http://**.**.**.**/k3cloud
```
[<img src="https://images.seebug.org/upload/201512/0419511748fa839a1a068e4ff9adb767b304b9d0.png" alt="9.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201512/0419511748fa839a1a068e4ff9adb767b304b9d0.png)
[<img src="https://images.seebug.org/upload/201512/041951408d063a7b79df1999a6078de2759e6d24.png" alt="10.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201512/041951408d063a7b79df1999a6078de2759e6d24.png)
[<img src="https://images.seebug.org/upload/201512/0419515209dfb8bead1834d394e08c395db43c88.png" alt="11.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201512/0419515209dfb8bead1834d394e08c395db43c88.png)
官网demo
[<img src="https://images.seebug.org/upload/201512/04195319988a05dde7356f833d50a4a6154e4c24.png" alt="12.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201512/04195319988a05dde7356f833d50a4a6154e4c24.png)
[<img src="https://images.seebug.org/upload/201512/04195335124afe538d8a4e80659055454b3c79e9.png" alt="13.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201512/04195335124afe538d8a4e80659055454b3c79e9.png)
京公网安备 11010502034610号
Unavailable Comments