A general-purpose electronic procurement platform has the Arbitrary File Upload Vulnerability GETSHELL

A general-purpose electronic procurement platform has the Arbitrary File Upload Vulnerability GETSHELL

 

Detailed description:

#1. carefully studying and finding that uploading arbitrary files in an editor can result in batch Getshell, which has a great impact.

Vendor:
 

Http://www.1caitong.com/Beijing wangda Xinlian Technology Development Co., Ltd.

#2. Getshell vulnerability.
 

/Ftb. imagegallery. aspx can directly upload asp files

 

 

[Declare that the following cases are for CNCERT and CNVD repeat tests only. Others shall not use or use it to maliciously destroy them. Otherwise, the consequences will be borne by you !]

#3. Case test:
 

http://eps.gfgt.com/ftb.imagegallery.aspx

 

 

 

http://eps.lomon.com:8008/ftb.imagegallery.aspx

 

 

http://ebid.rsm.com.cn:88/ftb.imagegallery.aspx

 

 

http://eps.hjgrp.com/ftb.imagegallery.aspx

 

 

http://www.bidding-mro.com/ftb.imagegallery.aspx

 

 

Solution:

None of the above tests were conducted. shell has all been deleted. Click here. Thank you for your support and understanding! Ask the national Internet emergency center to inform the manufacturer of the solution as soon as possible ~