We7cmd background upload to obtain webshell and repair solution

Author: Lu renjia

Vulnerability Type: Arbitrary Code Execution caused by File Upload
Vulnerability Description: the backend is not strictly filtered and the webshell is directly uploaded.

Filter is a Filter, is allowed to upload type, see the http://sdk26.we7.cn/html/c68dcc7c-d336-8c03-7fd7-cdbd18f025ef.htm

Obviously, if it is not filtered, it will be used directly. OK,
Go to the background, select template> edit template> Create template> Import static html. A dialog box is displayed,
Aspx? NoSelect = 0 & folder =/_ skins/r & filter = *. htm "> www.2cto.com/admin/Folder.aspx? NoSelect = 0 & folder =/_ skins/r & filter = *. htm
, Copy url, open in the window, modify www.2cto.com/admin/Folder.aspx? NoSelect = 0 & folder =/_ skins/r & filter = *. aspx
Upload webshell directly

Solution:
Filter Request ["filter "]