\MCMS-master\src\main\java\com\mingsoft\basic\action\web\FileAction.java

The user interface is not authenticated on the upload interface, resulting in unauthorized access to the upload interface.

(https://images.gitee.com/uploads/images/2018/1029/214944_475a01e4_2110619.png "111.png")

The whitelist check is not performed on the file suffix name. The file suffix name is obtained according to the file passed in by the client and combined with the current time to form a new file name _fileName, and then combined with the uploadPath file path passed in from the client into a file. Store the path and then upload the file directly.

(https://images.gitee.com/uploads/images/2018/1029/215035_4929f32f_2110619.png "112.png")

Since this upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First upload a picture horse, then intercept the data packet in the name parameter that changes the suffix name to jsp, after the release request, the server returns the storage path of the webshell.

(https://images.gitee.com/uploads/images/2018/1029/215053_29f52256_2110619.png "113.png")

\MCMS-master\src\main\java\com\mingsoft\basic\action\web\FileAction.java

The user interface is not authenticated on the upload interface, resulting in unauthorized access to the upload interface.

https://images.gitee.com/uploads/images/2018/1029/214944_475a01e4_2110619.png

The whitelist check is not performed on the file suffix name. The file suffix name is obtained according to the file passed in by the client and combined with the current time to form a new file name _fileName, and then combined with the uploadPath file path passed in from the client into a file. Store the path and then upload the file directly.

https://images.gitee.com/uploads/images/2018/1029/215035_4929f32f_2110619.png

Since this upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First upload a picture horse, then intercept the data packet in the name parameter that changes the suffix name to jsp, after the release request, the server returns the storage path of the webshell.

https://images.gitee.com/uploads/images/2018/1029/215053_29f52256_2110619.png