0x01 越权

0x02 任意文件上传

还是在提交申报那里，添加文件，抓包

并没有返回文件路径，但返回了id，所以要配合刚才的越权接口使用

成功解析

0x03 任意文件下载

0x04 任意权限的用户添加

<script type="text/javascript">    $(function() {        $('#userAddOrganizationId').combotree({            url : '/organization/tree',            parentField : 'pid',            lines : true,            panelHeight : '200'        });
        $('#userAddRoleIds').combotree({            url: '/role/tree',            multiple: true,            required: true,            panelHeight : 'auto'        });

        $('#sex').combobox({            url:'/dict/loadcombobox?code=sex',            method: 'get',            valueField:'val',            textField:'description',            panelHeight : 'auto',            groupField:'group'
        });
        $('#userType').combobox({            url:'/dict/loadcombobox?code=userType',            method: 'get',            valueField:'val',            textField:'description',            panelHeight : 'auto',            groupField:'group'        });
        $('#userStatus').combobox({            url:'/dict/loadcombobox?code=userStatus',            method: 'get',            valueField:'val',            textField:'description',            panelHeight : 'auto',            groupField:'group'        });
        $('#userAddForm').form({            url : '/user/add',            onSubmit : function() {                progressLoad();                var isValid = $(this).form('validate');                if (!isValid) {                    progressClose();                }                return isValid;            },            success : function(result) {                progressClose();                result = $.parseJSON(result);                if (result.success) {                    parent.$.modalDialog.openner_dataGrid.datagrid('reload');                    parent.$.modalDialog.handler.dialog('close');                } else {                    var form = $('#userAddForm');                    parent.$.messager.alert('提示', eval(result.msg), 'warning');                }            }        });
    });</script><div class="easyui-layout" data-options="fit:true,border:false">    <div data-options="region:'center',border:false" title="" style="overflow: hidden;padding: 3px;">        <form id="userAddForm" method="post">            <table class="grid">                <tr>                    <td>学工号</td>                    <td><input name="loginName" type="text" placeholder="请输入登录名称" class="easyui-validatebox" data-options="required:true" value=""></td>                    <td>姓名</td>                    <td><input name="name" type="text" placeholder="请输入姓名" class="easyui-validatebox" data-options="required:true" value=""></td>                </tr>                <tr>                    <td>密码</td>                    <td><input name="password" type="password" placeholder="请输入密码" class="easyui-validatebox" data-options="required:true"></td>                    <td>性别</td>                    <td>                        <input name="sex" class="easyui-textbox" id="sex" type="text" style="width: 140px; height: 29px;">
                    </td>                </tr>                <tr>                    <td>年龄</td>                    <td><input type="text" name="age" class="easyui-numberbox"/></td>                    <td>用户类型</td>                    <td>                        <input name="userType" class="easyui-textbox" id="userType" type="text" style="width: 140px; height: 29px;">                    </td>                </tr>                <tr>                    <td>部门</td>                    <td><select id="userAddOrganizationId" name="organizationId" style="width: 140px; height: 29px;" class="easyui-validatebox" data-options="required:true"></select></td>                    <td>角色</td>                    <td><select id="userAddRoleIds" name="roleIds" style="width: 140px; height: 29px;"></select></td>                </tr>                <tr>                    <td>电话</td>                    <td>                        <input type="text" name="phone" class="easyui-numberbox"/>                    </td>                    <td>用户状态</td>                    <td>                        <input name="status" class="easyui-textbox" id="userStatus" type="text" style="width: 140px; height: 29px;">                    </td>                </tr>            </table>        </form>    </div></div>

文章来源：先知社区（John）原文地址：https://xz.aliyun.com/t/1239排版：潇湘信安

黑白之道发布、转载的文章中所涉及的技术、思路和工具仅供以安全为目的的学习交流使用，任何人不得将其用于非法用途及盈利等目的，否则后果自行承担！

END