2022-05-17 17:43:20 +08:00
|
|
|
# 安徽阳光心健 心理测量平台 目录遍历漏洞 CNVD-2021-01929
|
|
|
|
|
|
|
|
|
|
## 漏洞描述
|
|
|
|
|
|
|
|
|
|
安徽阳光心健心理咨询有限公司心理测量平台存在目录遍历漏洞，攻击者可利用该漏洞获取敏感信息。
|
|
|
|
|
|
|
|
|
|
## 漏洞影响
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
安徽阳光心健 心理测量平台
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## FOFA
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
icon_hash="-320896955"
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## 漏洞复现
|
|
|
|
|
|
|
|
|
|
主页如下
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
2022-05-17 17:43:20 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
扫描目录
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
2022-05-17 17:43:20 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
访问 http://xxx.xxx.xxx.xxx/admin/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
2022-05-17 17:43:20 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
其中 http://xxx.xxx.xxx.xxx/admin/UserFiles/ 中还包含了用户信息可未授权下载
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
