mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-05 10:50:23 +00:00
39 lines
631 B
Markdown
39 lines
631 B
Markdown
|
# TerraMaster TOS 用户枚举漏洞 CVE-2020-28185
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
TerraMaster TOS 存在用户枚举漏洞，通过wizard/initialise.php页面的username参数即可枚举系统中的用户，以及泄露邮箱信息
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
TerraMaster TOS < 4.2.06
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 网络测绘
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
"TerraMaster" && header="TOS"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
漏洞点来源于找回密码的用户存在校验
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
输入用户名 admin 点击确定，查看Burp捕获的包
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
其中有一个请求包用于确认用户admin是否存在
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
存在则返回用户的邮箱信息
|