mirror of https://github.com/qwqdanchun/Goby.git
148 lines
6.5 KiB
JSON
148 lines
6.5 KiB
JSON
{
|
||
"Name": "SangFor Application Delivery login.php Command Execution",
|
||
"Description": "<p>Deep convinced application delivery can provide users with a comprehensive solution including multi-data center load balancing, multi-link load balancing and server load balancing. It not only realizes the real-time monitoring of the status of each data center, link and server, but also assigns the user's access request to the corresponding data center, link and server according to the preset rules, so as to realize the reasonable distribution of data flow and make full use of all data centers, links and servers. The 3.8 version /report/script/login. PHP file has arbitrary file reading vulnerability, through which the attacker can arbitrarily execute the code on the server side, write the back door, obtain the server permission, and then control the whole Web server.<br></p>",
|
||
"Product": "SangFor Application Delivery",
|
||
"Homepage": "https://www.sangfor.com.cn/product-and-solution/sangfor-its/5?utm_source=baidu&utm_medium=cpc&utm_campaign=%E4%BA%A7%E5%93%81-%E6%96%B0IT-AD&utm_content=%E5%BA%94%E7%94%A8%E4%BA%A4%E4%BB%98-%E6%A0%B8%E5%BF%83%E8%AF%8D&utm_term=%E5%BA%94%E7%94%A8%E4%BA%A4%E4%BB%98%E7%B3%BB%E7%BB%9F&bd_vid=9811747945155761359",
|
||
"DisclosureDate": "2022-03-23",
|
||
"Author": "1171373465@qq.com",
|
||
"FofaQuery": "title=\"ad.sangfor.com\"",
|
||
"GobyQuery": "title=\"ad.sangfor.com\"",
|
||
"Level": "2",
|
||
"Impact": "<p>Through this vulnerability, the attacker can arbitrarily execute the code on the server side, write the back door, obtain the server permission, and then control the whole Web server.<br></p>",
|
||
"Recommendation": "<p>Vendor has released leaks fixes, please pay attention to update: <a href=\"https://www.sangfor.com.cn\">https://www.sangfor.com.cn</a><br></p>",
|
||
"References": [
|
||
"https://fofa.so"
|
||
],
|
||
"Is0day": false,
|
||
"HasExp": true,
|
||
"ExpParams": [
|
||
{
|
||
"name": "Cmd",
|
||
"type": "input",
|
||
"value": "id"
|
||
}
|
||
],
|
||
"ExpTips": {
|
||
"Type": "",
|
||
"Content": ""
|
||
},
|
||
"ScanSteps": [
|
||
"AND",
|
||
{
|
||
"Request": {
|
||
"method": "GET",
|
||
"uri": "/test.php",
|
||
"follow_redirect": false,
|
||
"header": {},
|
||
"data_type": "text",
|
||
"data": ""
|
||
},
|
||
"ResponseTest": {
|
||
"type": "group",
|
||
"operation": "AND",
|
||
"checks": [
|
||
{
|
||
"type": "item",
|
||
"variable": "$code",
|
||
"operation": "==",
|
||
"value": "200",
|
||
"bz": ""
|
||
},
|
||
{
|
||
"type": "item",
|
||
"variable": "$body",
|
||
"operation": "contains",
|
||
"value": "",
|
||
"bz": ""
|
||
}
|
||
]
|
||
},
|
||
"SetVariable": []
|
||
}
|
||
],
|
||
"ExploitSteps": [
|
||
"AND",
|
||
{
|
||
"Request": {
|
||
"method": "GET",
|
||
"uri": "/test.php",
|
||
"follow_redirect": false,
|
||
"header": {},
|
||
"data_type": "text",
|
||
"data": ""
|
||
},
|
||
"ResponseTest": {
|
||
"type": "group",
|
||
"operation": "AND",
|
||
"checks": [
|
||
{
|
||
"type": "item",
|
||
"variable": "$code",
|
||
"operation": "==",
|
||
"value": "200",
|
||
"bz": ""
|
||
},
|
||
{
|
||
"type": "item",
|
||
"variable": "$body",
|
||
"operation": "contains",
|
||
"value": "",
|
||
"bz": ""
|
||
}
|
||
]
|
||
},
|
||
"SetVariable": []
|
||
}
|
||
],
|
||
"Tags": [
|
||
"Command Execution"
|
||
],
|
||
"VulType": [
|
||
"Command Execution"
|
||
],
|
||
"CVEIDs": [
|
||
""
|
||
],
|
||
"CNNVD": [
|
||
""
|
||
],
|
||
"CNVD": [
|
||
""
|
||
],
|
||
"CVSSScore": "10.0",
|
||
"Translation": {
|
||
"CN": {
|
||
"Name": "深信服 应用交付报表系统 login.php 远程命令执行漏洞",
|
||
"Product": "深信服 应用交付报表系统",
|
||
"Description": "<p>深信服应用交付 AD 能够为用户提供包括多数据中心负载均衡、多链路负载均衡、服务器负载均衡的全方位解决方案。不仅实现对各个数据中心、链路以及服务器状态的实时监控，同时根据预设规则，将用户的访问请求分配给相应的数据中心、 链路以及服务器，进而实现数据流的合理分配，使所有的数据中心、链路和服务器都得到充分利用。其中3.8版本 /report/script/login.php 文件存在任意文件读取漏洞，<span style=\"font-size: 16px;\">攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个web服务器。</span><br></p>",
|
||
"Recommendation": "<p>厂商已发布了漏洞修复程序，请及时关注更新： <a href=\"https://www.sangfor.com.cn\">https://www.sangfor.com.cn</a><br></p>",
|
||
"Impact": "<p><span style=\"color: rgba(255, 255, 255, 0.87); font-size: 16px;\">攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个web服务器。</span><br></p>",
|
||
"VulType": [
|
||
"命令执⾏"
|
||
],
|
||
"Tags": [
|
||
"命令执⾏"
|
||
]
|
||
},
|
||
"EN": {
|
||
"Name": "SangFor Application Delivery login.php Command Execution",
|
||
"Product": "SangFor Application Delivery",
|
||
"Description": "<p>Deep convinced application delivery can provide users with a comprehensive solution including multi-data center load balancing, multi-link load balancing and server load balancing. It not only realizes the real-time monitoring of the status of each data center, link and server, but also assigns the user's access request to the corresponding data center, link and server according to the preset rules, so as to realize the reasonable distribution of data flow and make full use of all data centers, links and servers. The 3.8 version /report/script/login. PHP file has arbitrary file reading vulnerability, through which the attacker can arbitrarily execute the code on the server side, write the back door, obtain the server permission, and then control the whole Web server.<br></p>",
|
||
"Recommendation": "<p>Vendor has released leaks fixes, please pay attention to update: <a href=\"https://www.sangfor.com.cn\">https://www.sangfor.com.cn</a><br></p>",
|
||
"Impact": "<p>Through this vulnerability, the attacker can arbitrarily execute the code on the server side, write the back door, obtain the server permission, and then control the whole Web server.<br></p>",
|
||
"VulType": [
|
||
"Command Execution"
|
||
],
|
||
"Tags": [
|
||
"Command Execution"
|
||
]
|
||
}
|
||
},
|
||
"AttackSurfaces": {
|
||
"Application": null,
|
||
"Support": null,
|
||
"Service": null,
|
||
"System": null,
|
||
"Hardware": null
|
||
}
|
||
} |