Description
大华DSS安防监控系统平台采用ApacheStruts2作为网站应用框架。/portal/login_init.action接口存在远程命令执行漏洞，攻击者可以通过在上传文件时修改HTTP请求标头中的ContentType值来触发该漏洞，然后执行该漏洞。系统命令以获取服务器权限
大华DSS城市安防监控平台 login_init.action 命令执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/adysec/POC/blob/main/wpoc/%E5%A4%A7%E5%8D%8E/%E5%A4%A7%E5%8D%8EDSS%E5%9F%8E%E5%B8%82%E5%AE%89%E9%98%B2%E7%9B%91%E6%8E%A7%E5%B9%B3%E5%8F%B0login_init.action%E6%8E%A5%E5%8F%A3%E5%AD%98%E5%9C%A8Struct2-045%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
https://ddpoc.com/DVB-2025-8706.html
https://cn-sec.com/archives/2830038.html
https://stack.chaitin.com/vuldb/detail/91aa3f01-62f7-44c2-b4cf-8fd5ab0f5b78
https://www.gitlink.org.cn/dnrops/2024-HW-PocLib