新开普掌上校园服务管理平台/api/v3/login任意命令执行

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://github.com/admin772/POC/blob/main/%E6%96%B0%E5%BC%80%E6%99%AE%E6%8E%8C%E4%B8%8A%E6%A0%A1%E5%9B%AD%E6%9C%8D%E5%8A%A1%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0/%E6%96%B0%E5%BC%80%E6%99%AE%E6%8E%8C%E4%B8%8A%E6%A0%A1%E5%9B%AD%E6%9C%8D%E5%8A%A1%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0service.action%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C.md
• https://cn-sec.com/archives/2247856.html
• https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/%E6%96%B0%E5%BC%80%E6%99%AE-%E5%89%8D%E7%BD%AE%E6%9C%8D%E5%8A%A1%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0-service.action-%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
• https://wlaq.sdws.edu.cn/2024/0117/c2095a55140/pagem.htm
• https://github.com/luck-ying/Library-POC/blob/master/2023HW/2023.8.15/%E6%96%B0%E5%BC%80%E6%99%AE%E5%89%8D%E7%BD%AE%E6%9C%8D%E5%8A%A1%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0service.action%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.py
• https://cn-sec.com/archives/2254476.html
• https://www.sxcast.edu.cn/uploadfile/ueditor/file/202510/1761869308d5a4ea.pdf
• https://ddpoc.com/DVB-2024-7929.html
• https://jiwo.org/ken/detail.php?id=3329

Related Vulnerabilities

• 新开普掌上校园服务管理平台任意文件读取漏洞
• 新开普掌上校园服务管理平台 /invoke.action 远程代码执行漏洞