Description
I Doc View存在远程代码执行漏洞，此漏洞是由于cmd.json接口对用户请求的cmd的值验证不当导致的。
I Doc View cmd.json远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://blog.csdn.net/xiayu729100940/article/details/135068973
https://developer.baidu.com/article/details/2857269
https://cloud.tencent.com/developer/article/2376094
https://www.secrss.com/articles/60990?app=1
https://www.h3c.com/cn/d_202312/1978829_30003_0.htm
https://www.aqtd.com/nd.jsp?id=5408
https://www.wangsu.com/news/content/blog/3618
http://www.bmth666.cn/2023/12/15/I-Doc-View%E5%9C%A8%E7%BA%BF%E6%96%87%E6%A1%A3%E9%A2%84%E8%A7%88-%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/index.html
https://github.com/adysec/POC/blob/main/wpoc/iDocView/I%20Doc%20View%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
https://cn-sec.com/archives/3831191.html
https://gryffinbit.top/2023/12/05/%E6%9C%A8%E9%A9%AC%E3%80%81%E5%8F%8D%E5%BC%B9shell-%E5%90%88%E9%9B%86/
https://update.nsfocusglobal.com/update/listNewipsDetail/v/rule5.6.11
https://117.73.22.80/services/ips/3_0_191.html
https://y4tacker.github.io/2023/11/22/year/2023/11/I%20Doc%20View%E5%85%A8%E7%89%88%E6%9C%AC%E5%89%8D%E5%8F%B0RCE%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E6%B1%87%E6%80%BB/