金蝶云星空存在远程命令执行漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.gksec.com/K3cloud_rce.html
• https://www.cnblogs.com/fuchangjiang/p/17678986.html
• https://zhuanlan.zhihu.com/p/644669676
• https://bbs.chaitin.cn/topic/540
• https://cloud.tencent.com/developer/article/2353930
• https://github.com/zan8in/pocwiki/blob/main/%E9%87%91%E8%9D%B6%E6%98%9F%E7%A9%BA%E4%BA%91K3Cloud%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E.md
• https://developer.aliyun.com/article/1333681
• https://www.secrss.com/articles/55737
• https://it.shanghaitech.edu.cn/2024/0409/c8406a1093717/page.htm
• https://jiwo.org/ken/detail.php?id=3314
• https://bbs.huaweicloud.com/blogs/420087
• https://www.lmboke.com/archives/jin-die-yun-xing-kong-fan-xu-lie-hua-yuan-cheng-dai-ma-zhi-xing-lou-dong
• https://qkl.seebug.org/vuldb/ssvid-99706
• https://www.cnblogs.com/Domren/articles/18735535
• https://github.com/MzzdToT/Kingdee_erp_Unserialize_rce
• https://www.cnblogs.com/ayoung/p/18551988

Related Vulnerabilities

• 金蝶云星空 /Kingdee.BOS.WebApi.ServicesStub.AuthService.ValidateLoginInfo.common.kdsvc 命令执行漏洞
• PoCjindie-yunxingkong-dynamicformservice-rce: 金蝶云星空DynamicFormService.CloseForm.common.kdsvc远程代码执行漏洞
• PoCkindee-scpsupreghandler-fileupload: 金蝶云星空ScpSupRegHandler任意文件上传
• PoCkingdee-cloud-user-deserialization-rce: 金蝶云星空 UserService 反序列化远程代码执行
• PoCkingdee-commonfileserver-fileread: 金蝶云星空 CommonFileserver 任意文件读取漏洞
• PoCkingdee-deserialization-rce: 金蝶云星空反序列化rce
• 金蝶云星空 /Kingdee.BOS.ServiceFacade.ServicesStub.InOutDataService.GetImportOutData.common.kdsvc 命令执行漏洞
• 金蝶云星空 BusinessDataService.BatchLoad.common.kdsvc 远程代码执行漏洞
• PoC金蝶云星空 /Kingdee.BOS.ServiceFacade.ServicesStub.AppDesigner.AppDesignerService.RecordCurDevCodeInfo.common.kdsvc 命令执行漏洞
• 金蝶云星空 /kingdee.BOS.ServiceFacade.ServicesStub.BusinessData.BusinessDataService.BatchLoad.common.kdsvc 代码执行漏洞