脸爱云一脸通智慧管理平台 /SystemMng.ashx operatorRole参数权限绕过漏洞

2023-11-18 脸爱云一脸通智慧管理平台 PoC No

Description

Shenzhen Youkate Industrial Facial Love Cloud Payment System是中国深圳市优卡特实业有限公司（Shenzhen Youkate Industrial）公司的一个人脸爱心云支付系统。 Shenzhen Youkate Industrial Facial Love Cloud Payment System 1.0.55.0.0.1及之前版本存在安全漏洞，该漏洞源于文件/SystemMng.ashx参数operatorRole存在权限管理不当问题。

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

https://cn-sec.com/archives/2386231.html
https://github.com/AboSteam/POPC/blob/main/%E8%84%B8%E7%88%B1%E4%BA%91%20%E4%B8%80%E8%84%B8%E9%80%9A%E6%99%BA%E6%85%A7%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E6%B7%BB%E5%8A%A0%E6%BC%8F%E6%B4%9E.md
https://avd.aliyun.com/detail?id=AVD-2023-6099
https://cn-sec.com/archives/2228533.html
https://www.ddpoc.com/DVB-2023-5542.html
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E8%84%B8%E7%88%B1%E4%BA%91%E4%B8%80%E8%84%B8%E9%80%9A%E6%99%BA%E6%85%A7%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0/%E8%84%B8%E7%88%B1%E4%BA%91%20%E4%B8%80%E8%84%B8%E9%80%9A%E6%99%BA%E6%85%A7%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E6%B7%BB%E5%8A%A0%E6%BC%8F%E6%B4%9E.md
https://stack.chaitin.com/poc/detail/4273
https://cve.imfht.com/detail/CVE-2023-6099?lang=en
https://github.com/yujiangxian/pocwiki/blob/main/%E8%84%B8%E7%88%B1%E4%BA%91/%E8%84%B8%E7%88%B1%E4%BA%91%E4%B8%80%E8%84%B8%E9%80%9A%E6%99%BA%E6%85%A7%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0SystemMng%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E6%B7%BB%E5%8A%A0%E6%BC%8F%E6%B4%9E.md

Description

PoC

References

Related Vulnerabilities