当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0108918

漏洞标题:天图迅联某站getshell

相关厂商:天图迅联

漏洞作者: 路人甲

提交时间:2015-04-23 17:09

修复时间:2015-06-07 17:10

公开时间:2015-06-07 17:10

漏洞类型:命令执行

危害等级:中

自评Rank:10

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-04-23: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-06-07: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

天图迅联,我也是西安的,求份工作哇~

详细说明:

站点存在Struts2命令执行
网址:http://my.tantuls.com/jsp/init.action

1.png

漏洞证明:

#------------ JDBC ------------
jdbc.driver=com.mysql.jdbc.Driver
jdbc.url==mysql://127.0.0.1:3306/myland?true&characterEncoding=UTF-8
jdbc.username=root
jdbc.password=#o9L73(JKleP
#------------ ConnectionPools ------------
connection_pools.initial_pool_size=5
connection_pools.min_pool_size=5
connection_pools.max_pool_size=10
connection_pools.max_idle_time=60
connection_pools.acquire_increment=5
connection_pools.checkout_timeout=60000


#file temp dir
file.temp.dir=d:/upload
file.local.temp.dir=d:/upload
#tantuls request domain url
system.domain.url=http://my.tantuls.com/tantulsV1
#file server upload url
file.server.upload.url=http://219.153.20.229:8180/upload/upload.action
#file server delete url
file.server.delete.url=http://219.153.20.229:8180/upload/delete.action
#file root path
file.server.path.root=tantuls/
#file max size <=3M
file.size.limit.max=3M
# camera's user for view manager role's id
camera.role.manager.id=10
# camera's user for view camera role's id
camera.role.view.id=11
#default user role id,user registered ,then he will get this role;
user.role.id.default=12
#send email
mail.port=smtp
mail.host=smtp.exmail.qq.com
[email protected]
[email protected]
mail.account.from.login.password=123321qQ
#send sms
sms.ihuyi.account=cf_cgkj
sms.ihuyi.password=20D1D5E7043D57BDCBA6DD0598FC80C3
sms.ihuyi.url=http://106.ihuyi.cn/webservice/sms.php?method=Submit
#find pwd
pwd.email.returnurl=/user/emailReturn
# system Id
user.system.id=1
# apk version
apk.android.version=2
apk.ios.version=1
# apk downLoad url
apk.downLoad.url=http://127.0.0.1:80/tantulsV1/interface/apkDownLoad/downLoad
#apk file
apk.file=d:/tantuls.apk

修复方案:

补丁+配置

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝