Penetration caused by improper configuration of an internal Haier Platform

Penetration caused by improper configuration of an internal Haier Platform

Haier http://www.haierpeople.cn

Haier's internal sns community, there are still a lot of sections, using near cms, only allow haier email registration, js verification.

Registered accounts, xss management, and incomplete Cookies cannot be accessed.

Re-register the account, modify the selectrole parameter, and super Administrator (this is a criticism)

Enter the background.

Upload the skin, compress shell and Emotions. xml into a zip file, and decompress the file. shell path:/images/Emotions/xxxx/test. aspx

 

 

Is it Intranet roaming in Haier?