漏洞名称：海康威视部分iVMS系统存在文件上传漏洞

English Name：Some Hikvision iVMS file upload vulnerabilitie

CVSS core: 9.8

影响资产数：15294

漏洞描述：

海康威视-iVMS综合安防管理平台是一套“集成化”、“数字化”、“智能化”的平台，包含视频、报警、门禁、访客、梯控、巡查、考勤、消费、停车场、可视对讲等多个子系统。攻击者通过获取密钥任意构造token，请求某个接口任意上传文件，导致获取服务器webshell权限，同时可远程进行恶意代码执行。

漏洞影响：

FOFA查询语句（点击直接查看结果）：

(body=“class=“enname”>iVMS-4200” && body=“laRemPassword”) || (body=“home/locationIndex.action?time=” && body=“result.data.indexUrl;”) || (body=“//caoshiyan modify 2015-06-30 中转页面” && body=“/home/locationIndex.action?time=” || body=“home/licenseUpload.action”) || (body=“class=“out”><a href=“download/iVMS-”) || ((body=“tab-border code-iivms”>” || body=“login?service=” || body=“/eop/common/css/reset.css” || header=“/cms/web/gateway/”|| body=“/cms/web/gateway/” || header=“/login?service=” || title=“iVMS”) && header=“Server: If you want know, you can ask me” && header!=“404 Not Found”) || (body=“var uuid = “2b73083e-9b29-4005-a123-1d4ec47a36d5”; // 用于检测VMS是否超时, chenliangyf1”) || (body=“/cas/login” && body=“js/login/login.service.js”) || (body=“daysOflicenseDatedWarn” && body=“/cas/login”) || (body=“/ivms-ui/default/css/login.css”) || (server=“Apache-Coyote/1.1” && body=“/baseui/js/plugins/ui/jquery.placeholder.js”) || (body=“/cas/static/js/jquery.placeholder.js”) || (body=“IVMS.files/logo.gif”) || (body=“license!getExpireDateOfDays.action” && body=" window.document.location = ‘/license!getExpireDateOfDays.action’;“) || (body=“iVMS-A100” && title=“登录”) || (body=”/error/browser.do" && body=“/portal” && body=“settings.skinStyle” && (body=“src=”/portal/common/js/commonVar.js" || body=“nginxService/v1/download/InstallRootCert.exe”))