Skip to main content

百度笑传之虫虫bug省流：百度云本地监听10000端口提供网页拉起客户端服务，OpenSafeBox接口直接把传入内容作为参数传给netdisk.exe，直接参数注入拿到远程任意代码执行sounds familiar（百度android sdk 15年worm hole）scenes like this are happening all over the galaxy right now（WPS命令注入）

  1. 百度笑传之虫虫bug
    省流：百度云本地监听10000端口提供网页拉起客户端服务，OpenSafeBox接口直接把传入内容作为参数传给netdisk.exe，直接参数注入拿到远程任意代码执行
    sounds familiar（百度android sdk 15年worm hole）
    scenes like this are happening all over the galaxy right now（WPS命令注入）
    Welivesecurity
    Analysis of two arbitrary code execution vulnerabilities affecting WPS Office
    ESET research uncovers a vulnerability in WPS Office for Windows (CVE-2024-7262), as it was being exploited by South Korea-aligned cyberespionage group APT-C-60 to target East Asian countries. Analysis of the vendor’s silently released patch led to the discovery…
OKHK