'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

inject_code:freemarker_ssti（Rule ID：1020810048）

Release Date：2025/9/29

Rule Name：FreeMarker Server Side Template Injection

Severity：critical

CVE ID：

 

Descripiton：

Template injection is an attack method in which attackers inserts malicious code into template engine of an application. When the template is rendered, the malicious code is executed, which may lead to serious hazards such as information leakage,code execution and server control. This rule detects the injection behavior for FreeMarker template engine. This rule supports to defend the A3: Injection of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.