'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

infoleak_dircont:graphql_schema_exposure（Rule ID：1040210004）

Release Date：2026/6/15

Rule Name：GraphQL/GraphiQL Schema File Exposure

Severity：high

CVE ID：

 

Descripiton：

Sensitive information is a kind of information that is not known by the public and has actual or potential value. Loss, misuse or unauthorized access to sensitive information may do harm to individuals, enterprises and even the society. GraphQL is a query language for APIs and a runtime for executing those queries. GraphiQL is an interactive in-browser GraphQL IDE. When the schema.json file is exposed to untrusted users, attackers can obtain the complete GraphQL schema, including all types, queries, mutations, and subscriptions. This information can be used to discover hidden API endpoints and craft targeted attacks. This rule supports to defend the A2: Cryptgraphic Failures of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.