'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

vul_frame:struts_includeparams（Rule ID：1070110011）

Release Date：2025/9/15

Rule Name：CVE-2013-1966: Apache Struts includeParams Remote Code Execution(and CVE-2013-2115)

Severity：critical

CVE ID：CVE-2013-1966 CVE-2013-2115

 

Descripiton：

Apache Struts 2 is an open-source Web application framework for developing Java EE Web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller (MVC) architecture. URL and the Anchor Tag in Apache Struts 2.0.0 through 2.3.14.1 privede an includeparams attribute. The allowed values of includeParams are none, get and all. Struts will treat input parameters as OGNL expression if the value of includeParams is get or all, which allows attackers to set allowStaticMethodAccess property of memberAccess component and execute arbitrary Java code. The MemberAccess component's allowStaticMethodAccess property is already immutable. Refer to https://struts.apache.org/docs/s2-014.html. This rule supports to defend the A6: Vulnerable and Outdated Components of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.