'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

vul_app:smartbi_api_engineaddress_permission_bypass_vulnerability（Rule ID：1070210451）

Release Date：2025/9/15

Rule Name：Smartbi API EngineAddress Permission bypass Vulnerability

Severity：critical

CVE ID：

 

Descripiton：

Smartbi is an enterprise-level BI and big data analysis brand, meeting users' big data analysis needs in enterprise-level reports, data visualization analysis, self-service analysis platform, data mining modeling, AI intelligent analysis and other big data analysis needs. An unauthorized remote attacker could exploit the vulnerability to obtain an administrator Token, which could take over the background with administrator rights and further exploit it for arbitrary code execution. This rule supports to defend the A6: Vulnerable and Outdated Components of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.