通達OA一些漏洞點
阿新 • • 發佈:2020-11-13
TongDa-OA
SQLi path
2013-2017
http[s]://TongDaOA.domain/module/crm2010/imageOperation/deleteImage.php http[s]://TongDaOA.domain/module/crm2010/product/type_tree.php http[s]://TongDaOA.domain/module/crm2010/select/getData.php http[s]://TongDaOA.domain/module/crm2010/select/getValue.php http[s]://TongDaOA.domain/module/crm2010/select/index.php http[s]://TongDaOA.domain/module/crm2010/share/update.php http[s]://TongDaOA.domain/portal/webportals/source/oa/news.php http[s]://TongDaOA.domain/portal/webportals/source/oa/notify.php?LOGIN_USER_ID= http[s]://TongDaOA.domain/task/crm/account_care_remind.php http[s]://TongDaOA.domain/task/crm/action_link_remind.php http[s]://TongDaOA.domain/task/crm/contract_birthday_remind.php http[s]://TongDaOA.domain/task/crm/contract_near_remind.php http[s]://TongDaOA.domain/task/crm/contract_remind.php http[s]://TongDaOA.domain/task/crm/crm_account_contact_bir_remind.php http[s]://TongDaOA.domain/task/crm/crm_complain_remind.php http[s]://TongDaOA.domain/task/crm/crm_opportunity_status_remind.php http[s]://TongDaOA.domain/task/crm/crm_salepay_remind.php http[s]://TongDaOA.domain/task/crm/crm_stockout_remind.php http[s]://TongDaOA.domain/task/crm/marketing_near_remind.php http[s]://TongDaOA.domain/task/crm/order_to_stockout_remind.php http[s]://TongDaOA.domain/task/crm/payment_near_remind.php http[s]://TongDaOA.domain/task/crm/storage_near_remind.php http[s]://TongDaOA.domain/ispirit/myoa.php http[s]://TongDaOA.domain/ispirit/retrieve_pwd.php
v11~V11.6 【0DAY】
http[s]://TongDaOA.domain/general/approve_center/list/roll_config.inc.php http[s]://TongDaOA.domain/general/bi_design/reportshop/report_bi.func.php http[s]://TongDaOA.domain/general/data_center/console/autocode/autocode.php http[s]://TongDaOA.domain/general/data_center/model_design/console/autocode/autocode.php http[s]://TongDaOA.domain/general/data_center/model_design/design/report/action.php http[s]://TongDaOA.domain/general/reportshop/design/report/action.php http[s]://TongDaOA.domain/general/project/portal/details/budget/table.php http[s]://TongDaOA.domain/general/reportshop/design/report/console/autocode/autocode.php http[s]://TongDaOA.domain/general/reportshop/workshop/report/attachment-remark/form3.php http[s]://TongDaOA.domain/general/system/user/get_key_user_info.php http[s]://TongDaOA.domain/general/workflow/list/roll_config.inc.php http[s]://TongDaOA.domain/interface/GetNewAPP.php http[s]://TongDaOA.domain/interface/GetNewAPP1.php http[s]://TongDaOA.domain/general/workflow/plugin/turn/kd_k3_applly/kd_k3_applly.php http[s]://TongDaOA.domain/general/workflow/document_list/roll_config.inc.php
通達OA TIPS:
http[s]://TongDaOA.domain/inc/expired.php 判斷通達版本
http[s]://TongDaOA.domain/inc/reg_trial.php
http[s]://TongDaOA.domain/inc/reg_trial_submit.php
http[s]://TongDaOA.domain/ispirit/retrieve_pwd.php
GET 引數username、email 可爆使用者、郵箱
http[s]://TongDaOA.domain/resque/worker.php 計算機名
RCE
V11.6
http[s]://TongDaOA.domain/module/appbuilder/assets/print.php 任意檔案刪除
Enjoy yourself,Blue Team.